@herbertgao/pi-extensions 2026.8.6 → 2026.8.7

package/node_modules/pi-lens/dist/clients/lsp/index.js

@@ -7,7 +7,7 @@
  * - Bus event integration
  * - Resource cleanup
  */
-import { createHash } from "node:crypto";
+import { CASCADE_DIAGNOSTICS_TTL_MS } from "../cascade-types.js";
 import * as nodeFs from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -16,25 +16,30 @@ import { getProjectIgnoreMatcher, isExcludedDirName, } from "../file-utils.js";
 import { recordLsp } from "../widget-state.js";
 import { applyAuxiliarySuppressions } from "../dispatch/auxiliary-lsp.js";
 import { detectFileRole } from "../file-role.js";
+import { emitBounded } from "../bounded-telemetry.js";
 import { logLatency } from "../latency-logger.js";
 import { logSessionStart } from "../sessionstart-logger.js";
 import { incrementDegradationCount, recordDegradation, recordDegradationOnce, } from "../degradation-ledger.js";
 import { isLspSpawnAllowedByTrust, assertInstallAllowed, projectTrustDenialReason, } from "../project-trust.js";
 import { shouldPreferPullOnlyDiagnostics } from "../lsp-budget.js";
-import { withDeadline } from "../deadline-utils.js";
+import { withDeadline, withTimeout } from "../deadline-utils.js";
+import { acquireWorkspaceSweepHold, clearWorkspaceSweepHoldForSessionStart, } from "./workspace-sweep-hold.js";
+import { DocumentDriftTracker, fingerprintDocumentContent, } from "./document-drift.js";
 import { isAtOrAboveHomeDir, isWindowsPath, normalizeMapKey, uriToPath, } from "../path-utils.js";
 import { recordLspMutation, } from "../lsp-mutation.js";
 import { createLSPClient } from "./client.js";
-import { bindingStateLabel, composeBoundToCurrentDisk, createDiskBindingCache, touchCoverageGap, } from "./diagnostic-binding.js";
+import { auxiliaryCoverageGap, bindingStateLabel, composeBoundToCurrentDisk, createDiskBindingCache, hashDiagnosticContent, resolveTouchVerdict, touchCoverageGap, } from "./diagnostic-binding.js";
 import { getServersForFileWithConfig, getServerInitOverride } from "./config.js";
 import { getLanguageId } from "./language.js";
-import { LSP_SERVERS, enforceLspRootCeiling, hasProjectBoundaryMarker, isDirectLspCommandTemporarilyUnavailable, } from "./server.js";
+import { LSP_SERVERS, enforceLspRootCeiling, hasProjectBoundaryMarker, isDirectLspCommandTemporarilyUnavailable, resetClassicTsRepairGuard, } from "./server.js";
 import { classifyCascadeWaitTier, classifyServerWaitTier, getStrategy, } from "./wait-policy/index.js";
+const WORKSPACE_ATTRIBUTION_CLIENT_CAP = 16;
 import { raceToCompletion } from "./aggregation.js";
 import { applyWorkspaceEdit, mergeWorkspaceTextEditsByPriority, summarizeWorkspaceEdit, validateWorkspaceEdit, } from "./edits.js";
 import { buildScopeKey, createWorkspaceDiagnosticsCacheContext, } from "./workspace-diagnostics-cache.js";
 import { attemptTsserverSyncDiagnostics, } from "./tsserver-sync.js";
 import { isWarmAttached, tryWarmAttachedDiagnostics, } from "../warm-attach.js";
+import { getSuccessfulLspSpawnDurationMs, recordSuccessfulLspSpawn, } from "./spawn-history.js";
 function destinationUriPreservingSpelling(oldUri, oldFilePath, newFilePath) {
     const canonical = pathToFileURL(newFilePath);
     try {
@@ -160,6 +165,34 @@ const NAV_CLIENT_WAIT_TIMEOUT_MS = Math.max(0, Number.parseInt(process.env.PI_LE
     1500);
 const TOUCH_DEBOUNCE_MS = Math.max(0, Number.parseInt(process.env.PI_LENS_LSP_TOUCH_DEBOUNCE_MS ?? "1500", 10) ||
     1500);
+// #1621: the rename-propagation notifies (`didClose` ahead of the rename,
+// `workspace/didRenameFiles` after) share the exit-notify defect #1620 fixed —
+// a notify write on a pipe that is not draining neither resolves nor rejects,
+// so the bare `await` was unbounded. Rename propagation is best-effort advice
+// to servers, not a correctness gate, so a wedged client's notify gets its own
+// ceiling and a recorded disposition rather than stalling the `Promise.all`
+// for every healthy client alongside it.
+// #1621 F3: floor at 50ms, not 0 — a negative env value (e.g. "-100") is
+// truthy after `Number.parseInt`, so it survives the `|| 1500` fallback and
+// would otherwise reach `withDeadline`'s `ms <= 0` branch. That branch treats
+// the budget as already expired and settles without ever really attempting
+// the notify — a negative override would silently disable rename propagation
+// instead of merely shortening its budget.
+const RENAME_NOTIFY_TIMEOUT_MS = Math.max(50, Number.parseInt(process.env.PI_LENS_LSP_RENAME_NOTIFY_TIMEOUT_MS ?? "1500", 10) || 1500);
+async function runRenameNotify(send, timeoutMs) {
+    try {
+        await withTimeout(send(), timeoutMs);
+        return { ok: true };
+    }
+    catch (err) {
+        const timedOut = err instanceof Error && err.message.startsWith("Timeout after");
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+            disposition: timedOut ? "timedOut" : "rejected",
+        };
+    }
+}
 const DEFAULT_LSP_CLIENT_CEILING = 24;
 const DEFAULT_TS_IDLE_EVICT_MS = 20 * 60_000;
 export function getTypeScriptIdleEvictMs() {
@@ -181,6 +214,24 @@ export function getLspClientCeiling() {
 // project load/index before it can usefully answer ANY diagnostics request,
 // not just one file's worth of work. Env-tunable like every other wait budget
 // in this file.
+/**
+ * #1783: does this client hold the document open? Tolerates a client that does
+ * not implement `isDocumentOpen` (a test double, or a future client shape) by
+ * answering "no" — the drift backstop then drops the record rather than
+ * resyncing a view it cannot confirm exists.
+ */
+function documentIsOpenOn(client, filePath) {
+    const probe = client
+        .isDocumentOpen;
+    if (typeof probe !== "function")
+        return false;
+    try {
+        return probe.call(client, filePath) === true;
+    }
+    catch {
+        return false;
+    }
+}
 function warmupTimeoutMs() {
     const raw = Number.parseInt(process.env.PI_LENS_LSP_WARMUP_TIMEOUT_MS ?? "", 10);
     return Number.isFinite(raw) && raw > 0 ? raw : 20_000;
@@ -254,7 +305,6 @@ const DIAGNOSTICS_SEMANTIC_SETTLE_WAIT_MS = Math.max(0, Number.parseInt(process.
 // Once the fastest client has diagnostics, remaining clients get this window before
 // we proceed with whatever results are ready. 0 disables early-unblock.
 const EARLY_UNBLOCK_GRACE_MS = Math.max(0, Number.parseInt(process.env.PI_LENS_LSP_EARLY_UNBLOCK_GRACE_MS ?? "400", 10) || 400);
-const CASCADE_DIAGNOSTICS_TTL_MS = 240_000;
 function mergeLspDiagnostics(diagnostics) {
     const merged = [];
     const seen = new Set();
@@ -399,6 +449,40 @@ function notifyWriteBudgetMs() {
     const raw = Number(process.env.PI_LENS_LSP_NOTIFY_BUDGET_MS);
     return Number.isFinite(raw) && raw > 0 ? raw : 2000;
 }
+// #1459: how long ONE auxiliary notify write may stay outstanding before the
+// server counts as wedged rather than merely slow. A scanner whose per-file work
+// exceeds the write budget is normal (opengrep routinely needs >2s on a large
+// file) and must not be demoted for it — the gate defers the next write instead.
+// A write still unaccepted after this window is a different animal: nothing is
+// draining that stdin, so the server is demoted through the existing breaker.
+// Expressed as a multiple of the write budget so tuning one moves both.
+const NOTIFY_WEDGED_BUDGET_MULTIPLIER = 5;
+function notifyWedgedMs() {
+    return notifyWriteBudgetMs() * NOTIFY_WEDGED_BUDGET_MULTIPLIER;
+}
+// #1714: how many document notifies one auxiliary may hold UNACKNOWLEDGED
+// before the next notify has to prove the server drained its input.
+//
+// #1459's gate bounds CONCURRENT writes to one per auxiliary. That stops a
+// simultaneous fan-out, but a `lens_diagnostics mode=full` sweep is mostly
+// SEQUENTIAL — one file after another inside a server group (#387) — so every
+// write is alone in flight and the gate never engages. Each write still resolves
+// as soon as the pipe accepts the bytes, not when the scanner has read them, so
+// the sweep can hand a single-threaded scanner hundreds of full re-parses faster
+// than it consumes them. ast-grep stalled and had to be force-killed twice in
+// two full-scan exposures. Counting unacknowledged notifies bounds the BACKLOG
+// the sweep is allowed to build, which pipe-level backpressure alone does not.
+const AUX_NOTIFY_INFLIGHT_DEFAULT = 8;
+function auxNotifyInflightLimit(info) {
+    const perServer = info.notifyInflightLimit;
+    if (typeof perServer === "number" && Number.isFinite(perServer) && perServer > 0) {
+        return Math.floor(perServer);
+    }
+    const raw = Number(process.env.PI_LENS_LSP_AUX_NOTIFY_INFLIGHT);
+    return Number.isFinite(raw) && raw > 0
+        ? Math.floor(raw)
+        : AUX_NOTIFY_INFLIGHT_DEFAULT;
+}
 // Budget for one project-wide `workspace/diagnostic` pull (#387 Item 2). Larger
 // than a per-file wait — it's a single request but scans the whole program —
 // yet bounded so a hung server still falls back to the per-file path.
@@ -547,6 +631,13 @@ export class LSPService {
      * those falls through to a fresh check rather than serving a stale result.
      */
     lastKnownContentHash = new Map();
+    /**
+     * #1783: what content actually landed on a language server, per document.
+     * The drift sweep compares disk (size, mtime) against these records and
+     * resynchronizes anything an untracked edit moved behind the server's back.
+     * See `document-drift.ts` for the key design and the pacing rules.
+     */
+    documentDrift = new DocumentDriftTracker();
     /**
      * #1095: lazily verifies a stored {@link DiagnosticBinding} against current
      * disk bytes, memoizing the disk fingerprint per (file, mtime) so repeated
@@ -577,6 +668,42 @@ export class LSPService {
      * successful write clears its entry.
      */
     notifyWriteBackpressureStreak = new Map();
+    /**
+     * #1714: unacknowledged auxiliary document notifies per server key
+     * ("serverId:normalizedRoot" — the same identity as every other gate here).
+     *
+     * `unacked` counts notifies ISSUED to this client that the server has not yet
+     * been proven to have PROCESSED. It rises with each write the sweep hands over
+     * and falls only when a drain barrier round-trips (see {@link paceAuxNotify}).
+     * `drain` holds the one in-flight barrier so a burst shares a single
+     * round-trip instead of each touch sending its own.
+     *
+     * `gateOpen` is the fail-open latch. A scanner that will not answer the
+     * barrier inside the caller's budget has stopped being a pacing problem and
+     * become a stall, which #743's write deadline, streak and wedge timer already
+     * own — and they own it by DEMOTING and respawning, which pacing can never do.
+     * Once latched, this gate steps aside for the rest of the client's life and
+     * every notify takes the pre-#1714 path. It re-arms on the only event that
+     * means the stall is over: a new client generation, which gets a new record.
+     *
+     * Cleared wholesale by the service teardown (`session_start` runs through it),
+     * by {@link demoteForNotifyStall}, and per key whenever the client identity
+     * changes, so no count can outlive the client it describes.
+     */
+    auxNotifyInflight = new Map();
+    /**
+     * #1459: the ONE outstanding auxiliary notify write per server key
+     * ("serverId:normalizedRoot"). A `reopenOnResync` scanner re-parses the whole
+     * file on every `didOpen`, so a `clientScope: "all"` sweep that fans out
+     * across a neighbour set pushes N full re-scans at it inside a few
+     * milliseconds; its stdin stops draining and the #743 write deadline expires
+     * for each one, which walked the breaker open in three touches. The gate keeps
+     * a sweep to one in-flight resync per auxiliary: while one is outstanding the
+     * next touch DEFERS its write and reports the server as uncovered instead of
+     * adding to the flood. `startedAt` dates the outstanding write so a write that
+     * never lands is still demoted (see {@link demoteForNotifyStall}).
+     */
+    outstandingAuxNotifyWrites = new Map();
     /** LRU clock for capacity eviction, keyed by the canonical server/root key. */
     clientLastUsedAt = new Map();
     /**
@@ -946,6 +1073,22 @@ export class LSPService {
             return;
         }
         this.notifyWriteBackpressureStreak.delete(key);
+        this.demoteForNotifyStall(key, entry, filePath, {
+            consecutiveTimeouts: NOTIFY_BACKPRESSURE_BROKEN_AFTER,
+        });
+    }
+    /**
+     * The demotion itself, shared by the #743 consecutive-timeout streak and the
+     * #1459 wedged-write rule. Both mean the same thing — this client's input path
+     * is not moving — and both need the same teardown.
+     */
+    demoteForNotifyStall(key, entry, filePath, reason) {
+        this.notifyWriteBackpressureStreak.delete(key);
+        this.outstandingAuxNotifyWrites.delete(key);
+        // #1714: the demoted client is torn down, so its backlog count describes a
+        // process that no longer exists. Leaving it would make the replacement start
+        // at the ceiling and pay a barrier on its first file.
+        this.auxNotifyInflight.delete(key);
         this.state.broken.set(key, Date.now() + BROKEN_BASE_COOLDOWN_MS);
         void entry.client.shutdown().catch(() => { });
         this.state.clients.delete(key);
@@ -961,10 +1104,432 @@ export class LSPService {
             metadata: {
                 serverId: entry.info.id,
                 cooldownMs: BROKEN_BASE_COOLDOWN_MS,
-                consecutiveTimeouts: NOTIFY_BACKPRESSURE_BROKEN_AFTER,
+                ...reason,
+            },
+        });
+    }
+    /**
+     * #1459: the caller's write deadline is a LATENCY bound, not a health verdict.
+     * A scanner whose `didOpen` lands a second after we stopped waiting is slow,
+     * not broken, so its late success retracts the timeout it was charged for.
+     * Without this, three slow-but-healthy scans in a row opened the breaker and
+     * blacked out the security lane for 15 s.
+     */
+    retractNotifyWriteBackpressure(key, serverId, filePath, outstandingMs, client) {
+        // Generation-checked, exactly like the gate: a predecessor's late landing
+        // must not decrement its SUCCESSOR's streak and mask a real stall.
+        if (this.state.clients.get(key) !== client)
+            return;
+        const streak = this.notifyWriteBackpressureStreak.get(key);
+        if (!streak)
+            return;
+        const streakAfter = streak - 1;
+        if (streakAfter <= 0)
+            this.notifyWriteBackpressureStreak.delete(key);
+        else
+            this.notifyWriteBackpressureStreak.set(key, streakAfter);
+        logLatency({
+            type: "phase",
+            phase: "lsp_notify_write_late_landed",
+            filePath: normalizeMapKey(filePath),
+            durationMs: outstandingMs,
+            metadata: { serverId, outstandingMs, streakAfter },
+        });
+    }
+    /**
+     * #1714: record that one more document notify went to this auxiliary.
+     *
+     * Counted at ISSUE time, not on the write's settle: the backlog the sweep
+     * builds is what the server still has to read, and a write that has not landed
+     * yet is part of it. A client-identity change resets the count, because a
+     * respawned server carries none of its predecessor's backlog.
+     */
+    noteAuxNotifyIssued(key, client) {
+        const record = this.auxNotifyInflight.get(key);
+        if (record && record.client === client) {
+            record.unacked += 1;
+            return;
+        }
+        this.auxNotifyInflight.set(key, { client, unacked: 1 });
+    }
+    /**
+     * #1714: is this auxiliary already holding as many documents as it may?
+     *
+     * Read by the sweep's PRE-OPEN pass, which writes `didOpen` directly instead
+     * of going through `touchFile` and so meets neither the #1459 slot gate nor
+     * the drain barrier. Pre-opening is explicitly best-effort — the file's own
+     * `touchFile` opens it a moment later, through the barrier — so a backlogged
+     * scanner is simply left out of the warm-up burst rather than handed a second
+     * copy of every file in the chunk.
+     */
+    auxNotifyBacklogAtCeiling(key, entry) {
+        const record = this.auxNotifyInflight.get(key);
+        if (!record || record.client !== entry.client)
+            return false;
+        // Latched open: this scanner is a stall, not a pacing problem, and the
+        // breaker owns it. Step aside here too rather than half-throttling it.
+        if (record.gateOpen)
+            return false;
+        return record.unacked >= auxNotifyInflightLimit(entry.info);
+    }
+    /**
+     * #1714: hold the next notify until this auxiliary has proven it PROCESSED the
+     * ones already sent. Returns when the caller may write — it never refuses.
+     *
+     * Under the limit there is nothing to prove, so the common case returns without
+     * awaiting anything and the sweep runs at full speed. At the limit the gate
+     * sends ONE request round-trip (`pingLiveness`, #1277,
+     * clients/lsp/client.ts:2577).
+     *
+     * WHY A REPLY PROVES PROCESSING, measured rather than assumed. ast-grep-lsp is
+     * tower-lsp-server and drains its message stream in order on one task, so a
+     * request written after N `didOpen`s is answered after those N are scanned.
+     * Live probe against the real binary, 30 real repository files:
+     *
+     *   idle `workspace/symbol` reply        0 ms
+     *   after 30 didOpens                 2263 ms, 29 of 30 publishes already in
+     *   all 30 processed                  2330 ms
+     *
+     *   idle `textDocument/hover` reply      1 ms
+     *   after 30 didOpens                 2086 ms, 29 of 30 publishes already in
+     *
+     * Idle-zero to loaded-seconds, landing within one document of the whole
+     * backlog, is the ordering property this gate needs; one document of slack is
+     * immaterial against a ceiling of 4 to 8.
+     *
+     * A server that answered requests off a SEPARATE task would not give this
+     * proof. What keeps that server safe is NOT the fail-open latch below: the
+     * latch never arms for it. Such a server answers the barrier instantly,
+     * `unacked` resets, and the gate stays inert for the whole sweep. Safety comes
+     * from the outcome that inertness produces — the notify sequence is exactly
+     * the pre-#1714 one, and #743's write deadline, backpressure streak and wedge
+     * timer own the stall the same way they did before this change. The throttle
+     * buys such a server nothing; it also costs it nothing.
+     *
+     * The wait is bounded by the CALLER's remaining budget, never by a schedule of
+     * its own: every waiter gives the shared round-trip only `waitMs`, so a caller
+     * that asked for a 1 s touch still gets one.
+     *
+     * A waiter whose budget runs out does NOT defer the file. It latches the gate
+     * open and falls through to the write. Pacing exists to stop a healthy-but-slow
+     * scanner drowning; a scanner that will not answer at all is a stall, and #743's
+     * write deadline, backpressure streak and wedge timer already own that case —
+     * they demote and respawn it, which is the self-heal that recovered the live
+     * session. Deferring instead withheld the write, accrued no strike, and left
+     * the sweep with no exit.
+     *
+     * Fails OPEN for a client with no liveness round-trip: unmeasurable is not the
+     * same as backlogged, and the codebase already reads this capability as
+     * `pingLiveness?.() ?? true` (clients/lsp/client.ts:281). Every real client
+     * provides it.
+     */
+    async paceAuxNotify(key, entry, filePath, waitMs, context) {
+        const record = this.auxNotifyInflight.get(key);
+        if (!record)
+            return;
+        if (record.client !== entry.client) {
+            // A previous generation's backlog says nothing about this client.
+            this.auxNotifyInflight.delete(key);
+            return;
+        }
+        // Already handed to the breaker: no barrier, no wait, no extra cost per
+        // file. This is what stops a stalled scanner turning every remaining file
+        // into a fresh full-budget wait.
+        if (record.gateOpen)
+            return;
+        const limit = auxNotifyInflightLimit(entry.info);
+        if (record.unacked < limit)
+            return;
+        const ping = entry.client.pingLiveness;
+        if (!ping) {
+            record.unacked = 0;
+            return;
+        }
+        if (waitMs <= 0) {
+            this.openAuxNotifyGate(key, entry, filePath, context, {
+                unacked: record.unacked,
+                limit,
+                waitMs,
+                durationMs: 0,
+            });
+            return;
+        }
+        if (!record.drain) {
+            const startedAt = Date.now();
+            const outstanding = record.unacked;
+            const client = entry.client;
+            const barrier = (async () => {
+                let drained = false;
+                try {
+                    drained = await ping.call(client, waitMs);
+                }
+                catch {
+                    // A ping that throws proves nothing about the backlog; treat it as
+                    // undrained rather than waving the next write through.
+                    drained = false;
+                }
+                const current = this.auxNotifyInflight.get(key);
+                if (current === record && current.client === client) {
+                    current.drain = undefined;
+                    // Subtract the snapshot rather than zeroing: a concurrent touch may
+                    // have issued a write after this round-trip was sent, and that write
+                    // is still unacknowledged.
+                    if (drained)
+                        current.unacked = Math.max(0, current.unacked - outstanding);
+                    // Deliberately no `else` latch here. A barrier is only ever created
+                    // by a call that goes on to await it, so a negative result always
+                    // reaches a waiter — as `false`, or as that waiter's own timeout —
+                    // and the waiter is what latches. A second latch here would be
+                    // unreachable, and no test could hold it honest.
+                }
+                this.noteDrainBarrierOutcome(key, entry, filePath, context, {
+                    unacked: outstanding,
+                    limit,
+                    waitMs,
+                    durationMs: Date.now() - startedAt,
+                    outcome: drained ? "drained" : "stalled",
+                });
+                return drained;
+            })();
+            barrier.catch(() => { });
+            record.drain = barrier;
+            record.stallLogged = false;
+        }
+        // Each waiter spends only its OWN remaining budget on the shared barrier.
+        const waitStartedAt = Date.now();
+        const drained = await withDeadline(record.drain, {
+            ms: waitMs,
+            onTimeout: "undefined",
+            onReject: "undefined",
+        });
+        if (drained !== true) {
+            // The waiter gave up before the round-trip answered. Latch open and let
+            // the caller write: a barrier whose ping never answers would otherwise
+            // tax every remaining file a full budget for nothing.
+            this.openAuxNotifyGate(key, entry, filePath, context, {
+                unacked: record.unacked,
+                limit,
+                waitMs,
+                durationMs: Date.now() - waitStartedAt,
+            });
+        }
+    }
+    /**
+     * #1714: stop pacing this client and hand it to the breaker.
+     *
+     * Latched, not cooled down — a timer here would be a schedule of this gate's
+     * own, and it would race the caller's cadence. The latch clears only when the
+     * record does: a demotion ({@link demoteForNotifyStall}), a client-identity
+     * change, or the service teardown. Every one of those means a new server
+     * process, which is the only event that makes the old backlog meaningless.
+     */
+    openAuxNotifyGate(key, entry, filePath, context, detail) {
+        const record = this.auxNotifyInflight.get(key);
+        if (record && record.client === entry.client) {
+            // `drain` is deliberately left alone. Once the gate is open nothing
+            // reads it again — `paceAuxNotify` returns above the barrier — and the
+            // round-trip's own settle handler clears it when it finally answers.
+            // Clearing it here would be a write no test could hold honest.
+            record.gateOpen = true;
+        }
+        this.noteDrainBarrierOutcome(key, entry, filePath, context, {
+            ...detail,
+            outcome: "stalled",
+        });
+    }
+    /**
+     * #1714: emit at most ONE record per barrier. A stalled barrier can be
+     * abandoned by every file left in the sweep, and one row per file would turn a
+     * single stuck scanner into hundreds of identical records.
+     */
+    noteDrainBarrierOutcome(key, entry, filePath, context, detail) {
+        const record = this.auxNotifyInflight.get(key);
+        if (detail.outcome === "stalled" && record) {
+            if (record.stallLogged)
+                return;
+            record.stallLogged = true;
+        }
+        this.logDrainBarrier(key, entry, filePath, context, detail);
+    }
+    /**
+     * #1714: one row per barrier, not per waiter — a burst of N notifies produces
+     * at most one round-trip and one record, so the volume is bounded by the sweep
+     * divided by the limit. Names the server and the file that hit the ceiling, so
+     * "which scanner is falling behind" survives aggregation.
+     */
+    logDrainBarrier(key, entry, filePath, context, detail) {
+        if (detail.outcome === "stalled") {
+            incrementDegradationCount({
+                kind: "lsp-notify-inflight-stall",
+                subject: `${entry.info.id}:${normalizeMapKey(filePath)}`,
+                reason: `notify barrier stalled with ${detail.unacked} unacknowledged writes`,
+            });
+        }
+        logLatency({
+            type: "phase",
+            phase: "lsp_notify_inflight_barrier",
+            filePath: normalizeMapKey(filePath),
+            durationMs: detail.durationMs,
+            metadata: {
+                serverId: entry.info.id,
+                clientKey: key,
+                source: context.source,
+                clientScope: context.clientScope,
+                ...detail,
             },
         });
     }
+    /**
+     * #1459: take this auxiliary's resync slot, waiting up to `budgetMs` for it.
+     *
+     * The gate is a QUEUE, not a drop: a healthy scanner accepts a `didOpen` in
+     * milliseconds, so a sweep's neighbours take their turns one after another and
+     * every file still gets scanned — what the gate prevents is N simultaneous
+     * full re-scans flooding one stdin. Only a scanner that cannot accept a write
+     * inside the budget makes a waiter give up, and giving up is reported as a
+     * coverage gap rather than pushed anyway.
+     *
+     * The slot is CLAIMED SYNCHRONOUSLY: the check and the insert sit in one
+     * uninterrupted run of statements, and the returned handle owns the entry. A
+     * version that returned "the slot looks free, go write" and let the caller
+     * insert its own record after an `await` was not a gate at all — when the
+     * holder's write landed, every waiter woke in the same microtask batch, each
+     * read an empty map, and all of them wrote at once (measured: one write at t=0,
+     * then a five-wide flood at t=50 for six touches). That is #1459's own root
+     * cause rebuilt inside the fix for it.
+     *
+     * Returns a handle with `release()` (call on the write's settle, idempotent), or
+     * a verdict naming how long the blocking write has been outstanding.
+     */
+    async claimAuxNotifySlot(clientKey, entry, filePath, budgetMs) {
+        const deadline = Date.now() + budgetMs;
+        for (;;) {
+            const outstanding = this.outstandingAuxNotifyWrites.get(clientKey);
+            // A record left behind by a PREVIOUS client generation (evicted,
+            // respawned) says nothing about this client's stdin — drop it, so a stale
+            // entry can never starve a healthy server.
+            if (outstanding && outstanding.client !== entry.client) {
+                this.outstandingAuxNotifyWrites.delete(clientKey);
+            }
+            else if (outstanding) {
+                const outstandingMs = Date.now() - outstanding.startedAt;
+                const remainingMs = deadline - Date.now();
+                if (remainingMs <= 0)
+                    return { outstandingMs };
+                // `settled` never rejects, so this only resolves or times out.
+                await withDeadline(outstanding.settled, {
+                    ms: remainingMs,
+                    onTimeout: "undefined",
+                    onReject: "undefined",
+                });
+                continue;
+            }
+            // This client was evicted or replaced while we queued — writing to it
+            // would target a retired generation. Report the gap instead.
+            //
+            // `!== entry.client` covers BOTH shapes, and the missing-entry one is the
+            // dangerous half: eviction (idle, capacity, a #743 demotion) DELETES the
+            // registry entry, so an `undefined`-exempting guard would wave the waiter
+            // through to a corpse whose write resolves `true` — and `markTouched` would
+            // then record this content as delivered, which is exactly the #1253
+            // laundering the debounce entry must never do.
+            const current = this.state.clients.get(clientKey);
+            if (current !== entry.client) {
+                return { outstandingMs: 0 };
+            }
+            // ---- No `await` from here to the `set` below: the claim is atomic. ----
+            let resolveSettled;
+            const settled = new Promise((resolve) => {
+                resolveSettled = resolve;
+            });
+            const token = {
+                startedAt: Date.now(),
+                client: entry.client,
+                settled,
+                // A write nothing accepts for the whole wedge window is a dead input
+                // path, not a slow scan. Armed HERE rather than checked by the next
+                // waiter: inside a burst every waiter arrives within one budget, so a
+                // waiter-side check could never see the wedge window elapse and a
+                // wedged scanner was never demoted. Unref'd so it cannot hold a
+                // one-shot host alive, and cleared on release.
+                wedgeTimer: setTimeout(() => {
+                    if (this.outstandingAuxNotifyWrites.get(clientKey) !== token)
+                        return;
+                    this.demoteForNotifyStall(clientKey, entry, filePath, {
+                        outstandingMs: Date.now() - token.startedAt,
+                    });
+                    resolveSettled?.();
+                }, notifyWedgedMs()),
+            };
+            token.wedgeTimer.unref?.();
+            this.outstandingAuxNotifyWrites.set(clientKey, token);
+            return {
+                release: () => {
+                    clearTimeout(token.wedgeTimer);
+                    if (this.outstandingAuxNotifyWrites.get(clientKey) === token) {
+                        this.outstandingAuxNotifyWrites.delete(clientKey);
+                    }
+                    resolveSettled?.();
+                },
+            };
+        }
+    }
+    /**
+     * #1459: the auxiliary scanners that WOULD have attached to this touch but got
+     * no client because their circuit breaker is open (cooldown or permanent).
+     *
+     * A skipped scanner said nothing about the file. Until now it also left no
+     * trace on the result: it simply dropped out of `spawned`, and the touch
+     * resolved `confirmation: "confirmed"` on the strength of whoever was left —
+     * so a 15 s opengrep cooldown read as "scanned, clean" for every file swept
+     * inside it. Naming the scanners here narrows the touch to `"partial"` instead,
+     * which every coverage consumer already fails closed on (#1470).
+     *
+     * Deliberately AUXILIARY-only. A broken primary is already visible through the
+     * `no_clients` failure kind and the demonstrated-cold path; the false-clean
+     * hazard this addresses is the scanner lane, where an empty result is the
+     * normal, expected answer.
+     *
+     * SCOPE, stated so the next reader does not assume the room is closed: this
+     * covers the BREAKER doors only (cooldown + permanent). `ensureClientForServer`
+     * also drops a scanner for a temporarily-unavailable command (the #1496 latch),
+     * `optionalDisabled`, a spawn failure, or capacity eviction. Those are the same
+     * defect class in the same lane, but they are persistent-absence states rather
+     * than a transient blackout, so flagging every touch partial for them is a
+     * broader behavior change than #1459 is scoped to make. Tracked separately.
+     */
+    async brokenSkippedAuxiliaryServerIds(filePath, clientScope, options, spawned) {
+        // "primary" scope attaches no auxiliaries at all, so nothing was skipped.
+        if (clientScope === "primary")
+            return [];
+        const enabledAuxiliaries = clientScope === "with-auxiliary"
+            ? new Set(options.auxiliaryServerIds ?? [])
+            : undefined;
+        const attached = new Set(spawned.map((entry) => entry.info.id));
+        const skipped = [];
+        for (const server of getServersForFileWithConfig(filePath)) {
+            if (server.role !== "auxiliary")
+                continue;
+            if (attached.has(server.id))
+                continue;
+            // An explicitly excluded server (the #584 workspace-sweep exclusion) was
+            // never asked, and its findings come from its own CLI extractor — that is
+            // a routing decision, not a coverage gap.
+            if (options.excludeServerIds?.has(server.id))
+                continue;
+            if (enabledAuxiliaries && !enabledAuxiliaries.has(server.id))
+                continue;
+            const key = await this.demonstratedReadyKeyFor(server, filePath);
+            if (!key)
+                continue;
+            const brokenUntil = this.state.broken.get(key);
+            if (this.permanentlyBroken.has(key) ||
+                (typeof brokenUntil === "number" && brokenUntil > Date.now())) {
+                skipped.push(server.id);
+            }
+        }
+        return skipped;
+    }
     activeClientsForCwd(cwd, priorityServerIds = []) {
         const normalizedCwd = normalizeMapKey(cwd);
         const priority = new Map(priorityServerIds.map((serverId, index) => [serverId, index]));
@@ -989,7 +1554,7 @@ export class LSPService {
      * Get or create LSP client for a file
      * Prevents duplicate client creation via in-flight promise tracking
      */
-    async getClientForFile(filePath, maxWaitMs, hardCapMs) {
+    async getClientForFile(filePath, maxWaitMs, hardCapMs, resolvedRoots, waitSkipReasons) {
         if (this.checkDestroyed())
             return undefined;
         // Primary selection considers language servers only — auxiliary servers
@@ -1008,12 +1573,25 @@ export class LSPService {
                 ? Math.min(serverBaseMs, hardCapMs)
                 : hardCapMs
             : serverBaseMs;
+        let knownSlowResolve;
+        const knownSlowSentinel = Symbol("lsp-client-wait-known-slow");
+        const knownSlow = new Promise((resolve) => {
+            knownSlowResolve = () => resolve(knownSlowSentinel);
+        });
+        const noteSpawnInFlight = (serverId) => {
+            const knownDurationMs = getSuccessfulLspSpawnDurationMs(serverId);
+            if (knownDurationMs !== undefined && knownDurationMs > effectiveMaxWaitMs * 2) {
+                // Let a completion microtask already queued by the acquisition win
+                // before the shortcut decision is observed by Promise.race.
+                queueMicrotask(() => knownSlowResolve?.());
+            }
+        };
         const withBudget = async () => {
             if (servers.length === 0)
                 return undefined;
             // Try each matching server
             for (const server of servers) {
-                const spawned = await this.ensureClientForServer(filePath, server);
+                const spawned = await this.ensureClientForServer(filePath, server, resolvedRoots, noteSpawnInFlight);
                 if (spawned) {
                     logLatency({
                         type: "phase",
@@ -1071,6 +1649,7 @@ export class LSPService {
         try {
             waitResult = await Promise.race([
                 withBudget(),
+                knownSlow,
                 new Promise((resolve) => {
                     waitTimer = setTimeout(() => resolve(timeoutSentinel), effectiveMaxWaitMs);
                 }),
@@ -1080,6 +1659,32 @@ export class LSPService {
             if (waitTimer)
                 clearTimeout(waitTimer);
         }
+        if (waitResult === knownSlowSentinel) {
+            // `inFlight` is cleared in ensureClientForServer's finally block, so a
+            // settled acquisition can still be present here. Re-read the published
+            // clients at the decision point; a usable client outranks the sentinel.
+            for (const server of servers) {
+                const root = await this.resolveServerRoot(server, filePath);
+                const client = root
+                    ? this.state.clients.get(`${server.id}:${normalizeMapKey(root)}`)
+                    : undefined;
+                if (client?.isAlive())
+                    return { client, info: server };
+            }
+            waitSkipReasons?.add("budget_skipped_known_slow");
+            logLatency({
+                type: "phase",
+                phase: "lsp_client_wait_skipped",
+                filePath,
+                durationMs: 0,
+                metadata: {
+                    maxWaitMs: effectiveMaxWaitMs,
+                    serverIds: servers.map((server) => server.id),
+                    reason: "budget_skipped_known_slow",
+                },
+            });
+            return undefined;
+        }
         if (waitResult === timeoutSentinel) {
             // Snapshot known client health — scan by serverId prefix (no root needed)
             const knownHealth = [...this.state.clients.entries()]
@@ -1109,7 +1714,7 @@ export class LSPService {
      * Get or create ALL LSP clients that can serve a file.
      * Used for diagnostics aggregation across complementary servers.
      */
-    async getClientsForFile(filePath, excludeServerIds) {
+    async getClientsForFile(filePath, excludeServerIds, resolvedRoots) {
         const allServers = getServersForFileWithConfig(filePath);
         const servers = excludeServerIds && excludeServerIds.size > 0
             ? allServers.filter((s) => !excludeServerIds.has(s.id))
@@ -1120,7 +1725,7 @@ export class LSPService {
         // that fail the root check are not real spawn attempts.
         const roots = await Promise.all(servers.map((s) => this.resolveServerRoot(s, filePath)));
         const serverCountAttempted = roots.filter(Boolean).length;
-        const spawned = await Promise.all(servers.map((server) => this.ensureClientForServer(filePath, server)));
+        const spawned = await Promise.all(servers.map((server) => this.ensureClientForServer(filePath, server, resolvedRoots)));
         return {
             clients: spawned.filter((entry) => Boolean(entry)),
             serverCountAttempted,
@@ -1180,7 +1785,194 @@ export class LSPService {
         }
         return false;
     }
-    async ensureClientForServer(filePath, server) {
+    /**
+     * #1668: deliver a `workspace/didChangeWatchedFiles` event for a disk
+     * change the client did not author through open-document sync — a bash
+     * write/delete, or any other external change. `type` is the LSP
+     * `FileChangeType` (1 Created, 2 Changed, 3 Deleted).
+     *
+     * Only reaches ALREADY-ACTIVE clients for this file's servers — a server
+     * that hasn't been spawned yet has no stale cache to correct, so this
+     * never spawns one just to deliver the notification. Each affected
+     * client enqueues into its own #271 debounced queue, so a burst of
+     * external changes still coalesces into one notification per server.
+     */
+    async notifyExternalFileChange(filePath, type) {
+        if (this.checkDestroyed())
+            return;
+        for (const server of getServersForFileWithConfig(filePath)) {
+            const root = await this.resolveServerRoot(server, filePath);
+            if (!root)
+                continue;
+            const key = `${server.id}:${normalizeMapKey(root)}`;
+            const existing = this.state.clients.get(key);
+            if (existing?.isAlive()) {
+                existing.notify.watchedFileChange(filePath, type);
+            }
+        }
+    }
+    /**
+     * #1783: disk-drift backstop. Stat one batch of the documents a language
+     * server currently holds, and re-push any whose bytes on disk no longer
+     * match what the server was last given.
+     *
+     * Why this exists: an edit made outside the tracked write/edit path (a
+     * bash-tool bulk edit) sends no `didChange`, so the server keeps publishing
+     * pre-edit diagnostics with nothing to correct it. The resync-on-read path
+     * only fires for a file the session reads again; a file that is edited and
+     * never re-read stayed stale for the life of the server.
+     *
+     * Hot-path contract: callers fire this WITHOUT awaiting it. It is
+     * rate-limited to one pass per drift-check interval (10s default),
+     * stats at most 64 documents per pass, reads only the ones whose stat
+     * already diverged, and issues at most 4 resyncs per pass serially. So the
+     * steady-state cost on the touch path is zero, and the worst-case cost of a
+     * pass is 64 stats plus up to 4 reads, off the caller's critical path.
+     *
+     * Never spawns: a document with no live client already holding it open has
+     * no stale view to correct, so its record is dropped instead of resynced.
+     */
+    async sweepDocumentDrift(options = {}) {
+        if (this.checkDestroyed())
+            return undefined;
+        return this.documentDrift.sweep({
+            resync: async (filePath, content) => {
+                // Reuse the normal touch path so the resync inherits the existing
+                // per-server notify-write budget, the #743 backpressure demotion and
+                // the client-lease machinery. diagnostics:"none" keeps it a pure
+                // content push — the next genuine query gets correct diagnostics
+                // because the server's view is now right, not because this call
+                // waited for them.
+                //
+                // Scope "all" MINUS the servers that are not holding this document:
+                // the resync must cover every view that is actually stale, primary
+                // and auxiliary alike, and the exclusion set is what keeps that from
+                // spawning anything (see serverIdsNotHoldingDocument). The write is
+                // still one per held server through the same bounded notify path, so
+                // the per-pass resync cap continues to bound the total writes.
+                await this.touchFile(filePath, content, {
+                    diagnostics: "none",
+                    source: "drift_resync",
+                    clientScope: "all",
+                    excludeServerIds: await this.serverIdsNotHoldingDocument(filePath),
+                });
+                // touchFile swallows a rejected or timed-out notify write so the
+                // caller's edit keeps moving, so its return proves nothing about
+                // whether the heal landed. The drift record is stamped in exactly
+                // one place — recordFullyCoveredSync, and only on full coverage —
+                // so "did the record advance to this content" IS the answer.
+                return (this.documentDrift.peek(filePath)?.fingerprint ===
+                    fingerprintDocumentContent(content));
+            },
+            holdsDocument: (filePath) => this.hasLiveClientHoldingDocument(filePath),
+            onDrift: (event) => {
+                // A clean re-stamp, a deleted file and a closed document are all
+                // normal bookkeeping, not degradations. Only a real resync — or a
+                // heal the pacing had to defer — earns a record.
+                if (event.disposition === "unchanged" ||
+                    event.disposition === "vanished" ||
+                    event.disposition === "unheld") {
+                    return;
+                }
+                // Bounded record, per-file so the identity of the stuck document
+                // survives aggregation. `incrementDegradationCount` keeps one entry
+                // per file with an exact repeat tally instead of N entries.
+                incrementDegradationCount({
+                    kind: "lsp-document-drift",
+                    subject: event.filePath,
+                    reason: event.disposition === "deferred"
+                        ? `disk drift deferred by resync pacing after ${event.driftAgeMs}ms`
+                        : event.disposition === "failed"
+                            ? `resync FAILED after ${event.driftAgeMs}ms of untracked disk drift; view still stale (${event.syncedSize}->${event.diskSize} bytes)`
+                            : `resynced after ${event.driftAgeMs}ms of untracked disk drift (${event.syncedSize}->${event.diskSize} bytes)`,
+                });
+                logLatency({
+                    type: "phase",
+                    phase: "lsp_document_drift",
+                    filePath: event.filePath,
+                    durationMs: event.driftAgeMs,
+                    metadata: {
+                        disposition: event.disposition,
+                        driftAgeMs: event.driftAgeMs,
+                        syncedSize: event.syncedSize,
+                        diskSize: event.diskSize,
+                    },
+                });
+            },
+        }, options);
+    }
+    /** #1783: tracked drift-record count. Test seam for the reset conformance. */
+    _driftTrackedCountForTests() {
+        return this.documentDrift.size;
+    }
+    /**
+     * #1783: does any LIVE client already hold this document open? A record for
+     * a document no server holds is dropped rather than resynced, so the drift
+     * backstop can never spawn a server just to correct a view nobody has.
+     */
+    hasLiveClientHoldingDocument(filePath) {
+        for (const client of this.state.clients.values()) {
+            if (!client.isAlive())
+                continue;
+            if (documentIsOpenOn(client, filePath))
+                return true;
+        }
+        return false;
+    }
+    /**
+     * #1783: server ids for this file whose client is NOT currently holding the
+     * document open — the exclusion set the drift resync passes to
+     * `clientScope:"all"`.
+     *
+     * This is what keeps "resync every server that holds it" and "never spawn"
+     * compatible. `getClientsForFile` filters by this set BEFORE
+     * `ensureClientForServer`, so an excluded server is never reached, and every
+     * remaining server already has a live client that returns from the cache.
+     * Without it, `clientScope:"all"` would spawn the file's other servers, and
+     * `clientScope:"primary"` would leave an auxiliary's view stale while the
+     * record claimed the file was back in sync.
+     */
+    async serverIdsNotHoldingDocument(filePath) {
+        const exclude = new Set();
+        for (const server of getServersForFileWithConfig(filePath)) {
+            const root = await this.resolveServerRoot(server, filePath);
+            const existing = root
+                ? this.state.clients.get(`${server.id}:${normalizeMapKey(root)}`)
+                : undefined;
+            if (existing?.isAlive() && documentIsOpenOn(existing, filePath))
+                continue;
+            exclude.add(server.id);
+        }
+        return exclude;
+    }
+    /**
+     * #1783: stamp the drift record only when this touch reached EVERY server
+     * that currently holds the document, and every one of those writes landed.
+     *
+     * `at` is the touch's START time, not the moment the write landed. The write
+     * can take up to the notify budget, and an untracked edit inside that window
+     * would otherwise be stamped as already-synchronized and become invisible
+     * (the mtime half of the key compares against this timestamp). Starting the
+     * clock at the touch — within a millisecond or two of the caller's read —
+     * narrows that blind window to the caller's own read-to-touch gap.
+     */
+    recordFullyCoveredSync(filePath, content, targeted, allWritesLanded, at) {
+        if (!allWritesLanded || targeted.length === 0)
+            return;
+        const targetedClients = new Set(targeted.map((entry) => entry.client));
+        for (const client of this.state.clients.values()) {
+            if (targetedClients.has(client))
+                continue;
+            if (!client.isAlive())
+                continue;
+            // A live client outside this touch's scope still holds the document, so
+            // its view is NOT covered by this content. Recording here would claim it.
+            if (documentIsOpenOn(client, filePath))
+                return;
+        }
+        this.documentDrift.recordSynced(filePath, content, at);
+    }
+    async ensureClientForServer(filePath, server, resolvedRoots, onSpawnInFlight) {
         const handoff = this.generationHandoff;
         if (handoff) {
             await handoff;
@@ -1193,21 +1985,30 @@ export class LSPService {
         const root = await this.resolveServerRoot(server, filePath);
         if (!root || this.checkDestroyed())
             return undefined;
+        if (server.role !== "auxiliary") {
+            resolvedRoots?.set(server.id, normalizeMapKey(root));
+        }
         const allowInstall = this.shouldAllowInstall(server.id);
         const normalizedRoot = normalizeMapKey(root);
         const key = `${server.id}:${normalizedRoot}`;
         const isOptionalServer = OPTIONAL_LSP_SERVER_IDS.has(server.id); // NOSONAR: set intentionally empty — no optional servers configured yet
         if (server.availabilityKey &&
             isDirectLspCommandTemporarilyUnavailable(server.availabilityKey)) {
-            logLatency({
-                type: "phase",
-                phase: "lsp_client_skipped_unavailable_command",
+            // #1743: during an outage this path runs once per file per touch,
+            // so a raw write here is a per-file log storm. The ledger counts
+            // every skip exactly, keyed on (command, file); only the first per
+            // pair also writes the detailed record.
+            emitBounded("lsp_client_skipped_unavailable_command", `${server.availabilityKey}:${normalizeMapKey(filePath)}`, {
                 filePath,
                 durationMs: 0,
                 metadata: {
                     serverId: server.id,
                     command: server.availabilityKey,
                 },
+            }, {
+                ledgerKind: "lsp-client-skipped-unavailable-command",
+                risingEdgePer: "identity",
+                reason: `command ${server.availabilityKey} temporarily unavailable`,
             });
             return undefined;
         }
@@ -1215,15 +2016,20 @@ export class LSPService {
             return undefined;
         }
         if (this.permanentlyBroken.has(key)) {
-            logLatency({
-                type: "phase",
-                phase: "lsp_client_skipped_broken",
+            // #1743: same per-file-per-touch storm as the unavailable-command
+            // skip above. Identity is (server, file) so a single wedged server
+            // cannot hide which files it is refusing.
+            emitBounded("lsp_client_skipped_broken", `${server.id}:${normalizeMapKey(filePath)}`, {
                 filePath,
                 durationMs: 0,
                 metadata: {
                     serverId: server.id,
                     permanent: true,
                 },
+            }, {
+                ledgerKind: "lsp-client-skipped-broken",
+                risingEdgePer: "identity",
+                reason: `${server.id} latched permanently broken`,
             });
             return undefined;
         }
@@ -1407,15 +2213,20 @@ export class LSPService {
         }
         const brokenUntil = this.state.broken.get(key);
         if (typeof brokenUntil === "number" && brokenUntil > Date.now()) {
-            logLatency({
-                type: "phase",
-                phase: "lsp_client_skipped_broken",
+            // #1743: the breaker-cooldown sibling of the permanently-broken skip
+            // above, sharing its identity so an outage produces one record per
+            // (server, file) rather than one per touch.
+            emitBounded("lsp_client_skipped_broken", `${server.id}:${normalizeMapKey(filePath)}`, {
                 filePath,
                 durationMs: 0,
                 metadata: {
                     serverId: server.id,
                     retryInMs: Math.max(0, brokenUntil - Date.now()),
                 },
+            }, {
+                ledgerKind: "lsp-client-skipped-broken",
+                risingEdgePer: "identity",
+                reason: `${server.id} in breaker cooldown`,
             });
             return undefined;
         }
@@ -1444,6 +2255,19 @@ export class LSPService {
                 return undefined;
             spawnPromise = started.promise;
         }
+        // Announce the in-flight spawn so the caller can skip a doomed touch
+        // wait. The announcement never returns a client and never
+        // short-circuits. A spawn that settles inside the race window is picked
+        // up by getClientForFile, which re-reads `state.clients` at the point it
+        // acts on the shortcut.
+        //
+        // Do NOT add a `state.clients` early return here. This point sits
+        // downstream of the warm-reuse path, the dead-client shutdown, the #1127
+        // give-up latch, the breaker cooldown, and the #1332 idle eviction, so a
+        // return here re-publishes a client every one of those already declined.
+        // It also skips the `finally` below that owns the `inFlight` entry,
+        // which strands the settled promise and stops the server respawning.
+        onSpawnInFlight?.(server.id);
         try {
             return await spawnPromise;
         }
@@ -1549,7 +2373,9 @@ export class LSPService {
                 this.optionalFailureLogged.delete(key);
             }
             logSessionStart(`lsp spawn ${server.id}: success source=${spawned.source ?? "unknown"} (${Date.now() - startedAt}ms)`);
-            recordLsp(server.id, root, "spawn_success", Date.now() - startedAt);
+            const spawnDurationMs = Date.now() - startedAt;
+            recordLsp(server.id, root, "spawn_success", spawnDurationMs);
+            recordSuccessfulLspSpawn(server.id, spawnDurationMs);
             if (!this.workspaceProbeLogged.has(key)) {
                 logSessionStart(`lsp workspace-diag probe ${server.id}: advertised=${wsDiag.advertised} mode=${wsDiag.mode} provider=${wsDiag.diagnosticProviderKind}`);
                 this.workspaceProbeLogged.add(key);
@@ -1587,9 +2413,19 @@ export class LSPService {
     async openFile(filePath, content, options) {
         if (this.checkDestroyed())
             return;
+        // #1783: anchored before the client acquisition, for the same reason
+        // touchFile anchors on its own start — see recordFullyCoveredSync.
+        const startedAt = Date.now();
         await this.withClientForFileUse(filePath, undefined, options?.spawnBudgetMs, async (spawned) => {
             const languageId = getLanguageId(filePath) ?? "plaintext";
             await spawned.client.notify.open(filePath, content, languageId, options?.preserveDiagnostics);
+            // #1783: openFile is a real sync path — actionable-warnings and the
+            // diagnostic-freshness callers reach a server through here and never
+            // through touchFile. Without this, those documents were invisible to
+            // the drift backstop. The same full-coverage gate applies, so an
+            // auxiliary holding the document keeps the record unwritten rather
+            // than letting one client's push claim every view is current.
+            this.recordFullyCoveredSync(filePath, content, [spawned], true, startedAt);
         });
     }
     /**
@@ -1605,20 +2441,58 @@ export class LSPService {
      * and optionally collect diagnostics with explicit scope.
      */
     async touchFile(filePath, content, options = {}) {
-        if (this.checkDestroyed())
+        if (this.checkDestroyed()) {
+            // #1618: a destroyed service never reaches the language server — this
+            // early return used to log nothing at all, so a workspace sweep whose
+            // idle-reset timer fired mid-run left every remaining file with zero
+            // trace, indistinguishable from budget exhaustion. Cheap and local: no
+            // server round trip, matching the `no_clients`/`success` sibling
+            // records this phase already emits below.
+            const destroyedDiagnosticsMode = options.collectDiagnostics
+                ? (options.diagnostics ?? "document")
+                : (options.diagnostics ?? "none");
+            logLatency({
+                type: "phase",
+                phase: "lsp_touch_file",
+                filePath: normalizeMapKey(filePath),
+                durationMs: 0,
+                metadata: {
+                    serverCountAttempted: 0,
+                    serverCountReady: 0,
+                    clientScope: options.clientScope ??
+                        (destroyedDiagnosticsMode === "full" ? "all" : "primary"),
+                    diagnosticsMode: destroyedDiagnosticsMode,
+                    source: options.source ?? "unknown",
+                    failureKind: "destroyed",
+                },
+            });
             return;
+        }
         const startedAt = Date.now();
         const normalizedPath = normalizeMapKey(filePath);
+        // #1783: every path that asks a language server anything comes through
+        // here, so this is where the disk-drift backstop gets its heartbeat.
+        // Deliberately NOT awaited: the sweep is rate-limited to one pass per
+        // 10s and runs alongside this touch's own client acquisition and
+        // diagnostics wait, so it adds nothing to this call's latency. The
+        // resync it may issue re-enters touchFile; every such re-entry happens
+        // while the pass is still running, so the tracker's single-flight guard
+        // returns the running pass and no recursion occurs. That guard is the
+        // single mechanism — there is deliberately no second source-based check
+        // here, which would be an unprovable duplicate of it.
+        void this.sweepDocumentDrift().catch(() => { });
         const diagnosticsMode = options.collectDiagnostics
             ? (options.diagnostics ?? "document")
             : (options.diagnostics ?? "none");
         const source = options.source ?? "unknown";
         const clientScope = options.clientScope ?? (diagnosticsMode === "full" ? "all" : "primary");
         const useAllClients = clientScope === "all";
+        const resolvedPrimaryRoots = new Map();
+        const waitSkipReasons = new Set();
         let spawned;
         let serverCountAttempted;
         if (useAllClients) {
-            const result = await this.getClientsForFile(filePath, options.excludeServerIds);
+            const result = await this.getClientsForFile(filePath, options.excludeServerIds, resolvedPrimaryRoots);
             spawned = result.clients;
             serverCountAttempted = result.serverCountAttempted;
         }
@@ -1626,14 +2500,14 @@ export class LSPService {
             // Primary language server + the enabled cross-cutting auxiliaries
             // (opengrep, …). The aggregation layer merges/dedups their diagnostics.
             const [entry, aux] = await Promise.all([
-                this.getClientForFile(filePath, options.maxClientWaitMs),
+                this.getClientForFile(filePath, options.maxClientWaitMs, undefined, resolvedPrimaryRoots, waitSkipReasons),
                 this.getAuxiliaryClientsForFile(filePath, new Set(options.auxiliaryServerIds ?? [])),
             ]);
             spawned = entry ? [entry, ...aux] : aux;
             serverCountAttempted = spawned.length;
         }
         else {
-            const entry = await this.getClientForFile(filePath, options.maxClientWaitMs);
+            const entry = await this.getClientForFile(filePath, options.maxClientWaitMs, undefined, resolvedPrimaryRoots, waitSkipReasons);
             spawned = entry ? [entry] : [];
             serverCountAttempted =
                 spawned.length > 0
@@ -1643,6 +2517,14 @@ export class LSPService {
                         : 0;
         }
         if (spawned.length === 0) {
+            // A bounded caller can lose the client race while the single-flight spawn
+            // it started is still progressing. Preserve that lifecycle evidence in the
+            // touch verdict instead of reclassifying an empty ready set as absence.
+            // `isSpawnInFlight` reads the spawn coordinator's own state and filters to
+            // primary candidates, so this stays coupled to the dedupe mechanism.
+            const failureKind = this.isSpawnInFlight(filePath, resolvedPrimaryRoots)
+                ? "spawn_in_flight_budget_elapsed"
+                : "no_clients_none_spawning";
             logLatency({
                 type: "phase",
                 phase: "lsp_touch_file",
@@ -1655,7 +2537,10 @@ export class LSPService {
                     diagnosticsMode,
                     source,
                     maxClientWaitMs: options.maxClientWaitMs,
-                    failureKind: "no_clients",
+                    failureKind,
+                    ...(waitSkipReasons.size > 0
+                        ? { reason: [...waitSkipReasons][0] }
+                        : {}),
                 },
             });
             return;
@@ -1703,7 +2588,22 @@ export class LSPService {
             // no-new-version baseline below.
             const notifySkippedServerIds = new Set(spawnedServerIds.filter((serverId) => this.shouldSkipNotify(filePath, content, clientScope, serverId)));
             const notifySkipped = spawned.length > 0 && notifySkippedServerIds.size === spawned.length;
-            const diagnosticBaselines = new Map(spawned.map((entry) => [entry.client, entry.client.diagnosticsVersion]));
+            // #1531: the pre-notify diagnostics baseline for THIS file on each client.
+            // It used to be `client.diagnosticsVersion`, a client-GLOBAL counter that also
+            // advances for files this touch never mentions — which let a sibling file's
+            // publication both end this file's wait early and read as an answer for it.
+            // `getDiagnosticsVersionForPath` returns that same counter's value as of this
+            // file's last publication, so every comparison downstream stays on one axis
+            // while ignoring sibling paths. Captured here because the notify below clears
+            // each client's cache for the file.
+            //
+            // The accessor is REQUIRED on `LSPClient`, so a real client always answers
+            // with a number. The optional call is only so a hand-written test double that
+            // predates it fails CLOSED — `undefined` keeps the existing "no usable
+            // baseline" branch below and can never satisfy the evidence check — instead of
+            // quietly reverting to the global counter, which is the defect itself.
+            const readPathVersion = (client) => client.getDiagnosticsVersionForPath?.(filePath);
+            const diagnosticBaselines = new Map(spawned.map((entry) => [entry.client, readPathVersion(entry.client)]));
             // #1458: read a late auxiliary publication BEFORE the ordinary resync
             // clears its client cache. Carry it only when the publication's exact
             // sent-content fingerprint matches this touch's content. A changed edit,
@@ -1711,17 +2611,77 @@ export class LSPService {
             // replayed. The fresh notify still runs below, so scanners continue toward
             // a publication for this touch while the prior late result reaches the read.
             const touchContentHash = this.hashContent(content);
+            // #1586: THE content-match atom. Every content-bound question in this touch
+            // — the carry-over below, #1493's pre-notify snapshot, and the merge-time
+            // coverage predicate — asks it here and nowhere else, so a door cannot
+            // acquire a rule of its own by writing the comparison inline. A binding with
+            // no `contentHash` (version-less publish) fails closed: `undefined` never
+            // equals a hash.
+            const bindingMatchesTouchContent = (binding) => binding?.contentHash === touchContentHash;
             const carriedAuxiliary = options.collectDiagnostics
                 ? spawned.flatMap((entry) => {
                     if (entry.info.role !== "auxiliary")
                         return [];
                     const binding = entry.client.getDiagnosticBinding?.(filePath);
-                    if (binding?.contentHash !== touchContentHash)
+                    if (!bindingMatchesTouchContent(binding))
                         return [];
                     const diags = entry.client.getDiagnostics(filePath);
                     return diags.length > 0 ? [{ diags, binding }] : [];
                 })
                 : [];
+            // #1493: auxiliaries whose STORED publication already covers exactly the
+            // bytes this touch carries. Read BEFORE the notify below, which clears each
+            // client's cache for the file. Unlike `carriedAuxiliary` this does not
+            // require findings: an empty publication bound to this content is evidence
+            // the scanner reported, which is what keeps a genuinely clean file clean
+            // when its wait produces nothing new (a debounce-skipped notify, or a late
+            // publication carried in from the previous touch).
+            const auxPublishedThisContent = new Set(spawned.flatMap((entry) => entry.info.role === "auxiliary" &&
+                bindingMatchesTouchContent(entry.client.getDiagnosticBinding?.(filePath))
+                ? [entry.info.id]
+                : []));
+            const spawnedByServerId = new Map(spawned.map((entry) => [entry.info.id, entry]));
+            // #1549/#1586: does this auxiliary's publication describe exactly the bytes
+            // this touch carries? THE coverage predicate — every door reads it, so a
+            // scanner can never be named uncovered while its findings ride along in
+            // `.diags`, or the reverse.
+            //
+            // It UNIONS two content-bound reads rather than replacing one with the other,
+            // because they answer different questions:
+            //
+            //   - `auxPublishedThisContent` was captured BEFORE the notify (#1493), because
+            //     a landed write clears the cache and would erase the evidence that the
+            //     scanner had already reported on these bytes.
+            //   - the read below is LIVE, and it catches the opposite race — #1459's own
+            //     documented signature: a write charged as timed out, or one the fan-out
+            //     gate deferred behind, that LANDS LATE, after which the scanner publishes
+            //     for this touch's content. Judging that auxiliary on the pre-notify
+            //     snapshot alone drops its CURRENT findings and names it uncovered — an
+            //     underclaim about a scanner that answered.
+            //
+            // Either match means covered; both are content-bound, so neither can pass off
+            // another revision's findings as this touch's answer.
+            //
+            // WHEN it is asked is part of the rule. The live half moves over the life of
+            // a touch, so two doors that ask at two instants can disagree — and the merge
+            // ACTS on its answer by dropping findings, which a later answer cannot undo.
+            // Every door that shares the merge's consequences therefore reads ONE frozen
+            // evaluation (`auxCoveredAtMerge`, below), taken immediately before the merge
+            // and never re-asked afterwards. The only callers of this function are that
+            // freeze and the two aux wait-outcome producers, whose rows describe their own
+            // instant and are reconciled against the freeze before anything is claimed.
+            //
+            // Everything it cannot speak for fails CLOSED — an id that never reached
+            // `spawned` (a breaker-skipped scanner, which never attached) and any
+            // primary-role server, whose findings are governed by #570's
+            // timeout-preserves-last-known semantics rather than by this exemption.
+            const auxCoversThisContent = (serverId) => {
+                const entry = spawnedByServerId.get(serverId);
+                if (entry?.info.role !== "auxiliary")
+                    return false;
+                return (auxPublishedThisContent.has(serverId) ||
+                    bindingMatchesTouchContent(entry.client.getDiagnosticBinding?.(filePath)));
+            };
             // #743: PER-SERVER notify-write deadlines. Each server's didOpen/didChange
             // write gets its OWN notifyWriteBudgetMs budget rather than one shared
             // deadline over a single Promise.all — otherwise one backpressured server
@@ -1736,8 +2696,22 @@ export class LSPService {
             // server timed out"; this list carries the per-server detail the
             // demonstratedReady gate reads so a healthy sibling stays eligible.
             const notifyWriteTimedOutServerIds = [];
+            // #1459: auxiliaries whose resync was DEFERRED because the gate already had
+            // one outstanding write for that server. They carry no evidence about this
+            // content, so they join the coverage gap below.
+            const notifyDeferredServerIds = [];
             if (!notifySkipped) {
                 const budget = notifyWriteBudgetMs();
+                // #1459: how long a queued auxiliary may wait for its resync slot. Bounded
+                // by the write budget AND by whatever the caller already declared it is
+                // willing to spend on this touch (`maxClientWaitMs` — cascade's cold
+                // snapshot passes 1000ms), minus what the client wait above already spent.
+                // A flat write-budget wait would tax a caller that asked for less than one
+                // budget in total. Non-positive means "no time left to queue": the server
+                // is reported as uncovered immediately.
+                const queueWaitMs = options.maxClientWaitMs !== undefined
+                    ? Math.min(budget, Math.max(0, options.maxClientWaitMs - (Date.now() - startedAt)))
+                    : budget;
                 await Promise.all(spawned.map(async (entry) => {
                     // #743: this server already has this content from a recent touch
                     // that landed. Pushing again would clear its diagnostic cache for
@@ -1747,12 +2721,95 @@ export class LSPService {
                         return;
                     // Same identity as the broken/demonstratedReady maps.
                     const clientKey = await this.demonstratedReadyKeyFor(entry.info, filePath);
+                    // #1459: one outstanding resync per auxiliary. Primaries are
+                    // untouched — they serve one file per touch and are not the fan-out
+                    // target a `clientScope: "all"` sweep floods.
+                    const gated = entry.info.role === "auxiliary" && clientKey !== undefined;
+                    let slot;
+                    if (gated && clientKey) {
+                        // #1714: before taking the slot, make the server prove it
+                        // processed the notifies already sent. A sweep is sequential, so
+                        // the slot gate below is almost always free and cannot see a
+                        // backlog building. This never refuses the write — a scanner that
+                        // will not answer is latched past and left to #743's stall
+                        // machinery, which can demote and respawn it.
+                        const barrierStartedAt = Date.now();
+                        await this.paceAuxNotify(clientKey, entry, filePath, queueWaitMs, {
+                            source,
+                            clientScope,
+                        });
+                        // The barrier spends from the SAME budget the caller granted, so
+                        // the slot wait gets only what is left. Otherwise a paced touch
+                        // could cost two full budgets.
+                        const slotWaitMs = Math.max(0, queueWaitMs - (Date.now() - barrierStartedAt));
+                        const claim = await this.claimAuxNotifySlot(clientKey, entry, filePath, slotWaitMs);
+                        if ("outstandingMs" in claim) {
+                            // Queued behind a write the scanner has not accepted inside our
+                            // budget. Pushing anyway is what floods it, so this touch reports
+                            // the scanner as uncovered instead. The wedge timer armed with the
+                            // blocking write is what demotes a dead input path.
+                            notifyDeferredServerIds.push(entry.info.id);
+                            logLatency({
+                                type: "phase",
+                                phase: "lsp_notify_resync_deferred",
+                                filePath: normalizedPath,
+                                durationMs: claim.outstandingMs,
+                                metadata: {
+                                    serverId: entry.info.id,
+                                    source,
+                                    clientScope,
+                                    reason: "outstanding_write",
+                                    outstandingMs: claim.outstandingMs,
+                                    queueWaitMs,
+                                },
+                            });
+                            return;
+                        }
+                        slot = claim;
+                    }
                     let wrote;
                     let rejected = false;
                     try {
-                        wrote = await withDeadline(entry.client.notify
+                        const writeStartedAt = Date.now();
+                        // Constructed inside the try so a client double without `notify`
+                        // (or any synchronous throw) still reads as a rejected write rather
+                        // than rejecting the whole per-file `Promise.all`.
+                        const writePromise = entry.client.notify
                             .open(filePath, content, languageId, undefined, silent)
-                            .then(() => true), { ms: budget, onTimeout: "undefined", onReject: "propagate" });
+                            .then(() => true);
+                        // #1714: the document is now in this auxiliary's input queue,
+                        // whether or not the write settles inside our budget. Counted here
+                        // so the next file sees the real backlog.
+                        if (gated && clientKey) {
+                            this.noteAuxNotifyIssued(clientKey, entry.client);
+                        }
+                        if (slot && clientKey) {
+                            const client = entry.client;
+                            const release = slot.release;
+                            // Release the slot on the write's OWN settle, whatever the caller
+                            // below decided to wait for. The handle is identity-checked, so a
+                            // demotion (which clears the map) or a later claim cannot be
+                            // released by this one.
+                            void writePromise.then(() => {
+                                release();
+                                // The write landed, just not inside the caller's budget —
+                                // retract the timeout it was charged for. A write that landed
+                                // IN budget took the success path below, which clears the
+                                // streak outright, so only the late case retracts. A landing
+                                // past the WEDGE window keeps its strike: at that point the
+                                // stall was long enough that #743's demotion is the honest
+                                // verdict, not a latency artifact.
+                                const outstandingMs = Date.now() - writeStartedAt;
+                                if (outstandingMs > budget && outstandingMs <= notifyWedgedMs()) {
+                                    this.retractNotifyWriteBackpressure(clientKey, entry.info.id, filePath, outstandingMs, client);
+                                }
+                            }, release);
+                        }
+                        wrote = await withDeadline(writePromise, {
+                            ms: budget,
+                            onTimeout: "undefined",
+                            onReject: "propagate",
+                        });
                     }
                     catch {
                         // The write itself rejected (not backpressure): the content did
@@ -1760,6 +2817,10 @@ export class LSPService {
                         // rejection is not a stdin-backpressure signal and must not count
                         // toward the backpressure demotion streak.
                         rejected = true;
+                        // A synchronous throw (a client double without `notify`) never
+                        // reached the settle handlers that release the slot — release it
+                        // here so one bad client cannot wedge the queue. Idempotent.
+                        slot?.release();
                     }
                     if (wrote === true) {
                         // A clean write clears any accrued backpressure streak (#743).
@@ -1780,6 +2841,25 @@ export class LSPService {
                         }
                     }
                 }));
+                // #1783: stamp the disk-drift record only when the touch achieved FULL
+                // coverage — every targeted server's write landed AND no other live
+                // client holds this document. The debounce entry above is per-server, so
+                // stamping a per-FILE record inside that loop claimed a coverage the
+                // touch may not have had: a primary-scoped touch leaves an auxiliary's
+                // view untouched, and a touch where one server times out leaves that
+                // server behind. Either way the sweep would then read "in sync" and stop
+                // looking. On a partial touch the PREVIOUS record is deliberately kept:
+                // its older `syncedAt` and older fingerprint keep the document eligible,
+                // so the next sweep re-pushes it at full scope instead of going blind.
+                //
+                // BOTH exit lists, not just the timed-out one. The #1459 gate defers an
+                // auxiliary whose previous write is still outstanding, and that server
+                // leaves the write loop early without ever joining
+                // `notifyWriteTimedOutServerIds`. Reading only that list let a deferred
+                // scanner's untouched view be stamped as covered — the same laundering
+                // through a different door.
+                this.recordFullyCoveredSync(filePath, content, spawned, notifyWriteTimedOutServerIds.length === 0 &&
+                    notifyDeferredServerIds.length === 0, startedAt);
                 if (notifyWriteTimedOutServerIds.length > 0) {
                     logLatency({
                         type: "phase",
@@ -1795,14 +2875,50 @@ export class LSPService {
                     });
                 }
             }
-            // File-level flag: at least one server's write timed out (kept for the
-            // conservative touch-wide `inconclusive` merge semantics — see below).
+            // File-level flag: at least one server's write timed out. Kept as the
+            // observability summary (`lsp_touch_file.notifyWriteTimedOut`); the
+            // `inconclusive` verdict reads the PRIMARY-scoped flag below (#1549).
             const notifyWriteTimedOut = notifyWriteTimedOutServerIds.length > 0;
+            // #1549: the honesty verdict is decided from the PRIMARY population only.
+            // An auxiliary that missed a deadline is a named coverage gap, never an
+            // inconclusive touch — see `resolveTouchVerdict` (diagnostic-binding.ts).
+            const primaryEntries = spawned.filter((entry) => entry.info.role !== "auxiliary");
+            const primaryServerIds = new Set(primaryEntries.map((e) => e.info.id));
+            const primaryNotifyWriteTimedOutServerIds = notifyWriteTimedOutServerIds.filter((id) => primaryServerIds.has(id));
+            const primaryNotifyWriteTimedOut = primaryNotifyWriteTimedOutServerIds.length > 0;
+            // #1459: read by the diagnostics wait and the merge below — a deferred
+            // server is neither waited on nor read from.
+            const deferredResyncServerIds = new Set(notifyDeferredServerIds);
             let diagnosticsTimedOut = false;
+            // #1549: every server (any role) that produced no publication evidence when
+            // the diagnostics wait lapsed. Read three ways: the primary members decide
+            // `diagnosticsTimedOut` and are the `inconclusiveServerIds` attribution, the
+            // auxiliary members join the coverage gap, and no member may be marked
+            // `demonstratedReady`. Empty when the wait did not lapse.
+            let diagnosticsUnansweredServerIds = [];
+            // #1549: the primary subset of the list above, captured when the wait lapsed
+            // so the attribution survives the silent-clean/sync gates clearing the flag.
+            let diagnosticsUnansweredPrimaryServerIds = [];
+            // #1549: a gate that certifies silence AS the answer (the tsserver sync
+            // confirm, either silent-clean gate) retracts the primary attribution with it —
+            // those servers answered, in the only way their capabilities allow, so they
+            // stay eligible for `demonstratedReady` exactly as before this change.
+            // Auxiliary members are left in place: nothing certified them, and they are
+            // what the coverage gap reports.
+            const retractPrimaryTimeoutAttribution = () => {
+                diagnosticsUnansweredPrimaryServerIds = [];
+                diagnosticsUnansweredServerIds = diagnosticsUnansweredServerIds.filter((id) => !primaryServerIds.has(id));
+            };
             // R8 (#714): server ids of aux-role servers whose push wait was cut off by
             // the aux grace window. Undefined when no aux was cut off (primary-only
             // paths never set this). Logged in lsp_touch_file metadata.
             let auxCutOffServerIds;
+            // #1493: aux-role servers this touch carries NO evidence from — the cut-off
+            // set above PLUS the ones that stayed silent through their own budget with
+            // no stored publication for this content. This is what narrows the
+            // confirmation; `auxCutOffServerIds` stays cut_off-only so the R8 latency
+            // field keeps its original meaning.
+            let auxUnconfirmedServerIds;
             // #707: tsserver sync clean-confirm state. `tsserverSyncEligible` is the
             // full gate (evaluated once, before the wait); `tsserverSyncConfirmed`
             // holds the sync commands' answer when the racing confirm won the wait
@@ -1957,7 +3073,13 @@ export class LSPService {
                     timeoutFor = () => callerCap ?? modeFloor;
                 }
                 // Detection deadline = the slowest individual server's budget.
-                const timeoutMs = Math.max(0, ...spawned.map((e) => timeoutFor(e.client.serverId)));
+                // #1459: computed over the servers actually WAITED ON. A deferred server
+                // contributes no wait, so including its (typically longest) scanner budget
+                // here would raise the aggregate threshold above anything that can elapse
+                // and mask a real timeout on the servers that did wait.
+                const timeoutMs = Math.max(0, ...spawned
+                    .filter((e) => !deferredResyncServerIds.has(e.info.id))
+                    .map((e) => timeoutFor(e.client.serverId)));
                 // #707: evaluate the tsserver sync clean-confirm gate BEFORE the wait
                 // starts. Cheap synchronous gates first (notify succeeded, collecting,
                 // primary scope, `serverId === "typescript"` — the sync commands this
@@ -2027,21 +3149,51 @@ export class LSPService {
                     }
                 }
                 const perServerWaits = spawned.map((entry) => {
+                    // #1459: a DEFERRED server never received this content, so its version
+                    // can never advance past the baseline — waiting on it burns its whole
+                    // budget and would flip the touch to `inconclusive`, discarding a
+                    // primary answer that IS trustworthy. It contributes no wait; the
+                    // coverage gap below is what reports its absence.
+                    if (deferredResyncServerIds.has(entry.info.id)) {
+                        return Promise.resolve(undefined);
+                    }
                     const serverTimeout = timeoutFor(entry.client.serverId);
+                    // #1531: a per-path baseline. `clientWaitForDiagnostics` compares it
+                    // against this path's own publication stamp, so a sibling file's
+                    // publication on a shared client can no longer end this wait before the
+                    // server's own budget lapses — which is what kept the outcome labels
+                    // honest (`cut_off` means our grace won, `silent` means the server's own
+                    // budget lapsed with nothing published).
                     const baseline = diagnosticBaselines.get(entry.client);
                     const pullOnly = classifyServerWaitTier(entry.client.serverId, pressureSnapshots.find((snapshot) => snapshot.serverId === entry.client.serverId)) === "pull-capable";
+                    // #1639: `ensureWarmForSweep`'s readiness probe (`source:
+                    // "lsp_sweep_warmup"`, `collectDiagnostics: false`) runs a real pull
+                    // round trip on this same file, then the sweep's real touch follows
+                    // immediately after — two legitimate settle observations for one
+                    // file, not a duplicate. Tag the warm-up one distinctly so a
+                    // consumer can tell them apart instead of double-counting. Omitted
+                    // (rather than passed as "pull") on the common path — the client
+                    // already defaults to "pull", and existing tests assert the exact
+                    // argument list `waitForDiagnostics` is called with.
+                    const isWarmupTouch = source === "lsp_sweep_warmup";
                     // #743: per-server — a server we DID push to still gets the
                     // version-baseline wait even when a sibling was debounced away.
                     const wait = !notifySkippedServerIds.has(entry.info.id) && Number.isFinite(baseline)
                         ? entry.client.waitForDiagnostics(filePath, serverTimeout, {
                             minVersion: baseline,
                             ...(pullOnly && { pullOnly: true }),
+                            ...(isWarmupTouch && { pullSettleSource: "pull-warmup" }),
                         })
                         : pullOnly
                             ? entry.client.waitForDiagnostics(filePath, serverTimeout, {
                                 pullOnly: true,
+                                ...(isWarmupTouch && { pullSettleSource: "pull-warmup" }),
                             })
-                            : entry.client.waitForDiagnostics(filePath, serverTimeout);
+                            : isWarmupTouch
+                                ? entry.client.waitForDiagnostics(filePath, serverTimeout, {
+                                    pullSettleSource: "pull-warmup",
+                                })
+                                : entry.client.waitForDiagnostics(filePath, serverTimeout);
                     return wait.catch(() => undefined);
                 });
                 // The push wait — same per-server budget composition as before #707;
@@ -2112,17 +3264,43 @@ export class LSPService {
                                 //     NOT the same as having answered).
                                 //   - raced === true, evidence   → "answered" (a fresh
                                 //     publication actually landed for this touch).
+                                //
+                                // #1531: the evidence is read PER PATH. The global
+                                // `diagnosticsVersion` advances for every file this client
+                                // publishes, so a concurrent touch of an unrelated file used to
+                                // hand this one an unearned "answered" row. The per-path stamp
+                                // carries the global counter's value at store time, so the
+                                // comparison stays monotonic across cache evictions while
+                                // ignoring sibling paths — and it is the SAME axis `baseline`
+                                // was captured on above.
+                                const currentPathVersion = readPathVersion(aux.client);
                                 const publishedEvidence = raced &&
                                     Number.isFinite(aux.baseline) &&
-                                    aux.client.diagnosticsVersion > aux.baseline;
-                                const outcome = !raced
-                                    ? "cut_off"
-                                    : publishedEvidence
-                                        ? "answered"
-                                        : "silent";
+                                    currentPathVersion !== undefined &&
+                                    currentPathVersion > aux.baseline;
+                                // #1459: a DEFERRED aux was never sent this content and is not
+                                // waited on at all, so its instantly-resolved placeholder
+                                // promise must not read as "silent". "Silent" is the reserved
+                                // signal for a scanner that HAD the content, finished inside
+                                // its own budget, and published nothing (#1493) — recording a
+                                // deferral there would corrupt the one row that tracks it.
+                                const outcome = deferredResyncServerIds.has(aux.serverId)
+                                    ? "deferred"
+                                    : !raced
+                                        ? "cut_off"
+                                        : publishedEvidence
+                                            ? "answered"
+                                            : "silent";
                                 return {
                                     serverId: aux.serverId,
                                     outcome,
+                                    // #1493: carried into the coverage-gap policy so a silent
+                                    // auxiliary that already published for these exact bytes is
+                                    // not demoted. Logged too — it is the reason a `silent` row
+                                    // did not narrow the touch.
+                                    // #1586: through the one predicate, so this row and the merge
+                                    // below cannot disagree about the same scanner.
+                                    publishedThisContent: auxCoversThisContent(aux.serverId),
                                     budgetMs,
                                     elapsedMs: Date.now() - auxWaitStartedAt,
                                     // #1458 S3: elapsed measured from BEFORE the primary wait
@@ -2138,12 +3316,23 @@ export class LSPService {
                                 .map((outcome) => outcome.serverId);
                             if (unfinished.length > 0)
                                 auxCutOffServerIds = unfinished;
+                            // #1493: one policy over both no-answer shapes. Lives in
+                            // diagnostic-binding.ts so no consumer re-derives the rule from
+                            // an outcome string.
+                            const uncovered = auxiliaryCoverageGap(outcomes);
+                            if (uncovered.length > 0)
+                                auxUnconfirmedServerIds = uncovered;
                             logLatency({
                                 type: "phase",
                                 phase: "lsp_aux_wait_outcome",
                                 filePath: normalizedPath,
                                 durationMs: Date.now() - auxWaitStartedAt,
-                                metadata: { clientScope, outcomes },
+                                // #1533: `waitShape` names the producer, because the aggregate
+                                // path emits the same row with the same outcome vocabulary
+                                // minus `cut_off`. A field query that sees only `silent` rows
+                                // must be able to tell "our ceiling was in play" from "the
+                                // auxiliary's own full budget lapsed".
+                                metadata: { clientScope, waitShape: "aux_grace", outcomes },
                             });
                         });
                     })()
@@ -2219,6 +3408,109 @@ export class LSPService {
                     await pushWait;
                 }
                 const waitedMs = Date.now() - waitStartedAt;
+                // #1533: the same auxiliary coverage evidence for a collecting touch that
+                // did NOT enter the aux-grace wait — in practice `clientScope: "all"`, the
+                // batch/directory scan surface. Auxiliaries ARE spawned on that scope
+                // (`getClientsForFile` returns every matching server, #573) and each one is
+                // waited on inside `Promise.all(perServerWaits)` on its own per-server
+                // budget, but `hasTouchAuxiliaries` is `with-auxiliary`-only, so no evidence
+                // was ever derived and a silent scanner aggregated as an unqualified
+                // `"confirmed"` — the #1493 false clean surviving on a different scope.
+                //
+                // NO SECOND WAIT. Every aux promise here has already settled (the
+                // `Promise.all` above awaited it), so this reads post-wait state only. That
+                // is deliberate: #1459's resync gate exists to ABSORB the aux fan-out of an
+                // "all"-scope sweep into deferrals, and entering a per-neighbour aux grace
+                // here would pay back the latency that gate just recovered. The evidence is
+                // free; only the verdict changes.
+                //
+                // WHICH verdicts change, stated without overreach. Where the auxiliary's
+                // budget is the MAX over waited servers (`perServerTimeout` is
+                // `min(callerCap, strategyWait)` per server, `timeoutMs` is the max across
+                // them), a silent auxiliary already tripped `diagnosticsTimedOut` and the
+                // touch was already `inconclusive` — which is decided BEFORE the coverage
+                // gap, so those results are unchanged. That covers opengrep on every current
+                // per-edit path, whose 3500 exceeds either cap. But a FASTER auxiliary beside
+                // a slower primary (typos 1500 or ast-grep 1800 next to rust-analyzer 3000
+                // under a 2000 cap) settles inside `timeoutMs`, so nothing timed out and this
+                // block genuinely narrows a result that used to read `confirmed`. That is the
+                // fix working: the scanner said nothing about these bytes. It is fail-safe —
+                // the primary's findings still ride along and only the coverage claim is
+                // withdrawn — and the cost is a skipped cache seed for that file. Both cases
+                // are pinned in `tests/clients/lsp/service-aux-grace.test.ts`.
+                //
+                // `cut_off` cannot arise on this path — there is no grace timer to end a
+                // wait early — so the shapes are `answered` / `silent` / `deferred`, decided
+                // by exactly the rules the grace path uses (#1458 S1: a settled promise is
+                // not proof of a publication; only a `diagnosticsVersion` advance past the
+                // pre-notify baseline is). `waitShape` distinguishes the two producers in
+                // field data, since a `silent` row here means the auxiliary's own full
+                // per-server budget lapsed rather than our ceiling cutting it short.
+                //
+                // A server the caller EXCLUDED (`WORKSPACE_SWEEP_EXCLUDED_SERVER_IDS`, #584)
+                // never reaches `spawned`, so it cannot be reported here — an excluded-by-
+                // design scanner is a routing decision, not a coverage gap, exactly as
+                // `brokenSkippedAuxiliaryServerIds` already treats it.
+                //
+                // Written as `!hasTouchAuxiliaries` rather than `clientScope === "all"` so a
+                // future scope that spawns auxiliaries without entering the grace wait fails
+                // closed here by default instead of needing to be remembered. The #707
+                // tsserver sync race can reach here with `pushWait` still pending, but it is
+                // gated on `clientScope === "primary" && spawned.length === 1`, which spawns
+                // no auxiliaries at all — so the per-role filter below is empty and no
+                // evidence is read before its wait ends.
+                //
+                // `elapsedMs` and `elapsedSinceNotifyMs` are equal by construction here:
+                // there is no separate post-primary aux phase to measure, so both describe
+                // the one aggregate wait. Both fields are kept so a query can read either
+                // producer's rows without special-casing the schema.
+                //
+                // The evidence is read PER PATH, through the same `readPathVersion` accessor
+                // the grace path uses (#1531, landed on master while this was in review).
+                // This is NOT interchangeable with `client.diagnosticsVersion`: that global
+                // counter also advances for files this touch never mentions, so two
+                // CONCURRENT touches sharing one auxiliary client cross-satisfy — a
+                // publication for a.ts hands b.ts an unearned `answered`. That matters
+                // especially here, because the highest-frequency `"all"` caller (the cascade
+                // neighbour fan-out in `clients/dispatch/integration.ts`) is a
+                // `Promise.allSettled` and its touches are always concurrent. Reading the
+                // per-path stamp keeps this comparison on the SAME axis `baseline` was
+                // captured on, and `undefined` from a double that predates the accessor fails
+                // CLOSED rather than silently reverting to the global counter.
+                if (!hasTouchAuxiliaries && options.collectDiagnostics === true) {
+                    const auxEntries = spawned.filter((entry) => entry.info.role === "auxiliary");
+                    if (auxEntries.length > 0) {
+                        const outcomes = auxEntries.map((entry) => {
+                            const baseline = diagnosticBaselines.get(entry.client);
+                            const currentPathVersion = readPathVersion(entry.client);
+                            const publishedEvidence = Number.isFinite(baseline) &&
+                                currentPathVersion !== undefined &&
+                                currentPathVersion > baseline;
+                            return {
+                                serverId: entry.info.id,
+                                outcome: deferredResyncServerIds.has(entry.info.id)
+                                    ? "deferred"
+                                    : publishedEvidence
+                                        ? "answered"
+                                        : "silent",
+                                publishedThisContent: auxCoversThisContent(entry.info.id),
+                                budgetMs: timeoutFor(entry.client.serverId),
+                                elapsedMs: waitedMs,
+                                elapsedSinceNotifyMs: waitedMs,
+                            };
+                        });
+                        const uncovered = auxiliaryCoverageGap(outcomes);
+                        if (uncovered.length > 0)
+                            auxUnconfirmedServerIds = uncovered;
+                        logLatency({
+                            type: "phase",
+                            phase: "lsp_aux_wait_outcome",
+                            filePath: normalizedPath,
+                            durationMs: waitedMs,
+                            metadata: { clientScope, waitShape: "aggregate", outcomes },
+                        });
+                    }
+                }
                 if (tsserverSyncConfirmed !== undefined) {
                     // #707: the racing sync confirm won — a definitive answer well under
                     // the push-wait budget. Not a timeout, not inconclusive.
@@ -2243,8 +3535,59 @@ export class LSPService {
                     // Within ~20 ms of the configured budget we treat it as a timeout;
                     // the LSP didn't beat the cap. Diagnostics that arrive late still
                     // land in the client's cache and surface on the next edit.
-                    diagnosticsTimedOut = true;
-                    for (const entry of spawned) {
+                    //
+                    // #1549: WHOSE budget lapsed decides the verdict. `timeoutMs` is the MAX
+                    // over the servers waited on, so a slow auxiliary (opengrep declares
+                    // 3500ms) sets the aggregate deadline for the whole touch — and a
+                    // touch-wide `diagnosticsTimedOut = true` then discarded a primary answer
+                    // that landed in 100ms. Attribute the lapse per server instead: the
+                    // touch is inconclusive only when a PRIMARY produced no evidence; an
+                    // auxiliary that produced none becomes a named coverage gap below.
+                    //
+                    // Evidence, not promise settlement (#1458 S1): `waitForDiagnostics`
+                    // resolves on its own timeout, so a settled wait proves nothing. The
+                    // per-path publication stamp advancing past this touch's pre-notify
+                    // baseline (#1531) is the primary signal; a present per-file cache entry
+                    // is the second, because the notify this touch just sent cleared that
+                    // entry (`clearDiagnosticsForPath`), so a present one can only be a fresh
+                    // answer — the same signal #814's aggregate gate already trusts.
+                    //
+                    // Every unknown fails CLOSED: a client that exposes neither accessor
+                    // reads as unanswered, which for a primary is exactly the pre-#1549
+                    // verdict. This block can therefore only ever NARROW an inconclusive
+                    // touch, never create one.
+                    const answeredForThisTouch = (entry) => {
+                        const baseline = diagnosticBaselines.get(entry.client);
+                        const currentPathVersion = readPathVersion(entry.client);
+                        if (Number.isFinite(baseline) &&
+                            currentPathVersion !== undefined &&
+                            currentPathVersion > baseline) {
+                            return true;
+                        }
+                        try {
+                            return entry.client.getAllDiagnostics?.().has(normalizedPath) === true;
+                        }
+                        catch {
+                            // Fail closed: an unreadable cache is not evidence of an answer.
+                            return false;
+                        }
+                    };
+                    // A deferred server was never sent this content and is not waited on, so
+                    // it cannot have "timed out" — it is already reported as a coverage gap.
+                    const waited = spawned.filter((entry) => !deferredResyncServerIds.has(entry.info.id));
+                    const unanswered = waited.filter((entry) => !answeredForThisTouch(entry));
+                    diagnosticsUnansweredServerIds = unanswered.map((e) => e.info.id);
+                    diagnosticsUnansweredPrimaryServerIds = unanswered
+                        .filter((entry) => entry.info.role !== "auxiliary")
+                        .map((e) => e.info.id);
+                    // Fail-safe: a touch with no waited-on primary has no primary answer to
+                    // preserve, so it keeps the pre-#1549 touch-wide verdict rather than
+                    // absolving itself on an auxiliary's evidence.
+                    const hasWaitedPrimary = waited.some((entry) => entry.info.role !== "auxiliary");
+                    diagnosticsTimedOut =
+                        !hasWaitedPrimary ||
+                            diagnosticsUnansweredPrimaryServerIds.length > 0;
+                    for (const entry of unanswered) {
                         incrementDegradationCount({
                             kind: "lsp-diagnostics-timeout",
                             // `info.id` is the authoritative server identity carried by
@@ -2272,6 +3615,13 @@ export class LSPService {
                             clientScope,
                             diagnosticsMode,
                             timeoutMs,
+                            // #1549: which of those servers actually produced no evidence, and
+                            // whether the lapse is attributable to a primary (the touch is
+                            // inconclusive) or only to auxiliaries (a named coverage gap, with
+                            // the primary's findings intact). Without these two fields a
+                            // forensic sweep cannot tell the two apart at all.
+                            unansweredServerIds: diagnosticsUnansweredServerIds,
+                            attributedToPrimary: diagnosticsTimedOut,
                         },
                     });
                 }
@@ -2308,9 +3658,20 @@ export class LSPService {
                 // must have actually landed" conservatism #799 established — a
                 // server's silence is only evidence of "clean" when we know it saw
                 // the new content.
-                if (diagnosticsTimedOut && !notifyWriteTimedOut && clientScope === "all") {
+                //
+                // #1549: both the gate and its "still outstanding" set are PRIMARY-scoped.
+                // An auxiliary is never asked to prove itself tier3-silent here, because an
+                // auxiliary that never reported is already named as a coverage gap — and
+                // requiring it to was the second half of the touch-wide conflation: a clean
+                // markdown file whose marksman silence IS the answer stayed inconclusive
+                // purely because an opengrep scan beside it had not finished. The auxiliary's
+                // absence still costs the touch its full confirmation (`partial`); what it no
+                // longer does is erase the primary's answer.
+                if (diagnosticsTimedOut &&
+                    !primaryNotifyWriteTimedOut &&
+                    clientScope === "all") {
                     try {
-                        const outstanding = spawned.filter((entry) => !notifyWriteTimedOutServerIds.includes(entry.info.id) &&
+                        const outstanding = primaryEntries.filter((entry) => !notifyWriteTimedOutServerIds.includes(entry.info.id) &&
                             !entry.client.getAllDiagnostics().has(normalizedPath));
                         if (outstanding.length > 0) {
                             const snapshots = await this.getCapabilitySnapshots(filePath);
@@ -2329,6 +3690,7 @@ export class LSPService {
                                 const liveness = await Promise.all(outstanding.map((entry) => (entry.client.pingLiveness?.() ?? Promise.resolve(true)).catch(() => false)));
                                 if (liveness.every(Boolean)) {
                                     diagnosticsTimedOut = false;
+                                    retractPrimaryTimeoutAttribution(); // #1549
                                     logLatency({
                                         type: "phase",
                                         phase: "lsp_silent_clean_confirm",
@@ -2352,6 +3714,55 @@ export class LSPService {
                     }
                 }
             }
+            // #1586: THE coverage evaluation, taken ONCE, here — the last statement before
+            // the merge, with no `await` between it and the drop it authorizes. Everything
+            // that shares the merge's consequences reads this frozen set and never asks
+            // the live predicate again.
+            //
+            // The review round on this change proved why the freeze has to be the unit.
+            // `touchFile` awaits after the merge — `brokenSkippedAuxiliaryServerIds` on
+            // every collecting touch, the tsserver sync and liveness gates on theirs — and
+            // a publication landing in that window flips the live predicate. Re-asking it
+            // when the coverage gap was named then un-named a scanner whose findings the
+            // merge had ALREADY dropped: `.diags` missing the scanner's answer while the
+            // touch claimed `confirmed`, which unblocks the `lastKnownDiagnostics` prime
+            // and the `demonstratedReady` mark that `coverageGap` exists to hold shut.
+            // That is #1459's blackout reading as scanned-clean — the overclaim direction,
+            // and the worse one. A drop is an action; a later answer cannot undo it, so
+            // the naming must be settled from the same instant that authorized it.
+            const auxCoveredAtMerge = new Set(spawned
+                .filter((entry) => auxCoversThisContent(entry.info.id))
+                .map((entry) => entry.info.id));
+            // Which DEFERRED auxiliaries this touch genuinely carries no evidence from.
+            // The deferral itself only proves the gate did not send these bytes on THIS
+            // touch; whether the scanner has reported on them is a content-hash question.
+            const uncoveredDeferredServerIds = notifyDeferredServerIds.filter((serverId) => !auxCoveredAtMerge.has(serverId));
+            // An AUXILIARY whose notify write never landed still holds the previous
+            // content's findings — nothing cleared its cache — and before this change that
+            // touch was blanket `inconclusive`, so no consumer read the merged array. Now
+            // the primary's answer flows, which means the auxiliary's stale findings would
+            // flow with it and be reported (with the previous revision's line numbers) as
+            // this touch's answer. Drop them; the write failure is reported as a coverage
+            // gap instead.
+            // Auxiliaries only. A PRIMARY keeps #570's deliberate
+            // timeout-preserves-last-known-diagnostics semantics, and its write failure
+            // makes the touch inconclusive anyway, so no consumer reads the array as
+            // current.
+            const staleWriteAuxiliaryServerIds = spawned
+                .filter((entry) => entry.info.role === "auxiliary" &&
+                notifyWriteTimedOutServerIds.includes(entry.info.id) &&
+                !auxCoveredAtMerge.has(entry.info.id))
+                .map((entry) => entry.info.id);
+            // #1586: every contribution this merge withholds, in one set. The merged
+            // BINDING reads it too (#1459's door, which filtered the raw deferral set and
+            // so excluded the fingerprint of a deferred-but-covered scanner whose findings
+            // the merge had just kept) — a dropped contributor must lose its findings and
+            // its binding together, or the merged `boundToCurrentDisk` describes bytes the
+            // result no longer contains.
+            const droppedAuxiliaryServerIds = new Set([
+                ...uncoveredDeferredServerIds,
+                ...staleWriteAuxiliaryServerIds,
+            ]);
             // #707: when the racing sync confirm won the wait, its answer IS the
             // collected result — the file's real syntactic + semantic state straight
             // from tsserver (clean = [], dirty = real findings that a silentOnClean
@@ -2361,7 +3772,17 @@ export class LSPService {
                 ? tsserverSyncConfirmed !== undefined
                     ? mergeLspDiagnostics(tsserverSyncConfirmed)
                     : mergeLspDiagnostics([
-                        ...spawned.flatMap((entry) => entry.client.getDiagnostics(filePath)),
+                        // #1459: a DEFERRED server's cache still holds the PREVIOUS
+                        // content's findings — the resync that would have cleared it never
+                        // ran. Merging them would report another revision's findings (and
+                        // its line numbers) as this touch's answer, the one hazard the
+                        // gate itself creates. Drop them; the gap is reported instead.
+                        // #1586: unless the scanner has since published for exactly these
+                        // bytes — `droppedAuxiliaryServerIds` is the one frozen answer the
+                        // coverage naming and the merged binding read too.
+                        ...spawned.flatMap((entry) => droppedAuxiliaryServerIds.has(entry.info.id)
+                            ? []
+                            : entry.client.getDiagnostics(filePath)),
                         ...carriedAuxiliary.flatMap((entry) => entry.diags),
                     ])
                 : undefined;
@@ -2399,6 +3820,7 @@ export class LSPService {
                         // Sync answered — confirmed result (clean or with diagnostics).
                         // Clear the timed-out flag so the touch is no longer inconclusive.
                         diagnosticsTimedOut = false;
+                        retractPrimaryTimeoutAttribution(); // #1549
                         syncConfirmed = true;
                         collected = syncResult.length > 0
                             ? mergeLspDiagnostics(syncResult)
@@ -2457,7 +3879,10 @@ export class LSPService {
             // into the general one once both have soaked, but that's a separate,
             // lower-risk follow-up, not bundled into this fix.
             if (diagnosticsTimedOut &&
-                !notifyWriteTimedOut &&
+                // #1549: primary-scoped, like the aggregate gate. `spawned.length === 1`
+                // below means the one server IS the primary, so this is the same condition
+                // written in the vocabulary the rest of the merge now uses.
+                !primaryNotifyWriteTimedOut &&
                 !tsserverSyncEligible &&
                 clientScope === "primary" &&
                 spawned.length === 1 &&
@@ -2474,6 +3899,7 @@ export class LSPService {
                         const alive = await (spawned[0].client.pingLiveness?.() ?? Promise.resolve(true)).catch(() => false);
                         if (alive) {
                             diagnosticsTimedOut = false;
+                            retractPrimaryTimeoutAttribution(); // #1549
                             if (collected !== undefined)
                                 collected = mergeLspDiagnostics([]);
                             logLatency({
@@ -2496,32 +3922,138 @@ export class LSPService {
                     // behavior.
                 }
             }
-            // A touch is inconclusive when EITHER the notify write or the
-            // diagnostics wait hit their deadline for ANY of the spawned servers
-            // (these flags are touch-wide, covering the whole `Promise.all` over
-            // `spawned` — see the field doc on the return type). We deliberately
-            // err toward caution here: `collected` merges diagnostics across every
-            // spawned server, so even a partial timeout (e.g. a slow auxiliary
-            // while the primary answered) means the merged result may be missing
-            // findings that just hadn't arrived yet — it must not be trusted as a
-            // confirmed answer.
-            const inconclusive = notifyWriteTimedOut || diagnosticsTimedOut;
-            // #1470: an auxiliary whose push wait was CUT OFF by the aux grace timer
-            // (R8/#714) contributed exactly as much evidence about this file as one that
-            // went silent inside its own budget — none. A hung opengrep resolved
-            // `confirmation: "confirmed"` and read as confirmed-clean on the security
-            // lane. (The SILENT case still does, and is NOT addressed here: a scanner
-            // that settles inside its own budget without publishing also yields an
-            // unqualified confirmation. Same #533 class, same lane, different door —
-            // filed as #1493, deliberately untouched by this change.)
+            // #1549: a touch is inconclusive when a PRIMARY's notify write or the
+            // diagnostics wait hit their deadline. Both inputs are primary-scoped now.
+            //
+            // The rule this replaced — `notifyWriteTimedOut || diagnosticsTimedOut`, both
+            // flags touch-wide over every spawned server — discarded every good answer in
+            // the touch whenever one auxiliary was slow. `timeoutMs` is the MAX over the
+            // servers waited on, so opengrep's 3500ms budget set the deadline for the whole
+            // touch and a typescript answer that landed in 100ms read as "nothing is known
+            // about this file". Measured over 6,079 cascade neighbour sweeps: 97.6%
+            // inconclusive, against 15% for ordinary edit-time touches in the same window.
+            //
+            // The caution the old comment argued for is preserved, in the honest place: the
+            // merged result IS missing whatever the unreporting auxiliary would have said,
+            // so the touch withdraws its claim of full coverage (`confirmation: "partial"`
+            // plus `unconfirmedServerIds`, below) and every consumer that treats
+            // confirmation as proof of coverage still fails closed. What it no longer does
+            // is throw away the primary's answer, which is the #533 honesty doctrine
+            // cutting both ways.
+            const verdict = resolveTouchVerdict({
+                primaryNotifyWriteTimedOutServerIds,
+                diagnosticsTimedOut,
+                diagnosticsUnansweredServerIds: diagnosticsUnansweredPrimaryServerIds,
+            });
+            const inconclusive = verdict.inconclusive;
+            // #1470/#1493: an auxiliary whose push wait was CUT OFF by the aux grace
+            // timer (R8/#714) contributed exactly as much evidence about this file as one
+            // that went silent inside its own budget — none. Both now narrow the
+            // confirmation, through the one `auxiliaryCoverageGap` policy. A hung or
+            // silent opengrep used to resolve `confirmation: "confirmed"` and read as
+            // confirmed-clean on the security lane; the silent half survived #1470
+            // because it only tripped `diagnosticsTimedOut` when it was the ONLY
+            // auxiliary, so a fast sibling hid it (#1493).
             // This does NOT flip the touch to inconclusive: that would discard a
             // primary answer that IS trustworthy (#533 honesty doctrine cuts both ways —
             // overclaiming and underclaiming are both dishonest). Instead the confirmation
             // is NARROWED: `"partial"`, naming the servers it does not speak for, so every
             // consumer that treats confirmation as proof of coverage fails closed while
             // the primary's findings still flow.
-            const unconfirmedServerIds = auxCutOffServerIds ?? [];
+            // #1459: two more doors into the same room, and they open BEFORE any wait —
+            // so `auxiliaryCoverageGap` (which reads wait outcomes) cannot see either on
+            // its own. A scanner whose breaker was open never attached, and one whose
+            // resync the fan-out gate deferred never received this content.
+            //
+            // The deferred ids are unioned in rather than left to the aux-wait policy on
+            // purpose: an aux outcome row requires an auxiliary to have been SPAWNED, and a
+            // breaker-skipped scanner never was. #1533: an `"all"`-scope sweep emits outcome
+            // rows now too, so a spawned-but-deferred server arrives through BOTH routes as
+            // outcome `"deferred"` — where a stored publication
+            // for these exact bytes can still exempt it — so the Set dedups rather than
+            // double-reports, and #1493's content-hash exemption is not bypassed here:
+            // a deferred aux is only unioned in because the gate itself proves it was
+            // never sent this content.
+            const brokenSkippedServerIds = collected !== undefined
+                ? await this.brokenSkippedAuxiliaryServerIds(filePath, clientScope, options, spawned)
+                : [];
+            // #1549: the fourth door, and the one this issue opened. An auxiliary that
+            // missed a deadline no longer makes the touch inconclusive, so it MUST arrive
+            // here instead — otherwise the fix would launder a scanner blackout into a
+            // clean bill of health, which is the #1459/#1493 false-clean pointing the other
+            // way. Two shapes reach this and no aux outcome row: an auxiliary whose notify
+            // write timed out or rejected, and one that produced no publication evidence
+            // when the wait lapsed (including on a NON-collecting touch, which derives no
+            // outcome rows at all). The content-bound exemption is honored through the same
+            // `auxCoversThisContent` predicate the merge uses — one rule, so a scanner
+            // cannot be named uncovered while its findings ride along in `.diags`, or the
+            // reverse. The Set dedups against the ids `auxiliaryCoverageGap` reported.
+            const auxNoAnswerServerIds = spawned
+                .filter((entry) => entry.info.role === "auxiliary" &&
+                (diagnosticsUnansweredServerIds.includes(entry.info.id) ||
+                    notifyWriteTimedOutServerIds.includes(entry.info.id)) &&
+                !auxCoveredAtMerge.has(entry.info.id))
+                .map((entry) => entry.info.id);
+            // #1586: whatever the doors contributed, the RESULT's coverage claim is
+            // settled from the MERGE's frozen evaluation — never a fresh one, which is
+            // what made this an overclaim in review (see `auxCoveredAtMerge`). The
+            // per-door filters above are not redundant with this one: they shape the
+            // `lsp_scanner_coverage_gap` fields, which each answer "what did THIS door
+            // see", while this settles "what does the touch speak for". It matters most
+            // for `auxUnconfirmedServerIds`, decided when the aux wait ended and therefore
+            // strictly BEFORE the merge — reconciling it here is what keeps a scanner from
+            // being named while the merge kept its findings. A breaker-skipped scanner
+            // never reached `spawned`, so it is not in the covered set and stays named:
+            // fail closed.
+            const unconfirmedServerIds = [
+                ...new Set([
+                    ...(auxUnconfirmedServerIds ?? []),
+                    ...auxNoAnswerServerIds,
+                    ...uncoveredDeferredServerIds,
+                    ...brokenSkippedServerIds,
+                ]),
+            ].filter((serverId) => !auxCoveredAtMerge.has(serverId));
             const coverageGap = unconfirmedServerIds.length > 0;
+            // The record that proves a blackout is no longer read as clean: one row per
+            // touch that a scanner did not cover, naming the scanner and the reason.
+            if (brokenSkippedServerIds.length > 0 ||
+                uncoveredDeferredServerIds.length > 0 ||
+                // #1549: the auxiliary deadline misses that used to surface as a blanket
+                // `inconclusive` need their own row now that the touch reports usable
+                // findings — otherwise the fix would remove the only record of the blackout.
+                auxNoAnswerServerIds.length > 0) {
+                for (const serverId of unconfirmedServerIds) {
+                    const reasons = [
+                        brokenSkippedServerIds.includes(serverId) && "breaker skip",
+                        uncoveredDeferredServerIds.includes(serverId) && "deferred resync",
+                        auxNoAnswerServerIds.includes(serverId) && "no diagnostics answer",
+                    ].filter(Boolean);
+                    incrementDegradationCount({
+                        kind: "lsp-scanner-coverage-gap",
+                        subject: `${serverId}:${normalizedPath}`,
+                        reason: reasons.join(", ") || "scanner coverage gap",
+                    });
+                }
+                logLatency({
+                    type: "phase",
+                    phase: "lsp_scanner_coverage_gap",
+                    filePath: normalizedPath,
+                    durationMs: Date.now() - startedAt,
+                    metadata: {
+                        source,
+                        clientScope,
+                        ...(brokenSkippedServerIds.length > 0 && { brokenSkippedServerIds }),
+                        // #1586: the deferrals this touch is actually uncovered for. The raw
+                        // gate action keeps its own record in `lsp_notify_resync_deferred`;
+                        // this row exists to prove a blackout, and a scanner already bound to
+                        // these bytes is not one.
+                        ...(uncoveredDeferredServerIds.length > 0 && {
+                            deferredResyncServerIds: uncoveredDeferredServerIds,
+                        }),
+                        ...(auxNoAnswerServerIds.length > 0 && { auxNoAnswerServerIds }),
+                    },
+                });
+            }
             // #667: a confirmed (non-inconclusive) diagnostics-mode touch is the
             // "actually warm" signal `ensureWarmForSweep` waits for — mark every
             // spawned server so a later sweep in this session sees the check as a
@@ -2533,9 +4065,10 @@ export class LSPService {
             // timed out are skipped here (rather than gating the whole loop on the
             // file-level `inconclusive`).
             //
-            // #1470: same per-server reasoning for a CUT-OFF auxiliary. "Demonstrated
-            // ready" means this server answered for this file; an auxiliary our grace
-            // timer cut off demonstrably did not.
+            // #1470/#1493: same per-server reasoning for an auxiliary that contributed
+            // no evidence. "Demonstrated ready" means this server answered for this
+            // file; an auxiliary our grace timer cut off, or one that stayed silent
+            // through its own budget, demonstrably did not.
             //
             // NO TEST PINS THIS LINE, and that is a property of today's readers rather
             // than a coverage gap: `ensureWarmForSweep` filters `role === "auxiliary"`
@@ -2545,13 +4078,23 @@ export class LSPService {
             // because the mark's meaning is "this server answered", and the moment any
             // reader stops filtering auxiliaries out, marking a cut-off scanner warm
             // would let it skip a warm-up it never earned.
+            //
+            // #1549: `diagnosticsTimedOut` is primary-attributed now, so this loop can be
+            // reached with an auxiliary that never answered — including on a NON-COLLECTING
+            // touch, which derives no aux wait-outcome rows. `unconfirmedServerIds` covers
+            // that case because `auxNoAnswerServerIds` is computed for every touch, not only
+            // a collecting one; an unheard scanner is therefore already excluded here and
+            // needs no separate guard. A primary cannot reach this loop unheard at all: it
+            // would have set `diagnosticsTimedOut`, and the gates that clear that flag
+            // retract its attribution precisely because they certified its silence AS the
+            // answer (`retractPrimaryTimeoutAttribution`).
             const notifyTimedOutServerIds = new Set(notifyWriteTimedOutServerIds);
-            const cutOffServerIds = new Set(unconfirmedServerIds);
+            const uncoveredServerIds = new Set(unconfirmedServerIds);
             if (diagnosticsMode !== "none" && !diagnosticsTimedOut) {
                 for (const entry of spawned) {
                     if (notifyTimedOutServerIds.has(entry.info.id))
                         continue;
-                    if (cutOffServerIds.has(entry.info.id))
+                    if (uncoveredServerIds.has(entry.info.id))
                         continue;
                     const key = await this.demonstratedReadyKeyFor(entry.info, filePath);
                     if (key)
@@ -2567,8 +4110,8 @@ export class LSPService {
             // empty `collected` must never erase a previously-confirmed non-empty
             // record (that's the #570 bug — a timeout silently reporting as clean
             // and wiping out known-good diagnostic state).
-            // #1470: a PARTIAL touch is the same hazard wearing a different flag. Its
-            // merged array is missing whatever the cut-off auxiliary would have said, so
+            // #1470/#1493: a PARTIAL touch is the same hazard wearing a different flag.
+            // Its merged array is missing whatever the unreporting auxiliary would have said, so
             // priming the cache with it would let `actionable-warnings`' hash-guarded
             // read replay a partially-covered result as an authoritative observation —
             // and an empty one would DELETE a previously-confirmed record on the strength
@@ -2597,12 +4140,23 @@ export class LSPService {
             const result = { diags: collected ?? [] };
             if (collected !== undefined && inconclusive) {
                 result.inconclusive = true;
+                // #1549: name the primary that produced the verdict and which deadline it
+                // missed, so a forensic sweep reads the cause instead of inferring it from
+                // duration histograms. Absent ids on an inconclusive touch mean the
+                // attribution was not derivable (a client with no per-path publication
+                // stamp) — honest, and the same fail-closed verdict as before.
+                if (verdict.inconclusiveServerIds) {
+                    result.inconclusiveServerIds = verdict.inconclusiveServerIds;
+                }
+                result.inconclusiveReason = verdict.inconclusiveReason;
             }
             else if (collected !== undefined && coverageGap) {
-                // #1470: narrowed, not collapsed. The primary's findings ride along in
-                // `.diags` exactly as before; what changes is that the touch now states
-                // which servers it does not speak for, so no consumer can read this as a
-                // full clean bill of health.
+                // #1470/#1493: narrowed, not collapsed. Reached for EITHER no-answer
+                // shape — a cut-off auxiliary or a silent one with nothing published for
+                // this content. The primary's findings ride along in `.diags` exactly as
+                // before; what changes is that the touch now states which servers it does
+                // not speak for, so no consumer can read this as a full clean bill of
+                // health.
                 result.confirmation = "partial";
                 result.unconfirmedServerIds = [...unconfirmedServerIds];
             }
@@ -2630,7 +4184,17 @@ export class LSPService {
                     // partially-mocked client) yields "unknown" rather than throwing —
                     // unknown preserves pre-#1095 behavior for that contributor.
                     [
-                        ...spawned.map((entry) => entry.client.getDiagnosticBinding?.(filePath)),
+                        // #1459/#1549: a contributor whose findings the merge DROPPED must
+                        // not decide the merged verdict either — its binding describes
+                        // bytes this result no longer contains.
+                        // #1586: read off the same frozen set the drop used. Filtering the
+                        // raw deferral set instead excluded the fingerprint of a
+                        // deferred-but-COVERED scanner whose findings the merge had just
+                        // kept, which diverges whenever the primary is version-less and
+                        // that scanner is the only contributor with a fingerprint.
+                        ...spawned
+                            .filter((entry) => !droppedAuxiliaryServerIds.has(entry.info.id))
+                            .map((entry) => entry.client.getDiagnosticBinding?.(filePath)),
                         ...carriedAuxiliary.map((entry) => entry.binding),
                     ]);
                 result.binding = binding;
@@ -2671,6 +4235,16 @@ export class LSPService {
                     }),
                     diagnosticsTimedOut,
                     inconclusive,
+                    // #1549: the attribution the issue's observability contract asks for —
+                    // WHICH primary made the touch inconclusive and which deadline it missed
+                    // (`notify-write` vs `diagnostics-wait`, or `mixed`). Absent on a
+                    // conclusive touch, which blames nobody.
+                    ...(verdict.inconclusiveServerIds && {
+                        inconclusiveServerIds: verdict.inconclusiveServerIds,
+                    }),
+                    ...(verdict.inconclusiveReason && {
+                        inconclusiveReason: verdict.inconclusiveReason,
+                    }),
                     // #1470: the touch's own honesty verdict, so a `cut_off` row in
                     // `lsp_aux_wait_outcome` can be joined to the touch that produced it and
                     // shown NOT to have claimed confirmation for that server's coverage.
@@ -2683,6 +4257,32 @@ export class LSPService {
                     // Absent when no aux was cut off. These servers' diagnostics are
                     // advisory-only and will surface on the next edit from their cache.
                     ...(auxCutOffServerIds !== undefined && { auxCutOffServerIds }),
+                    // #1493: the full set the confirmation was narrowed on — the cut-off
+                    // ids plus every auxiliary that stayed silent with nothing published
+                    // for this content. Absent when the touch speaks for every server.
+                    // This is the join key for the issue's observability contract: a
+                    // `silent` row in `lsp_aux_wait_outcome` must appear here, on a touch
+                    // whose `confirmation` is `"partial"`.
+                    ...(auxUnconfirmedServerIds !== undefined && {
+                        auxUnconfirmedServerIds,
+                    }),
+                    // #1459: scanners this touch does not speak for because their breaker
+                    // was open, or because the resync gate deferred their write. Separate
+                    // fields because these two doors open BEFORE any wait, so neither can
+                    // appear in an `lsp_aux_wait_outcome` row on the sweep path. Absent
+                    // when every configured scanner got this content — #1586 included: a
+                    // deferred scanner already bound to these bytes is covered, so it is not
+                    // named here either. The gate's own action is recorded regardless, in
+                    // `lsp_notify_resync_deferred`.
+                    ...(brokenSkippedServerIds.length > 0 && { brokenSkippedServerIds }),
+                    ...(uncoveredDeferredServerIds.length > 0 && {
+                        deferredResyncServerIds: uncoveredDeferredServerIds,
+                    }),
+                    // #1549: auxiliaries whose own deadline lapsed — the wait produced no
+                    // publication, or the notify write never landed. Distinct from the fields
+                    // above (a different door) and from `auxUnconfirmedServerIds` (derived
+                    // from aux wait-outcome rows, which a non-collecting touch never emits).
+                    ...(auxNoAnswerServerIds.length > 0 && { auxNoAnswerServerIds }),
                 },
             });
             return result;
@@ -2918,8 +4518,15 @@ export class LSPService {
         this.lastKnownContentHash.delete(normalizedPath);
         return merged;
     }
+    /**
+     * Delegates to {@link hashDiagnosticContent} rather than re-hashing here. Every
+     * comparison this hash takes part in (`publishedThisContent`, the carried-aux
+     * check, the last-known content guard) is against a hash the client produced
+     * with that function, so the two implementations must agree byte for byte —
+     * a duplicate is a silent divergence waiting for one of them to be tuned.
+     */
     hashContent(content) {
-        return createHash("sha256").update(content).digest("hex");
+        return hashDiagnosticContent(content);
     }
     /**
      * #1095: compose the content `binding` for a merged diagnostics result across
@@ -2962,6 +4569,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().definition) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for definition");
+        }
         return spawned.client.definition(filePath, line, character);
     }
     /**
@@ -2971,6 +4581,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().typeDefinition) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for typeDefinition");
+        }
         return spawned.client.typeDefinition(filePath, line, character);
     }
     /**
@@ -2980,6 +4593,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().declaration) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for declaration");
+        }
         return spawned.client.declaration(filePath, line, character);
     }
     /**
@@ -2989,6 +4605,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().references) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for references");
+        }
         return spawned.client.references(filePath, line, character, includeDeclaration);
     }
     /**
@@ -2998,6 +4617,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return null;
+        if (!spawned.client.getOperationSupport().hover) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for hover");
+        }
         return spawned.client.hover(filePath, line, character);
     }
     /**
@@ -3007,6 +4629,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return null;
+        if (!spawned.client.getOperationSupport().signatureHelp) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for signatureHelp");
+        }
         return spawned.client.signatureHelp(filePath, line, character);
     }
     /**
@@ -3016,44 +4641,116 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().documentSymbol) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for documentSymbol");
+        }
         return spawned.client.documentSymbol(filePath);
     }
+    /**
+     * Resolves "the target client" for a workspace-scope query that has no
+     * filePath to route through `getClientForFile`. `state.clients` is keyed
+     * `${serverId}:${root}` in spawn order, not role order, so an auxiliary
+     * scanner (ast-grep, opengrep, zizmor, ...) that happens to spawn first in
+     * a polyglot workspace used to win every no-filePath query outright (#1812
+     * — a supporting primary server spawned later never got a look-in). Scans
+     * for the first LIVE client matching `predicate` (when given), preferring
+     * any primary (non-`"auxiliary"` role) match over an auxiliary one — the
+     * same primary-over-auxiliary preference `getClientForFile` encodes via
+     * its `role !== "auxiliary"` filter (this file, `getClientForFile`) and
+     * `getAliveServerIds` groups by. `isAlive()` is required for BOTH the
+     * preferred and fallback candidate — mirrors `getCapabilitySnapshots`'s
+     * own no-filePath branch (this file, ~line 5868), whose liveness filter
+     * this helper otherwise duplicates; without it a dead primary would win
+     * over a live, answering auxiliary. Role is read from the map key's
+     * `serverId` prefix against `LSP_SERVERS`, the same single source of
+     * truth `getCapabilitySnapshots` already parses that key from — never a
+     * second, hand-rolled role table. A `serverId` prefix absent from
+     * `LSP_SERVERS` (should not happen in practice — every spawned client's
+     * key is built from a known server's `id`) resolves to `role === undefined`,
+     * which falls through to the primary branch: unknown treated as primary,
+     * never silently dropped. Returns undefined only when NO live client
+     * (primary or auxiliary) matches.
+     */
+    selectWorkspaceScopeClient(predicate) {
+        let auxFallback;
+        for (const [key, client] of this.state.clients) {
+            if (!client.isAlive())
+                continue;
+            if (predicate && !predicate(client))
+                continue;
+            const separator = key.indexOf(":");
+            const serverId = separator >= 0 ? key.slice(0, separator) : key;
+            const role = LSP_SERVERS.find((s) => s.id === serverId)?.role;
+            if (role === "auxiliary") {
+                if (!auxFallback)
+                    auxFallback = { client, serverId };
+                continue;
+            }
+            return { client, serverId };
+        }
+        return auxFallback;
+    }
     /**
      * Navigation: workspace-wide symbol search
+     *
+     * #1789: gated on the target server's advertised `workspaceSymbolProvider`
+     * (the same `getOperationSupport().workspaceSymbol` single source of truth
+     * `lsp-document-symbols.ts`'s documentSymbol gate reads — see clients/
+     * lsp-document-symbols.ts:50).
+     *
+     * #1812: without a path, the no-filePath branch used to stop at
+     * `state.clients`' first entry by insertion order regardless of whether it
+     * supported `workspace/symbol` — an auxiliary spawned first silently ate
+     * every query with `[]` and zero requests, even when a supporting primary
+     * server was already spawned too. `selectWorkspaceScopeClient` now scans
+     * for the first client that DOES support it, preferring a primary over an
+     * auxiliary; only when none of the spawned clients support it does this
+     * fall back to `[]`.
      */
-    async workspaceSymbol(query, filePath) {
+    async workspaceSymbol(query, filePath, attribution) {
         if (filePath) {
             const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
             if (!spawned)
                 return [];
+            if (!spawned.client.getOperationSupport().workspaceSymbol)
+                return [];
             return spawned.client.workspaceSymbol(query);
         }
-        // Use the first active client for workspace-level queries
-        const clients = Array.from(this.state.clients.values());
-        if (clients.length === 0)
+        const target = this.selectWorkspaceScopeClient((client) => client.getOperationSupport().workspaceSymbol);
+        if (!target)
             return [];
-        return clients[0].workspaceSymbol(query);
+        if (attribution)
+            attribution.workspaceSymbol = target.serverId;
+        return target.client.workspaceSymbol(query);
     }
     /**
      * Commands advertised for workspace/executeCommand. If filePath is given,
-     * the server for that file; otherwise the first active client.
+     * the server for that file; otherwise the first active client, preferring
+     * a primary over an auxiliary scanner spawned first (#1812 sweep — see
+     * `selectWorkspaceScopeClient`).
      */
-    async getAdvertisedCommands(filePath) {
+    async getAdvertisedCommands(filePath, attribution) {
         if (filePath) {
             const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
             if (!spawned)
                 return [];
             return spawned.client.getAdvertisedCommands();
         }
-        const first = this.state.clients.values().next().value;
-        return first ? first.getAdvertisedCommands() : [];
+        const first = this.selectWorkspaceScopeClient();
+        if (!first)
+            return [];
+        if (attribution)
+            attribution.getAdvertisedCommands = first.serverId;
+        return first.client.getAdvertisedCommands();
     }
     /**
      * Run a server command via workspace/executeCommand (hardened: allowlisted by
      * advertisement in the client). If filePath is given, target that file's
-     * server; otherwise the first active client.
+     * server; otherwise the first active client, preferring a primary over an
+     * auxiliary scanner spawned first (#1812 sweep — see
+     * `selectWorkspaceScopeClient`).
      */
-    async executeCommand(filePath, command, args, mutationContext) {
+    async executeCommand(filePath, command, args, mutationContext, attribution) {
         if (filePath) {
             const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
             if (!spawned) {
@@ -3061,16 +4758,74 @@ export class LSPService {
             }
             return spawned.client.executeCommand(command, args, mutationContext);
         }
-        const first = this.state.clients.values().next().value;
+        const first = this.selectWorkspaceScopeClient();
         if (!first)
             return { executed: false, reason: "no active LSP server" };
-        return first.executeCommand(command, args, mutationContext);
+        if (attribution)
+            attribution.executeCommand = first.serverId;
+        return first.client.executeCommand(command, args, mutationContext);
+    }
+    /**
+     * #1640: run a read-only probe command against a server that is ALREADY
+     * running for this file. Two hard guarantees the mutation-channel
+     * `executeCommand` above cannot give a render-path probe:
+     *
+     * - **Never spawns.** It resolves the already-connected client map the way
+     *   `isServerAliveForFile` does, instead of routing through
+     *   `getClientForFile` → `ensureClientForServer`. A probe that spawns a
+     *   language-server fleet to answer a question about how to RENDER a
+     *   diagnostic is a cost the caller never asked for — and under warm attach
+     *   the freshly spawned server's answer would not even be the warm session's
+     *   answer.
+     * - **Never opens the mutation window.** `executeReadOnlyCommand` leaves
+     *   `serverEditsAllowed` and `activeMutationContext` alone, so an in-flight
+     *   real command's mutation context survives a concurrent probe.
+     *
+     * Returns `{executed:false}` — never a thrown error and never a spawn — when
+     * no live client owns the file. Callers must read that as UNKNOWN.
+     */
+    async executeReadOnlyCommandOnLiveClient(filePath, command, args) {
+        if (this.checkDestroyed()) {
+            return { executed: false, reason: "lsp service destroyed" };
+        }
+        for (const server of getServersForFileWithConfig(filePath)) {
+            const root = await this.resolveServerRoot(server, filePath);
+            if (!root)
+                continue;
+            const entry = this.state.clients.get(`${server.id}:${normalizeMapKey(root)}`);
+            if (!entry?.isAlive())
+                continue;
+            const run = entry.executeReadOnlyCommand;
+            if (typeof run !== "function")
+                continue;
+            return run.call(entry, command, args);
+        }
+        return { executed: false, reason: "no live LSP server for file" };
     }
     /**
      * Capability snapshot for LSP operations.
-     * If filePath is provided, probes that server; otherwise uses first active client.
+     * If filePath is provided, probes that server. Without a filePath the
+     * snapshot describes the whole workspace, so each capability is ORed
+     * across every client `selectWorkspaceScopeClient` would consider.
+     *
+     * #1846: the no-filePath branch used to report ONE client's capabilities,
+     * whichever `selectWorkspaceScopeClient()` returned with no predicate. In
+     * a multi-primary workspace (say `json` spawned before `typescript`), a
+     * first client that does not advertise `workspaceSymbolProvider` reported
+     * the operation unsupported even though a later client advertises it. The
+     * tool layer then refused the call before `workspaceSymbol()` — which
+     * #1812 taught to find the supporting client — was ever reached
+     * (tools/lsp-navigation.ts, the `runWorkspaceSymbolOperation` gate).
+     *
+     * Each capability resolves through `selectWorkspaceScopeClient` with a
+     * per-capability predicate, so this answer is built from the SAME liveness
+     * and primary-over-auxiliary rules that route the operation itself (see
+     * `selectWorkspaceScopeClient`, this file). A dead client therefore cannot
+     * contribute a capability nobody can execute. Capabilities the base client
+     * already reports true are skipped, so the extra scans only run for the
+     * capabilities it lacks.
      */
-    async getOperationSupport(filePath) {
+    async getOperationSupport(filePath, attribution) {
         if (filePath) {
             const spawned = await this.getClientForFile(filePath);
             if (!spawned)
@@ -3080,19 +4835,36 @@ export class LSPService {
                 return null;
             return getter();
         }
-        const first = this.state.clients.values().next().value;
+        const readable = (client) => typeof client.getOperationSupport === "function";
+        const first = this.selectWorkspaceScopeClient(readable);
         if (!first)
             return null;
-        const getter = first.getOperationSupport;
-        if (typeof getter !== "function")
-            return null;
-        return getter();
+        const aggregate = { ...first.client.getOperationSupport() };
+        const contributors = {};
+        for (const capability of Object.keys(aggregate)) {
+            if (aggregate[capability]) {
+                contributors[capability] = first.serverId;
+                continue;
+            }
+            const supporter = this.selectWorkspaceScopeClient((client) => readable(client) && Boolean(client.getOperationSupport()[capability]));
+            if (supporter) {
+                aggregate[capability] = true;
+                contributors[capability] = supporter.serverId;
+            }
+        }
+        if (attribution) {
+            attribution.getOperationSupport = {
+                baseClientId: first.serverId,
+                contributors,
+            };
+        }
+        return aggregate;
     }
     /**
      * Capability snapshot for workspace diagnostics support.
      * If filePath is provided, probes that server; otherwise uses first active client.
      */
-    async getCapabilitySnapshots(filePath) {
+    async getCapabilitySnapshots(filePath, attribution) {
         if (this.checkDestroyed())
             return [];
         const snapshots = [];
@@ -3132,9 +4904,17 @@ export class LSPService {
                 launchVariant: client.getLaunchVariant?.(),
             });
         }
+        if (attribution) {
+            attribution.getCapabilitySnapshots = {
+                clientIds: snapshots
+                    .slice(0, WORKSPACE_ATTRIBUTION_CLIENT_CAP)
+                    .map((snapshot) => snapshot.serverId),
+                clientCount: snapshots.length,
+            };
+        }
         return snapshots;
     }
-    async getWorkspaceDiagnosticsSupport(filePath) {
+    async getWorkspaceDiagnosticsSupport(filePath, attribution) {
         if (filePath) {
             const spawned = await this.getClientForFile(filePath);
             if (!spawned)
@@ -3144,13 +4924,15 @@ export class LSPService {
                 return null;
             return getter();
         }
-        const first = this.state.clients.values().next().value;
+        const first = this.selectWorkspaceScopeClient();
         if (!first)
             return null;
-        const getter = first.getWorkspaceDiagnosticsSupport;
+        const getter = first.client.getWorkspaceDiagnosticsSupport;
         if (typeof getter !== "function")
             return null;
-        return getter();
+        if (attribution)
+            attribution.getWorkspaceDiagnosticsSupport = first.serverId;
+        return getter.call(first.client);
     }
     /**
      * Navigation: available code actions at position/range
@@ -3159,6 +4941,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().codeAction) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for codeAction");
+        }
         return spawned.client.codeAction(filePath, line, character, endLine, endCharacter);
     }
     /**
@@ -3168,6 +4953,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return null;
+        if (!spawned.client.getOperationSupport().rename) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for rename");
+        }
         return spawned.client.rename(filePath, line, character, newName);
     }
     async renameFile(oldFilePath, newFilePath, options) {
@@ -3252,16 +5040,16 @@ export class LSPService {
         }));
         const closeFailures = [];
         await Promise.all(openDocuments.map(async ({ serverId, client }) => {
-            try {
-                await client.closeDocument(oldFilePath);
-                return undefined;
-            }
-            catch (err) {
+            // #1621: bounded so one wedged server's didClose write cannot stall
+            // this Promise.all — and therefore the whole rename — for every
+            // other client alongside it.
+            const result = await runRenameNotify(() => client.closeDocument(oldFilePath), RENAME_NOTIFY_TIMEOUT_MS);
+            if (!result.ok) {
                 closeFailures.push({
                     serverId,
-                    error: err instanceof Error ? err.message : String(err),
+                    error: result.error,
+                    disposition: result.disposition,
                 });
-                return undefined;
             }
         }));
         if (closeFailures.length > 0) {
@@ -3280,8 +5068,49 @@ export class LSPService {
             // next genuine open (#1147 P3-7).
             const content = await fs.readFile(oldFilePath, "utf-8");
             const languageId = getLanguageId(oldFilePath) ?? "plaintext";
-            await Promise.all(openDocuments.map(({ client }) => client.notify.open(oldFilePath, content, languageId, true, true)));
-            throw new Error(`workspace/didClose failed; rename aborted: ${closeFailures.map((failure) => `${failure.serverId}: ${failure.error}`).join("; ")}`);
+            const resyncFailures = [];
+            // #1621 F1: the resync write is the SAME class of notify as the didClose
+            // it is repairing after — a pipe that is wedged for didClose is wedged
+            // for every subsequent write on it too, so this bare await reintroduced
+            // the exact unbounded primitive one Promise.all up. Bound it with the
+            // same budget and record the disposition rather than let a wedged
+            // resync silently move the hang here instead of removing it.
+            await Promise.all(openDocuments.map(async ({ serverId, client }) => {
+                const resyncResult = await runRenameNotify(() => client.notify.open(oldFilePath, content, languageId, true, true), RENAME_NOTIFY_TIMEOUT_MS);
+                if (!resyncResult.ok) {
+                    resyncFailures.push({
+                        serverId,
+                        error: resyncResult.error,
+                        disposition: resyncResult.disposition,
+                    });
+                }
+            }));
+            if (resyncFailures.length > 0) {
+                // A resync failure is not swallowed: the affected client is left with
+                // no open document at all until its next genuine open, so this is
+                // logged for the same reason lsp_client_shutdown records a forced
+                // teardown — a degraded resync must be countable from the log.
+                logLatency({
+                    type: "phase",
+                    phase: "lsp_rename_resync_failed",
+                    filePath: oldFilePath,
+                    durationMs: 0,
+                    metadata: {
+                        failures: resyncFailures.map((failure) => ({
+                            serverId: failure.serverId,
+                            disposition: failure.disposition,
+                            error: failure.error,
+                        })),
+                    },
+                });
+            }
+            const closeFailureSummary = closeFailures
+                .map((failure) => `${failure.serverId} (${failure.disposition}): ${failure.error}`)
+                .join("; ");
+            const resyncFailureSummary = resyncFailures.length > 0
+                ? ` (resync also failed: ${resyncFailures.map((failure) => `${failure.serverId} (${failure.disposition}): ${failure.error}`).join("; ")})`
+                : "";
+            throw new Error(`workspace/didClose failed; rename aborted: ${closeFailureSummary}${resyncFailureSummary}`);
         }
         let renameApplied;
         try {
@@ -3314,21 +5143,19 @@ export class LSPService {
         const renameDescription = `Renamed ${relOld} → ${relNew}`;
         await Promise.all(activeClients.map(async ({ serverId, client }) => {
             const opened = openDocuments.find((entry) => entry.serverId === serverId);
-            try {
-                if (opened?.oldUri) {
-                    await client.didRenameFiles(oldFilePath, newFilePath, opened.oldUri, destinationUriPreservingSpelling(opened.oldUri, oldFilePath, newFilePath));
-                }
-                else {
-                    await client.didRenameFiles(oldFilePath, newFilePath);
-                }
-                return undefined;
-            }
-            catch (err) {
+            // #1621: bounded for the same reason as the didClose notify above —
+            // rename propagation is best-effort advice to servers, not a
+            // correctness gate, so a wedged client's notify must not stall the
+            // healthy clients settling alongside it in this Promise.all.
+            const result = await runRenameNotify(() => opened?.oldUri
+                ? client.didRenameFiles(oldFilePath, newFilePath, opened.oldUri, destinationUriPreservingSpelling(opened.oldUri, oldFilePath, newFilePath))
+                : client.didRenameFiles(oldFilePath, newFilePath), RENAME_NOTIFY_TIMEOUT_MS);
+            if (!result.ok) {
                 didRenameFailures.push({
                     serverId,
-                    error: err instanceof Error ? err.message : String(err),
+                    error: result.error,
+                    disposition: result.disposition,
                 });
-                return undefined;
             }
         }));
         const files = [...new Set([...applied.files, oldFilePath, newFilePath])];
@@ -3378,6 +5205,9 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().implementation) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for implementation");
+        }
         return spawned.client.implementation(filePath, line, character);
     }
     /**
@@ -3387,24 +5217,38 @@ export class LSPService {
         const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().callHierarchy) {
+            throw new Error("__UNSUPPORTED__ Active LSP server does not advertise support for prepareCallHierarchy");
+        }
         return spawned.client.prepareCallHierarchy(filePath, line, character);
     }
     /**
      * Navigation: find incoming calls (callers)
+     *
+     * #1803: gated on the target server's advertised `callHierarchyProvider`
+     * (the same `getOperationSupport().callHierarchy` single source of truth
+     * populated by `detectOperationSupport` in clients/lsp/client.ts — see
+     * client.ts:5253). Mirrors the #1789 gate on `workspaceSymbol` above.
      */
     async incomingCalls(item) {
         const spawned = await this.getClientForFile(uriToPath(item.uri), NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().callHierarchy)
+            return [];
         return spawned.client.incomingCalls(item);
     }
     /**
      * Navigation: find outgoing calls (callees)
+     *
+     * #1803: same gate as `incomingCalls` above.
      */
     async outgoingCalls(item) {
         const spawned = await this.getClientForFile(uriToPath(item.uri), NAV_CLIENT_WAIT_TIMEOUT_MS);
         if (!spawned)
             return [];
+        if (!spawned.client.getOperationSupport().callHierarchy)
+            return [];
         return spawned.client.outgoingCalls(item);
     }
     /**
@@ -3468,10 +5312,13 @@ export class LSPService {
      * attempts never proved it can answer diagnostics. Warm-up stays
      * `clientScope:"primary"` (not the sweep's `"all"`) on purpose: `"all"`
      * would additionally spawn the sweep-EXCLUDED auxiliaries
-     * (`WORKSPACE_SWEEP_EXCLUDED_SERVER_IDS`), and because `touchFile`'s
-     * `inconclusive` flag is touch-wide, one slow advisory auxiliary would then
-     * suppress the `demonstratedReady` marking for a perfectly healthy primary —
-     * falsely condemning it. Recording per-primary-server outcomes and skipping
+     * (`WORKSPACE_SWEEP_EXCLUDED_SERVER_IDS`), which is work this warm-up does not
+     * need. (Before #1549 it was also unsafe: `touchFile`'s `inconclusive` flag was
+     * touch-wide, so one slow advisory auxiliary suppressed the `demonstratedReady`
+     * marking for a perfectly healthy primary — falsely condemning it. The verdict is
+     * per-server now, and the marking loop skips only the servers that did not answer
+     * for themselves, so the scope choice is a cost argument rather than a
+     * correctness one.) Recording per-primary-server outcomes and skipping
      * on those is the correct, non-regressing way to cover the servers the sweep
      * actually gates on (the sweep groups by primary server, so the group this
      * warms IS the one whose per-file touches would drag).
@@ -3664,9 +5511,30 @@ export class LSPService {
      * This is intentionally expensive and used only by explicit project-wide tools.
      */
     async runWorkspaceDiagnostics(cwd, options = {}) {
+        // #1618: hold the shared sweep gate for this call's ENTIRE lifetime —
+        // counter-based (not a boolean) so two overlapping `mode=full` calls each
+        // release independently, and try/finally so a throw or an aborted sweep
+        // still releases it (a leaked hold would permanently disable idle reset,
+        // the inverse defect). While held, `clients/runtime-turn.ts`'s idle-reset
+        // timer defers instead of destroying this service mid-sweep.
+        const releaseSweepHold = acquireWorkspaceSweepHold();
+        try {
+            return await this.runWorkspaceDiagnosticsSwept(cwd, options);
+        }
+        finally {
+            releaseSweepHold();
+        }
+    }
+    async runWorkspaceDiagnosticsSwept(cwd, options = {}) {
         const startedAt = Date.now();
         const root = path.resolve(cwd);
         const { signal } = options;
+        // #1783: second heartbeat for the drift backstop. The per-file touch
+        // below already carries one, but a round that answers every file from
+        // the #671 cache never calls touchFile at all — and that is precisely the
+        // round whose stale answers the pi-codec witness recorded. Same rate
+        // limit, same non-awaited contract.
+        void this.sweepDocumentDrift().catch(() => { });
         // Cap the per-file LSP sweep: a Next.js-scale project can route thousands
         // of files through the language server at concurrency 8, and without a
         // caller cap that grinds for tens of minutes (#341). `maxFiles` lets
@@ -3742,6 +5610,16 @@ export class LSPService {
         if (cachedResults.length > 0) {
             options.onProgress?.(completed, files.length);
         }
+        // #1782: which files this sweep is REPLAYING from cache, and which of those
+        // a workspace pull then explicitly re-answered clean. A project-wide pull
+        // report names files far beyond the group that asked for it; an explicit
+        // zero-diagnostic answer for a replayed file is authoritative and must
+        // supersede the replay, in the sweep's result list AND on disk. Without
+        // this, a server that re-checked a file and found it clean could not
+        // dislodge the stale entry by any means available to a user — the
+        // 2026-08-20 dogfood's 23:07 record.
+        const cacheServedKeys = new Set(cachedResults.map((result) => normalizeMapKey(result.filePath)));
+        const supersededCacheKeys = new Set();
         // Per-file scan mtime captured as each file completes below, so a
         // confirmed fresh result can be written back into the cache with the
         // mtime it was ACTUALLY scanned at (not re-stat'd after the fact, which
@@ -3858,8 +5736,27 @@ export class LSPService {
                 const preOpenAttempt = withDeadline((async () => {
                     const { clients } = await this.getClientsForFile(filePath, WORKSPACE_SWEEP_EXCLUDED_SERVER_IDS);
                     for (const entry of clients) {
+                        // #1714: this pass is the sweep's SECOND source of `didOpen`
+                        // volume, and it reaches the server without passing the drain
+                        // barrier. Charge it to the same backlog ledger, and leave a
+                        // scanner that is already at its ceiling out of the burst.
+                        let auxKey;
+                        if (entry.info.role === "auxiliary") {
+                            auxKey = await this.demonstratedReadyKeyFor(entry.info, filePath);
+                            if (auxKey && this.auxNotifyBacklogAtCeiling(auxKey, entry)) {
+                                continue;
+                            }
+                        }
                         try {
                             await entry.client.notify.open(filePath, content, languageId);
+                            if (auxKey)
+                                this.noteAuxNotifyIssued(auxKey, entry.client);
+                            // #1783: deliberately NOT recorded for the drift backstop.
+                            // This pass can skip a scanner at its backlog ceiling, so its
+                            // coverage is partial by design, and `processFile` runs
+                            // `touchFile` over every file in the group immediately after
+                            // — that call records with a full-coverage check. Stamping
+                            // here would only claim a coverage this loop does not have.
                         }
                         catch {
                             // Best-effort: a failed pre-open just means processFile's own
@@ -3883,6 +5780,26 @@ export class LSPService {
                     : preOpenAttempt);
             }
         };
+        // #1618: a service destroyed mid-sweep (idle-reset race, an explicit
+        // `resetLSPService` call, session replacement, …) must stop the loop for
+        // every file it has not yet reached and record WHY — never a bare
+        // `timedOut` that reads identically to a budget timeout. Cheap: no
+        // language-server round trip, just a results push.
+        const markServiceDestroyed = (remainingFiles) => {
+            for (const filePath of remainingFiles) {
+                results.push({
+                    filePath,
+                    diagnostics: [],
+                    count: 0,
+                    timedOut: true,
+                    unconfirmedReason: "service_destroyed",
+                    writeIndex: writeIndexByPath.get(normalizeMapKey(filePath)),
+                });
+                timedOutFiles += 1;
+                completed += 1;
+            }
+            options.onProgress?.(completed, files.length);
+        };
         const processFile = async (filePath) => {
             try {
                 const content = contentCache.get(filePath) ??
@@ -3954,20 +5871,37 @@ export class LSPService {
                 // `perFileMs` deadline, which only catches a touch that never returned at
                 // all within budget. Either one means the result wasn't confirmed.
                 const inconclusive = touchResult?.inconclusive === true;
-                // #1470: a cut-off auxiliary is the THIRD reason this result is not a
-                // confirmed observation, and it is deliberately not `inconclusive`. The
+                // #1470/#1493: an auxiliary that never reported — cut off by the grace
+                // timer, or silent with nothing published for this content — is the
+                // THIRD reason this result is not a confirmed observation, and it is
+                // deliberately not `inconclusive`. The
                 // record loop below persists every `!timedOut` result into the workspace
                 // cache, so reading `inconclusive` alone caches a partially covered
-                // answer as clean and replays it on every later sweep. Today the only
-                // route that can reach this branch with a gap is the warm-attach
-                // incumbent, whose touch runs `clientScope: "with-auxiliary"`; the
-                // sweep's own local touch uses `clientScope: "all"`, which never arms
-                // the aux grace timer at all. Both are gated here so a future scope
-                // change cannot reopen the hole silently.
-                const coverageGap = touchCoverageGap(touchResult).length > 0;
-                const timedOut = touchResult === undefined || inconclusive || coverageGap;
+                // answer as clean and replays it on every later sweep. The warm-attach
+                // incumbent reaches this branch through the aux GRACE wait (its touch
+                // runs `clientScope: "with-auxiliary"`), where all three no-answer shapes
+                // arise. #1459 added the two pre-wait doors for the sweep's own local
+                // `clientScope: "all"` touch — a scanner whose breaker was open, or whose
+                // resync the fan-out gate deferred. #1533 closed the last hole: `"all"`
+                // still never enters the grace wait, but it now derives the SAME evidence
+                // from post-wait state, so a silent auxiliary narrows this scope too
+                // instead of aggregating as a confirmed clean. Every route is gated here.
+                const unconfirmedServerIds = touchCoverageGap(touchResult);
+                const coverageGap = unconfirmedServerIds.length > 0;
+                // #1549: the sweep verdict is per answering lane. An auxiliary gap
+                // narrows coverage, but a primary answer remains usable; only absence of
+                // the touch result or a primary-scoped inconclusive verdict poisons it.
+                const timedOut = touchResult === undefined || inconclusive;
                 if (timedOut)
                     timedOutFiles += 1;
+                // #1618: WHY, in priority order — the outer deadline (nothing came
+                // back at all) outranks an inner inconclusive signal, which outranks
+                // a narrower auxiliary coverage gap.
+                const unconfirmedReason = touchResult === undefined
+                    ? "budget"
+                    : inconclusive
+                        ? "inconclusive"
+                        : undefined;
                 // #1104 (shape 5 — AGENTS.md): the touch's content binding is an
                 // EXPLICIT enumerable field on the wrapper now (#1179), so it survives
                 // `applyAuxiliarySuppressions` below rebuilding `.diags` via `.filter()`
@@ -3997,7 +5931,10 @@ export class LSPService {
                     filePath,
                     diagnostics: filteredDiagnostics ?? [],
                     count: filteredDiagnostics?.length ?? 0,
-                    timedOut,
+                    ...(timedOut && { timedOut: true, unconfirmedReason }),
+                    ...(coverageGap && {
+                        unconfirmedServerIds: [...unconfirmedServerIds],
+                    }),
                     contentHash: rawBinding?.contentHash,
                     boundToCurrentDisk: rawBinding?.boundToCurrentDisk,
                     writeIndex: writeIndexByPath.get(normalizeMapKey(filePath)),
@@ -4011,8 +5948,12 @@ export class LSPService {
                     error: err instanceof Error ? err.message : String(err),
                     // An errored check is exactly as inconclusive as a timed-out one —
                     // no confirmed result was obtained, so reconciliation (#571) must
-                    // skip it the same way.
+                    // skip it the same way. #1618: distinct from every OTHER
+                    // `timedOut: true` reason — an `error` must never render as "didn't
+                    // complete within budget" (the old dead-subtraction bug in
+                    // tools/lens-diagnostics.ts's `unconfirmedErrored` computation).
                     timedOut: true,
+                    unconfirmedReason: "error",
                     writeIndex: writeIndexByPath.get(normalizeMapKey(filePath)),
                 });
             }
@@ -4046,13 +5987,29 @@ export class LSPService {
         await runPerServerGroups(groups, groupWorkers, async (group) => {
             if (signal?.aborted)
                 return;
+            // #1618: checked before any per-group work (pull attempt, warm-up,
+            // per-file loop) so a service already destroyed when this group
+            // starts never pays for a language-server round trip it cannot get.
+            if (this.checkDestroyed()) {
+                markServiceDestroyed(group.files);
+                return;
+            }
             // Fast path: one project-wide pull for the whole group (opt-in).
             if (!isWarmAttached() &&
                 workspacePullEnabled &&
                 !group.multiServer) {
-                const pulled = await this.tryWorkspacePull(group.files, perFileMs);
+                const pulled = await this.tryWorkspacePull(group.files, perFileMs, cacheServedKeys);
                 if (pulled) {
-                    for (const result of pulled) {
+                    // #1782: an explicit zero-diagnostic answer for a file this
+                    // sweep served from cache SUPERSEDES that cached replay. Route
+                    // it through the same result list every other answer uses, so
+                    // the cache write below overwrites the stale entry and the
+                    // footer reconcile in `tools/lens-diagnostics.ts` clears the
+                    // widget rows — no second eviction path to keep in step.
+                    for (const clean of pulled.extraClean) {
+                        supersededCacheKeys.add(normalizeMapKey(clean.filePath));
+                    }
+                    for (const result of [...pulled.results, ...pulled.extraClean]) {
                         results.push({
                             ...result,
                             writeIndex: writeIndexByPath.get(normalizeMapKey(result.filePath)),
@@ -4117,6 +6074,7 @@ export class LSPService {
                             diagnostics: [],
                             count: 0,
                             timedOut: true,
+                            unconfirmedReason: "inconclusive",
                             skippedWarmupFailure: true,
                         });
                         timedOutFiles += 1;
@@ -4138,6 +6096,15 @@ export class LSPService {
             for (let chunkStart = 0; chunkStart < group.files.length; chunkStart += WORKSPACE_SWEEP_PREOPEN_CHUNK_SIZE) {
                 if (signal?.aborted)
                     return;
+                // #1618: a service destroyed WHILE this group's chunk loop was
+                // already running (the group-start check above can't see a
+                // destruction that lands mid-loop) — stop here and mark every
+                // file from this chunk onward, rather than letting the remaining
+                // chunks pay for pre-opens/touches against a torn-down service.
+                if (this.checkDestroyed()) {
+                    markServiceDestroyed(group.files.slice(chunkStart));
+                    return;
+                }
                 const chunk = group.files.slice(chunkStart, chunkStart + WORKSPACE_SWEEP_PREOPEN_CHUNK_SIZE);
                 await preOpenGroupFiles(chunk);
                 for (const filePath of chunk) {
@@ -4145,10 +6112,33 @@ export class LSPService {
                     // results are returned as a partial.
                     if (signal?.aborted)
                         return;
+                    if (this.checkDestroyed()) {
+                        markServiceDestroyed(group.files.slice(group.files.indexOf(filePath)));
+                        return;
+                    }
                     await processFile(filePath);
                 }
             }
         }, signal);
+        // #1618: per-reason tally alongside the flat `timedOutFiles` count (kept
+        // for the existing `scripts/analyze-pi-lens-logs.mjs` consumer) — a
+        // dashboard reading only the flat count can no longer mistake 81
+        // service-destroyed files for 81 budget-exhausted ones.
+        const unconfirmedByReason = {};
+        for (const result of results) {
+            if (!result.timedOut)
+                continue;
+            const reason = result.unconfirmedReason ?? "budget";
+            unconfirmedByReason[reason] = (unconfirmedByReason[reason] ?? 0) + 1;
+        }
+        const partiallyCoveredFiles = results.filter((result) => (result.unconfirmedServerIds?.length ?? 0) > 0).length;
+        // Code-unit comparator (#1883): this list ships as the
+        // `unconfirmedServerIds` field on the `lsp_workspace_diagnostics` record,
+        // so its order must be deterministic across locales — localeCompare is
+        // deliberately avoided.
+        const unconfirmedServerIds = [
+            ...new Set(results.flatMap((result) => result.unconfirmedServerIds ?? [])),
+        ].sort((a, b) => Number(a > b) - Number(a < b));
         logLatency({
             type: "phase",
             phase: "lsp_workspace_diagnostics",
@@ -4162,6 +6152,9 @@ export class LSPService {
                 concurrency: groupWorkers,
                 maxFiles,
                 timedOutFiles,
+                unconfirmedByReason,
+                partiallyCoveredFiles,
+                ...(unconfirmedServerIds.length > 0 && { unconfirmedServerIds }),
                 aborted: signal?.aborted ?? false,
             },
         });
@@ -4178,8 +6171,12 @@ export class LSPService {
         // freshness check; nothing here needs to explicitly evict them).
         for (const result of results) {
             const scannedAt = scannedMtimeByFile.get(result.filePath);
-            if (result.error || result.timedOut || scannedAt === undefined)
+            if (result.error ||
+                result.timedOut ||
+                (result.unconfirmedServerIds?.length ?? 0) > 0 ||
+                scannedAt === undefined) {
                 continue;
+            }
             // #1104: thread the per-result `contentHash` (from either the
             // `tryWorkspacePull` fast path or a per-file touch's own #1095 binding)
             // into the cache entry — previously this call never passed one, so
@@ -4191,15 +6188,37 @@ export class LSPService {
             workspaceDiagnosticsCacheCtx.record(result.filePath, workspaceSweepScopeKey, result.diagnostics, scannedAt, result.contentHash);
         }
         workspaceDiagnosticsCacheCtx.persist();
-        return [...cachedResults, ...results].filter(Boolean);
+        // #1782: drop every cached replay a pull answered clean — returning both
+        // would hand the footer reconcile two contradictory results for one file,
+        // and the stale one could win on ordering.
+        const servedCacheResults = supersededCacheKeys.size === 0
+            ? cachedResults
+            : cachedResults.filter((result) => !supersededCacheKeys.has(normalizeMapKey(result.filePath)));
+        return [...servedCacheResults, ...results].filter(Boolean);
     }
     /**
      * #387 Item 2: one `workspace/diagnostic` pull covering a whole server group,
      * instead of N per-file opens. Returns per-file results (files absent from the
      * report are reported clean), or `undefined` when the server doesn't advertise
      * workspace pull / the pull fails — the caller then falls back to per-file.
+     *
+     * #1782: the report is project-wide, so it routinely names files this group
+     * never asked about — including files this sweep already served from the
+     * cache. Those answers used to be dropped on the floor: the mapping below
+     * only ever looked up `groupFiles`. That is how a server can explicitly
+     * re-answer a file with ZERO diagnostics while the cache and the widget keep
+     * rendering its stale blockers, which is what the 2026-08-20 dogfood recorded
+     * at 23:07. `reanswerFor` opts a caller into those extra answers: pass the
+     * normalized keys of files served from cache, and any of them the report
+     * explicitly names with zero diagnostics comes back in `extraClean` as a
+     * confirmed clean result.
+     *
+     * Only an EXPLICIT zero-diagnostic entry qualifies. Absence from the report
+     * reads as clean for `groupFiles`, which this sweep did ask about, but it is
+     * genuinely UNKNOWN for a file nobody asked about — a server may report only
+     * what it re-checked.
      */
-    async tryWorkspacePull(groupFiles, perFileMs) {
+    async tryWorkspacePull(groupFiles, perFileMs, reanswerFor) {
         try {
             const first = groupFiles[0];
             if (!first)
@@ -4213,11 +6232,13 @@ export class LSPService {
             const report = await spawned.client.requestWorkspaceDiagnostics(Math.max(perFileMs, workspacePullBudgetMs()));
             if (!report)
                 return undefined;
+            // Last-wins per file: the report builder does not dedup, so a server
+            // naming the same URI twice appears twice in `report` (#1786 review F2).
             const byPath = new Map();
             for (const entry of report) {
                 byPath.set(normalizeMapKey(entry.filePath), entry);
             }
-            return groupFiles.map((filePath) => {
+            const results = groupFiles.map((filePath) => {
                 const entry = byPath.get(normalizeMapKey(filePath));
                 const diagnostics = entry?.diagnostics ?? [];
                 // A pull that got here returned a real workspace/diagnostic report
@@ -4234,6 +6255,48 @@ export class LSPService {
                     contentHash: entry?.contentHash,
                 };
             });
+            // #1782: harvest explicit clean answers for files this group never asked
+            // about but the caller is serving from cache. Same confirmed status as
+            // the mapping above — it is the same report.
+            //
+            // #1786 review F2: iterate `byPath`, not `report`. The report BUILDER
+            // (`clients/lsp/client.ts`'s `requestWorkspaceDiagnostics`) pushes one
+            // output entry per report item with no dedup, so a server that names the
+            // same URI twice yields two entries for one file. Walking the raw list
+            // would emit two results for one file — breaking the caller's
+            // one-result-per-file invariant — and would let a zero-diagnostic
+            // duplicate evict a cached blocker that the SAME report also reports as
+            // still failing. `byPath` is last-wins and unique per file, and
+            // `withFindings` refuses eviction whenever ANY entry for that file
+            // reports findings, whatever the order. Refusing costs a stale entry one
+            // more sweep; evicting on a contradicted answer discards a live blocker.
+            const extraClean = [];
+            if (reanswerFor && reanswerFor.size > 0) {
+                const asked = new Set(groupFiles.map((f) => normalizeMapKey(f)));
+                const withFindings = new Set();
+                for (const entry of report) {
+                    if (entry.diagnostics.length > 0) {
+                        withFindings.add(normalizeMapKey(entry.filePath));
+                    }
+                }
+                for (const [key, entry] of byPath) {
+                    // The membership filter is load-bearing: a report names files far
+                    // beyond this sweep, and a file nobody asked about and nothing is
+                    // replaying has no business entering the sweep's results.
+                    if (asked.has(key) || !reanswerFor.has(key))
+                        continue;
+                    if (entry.diagnostics.length > 0 || withFindings.has(key))
+                        continue;
+                    extraClean.push({
+                        filePath: entry.filePath,
+                        diagnostics: [],
+                        count: 0,
+                        timedOut: false,
+                        contentHash: entry.contentHash,
+                    });
+                }
+            }
+            return { results, extraClean };
         }
         catch {
             return undefined;
@@ -4317,6 +6380,35 @@ export class LSPService {
     supportsLSP(filePath) {
         return getServersForFileWithConfig(filePath).length > 0;
     }
+    /**
+     * Check whether the PRIMARY server for this file is currently mid-spawn
+     * (`state.inFlight`, keyed `${server.id}:${normalizeMapKey(root)}` — see
+     * :2413). Lets a caller whose own wait budget expires distinguish "the
+     * server hasn't finished its first spawn yet" from "the server is running
+     * but slow/wedged" (#1766) — a cold spawn still in flight is not a verdict
+     * on a server that doesn't exist yet.
+     *
+     * Mirrors the `role !== "auxiliary"` filter getClientForFile applies at
+     * :2146-2148 (kept coupled to that line intentionally): auxiliary servers
+     * (opengrep, typos, …) spawn routinely and concurrently with an ALREADY
+     * ALIVE primary (dispatch/runners/lsp.ts's with-auxiliary path fires one
+     * per edit for most files via TYPOS_EXTENSIONS). Without this filter, an
+     * unrelated auxiliary spawn would downgrade a genuinely wedged primary to
+     * a benign "spawn-in-flight" verdict — the worse misreport direction.
+     *
+     * The touch path supplies roots resolved before acquisition. Matching the full
+     * server/root key prevents another workspace's spawn from relabeling this one.
+     * Root resolution is already complete, and this check stays synchronous.
+     * The failure mode is limited to the matching workspace key.
+     * Pure lookup — does not spawn or wait for a client.
+     */
+    isSpawnInFlight(_filePath, resolvedRoots = new Map()) {
+        for (const [serverId, root] of resolvedRoots) {
+            if (this.state.inFlight.has(`${serverId}:${root}`))
+                return true;
+        }
+        return false;
+    }
     /**
      * Check whether an LSP client is already alive for a file.
      * Lightweight — does not spawn or wait for a client.
@@ -4387,6 +6479,21 @@ export class LSPService {
         });
         this.state.clients.clear();
         this.state.broken.clear();
+        // #1459: every gated client is gone, so no outstanding-write record can
+        // describe a live one. The gate's identity check already neutralises a stale
+        // entry; clearing keeps the map honest rather than relying on that.
+        this.outstandingAuxNotifyWrites.clear();
+        // #1714: same reasoning — a backlog count belongs to a client generation,
+        // and every client is gone. `session_start` reaches this through the service
+        // reset, so the pacing state re-arms with the session rather than living for
+        // the process.
+        this.auxNotifyInflight.clear();
+        // #1783: the drift records describe what THESE clients hold. Every client
+        // is gone, so every record is a claim about a dead server's view. Keeping
+        // them would make the first sweep of the next generation resync files no
+        // one has open yet, and — like the pacing state above — this is state that
+        // must re-arm at `session_start`, which reaches it through this reset.
+        this.documentDrift.clear();
         this.workspaceProbeLogged.clear();
         this.warmStartLogged.clear();
     }
@@ -4542,7 +6649,27 @@ export function getLSPService() {
 export async function isAuxiliaryLspAlive(serverId, filePath) {
     return getLSPService().isServerAliveForFile(serverId, filePath);
 }
+/**
+ * Cross-layer seam (#1668) for callers outside `lsp/` (bash/write tool-result
+ * handling) that observe a disk change no open-document sync path will ever
+ * report — an external delete/create/modify. Delivers to already-active
+ * clients only; see `LSPService.notifyExternalFileChange`.
+ */
+export async function notifyExternalFileChange(filePath, type) {
+    return getLSPService().notifyExternalFileChange(filePath, type);
+}
 export function resetLSPService(options = {}) {
+    // A new session must get its own classic-tsserver-repair attempt: the
+    // guard is a process-lifetime flag (see resetClassicTsRepairGuard), so a
+    // repair that failed transiently in an earlier session must not stay
+    // latched for the rest of the extension-host process (#1570).
+    if (options.reason === "session_start") {
+        resetClassicTsRepairGuard();
+        // #1618 (R3): a hold from a PRIOR generation's sweep must never survive
+        // a session boundary — state that must re-arm at session_start cannot
+        // hide behind a leaked/stuck guard from the generation before it.
+        clearWorkspaceSweepHoldForSessionStart();
+    }
     const retiringService = globalLSPService;
     globalLSPService = null;
     if (!retiringService)