@herbertgao/pi-extensions 2026.8.6 → 2026.8.7

package/node_modules/pi-lens/dist/clients/runtime-turn.js

@@ -3,17 +3,24 @@ import { appendActionableWarningsHistory, buildActionableWarningsReport, formatA
 import { logActionableWarningsEvent } from "./actionable-warnings-logger.js";
 import { appendCodeQualityWarningsHistory, buildCodeQualityWarningsReport, formatCodeQualityWarningsAdvisory, writeCodeQualityWarningsReport, } from "./code-quality-warnings.js";
 import { clearGitGuardTestFailure, mergeGitGuardTestFailure, writeGitGuardRecord, } from "./git-guard.js";
+import { cascadeSettleWaitMs } from "./cascade-budget.js";
 import { logCascade } from "./cascade-logger.js";
 import { normalizeMapKey } from "./path-utils.js";
 import { resolveRunnerPath, toRunnerDisplayPath, } from "./dispatch/runner-context.js";
 import { getKnipIgnorePatterns } from "./file-utils.js";
+import { formatCacheAgeLabel } from "./finding-delivery-gate.js";
+import { getFullScanWallClockMs, isWorkspaceSweepActive, runWhenWorkspaceSweepIdle, SWEEP_IDLE_SAFETY_MARGIN_MS, } from "./lsp/workspace-sweep-hold.js";
 import { isTestRoleCollateral } from "./collateral-test-role.js";
 import { dedupeSecretFindings, fromAstGrepWarnings, fromGitleaks, fromTrivySecrets, isSecretWarning, secretLocationKey, } from "./secret-findings.js";
-import { deadCodeIssueKey, deadCodeIssues, formatDeadCodeDelta, } from "./dead-code-client.js";
+import { deadCodeIssueKey, deadCodeIssues, formatDeadCodeDelta, stableFindingKey, } from "./dead-code-client.js";
 import { logDeadCodeScan } from "./dead-code-logger.js";
 import { PROJECT_DIAGNOSTICS_CACHE_VERSION, writeProjectDiagnosticsDeltaReport, } from "./project-diagnostics/cache.js";
 import { deadCodeIssueToProjectDiagnostic } from "./project-diagnostics/runner-adapters/dead-code.js";
+import { gitleaksFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/gitleaks.js";
+import { govulncheckFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/govulncheck.js";
+import { trivyFindingToProjectDiagnostic, trivySecretFindingToProjectDiagnostic, } from "./project-diagnostics/runner-adapters/trivy.js";
 import { knipIssuesToProjectDiagnostics } from "./project-diagnostics/runner-adapters/knip.js";
+import { applyDispositionsMultiFile } from "./diagnostic-dispositions.js";
 import { logLatency } from "./latency-logger.js";
 import { getLspBudgetIdleTimeoutMs, shouldShortenLspIdleTimeout, } from "./lsp-budget.js";
 import { updateHeartbeat } from "./instance-registry.js";
@@ -21,7 +28,48 @@ import { emitLensTurnFindings } from "./lens-events.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { isSubagentSession } from "./subagent-mode.js";
 import { formatRunDurationMs } from "./run-duration.js";
-import { MAX_ADVISORY_AFFECTED_FILES, dropFindingsForMissingPaths, snapshotAdvisoryProvenance, } from "./advisory-provenance.js";
+import { MAX_ADVISORY_AFFECTED_FILES, gateFindingsByPathFreshness, snapshotAdvisoryProvenance, } from "./advisory-provenance.js";
+import { sweepInlineBlockerFreshness } from "./blocker-freshness.js";
+import { sweepInlineBlockerPastEof } from "./blocker-past-eof.js";
+// #1631 review V2: moved to its own leaf module so a low-level store
+// (widget-state.ts) can use the marker without importing this orchestrator —
+// see clients/stale-marker.ts's doc comment.
+import { STALE_LINE_MARKER } from "./stale-marker.js";
+import { getWidgetBlockingFilesForSweep, markWidgetFileBlockersStale, } from "./widget-state.js";
+/**
+ * #1617: turn_end reads gitleaks/govulncheck/trivy straight from their
+ * session-scan caches and formats them into advisory/blocker text — a
+ * reporting lane parallel to (and, before this fix, entirely bypassing)
+ * `dispatcher.ts:924`'s `applyDispositions` filter. An agent-marked
+ * false-positive/won't-fix on one of these findings never suppressed it
+ * here, so it re-reported on every turn.
+ *
+ * Filters `findings` through the SAME anchor derivation the dispatch path
+ * and `lens_diagnostics mode=full` use (`applyDispositionsMultiFile` in
+ * `diagnostic-dispositions.ts`), keyed off each lane's own canonical
+ * `ProjectDiagnostic` adapter (`toDiagnostic`) — the exact tool/rule/message
+ * identity `lens_diagnostics` already surfaces and `lens_diagnostic_mark`
+ * already anchors a mark against, not a second, cloned identity that would
+ * silently diverge from what the agent actually marked.
+ *
+ * Returns the surviving findings plus how many were dropped, so a caller can
+ * still surface a "suppressed by disposition: N" trace (the #1616
+ * suppressed-bucket rule — a security finding must never vanish with no
+ * trace, even when the disposition that dropped it is working as intended).
+ */
+function filterFindingsByDisposition(findings, cwd, toDiagnostic) {
+    if (findings.length === 0)
+        return { kept: findings, suppressed: 0 };
+    const candidates = findings.map((finding) => ({
+        finding,
+        diagnostic: toDiagnostic(finding),
+    }));
+    const survivors = new Set(applyDispositionsMultiFile(candidates.map((c) => c.diagnostic), cwd, (d) => d.filePath));
+    const kept = candidates
+        .filter((c) => survivors.has(c.diagnostic))
+        .map((c) => c.finding);
+    return { kept, suppressed: findings.length - kept.length };
+}
 /**
  * Would writing `next` over `prev` throw away a good scan for a failed one?
  *
@@ -35,6 +83,13 @@ function wouldPoisonCache(prev, next) {
 }
 // LSP idle reset scheduling — prevents thrashing by delaying shutdown
 let lspIdleResetTimeout = null;
+// #1618: set while this timer's fire is deferred behind an in-flight
+// workspace sweep (see `scheduleLSPIdleReset`'s `isWorkspaceSweepActive`
+// branch). `cancelLSPIdleReset` must be able to cancel THIS too — otherwise
+// an active-editing turn that cancels idle reset while a sweep is still
+// running would have it silently resurrected once the sweep finishes, even
+// though the session is no longer idle.
+let pendingSweepRearm = null;
 function emitIdleResetReporterWarning(reportErr) {
     try {
         process.emitWarning(`pi-lens LSP idle reset error reporter failed: ${reportErr}`, { code: "PI_LENS_LSP_IDLE_RESET_REPORTER_FAILED" });
@@ -53,12 +108,40 @@ function reportIdleResetError(onError, err) {
     }
 }
 function scheduleLSPIdleReset(resetFn, delayMs, options = {}) {
-    // Clear any pending reset to avoid multiple timers
+    // Clear any pending reset to avoid multiple timers. #1618: also cancel a
+    // rearm still waiting on a prior sweep's hold — otherwise re-scheduling
+    // here (this call) leaves that OLD waiter armed too, and the sweep's
+    // eventual release would fire a SECOND, independent `scheduleLSPIdleReset`
+    // alongside this fresh one.
     if (lspIdleResetTimeout) {
         clearTimeout(lspIdleResetTimeout);
     }
+    if (pendingSweepRearm) {
+        pendingSweepRearm.cancelled = true;
+        pendingSweepRearm = null;
+    }
     lspIdleResetTimeout = setTimeout(() => {
         lspIdleResetTimeout = null;
+        // #1618: a full workspace sweep (`lens_diagnostics mode=full`) grants
+        // itself a wall-clock ceiling that can outlive this timer's delay — this
+        // used to fire straight into an in-flight sweep and destroy the very
+        // service the sweep was actively touching, mislabeling every file the
+        // sweep had not yet reached as budget exhaustion. Defer instead of
+        // firing: re-arm a FRESH `delayMs` timer once the sweep releases its
+        // hold, rather than resuming a countdown that's already elapsed (which
+        // would fire the instant the hold releases) or destroying mid-sweep.
+        if (isWorkspaceSweepActive()) {
+            const rearmToken = { cancelled: false };
+            pendingSweepRearm = rearmToken;
+            runWhenWorkspaceSweepIdle(() => {
+                if (rearmToken.cancelled)
+                    return;
+                if (pendingSweepRearm === rearmToken)
+                    pendingSweepRearm = null;
+                scheduleLSPIdleReset(resetFn, delayMs, options);
+            });
+            return;
+        }
         try {
             if (options.isCurrentSession && !options.isCurrentSession()) {
                 return;
@@ -77,17 +160,58 @@ function scheduleLSPIdleReset(resetFn, delayMs, options = {}) {
     // exit after completing its work, not wait 240 seconds for this to fire)
     lspIdleResetTimeout.unref();
 }
+// #1618 acceptance criterion 6: FULL_SCAN_WALL_CLOCK_MS (the full-sweep wall
+// clock ceiling, `tools/lens-diagnostics.ts`) must stay under EVERY idle
+// reset delay this module can arm — derived, not asserted, so the constants
+// can't drift back into a relationship where a still-running sweep can
+// outlive the timer. The AC1 hold above already makes a mid-sweep fire
+// impossible regardless of this margin; this is defense in depth against a
+// future caller that touches the LSP service outside
+// `runWorkspaceDiagnostics`' hold. `SWEEP_IDLE_SAFETY_MARGIN_MS` is
+// single-sourced from `workspace-sweep-hold.ts`, which also uses it for its
+// own max-hold-age failsafe — one tunable, not two.
+const DEFAULT_LSP_IDLE_RESET_MS = 240_000;
+function sweepDerivedFloorMs() {
+    return getFullScanWallClockMs() + SWEEP_IDLE_SAFETY_MARGIN_MS;
+}
+/** The normal (non-subagent, non-budget-pressured) idle-reset delay. */
+function getBaseLspIdleResetMs() {
+    return Math.max(DEFAULT_LSP_IDLE_RESET_MS, sweepDerivedFloorMs());
+}
+/**
+ * #1618 (R4): the subagent-light (#713) and cross-process-budget-pressured
+ * (#449) paths used to arm a flat, much SHORTER delay (60s default) than the
+ * sweep's own 300s ceiling — a 5:1 inversion covered only by the AC1 hold.
+ * Deriving this path too means AC6 ("the sweep's ceiling stays under every
+ * idle-reset delay") holds universally, not just for the common path, and an
+ * env override to either constant can never invert it (`Math.max` floors at
+ * the derived value no matter how small the override pushes the other side).
+ *
+ * Accepted cost (deliberate, not incidental — see R6 in the PR body): under
+ * default settings this now ALSO arms the ~360s derived floor rather than a
+ * true 60s teardown, trading some of #713's "release a short-lived
+ * subagent's fleet fast" benefit for AC6 holding without exceptions.
+ */
+function getShortenedLspIdleResetMs() {
+    return Math.max(getLspBudgetIdleTimeoutMs(), sweepDerivedFloorMs());
+}
+/** The idle-reset delay `handleTurnEnd` actually arms on a file-less turn —
+ *  exported so tests assert against the REAL computed value instead of a
+ *  hand-derived literal that can silently drift from this function. */
+export function getEffectiveLspIdleResetMs() {
+    return isSubagentSession() || shouldShortenLspIdleTimeout()
+        ? getShortenedLspIdleResetMs()
+        : getBaseLspIdleResetMs();
+}
 export function cancelLSPIdleReset() {
     if (lspIdleResetTimeout) {
         clearTimeout(lspIdleResetTimeout);
         lspIdleResetTimeout = null;
     }
-}
-// Bounded wait for the turn's deferred cascade computes (#450) to settle before
-// they are merged below. A late compute is carried over to the next turn_end.
-function cascadeSettleWaitMs() {
-    const raw = Number(process.env.PI_LENS_CASCADE_SETTLE_WAIT_MS);
-    return Number.isFinite(raw) && raw >= 0 ? raw : 5000;
+    if (pendingSweepRearm) {
+        pendingSweepRearm.cancelled = true;
+        pendingSweepRearm = null;
+    }
 }
 function capTurnEndMessage(content) {
     const maxLines = RUNTIME_CONFIG.turnEnd.maxLines;
@@ -165,14 +289,15 @@ export async function handleTurnEnd(deps) {
                 cacheManager.clearCache("turn-end-findings", cwd);
             }
         }
-        // #713: subagent sessions use a shorter idle reset (60s) — a short-lived
-        // task agent holding a warm fleet for 4 minutes after its last turn is
-        // pure waste under fan-out. Classify ONCE here so every tick in this call
-        // path shares the same answer. PI_LENS_SUBAGENT_FULL=1 restores 240s via
-        // isSubagentSession() returning false.
-        const idleResetMs = isSubagentSession() || shouldShortenLspIdleTimeout()
-            ? getLspBudgetIdleTimeoutMs()
-            : 240_000;
+        // #713: subagent sessions use a shorter idle reset (nominally 60s) — a
+        // short-lived task agent holding a warm fleet for 4 minutes after its
+        // last turn is pure waste under fan-out. Classify ONCE here so every
+        // tick in this call path shares the same answer. PI_LENS_SUBAGENT_FULL=1
+        // restores the base delay via isSubagentSession() returning false.
+        // #1618: both branches route through `getEffectiveLspIdleResetMs` so
+        // AC6's derivation applies universally — see that function's doc for
+        // why the "shorter" path is not always literally 60s anymore.
+        const idleResetMs = getEffectiveLspIdleResetMs();
         dbg(`turn_end: no modified files, scheduling LSP idle reset (${idleResetMs / 1000}s)`);
         if (!getFlag("no-lsp")) {
             const sessionGeneration = runtime.sessionGeneration;
@@ -184,8 +309,14 @@ export async function handleTurnEnd(deps) {
         resetFormatService();
         return;
     }
-    // Cancel any pending idle reset since we're actively working
-    if (lspIdleResetTimeout) {
+    // Cancel any pending idle reset since we're actively working. #1618: also
+    // checks `pendingSweepRearm` — a timer deferred behind an in-flight
+    // workspace sweep already nulled `lspIdleResetTimeout` (the setTimeout
+    // callback clears it before checking the hold), so this guard used to
+    // read "nothing pending" and skip the cancel while a rearm was still
+    // queued to fire the instant the sweep released its hold — resurrecting
+    // idle reset on a session that had since gone back to active editing.
+    if (lspIdleResetTimeout || pendingSweepRearm) {
         cancelLSPIdleReset();
         dbg("turn_end: cancelled pending LSP idle reset (active editing)");
     }
@@ -199,22 +330,91 @@ export async function handleTurnEnd(deps) {
     }
     const turnEndStart = Date.now();
     const blockerParts = [];
+    /**
+     * #1622 review M2: findings the freshness gate demoted. A third tier between
+     * blockers and advisories — not a blocker, because the cached coordinate is
+     * untrustworthy; not an advisory, because the advisory label reads "no action
+     * required this turn" and these DO require a re-scan. Each part carries its
+     * own imperative preamble rather than inheriting that label.
+     */
+    const staleSecretParts = [];
     const advisoryParts = [];
     const projectDiagnosticsDelta = [];
     const projectDiagnosticsSources = new Set();
+    // #1641: past-EOF gate. Runs BEFORE the dependency-drift sweep below — a
+    // cheap statSync per cited file is worth paying first so the pricier
+    // import-parsing sweep can skip anything already taken out of the
+    // authoritative channel this turn (see blocker-past-eof.ts's module doc
+    // for the full composition rule with #1631's gate).
+    const blockerPastEofStart = Date.now();
+    const blockerPastEof = sweepInlineBlockerPastEof(runtime, cwd);
+    logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "blocker_past_eof_sweep",
+        durationMs: Date.now() - blockerPastEofStart,
+        metadata: {
+            total: blockerPastEof.total,
+            checked: blockerPastEof.checked,
+            demoted: blockerPastEof.demoted,
+            healed: blockerPastEof.healed,
+        },
+    });
+    // #1631: freshness gate. A cached blocker is a verdict about the file AND
+    // everything it imports; before re-serving it, sweep for out-of-band drift of
+    // the file or its forward imports and demote drifted entries to a
+    // `[stale — re-run to confirm]` advisory instead of re-asserting them at full
+    // authority (#1419 demote-not-drop).
+    const blockerFreshnessStart = Date.now();
+    // #1790: widen the sweep's population with widget-store rows a cache-served
+    // replay populated without ever touching RuntimeCoordinator's inline-blocker
+    // map — see blocker-freshness.ts's `WidgetSweepBlockerEntry` doc for why this
+    // is injected here rather than imported by blocker-freshness.ts itself.
+    const blockerFreshness = await sweepInlineBlockerFreshness(runtime, cwd, {
+        additionalEntries: getWidgetBlockingFilesForSweep().map((row) => ({
+            filePath: row.filePath,
+            recordedAtMs: row.recordedAtMs,
+            demote: () => markWidgetFileBlockersStale(row.filePath, "dependency-drift"),
+        })),
+    });
+    logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "blocker_freshness_sweep",
+        durationMs: Date.now() - blockerFreshnessStart,
+        metadata: {
+            total: blockerFreshness.total,
+            kept: blockerFreshness.kept,
+            revalidated: blockerFreshness.revalidated,
+            alreadyStale: blockerFreshness.alreadyStale,
+            truncatedImports: blockerFreshness.truncatedImports,
+        },
+    });
     // Re-surface inline blockers from this turn that the agent didn't fix.
     // These were shown inline during write/edit but the agent moved on without resolving them.
     const unresolvedBlockers = runtime.getInlineBlockersSnapshot();
-    for (const { filePath: bPath, summary } of unresolvedBlockers) {
+    for (const { filePath: bPath, summary, stale } of unresolvedBlockers) {
         const displayPath = toRunnerDisplayPath(cwd, bPath);
-        blockerParts.push(`Unresolved from this turn — ${displayPath}:\n${summary}`);
+        if (stale) {
+            // #1631: demoted — out of the authoritative blocker channel and into the
+            // advisory channel with a stale marker, so the agent is told to re-run
+            // rather than pressured by a verdict that may already be resolved.
+            // @delivery-surface: runtime-turn:unresolved-inline-blocker
+            advisoryParts.push(`${STALE_LINE_MARKER} ${displayPath}:\n${summary}`);
+        }
+        else {
+            // @delivery-surface: runtime-turn:unresolved-inline-blocker
+            blockerParts.push(`Unresolved from this turn — ${displayPath}:\n${summary}`);
+        }
     }
     // Drain the deferred cascade computes kicked off this turn (#450). They ran
     // concurrently off the write hot path; wait a bounded time for them here so
     // their runs are available to the merge below. A compute still in flight at
     // the cap is carried over to the next turn_end (never dropped).
     const cascadeSettleStart = Date.now();
-    const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs());
+    const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs(), { trackTurnEndClock: true });
     logLatency({
         type: "phase",
         toolName: "turn_end",
@@ -260,7 +460,10 @@ export async function handleTurnEnd(deps) {
             if (changedSince.length > 0) {
                 const changedSet = new Set(changedSince);
                 const primaryKey = normalizeMapKey(path.resolve(run.filePath));
-                const neighborKeys = (run.result?.neighbors ?? []).map((n) => normalizeMapKey(path.resolve(n.filePath)));
+                const neighborKeys = [
+                    ...(run.result?.neighbors ?? []).map((n) => n.filePath),
+                    ...(run.selectedNeighborPaths ?? []),
+                ].map((filePath) => normalizeMapKey(path.resolve(filePath)));
                 const supersededByOwnFile = changedSet.has(primaryKey) ||
                     neighborKeys.some((k) => changedSet.has(k));
                 if (supersededByOwnFile) {
@@ -286,6 +489,15 @@ export async function handleTurnEnd(deps) {
         return true;
     });
     const cascadeResults = cascadeRuns.flatMap((r) => r.result ? [r.result] : []);
+    // #1550 class sweep: every cascade record below summarises `cascadeResults`
+    // — runs, which carry their own paths and can be carried across turns
+    // (#1443) — so labelling them with the turn's first EDITED file is the same
+    // mis-attribution the `cascade_indeterminate` fix removes. On a read-only
+    // drain turn `files` is empty and the old `?? cwd` fallback stamped a bare
+    // DIRECTORY as the record's file. These three are turn-level AGGREGATES (no
+    // per-file cause is claimed), so one label suffices; the edited file and cwd
+    // stay as fallbacks.
+    const cascadeLogFilePath = cascadeResults[0]?.filePath ?? files[0] ?? cwd;
     if (cascadeResults.length > 0) {
         const seen = new Map();
         for (const result of cascadeResults) {
@@ -339,7 +551,7 @@ export async function handleTurnEnd(deps) {
             // recorded on the same phase rather than only logging on a hit.
             logCascade({
                 phase: "cascade_test_targets",
-                filePath: files[0] ?? cwd,
+                filePath: cascadeLogFilePath,
                 neighborCount: uniqueNeighborFiles.length,
                 metadata: {
                     neighborFiles: uniqueNeighborFiles.slice(0, 10),
@@ -362,6 +574,7 @@ export async function handleTurnEnd(deps) {
         }
         if (parts.length > 0) {
             const section = parts.join("\n\n");
+            // @delivery-surface: runtime-turn:cascade-blocker
             blockerParts.push(section);
             // #1446 item 1: proves the cascade section reached `blockerParts` —
             // i.e. it was QUEUED for persistence into the turn-end advisory — not
@@ -374,7 +587,7 @@ export async function handleTurnEnd(deps) {
             // the agent ever saw the text.
             logCascade({
                 phase: "cascade_injected",
-                filePath: files[0] ?? cwd,
+                filePath: cascadeLogFilePath,
                 neighborCount: injectedNeighborCount,
                 diagnosticCount: injectedDiagnosticCount,
                 metadata: {
@@ -386,7 +599,7 @@ export async function handleTurnEnd(deps) {
         }
         logCascade({
             phase: "cascade_turn_end",
-            filePath: files[0] ?? cwd,
+            filePath: cascadeLogFilePath,
             neighborCount: cascadeResults.reduce((s, r) => s + r.neighbors.length, 0),
             diagnosticCount: cascadeResults.reduce((s, r) => s + r.neighbors.reduce((ns, n) => ns + n.diagnostics.length, 0), 0),
             metadata: {
@@ -396,8 +609,9 @@ export async function handleTurnEnd(deps) {
         });
     }
     // #1023: surface an HONEST note whenever a cascade run could not compute
-    // downstream impact (degraded/over-cap graph, missing node, or a thrown
-    // compute) — never a silent all-clear (#533). This goes to the ADVISORY tier,
+    // downstream impact (degraded/over-cap graph, missing node, a thrown compute,
+    // or a deliberately budget-truncated neighbor set) — never a silent all-clear
+    // (#533). This goes to the ADVISORY tier,
     // NOT the blocker tier: in an over-cap monorepo the graph is `skipped` on
     // every edit, so a blocker would fire hard and never clear turn state every
     // turn (over-escalation — the mirror of the silent-all-clear bug). Advisory
@@ -434,7 +648,8 @@ export async function handleTurnEnd(deps) {
                 const more = files.length > 5 ? ` (+${files.length - 5} more)` : "";
                 lines.push(`  • ${detail}: ${shown}${more}`);
             }
-            const fileCount = new Set(runs.map((r) => normalizeMapKey(r.filePath))).size;
+            const fileCount = new Set(runs.map((r) => normalizeMapKey(r.filePath)))
+                .size;
             const reasons = [...byDetail.keys()].join("; ");
             return `${frame.lead(fileCount, reasons)}\n${lines.join("\n")}`;
         };
@@ -446,8 +661,15 @@ export async function handleTurnEnd(deps) {
         // info-level) so the log can tell an intentional exclusion from a real
         // graph gap, but it never reaches `buildAdvisory`/the agent.
         const graphRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason !== "lsp_binding_rejected" &&
-            r.indeterminate?.reason !== "excluded_by_role");
-        const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected");
+            r.indeterminate?.reason !== "excluded_by_role" &&
+            r.indeterminate?.reason !== "budget_truncated" &&
+            r.indeterminate?.budget === undefined);
+        const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected" &&
+            r.indeterminate?.budget === undefined);
+        // Budget coverage can be merged into a graph or binding marker, so its
+        // advisory bucket follows the evidence rather than replacing that reason.
+        const budgetRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "budget_truncated" ||
+            r.indeterminate?.budget !== undefined);
         // Factual/informational phrasing — the advisory tier wraps this with an
         // "ℹ️ Advisory — no action required this turn:" label, so an imperative
         // ("review dependents manually") would contradict it. The #533 substance
@@ -460,6 +682,7 @@ export async function handleTurnEnd(deps) {
                 ? "changed file not in the review graph"
                 : "review graph unavailable",
         });
+        // @delivery-surface: runtime-turn:cascade-coverage-advisory
         if (graphAdvisory)
             advisoryParts.push(graphAdvisory);
         const bindingAdvisory = buildAdvisory(bindingRuns, {
@@ -468,15 +691,57 @@ export async function handleTurnEnd(deps) {
                 `cascade result does not cover them.`,
             fallbackDetail: () => "cascade diagnostics withheld (binding rejected)",
         });
+        // @delivery-surface: runtime-turn:cascade-coverage-advisory
         if (bindingAdvisory)
             advisoryParts.push(bindingAdvisory);
+        const budgetAdvisory = buildAdvisory(budgetRuns, {
+            lead: (fileCount, reasons) => `Cascade checked the selected neighbors for ${fileCount} edited file(s) this turn, ` +
+                `but some eligible dependents were not checked because the cascade budget ` +
+                `was exhausted (${reasons}); a clean cascade result does not cover them.`,
+            fallbackDetail: (r) => {
+                const budget = r.indeterminate?.budget;
+                if (!budget)
+                    return "cascade budget omitted eligible dependents";
+                const detail = `cascade budget checked ${budget.selectedCount} of ${budget.eligibleCount} eligible dependents (${budget.truncatedCount} omitted)`;
+                return budget.transitiveTruncated
+                    ? `${detail}; transitive expansion was capped before all eligible dependents were enumerated`
+                    : detail;
+            },
+        });
+        // @delivery-surface: runtime-turn:cascade-coverage-advisory
+        if (budgetAdvisory)
+            advisoryParts.push(budgetAdvisory);
         const fileCount = new Set(indeterminateRuns.map((r) => normalizeMapKey(r.filePath))).size;
+        // #1550: attribute each reason to the file that PRODUCED it. This record
+        // used to stamp `filePath: files[0] ?? cwd` — the turn's first EDITED file
+        // — and a bare `reasons` array with no file association. The two sets are
+        // disjoint: a run can be carried across turns (#1443), and an edited file
+        // can skip the graph entirely (markdown/JSON return `non_code` before
+        // computeImpactCascade ever runs). So the log blamed a file that could not
+        // have produced the reason — a markdown file credited with `missing_node`,
+        // a non-test source file credited with `excluded_by_role` — and the defect
+        // read as "concentrated on test files" only because the first edited file
+        // of a turn usually is one. `fileCount` and the agent-facing advisory
+        // already keyed off `r.filePath`; only this record's labels did not.
+        const byFile = indeterminateRuns.map((r) => ({
+            file: toRunnerDisplayPath(cwd, r.filePath),
+            reason: r.indeterminate?.reason,
+            ...(r.indeterminate?.detail && { detail: r.indeterminate.detail }),
+            ...(r.indeterminate?.budget && { budget: r.indeterminate.budget }),
+            ...(r.indeterminate?.diagnostic && {
+                diagnostic: r.indeterminate.diagnostic,
+            }),
+        }));
         logCascade({
             phase: "cascade_indeterminate",
-            filePath: files[0] ?? cwd,
+            // The first indeterminate run's own file. `files[0] ?? cwd` survives only
+            // as a last resort for a run with no path at all.
+            filePath: indeterminateRuns[0]?.filePath ?? files[0] ?? cwd,
             metadata: {
                 fileCount,
                 reasons: indeterminateRuns.map((r) => r.indeterminate?.reason),
+                byFile: byFile.slice(0, 20),
+                ...(byFile.length > 20 && { byFileTruncated: byFile.length - 20 }),
             },
         });
     }
@@ -530,7 +795,9 @@ export async function handleTurnEnd(deps) {
             knipMeta = { skipped: true, reason: prevKnip.data.summary };
         }
         else {
-            const knipResult = await knipClient.analyze(cwd, getKnipIgnorePatterns());
+            const knipResult = await knipClient.analyze(cwd, getKnipIgnorePatterns(), {
+                projectSeq: runtime.projectSeq,
+            });
             // Never overwrite a good scan with a failure (#925, #1467): the last
             // good result stays until a new successful scan replaces it.
             const knipWouldPoison = wouldPoisonCache(prevKnip, knipResult);
@@ -541,6 +808,7 @@ export async function handleTurnEnd(deps) {
                 cacheManager.writeCache("knip", knipResult, cwd);
             }
             knipMeta = {
+                execution: knipResult.execution ?? "executed",
                 success: knipResult.success,
                 totalIssues: knipResult.issues.length,
                 newIssues: 0,
@@ -550,7 +818,9 @@ export async function handleTurnEnd(deps) {
                 ...(knipWouldPoison && { cacheKept: true }),
             };
             if (knipResult.success && knipResult.issues.length > 0) {
-                const issueKey = (i) => `${i.type}:${i.file ?? ""}:${i.name}:${i.line ?? 0}:${i.package ?? ""}`;
+                // Deliberately excludes the line number — see stableFindingKey's
+                // doc comment (#1483: mirrors the dead-code fix in #1477).
+                const issueKey = (i) => stableFindingKey(i.type, i.file, i.name, i.package);
                 const prevKeys = new Set((prevKnip?.data?.issues ?? []).map(issueKey));
                 const modifiedSet = new Set(files.map((f) => resolveRunnerPath(cwd, f)));
                 const newIssues = knipResult.issues.filter((issue) => {
@@ -582,6 +852,7 @@ export async function handleTurnEnd(deps) {
                     if (firstPath) {
                         report += `  First location: ${firstPath}\n`;
                     }
+                    // @delivery-surface: runtime-turn:knip-blocker
                     blockerParts.push(report);
                 }
                 // Turn-end injects only this turn's HIGH-CONFIDENCE, ATTRIBUTABLE
@@ -601,6 +872,7 @@ export async function handleTurnEnd(deps) {
                             : "(unknown)";
                         report += `  ${display}${issue.line ? `:${issue.line}` : ""} — ${issue.name}\n`;
                     }
+                    // @delivery-surface: runtime-turn:knip-advisory
                     advisoryParts.push(report);
                 }
             }
@@ -724,6 +996,7 @@ export async function handleTurnEnd(deps) {
                     newIssueTotal += newIssues.length;
                     projectDiagnosticsDelta.push(...newIssues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language)));
                     projectDiagnosticsSources.add("dead-code");
+                    // @delivery-surface: runtime-turn:dead-code-advisory
                     advisoryParts.push(formatDeadCodeDelta(newIssues, result.language));
                 }
                 catch (err) {
@@ -748,25 +1021,71 @@ export async function handleTurnEnd(deps) {
         durationMs: Date.now() - tDeadCode,
         metadata: deadCodeMeta,
     });
+    // #1617: running total of findings this turn's advisory/blocker sections
+    // dropped because an agent/user marked them false-positive/won't-fix —
+    // the #1616 suppressed-bucket rule applied to turn_end's own reporting
+    // lanes, so a mark's effect stays visible even though the finding itself
+    // no longer appears above. Review-round F4 (#1625): kept per-lane, not
+    // just a bare total, so the eventual trace says WHICH lane's marks did
+    // the suppressing.
+    let dispositionSuppressedTotal = 0;
+    const dispositionSuppressedByLane = {};
+    function recordDispositionSuppressed(lane, count) {
+        if (count <= 0)
+            return;
+        dispositionSuppressedTotal += count;
+        dispositionSuppressedByLane[lane] =
+            (dispositionSuppressedByLane[lane] ?? 0) + count;
+    }
     // govulncheck — surface session_start-cached Go CVE findings as advisory.
     // No per-turn re-run in this slice; the cache refreshes at next session_start.
     const govCacheEntry = cacheManager.readCache("govulncheck", cwd);
-    if (govCacheEntry?.data?.findings?.length) {
-        const findings = govCacheEntry.data.findings.slice(0, 5);
+    // #1622: govulncheck renders a call site as `file:line`, and the cache is a
+    // session_start snapshot — the same stale-line shape as gitleaks, one tier
+    // lower. A CVE is pinned by go.mod, NOT by the call site, so neither an edit
+    // nor a deletion may drop it: `onMissing: "demote"` routes a vanished traced
+    // file into the same arm as an edited one. This gate only ever decides
+    // whether the cited LINE is still worth printing. (Review round H1: the first
+    // cut let a deleted trace file drop the CVE, contradicting this comment, and
+    // `citedPath` reads only the FIRST filename frame — so one deleted file in a
+    // long trace silently killed a CVE that go.mod still pins.)
+    const govGate = gateFindingsByPathFreshness({
+        store: "govulncheck",
+        findings: govCacheEntry?.data?.findings ?? [],
+        cwd,
+        scannedAt: govCacheEntry?.data?.scannedAt,
+        citedPath: (finding) => finding.trace.find((t) => t.filename)?.filename,
+        onMissing: "demote",
+    });
+    const govStale = new Set(govGate.stale);
+    // #1625 review round: the #1622 freshness gate runs FIRST — the disposition
+    // filter's anchor is derived from each finding's post-demotion identity
+    // (this array is already the gate's live+stale partition, never the raw
+    // pre-gate cache). #1627's own post-gate guard (`if (govFindings.length)`)
+    // and this round's disposition guard are the SAME guard — compose them,
+    // never fall back to a raw-cache-length check (that would print the header
+    // with zero rows beneath it whenever either filter empties the list).
+    const govFiltered = filterFindingsByDisposition([...govGate.live, ...govGate.stale], cwd, (f) => govulncheckFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("govulncheck", govFiltered.suppressed);
+    const govFindings = govFiltered.kept;
+    if (govFindings.length) {
+        const findings = govFindings.slice(0, 5);
         let report = "🛡️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:\n";
         for (const f of findings) {
             const callSite = f.trace.find((t) => t.filename);
+            const stale = govStale.has(f);
             const where = callSite?.filename
-                ? `${toRunnerDisplayPath(cwd, callSite.filename)}${callSite.line ? `:${callSite.line}` : ""}`
+                ? `${toRunnerDisplayPath(cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}`
                 : (f.module ?? f.packageName ?? "(module)");
             const fix = f.fixedVersion
                 ? ` — upgrade to ${f.fixedVersion} or later`
                 : " — no fix yet, track upstream";
             report += `  ${f.osv} (${where})${fix}\n`;
         }
-        if (govCacheEntry.data.findings.length > findings.length) {
-            report += `  … and ${govCacheEntry.data.findings.length - findings.length} more\n`;
+        if (govFindings.length > findings.length) {
+            report += `  … and ${govFindings.length - findings.length} more\n`;
         }
+        // @delivery-surface: runtime-turn:govulncheck-advisory
         advisoryParts.push(report);
     }
     const trivyCacheEntry = cacheManager.readCache("trivy", cwd);
@@ -776,6 +1095,7 @@ export async function handleTurnEnd(deps) {
     // location so a committed/hardcoded secret is reported ONCE (with combined
     // provenance) — a blocker, since credentials need rotation before merge.
     const gitleaksData = cacheManager.readCache("gitleaks", cwd)?.data;
+    const trivySecretsData = trivyCacheEntry?.data;
     // #1461 slice 1 (#1460): the gitleaks cache is TTL-only, so a finding for a
     // file deleted after the scan is still served as a 🔴 blocker for the rest
     // of the 30-minute window — the live case, and 119 of 126 findings in
@@ -783,20 +1103,85 @@ export async function handleTurnEnd(deps) {
     // store (session_start's read only decides whether to re-scan; the
     // project-diagnostics path re-scans fresh and reconciles at load), so the
     // drop belongs here, before the findings enter the shared secret pipeline.
-    // gitleaks only in this slice — trivy secrets are slice 1's sibling store.
-    const gitleaksFindings = dropFindingsForMissingPaths({
+    // #1622 extends that gate from existence to freshness, and adds trivy
+    // secrets — the sibling store with the identical shape. A cited file edited
+    // after the scan keeps its finding but loses its line number: the credential
+    // may still be there, just not where the snapshot says. Dropping instead
+    // would let any edit — malicious or accidental — mute a real secret.
+    const gitleaksGate = gateFindingsByPathFreshness({
         store: "gitleaks",
         findings: gitleaksData?.findings ?? [],
         cwd,
+        scannedAt: gitleaksData?.scannedAt,
         citedPath: (finding) => finding.file,
     });
+    const trivySecretsGate = gateFindingsByPathFreshness({
+        store: "trivy-secrets",
+        findings: trivySecretsData?.secrets ?? [],
+        cwd,
+        scannedAt: trivySecretsData?.scannedAt,
+        citedPath: (finding) => finding.file,
+    });
+    // #1617: THE bug this issue exists for — gitleaks findings never passed
+    // through `applyDispositions`, so an agent-marked false-positive/won't-fix
+    // re-reported as a 🔴 STOP blocker on every turn. Filter through the SAME
+    // `gitleaksFindingToProjectDiagnostic` identity `lens_diagnostics
+    // mode=full` surfaces (tool="gitleaks", rule="gitleaks:<ruleId>", the
+    // exact "Potential secret: …" message) so a mark made against what the
+    // agent was shown is honored here too.
+    //
+    // #1625 review round: filtered AFTER the #1622 freshness gate above — the
+    // anchor is derived from each finding's post-demotion identity, never the
+    // raw pre-gate cache. Applied to BOTH `gitleaksGate.live` AND
+    // `gitleaksGate.stale`: `staleSecretEntries` below derives from the stale
+    // arm, and an fp-marked finding that later goes stale must not reappear
+    // there — a suppression escape (and a double count against
+    // `dispositionSuppressedTotal`) that a live-only filter would have missed.
+    //
+    // #1628: trivy-secret findings get the SAME treatment, now that
+    // `trivySecretFindingToProjectDiagnostic` (project-diagnostics/runner-
+    // adapters/trivy.ts) gives them a `lens_diagnostics`-surfaced identity
+    // (tool="trivy", rule="trivy-secret:<ruleId>") to anchor a mark against —
+    // same pattern as gitleaks above, applied to both the live and stale arms
+    // for the same reason.
+    //
+    // ast-grep secret findings need no filtering here — they already went
+    // through dispatch's applyDispositions before reaching
+    // `peekActionableWarnings()`.
+    const gitleaksLiveFiltered = filterFindingsByDisposition(gitleaksGate.live, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
+    const gitleaksStaleFiltered = filterFindingsByDisposition(gitleaksGate.stale, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("gitleaks", gitleaksLiveFiltered.suppressed + gitleaksStaleFiltered.suppressed);
+    const trivySecretsLiveFiltered = filterFindingsByDisposition(trivySecretsGate.live, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
+    const trivySecretsStaleFiltered = filterFindingsByDisposition(trivySecretsGate.stale, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("trivy-secrets", trivySecretsLiveFiltered.suppressed + trivySecretsStaleFiltered.suppressed);
     const astSecretWarnings = runtime
         .peekActionableWarnings()
         .filter(isSecretWarning);
     const sessionSecrets = dedupeSecretFindings([
-        ...fromGitleaks(gitleaksFindings),
-        ...fromTrivySecrets(trivyCacheEntry?.data?.secrets ?? []),
+        ...fromGitleaks(gitleaksLiveFiltered.kept),
+        ...fromTrivySecrets(trivySecretsLiveFiltered.kept),
     ]);
+    // Demoted secrets are addressed by FILE, never by line — the line is the one
+    // field the edit invalidated. Rule id and source survive it and must be
+    // carried through (review round M1): an agent triages an `aws-access-token`
+    // differently from a low-confidence `generic-api-key`, and cannot do that
+    // from a bare path. Deduped on file+rule+source so a file with twenty stale
+    // hits of one rule is named once.
+    const staleSecretEntries = [
+        ...gitleaksStaleFiltered.kept.map((f) => ({
+            file: toRunnerDisplayPath(cwd, f.file),
+            rule: f.ruleId,
+            source: "gitleaks",
+        })),
+        ...trivySecretsStaleFiltered.kept.map((f) => ({
+            file: toRunnerDisplayPath(cwd, f.file),
+            rule: f.ruleId,
+            source: "trivy",
+        })),
+    ];
+    const staleSecrets = [
+        ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values(),
+    ];
     // Locations already surfaced as session-scan secret blockers — used to enrich
     // provenance where ast-grep agrees and to suppress the duplicate ast-grep copy
     // from the actionable-warnings advisory below.
@@ -817,14 +1202,48 @@ export async function handleTurnEnd(deps) {
         if (enriched.length > shown.length) {
             report += `  … and ${enriched.length - shown.length} more\n`;
         }
+        // @delivery-surface: runtime-turn:secrets-gitleaks,runtime-turn:secrets-trivy
         blockerParts.push(report);
     }
+    if (staleSecrets.length) {
+        // Its OWN tier, never `advisoryParts` (review round M2). The advisory tier
+        // is labelled "no action required this turn", which would sit directly
+        // above copy telling the agent to re-scan — a section that contradicts its
+        // own heading. This preamble is imperative because the action is real: the
+        // finding is unverified, not dismissed.
+        const shown = staleSecrets.slice(0, 5);
+        let report = `🔑 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}\n` +
+            "The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:\n";
+        for (const entry of shown) {
+            report += `  ${entry.file} — ${entry.rule} [${entry.source}]\n`;
+        }
+        if (staleSecrets.length > shown.length) {
+            report += `  … and ${staleSecrets.length - shown.length} more\n`;
+        }
+        // @delivery-surface: runtime-turn:stale-secrets-tier
+        staleSecretParts.push(report);
+    }
     // trivy — surface session_start-cached dependency CVEs (#131, Phase 1).
     // CRITICAL is a blocker (a known-exploitable CVE in a shipped dep is real
     // production risk); HIGH/MEDIUM/LOW are advisory. The agent gets the upgrade
     // target as a hint and decides — we never auto-edit lockfiles.
-    if (trivyCacheEntry?.data?.findings?.length) {
-        const all = trivyCacheEntry.data.findings;
+    //
+    // #1634: these three trivy reports (critical blocker, non-critical
+    // advisory, license advisory below) name a PACKAGE, not a file:line — there
+    // is no cited path for `gateFindingsByPathFreshness` to stat, so unlike the
+    // secrets/govulncheck stores above this store cannot be freshness-GATED.
+    // It is the delivery gate's explicit-label escape hatch instead
+    // (`clients/finding-delivery-gate.ts`, surfaces `runtime-turn:trivy-*`):
+    // the session_start cache can be arbitrarily old, so its age is stated
+    // plainly rather than presenting a CRITICAL blocker as if it were current.
+    // This runs on top of (not instead of) #1625's disposition filter below —
+    // a suppressed finding never reaches this render at all, so the two only
+    // ever compose.
+    const trivyAgeLabel = formatCacheAgeLabel(trivyCacheEntry?.data?.scannedAt);
+    const trivyFindingsFiltered = filterFindingsByDisposition(trivyCacheEntry?.data?.findings ?? [], cwd, (f) => trivyFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("trivy", trivyFindingsFiltered.suppressed);
+    if (trivyFindingsFiltered.kept.length) {
+        const all = trivyFindingsFiltered.kept;
         const critical = all.filter((f) => f.severity === "CRITICAL");
         const advisory = all.filter((f) => f.severity !== "CRITICAL");
         const fmt = (f) => {
@@ -838,32 +1257,35 @@ export async function handleTurnEnd(deps) {
         };
         if (critical.length) {
             const shown = critical.slice(0, 5);
-            let report = "🔴 STOP — CRITICAL dependency CVEs (trivy). Upgrade before shipping:\n";
+            let report = `🔴 STOP — CRITICAL dependency CVEs (trivy, ${trivyAgeLabel}). Upgrade before shipping:\n`;
             for (const f of shown)
                 report += fmt(f);
             if (critical.length > shown.length) {
                 report += `  … and ${critical.length - shown.length} more\n`;
             }
+            // @delivery-surface: runtime-turn:trivy-critical-blocker
             blockerParts.push(report);
         }
         if (advisory.length) {
             const shown = advisory.slice(0, 5);
-            let report = "🛡️ Dependency CVEs (trivy) — upgrade where possible:\n";
+            let report = `🛡️ Dependency CVEs (trivy, ${trivyAgeLabel}) — upgrade where possible:\n`;
             for (const f of shown)
                 report += fmt(f);
             if (advisory.length > shown.length) {
                 report += `  … and ${advisory.length - shown.length} more\n`;
             }
+            // @delivery-surface: runtime-turn:trivy-cve-advisory
             advisoryParts.push(report);
         }
     }
     // trivy — dependency license risk (#131 Mode 4). Advisory only: a copyleft /
     // restricted license in a proprietary tree is a compliance signal, not a
-    // build break. Surfaced from the same cached `trivy fs` pass.
+    // build break. Surfaced from the same cached `trivy fs` pass — same #1634
+    // explicit-label rationale as the CVE reports above (no cited path to gate).
     const licenses = trivyCacheEntry?.data?.licenses ?? [];
     if (licenses.length) {
         const shown = licenses.slice(0, 5);
-        let report = "📜 Dependency license risk (trivy) — review for compliance:\n";
+        let report = `📜 Dependency license risk (trivy, ${trivyAgeLabel}) — review for compliance:\n`;
         for (const l of shown) {
             const cat = l.category ? `, ${l.category}` : "";
             report += `  ${l.pkgName} — ${l.license} (${l.severity}${cat})\n`;
@@ -871,11 +1293,30 @@ export async function handleTurnEnd(deps) {
         if (licenses.length > shown.length) {
             report += `  … and ${licenses.length - shown.length} more\n`;
         }
+        // @delivery-surface: runtime-turn:trivy-license-advisory
         advisoryParts.push(report);
     }
+    // #1616 suppressed-bucket rule: surface the running disposition-drop total
+    // as its own advisory line so a mark's effect is visible, not a silent
+    // absence — trace, not a vanish.
+    if (dispositionSuppressedTotal > 0) {
+        // Review-round F4 (#1625): per-lane attribution, e.g.
+        // "gitleaks 2, govulncheck 1" — not just a bare total.
+        const byLane = Object.entries(dispositionSuppressedByLane)
+            .map(([lane, count]) => `${lane} ${count}`)
+            .join(", ");
+        // @delivery-surface: runtime-turn:disposition-suppressed-notice
+        advisoryParts.push(`suppressed by disposition: ${dispositionSuppressedTotal} finding(s) ` +
+            `dropped from this turn's gitleaks/govulncheck/trivy sections (${byLane}) ` +
+            "(marked false-positive or won't-fix).");
+    }
     const t3 = Date.now();
     let madgeStats;
-    if (await depChecker.ensureAvailable()) {
+    // Off by default (#766): this pass only writes debug output, and user-facing
+    // madge diagnostics come from the session-start `madge` cache + the
+    // `lens_diagnostics` extractor. Enabled with `--lens-turn-end-madge` /
+    // `turnEnd.madge.enabled=true` for those who want the per-edit circular note.
+    if (getFlag("lens-turn-end-madge") && (await depChecker.ensureAvailable())) {
         const madgeFiles = cacheManager.getFilesForMadge(cwd);
         if (madgeFiles.length > 0) {
             dbg(`turn_end: madge checking ${madgeFiles.length} file(s) for circular deps`);
@@ -911,7 +1352,9 @@ export async function handleTurnEnd(deps) {
         filePath: cwd,
         phase: "madge",
         durationMs: Date.now() - t3,
-        ...(madgeStats && { metadata: madgeStats }),
+        // A ~0ms entry with no metadata is indistinguishable from "ran and was
+        // fast" when re-analyzing the #766 tail — mark the skipped case.
+        metadata: madgeStats ?? { skipped: true },
     });
     // --- Test runner: fire once per turn after all edits are done ---
     // Runs for each unique test target across modified files; results appear
@@ -966,8 +1409,14 @@ export async function handleTurnEnd(deps) {
             const priorTestCache = cacheManager.readCache("test-runner-findings", cwd)?.data;
             const testRunGeneration = (priorTestCache?.testRunGeneration ?? 0) + 1;
             const provenanceFiles = [
-                ...candidates.map((candidate) => ({ path: candidate.abs, role: "source" })),
-                ...targets.map((target) => ({ path: target.testFile, role: "test" })),
+                ...candidates.map((candidate) => ({
+                    path: candidate.abs,
+                    role: "source",
+                })),
+                ...targets.map((target) => ({
+                    path: target.testFile,
+                    role: "test",
+                })),
             ];
             const launchedFrom = snapshotAdvisoryProvenance({
                 cwd,
@@ -1029,7 +1478,16 @@ export async function handleTurnEnd(deps) {
                         ? `error: ${error}`
                         : `${verdict} ${passed}p/${failed}f (${elapsed})`;
                     dbg(`turn_end: ${stale ? "[stale] " : ""}test ${runner} ${shortFile} → ${summary}`);
-                    if (failed > 0) {
+                    // #1524: also fires on `error` alone, not just `failed > 0`.
+                    // A runner-error result (the suite never started — spawn/
+                    // config failure) has `failed === 0` by construction, so
+                    // gating on `failed > 0` alone dropped it silently: the
+                    // agent got no context at all, and the empty `failures`
+                    // array below sent this result down the "all tests
+                    // passed" branch, clearing any prior real test-failure
+                    // git-guard blocker. `formatResult` already renders the
+                    // error-only case as "Could not run tests: ...".
+                    if (failed > 0 || error) {
                         const formatted = testRunnerClient.formatResult(r.value);
                         if (formatted)
                             failures.push(formatted);
@@ -1037,7 +1495,8 @@ export async function handleTurnEnd(deps) {
                 }
                 if (failures.length > 0) {
                     const currentGeneration = cacheManager.readCache("test-runner-findings", cwd)?.data?.testRunGeneration;
-                    if (currentGeneration !== undefined && currentGeneration > testRunGeneration) {
+                    if (currentGeneration !== undefined &&
+                        currentGeneration > testRunGeneration) {
                         dbg(`turn_end: test generation ${testRunGeneration} superseded by ${currentGeneration}`);
                         return;
                     }
@@ -1055,9 +1514,25 @@ export async function handleTurnEnd(deps) {
                         superseded,
                     }, cwd);
                     if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
-                        clearGitGuardTestFailure(cacheManager, cwd, runtime, resultValues
-                            .filter((value) => value.failed === 0)
-                            .map((value) => value.file));
+                        // #1524: `&& !value.error` — a runner-error result has
+                        // `failed === 0` (the suite never ran, so nothing could
+                        // fail), but it is not a pass. Without the filter it
+                        // would clear a prior real test-failure git-guard
+                        // blocker on the strength of a suite that never
+                        // started. And the call itself is skipped when this
+                        // list is empty rather than passed as `[]`:
+                        // `clearGitGuardTestFailure`'s own empty-array
+                        // fallback treats "no files named" as "clear every
+                        // blocked file", so an all-error batch (one go file,
+                        // runner-error, zero clean files) would otherwise
+                        // clear every blocker through that fallback instead
+                        // of clearing none.
+                        const cleanFiles = resultValues
+                            .filter((value) => value.failed === 0 && !value.error)
+                            .map((value) => value.file);
+                        if (cleanFiles.length > 0) {
+                            clearGitGuardTestFailure(cacheManager, cwd, runtime, cleanFiles);
+                        }
                         mergeGitGuardTestFailure(cacheManager, cwd, runtime, content, resultValues
                             .filter((value) => value.failed > 0)
                             .map((value) => value.file));
@@ -1065,7 +1540,8 @@ export async function handleTurnEnd(deps) {
                     dbg(`turn_end: ${failures.length} test failure(s) cached for next context injection${stale ? " (stale — turn advanced while tests ran)" : ""}`);
                 }
                 else if (results.length > 0) {
-                    if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
+                    if (getFlag("lens-guard") &&
+                        firedSessionId === runtime.telemetrySessionId) {
                         clearGitGuardTestFailure(cacheManager, cwd, runtime, resultValues.map((value) => value.file));
                     }
                     dbg(`turn_end: all tests passed${stale ? " (stale — turn advanced while tests ran)" : ""}`);
@@ -1098,6 +1574,7 @@ export async function handleTurnEnd(deps) {
             // into an authoritative-looking clean result for the rest of the file.
             // Keep the limitation visible and require a complete graph for this
             // user-facing impact surface (#1070).
+            // @delivery-surface: runtime-turn:call-graph-advisory
             advisoryParts.push("Call-graph impact was not emitted because call-graph extraction coverage is incomplete; " +
                 "the affected files may have unreported callers.");
         }
@@ -1115,7 +1592,8 @@ export async function handleTurnEnd(deps) {
                     const changedFileKey = normalizeMapKey(resolveRunnerPath(cwd, filePath));
                     const fileCallerKeys = [...runtime.callGraph.callers.keys()].filter((k) => {
                         const graphFilePath = parseSymbolKey(k).filePath;
-                        return normalizeMapKey(resolveRunnerPath(cwd, graphFilePath)) === changedFileKey;
+                        return (normalizeMapKey(resolveRunnerPath(cwd, graphFilePath)) ===
+                            changedFileKey);
                     });
                     for (const calleeKey of fileCallerKeys.slice(0, 3)) {
                         // #1080: drop KNOWN test-role callers BEFORE both the human advisory
@@ -1139,6 +1617,7 @@ export async function handleTurnEnd(deps) {
                     }
                 }
                 if (impactLines.length > 0) {
+                    // @delivery-surface: runtime-turn:call-graph-advisory
                     advisoryParts.push(`📊 Call-graph impact (changed symbols have callers):\n${impactLines.join("\n")}`);
                 }
                 if (impactFindings.length > 0) {
@@ -1207,6 +1686,7 @@ export async function handleTurnEnd(deps) {
             writeActionableWarningsReport(cacheManager, cwd, report);
             appendActionableWarningsHistory(cwd, report);
             const advisory = formatActionableWarningsAdvisory(report);
+            // @delivery-surface: runtime-turn:actionable-warnings-advisory
             if (advisory)
                 advisoryParts.push(advisory);
             logActionableWarningsEvent({
@@ -1256,6 +1736,7 @@ export async function handleTurnEnd(deps) {
         writeCodeQualityWarningsReport(cacheManager, cwd, qualityReport);
         appendCodeQualityWarningsHistory(cwd, qualityReport);
         const advisory = formatCodeQualityWarningsAdvisory(qualityReport);
+        // @delivery-surface: runtime-turn:code-quality-warnings-advisory
         if (advisory)
             advisoryParts.push(advisory);
         logLatency({
@@ -1283,7 +1764,13 @@ export async function handleTurnEnd(deps) {
     }
     cacheManager.incrementTurnCycle(cwd, currentOwner);
     const labeledAdvisoryParts = advisoryParts.map((p) => `ℹ️ Advisory — no action required this turn:\n${p}`);
-    const findingParts = [...blockerParts, ...labeledAdvisoryParts];
+    // Stale-secret parts sit between the two tiers and are NOT relabelled — they
+    // ship the imperative preamble they were built with (#1622 review M2).
+    const findingParts = [
+        ...blockerParts,
+        ...staleSecretParts,
+        ...labeledAdvisoryParts,
+    ];
     if (findingParts.length > 0) {
         dbg(`turn_end: ${blockerParts.length} blocker section(s), ${advisoryParts.length} advisory section(s) found, persisting for next context`);
         const content = capTurnEndMessage(findingParts.join("\n\n"));
@@ -1308,7 +1795,12 @@ export async function handleTurnEnd(deps) {
                         blockingFiles: blockerParts.length > 0 ? existingGuard.affectedFiles : undefined,
                         projectSeqStart: runtime.turnStartProjectSeq,
                         projectSeqEnd: runtime.projectSeq,
-                        fileSeqByPath: Object.fromEntries(runtime.getFileSeqEntries().map(([filePath, seq]) => [normalizeMapKey(path.resolve(filePath)), seq])),
+                        fileSeqByPath: Object.fromEntries(runtime
+                            .getFileSeqEntries()
+                            .map(([filePath, seq]) => [
+                            normalizeMapKey(path.resolve(filePath)),
+                            seq,
+                        ])),
                         fileContentHashes: {},
                         consumed: false,
                     });
@@ -1361,8 +1853,7 @@ export async function handleTurnEnd(deps) {
                     .filter((neighbor) => neighbor.diagnostics.length > 0)
                     .map((neighbor) => resolveRunnerPath(cwd, neighbor.filePath))),
             ];
-            const affectedFiles = [...new Set(allAffectedFiles)]
-                .slice(0, MAX_ADVISORY_AFFECTED_FILES);
+            const affectedFiles = [...new Set(allAffectedFiles)].slice(0, MAX_ADVISORY_AFFECTED_FILES);
             const affectedFilesTruncated = new Set(allAffectedFiles).size > affectedFiles.length;
             cacheManager.writeCache("turn-end-findings", {
                 content,
@@ -1372,7 +1863,10 @@ export async function handleTurnEnd(deps) {
                     cwd,
                     runtime,
                     generation: 0,
-                    files: affectedFiles.map((file) => ({ path: file, role: "affected" })),
+                    files: affectedFiles.map((file) => ({
+                        path: file,
+                        role: "affected",
+                    })),
                     truncated: affectedFilesTruncated,
                 }),
             }, cwd);
@@ -1395,7 +1889,13 @@ export async function handleTurnEnd(deps) {
     }
     if (blockerParts.length === 0) {
         cacheManager.clearTurnState(cwd, currentOwner);
-        if (getFlag("lens-guard") && advisoryParts.length === 0 && !runtime.gitGuardHasBlockers) {
+        // `staleSecretParts` counts here too (#1622 review M2): clearing the
+        // findings record while a stale secret is still unverified would drop the
+        // only surviving trace of it.
+        if (getFlag("lens-guard") &&
+            advisoryParts.length === 0 &&
+            staleSecretParts.length === 0 &&
+            !runtime.gitGuardHasBlockers) {
             const guardRecord = cacheManager.readCache("turn-end-findings", cwd)?.data;
             if (guardRecord?.sessionId === runtime.telemetrySessionId &&
                 guardRecord.testFailures !== true) {
@@ -1411,10 +1911,18 @@ export async function handleTurnEnd(deps) {
         toolName: "turn_end",
         filePath: cwd,
         durationMs: Date.now() - turnEndStart,
-        result: blockerParts.length > 0 ? "blockers_found" : "clean",
+        // #1622 review M2: a pending stale secret is NOT a clean turn. It gets its
+        // own result rather than being promoted to `blockers_found`, which would
+        // undo the demotion the freshness gate just made.
+        result: blockerParts.length > 0
+            ? "blockers_found"
+            : staleSecretParts.length > 0
+                ? "stale_secrets_pending"
+                : "clean",
         metadata: {
             fileCount: files.length,
             blockerSections: blockerParts.length,
+            staleSecretSections: staleSecretParts.length,
             advisorySections: advisoryParts.length,
         },
     });