@herbertgao/pi-extensions 2026.9.0 → 2026.9.2

package/node_modules/pi-lens/dist/clients/tree-sitter-query-loader.js

@@ -7,7 +7,51 @@
 import { logTreeSitterDiagnostic } from "./tree-sitter-logger.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { classifyBundledResourceDir, reportBundledResourceDirHealth, } from "./bundled-resource-health.js";
+import { getDegradationLedgerGeneration } from "./degradation-ledger.js";
 import { resolvePackagePath } from "./package-root.js";
+/**
+ * The bundled `rules/tree-sitter-queries` root — the ONE spelling of this
+ * path, imported by `clients/cache/rule-cache.ts` (re-exported there as
+ * `BUNDLED_RULES_ROOT`, #2636 review F4) rather than computed a second time,
+ * so the "one ledger row, not two" claim for `tree-sitter-queries-dir-missing`
+ * rests on reference equality, not merely two independently-resolved strings
+ * that happen to match.
+ */
+export const BUNDLED_QUERIES_ROOT = resolvePackagePath(import.meta.url, "rules", "tree-sitter-queries");
+let cachedBundledQueriesRootHealth;
+let cachedBundledQueriesRootHealthGeneration;
+/**
+ * #2636 review F6/round-2 F3: memoized, but keyed on the degradation
+ * ledger's OWN generation counter (bumped by `resetDegradationLedger`, wired
+ * into `handleSessionStart`) rather than "compute once, forever" — round 1's
+ * version overclaimed that the underlying fact "cannot change mid-process
+ * any more than the package's own install location can", but a managed
+ * extension cache RELOCATING a live install mid-process is exactly the
+ * failure #2587/#2626 investigated: a permanently-cached "absent" verdict
+ * from the FIRST probe would never notice the directory coming back (or
+ * disappearing later), the same silent-zero shape this issue exists to end.
+ * Re-probing once per SESSION (not once per call) is the right middle
+ * ground: a real, measured `readdirSync` cost (4.2 µs) is paid once per
+ * session rather than on every dispatched file — same generation-keyed
+ * pattern `clients/ast-grep-client.ts`'s `ensureRulesHealthReported` uses
+ * for its own per-instance re-check.
+ */
+export function getBundledQueriesRootHealth() {
+    const generation = getDegradationLedgerGeneration();
+    if (cachedBundledQueriesRootHealth === undefined ||
+        cachedBundledQueriesRootHealthGeneration !== generation) {
+        cachedBundledQueriesRootHealthGeneration = generation;
+        cachedBundledQueriesRootHealth =
+            classifyBundledResourceDir(BUNDLED_QUERIES_ROOT);
+    }
+    return cachedBundledQueriesRootHealth;
+}
+/** Test-only: clear the memo so a scenario can simulate a different install layout. */
+export function _resetBundledQueriesRootHealthForTests() {
+    cachedBundledQueriesRootHealth = undefined;
+    cachedBundledQueriesRootHealthGeneration = undefined;
+}
 export function isDisabledQueryDirectoryName(name) {
     return name.endsWith("-disabled");
 }
@@ -60,7 +104,7 @@ export function ruleFilesForLanguage(languageId, rootDir = process.cwd()) {
     for (const lang of ruleSourceLanguages(languageId)) {
         for (const dir of [
             path.join(resolvedRoot, "rules", "tree-sitter-queries", lang),
-            resolvePackagePath(import.meta.url, "rules", "tree-sitter-queries", lang),
+            path.join(BUNDLED_QUERIES_ROOT, lang),
         ]) {
             if (!fs.existsSync(dir))
                 continue;
@@ -70,6 +114,42 @@ export function ruleFilesForLanguage(languageId, rootDir = process.cwd()) {
             }
         }
     }
+    // #2636 (review F2): a language resolving zero files here is NORMAL when
+    // nobody has authored bundled/project queries for it — seven REACHABLE
+    // grammars have none by design: bash, dart, elixir, lua, ocaml, swift, zig
+    // (`.sh`/`.bash`, `.dart`, `.ex`/`.exs`, `.lua`, `.ml`/`.mli`, `.swift`,
+    // `.zig` — see `language-registry.ts`'s `EXTENSION_TO_GRAMMAR`). cobol and
+    // plsql are NOT in that registry at all — only their `-disabled` query
+    // directories exist — so `ruleFilesForLanguage` never actually resolves
+    // those two languageIds in production; they are not examples of this
+    // case. A BUG looks identical from an empty `files` set alone: the
+    // bundled root itself relocated out from under the package (same
+    // managed-cache-relocation shape #2626 fixed for skills/). Only pay for
+    // the extra classification in this COLD branch (never on the common,
+    // non-empty path), key it on the shared ROOT rather than this call's
+    // `languageId` (every language hitting an actually-missing root collapses
+    // into the SAME ledger row instead of one per language), and only RECORD
+    // when the root is actually unhealthy — one of the seven by-design-empty
+    // languages is touched routinely (any `.sh`/`.lua` edit).
+    //
+    // #2636 review round 2, F2: NO separate phase/latency row here (unlike
+    // the ast-grep/skills sibling sites, which log one PER CONSTRUCTION or
+    // PER REQUEST — a bounded cardinality). This branch runs on EVERY
+    // dispatched file while the root stays broken (AGENTS.md's "no raw
+    // per-occurrence log for repeats"): 200 touches of a by-design-empty
+    // language against a broken root would otherwise write 200 raw
+    // `latency.log` rows. `reportBundledResourceDirHealth`'s
+    // `incrementDegradationCount` already answers "did this run" AND "how
+    // many times" in a BOUNDED way — one row per session at count 1, then
+    // only at power-of-two milestones (1, 2, 4, 8, … so 200 occurrences write
+    // exactly 8 durable rows) — so a second, unbounded record here would add
+    // nothing the ledger row lacks.
+    if (files.size === 0) {
+        const health = getBundledQueriesRootHealth();
+        if (health.status !== "healthy") {
+            reportBundledResourceDirHealth("tree-sitter-queries-dir-missing", BUNDLED_QUERIES_ROOT, health, "bundled tree-sitter query rules");
+        }
+    }
     return [...files];
 }
 /**

package/node_modules/pi-lens/dist/clients/tree-sitter-shared.js

@@ -16,6 +16,7 @@
 import { notifyUserDegradation } from "./user-notify.js";
 import * as path from "node:path";
 import { TreeSitterClient, } from "./tree-sitter-client.js";
+import { EXTENSION_TO_GRAMMAR } from "./language-registry.js";
 import { logTreeSitter } from "./tree-sitter-logger.js";
 let _shared = null;
 let _wasmAborted = false;
@@ -80,56 +81,60 @@ export function _resetSharedTreeSitterClientForTests() {
     _wasmAborted = false;
     _wasmAbortedAt = undefined;
 }
-// Grammar selection by extension — the single ext→grammar-id authority. `.tsx` →
-// the tsx grammar (parses JSX); `.jsx` → the javascript grammar. The project
-// scanner (project-diagnostics/scanner.ts) DERIVES its map from this one and
-// module-report (module-report.ts `tsLangForFile`, #887) resolves its
-// extension-split kinds (jsts/cxx) through `resolveTreeSitterLanguage` below,
-// so neither can drift: post-#877 both key `.tsx`→tsx (the old note here said the
-// scanner mapped `.tsx`→typescript to reuse typescript queries — that stopped
-// being true when #877 moved typescript-rule inheritance into
-// `queriesForLanguage`). The scanner layers only java/kotlin on top, whose
-// grammars + rule dirs exist but are not wired into a per-edit runner `appliesTo`.
-export const EXT_TO_LANG = {
-    ".ts": "typescript",
-    ".mts": "typescript",
-    ".cts": "typescript",
-    ".tsx": "tsx",
-    ".js": "javascript",
-    ".mjs": "javascript",
-    ".cjs": "javascript",
-    ".jsx": "javascript",
-    ".py": "python",
-    ".go": "go",
-    ".rs": "rust",
-    ".rb": "ruby",
-    ".c": "c",
-    ".h": "c",
-    ".cc": "cpp",
-    ".cpp": "cpp",
-    ".cxx": "cpp",
-    ".c++": "cpp",
-    ".hh": "cpp",
-    ".hpp": "cpp",
-    ".hxx": "cpp",
-    ".inl": "cpp",
-    ".ipp": "cpp",
-    ".tpp": "cpp",
-    ".txx": "cpp",
-    ".cu": "cpp",
-    ".hip": "cpp",
-    ".cs": "csharp",
-    ".php": "php",
-    ".phtml": "php",
-    ".php3": "php",
-    ".php4": "php",
-    ".php5": "php",
-    ".css": "css",
-};
+// Grammar selection by extension — projected from the canonical language
+// registry (language-registry.ts, #2424), which is now THE ext→grammar
+// authority. `.tsx` → the tsx grammar (parses JSX); `.jsx` → the javascript
+// grammar. The project scanner (project-diagnostics/scanner.ts), read expansion
+// (read-expansion.ts) and module-report (`tsLangForFile`, #887) all project the
+// same registry column, so none of them can drift from this one: before #2424
+// the scanner spread this map and layered java/kotlin on top while read
+// expansion kept a hand-copied near-copy of it.
+// `Readonly` because the projection is `Object.freeze`d at the source, and the
+// mutable `Record` type let a caller type-check a write that would throw at
+// runtime (#2424 review, S4).
+export const EXT_TO_LANG = EXTENSION_TO_GRAMMAR;
 /** Resolve a tree-sitter grammar/language id from a file path's extension. */
 export function resolveTreeSitterLanguage(filePath) {
     return EXT_TO_LANG[path.extname(filePath).toLowerCase()];
 }
+/**
+ * The grammars `clients/complexity-client.ts` has a node mapping for.
+ *
+ * Lives HERE, beside the ext→grammar resolver, because the question "can this
+ * path produce a complexity baseline?" has to be answerable WITHOUT loading
+ * the analyzer graph (#2467): `clients/runtime-tool-call.ts` asks it on every
+ * tool call to decide whether the seventeen-module load is worth starting, and
+ * the client that owns the answer is behind that very load.
+ *
+ * It is not a second extension table — the extension half still comes from the
+ * one canonical registry through {@link resolveTreeSitterLanguage}. It is the
+ * language-id half, and `LANGUAGE_NODES` is typed
+ * `Record<ComplexityLanguageId, …>`, so adding a grammar there without adding
+ * it here (or the reverse) is a COMPILE error rather than a predicate that
+ * quietly drifts from the client it is supposed to mirror.
+ */
+export const COMPLEXITY_LANGUAGE_IDS = [
+    "typescript",
+    "tsx",
+    "javascript",
+    "python",
+    "go",
+    "rust",
+];
+/** Narrow a resolved grammar id to one complexity can analyze. */
+export function isComplexityLanguageId(languageId) {
+    return COMPLEXITY_LANGUAGE_IDS.includes(languageId);
+}
+/**
+ * Can a complexity baseline be produced for this path? Pure, synchronous, and
+ * free of every analyzer module — the guard `handleToolCallImpl` needs above
+ * its demand on the bootstrap seam. `ComplexityClient.isSupportedFile`
+ * delegates to it, so there is exactly one answer.
+ */
+export function isComplexitySupportedFile(filePath) {
+    const languageId = resolveTreeSitterLanguage(filePath);
+    return languageId !== undefined && isComplexityLanguageId(languageId);
+}
 export async function withTreeSitterRoot(filePath, content, consume) {
     const languageId = resolveTreeSitterLanguage(filePath);
     const client = getSharedTreeSitterClient();

package/node_modules/pi-lens/dist/clients/tree-sitter-symbol-extractor.js

@@ -3,6 +3,7 @@
  * Extracts definitions and references from source files
  */
 import { logTreeSitterDiagnostic } from "./tree-sitter-logger.js";
+import { EXTENSION_TO_GRAMMAR, KIND_TO_GRAMMAR } from "./language-registry.js";
 import * as path from "node:path";
 import { loadWebTreeSitter } from "./deps/web-tree-sitter.js";
 // Tree-sitter query patterns for symbol extraction
@@ -563,6 +564,33 @@ SYMBOL_QUERIES.javascript = {
         constructor: (identifier) @newIdent) @newRef
     `,
 };
+/**
+ * The grammar a KIND-keyed consumer (review-graph builder, module-report
+ * outline) should extract `filePath` with, or undefined when this file is not
+ * something the symbol extractor can read.
+ *
+ * Three registry-derived steps, no hand-kept table (#2424 replaced one switch
+ * in review-graph/builder.ts and one map in module-report.ts with this):
+ *  1. the kind must have a single grammar-bearing language, or declare a
+ *     `kindFallback` one — so extension-split `jsts` is excluded and its
+ *     callers keep resolving it by path;
+ *  2. the file's own extension wins where it has grammar wiring, which is what
+ *     splits `cxx` into `.c`/`.h` -> c and the rest -> cpp;
+ *  3. the grammar must actually have symbol queries here, which is what keeps
+ *     css/json/yaml/html/toml (grammars that ship, queries that do not) out.
+ */
+export function symbolExtractionGrammar(kind, filePath) {
+    if (!kind)
+        return undefined;
+    const kindGrammar = KIND_TO_GRAMMAR[kind];
+    if (!kindGrammar)
+        return undefined;
+    const byExtension = filePath
+        ? EXTENSION_TO_GRAMMAR[path.extname(filePath).toLowerCase()]
+        : undefined;
+    const grammar = byExtension ?? kindGrammar;
+    return grammar in SYMBOL_QUERIES ? grammar : undefined;
+}
 /** Language keys with symbol queries; used by fixture drift guards. */
 export function getSymbolQueryLanguages() {
     return Object.keys(SYMBOL_QUERIES);

package/node_modules/pi-lens/dist/clients/tui-fit.js

@@ -18,10 +18,6 @@
 import { truncateToWidth } from "./deps/pi-tui.js";
 const ELLIPSIS_KIND = { "…": 0, "...": 1, "": 2 };
 let truncateIsNative = null;
-/** Test-only: reset the signature probe between test cases. */
-export function _resetTruncateProbeForTests() {
-    truncateIsNative = null;
-}
 export function fitLine(s, maxWidth, ellipsis = "...") {
     const w = Math.max(0, maxWidth);
     const fn = truncateToWidth;

package/node_modules/pi-lens/dist/clients/typos-config.js

@@ -19,6 +19,11 @@ export const LOCAL_TYPOS_CONFIG_NAMES = [
     "_typos.toml",
     ".typos.toml",
 ];
+// Deliberately UNCEILINGED at $HOME (refs #2472 review round 3, F1): typos
+// discovers `~/typos.toml` as the user's legitimate global config, and
+// `typos-lsp` merges an injected config with its own discovery (injected
+// wins) — a ceilinged search here silently hid the user's config from that
+// merge and let pi-lens's own shipped `_typos.toml` clobber it instead.
 export function findLocalTyposConfig(startDir) {
     return findLocalToolConfig(startDir, LOCAL_TYPOS_CONFIG_NAMES);
 }

package/node_modules/pi-lens/dist/clients/user-notify.js

@@ -19,6 +19,7 @@
  * is a no-op and the ndjson sink remains the sole destination — the message is
  * never lost, only un-rendered.
  */
+import { withConfigDiagnosticCode, } from "./config-diagnostic-codes.js";
 let notifierGetter;
 /** Called once from the extension entry with a getter over the live `ctx.ui.notify`. */
 export function wireUserNotifier(portsOrGetter) {
@@ -31,19 +32,18 @@ export function wireUserNotifier(portsOrGetter) {
 export function resetUserNotifier() {
     notifierGetter = undefined;
 }
-/** True when a host render path is available (for callers that want to branch). */
-export function hasUserNotifier() {
-    return notifierGetter !== undefined;
-}
 /**
  * Best-effort delivery of a user-facing degradation. Never throws — a stale
  * `ctx` after a session replacement must degrade to a no-op, not break the
  * diagnostic path that called it.
  */
-export function notifyUserDegradation(message, level = "warning") {
+export function notifyUserDegradation(message, level = "warning", options) {
     try {
         const notify = notifierGetter?.();
-        notify?.(message, level);
+        const coded = options?.code
+            ? withConfigDiagnosticCode(message, options.code)
+            : message;
+        notify?.(coded, level);
     }
     catch {
         // The ndjson sink already holds this message; a dead host is not an error.

package/node_modules/pi-lens/dist/clients/widget-state.js

@@ -1,6 +1,7 @@
 import { stat } from "node:fs/promises";
 import * as path from "node:path";
 import { pathToFileURL } from "node:url";
+import { BoundedFifoMap } from "./bounded-cache.js";
 import { demotePastEofDiagnostics, } from "./diagnostic-line-freshness.js";
 import { visibleWidth } from "./deps/pi-tui.js";
 import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
@@ -58,7 +59,6 @@ export function isBlocking(d) {
 }
 // ── Module state ─────────────────────────────────────────────────────────────
 const files = new Map();
-const lspServers = new Map();
 let sessionLanguages = [];
 let requestRenderFn = null;
 /**
@@ -81,7 +81,8 @@ const runnerWriteGuard = new WriteOrderingGuard();
 const MAX_STORED_DIAGNOSTICS_PER_FILE = 12;
 const MAX_INACTIVE_FILE_RECORDS = 1024;
 const ACTIVE_FILE_IDLE_MS = 30 * 60_000;
-const MAX_LSP_SERVER_RECORDS = 128;
+export const MAX_LSP_SERVER_RECORDS = 128;
+const lspServers = new BoundedFifoMap(MAX_LSP_SERVER_RECORDS);
 // Pruning is a cold-size-boundary operation. Do not walk the whole file map
 // for every record in a large diagnostics reconciliation; the full-scan path
 // can legitimately create thousands of records in one synchronous batch.
@@ -110,8 +111,23 @@ function maybePruneInactiveFileRecords() {
 export function setRenderCallback(fn) {
     requestRenderFn = fn;
 }
+/**
+ * #2275 review F1: files whose dependency-drift-demoted rows the footer has
+ * ACTUALLY DRAWN since the last turn end — the delivery population
+ * `runtime-turn.ts`'s cap step drains.
+ *
+ * The footer is not a broadcast of the whole store: `renderWidget` picks ONE
+ * record (`withBlocking[0]`) and its first five qualifying entries, and it
+ * may not be drawn at all (headless, or a turn with no repaint). Counting a
+ * delivery per turn end therefore charged the cap for rows the agent never
+ * saw, and retired them a delivery early. A Set (not a counter) is the right
+ * shape: the widget repaints many times per turn, and all of those repaints
+ * are the SAME one delivery.
+ */
+const renderedDependencyDriftFiles = new Set();
 export function clearWidgetState() {
     files.clear();
+    renderedDependencyDriftFiles.clear();
     lspServers.clear();
     sessionLanguages = [];
     requestRenderFn = null;
@@ -174,7 +190,19 @@ export function exportWidgetState() {
  */
 function migrateEntryStamps(entries, recordTouchedAt) {
     return (entries ?? []).map((d) => {
-        const { stale: _stale, ...rest } = d;
+        // #2275: strip staleDeliveryCount and footerRetired alongside stale — a
+        // delivery count (and the footer-hide it earned) without the demotion
+        // it counts is meaningless, and a resumed session re-evaluates
+        // dependency-drift from scratch (#1631 review F3) same as the `stale`
+        // bit itself. A restored footer has shown the row zero times.
+        // Fix-round 3 (#2275 review F2): `staleReason` left the round trip
+        // unstripped, so a resumed row could carry `staleReason:
+        // "dependency-drift"` with `stale` gone — `isDependencyDriftDemoted`
+        // reads `stale === true`, so that combination reads as clean today, but
+        // the stray reason is still a demotion label with no demotion behind
+        // it, the same "meaningless without the bit it counts" shape as the
+        // other three fields. Strip it alongside them.
+        const { stale: _stale, staleDeliveryCount: _staleDeliveryCount, footerRetired: _footerRetired, staleReason: _staleReason, ...rest } = d;
         return rest.observedAt == null
             ? { ...rest, observedAt: recordTouchedAt }
             : rest;
@@ -271,9 +299,9 @@ export function getFailedLspServerIds() {
     }
     return ids;
 }
-export function recordFormatter(filePath, formatter, changed, success) {
+export function recordFormatter(filePath, formatter, changed, success, outcome) {
     const rec = getOrCreate(filePath);
-    rec.formatters.set(formatter, { changed, success });
+    rec.formatters.set(formatter, { changed, success, outcome });
     rec.touchedAt = Date.now();
     files.set(fileMapKey(filePath), rec);
     requestRender();
@@ -381,7 +409,19 @@ function commitDiagnostics(rec, filePath, normalized, observedAt, key = fileMapK
     files.set(key, rec);
     requestRender();
 }
-/** Recompute the {blocking, errors, warnings} tally for a diagnostic set. */
+export function classifyDiagnosticTier(d) {
+    if (d.severity === "error")
+        return "error";
+    if (d.severity === "warning")
+        return "warning";
+    if (d.severity === "hint" || d.severity === "info")
+        return "advisory";
+    return undefined;
+}
+/** Recompute the {blocking, errors, warnings} tally for a diagnostic set.
+ * `hint`/`info` tier findings are tallied separately — see
+ * {@link classifyDiagnosticTier} and {@link countAdvisories} — and never
+ * inflate `warnings` (#2414). */
 function countDiagnostics(diags) {
     let blocking = 0;
     let errors = 0;
@@ -398,22 +438,34 @@ function countDiagnostics(diags) {
         if (diagnostic.stale &&
             (diagnostic.staleReason ?? "past-eof") === "past-eof")
             continue;
-        if (diagnostic.severity === "error")
+        const tier = classifyDiagnosticTier(diagnostic);
+        if (tier === "error")
             errors++;
-        // #1777: `hint` and `info` tally alongside `warning`. The dispatch path
-        // now preserves all four ast-grep tiers; before, the runner collapsed
-        // them to "warning" here. An exact `=== "warning"` test would drop those
-        // findings out of the footer entirely, so a file with real findings would
-        // render clean. The footer stays a blocking/error/warning summary on
-        // purpose — the tier distinction is rendered by the code-quality-warnings
-        // advisory, not by these counters.
-        else if (diagnostic.severity === "warning" ||
-            diagnostic.severity === "hint" ||
-            diagnostic.severity === "info")
+        else if (tier === "warning")
             warnings++;
+        // tier === "advisory" (hint/info): intentionally excluded from the
+        // footer's warning tally (#2414) — see `countAdvisories` for the
+        // parallel count `getFileDiagnosticSummaries` exposes to
+        // `lens_diagnostics` so a hint-only file still shows up as "has issues".
     }
     return { blocking, errors, warnings };
 }
+/** Count `hint`/`info` tier findings using the same past-EOF exclusion as
+ * {@link countDiagnostics} (#2414). Kept as a standalone accessor rather than
+ * a new `FileRecord.diagnosticCounts` field — the footer never renders this
+ * number, only `getFileDiagnosticSummaries` (mode=all) needs it, to keep a
+ * hint-only file from being silently dropped from a detailed listing. */
+function countAdvisories(diags) {
+    let advisories = 0;
+    for (const diagnostic of diags) {
+        if (diagnostic.stale &&
+            (diagnostic.staleReason ?? "past-eof") === "past-eof")
+            continue;
+        if (classifyDiagnosticTier(diagnostic) === "advisory")
+            advisories++;
+    }
+    return advisories;
+}
 /**
  * Apply the #1641 past-EOF gate to `rec` in place: demote (never drop) any
  * stored diagnostic whose cited line exceeds the file's CURRENT on-disk line
@@ -804,6 +856,102 @@ export function markWidgetFileBlockersStale(filePath, reason) {
     }
     return changed;
 }
+/**
+ * #2275: a dependency-drift demotion the footer is still allowed to draw —
+ * the one predicate the render marker, the delivery counter and the
+ * footer-hide all ask, so "which rows does this cap govern" cannot drift
+ * apart between them.
+ */
+function isDependencyDriftDemoted(d) {
+    return (d.stale === true &&
+        d.staleReason === "dependency-drift" &&
+        d.footerRetired !== true);
+}
+/**
+ * #2275 review F1: take (and clear) the files whose dependency-drift
+ * demotions the footer actually RENDERED since the last call — the delivery
+ * population `runtime-turn.ts`'s per-turn cap step walks at turn end.
+ *
+ * Deliberately NOT a store-wide query over everything currently demoted.
+ * `renderWidget` serves one record per pass, so a store-wide walk charged a
+ * delivery to every demoted file every turn — including files the footer had
+ * never shown and one demoted moments earlier by the same turn end, which
+ * also made the ledger's "capped after N deliveries" overstate N by one.
+ * Draining here is what makes many repaints within one turn count as the one
+ * delivery they are, and a turn with no repaint count as none.
+ */
+export function drainRenderedDependencyDriftFilePaths() {
+    const out = [...renderedDependencyDriftFiles];
+    renderedDependencyDriftFiles.clear();
+    return out;
+}
+/**
+ * #2275: commit one more RENDERED delivery of `filePath`'s
+ * dependency-drift-demoted diagnostics. Every qualifying entry on the record
+ * advances together — `markWidgetFileBlockersStale` demotes them as one
+ * batch per file, so they share one delivery history, mirroring that
+ * write's own file-level scope. Returns the new count, or 0 when the file
+ * has nothing this cap governs (never demoted, or already footer-retired —
+ * a hidden row is delivered no more, so it must stop advancing).
+ */
+export function incrementWidgetDependencyDriftDelivery(filePath) {
+    const rec = files.get(fileMapKey(filePath));
+    if (!rec)
+        return 0;
+    let next = 0;
+    for (const d of rec.allDiagnostics) {
+        if (isDependencyDriftDemoted(d)) {
+            next = (d.staleDeliveryCount ?? 0) + 1;
+            d.staleDeliveryCount = next;
+        }
+    }
+    return next;
+}
+/**
+ * #2275 review F2: retire every dependency-drift-demoted diagnostic on
+ * `filePath` once its delivery cap is reached — by HIDING it from the
+ * footer, not by dropping it.
+ *
+ * `RuntimeCoordinator.retireDemotedDependencyDriftBlocker` can delete its
+ * whole `_pendingInlineBlockers` record because that store backs exactly one
+ * surface (the turn-end advisory text). This store does not: `allDiagnostics`
+ * is also what `getFileDiagnosticSummaries` serves to `lens_diagnostics
+ * mode=all` and what `lens_diagnostic_mark` cross-checks to reanchor. Removing
+ * the entry there turned an unconfirmed LSP error into a CLEAN read and took
+ * it out of the error tally #1631 requires it to stay in. So the cap marks
+ * `footerRetired` and leaves everything else — severity, counts, the
+ * `stale`/`dependency-drift` demotion — exactly as it was; mode=all carries
+ * the "capped, still confirmable" wording in its own note. Returns true iff
+ * something changed (idempotent on a second call).
+ */
+export function retireWidgetDependencyDriftBlockers(filePath) {
+    const rec = files.get(fileMapKey(filePath));
+    if (!rec)
+        return false;
+    let changed = false;
+    for (const d of rec.allDiagnostics) {
+        if (isDependencyDriftDemoted(d)) {
+            d.footerRetired = true;
+            changed = true;
+        }
+    }
+    if (!changed)
+        return false;
+    // The record's severity tallies are unchanged by design (the finding is
+    // still an error, still non-blocking) — only what the footer draws moves.
+    // Fix-round 3 (#2275 review F1): this delete is live only for the
+    // multi-file drain re-render case — `drainRenderedDependencyDriftFilePaths`
+    // already clears the whole Set before this loop starts, so by the time a
+    // given `wPath` reaches this call its own entry is normally long gone. It
+    // only does something when a render for a DIFFERENT file interleaves
+    // between the drain and this retire (adding `rec.filePath` back to the
+    // Set mid-loop) or a render fires between retirement and the caller's next
+    // drain — either way, defensive: it keeps a just-retired file from being
+    // double-drained (and double-charged) on the next pass.
+    renderedDependencyDriftFiles.delete(rec.filePath);
+    requestRenderFn?.();
+    return true;
+}
 /**
  * Keep the TUI honest (#298 follow-up). `reconcileStaleWidgetFiles` drops
  * widget entries whose file changed on disk after they were last recorded
@@ -840,6 +988,7 @@ export function getFileDiagnosticSummaries() {
             blocking: rec.diagnosticCounts.blocking,
             errors: rec.diagnosticCounts.errors,
             warnings: rec.diagnosticCounts.warnings,
+            advisories: countAdvisories(rec.allDiagnostics),
             hasFinalSnapshot: rec.hasFinalDiagnosticsSnapshot,
             diagnostics: rec.allDiagnostics.map((d) => ({ ...d })),
         };
@@ -893,12 +1042,6 @@ export function recordLsp(serverId, root, status, durationMs) {
             ? "ready"
             : "failed";
     lspServers.set(key, { serverId, root, status: mapped, durationMs });
-    while (lspServers.size > MAX_LSP_SERVER_RECORDS) {
-        const oldest = lspServers.keys().next().value;
-        if (oldest === undefined)
-            break;
-        lspServers.delete(oldest);
-    }
     requestRender();
 }
 // ── Render ────────────────────────────────────────────────────────────────────
@@ -961,7 +1104,12 @@ export function renderWidget(width, theme) {
     // the footer entirely instead of demoting visibly. `isBlockingOrDemoted` keeps
     // it in the list; the per-entry render below distinguishes the two with a
     // dimmed marker instead of the red dot.
-    const isBlockingOrDemoted = (d) => isBlocking(d) || d.stale === true;
+    //
+    // #2275: a demotion that reached its delivery cap is hidden from THIS
+    // surface only (`footerRetired`) — it stays in `allDiagnostics` for
+    // mode=all and lens_diagnostic_mark, which is where the agent is told it
+    // was capped and can still be confirmed by a re-run.
+    const isBlockingOrDemoted = (d) => (isBlocking(d) || d.stale === true) && d.footerRetired !== true;
     const withBlocking = recencySorted.filter((r) => r.diagnostics.some(isBlockingOrDemoted));
     if (withBlocking.length > 0) {
         const rec = withBlocking[0];
@@ -979,6 +1127,18 @@ export function renderWidget(width, theme) {
             lines.push(fitLine(` ${dim(path.basename(rec.filePath))}`, w));
         }
         const blockers = rec.diagnostics.filter(isBlockingOrDemoted).slice(0, 5);
+        // #2275 review F1: THIS is the point where a demoted row is delivered to
+        // a human — after the `withBlocking[0]` pick and the top-five slice, not
+        // before them. Mark the file so the next turn end can charge exactly one
+        // delivery against its cap. File-level, matching
+        // `markWidgetFileBlockersStale`'s own file-level demotion batch (all of a
+        // file's drift demotions share one delivery history); a file holding more
+        // than five demoted rows delivers the visible ones and counts the batch,
+        // which is the conservative direction — it retires no LATER than the rows
+        // the agent actually read.
+        if (blockers.some(isDependencyDriftDemoted)) {
+            renderedDependencyDriftFiles.add(rec.filePath);
+        }
         for (const d of blockers) {
             // A past-EOF demotion's coordinate is untrustworthy — render the
             // marker instead of the line (#1641); drift demotions keep theirs.
@@ -1062,7 +1222,10 @@ function formatFileRowVertical(rec, theme) {
         .filter(([, f]) => f.changed && f.success)
         .map(([name]) => name);
     const failedFormatters = [...rec.formatters.entries()]
-        .filter(([, f]) => !f.success)
+        // An `unavailable` tool is not a code failure (#2413): it never earns a red
+        // `fmt-failed` marker. Its result already carries success:true, so this
+        // guard is a belt that keeps the intent explicit at the render seam.
+        .filter(([, f]) => !f.success && f.outcome !== "unavailable")
         .map(([name]) => name);
     const formatMark = (failedFormatters.length > 0
         ? red(` fmt-failed:${failedFormatters.join(",")}`)
@@ -1205,7 +1368,9 @@ function hasChangedFormatter(rec) {
     return [...rec.formatters.values()].some((f) => f.changed && f.success);
 }
 function hasFailedFormatter(rec) {
-    return [...rec.formatters.values()].some((f) => !f.success);
+    // `unavailable` (#2413) is success:true and must never count as a failure —
+    // the explicit guard keeps that true even if a future path mislabels it.
+    return [...rec.formatters.values()].some((f) => !f.success && f.outcome !== "unavailable");
 }
 function shouldRenderFile(rec) {
     return (rec.hasFinalDiagnosticsSnapshot ||