@herbertgao/pi-extensions 2026.9.15 → 2026.9.17

package/node_modules/pi-lens/dist/clients/dispatch/runners/taplo.js

@@ -1,5 +1,7 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { findLocalBinUpwards } from "../../package-manager.js";
+import { stripAnsi } from "../../sanitize.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
@@ -12,6 +14,7 @@ const taplo = createAvailabilityChecker("taplo", ".exe");
 //
 // #1937 round 2: the parser fix alone turned the old silent-clean into a false
 // BLOCKING diagnostic. clap prints `error: unexpected argument '--output'
+// EXIT TABLE (taplo 0.9 measured fixture): 0 clean; 1 findings; other nonzero rejected/error.
 // found`, which starts with the same lowercase `error:` a real taplo
 // diagnostic does, so a mistyped flag would have reddened every valid TOML
 // file. Both readings are wrong; the exit code is what separates them.
@@ -21,7 +24,7 @@ const HEADER_PATTERN = /^\s*(error|warning):(.*)$/;
 /** The box-drawing lead taplo puts on a codespan location line. */
 const LOCATION_LEAD = "┌─";
 /** The `:line:column` tail of a codespan location line. */
-const LOCATION_PATTERN = /:(\d+):(\d+)$/;
+const LOCATION_PATTERN = /^\s*┌─\s+(.+?):(\d+):(\d+)$/;
 /**
  * Parse `taplo lint` output (#1937).
  *
@@ -48,9 +51,10 @@ const LOCATION_PATTERN = /:(\d+):(\d+)$/;
  * (#1937 round 2). The exit-code table in the runner is the primary guard;
  * this is the structural one, and each covers a case the other does not.
  */
-export function parseTaploOutput(raw, filePath) {
+export function parseTaploOutput(raw, filePath, cwd) {
     const diagnostics = [];
-    const lines = (raw ?? "").split(/\r?\n/);
+    const absTarget = path.resolve(cwd, filePath);
+    const lines = stripAnsi(raw ?? "").split(/\r?\n/);
     for (let i = 0; i < lines.length; i++) {
         // Lowercase `error:`/`warning:` starts a diagnostic. taplo's tracing
         // lines are uppercase (`ERROR taplo:lint_files: ...`), so a
@@ -79,8 +83,10 @@ export function parseTaploOutput(raw, filePath) {
             const location = LOCATION_PATTERN.exec(lines[j].trimEnd());
             if (!location)
                 continue;
-            line = Number.parseInt(location[1], 10) || 1;
-            column = Number.parseInt(location[2], 10) || 1;
+            if (!pathsEqual(path.resolve(cwd, location[1].trim()), absTarget))
+                continue;
+            line = Number.parseInt(location[2], 10) || 1;
+            column = Number.parseInt(location[3], 10) || 1;
             break;
         }
         if (line === null)
@@ -155,7 +161,7 @@ const taploRunner = {
         // outright lie, so taplo opts into `skipWhenParsedNothing` (#1948). This
         // replaces a hand-rolled per-runner copy of the same rule, which wrote
         // its own `runner-empty-result` row with its own wording.
-        const run = parseToolRun("taplo", { result, output: raw, exitCodes: TAPLO_EXIT_CODES }, (out) => parseTaploOutput(out, ctx.filePath), { skipWhenParsedNothing: true });
+        const run = parseToolRun("taplo", { result, output: raw, exitCodes: TAPLO_EXIT_CODES }, (out) => parseTaploOutput(out, ctx.filePath, cwd), { skipWhenParsedNothing: true });
         if (run.skipped)
             return run.skipped;
         const diagnostics = run.diagnostics;

package/node_modules/pi-lens/dist/clients/dispatch/runners/tflint.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd } from "../../tool-policy.js";
@@ -23,24 +24,34 @@ function findTflintConfig(fileDir) {
     const dir = findNearestDirWithAnyBasename(fileDir, [TFLINT_CONFIG]);
     return dir ? path.join(dir, TFLINT_CONFIG) : null;
 }
-function parseTflintOutput(raw, filePath) {
+function parseTflintOutput(raw, filePath, toolCwd) {
     try {
         const parsed = JSON.parse(raw);
         const issues = parsed.issues ?? [];
-        return issues.map((issue) => {
+        // #3295: tflint loads EVERY `*.tf` in its working directory — `--filter` is
+        // best-effort — and names each issue's own `range.filename`, relative to
+        // the directory it ran in (`toolCwd`, which is the file's dir, not the
+        // runner cwd).
+        const absTarget = path.resolve(toolCwd, filePath);
+        return issues.flatMap((issue) => {
+            if (issue.range?.filename &&
+                !pathsEqual(path.resolve(toolCwd, issue.range.filename), absTarget))
+                return [];
             const severity = issue.rule.severity === "error" ? "error" : "warning";
-            return {
-                id: `tflint-${issue.rule.name}-${issue.range.start.line}`,
-                message: `[${issue.rule.name}] ${issue.message}`,
-                filePath,
-                line: issue.range.start.line,
-                column: issue.range.start.column,
-                severity,
-                semantic: severity === "error" ? "blocking" : "warning",
-                tool: "tflint",
-                rule: issue.rule.name,
-                fixable: false,
-            };
+            return [
+                {
+                    id: `tflint-${issue.rule.name}-${issue.range.start.line}`,
+                    message: `[${issue.rule.name}] ${issue.message}`,
+                    filePath,
+                    line: issue.range.start.line,
+                    column: issue.range.start.column,
+                    severity,
+                    semantic: severity === "error" ? "blocking" : "warning",
+                    tool: "tflint",
+                    rule: issue.rule.name,
+                    fixable: false,
+                },
+            ];
         });
     }
     catch {
@@ -88,7 +99,11 @@ const tflintRunner = {
         // not a clean file. No exit-code table: tflint's nonzero codes are not
         // verified against a real binary here, so the conservative
         // nothing-to-parse rule stays the only discriminator.
-        const run = parseToolRun("tflint", { result }, (out) => parseTflintOutput(out, ctx.filePath));
+        const run = parseToolRun("tflint", {
+            result,
+            // EXIT TABLE (TFLint 0.52 measured fixture): 0 clean; 1 error; 2 findings; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (out) => parseTflintOutput(out, absPath, fileDir));
         if (run.skipped)
             return run.skipped;
         const diagnostics = run.diagnostics;

package/node_modules/pi-lens/dist/clients/dispatch/runners/tree-sitter.js

@@ -585,6 +585,29 @@ const treeSitterRunner = {
             }
         }
         if (diagnostics.length === 0) {
+            // #3409: zero diagnostics because the language's GRAMMAR never loaded is
+            // not a clean file, and `runQueriesOnFile` returns [] for both. The
+            // honest discriminator, once the run has already demanded the language,
+            // is the client's own loaded-language map: a grammar that could not be
+            // resolved, fetched, or decoded is absent from it. Reported through this
+            // runner's existing "the analysis did not run" arm (the same
+            // `runner_skip` + `status: "skipped"` shape as client-unavailable,
+            // init-failed and unsupported-extension) instead of as a pass with
+            // nothing found — which is what made a degraded language on a compiled
+            // host indistinguishable from a clean file in `runner_complete`.
+            //
+            // The abort term keeps a mid-run WASM abort (#402, its own
+            // `runtime_abort` record) from being misreported as a missing grammar.
+            if (!isTreeSitterWasmAborted() && !client.getLanguage(languageId)) {
+                logTreeSitter({
+                    phase: "runner_skip",
+                    filePath,
+                    languageId,
+                    reason: "grammar_unavailable",
+                    status: "skipped",
+                });
+                return { status: "skipped", diagnostics: [], semantic: "none" };
+            }
             logTreeSitter({
                 phase: "runner_complete",
                 filePath,

package/node_modules/pi-lens/dist/clients/dispatch/runners/trivy-config.js

@@ -38,6 +38,7 @@
 import { formatToolFailure } from "./utils/tool-failure.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { incrementDegradationCount } from "../../degradation-ledger.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
@@ -89,7 +90,7 @@ function normalizeSeverity(raw) {
  * CauseMetadata: { StartLine } }] }] }`. CRITICAL → blocking, the rest advisory.
  * Defensive: malformed input returns `[]`. Exported for unit tests.
  */
-export function parseTrivyConfigOutput(raw, filePath) {
+export function parseTrivyConfigOutput(raw, filePath, cwd = process.cwd()) {
     if (!raw.trim())
         return [];
     let parsed;
@@ -103,9 +104,14 @@ export function parseTrivyConfigOutput(raw, filePath) {
     if (!Array.isArray(results))
         return [];
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const resultEntry of results) {
         if (!resultEntry || typeof resultEntry !== "object")
             continue;
+        const target = resultEntry.Target;
+        if (typeof target !== "string" ||
+            !pathsEqual(path.resolve(cwd, target), absTarget))
+            continue;
         const rows = resultEntry
             .Misconfigurations;
         if (!Array.isArray(rows))
@@ -232,7 +238,7 @@ const trivyConfigRunner = {
             });
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const diagnostics = parseTrivyConfigOutput(result.stdout || "", ctx.filePath);
+        const diagnostics = parseTrivyConfigOutput(result.stdout || "", ctx.filePath, cwd);
         if (diagnostics.length === 0) {
             return { status: "succeeded", diagnostics: [], semantic: "none" };
         }

package/node_modules/pi-lens/dist/clients/dispatch/runners/utils/diagnostic-parsers.js

@@ -4,6 +4,8 @@
  * Common patterns for parsing tool output into standardized diagnostics.
  * Supports the common `file:line:col: message` format used by most linters.
  */
+import * as path from "node:path";
+import { pathsEqual } from "../../../path-utils.js";
 import { stripAnsi } from "../../../sanitize.js";
 import { getAutofixCapability } from "../../../tool-policy.js";
 /**
@@ -11,8 +13,13 @@ import { getAutofixCapability } from "../../../tool-policy.js";
  * Common format: file:line:col: message (with variations)
  */
 function createLineParser(config) {
-    return (raw, filePath) => {
+    return (raw, filePath, cwd) => {
         const diagnostics = [];
+        // #3295: `config.regex` is documented above as capturing the FILE in group
+        // 1, and every parser built here then dropped it and stamped the dispatched
+        // path on every line. This is the shared factory, so the predicate lives
+        // here once rather than in each `createLineParser` caller.
+        const absTarget = path.resolve(cwd, filePath);
         // Optionally strip ANSI codes (for tools that output colored text)
         const clean = config.stripAnsi !== false ? stripAnsi(raw) : raw;
         const lines = clean.split("\n").filter((l) => l.trim());
@@ -20,6 +27,9 @@ function createLineParser(config) {
             const match = line.match(config.regex);
             if (!match)
                 continue;
+            const reported = match[1];
+            if (reported && !pathsEqual(path.resolve(cwd, reported), absTarget))
+                continue;
             const lineNum = parseInt(match[2], 10);
             const colNum = parseInt(match[3], 10);
             const severity = config.getSeverity

package/node_modules/pi-lens/dist/clients/dispatch/runners/vale.js

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { PRIORITY } from "../priorities.js";
@@ -25,17 +26,24 @@ function findValeConfig(cwd) {
     }
     return undefined;
 }
-export function parseValeOutput(raw, filePath) {
+export function parseValeOutput(raw, filePath, cwd) {
     const diagnostics = [];
     if (!raw.trim())
         return diagnostics;
+    const absTarget = path.resolve(cwd, filePath);
     try {
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed !== "object")
             return diagnostics;
-        for (const alerts of Object.values(parsed)) {
+        // #3295: vale's top level is keyed BY the linted file's path — the only
+        // place the reported path appears. `Object.values` dropped it, so a
+        // `.vale.ini` glob or a directory argv charged a second file's alerts to
+        // the dispatched one.
+        for (const [reported, alerts] of Object.entries(parsed)) {
             if (!Array.isArray(alerts))
                 continue;
+            if (reported && !pathsEqual(path.resolve(cwd, reported), absTarget))
+                continue;
             for (const alert of alerts) {
                 if (!alert.Message)
                     continue;
@@ -98,7 +106,11 @@ const valeRunner = {
         // #1948: `parseToolRun` adds the second gate. Vale's `Data.Files`
         // envelope bug produced exactly this shape — exit 1, a full JSON
         // report on stdout, zero alerts parsed — and left no record.
-        const run = parseToolRun("vale", { result }, (raw) => parseValeOutput(raw, ctx.filePath));
+        const run = parseToolRun("vale", {
+            result,
+            // EXIT TABLE (Vale 3.9.6 docs https://vale.sh/docs/topics/metrics/): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (raw) => parseValeOutput(raw, ctx.filePath, cwd));
         if (run.skipped)
             return run.skipped;
         const diagnostics = run.diagnostics;

package/node_modules/pi-lens/dist/clients/dispatch/runners/yamllint.js

@@ -1,3 +1,5 @@
+import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { logRunnerAdvisoryOnce } from "../../tool-cwd.js";
 import { getLinterPolicyForCwd, hasYamllintConfig } from "../../tool-policy.js";
@@ -7,14 +9,17 @@ import { parseToolRun } from "./utils/tool-failure.js";
 import { finishParsedRun } from "./utils/tool-failure.js";
 const yamllint = createAvailabilityChecker("yamllint", ".exe");
 export { hasYamllintConfig };
-function parseYamllintParsable(raw, filePath) {
+function parseYamllintParsable(raw, filePath, cwd) {
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const line of raw.split(/\r?\n/)) {
         if (!line.trim())
             continue;
         const match = line.match(/^(.*?):(\d+):(\d+):\s*\[(error|warning)\]\s*(.*?)\s*\(([^)]+)\)\s*$/i);
         if (!match)
             continue;
+        if (!pathsEqual(path.resolve(cwd, match[1]), absTarget))
+            continue;
         const severity = match[4].toLowerCase() === "error" ? "error" : "warning";
         diagnostics.push({
             id: `yamllint-${match[2]}-${match[3]}-${match[6]}`,
@@ -70,7 +75,12 @@ const yamllintRunner = {
         const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`;
         // #1948: classify on stdout as before, parse both streams as before, and
         // record when a failing run yields nothing.
-        const run = parseToolRun("yamllint", { result, output: result.stdout }, (out) => parseYamllintParsable(out, ctx.filePath), { parseOutput: raw });
+        const run = parseToolRun("yamllint", {
+            result,
+            output: result.stdout,
+            // EXIT TABLE (yamllint 1.35 docs https://yamllint.readthedocs.io/en/stable/): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (out) => parseYamllintParsable(out, ctx.filePath, cwd), { parseOutput: raw });
         if (run.skipped)
             return run.skipped;
         const diagnostics = run.diagnostics;

package/node_modules/pi-lens/dist/clients/dispatch/runners/zig-check.js

@@ -1,21 +1,23 @@
 import * as path from "node:path";
+import { pathsEqual } from "../../path-utils.js";
 import { safeSpawnAsync } from "../../safe-spawn.js";
 import { resolveRunnerCwd } from "../../tool-cwd.js";
 import { createAvailabilityChecker } from "./utils/runner-helpers.js";
 import { PRIORITY } from "../priorities.js";
+import { finishParsedRun, parseToolRun } from "./utils/tool-failure.js";
 // zig rejects `--version`; the version subcommand is `zig version`. Using the
 // default probe would make this runner skip on every machine.
 const zig = createAvailabilityChecker("zig", ".exe", ["version"]);
-function parseZigOutput(raw, filePath) {
+function parseZigOutput(raw, filePath, cwd) {
     const diagnostics = [];
+    const absTarget = path.resolve(cwd, filePath);
     for (const line of raw.split(/\r?\n/)) {
         const match = line.match(/^(.*?):(\d+):(\d+):\s*(error|warning|note):\s*(.+)$/);
         if (!match)
             continue;
         const [, rawFile, lineStr, colStr, level, message] = match;
-        const resolvedSource = path.resolve(rawFile.trim());
-        const resolvedTarget = path.resolve(filePath);
-        if (resolvedSource !== resolvedTarget)
+        // #3278: one seam for reported-path attribution — see javac.ts.
+        if (!pathsEqual(path.resolve(cwd, rawFile.trim()), absTarget))
             continue;
         const severity = level === "error" ? "error" : "warning";
         diagnostics.push({
@@ -35,12 +37,6 @@ function parseZigOutput(raw, filePath) {
     }
     return diagnostics;
 }
-function firstOutputLine(result) {
-    return `${result.stderr || ""}\n${result.stdout || ""}`
-        .trim()
-        .split(/\r?\n/, 1)[0]
-        .slice(0, 200);
-}
 const zigCheckRunner = {
     id: "zig-check",
     appliesTo: ["zig"],
@@ -57,35 +53,27 @@ const zigCheckRunner = {
         if (result.error && !result.stdout && !result.stderr) {
             return { status: "skipped", diagnostics: [], semantic: "none" };
         }
-        const diagnostics = parseZigOutput(`${result.stderr || ""}\n${result.stdout || ""}`, ctx.filePath);
-        if (diagnostics.length === 0) {
-            if (result.status && result.status !== 0) {
-                return {
-                    status: "failed",
-                    diagnostics: [
-                        {
-                            id: "zig-check-nonzero-no-diagnostics",
-                            message: firstOutputLine(result) ||
-                                "zig build-exe exited non-zero without structured diagnostics",
-                            filePath: ctx.filePath,
-                            severity: "warning",
-                            semantic: "warning",
-                            tool: "zig",
-                            rule: "zig-check",
-                            fixable: false,
-                        },
-                    ],
-                    semantic: "warning",
-                };
-            }
-            return { status: "succeeded", diagnostics: [], semantic: "none" };
-        }
-        const hasErrors = diagnostics.some((d) => d.severity === "error");
-        return {
-            status: hasErrors ? "failed" : "succeeded",
-            diagnostics,
-            semantic: "warning",
-        };
+        const raw = `${result.stdout || ""}\n${result.stderr || ""}`;
+        const parsed = parseToolRun("zig-check", {
+            result,
+            output: raw,
+            // EXIT TABLE (Zig 0.13 measured fixture): 0 clean; 1 findings; 2 error; other nonzero rejected.
+            exitCodes: { ran: [1, 2] },
+        }, (output) => parseZigOutput(output, ctx.filePath, cwd));
+        if (parsed.skipped)
+            return parsed.skipped;
+        return finishParsedRun({
+            tool: "zig-check",
+            ctx,
+            result,
+            diagnostics: parsed.diagnostics,
+            classify: (diagnostics) => ({
+                status: diagnostics.some((d) => d.severity === "error")
+                    ? "failed"
+                    : "succeeded",
+                semantic: "warning",
+            }),
+        });
     },
 };
 export default zigCheckRunner;

package/node_modules/pi-lens/dist/clients/dispatch/suppress-writer.js

@@ -7,6 +7,7 @@
  * vice versa.
  */
 import * as path from "node:path";
+import { parseInlineSuppressionRuleIds, splitInlineSuppressionPayload, } from "./inline-suppressions.js";
 const HASH_COMMENT_EXTENSIONS = new Set([
     ".py",
     ".rb",
@@ -50,14 +51,23 @@ export function insertSuppressComment(content, filePath, line, rule) {
     const suppressRe = /((?:\/\/|#)\s*pi-lens-ignore:\s*)(.+)$/;
     const match = existingAbove !== undefined ? suppressRe.exec(existingAbove) : null;
     if (match && existingAbove !== undefined) {
-        const rules = match[2]
+        const prefix = match[1];
+        const payload = match[2];
+        if (prefix === undefined || payload === undefined)
+            return content;
+        const { ruleList, trailingReason } = splitInlineSuppressionPayload(payload);
+        const rules = ruleList
             .split(",")
             .map((r) => r.trim())
             .filter(Boolean);
-        if (!rules.includes(rule))
+        const ruleIds = parseInlineSuppressionRuleIds(ruleList);
+        if (!ruleIds.includes(rule))
             rules.push(rule);
         lines[aboveIdx] =
-            existingAbove.slice(0, match.index) + match[1] + rules.join(", ");
+            existingAbove.slice(0, match.index) +
+                prefix +
+                rules.join(", ") +
+                trailingReason;
         return lines.join("\n");
     }
     // Match the indentation of the flagged line so the inserted comment lines

package/node_modules/pi-lens/dist/clients/effective-config.js

@@ -229,7 +229,9 @@ export async function effectiveConfig(options = {}) {
     const resolveAt = (dir) => resolvePiLensConfig({
         cwd: dir,
         globalDir: getGlobalPiLensDir(),
-        globalConfigPath: getPiLensGlobalConfigPath(homeDir),
+        // Production resolution for the global tier — see loadLSPConfig's
+        // comment (global-config-location PR, refs #2457).
+        globalConfigPath: getPiLensGlobalConfigPath(),
         homeDir,
     });
     // The queried path resolves HERE, beside the resolution root it selects, so

package/node_modules/pi-lens/dist/clients/finding-delivery-gate.js

@@ -30,7 +30,11 @@
  *     deliver unchanged. A missed demotion is noise; a wrong drop can hide a
  *     live credential or CVE.
  * The turn-end secrets (gitleaks/trivy-secrets) and govulncheck advisory both
- * route through this gate in `clients/runtime-turn.ts`.
+ * route through this gate in `clients/runtime-turn.ts`, in ONE shared call
+ * (#3264) whose arms the secrets LANE (`clients/turn-end/lanes/secrets.ts`,
+ * #1892) renders. A lane declares its sources and never gates itself: the
+ * pass, its stat budget and its bounded records are per DELIVERY, not per
+ * lane.
  *
  * The SAME freshness family, one level up, covers cross-file drift: a cached
  * inline blocker is a verdict about its file *and everything that file
@@ -222,9 +226,25 @@ function labeled(file, description, reason, ageSource, evidence = [], extra = {}
 const RUNTIME_TURN_FILE = "clients/runtime-turn.ts";
 const LENS_DIAGNOSTICS_FILE = "tools/lens-diagnostics.ts";
 export const DELIVERY_SURFACES = {
-    "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ['store: "gitleaks"']),
-    "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ['store: "trivy-secrets"']),
-    "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end 🛡️ Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ['store: "govulncheck"']),
+    // #1892 (lane extraction): both secrets tiers are rendered by the secrets
+    // LANE (`clients/turn-end/lanes/secrets.ts`), so `clients/runtime-turn.ts`
+    // no longer reads `.live`/`.stale` itself — the arm it can still be pinned
+    // to is the whole gated store object it hands the lane. That is WEAKER than
+    // the previous `gitleaksGate.live,` pin (it no longer says which partition
+    // feeds which tier) and the loss is deliberate: the live/stale split is a
+    // lane rule now, pinned behaviourally instead, by
+    // `tests/clients/runtime-turn-finding-freshness.test.ts` ("keeps an
+    // unmodified file's finding as a full-severity blocker" / "DEMOTES a
+    // finding whose file was edited after the scan — kept, no line") and the
+    // committed witness goldens under `tests/fixtures/witness/`. What the pin
+    // still proves is what this registry exists for: the rows the tier renders
+    // came out of a real `gateFindingsByPathFreshness` call and not out of a
+    // hand-built object (the R2 binding chain in
+    // `tests/clients/finding-delivery-gate.test.ts` walks
+    // `gitleaksGate` → `scannerGates` → the call).
+    "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ["gitleaksGate,"]),
+    "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end 🔴 secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ["trivySecretsGate,"]),
+    "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end 🛡️ Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ["scannerGates.govulncheck"]),
     // Two tagged seams (the stale and live render branches below the same
     // `sweepInlineBlockerFreshness` call) legitimately share one evidence
     // occurrence — evidenceMin: 2 tells the exclusive-assignment check both
@@ -234,9 +254,11 @@ export const DELIVERY_SURFACES = {
     // third argument, so the literal is the call's opening rather than the
     // whole single-line invocation.
     ["sweepInlineBlockerFreshness(runtime, cwd, {"], { evidenceMin: 2 }),
-    // Same two gate calls as the live secrets tier — this tier renders their
-    // `.stale` arm, so it has no OWN gate call to point at.
-    "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end 🔑 demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ['store: "gitleaks"', 'store: "trivy-secrets"']),
+    // The same shared gate call and the same two stores as the live secrets
+    // tier — one lane renders both tiers, so this surface has no gate call and
+    // no arm read of its own; see the note above the live tier for what the pin
+    // does and does not prove.
+    "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end 🔑 demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ["gitleaksGate,", "trivySecretsGate,"]),
     // The evidence below is the literal header FRAGMENT including the
     // interpolation — proves the label is actually rendered, not merely
     // computed and discarded (review round F1's "deleted the age
@@ -280,8 +302,17 @@ export const DELIVERY_SURFACES = {
     // nowhere else in this file: a bare `applyFindingPolicy` would also be
     // satisfied by an import line or an unrelated caller.
     "runtime-turn:late-auxiliary-findings": gated(RUNTIME_TURN_FILE, "Turn-end late-auxiliary LSP findings (collect-later probe of aux " +
-        "client caches whose grace window expired).", ["gateFindingsByPathFreshness", "applyFindingPolicy"], ['store: "late-auxiliary-findings"', "applyFindingPolicy(gate.live, {"]),
-    "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness"], ['store: "late-runner-findings"'], { evidenceMin: 2 }),
+        "client caches whose grace window expired).", 
+    // #3248: the open-coded `applyFindingPolicy(...)` here and the identical
+    // one the late-RUNNER lane needed are now one `applyPushedFindingPolicy`
+    // call, so the gate and the evidence name that call. Same stack, same
+    // identities — only the spelling moved.
+    ["gateFindingsByPathFreshness", "applyPushedFindingPolicy"], ['"late-auxiliary-findings": {', "applyPushedFindingPolicy(gate.live, {"]),
+    "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", 
+    // #3248: this lane was the last push surface with no disposition stage;
+    // it now routes through the same shared policy call as its
+    // late-auxiliary twin, which is what this gate pins.
+    ["gateFindingsByPathFreshness", "applyPushedFindingPolicy"], ['"late-runner-findings"'], { evidenceMin: 2 }),
     "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end 🧪 cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible " +
         "(`settleCascadeRuns`), but an unsettled compute can carry over to a " +
         "later turn (bounded by a carry cap) — a carried-over result renders " +
@@ -359,9 +390,9 @@ export const DELIVERY_SURFACES = {
     "lens-diagnostics:mode-delta": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=delta` report (the tool's DEFAULT mode) — " +
         "re-serves the actionable-warnings/code-quality-warnings caches AND " +
         "the persisted project-diagnostics delta report.", ["gateFindingsByPathFreshness"], [
-        'store: "lens-diagnostics-delta"',
+        '"lens-diagnostics-delta": {',
         "applyDeltaFreshnessGate(",
-        'store: "lens-diagnostics-delta-project"',
+        '"lens-diagnostics-delta-project": {',
     ]),
     "widget-state:footer": gated("clients/widget-state.ts", "TUI footer blocking/error/warning tally.", ["reconcileStaleWidgetFiles", "isBlocking"], ["isBlocking(diagnostic)", "reconcileStaleWidgetFiles()"]),
     "agent-nudge:context-message": labeled("clients/agent-nudge.ts", "Post-edit file-touch nudge injected via `context`.", "Not a scanner finding store: no severity, no cited line, no cache — the " +