@herbertgao/pi-extensions 2026.9.0 → 2026.9.2

package/node_modules/pi-lens/dist/clients/lsp/session-roots.js

@@ -11,10 +11,26 @@
  * index.ts`'s import surface from `config.js` is mirrored by an explicit
  * `vi.mock` factory in ~58 test files. Importing a new symbol from `config.js`
  * breaks every one of them with "No export is defined on the mock", which is a
- * standing tax on any future export. The registry is also a different concern
- * from `workspaceConfigs`: that map stores per-root CONFIG PAYLOAD and is
- * LRU-capped at 32, whereas this set answers "is this root served" and must
- * not silently evict a live root and start declining its files.
+ * standing tax on any future export.
+ *
+ * WHY THE CONFIG PAYLOAD LIVES HERE TOO (#2518). Until this fix the payload
+ * lived in `config.ts`'s own 32-entry `workspaceConfigs` LRU while this
+ * registry held 128, and the two answered halves of ONE question: the registry
+ * decides whether a root still needs initializing (`ensureReady`,
+ * `mcp/server.ts`), the payload decides whether the operator's
+ * `lsp.disabledServers` denial applies (`isServerDisabled`). Thirty-three
+ * `ensureReady` calls on other cwds therefore dropped a LIVE root's denial
+ * while the registry still reported the root ready, so nothing re-initialized
+ * it and a server the operator had turned off came back — #2415 AC 3's exact
+ * prohibition, silently.
+ *
+ * Tying the two CAPS would not have fixed it. `initLSPConfig` registers the
+ * root BEFORE its `await` and writes the payload AFTER, so two interleaved
+ * initializations enter the two containers in different orders; with separate
+ * containers the same cap still evicts different keys from each. One entry per
+ * root — the key IS the registration, the value IS the payload — makes a
+ * payload miss for a served root impossible by construction instead of by an
+ * ordering agreement between two modules.
  *
  * WHY IT IS NOT A LATCH. The first attempt at #2052 used a single
  * last-writer-wins session cwd that fell back to `process.cwd()`. Two bugs
@@ -31,31 +47,108 @@
  *
  * This is also the seam #2053 needs: an explicit `analysisRoot` registers here.
  */
+import { BoundedFifoMap } from "../bounded-cache.js";
+import { incrementDegradationCount } from "../degradation-ledger.js";
 import { isSameOrWithin } from "./server.js";
 import path from "node:path";
 /**
- * Insertion-ordered, so eviction drops the OLDEST root. Matches
- * `LSP_CONFIG_CWD_CAP` in `index.ts`, the cap on the set of cwds that
- * `ensureLSPConfigInitialized` will initialize at all — a root this process
- * cannot re-initialize must not still be considered served.
+ * Insertion-ordered, so eviction drops the OLDEST root. `BoundedFifoMap`
+ * (#2442) owns the eviction; this module no longer hand-rolls it. FIFO and not
+ * LRU on purpose: eviction order is REGISTRATION order, so a config write for
+ * an already-registered root cannot reorder the registry underneath the
+ * `ensureReady` memo that reads it.
+ *
+ * The value is `undefined` between `registerSessionRoot` and the config write
+ * that follows the loader's `await` — the same window in which, before #2518,
+ * no payload existed for the root at all. {@link sessionRootConfigEntries}
+ * skips those entries, so an in-flight root resolves exactly as it did before:
+ * to a shorter ancestor root's config, or to none.
  */
-const sessionRoots = new Set();
 const SESSION_ROOT_CAP = 128;
-/** Record a session cwd as served. Idempotent; re-registering refreshes nothing. */
-export function registerSessionRoot(cwd) {
-    sessionRoots.add(path.resolve(cwd));
-    while (sessionRoots.size > SESSION_ROOT_CAP) {
-        const oldest = sessionRoots.values().next().value;
-        if (oldest === undefined)
-            break;
-        sessionRoots.delete(oldest);
+const sessionRoots = new BoundedFifoMap(SESSION_ROOT_CAP);
+/**
+ * The cap dropped a root this process was serving. Its files fall back to
+ * pre-#2052 clamp behavior and its `lsp.disabledServers` denial stops applying
+ * until something initializes the root again — which `shouldInitializeSessionRoot`
+ * now guarantees the next SESSION START OR TOOL CALL naming that root does,
+ * because the registration went with the payload. Nothing else re-initializes:
+ * the readers of the denial (`isServerDisabled`, `getServersForFileWithConfig`,
+ * `getServerInitOverride`) ask the store, they never load it.
+ *
+ * A CONSTANT subject, counted rather than latched (#2518 review F3). The
+ * subject cannot be the evicted root: the ledger's `recordDegradationOnce` /
+ * `incrementDegradationCount` dedupe keys are unbounded, so a per-root subject
+ * would grow one key per root a long-lived process ever cycles through — a
+ * container bounded on one axis and unbounded on another, which is the shape
+ * this whole fix is about. That argument bounds the SUBJECT; it is not an
+ * argument for throwing the tally away, and the number of roots this process
+ * has had to drop is exactly what an operator tunes the cap against. The
+ * ledger keeps one entry per kind/subject and emits durable rows only on
+ * power-of-two counts, so counting is as bounded here as latching.
+ *
+ * Returns the evicted roots so the caller can drop the per-root session
+ * bookkeeping that described them — `initLSPConfig` releases each one's
+ * `config_resolved` claim (review F1).
+ */
+function noteEvictedRoots(evicted) {
+    const roots = evicted.map(([root]) => root);
+    if (roots.length > 0) {
+        incrementDegradationCount({
+            kind: "lsp-session-root-evicted",
+            subject: `cap=${SESSION_ROOT_CAP}`,
+            reason: `session root registry at capacity; dropped ${roots[0]} and will load it again on the next session start or tool call naming that root`,
+        });
     }
+    return roots;
+}
+/**
+ * Record a session cwd as served. Idempotent; re-registering refreshes nothing.
+ * Returns the roots this insertion dropped at the cap, oldest first.
+ */
+export function registerSessionRoot(cwd) {
+    const root = path.resolve(cwd);
+    // Present already: leave the entry alone. Writing the `undefined`
+    // placeholder over a loaded config would blank a served root's denial for
+    // the length of the re-initializing load — the #2518 window in miniature.
+    if (sessionRoots.has(root))
+        return [];
+    return noteEvictedRoots(sessionRoots.set(root, undefined));
+}
+/**
+ * Store the config `initLSPConfig` just loaded for a root it registered.
+ *
+ * Re-inserts the root when the cap dropped it while the load was in flight:
+ * the caller is a live session declaring this root right now, so the pair
+ * belongs in the registry — and it is a PAIR, which is what keeps the payload
+ * from outliving the registration or the registration from outliving the
+ * payload.
+ *
+ * Returns the roots this write dropped at the cap, oldest first.
+ */
+export function setSessionRootConfig(cwd, config) {
+    return noteEvictedRoots(sessionRoots.set(path.resolve(cwd), config));
+}
+/**
+ * Every served root that has a loaded config, in registration order —
+ * `getConfigForFile`'s (`config.ts`) longest-prefix walk. Entries still
+ * awaiting their first load are skipped; see the store's doc comment.
+ */
+export function sessionRootConfigEntries() {
+    return sessionRoots;
 }
 /** Return whether this exact root is still served after cap eviction. */
 export function isSessionRootRegistered(cwd) {
     return sessionRoots.has(path.resolve(cwd));
 }
-/** True when a readiness memo must run initialization for this root. */
+/**
+ * True when a readiness memo must run initialization for this root.
+ *
+ * The memo alone is never enough (#2052 R1, #2518): a readiness set caps
+ * itself, and `initLSPConfig` has callers (`clients/runtime-session.ts`,
+ * `clients/lens-engine.ts`) that no memo sees, so a memo hit can outlive the
+ * registration — and with it the config that carries the operator's denial.
+ * Every readiness memo asks this function, never its own `has` alone.
+ */
 export function shouldInitializeSessionRoot(cwd, readyRoots) {
     const normalized = path.resolve(cwd);
     return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
@@ -72,7 +165,7 @@ export function isOutsideAllSessionRoots(filePath) {
     if (sessionRoots.size === 0)
         return false;
     const resolved = path.resolve(filePath);
-    for (const root of sessionRoots) {
+    for (const root of sessionRoots.keys()) {
         if (isSameOrWithin(root, resolved))
             return false;
     }
@@ -85,14 +178,14 @@ export function isOutsideAllSessionRoots(filePath) {
  * roots must not emit an unbounded path list.
  */
 export function getSessionRootsForTelemetry(limit = 4) {
-    return [...sessionRoots]
+    return [...sessionRoots.keys()]
         .sort((a, b) => Number(a > b) - Number(a < b))
         .slice(0, limit);
 }
 /**
- * Clear the registry. Called by `resetLSPConfigStateForTests` so the registry
- * and the config store reset together and cannot disagree about which roots
- * exist.
+ * Clear the registry — the roots AND the configs they carry, which are one
+ * store since #2518, so a reset cannot leave the two disagreeing about which
+ * roots exist. Called by `resetLSPConfigStateForTests`.
  */
 export function resetSessionRootsForTests() {
     sessionRoots.clear();

package/node_modules/pi-lens/dist/clients/lsp/spawn-history.js

@@ -1,17 +1,12 @@
 /** Process-lifetime history of successful LSP spawn plus initialize durations. */
+import { BoundedFifoMap } from "../bounded-cache.js";
 const MAX_SERVER_HISTORIES = 64;
-const successfulSpawnDurationMs = new Map();
+const successfulSpawnDurationMs = new BoundedFifoMap(MAX_SERVER_HISTORIES);
 export function recordSuccessfulLspSpawn(serverId, durationMs) {
     if (!Number.isFinite(durationMs) || durationMs < 0)
         return;
     successfulSpawnDurationMs.delete(serverId);
     successfulSpawnDurationMs.set(serverId, durationMs);
-    while (successfulSpawnDurationMs.size > MAX_SERVER_HISTORIES) {
-        const oldest = successfulSpawnDurationMs.keys().next().value;
-        if (oldest === undefined)
-            break;
-        successfulSpawnDurationMs.delete(oldest);
-    }
 }
 export function getSuccessfulLspSpawnDurationMs(serverId) {
     return successfulSpawnDurationMs.get(serverId);

package/node_modules/pi-lens/dist/clients/lsp/sync-kind.js

@@ -16,7 +16,6 @@
  * always sent, so an unrecognized/absent value never regresses `Full`/`None`
  * behavior.
  */
-export const TEXT_DOCUMENT_SYNC_KIND_NONE = 0;
 export const TEXT_DOCUMENT_SYNC_KIND_FULL = 1;
 export const TEXT_DOCUMENT_SYNC_KIND_INCREMENTAL = 2;
 function isSyncKind(value) {

package/node_modules/pi-lens/dist/clients/lsp/tsserver-sync.js

@@ -37,7 +37,7 @@ import { normalizeMapKey } from "../path-utils.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
-export const TSSERVER_REQUEST_COMMAND = "typescript.tsserverRequest";
+const TSSERVER_REQUEST_COMMAND = "typescript.tsserverRequest";
 /**
  * tsserver's synthetic inferred-project name, as its own source builds it:
  * `"/dev/null/inferredProject" + counter + "*"`. `/dev/null` is a deliberate
@@ -219,13 +219,13 @@ export async function fetchTsserverProjectIdentity(svc, file) {
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-export function isTsserverSyncRawDiagnostic(value) {
+function isTsserverSyncRawDiagnostic(value) {
     if (!value || typeof value !== "object")
         return false;
     const v = value;
     return typeof v.message === "string" && typeof v.category === "string";
 }
-export function tsserverSeverityFromCategory(category) {
+function tsserverSeverityFromCategory(category) {
     switch (category) {
         case "error":
             return 1;
@@ -242,7 +242,7 @@ export function tsserverSeverityFromCategory(category) {
  * `LSPDiagnostic`. Both `line`/`offset` are 1-based in tsserver's protocol
  * and 0-based in LSP — this conversion handles that.
  */
-export function tsserverSyncDiagnosticToLsp(d) {
+function tsserverSyncDiagnosticToLsp(d) {
     const startLine = Math.max(0, (d.startLocation?.line ?? 1) - 1);
     const startChar = Math.max(0, (d.startLocation?.offset ?? 1) - 1);
     const endLine = Math.max(0, (d.endLocation?.line ?? d.startLocation?.line ?? 1) - 1);
@@ -265,7 +265,7 @@ export function tsserverSyncDiagnosticToLsp(d) {
  * executed, the response envelope isn't `{success:true, body:[...]}`, or
  * any error is thrown.
  */
-export async function runTsserverSyncCommand(svc, file, command) {
+async function runTsserverSyncCommand(svc, file, command) {
     if (typeof svc.executeCommand !== "function")
         return undefined;
     const outcome = await svc.executeCommand(file, TSSERVER_REQUEST_COMMAND, [
@@ -303,11 +303,18 @@ export async function runTsserverSyncCommand(svc, file, command) {
  * server had computed but never published (silentOnClean) — these must be
  * surfaced to the caller, not discarded. `confirmed: false` = sync path
  * unavailable, fall through to existing behavior.
+ *
+ * #2598: `getAdvertisedCommands` is REQUIRED here rather than probed for. The
+ * real `LSPService` defines it unconditionally (clients/lsp/index.ts), and both
+ * production callers hand this function that service, so the former
+ * `typeof … !== "function"` bail was reachable only from a partial test double
+ * (AGENTS.md shape 7). It was also unobservable even there: an absent method
+ * throws a `TypeError` that this function's own catch turns into the same
+ * `undefined` the bail returned. `executeCommand` stays optional on
+ * {@link TsserverSyncCapableService} — see {@link runTsserverSyncCommand}.
  */
 export async function attemptTsserverSyncDiagnostics(file, svc) {
     try {
-        if (typeof svc.getAdvertisedCommands !== "function")
-            return undefined;
         const advertised = await svc.getAdvertisedCommands(file);
         if (!advertised.includes(TSSERVER_REQUEST_COMMAND))
             return undefined;

package/node_modules/pi-lens/dist/clients/lsp/wait-policy/classification.js

@@ -24,6 +24,12 @@ export function classifyServerWaitTier(serverId, snapshot) {
     const mode = snapshot.workspaceDiagnosticsSupport?.mode;
     if (mode === "pull")
         return "pull-capable";
+    if (snapshot.customServer === true &&
+        mode === "push-only" &&
+        snapshot.diagnosticsUnsupported === true &&
+        snapshot.diagnosticsPublished !== true) {
+        return "diagnostics-unsupported";
+    }
     if (mode !== "push-only")
         return "waits";
     const strategy = getStrategy(serverId, snapshot.launchVariant);

package/node_modules/pi-lens/dist/clients/lsp/wait-policy/strategies.js

@@ -73,6 +73,7 @@ export function resolveAstGrepNativeExe(platform = process.platform, arch = proc
         return undefined;
     }
 }
+/** @public — loaded by scripts/probe-clean-signal.mjs through a dynamic import wrapper knip cannot see. */
 export const SERVER_DIAGNOSTIC_STRATEGIES = {
     typescript: {
         seedFirstPush: true,
@@ -287,7 +288,7 @@ const NATIVE_TS7_DIAGNOSTIC_STRATEGY = {
     silentOnClean: false,
 };
 /** Fallback for unknown servers. Conservative defaults. */
-export const DEFAULT_STRATEGY = {
+const DEFAULT_STRATEGY = {
     seedFirstPush: false,
     pullRetryBudgetMs: 250,
     debounceMs: 150,

package/node_modules/pi-lens/dist/clients/lsp/workspace-diagnostics-cache.js

@@ -398,7 +398,7 @@ export function createWorkspaceDiagnosticsCacheContext(cwd) {
     const epoch = _cacheEpochs.capture(root);
     const existing = loadWorkspaceDiagnosticsCache(root);
     const entries = {
-        ...(existing?.entries ?? {}),
+        ...existing?.entries,
     };
     const reverseDepsIndex = loadReverseDependencyIndexFromSnapshot({
         cwd: root,

package/node_modules/pi-lens/dist/clients/lsp-document-symbols.js

@@ -2,7 +2,7 @@ import { getLSPService } from "./lsp/index.js";
 // Grounded against this repo's workspace-native TypeScript 7.0.2 server
 // (`tsc --lsp --stdio`) on 2026-07-30: 20 already-open documentSymbol calls
 // measured p50 3.70 ms / p95 5.28 ms. Keep generous headroom for slower hosts.
-export const LSP_DOCUMENT_SYMBOL_TIMEOUT_MS = 150;
+const LSP_DOCUMENT_SYMBOL_TIMEOUT_MS = 150;
 export const SYMBOL_KIND_NAMES = {
     1: "file",
     2: "module",

package/node_modules/pi-lens/dist/clients/lsp-mutation.js

@@ -1,6 +1,37 @@
 import * as path from "node:path";
+import { BoundedSet } from "./bounded-cache.js";
 import { createReadGuardEditBatchSummary, getReadGuardCorrelationId, logReadGuardEvent, } from "./read-guard-logger.js";
 import { normalizeMapKey } from "./path-utils.js";
+import { getMutationBridge } from "./mutation-bridge.js";
+import { noteMutationHandled } from "./observed-mutation.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+// #2450 fix round 3 (minor): gates the "bridge unavailable" dbg line to fire
+// once per session, not once per FILE — a rename that touches many files in
+// a bridge-less process (e.g. the MCP server) would otherwise spam the same
+// line once per touched file. `recordDegradationOnce` itself has no
+// first-occurrence return value (unlike `incrementDegradationCount`), so this
+// tiny local latch is the minimal way to mirror that "once" intent onto the
+// dbg line without changing the ledger's own once-per-(kind,subject) record.
+//
+// Catalog shape 17 (a process-lifetime latch must re-arm at session_start):
+// wired into `handleSessionStart` (`clients/runtime-session.ts`) directly,
+// NOT into `resetDegradationLedger()` — that lives in `degradation-ledger.ts`,
+// which this module already imports, and reaching back from there to here
+// would be a cycle.
+let noBridgeDbgLogged = false;
+export function resetLspMutationNoBridgeDbgLatch() {
+    noBridgeDbgLogged = false;
+}
+/**
+ * Test-only peek at the latch's current value (#2450 fix round 5, F2) — lets
+ * the session-state registry probe the actual internal state instead of
+ * inferring it from captured dbg messages, the same pattern every other
+ * process-private-scalar probe in `tests/support/session-state-registry.ts`
+ * uses (e.g. `_observedMutationStateForTests`).
+ */
+export function _lspMutationNoBridgeDbgLoggedForTests() {
+    return noBridgeDbgLogged;
+}
 const MAX_SAMPLES = 100;
 const MAX_SUMMARIES_PER_CONTEXT = 100;
 export function newLspMutationCorrelationId(toolCallId) {
@@ -95,8 +126,35 @@ function uniqueDetails(files, fileDetails) {
 }
 function bookkeepLspMutation(context, files, fileDetails) {
     const details = uniqueDetails(files, fileDetails);
+    // The direct path below needs `context.runtime` (the receipt) and
+    // `context.cacheManager` (the turn-state entry) threaded in by the caller.
+    // One caller structurally cannot: `workspace/applyEdit`'s server-initiated-edit
+    // handler (clients/lsp/client.ts) builds its own fallback `LspMutationContext`
+    // with neither, because there is no live reference to the runtime/cache-manager
+    // singletons at that call site. Rather than silently drop bookkeeping for that
+    // write, fall back to the mutation bridge (#2423) — mounted once at extension
+    // activation with live getters closing over the SAME singletons — which is
+    // exactly the seam built for "a producer that cannot reach the bookkeeping
+    // surfaces directly". This keeps `recordLspMutation` the ONE call site every
+    // LSP-applied edit bookkeeps through; the bridge is this function's OWN
+    // fallback, not a second seam other code reaches for on its behalf (#2450).
+    // Only the receipt (recordProjectMutation) and the turn-state entry
+    // (cacheManager.addModifiedRange) need the bridge fallback: the read-guard
+    // stamp is independent of them and already tolerates either being absent.
+    const useBridgeFallback = !context.runtime || !context.cacheManager;
     for (const detail of details) {
         const filePath = path.resolve(detail.filePath);
+        // #2450 review round 2 (F4): the SAME recordability gate the bridge
+        // fallback below already applies internally (`isRecordable`, mounted in
+        // index.ts). Applied here too so the direct (deps-threaded) branch
+        // cannot record a write the fallback branch would have silently
+        // dropped for the exact same reason (`no-read-guard` / ignored /
+        // vendor) — the two branches must agree on which files count as
+        // project source, not just on how they bookkeep the ones that do.
+        if (context.isRecordable && !context.isRecordable(filePath)) {
+            context.dbg?.(`lsp mutation not recordable, skipping ${filePath}`);
+            continue;
+        }
         if (context.readGuard) {
             try {
                 context.readGuard.recordWritten(filePath);
@@ -105,34 +163,118 @@ function bookkeepLspMutation(context, files, fileDetails) {
                 context.dbg?.(`lsp mutation read-guard stamp failed for ${filePath}: ${err}`);
             }
         }
-        const runtime = context.runtime;
-        // One mutation seam (#2000 phase 1): bump + receipt + change-log live in
-        // RuntimeCoordinator.recordProjectMutation.
-        runtime?.recordProjectMutation?.({
-            filePath,
-            source: context.source,
-            cwd: context.cwd,
-            changedRange: detail.range,
-            onAppendError: (err) => context.dbg?.(`lsp mutation project change append failed for ${filePath}: ${err}`),
-        });
-        if (context.cacheManager) {
-            try {
-                context.cacheManager.addModifiedRange(filePath, detail.range ?? { start: 1, end: 1 }, detail.importsChanged ?? true, context.cwd, runtime?.telemetrySessionId);
+        if (useBridgeFallback) {
+            const bridge = getMutationBridge();
+            if (!bridge) {
+                // #2450 review round 2 (F4)/round 3 (minor): the MCP server process
+                // (`mcp/server.ts`) builds `lsp_navigation` with no
+                // `mutationDeps` AND never mounts the bridge (that only happens
+                // inside pi's own in-process extension activation, `index.ts`) —
+                // every LSP-applied edit in that process is unrecorded. Once per
+                // session (not once per file — a rename can touch many files in
+                // one call, and a session can issue many renames), not once per
+                // process lifetime silently. `subject` is a fixed, one-word
+                // degradation-ledger key (round 3: was `context.tool`, which
+                // varies per LSP operation — "lsp_navigation:rename" vs
+                // "...executeCommand" — so the SAME session could log this
+                // degradation once per operation kind instead of truly once).
+                recordDegradationOnce({
+                    kind: "lsp-mutation-bridge-unmounted",
+                    subject: "lsp-mutation:no-bridge",
+                    reason: "workspace/applyEdit bookkeeping fell back to the mutation " +
+                        "bridge, but no bridge is mounted in this process (e.g. the " +
+                        "MCP server, which never runs pi's extension activation) — " +
+                        "the write is unrecorded (no read-guard stamp, no turn-state " +
+                        "entry, no change-log receipt).",
+                });
+                if (!noBridgeDbgLogged) {
+                    noBridgeDbgLogged = true;
+                    context.dbg?.(`lsp mutation bridge unavailable, dropping bookkeeping for ${filePath}`);
+                }
             }
-            catch (err) {
-                context.dbg?.(`lsp mutation modified-range tracking failed for ${filePath}: ${err}`);
+            else {
+                try {
+                    const recorded = bridge.recordMutation({
+                        filePath,
+                        kind: "edit",
+                        editRanges: detail.range
+                            ? [[detail.range.start, detail.range.end]]
+                            : undefined,
+                        consumer: context.tool,
+                        // Real value threaded through, not the bridge's own
+                        // historical `false` default (#2450 review round 2, F1) —
+                        // the tsserver organize-imports/add-import case is exactly
+                        // the import-changing one.
+                        importsChanged: detail.importsChanged ?? true,
+                        // Equivalence with the direct branch below, which never
+                        // enqueues a deferred autofix/format pass for an LSP-applied
+                        // edit (#2450 review round 2, F3).
+                        deferAutofix: false,
+                    });
+                    if (!recorded) {
+                        context.dbg?.(`lsp mutation bridge dropped ${filePath} (recordMutation() ` +
+                            "returned false — see the mutation_bridge debug output " +
+                            "for the reason: malformed entry, out-of-scope path, or " +
+                            "a bookkeeping error)");
+                    }
+                }
+                catch (err) {
+                    context.dbg?.(`lsp mutation bridge fallback failed for ${filePath}: ${err}`);
+                }
+            }
+        }
+        else {
+            const runtime = context.runtime;
+            // One mutation seam (#2000 phase 1): bump + receipt + change-log live in
+            // RuntimeCoordinator.recordProjectMutation.
+            runtime?.recordProjectMutation?.({
+                filePath,
+                source: context.source,
+                cwd: context.cwd,
+                changedRange: detail.range,
+                onAppendError: (err) => context.dbg?.(`lsp mutation project change append failed for ${filePath}: ${err}`),
+            });
+            if (context.cacheManager) {
+                try {
+                    context.cacheManager.addModifiedRange(filePath, detail.range ?? { start: 1, end: 1 }, detail.importsChanged ?? true, context.cwd, runtime?.telemetrySessionId, undefined, 
+                    // #2504 review round 2 (F1). #2504 added a containment
+                    // filter to `addModifiedRange` and gave it `cwd` as the
+                    // project root. On THIS path `cwd` is the calling
+                    // directory, which `tools/lsp-navigation.ts` scopes to a
+                    // sub-package while the LSP client's root spans the whole
+                    // monorepo — so a server-initiated edit on a sibling
+                    // package (#2450) and every edit whose context carries a
+                    // separate bookkeeping cwd (#2479) were silently dropped
+                    // from the worklist. Same root the `isRecordable` gate a
+                    // few frames up already uses: `runtime.projectRoot`,
+                    // falling back to `cwd` when no runtime is threaded.
+                    runtime?.projectRoot ?? context.cwd);
+                }
+                catch (err) {
+                    context.dbg?.(`lsp mutation modified-range tracking failed for ${filePath}: ${err}`);
+                }
             }
+            // #2465: the bridge-fallback branch above gets this for free —
+            // `recordMutationThroughSeam` calls `noteMutationHandled` for every
+            // entry it takes. The DIRECT branch bypasses the bridge entirely, so
+            // it has to say so itself, or the #2430 `agent_settled` sweep finds
+            // bytes on disk it has no baseline for and reports every
+            // `lsp_navigation` rename as drift no tool call explains. Placed
+            // after `addModifiedRange` and OUTSIDE its `try`: the mark is about
+            // "pi-lens wrote this file", which is true whether or not the
+            // turn-state insert threw.
+            noteMutationHandled(filePath);
         }
+        // #2450 review round 2 (Partial-deps): its own surface, independent of
+        // whether the receipt/turn-state used the direct path or the bridge
+        // fallback above — a half-threaded caller (one that provides
+        // `recordAutofix` but not `runtime`/`cacheManager`) must not lose its
+        // turn-summary publisher just because SOME other surface fell back.
         if (context.recordAutofix && context.source === "autofix") {
             const key = normalizeMapKey(filePath);
-            const seen = context.autofixRecordedPaths ?? new Set();
+            const seen = context.autofixRecordedPaths ?? new BoundedSet(MAX_SAMPLES);
             context.autofixRecordedPaths = seen;
             if (!seen.has(key)) {
-                if (seen.size >= MAX_SAMPLES) {
-                    const oldest = seen.values().next().value;
-                    if (oldest)
-                        seen.delete(oldest);
-                }
                 seen.add(key);
                 context.recordAutofix(filePath);
             }

package/node_modules/pi-lens/dist/clients/map-with-concurrency.js

@@ -0,0 +1,36 @@
+/**
+ * Bounded worker pool — the repo's one shared `mapWithConcurrency`.
+ *
+ * Lived in `dependency-checker.ts` (its first caller) and was exported from
+ * there for `dispatch/runners/biome-check.ts`. #2504 added a third caller,
+ * `runtime-turn.ts`'s bounded test-runner batch — and runtime-turn must not
+ * drag an ANALYZER client into its eager import graph for a 15-line helper
+ * (that is exactly the eager-bootstrap cost #2467 removed). So the value moved
+ * to this zero-dependency leaf and `dependency-checker.ts` re-exports it: every
+ * existing importer keeps its specifier, and a consumer that only needs the
+ * pool no longer loads madge.
+ *
+ * Same shape as `ledger-bounds.ts` (#2426) for the degradation ledger's bound.
+ *
+ * NOT consolidated here: `lsp/client.ts` keeps its own file-local copy on
+ * purpose (see its comment) — that is a documented decision, not drift.
+ */
+/**
+ * Run `mapper` over `items` with at most `concurrency` in flight at once.
+ */
+export async function mapWithConcurrency(items, concurrency, mapper) {
+    if (items.length === 0)
+        return;
+    let nextIndex = 0;
+    const workerCount = Math.max(1, Math.min(concurrency, items.length));
+    const worker = async () => {
+        while (true) {
+            const index = nextIndex++;
+            if (index >= items.length)
+                return;
+            await mapper(items[index]);
+        }
+    };
+    const workers = Array.from({ length: workerCount }, () => worker());
+    await Promise.all(workers);
+}

package/node_modules/pi-lens/dist/clients/mcp/analyze.js

@@ -23,7 +23,7 @@ import { PathKeyedMap } from "../path-keyed-map.js";
 import { normalizeMapKey } from "../path-utils.js";
 import { loadProjectSnapshot } from "../project-snapshot.js";
 import { buildOrUpdateGraph } from "../review-graph/service.js";
-import { recordDiagnostics } from "../widget-state.js";
+import { classifyDiagnosticTier, recordDiagnostics } from "../widget-state.js";
 import { deserializeWordIndex, removeWordIndexDocumentAsync, scheduleWordIndexPersist, updateWordIndexDocumentForEdit, WORD_INDEX_MAX_BYTES, } from "../word-index.js";
 import { logWordIndex } from "../word-index-logger.js";
 import { createMcpHost } from "./host-shim.js";
@@ -170,6 +170,28 @@ export function _getWarmWordIndexCacheStateForTests() {
 // is the persistent warm server's job (see the `lsp` honesty signal + Tier 2).
 const WARMUP_CLIENT_WAIT_MS = 10_000;
 const WARMUP_DIAGNOSTICS_WAIT_MS = 6_000;
+/** One diagnostic, flattened to the fields an MCP consumer needs. */
+/**
+ * Split the dispatch `warnings` bucket into real warnings vs advisories using
+ * the ONE severity-projection policy ({@link classifyDiagnosticTier}, #2414/
+ * #2417) so the model-facing counts never present a `hint`/`info`-tier finding
+ * as a warning (#2420, remainder of #2414). The dispatch `semantic` axis (which
+ * also drives blocking) is intentionally NOT consulted or mutated here: this is
+ * a display-count split, not a blocking-decision change. `blockers`
+ * (`semantic:"blocking"`) are computed upstream and never enter this bucket, so
+ * nothing that blocks can stop blocking through this seam. A non-advisory entry
+ * in the bucket (an `error`/`warning`-tier finding routed here as
+ * `semantic:"warning"`/`"none"`) stays counted as a warning exactly as before,
+ * so a mixed file's real warning count is unchanged.
+ */
+export function summarizeWarningTiers(warnings) {
+    let advisories = 0;
+    for (const w of warnings) {
+        if (classifyDiagnosticTier(w) === "advisory")
+            advisories++;
+    }
+    return { warnings: warnings.length - advisories, advisories };
+}
 function toMcpDiagnostic(diagnostic) {
     return {
         line: diagnostic.line,
@@ -235,7 +257,7 @@ export async function analyzeFile(filePath, cwd, options = {}) {
         : path.resolve(cwd, filePath);
     // no-delta by default → a full snapshot every call (not delta-filtered);
     // caller flags win over the default.
-    const host = createMcpHost({ "no-delta": true, ...(options.flags ?? {}) }, cwd);
+    const host = createMcpHost({ "no-delta": true, ...options.flags }, cwd);
     if (options.warmLsp !== false) {
         await warmLspForFile(absPath, host);
     }
@@ -345,7 +367,9 @@ export async function analyzeFile(filePath, cwd, options = {}) {
     const lspRunner = latencyReport?.runners.find((runner) => runner.runnerId === "lsp");
     const lsp = lspRunner
         ? {
-            ran: lspRunner.status !== "skipped" && lspRunner.status !== "when_skipped",
+            ran: lspRunner.status !== "skipped" &&
+                lspRunner.status !== "when_skipped" &&
+                lspRunner.status !== "test_file_skipped",
             status: lspRunner.status,
             diagnosticCount: lspRunner.diagnosticCount,
             durationMs: lspRunner.durationMs,
@@ -360,7 +384,12 @@ export async function analyzeFile(filePath, cwd, options = {}) {
         counts: {
             diagnostics: result.diagnostics.length,
             blockers: result.blockers.length,
-            warnings: result.warnings.length,
+            // #2420: `result.warnings` is the dispatch warnings bucket
+            // (`semantic:"warning"|"none"`), which still carries `hint`/`info`-tier
+            // findings folded in by the runner's severity→semantic map. Project
+            // them out through the shared tier policy so the model sees real
+            // warnings and advisories separately.
+            ...summarizeWarningTiers(result.warnings),
             fixed: result.fixed.length,
         },
         lsp,