@herbertgao/pi-extensions 2026.9.15 → 2026.9.17

package/node_modules/pi-lens/dist/clients/runtime-turn.js

@@ -3,7 +3,7 @@ import * as path from "node:path";
 import { buildActionableWarningsReport, formatActionableWarningsAdvisory, publishActionableWarningsReport, writeDeferredActionableWarningsReport, } from "./actionable-warnings.js";
 import { logActionableWarningsEvent } from "./actionable-warnings-logger.js";
 import { appendCodeQualityWarningsHistory, buildCodeQualityWarningsReport, formatCodeQualityWarningsAdvisory, writeCodeQualityWarningsReport, } from "./code-quality-warnings.js";
-import { clearGitGuardTestFailure, mergeGitGuardTestFailure, writeGitGuardRecord, } from "./git-guard.js";
+import { clearGitGuardTestFailure, mergeGitGuardTestFailure, resyncGitGuardAfterInlinePolicy, writeGitGuardRecord, } from "./git-guard.js";
 import { cascadeSettleWaitMs } from "./cascade-budget.js";
 import { logCascade } from "./cascade-logger.js";
 import { normalizeMapKey } from "./path-utils.js";
@@ -13,17 +13,15 @@ import { getKnipIgnorePatterns } from "./file-utils.js";
 import { formatCacheAgeLabel } from "./finding-delivery-gate.js";
 import { getFullScanWallClockMs, isWorkspaceSweepActive, runWhenWorkspaceSweepIdle, SWEEP_IDLE_SAFETY_MARGIN_MS, } from "./lsp/workspace-sweep-hold.js";
 import { isTestRoleCollateral } from "./collateral-test-role.js";
-import { classifyAndFilterFindings, } from "./gitleaks-client.js";
-import { dedupeSecretFindings, fromAstGrepWarnings, fromGitleaks, fromTrivySecrets, isSecretWarning, secretLocationKey, } from "./secret-findings.js";
+import { isSecretWarning, secretLocationKey } from "./secret-findings.js";
+import { govulncheckLane } from "./turn-end/lanes/govulncheck.js";
+import { secretsLane } from "./turn-end/lanes/secrets.js";
 import { deadCodeIssueKey, deadCodeIssues, formatDeadCodeDelta, stableFindingKey, } from "./dead-code-client.js";
 import { logDeadCodeScan } from "./dead-code-logger.js";
 import { PROJECT_DIAGNOSTICS_CACHE_VERSION, writeProjectDiagnosticsDeltaReport, } from "./project-diagnostics/cache.js";
 import { deadCodeIssueToProjectDiagnostic } from "./project-diagnostics/runner-adapters/dead-code.js";
-import { gitleaksFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/gitleaks.js";
-import { govulncheckFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/govulncheck.js";
-import { trivyFindingToProjectDiagnostic, trivySecretFindingToProjectDiagnostic, } from "./project-diagnostics/runner-adapters/trivy.js";
+import { trivyFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/trivy.js";
 import { knipIssuesToProjectDiagnostics } from "./project-diagnostics/runner-adapters/knip.js";
-import { applyDispositionsMultiFile } from "./diagnostic-dispositions.js";
 import { logLatency } from "./latency-logger.js";
 import { getLspBudgetIdleTimeoutMs, shouldShortenLspIdleTimeout, } from "./lsp-budget.js";
 import { updateHeartbeat } from "./instance-registry.js";
@@ -42,8 +40,9 @@ import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
 import { retagAuxiliaryDiagnostics } from "./dispatch/auxiliary-lsp.js";
 import { runPersistentReverify, } from "./persistent-reverify.js";
 import { cascadeCarrySuffix } from "./cascade-format.js";
-import { applyFindingPolicy, loadProjectRulePolicyMap, renderedRuleIdentities, } from "./dispatch/finding-policy.js";
+import { applyPushedFindingPolicy, filterFindingsByDisposition, } from "./dispatch/finding-policy.js";
 import { detectFileRole } from "./file-role.js";
+import { applyInlineBlockerPolicy, summarizeInlineBlockerPolicy, } from "./inline-blocker-dispositions.js";
 import { drainPendingRunnerFindings, dropStaleRunnerFindings, pendingRunnerFindingsSize, } from "./dispatch/pending-runner-findings.js";
 // #1631 review V2: moved to its own leaf module so a low-level store
 // (widget-state.ts) can use the marker without importing this orchestrator —
@@ -283,40 +282,6 @@ export async function runTestTargetsBounded(args) {
         stopReason,
     };
 }
-/**
- * #1617: turn_end reads gitleaks/govulncheck/trivy straight from their
- * session-scan caches and formats them into advisory/blocker text — a
- * reporting lane parallel to (and, before this fix, entirely bypassing)
- * `dispatcher.ts:924`'s `applyDispositions` filter. An agent-marked
- * false-positive/won't-fix on one of these findings never suppressed it
- * here, so it re-reported on every turn.
- *
- * Filters `findings` through the SAME anchor derivation the dispatch path
- * and `lens_diagnostics mode=full` use (`applyDispositionsMultiFile` in
- * `diagnostic-dispositions.ts`), keyed off each lane's own canonical
- * `ProjectDiagnostic` adapter (`toDiagnostic`) — the exact tool/rule/message
- * identity `lens_diagnostics` already surfaces and `lens_diagnostic_mark`
- * already anchors a mark against, not a second, cloned identity that would
- * silently diverge from what the agent actually marked.
- *
- * Returns the surviving findings plus how many were dropped, so a caller can
- * still surface a "suppressed by disposition: N" trace (the #1616
- * suppressed-bucket rule — a security finding must never vanish with no
- * trace, even when the disposition that dropped it is working as intended).
- */
-function filterFindingsByDisposition(findings, cwd, toDiagnostic) {
-    if (findings.length === 0)
-        return { kept: findings, suppressed: 0 };
-    const candidates = findings.map((finding) => ({
-        finding,
-        diagnostic: toDiagnostic(finding),
-    }));
-    const survivors = new Set(applyDispositionsMultiFile(candidates.map((c) => c.diagnostic), cwd, (d) => d.filePath));
-    const kept = candidates
-        .filter((c) => survivors.has(c.diagnostic))
-        .map((c) => c.finding);
-    return { kept, suppressed: findings.length - kept.length };
-}
 /**
  * Would writing `next` over `prev` throw away a good scan for a failed one?
  *
@@ -746,9 +711,21 @@ export async function handleTurnEnd(deps) {
      * branch below.
      */
     const pendingDependencyDriftDeliveries = [];
-    for (const { filePath: bPath, summary, stale, staleReason, } of unresolvedBlockers) {
+    /** #3246: one bounded record per TURN for the policy pass, never per finding. */
+    const inlinePolicyEntries = [];
+    /**
+     * #3248: files whose EVERY blocker this pass suppressed — the post-policy
+     * survivor set, emptied per file. The commit gate is recomputed from it
+     * below, once, after the loop.
+     */
+    const policySuppressedPaths = [];
+    const inlinePolicyStart = Date.now();
+    for (const record of unresolvedBlockers) {
+        const { filePath: bPath, summary, stale, staleReason } = record;
         const displayPath = toRunnerDisplayPath(cwd, bPath);
+        const tally = { displayPath, sources: record.sources };
         if (stale) {
+            inlinePolicyEntries.push({ ...tally, stale: true });
             // #1631: demoted — out of the authoritative blocker channel and into the
             // advisory channel with a stale marker, so the agent is told to re-run
             // rather than pressured by a verdict that may already be resolved.
@@ -812,10 +789,61 @@ export async function handleTurnEnd(deps) {
                 (retirementNote ? `\n${retirementNote}` : ""));
         }
         else {
+            // #3246: the agent may have marked one of these blockers
+            // `false-positive` AFTER the record was written, via
+            // `lens_diagnostic_mark` — which every other findings surface honors.
+            // Re-derive the body from the record's structured diagnostics through
+            // the shared `dispatch/finding-policy.ts` stack against the file's
+            // CURRENT bytes, exactly as the late-auxiliary lane below does.
+            const policy = applyInlineBlockerPolicy(record, cwd);
+            inlinePolicyEntries.push({ ...tally, stale: false, outcome: policy });
+            if (policy.body === undefined) {
+                // Every blocker on this file was suppressed. This is a PUSH
+                // surface: silence after a mark is the mark working, not a clean
+                // verdict, so the count rides the bounded per-turn record below
+                // instead of announcing the suppression on every later turn.
+                policySuppressedPaths.push(bPath);
+                continue;
+            }
+            // #1616 suppressed-bucket rule: a delivery that still has something to
+            // say states what it dropped, once per delivery.
+            const suppressedNote = policy.suppressed > 0
+                ? ` (suppressed by disposition: ${policy.suppressed} finding(s))`
+                : "";
             // @delivery-surface: runtime-turn:unresolved-inline-blocker
-            blockerParts.push(`Unresolved from this turn — ${displayPath}:\n${summary}`);
+            blockerParts.push(`Unresolved from this turn — ${displayPath}${suppressedNote}:\n${policy.body}`);
         }
     }
+    // #3248: the post-policy survivor set per file is FINAL here. The commit
+    // gate reads a latch (`gitGuardHasBlockers`) before it ever reads the
+    // persisted record, and the policy wrote neither — so a file whose every
+    // blocker was just suppressed kept blocking `git commit` while the banner
+    // above said nothing about it. Recompute the latch from this set; the
+    // persisted record is rewritten or cleared further down by the writer that
+    // already owns it (`:4287` / `:4379`), from the same survivor set, and that
+    // clear is gated on the latch recomputed here.
+    const guardLatchBefore = runtime.gitGuardHasBlockers;
+    resyncGitGuardAfterInlinePolicy({
+        runtime,
+        suppressedFilePaths: policySuppressedPaths,
+    });
+    if (inlinePolicyEntries.length > 0) {
+        logLatency({
+            type: "phase",
+            toolName: "turn_end",
+            filePath: cwd,
+            phase: "inline_blocker_policy",
+            durationMs: Date.now() - inlinePolicyStart,
+            metadata: {
+                ...summarizeInlineBlockerPolicy(inlinePolicyEntries),
+                // #3248: one row per TURN for the gate outcome, never per finding
+                // — the flip is the event a reader needs to explain why a commit
+                // that was blocked is now allowed.
+                guardFilesSuppressed: policySuppressedPaths.length,
+                guardLatchCleared: guardLatchBefore && !runtime.gitGuardHasBlockers,
+            },
+        });
+    }
     // Drain the deferred cascade computes kicked off this turn (#450). They ran
     // concurrently off the write hot path; wait a bounded time for them here so
     // their runs are available to the merge below. A compute still in flight at
@@ -1289,6 +1317,9 @@ export async function handleTurnEnd(deps) {
                 totalIssues: knipResult.issues.length,
                 newIssues: 0,
                 blockerIssues: 0,
+                // #3248: bounded per-turn, on the row this lane already writes —
+                // never one record per finding.
+                dispositionSuppressed: 0,
                 ...(!knipResult.success && { reason: knipResult.summary }),
                 ...(knipResult.failureKind && { failureKind: knipResult.failureKind }),
                 ...(knipWouldPoison && { cacheKept: true }),
@@ -1312,7 +1343,30 @@ export async function handleTurnEnd(deps) {
                     projectDiagnosticsDelta.push(...knipIssuesToProjectDiagnostics(cwd, newIssues));
                     projectDiagnosticsSources.add("knip");
                 }
-                const blockerIssues = newIssues.filter((i) => i.type === "unlisted" || i.type === "bin");
+                // #3248: what the agent READS goes through the same stored-
+                // disposition filter every other findings surface applies, keyed off
+                // knip's OWN `ProjectDiagnostic` adapter — the identity
+                // `lens_diagnostics` surfaces and `lens_diagnostic_mark` anchors
+                // against — so a marked finding stops re-reporting here. The
+                // `projectDiagnosticsDelta` push above deliberately keeps the
+                // UNFILTERED set: that record is what the scan found, and its reader
+                // (`lens_diagnostics`) applies dispositions on read, so filtering it
+                // here would apply the same policy twice on one lane.
+                // Paired through `flatMap` rather than indexing the adapter's array:
+                // `knipIssuesToProjectDiagnostics` is a straight `issues.map(...)`
+                // (one diagnostic per issue, never empty), so this keeps the pairing
+                // total while staying honest under `noUncheckedIndexedAccess`.
+                const knipPaired = newIssues.flatMap((issue) => knipIssuesToProjectDiagnostics(cwd, [issue]).map((diagnostic) => ({
+                    issue,
+                    diagnostic,
+                })));
+                const knipFiltered = filterFindingsByDisposition(knipPaired, cwd, (pair) => pair.diagnostic);
+                const knipDeliverable = {
+                    kept: knipFiltered.kept.map((pair) => pair.issue),
+                    suppressed: knipFiltered.suppressed,
+                };
+                knipMeta.dispositionSuppressed = knipDeliverable.suppressed;
+                const blockerIssues = knipDeliverable.kept.filter((i) => i.type === "unlisted" || i.type === "bin");
                 knipMeta.blockerIssues = blockerIssues.length;
                 if (blockerIssues.length > 0) {
                     let report = "🔴 New unresolved imports/deps in modified code (Knip):\n";
@@ -1339,7 +1393,7 @@ export async function handleTurnEnd(deps) {
                 // drown the blockers and burn context every turn); it's available
                 // on demand via lens_diagnostics. The delta also feeds the session-slop
                 // record (`projectDiagnosticsDelta`) above.
-                const unusedExportDelta = newIssues.filter((i) => i.type === "export" || i.type === "enumMember");
+                const unusedExportDelta = knipDeliverable.kept.filter((i) => i.type === "export" || i.type === "enumMember");
                 if (unusedExportDelta.length > 0) {
                     let report = "⚠️ Newly unused exports in files you edited — check if callers need updating (Knip):\n";
                     for (const issue of unusedExportDelta.slice(0, 5)) {
@@ -1387,6 +1441,8 @@ export async function handleTurnEnd(deps) {
         let modifiedSet = null;
         const modifiedFiles = () => (modifiedSet ??= new Set(files.map((f) => resolveRunnerPath(cwd, f))));
         let newIssueTotal = 0;
+        /** #3248: bounded per-turn on this lane's own row, never per finding. */
+        let deadCodeDispositionSuppressed = 0;
         const reasons = [];
         // A malformed client or deps object must never abort turn_end. Before the
         // per-turn delta this block only read a cache; now it iterates and awaits,
@@ -1472,8 +1528,21 @@ export async function handleTurnEnd(deps) {
                     newIssueTotal += newIssues.length;
                     projectDiagnosticsDelta.push(...newIssues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language)));
                     projectDiagnosticsSources.add("dead-code");
+                    // #3248: the rendered advisory takes the stored-disposition
+                    // filter, keyed off this lane's OWN adapter. The delta record
+                    // above keeps the unfiltered set — its reader applies the policy
+                    // on read, so filtering both would double-apply on one lane.
+                    const deadCodeDeliverable = filterFindingsByDisposition(newIssues, cwd, (issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language));
+                    deadCodeDispositionSuppressed += deadCodeDeliverable.suppressed;
+                    // Every finding on this scan was marked: a PUSH surface stays
+                    // silent rather than re-announcing that the mark is working; the
+                    // count rides this lane's bounded per-turn row.
+                    if (deadCodeDeliverable.kept.length === 0) {
+                        reasons.push(`${client.id}:all_disposed`);
+                        continue;
+                    }
                     // @delivery-surface: runtime-turn:dead-code-advisory
-                    advisoryParts.push(formatDeadCodeDelta(newIssues, result.language));
+                    advisoryParts.push(formatDeadCodeDelta(deadCodeDeliverable.kept, result.language));
                 }
                 catch (err) {
                     dbg(`turn_end: dead-code(${client.id}) failed: ${err}`);
@@ -1486,6 +1555,7 @@ export async function handleTurnEnd(deps) {
             reasons.push("block_threw");
         }
         deadCodeMeta.newIssues = newIssueTotal;
+        deadCodeMeta.dispositionSuppressed = deadCodeDispositionSuppressed;
         if (reasons.length > 0)
             deadCodeMeta.reason = reasons.join(",");
     }
@@ -1513,212 +1583,167 @@ export async function handleTurnEnd(deps) {
         dispositionSuppressedByLane[lane] =
             (dispositionSuppressedByLane[lane] ?? 0) + count;
     }
-    // govulncheck — surface session_start-cached Go CVE findings as advisory.
-    // No per-turn re-run in this slice; the cache refreshes at next session_start.
-    const govCacheEntry = cacheManager.readCache("govulncheck", cwd);
-    // #1622: govulncheck renders a call site as `file:line`, and the cache is a
-    // session_start snapshot — the same stale-line shape as gitleaks, one tier
-    // lower. A CVE is pinned by go.mod, NOT by the call site, so neither an edit
-    // nor a deletion may drop it: `onMissing: "demote"` routes a vanished traced
-    // file into the same arm as an edited one. This gate only ever decides
-    // whether the cited LINE is still worth printing. (Review round H1: the first
-    // cut let a deleted trace file drop the CVE, contradicting this comment, and
-    // `citedPath` reads only the FIRST filename frame — so one deleted file in a
-    // long trace silently killed a CVE that go.mod still pins.)
-    const govGate = gateFindingsByPathFreshness({
-        store: "govulncheck",
-        findings: govCacheEntry?.data?.findings ?? [],
+    // #1892: ONE read per scanner store per turn_end. The inline lanes got this
+    // for free by reading each cache into a local; now that a lane reads its own
+    // stores (`TurnEndLaneContext.readScannerCache`), the composer and the lanes
+    // must still share one envelope per store — two reads of one store inside
+    // one delivery is the parallel-store shape this umbrella exists to kill, and
+    // the cache's TTL boundary can fall between them, so the secrets tier and
+    // the CVE tier would disagree about the trivy store they both read.
+    //
+    // #3274: the memo holds the PROMISE of each store's envelope, not the
+    // envelope. The read itself moved to `CacheManager.readCacheAsync`, which
+    // suspends on `fs.promises`, so `bounded()` finally has something to bound:
+    // the sync `readCache` completed during ARGUMENT EVALUATION, before
+    // `bounded()` was ever handed a promise, and a wrapper around it registered
+    // a turn_end budget that could never be spent (probed on #3274 with an
+    // already-aborted signal and `ms: 0` — bounded returned undefined and the
+    // read had already parsed). Memoizing the promise is also what keeps the
+    // one-envelope-per-store rule under concurrency: two lanes that await the
+    // same store share ONE read and ONE TTL boundary even when neither has
+    // settled yet, which a value memo could not do.
+    //
+    // An abandoned read yields null, never a throw and never a late envelope:
+    // `bounded()` resolves `undefined` on the budget or the hook's signal and
+    // records ONE `hook-await-exceeded` row per (hook, label) for the deadline
+    // arm, and the memoized promise is already settled by the time the
+    // abandoned read resolves, so nothing mutates after the delivery composed.
+    // A lane that receives null behaves exactly as it does for a cold cache.
+    const scannerCacheReads = new Map();
+    // Stores this delivery composed WITHOUT because a bound fired, in read
+    // order. `bounded()` records the AWAIT's own row (`hook-await-exceeded`),
+    // but only for the deadline arm and only about the await; the agent-facing
+    // consequence — the secrets tier went out with no gitleaks store behind it,
+    // which looks exactly like a clean scan (AGENTS.md defect shape 10) — has no
+    // record otherwise, on either arm. One row per DELIVERY, below, never one
+    // per store and never on a healthy turn.
+    const scannerStoresUnread = [];
+    function readScannerCache(scanner) {
+        let pending = scannerCacheReads.get(scanner);
+        if (pending === undefined) {
+            // An already-aborted turn does not start the read at all. `bounded()`
+            // abandons the await but cannot cancel work already dispatched, so
+            // without this the cancelled turn still pays six file reads whose
+            // result nothing can use. Checked AFTER the memo lookup: a signal that
+            // fires mid-delivery must not give the second lane a different answer
+            // from the first (that is the TTL-boundary split this memo exists for).
+            // It records nothing, on purpose: an already-cancelled turn is Escape,
+            // which `bounded()` also keeps off the ledger — the row below is for a
+            // delivery that went out degraded, not one the user stopped.
+            pending = deps.signal?.aborted
+                ? Promise.resolve(null)
+                : bounded(cacheManager.readCacheAsync(scanner, cwd), {
+                    ms: HOOK_WALL_BUDGET_MS.turn_end,
+                    signal: deps.signal,
+                    hook: "turn_end",
+                    label: `readScannerCache:${scanner}`,
+                }).then((entry) => {
+                    if (entry === undefined)
+                        scannerStoresUnread.push(scanner);
+                    return entry ?? null;
+                });
+            scannerCacheReads.set(scanner, pending);
+        }
+        return pending;
+    }
+    const laneCtx = {
         cwd,
-        scannedAt: govCacheEntry?.data?.scannedAt,
-        citedPath: (finding) => finding.trace.find((t) => t.filename)?.filename,
-        onMissing: "demote",
+        signal: deps.signal,
+        readScannerCache,
+        peekActionableWarnings: () => runtime.peekActionableWarnings(),
+    };
+    // govulncheck — the session_start-cached Go CVE store, delivered as ONE
+    // advisory tier by the govulncheck LANE
+    // (`clients/turn-end/lanes/govulncheck.ts`), which owns every rule this block
+    // used to state inline: the `onMissing: "demote"` freshness declaration and
+    // its first-filename-frame `citedPath` (#1622 H1), the disposition anchor
+    // over BOTH freshness arms (#1694 F1), the stale-line withholding and marker,
+    // the module/package fallback, the fix hint and the display cap. No per-turn
+    // re-run in this slice; the cache refreshes at next session_start. Like every
+    // lane it does NOT gate itself — the freshness pass below is shared.
+    const govSources = await govulncheckLane.collect(laneCtx);
+    const trivyCacheEntry = await readScannerCache("trivy");
+    // The secrets lane (`clients/turn-end/lanes/secrets.ts`) reads the gitleaks
+    // and trivy stores, classifies, and states the freshness policy its rows
+    // need; every rendering and disposition rule for the two secrets tiers lives
+    // there. It does NOT gate itself either.
+    const secretsSources = await secretsLane.collect(laneCtx);
+    // #1892: ONE freshness pass for the three cached scanner stores that cite a
+    // file. Each store keeps its own `scannedAt` and its own `onMissing` — the
+    // gate carries source identity, so gitleaks' older scan cannot demote a
+    // trivy secret its newer scan covers, and govulncheck's `demote` verdict for
+    // a deleted path cannot reach gitleaks, which must drop it. What IS shared
+    // is the filesystem: one `statSync` per unique cited path per delivery, one
+    // stat budget, and one bounded drop/demote record instead of up to six.
+    //
+    // #1461 slice 1 (#1460) on gitleaks: the cache is TTL-only, so a finding for
+    // a file deleted after the scan was served as a 🔴 blocker for the rest of
+    // the 30-minute window — 119 of 126 findings in pi-lens's own cache. This
+    // read is the single agent-facing consumer of that store (session_start's
+    // read only decides whether to re-scan; the project-diagnostics path
+    // re-scans fresh and reconciles at load), so the drop belongs here, before
+    // the findings enter the shared secret pipeline. #1622 extends the gate from
+    // existence to freshness, and adds trivy secrets — the sibling store with
+    // the identical shape. A cited file edited after the scan keeps its finding
+    // but loses its line number: the credential may still be there, just not
+    // where the snapshot says. Dropping instead would let any edit — malicious
+    // or accidental — mute a real secret.
+    if (scannerStoresUnread.length > 0) {
+        logLatency({
+            type: "phase",
+            toolName: "turn_end",
+            filePath: cwd,
+            phase: "scanner_cache_read_abandoned",
+            durationMs: 0,
+            metadata: {
+                stores: scannerStoresUnread.join("+"),
+                aborted: deps.signal?.aborted === true,
+            },
+        });
+    }
+    const scannerGates = gateFindingsByPathFreshness({
+        cwd,
+        sources: {
+            ...govSources,
+            ...secretsSources,
+        },
     });
-    const govStale = new Set(govGate.stale);
-    // #1625 review round: the #1622 freshness gate runs FIRST — the disposition
-    // filter's anchor is derived from each finding's post-demotion identity
-    // (this array is already the gate's live+stale partition, never the raw
-    // pre-gate cache). #1627's own post-gate guard (`if (govFindings.length)`)
-    // and this round's disposition guard are the SAME guard — compose them,
-    // never fall back to a raw-cache-length check (that would print the header
-    // with zero rows beneath it whenever either filter empties the list).
-    const govFiltered = filterFindingsByDisposition([...govGate.live, ...govGate.stale], cwd, (f) => govulncheckFindingToProjectDiagnostic(cwd, f));
-    recordDispositionSuppressed("govulncheck", govFiltered.suppressed);
-    const govFindings = govFiltered.kept;
-    if (govFindings.length) {
-        const findings = govFindings.slice(0, 5);
-        let report = "🛡️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:\n";
-        for (const f of findings) {
-            const callSite = f.trace.find((t) => t.filename);
-            const stale = govStale.has(f);
-            const where = callSite?.filename
-                ? `${toRunnerDisplayPath(cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}`
-                : (f.module ?? f.packageName ?? "(module)");
-            const fix = f.fixedVersion
-                ? ` — upgrade to ${f.fixedVersion} or later`
-                : " — no fix yet, track upstream";
-            report += `  ${f.osv} (${where})${fix}\n`;
-        }
-        if (govFindings.length > findings.length) {
-            report += `  … and ${govFindings.length - findings.length} more\n`;
-        }
-        // @delivery-surface: runtime-turn:govulncheck-advisory
-        advisoryParts.push(report);
+    const govGate = scannerGates.govulncheck;
+    const gitleaksGate = scannerGates.gitleaks;
+    const trivySecretsGate = scannerGates["trivy-secrets"];
+    const govDelivery = govulncheckLane.render(govulncheckLane.gate({ govulncheck: govGate }, laneCtx), laneCtx);
+    for (const [store, count] of Object.entries(govDelivery.dispositionSuppressed ?? {})) {
+        recordDispositionSuppressed(store, count);
     }
-    const trivyCacheEntry = cacheManager.readCache("trivy", cwd);
+    // @delivery-surface: runtime-turn:govulncheck-advisory
+    advisoryParts.push(...(govDelivery.advisoryParts ?? []));
     // Secrets — UNIFIED surfacing (#131 Mode 3). gitleaks, trivy secret, and the
     // ast-grep hardcoded-secret rules can each flag the SAME line with different
     // rule ids, which the rule-keyed diagnostic dedup can't collapse. Collapse by
     // location so a committed/hardcoded secret is reported ONCE (with combined
     // provenance) — a blocker, since credentials need rotation before merge.
-    const gitleaksData = cacheManager.readCache("gitleaks", cwd)?.data;
-    const trivySecretsData = trivyCacheEntry?.data;
-    // Gitleaks deliberately scans gitignored local files and nested repositories
-    // so an explicit security audit can still inspect them. The adapter is the
-    // source of truth for whether a finding belongs in a blocking delivery lane;
-    // filter here before freshness handling so demoted findings cannot leak into
-    // either the blocker or stale-secret turn context.
-    const boundedClassification = await bounded(classifyAndFilterFindings(gitleaksData?.findings ?? [], cwd), {
-        ms: HOOK_WALL_BUDGET_MS.turn_end,
-        signal: deps.signal,
-        hook: "turn_end",
-        label: "classifyAndFilterFindings",
-    });
-    const classifiedGitleaksFindings = boundedClassification ?? gitleaksData?.findings ?? [];
-    if (boundedClassification === undefined) {
-        recordDegradationOnce({
-            kind: "gitleaks_classification_timeout",
-            subject: cwd,
-            reason: "gitleaks classification exceeded the turn_end budget; retained raw findings to fail open",
-        });
-    }
-    const blockingGitleaksFindings = classifiedGitleaksFindings.filter((finding) => gitleaksFindingToProjectDiagnostic(cwd, finding).semantic === "blocking");
-    // #1461 slice 1 (#1460): the gitleaks cache is TTL-only, so a finding for a
-    // file deleted after the scan is still served as a 🔴 blocker for the rest
-    // of the 30-minute window — the live case, and 119 of 126 findings in
-    // pi-lens's own cache. This read is the single agent-facing consumer of that
-    // store (session_start's read only decides whether to re-scan; the
-    // project-diagnostics path re-scans fresh and reconciles at load), so the
-    // drop belongs here, before the findings enter the shared secret pipeline.
-    // #1622 extends that gate from existence to freshness, and adds trivy
-    // secrets — the sibling store with the identical shape. A cited file edited
-    // after the scan keeps its finding but loses its line number: the credential
-    // may still be there, just not where the snapshot says. Dropping instead
-    // would let any edit — malicious or accidental — mute a real secret.
-    const gitleaksGate = gateFindingsByPathFreshness({
-        store: "gitleaks",
-        findings: blockingGitleaksFindings,
-        cwd,
-        scannedAt: gitleaksData?.scannedAt,
-        citedPath: (finding) => finding.file,
-    });
-    const trivySecretsGate = gateFindingsByPathFreshness({
-        store: "trivy-secrets",
-        findings: trivySecretsData?.secrets ?? [],
-        cwd,
-        scannedAt: trivySecretsData?.scannedAt,
-        citedPath: (finding) => finding.file,
-    });
-    // #1617: THE bug this issue exists for — gitleaks findings never passed
-    // through `applyDispositions`, so an agent-marked false-positive/won't-fix
-    // re-reported as a 🔴 STOP blocker on every turn. Filter through the SAME
-    // `gitleaksFindingToProjectDiagnostic` identity `lens_diagnostics
-    // mode=full` surfaces (tool="gitleaks", rule="gitleaks:<ruleId>", the
-    // exact "Potential secret: …" message) so a mark made against what the
-    // agent was shown is honored here too.
     //
-    // #1625 review round: filtered AFTER the #1622 freshness gate above — the
-    // anchor is derived from each finding's post-demotion identity, never the
-    // raw pre-gate cache. Applied to BOTH `gitleaksGate.live` AND
-    // `gitleaksGate.stale`: `staleSecretEntries` below derives from the stale
-    // arm, and an fp-marked finding that later goes stale must not reappear
-    // there — a suppression escape (and a double count against
-    // `dispositionSuppressedTotal`) that a live-only filter would have missed.
-    //
-    // #1628: trivy-secret findings get the SAME treatment, now that
-    // `trivySecretFindingToProjectDiagnostic` (project-diagnostics/runner-
-    // adapters/trivy.ts) gives them a `lens_diagnostics`-surfaced identity
-    // (tool="trivy", rule="trivy-secret:<ruleId>") to anchor a mark against —
-    // same pattern as gitleaks above, applied to both the live and stale arms
-    // for the same reason.
-    //
-    // ast-grep secret findings need no filtering here — they already went
-    // through dispatch's applyDispositions before reaching
-    // `peekActionableWarnings()`.
-    const gitleaksLiveFiltered = filterFindingsByDisposition(gitleaksGate.live, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
-    const gitleaksStaleFiltered = filterFindingsByDisposition(gitleaksGate.stale, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
-    recordDispositionSuppressed("gitleaks", gitleaksLiveFiltered.suppressed + gitleaksStaleFiltered.suppressed);
-    const trivySecretsLiveFiltered = filterFindingsByDisposition(trivySecretsGate.live, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
-    const trivySecretsStaleFiltered = filterFindingsByDisposition(trivySecretsGate.stale, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
-    recordDispositionSuppressed("trivy-secrets", trivySecretsLiveFiltered.suppressed + trivySecretsStaleFiltered.suppressed);
-    const astSecretWarnings = runtime
-        .peekActionableWarnings()
-        .filter(isSecretWarning);
-    const sessionSecrets = dedupeSecretFindings([
-        ...fromGitleaks(gitleaksLiveFiltered.kept),
-        ...fromTrivySecrets(trivySecretsLiveFiltered.kept),
-    ]);
-    // Demoted secrets are addressed by FILE, never by line — the line is the one
-    // field the edit invalidated. Rule id and source survive it and must be
-    // carried through (review round M1): an agent triages an `aws-access-token`
-    // differently from a low-confidence `generic-api-key`, and cannot do that
-    // from a bare path. Deduped on file+rule+source so a file with twenty stale
-    // hits of one rule is named once.
-    const staleSecretEntries = [
-        ...gitleaksStaleFiltered.kept.map((f) => ({
-            file: toRunnerDisplayPath(cwd, f.file),
-            rule: f.ruleId,
-            source: "gitleaks",
-        })),
-        ...trivySecretsStaleFiltered.kept.map((f) => ({
-            file: toRunnerDisplayPath(cwd, f.file),
-            rule: f.ruleId,
-            source: "trivy",
-        })),
-    ];
-    const staleSecrets = [
-        ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values(),
-    ];
-    // Locations already surfaced as session-scan secret blockers — used to enrich
-    // provenance where ast-grep agrees and to suppress the duplicate ast-grep copy
-    // from the actionable-warnings advisory below.
-    const secretBlockedLocations = new Set(sessionSecrets.map((f) => secretLocationKey(f.file, f.line)));
-    if (sessionSecrets.length) {
-        // Fold in ast-grep provenance ONLY where it coincides with a session
-        // secret — don't promote ast-grep-only findings out of their advisory tier.
-        const enriched = dedupeSecretFindings([
-            ...sessionSecrets,
-            ...fromAstGrepWarnings(astSecretWarnings).filter((a) => secretBlockedLocations.has(secretLocationKey(a.file, a.line))),
-        ]);
-        const shown = enriched.slice(0, 5);
-        let report = "🔴 STOP — hardcoded secrets detected. Rotate the credentials and remove them from source:\n";
-        for (const f of shown) {
-            const where = `${toRunnerDisplayPath(cwd, f.file)}:${f.line}`;
-            report += `  ${where} — ${f.rule} [${f.sources.join(" + ")}]${f.description ? `: ${f.description}` : ""}\n`;
-        }
-        if (enriched.length > shown.length) {
-            report += `  … and ${enriched.length - shown.length} more\n`;
-        }
-        // @delivery-surface: runtime-turn:secrets-gitleaks,runtime-turn:secrets-trivy
-        blockerParts.push(report);
-    }
-    if (staleSecrets.length) {
-        // Its OWN tier, never `advisoryParts` (review round M2). The advisory tier
-        // is labelled "no action required this turn", which would sit directly
-        // above copy telling the agent to re-scan — a section that contradicts its
-        // own heading. This preamble is imperative because the action is real: the
-        // finding is unverified, not dismissed.
-        const shown = staleSecrets.slice(0, 5);
-        let report = `🔑 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}\n` +
-            "The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:\n";
-        for (const entry of shown) {
-            report += `  ${entry.file} — ${entry.rule} [${entry.source}]\n`;
-        }
-        if (staleSecrets.length > shown.length) {
-            report += `  … and ${staleSecrets.length - shown.length} more\n`;
-        }
-        // @delivery-surface: runtime-turn:stale-secrets-tier
-        staleSecretParts.push(report);
+    // #1892: both tiers are rendered by the secrets LANE
+    // (`clients/turn-end/lanes/secrets.ts`), which owns every rule this block
+    // used to state inline — the two stores' disposition anchors over BOTH
+    // freshness arms (#1617/#1625/#1628), the location dedupe and ast-grep
+    // provenance enrichment, the demoted tier's file+rule+source identity
+    // (#1622 M1) and its own-tier placement (#1622 M2). The composer keeps only
+    // what is not one lane's rule: the gated arms it hands over, the order the
+    // tiers are pushed in, and the per-lane suppression counts that fold into
+    // the one notice below.
+    const secretsDelivery = secretsLane.render(secretsLane.gate({
+        gitleaks: gitleaksGate,
+        "trivy-secrets": trivySecretsGate,
+    }, laneCtx), laneCtx);
+    for (const [store, count] of Object.entries(secretsDelivery.dispositionSuppressed ?? {})) {
+        recordDispositionSuppressed(store, count);
     }
+    const secretBlockedLocations = secretsDelivery.deliveredLocationKeys ?? new Set();
+    // @delivery-surface: runtime-turn:secrets-gitleaks,runtime-turn:secrets-trivy
+    blockerParts.push(...(secretsDelivery.blockerParts ?? []));
+    // @delivery-surface: runtime-turn:stale-secrets-tier
+    staleSecretParts.push(...(secretsDelivery.staleSecretParts ?? []));
     // trivy — surface session_start-cached dependency CVEs (#131, Phase 1).
     // CRITICAL is a blocker (a known-exploitable CVE in a shipped dep is real
     // production risk); HIGH/MEDIUM/LOW are advisory. The agent gets the upgrade
@@ -1828,11 +1853,6 @@ export async function handleTurnEnd(deps) {
                 const depResult = depResults.get(absPath);
                 if (!depResult)
                     continue;
-                if (depResult.localSkips && depResult.localSkips > 0) {
-                    // Not silent: a skipped LOCAL import means madge couldn't resolve
-                    // it into the graph, so a cycle through it would be missed.
-                    dbg(`turn_end: madge skipped ${depResult.localSkips} local file(s) resolving ${file} — possible silent cycle-miss`);
-                }
                 if (depResult.hasCircular && depResult.circular.length > 0) {
                     // Whole-project circular deps are surfaced in lens_diagnostics via the
                     // session-start `madge` cache + extractor; this per-file turn-end pass
@@ -2660,10 +2680,13 @@ export async function handleTurnEnd(deps) {
                 "the affected files may have unreported callers.");
         }
         else {
+            const callGraphStart = Date.now();
             try {
                 const { impact, formatImpact, parseSymbolKey } = await import("./call-graph.js");
                 const { callGraphImpactToProjectDiagnostics } = await import("./project-diagnostics/runner-adapters/call-graph-impact.js");
                 const impactLines = [];
+                /** #3248: bounded per-turn, never per finding. */
+                let callGraphDispositionSuppressed = 0;
                 const impactFindings = [];
                 for (const filePath of files.slice(0, 5)) {
                     // Turn-state files may be cwd-relative while graph keys are absolute,
@@ -2691,7 +2714,33 @@ export async function handleTurnEnd(deps) {
                         });
                         if (results.length > 0) {
                             impactFindings.push({ calleeKey, results });
-                            const summary = formatImpact(results, cwd);
+                            // #3248: the rendered line takes the stored-disposition
+                            // filter. A result is mapped to its diagnostic by the
+                            // lane's OWN adapter, ONE result at a time, so the
+                            // identity can never diverge from the one
+                            // `lens_diagnostics` surfaces and a mark anchors against
+                            // — and a result the adapter does not map (the Review
+                            // tier, an unattributable key, a test-role caller) is
+                            // kept unconditionally: it is not markable, so nothing
+                            // may suppress it. Re-rendered with `formatImpact`, the
+                            // same renderer, never a second one.
+                            // `flatMap` rather than a push-under-an-`if`: an entry the
+                            // adapter does not map simply yields nothing, so the array
+                            // is well-typed with no branch whose removal changes no
+                            // behaviour (there is nothing here to mutate).
+                            const markable = results.flatMap((result) => callGraphImpactToProjectDiagnostics(cwd, [
+                                { calleeKey, results: [result] },
+                            ]).map((diagnostic) => ({ result, diagnostic })));
+                            const filtered = filterFindingsByDisposition(markable, cwd, (entry) => entry.diagnostic);
+                            callGraphDispositionSuppressed += filtered.suppressed;
+                            const keptEntries = new Set(filtered.kept);
+                            const dropped = new Set(markable
+                                .filter((entry) => !keptEntries.has(entry))
+                                .map((entry) => entry.result));
+                            const survivors = dropped.size === 0
+                                ? results
+                                : results.filter((r) => !dropped.has(r));
+                            const summary = survivors.length > 0 ? formatImpact(survivors, cwd) : "";
                             if (summary)
                                 impactLines.push(`  ${parseSymbolKey(calleeKey).symbolName ?? calleeKey}: ${summary}`);
                         }
@@ -2708,6 +2757,23 @@ export async function handleTurnEnd(deps) {
                         projectDiagnosticsSources.add("call-graph");
                     }
                 }
+                // #3248: this lane wrote nothing per turn, so its delivery decision
+                // — including how many callers a stored disposition dropped — was
+                // unobservable. One bounded row per turn, only when the lane ran.
+                if (impactFindings.length > 0 || callGraphDispositionSuppressed > 0) {
+                    logLatency({
+                        type: "phase",
+                        toolName: "turn_end",
+                        filePath: cwd,
+                        phase: "call_graph_impact",
+                        durationMs: Date.now() - callGraphStart,
+                        metadata: {
+                            callees: impactFindings.length,
+                            lines: impactLines.length,
+                            dispositionSuppressed: callGraphDispositionSuppressed,
+                        },
+                    });
+                }
                 // Non-fatal — call graph is best-effort
             }
             catch {
@@ -2779,14 +2845,7 @@ export async function handleTurnEnd(deps) {
                 turnIndex: runtime.turnIndex,
                 files,
                 modifiedRangesByFile,
-                // Suppress the ast-grep secret advisory at any location already
-                // surfaced in the unified secrets blocker above (#131 Mode 3) — the
-                // secret is reported once, not twice.
-                dispatchWarnings: runtime
-                    .peekActionableWarnings()
-                    .filter((w) => !(isSecretWarning(w) &&
-                    typeof w.line === "number" &&
-                    secretBlockedLocations.has(secretLocationKey(w.filePath, w.line)))),
+                dispatchWarnings: runtime.peekActionableWarnings(),
                 includeLspCodeActions: !!getFlag("lens-actionable-warning-actions"),
                 projectSeqStart: runtime.turnStartProjectSeq,
                 projectSeqEnd: runtime.projectSeq,
@@ -2883,7 +2942,36 @@ export async function handleTurnEnd(deps) {
             // #2521: `cwd` is what resolves the store location the advisory
             // names -- it is the SAME cwd `publishActionableWarningsReport`
             // just wrote through, so the two cannot disagree.
-            const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd, host);
+            const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd, host, (report) => {
+                let dispositionSuppressed = 0;
+                const files = report.files
+                    .map((file) => {
+                    const policy = filterFindingsByDisposition(file.warnings, cwd, (warning) => {
+                        const { line, column, rule, code } = warning;
+                        return {
+                            filePath: warning.filePath,
+                            severity: warning.severity,
+                            semantic: "warning",
+                            tool: warning.tool,
+                            runner: warning.tool,
+                            message: warning.message,
+                            source: warning.origin === "lsp" ? "lsp" : "dispatch",
+                            ...(line === undefined ? {} : { line: warning.line }),
+                            ...(column === undefined ? {} : { column: warning.column }),
+                            ...(rule === undefined ? {} : { rule: warning.rule }),
+                            ...(code === undefined ? {} : { code }),
+                        };
+                    });
+                    dispositionSuppressed += policy.suppressed;
+                    const kept = policy.kept.filter((warning) => !(isSecretWarning(warning) &&
+                        typeof warning.line === "number" &&
+                        secretBlockedLocations.has(secretLocationKey(warning.filePath, warning.line))));
+                    return kept.length > 0 ? { ...file, warnings: kept } : undefined;
+                })
+                    .filter((file) => file !== undefined);
+                recordDispositionSuppressed("actionable-warnings", dispositionSuppressed);
+                return { files, suppressed: dispositionSuppressed };
+            });
             // @delivery-surface: runtime-turn:actionable-warnings-advisory
             if (advisory)
                 advisoryParts.push(advisory);
@@ -2927,11 +3015,46 @@ export async function handleTurnEnd(deps) {
     }
     const t5 = Date.now();
     try {
+        // #3248: the code-quality records were filtered at DISPATCH time, before
+        // any `lens_diagnostic_mark`. `lens_diagnostics mode=delta` re-applies
+        // dispositions when it re-serves this same cache
+        // (`tools/lens-diagnostics.ts`'s `visibleWarningFiles`), so without this
+        // the turn-end advisory counted warnings the delta view had already
+        // dropped — the two surfaces disagreed about the same records. Filtered
+        // at the report INPUT so the advisory, the persisted report and the delta
+        // view all agree; the delta view's own filter then re-applies to the same
+        // set and is idempotent. Per file, because the anchor is content-bound.
+        const qualityWarningsByFile = new Map();
+        for (const warning of runtime.peekCodeQualityWarnings()) {
+            const group = qualityWarningsByFile.get(warning.filePath);
+            if (group)
+                group.push(warning);
+            else
+                qualityWarningsByFile.set(warning.filePath, [warning]);
+        }
+        const qualityWarnings = [];
+        let qualityDispositionSuppressed = 0;
+        for (const [filePath, group] of qualityWarningsByFile) {
+            let content;
+            try {
+                content = fs.readFileSync(filePath, "utf-8");
+            }
+            catch {
+                content = undefined;
+            }
+            const { kept, suppressed } = applyPushedFindingPolicy(group, {
+                cwd,
+                filePath,
+                content,
+            });
+            qualityWarnings.push(...kept);
+            qualityDispositionSuppressed += suppressed;
+        }
         const qualityReport = buildCodeQualityWarningsReport({
             cwd,
             sessionId: runtime.telemetrySessionId,
             turnIndex: runtime.turnIndex,
-            warnings: runtime.peekCodeQualityWarnings(),
+            warnings: qualityWarnings,
             modifiedRangesByFile,
             projectSeqStart: runtime.turnStartProjectSeq,
             projectSeqEnd: runtime.projectSeq,
@@ -2949,7 +3072,11 @@ export async function handleTurnEnd(deps) {
             filePath: cwd,
             phase: "code_quality_warnings_report",
             durationMs: Date.now() - t5,
-            metadata: qualityReport.summary,
+            metadata: {
+                ...qualityReport.summary,
+                // #3248: bounded per-turn on this lane's own row.
+                dispositionSuppressed: qualityDispositionSuppressed,
+            },
         });
     }
     catch (err) {
@@ -2980,6 +3107,8 @@ export async function handleTurnEnd(deps) {
     let runnerFindingsStale = 0;
     let runnerFindingsFailed = 0;
     let runnerFindingsDropped = 0;
+    /** #3248: bounded per-turn on this lane's own row, never per finding. */
+    let runnerFindingsDispositionSuppressed = 0;
     const runnerFindingsDeliveredIds = [];
     for (const pending of pendingRunnerFindings) {
         const result = pending.result;
@@ -2996,12 +3125,15 @@ export async function handleTurnEnd(deps) {
         const findings = result.diagnostics;
         if (findings.length === 0)
             continue;
-        const gate = gateFindingsByPathFreshness({
-            store: "late-runner-findings",
-            findings,
+        const { "late-runner-findings": gate } = gateFindingsByPathFreshness({
             cwd,
-            scannedAt: pending.markedAtMs,
-            citedPath: (finding) => finding.filePath,
+            sources: {
+                "late-runner-findings": {
+                    findings,
+                    scannedAt: pending.markedAtMs,
+                    citedPath: (finding) => finding.filePath,
+                },
+            },
         });
         runnerFindingsStale += gate.stale.length;
         if (gate.stale.length > 0) {
@@ -3014,15 +3146,46 @@ export async function handleTurnEnd(deps) {
         if (gate.live.length === 0)
             continue;
         const displayPath = toRunnerDisplayPath(cwd, pending.filePath);
-        const lines = gate.live.map((finding) => `  ${displayPath}:${finding.line ?? 1}:${finding.column ?? 1} [${finding.rule ?? finding.id}] ${finding.message}`);
-        runnerFindingsDelivered += gate.live.length;
-        for (const finding of gate.live) {
+        // #3248: the survivors are what the agent READS, so they take the same
+        // policy stack the late-AUXILIARY drain below applies — this lane is its
+        // twin (same post-gate `Diagnostic[]`, same rendering) and was the one
+        // push surface still re-reporting a finding the agent had marked. AFTER
+        // the freshness gate, like every other lane: the anchor is derived from
+        // the post-gate identity, never the raw pre-gate set. The file's CURRENT
+        // bytes; an unreadable file fails open inside the helper.
+        let runnerContent;
+        try {
+            runnerContent = fs.readFileSync(pending.filePath, "utf-8");
+        }
+        catch {
+            runnerContent = undefined;
+        }
+        const { kept: runnerKept, suppressed: runnerSuppressedHere } = applyPushedFindingPolicy(gate.live, {
+            cwd,
+            filePath: pending.filePath,
+            content: runnerContent,
+        });
+        runnerFindingsDispositionSuppressed += runnerSuppressedHere;
+        if (runnerKept.length === 0) {
+            // Every late finding was marked. A PUSH surface stays silent rather
+            // than re-announcing that the mark is working; the count rides this
+            // lane's bounded per-turn row below.
+            continue;
+        }
+        const lines = runnerKept.map((finding) => `  ${displayPath}:${finding.line ?? 1}:${finding.column ?? 1} [${finding.rule ?? finding.id}] ${finding.message}`);
+        runnerFindingsDelivered += runnerKept.length;
+        for (const finding of runnerKept) {
             if (runnerFindingsDeliveredIds.length < 50) {
                 runnerFindingsDeliveredIds.push(finding.id);
             }
         }
+        // #1616 suppressed-bucket rule: a delivery that still has something to
+        // say states what it dropped, once per delivery.
+        const runnerSuppressedNote = runnerSuppressedHere > 0
+            ? `; suppressed by disposition: ${runnerSuppressedHere} finding(s)`
+            : "";
         // @delivery-surface: runtime-turn:late-runner-findings
-        advisoryParts.push(`⏱️ Late runner diagnostics (${pending.runnerId} completed after the edit):\n${lines.join("\n")}`);
+        advisoryParts.push(`⏱️ Late runner diagnostics (${pending.runnerId} completed after the edit${runnerSuppressedNote}):\n${lines.join("\n")}`);
     }
     logLatency({
         type: "phase",
@@ -3036,6 +3199,7 @@ export async function handleTurnEnd(deps) {
             stale: runnerFindingsStale,
             failed: runnerFindingsFailed,
             dropped: runnerFindingsDropped,
+            dispositionSuppressed: runnerFindingsDispositionSuppressed,
             deliveredIds: runnerFindingsDeliveredIds,
         },
     });
@@ -3264,12 +3428,15 @@ export async function handleTurnEnd(deps) {
                     // one), so a stale-arm replay would double-report old content.
                     // Both drops are COUNTED here and in the latency record below —
                     // never silent (shape 10).
-                    const gate = gateFindingsByPathFreshness({
-                        store: "late-auxiliary-findings",
-                        findings: retained,
+                    const { "late-auxiliary-findings": gate } = gateFindingsByPathFreshness({
                         cwd,
-                        scannedAt: pair.markedAtMs,
-                        citedPath: () => lateAuxPath,
+                        sources: {
+                            "late-auxiliary-findings": {
+                                findings: retained,
+                                scannedAt: pair.markedAtMs,
+                                citedPath: () => lateAuxPath,
+                            },
+                        },
                     });
                     lateAuxStale += gate.stale.length;
                     lateAuxMissing +=
@@ -3314,15 +3481,15 @@ export async function handleTurnEnd(deps) {
                     // a late pair. Runs AFTER the freshness gate, like the #1625
                     // govulncheck/secrets filters: the anchor is derived from the
                     // post-gate identity, never the raw pre-gate set.
-                    const { kept: lateAuxKept } = applyFindingPolicy(gate.live, {
+                    // #3248: the four arguments moved into
+                    // `applyPushedFindingPolicy` so the late-RUNNER drain below
+                    // cannot make a second copy of them. Same stack, same
+                    // identities, same fail-open content rule.
+                    const { kept: lateAuxKept, suppressed: lateAuxSuppressedHere } = applyPushedFindingPolicy(gate.live, {
                         cwd,
                         filePath: lateAuxPath,
-                        content: lateAuxContent ?? "",
-                        // mtime-cached, so a drain of several files costs one stat.
-                        policyMap: loadProjectRulePolicyMap(cwd),
-                        identities: renderedRuleIdentities,
+                        content: lateAuxContent,
                     });
-                    const lateAuxSuppressedHere = gate.live.length - lateAuxKept.length;
                     lateAuxDispositionSuppressed += lateAuxSuppressedHere;
                     if (lateAuxKept.length === 0) {
                         // Every late finding was suppressed. This is a PUSH surface: