@herbertgao/pi-extensions 2026.9.5 → 2026.9.7

package/node_modules/pi-lens/dist/clients/runtime-tool-result.js

@@ -2,8 +2,9 @@ import * as nodeCrypto from "node:crypto";
 import * as nodeFs from "node:fs";
 import * as path from "node:path";
 import { noteAuthoritativeContentAttachment } from "./agent-nudge.js";
-import { captureFileStats, diffFileStats, getOpaqueBaselineStore, recoverOpaqueChangesViaGit, } from "./opaque-mutation-scan.js";
+import { captureFileStats, diffFileContent, getOpaqueBaselineStore, recoverOpaqueChangesViaGit, } from "./opaque-mutation-scan.js";
 import { normalizeMapKey } from "./path-utils.js";
+import { detectFileKind } from "./file-kinds.js";
 import { extractReadPathsFromCommand, extractDeletedPathsFromCommand, extractGrepSearchReadsFromOutput, extractWrittenPathsFromCommand, tokenizeShellCommand, } from "./bash-file-access.js";
 import { registerSearchReads, } from "./search-read-registration.js";
 import { createFileTime } from "./file-time.js";
@@ -21,6 +22,7 @@ import { replayThroughMutationBridge, storedLineHashesFor, } from "./observed-mu
 import { getAmbientAbortSignal } from "./safe-spawn.js";
 import { resolveToolCallCorrelationId } from "./tool-event.js";
 import { boundedIndexesForCount, createReadGuardEditBatchSummary, getReadGuardCorrelationId, logReadGuardEvent, } from "./read-guard-logger.js";
+import { countFileLines } from "./read-guard-tool-lines.js";
 import { notifyExternalFileChange, resyncGitChangedFiles, } from "./lsp/index.js";
 import { runPipeline } from "./pipeline.js";
 import { renderPostAutofixNotice, } from "./post-autofix-notice.js";
@@ -28,7 +30,14 @@ import { syncGitGuardRecord } from "./git-guard.js";
 import { scheduleWordIndexPersist } from "./word-index.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { getActiveSessionId } from "./session-lifecycle.js";
+import { requestBootstrapClients } from "./bootstrap.js";
+import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
+import { incrementDegradationCount, recordDegradationOnce, } from "./degradation-ledger.js";
 const AUTHORITATIVE_CONTENT_MAX_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
+// Keep same-turn analysis below the observed-directory capture bound so one
+// opaque codemod cannot monopolize the hook or analyzer fleet.
+const OBSERVED_DISPATCH_MAX_PATHS = 32;
 /**
  * Git subcommands that import ANOTHER commit's content into the index. The
  * whole family, with a verdict for each (#2060):
@@ -93,6 +102,29 @@ export function isFailedGitIntegrationCommand(command, isError) {
         return false;
     });
 }
+function ensureToolResultClients(deps) {
+    if (deps.biomeClient && deps.ruffClient && deps.metricsClient)
+        return true;
+    const request = {
+        reason: "tool-result-analysis",
+        hook: "tool_result_edit",
+        timeoutMs: HOOK_WALL_BUDGET_MS.tool_result_edit,
+        ...(deps.signal === undefined ? {} : { signal: deps.signal }),
+    };
+    return bounded(requestBootstrapClients(request), {
+        ms: HOOK_WALL_BUDGET_MS.tool_result_edit,
+        signal: deps.signal,
+        hook: "tool_result_edit",
+        label: "tool-result-bootstrap-demand",
+    }).then((clients) => {
+        if (!clients)
+            return false;
+        deps.biomeClient = clients.biomeClient;
+        deps.ruffClient = clients.ruffClient;
+        deps.metricsClient = clients.metricsClient;
+        return true;
+    });
+}
 function parseDiffRanges(diff) {
     const changedLines = [];
     for (const line of diff.split("\n")) {
@@ -144,13 +176,11 @@ export function clearLastAnalyzedStateCache() {
  * with one owner (#2464 review round 3, F1) rather than two open-coded blocks
  * ~80 lines apart whose invariants only line up if a reader checks both.
  *
- * Exported for the isolation red in
- * `tests/clients/observed-mutation-integration.test.ts`: with
- * `claimPipelineDispatch` below now consulted by BOTH dispatch call sites, the
- * identity guard in the release has no reachable production trigger left, so
- * the only honest way to prove it is to drive the seam directly.
+ * Kept private because both dispatch call sites now use the shared claim before
+ * registration; publishing this seam without the claim obligation would make
+ * the identity guard's precondition easy to violate again.
  */
-export function registerInFlightPipeline(filePath, stateHash, pipeline) {
+function registerInFlightPipeline(filePath, stateHash, pipeline) {
     let filePipelines = inFlightPipelines.get(filePath);
     if (!filePipelines) {
         filePipelines = new Map();
@@ -172,7 +202,7 @@ export function registerInFlightPipeline(filePath, stateHash, pipeline) {
  * deduping and its `participantIds`/`participantTotal` under-count. Delete only
  * when the outer map still points at the very map this registration went into.
  */
-export function releaseInFlightPipeline(filePath, stateHash, registered) {
+function releaseInFlightPipeline(filePath, stateHash, registered) {
     registered.delete(stateHash);
     if (registered.size === 0 && inFlightPipelines.get(filePath) === registered) {
         inFlightPipelines.delete(filePath);
@@ -208,7 +238,7 @@ export function releaseInFlightPipeline(filePath, stateHash, registered) {
  * already analysed this turn — the duplicate-recording inversion #2464 exists
  * to remove.
  */
-export function claimPipelineDispatch(args) {
+function claimPipelineDispatch(args) {
     const { filePath, stateHash, turnIndex, participantId, dbg } = args;
     // Deduplicate concurrent calls for the same final file state (pi can fire one
     // tool_result per edit hunk). Do not dedupe by file alone: a distinct later
@@ -454,9 +484,10 @@ function refreshCachedExports(runtime, filePath) {
  * pipeline AND record" block could not express.
  */
 async function dispatchPipelineAnalysis(args) {
-    const { deps, runtime, filePath, dispatchCwd, turnStateCwd, autofixMode, modifiedRanges, writeIndex, initialStateHash, readGuardCorrelationId, requestedEditIndexes, requestedEditTotal, isPartialApplyResult, toolResultStart, nativeAppliedPairs, } = args;
+    const { deps, runtime, filePath, dispatchCwd, turnStateCwd, autofixMode, modifiedRanges, writeIndex, initialStateHash, readGuardCorrelationId, requestedEditIndexes, requestedEditTotal, isPartialApplyResult, toolResultStart, nativeAppliedPairs, allowReadGuardWrites, } = args;
     const { event, getFlag, getFlagSource, dbg, biomeClient, ruffClient, metricsClient, resetLSPService, } = deps;
     const pipelinePromise = runPipeline({
+        signal: deps.signal,
         filePath,
         cwd: dispatchCwd,
         projectRoot: turnStateCwd,
@@ -497,9 +528,9 @@ async function dispatchPipelineAnalysis(args) {
             scheduleWordIndexPersist(dispatchCwd, index, dbg);
         },
     }, {
-        biomeClient,
-        ruffClient,
-        metricsClient,
+        biomeClient: biomeClient,
+        ruffClient: ruffClient,
+        metricsClient: metricsClient,
         getFormatService,
         fixedThisTurn: runtime.fixedThisTurn,
     });
@@ -632,11 +663,20 @@ async function dispatchPipelineAnalysis(args) {
     // ladder (the #2402 after-write hash was never stamped), and a duplicate
     // tool_result for the same bytes analysed the file a second time (the
     // already-analysed latch was never set).
-    const finalStateHash = getFileStateHash(filePath);
-    lastAnalyzedStateByFile.set(filePath, {
-        turnIndex: runtime.turnIndex,
-        stateHash: finalStateHash,
-    });
+    // The latch identifies the bytes this pipeline actually analysed. A pipeline
+    // that reports no write analysed its input state, even if another writer
+    // changed disk while the await was parked. A pipeline-reported write selects
+    // only the identity captured by runPipeline before analysis awaits (#2499).
+    const pipelineOwnedWriteHash = result.fileModified
+        ? result.postWriteStateHash
+        : undefined;
+    const finalStateHash = pipelineOwnedWriteHash ?? initialStateHash;
+    if (!result.fileModified || pipelineOwnedWriteHash !== undefined) {
+        lastAnalyzedStateByFile.set(filePath, {
+            turnIndex: runtime.turnIndex,
+            stateHash: finalStateHash,
+        });
+    }
     // #2402: pi-lens' own immediate format/autofix may have rewritten the file
     // after the native edit was recorded by the caller. Stamp the post-pipeline
     // state so an identical retry against the formatted bytes is still
@@ -645,7 +685,7 @@ async function dispatchPipelineAnalysis(args) {
     // `initialStateHash` IS the post-write hash at both call sites — the
     // classified chain passes `postWriteStateHash` verbatim, the observed path
     // passes the same pre-settle digest.
-    if (finalStateHash !== initialStateHash) {
+    if (pipelineOwnedWriteHash !== undefined) {
         for (const pair of nativeAppliedPairs) {
             runtime.partialApplyRecords.noteAfterWriteHash(filePath, pair.oldText, pair.newText, finalStateHash);
         }
@@ -653,7 +693,7 @@ async function dispatchPipelineAnalysis(args) {
     // The model's write/edit and pi-lens' own immediate format/autofix are now
     // reflected on disk. Refresh read-guard staleness stamps so a follow-up edit
     // is judged by read-range coverage, not by our own previous write.
-    if (!getFlag("no-read-guard")) {
+    if (!getFlag("no-read-guard") && allowReadGuardWrites) {
         const changedForReadGuard = new Set([
             path.resolve(filePath),
             ...(result.changedFiles ?? []).map((changedFile) => path.resolve(changedFile)),
@@ -670,6 +710,7 @@ export async function handleToolResult(deps) {
     const { event, getFlag, dbg, runtime, cacheManager, agentBehaviorRecord, formatBehaviorWarnings, } = deps;
     const rawFilePath = event.input.path;
     const workspaceRoot = runtime.projectRoot || process.cwd();
+    let bashAuthorshipConfirmed = deps._readGuardAuthorship ?? event.toolName !== "bash";
     // #1642: a gitignored worktree edit got re-attributed onto a
     // same-relative-path file in the parent checkout because this handler
     // used to always resolve a relative path against `workspaceRoot`
@@ -791,10 +832,16 @@ export async function handleToolResult(deps) {
         // THIS set, not raw recognized - otherwise a redirect target dropped
         // by the isError filter would be subtracted from recovery AND
         // excluded here, attributed nowhere.
-        const recognizedWritten = event.isError !== true
+        let recognizedWritten = event.isError !== true
             ? recognized.filter((wp) => !isExternalOrVendorFile(wp, workspaceRoot) &&
                 !isPathIgnoredByProject(wp, workspaceRoot, false))
             : [];
+        // Fence the mtime-based session-authored fallback before any async
+        // observation. Only later content evidence may clear this fence.
+        if (!getFlag("no-read-guard")) {
+            for (const recognizedPath of recognizedWritten)
+                deps.readGuard?.recordUnchanged?.(recognizedPath);
+        }
         // #2000 phase 2: when the extractor recognizes NOTHING, the command is
         // opaque-candidate — recover its actual changed set by diffing the pre
         // snapshot taken at tool_call. Partial writes that landed before a
@@ -802,6 +849,8 @@ export async function handleToolResult(deps) {
         // them) — a deliberate divergence from the isError filter above, which
         // exists for restore semantics where attribution would lie.
         let opaquePaths = [];
+        let observedChangedKeys;
+        let recognizedAuthored = [];
         // Recovery runs for EVERY bash command with a pending baseline - not
         // only recognized-empty ones. A mixed command (`python x.py > out.ts`
         // plus script-internal writes) previously skipped observation entirely
@@ -829,6 +878,7 @@ export async function handleToolResult(deps) {
                 if (recovery.verdict === "recovered") {
                     opaquePaths = recovery.paths.filter((p) => !isExternalOrVendorFile(p, scanRoot) &&
                         !isPathIgnoredByProject(p, scanRoot, false));
+                    observedChangedKeys = new Set(opaquePaths);
                 }
                 else if (recovery.verdict === "unknown") {
                     // #2060: deliberately WIDER than the old `recognized.length > 0`
@@ -837,6 +887,12 @@ export async function handleToolResult(deps) {
                     // nothing at all.
                     unknownReason = recovery.unknownReason;
                 }
+                else {
+                    // A clean git verdict is complete evidence that no path
+                    // changed; it is not missing evidence. Keep recognized writes
+                    // out of authorship because git found no changed bytes.
+                    observedChangedKeys = new Set();
+                }
                 // #2060: both counts are bounded (one record per tool_result, no
                 // per-path logging) and exist because filtering is invisible in
                 // production otherwise - the dropped paths simply never appear.
@@ -862,9 +918,11 @@ export async function handleToolResult(deps) {
             else if (pending.stats) {
                 const outcome = await captureFileStats(scanRoot, {
                     withHashes: true,
+                    ...deps._opaqueCaptureOptions,
                 });
                 if (outcome.snapshot && !outcome.unknownReason) {
-                    opaquePaths = diffFileStats(pending.stats, outcome.snapshot);
+                    opaquePaths = diffFileContent(pending.stats, outcome.snapshot);
+                    observedChangedKeys = new Set(opaquePaths);
                 }
                 else {
                     unknownReason =
@@ -880,6 +938,16 @@ export async function handleToolResult(deps) {
                 const survivingKeys = new Set(recognizedWritten.map((p) => normalizeMapKey(path.resolve(p))));
                 opaquePaths = opaquePaths.filter((p) => !survivingKeys.has(p));
             }
+            if (observedChangedKeys) {
+                recognizedAuthored = recognizedWritten.filter((file) => observedChangedKeys.has(normalizeMapKey(path.resolve(file))));
+                if (recognizedAuthored.length === 0)
+                    recognizedWritten = [];
+            }
+            else if (unknownReason) {
+                recognizedAuthored = [];
+                // The bounded opaque_mutation_coverage_unknown record below remains
+                // the production proof that authorship evidence was unavailable.
+            }
             if (unknownReason) {
                 logLatency({
                     type: "phase",
@@ -906,9 +974,15 @@ export async function handleToolResult(deps) {
         // set must hold those exact strings - no re-resolution.
         const opaqueSet = new Set(opaquePaths);
         const written = [...recognizedWritten, ...opaquePaths];
+        const recognizedAuthoredSet = new Set(recognizedAuthored);
+        bashAuthorshipConfirmed =
+            recognizedAuthored.length > 0 || opaquePaths.length > 0;
         for (const wp of written) {
-            if (!getFlag("no-read-guard"))
+            if (!getFlag("no-read-guard") &&
+                (opaqueSet.has(wp) || recognizedAuthoredSet.has(wp)))
                 deps.readGuard?.recordWritten(wp);
+            else if (!getFlag("no-read-guard") && recognizedWritten.includes(wp))
+                deps.readGuard?.recordUnchanged?.(wp);
             const receipt = runtime
                 .recordMutationToolReceipt;
             const autofixMode = receipt
@@ -939,6 +1013,7 @@ export async function handleToolResult(deps) {
                 _autofixMode: autofixMode,
                 _attachmentBudget: syntheticAttachmentBudget,
                 _mutationSourceOverride: isOpaque ? "opaque-script" : undefined,
+                _readGuardAuthorship: opaqueSet.has(wp) || recognizedAuthoredSet.has(wp),
             });
             if (syntheticResult) {
                 // #1590: forward verbatim. The synthetic call already charged the
@@ -949,7 +1024,57 @@ export async function handleToolResult(deps) {
             }
         }
         if (event.isError !== true && !getFlag("no-read-guard")) {
-            for (const span of extractReadPathsFromCommand(command, workspaceRoot)) {
+            const truncation = event.details?.truncation;
+            const parsedSpans = extractReadPathsFromCommand(command, workspaceRoot);
+            let spans = parsedSpans;
+            if (truncation?.truncated === true &&
+                typeof truncation.outputLines === "number") {
+                if (parsedSpans.length === 1) {
+                    const span = parsedSpans[0];
+                    if (span) {
+                        // countFileLines intentionally preserves the split-based guard
+                        // convention, where a trailing newline contributes an empty final
+                        // element. The host's output line count does not include that
+                        // element, so remove it from the span basis before taking the tail.
+                        const hasTrailingNewline = nodeFs
+                            .readFileSync(span.filePath, "utf8")
+                            .endsWith("\n");
+                        const spanLineCount = hasTrailingNewline
+                            ? Math.max(1, span.limit - 1)
+                            : span.limit;
+                        const shown = Math.min(truncation.outputLines, spanLineCount);
+                        spans =
+                            shown > 0
+                                ? [
+                                    {
+                                        ...span,
+                                        offset: span.offset + spanLineCount - shown,
+                                        limit: shown,
+                                    },
+                                ]
+                                : [];
+                    }
+                }
+                else if (parsedSpans.length > 1) {
+                    recordDegradationOnce({
+                        kind: "bash-view-clipped",
+                        subject: "multi-span",
+                        reason: "truncated bash view contained multiple spans",
+                    });
+                    spans = [];
+                }
+                if (parsedSpans.length === 1 &&
+                    spans.length === 1 &&
+                    (spans[0]?.offset !== parsedSpans[0]?.offset ||
+                        spans[0]?.limit !== parsedSpans[0]?.limit)) {
+                    recordDegradationOnce({
+                        kind: "bash-view-clipped",
+                        subject: parsedSpans[0]?.filePath ?? "unknown",
+                        reason: "truncated bash view narrowed a single span",
+                    });
+                }
+            }
+            for (const span of spans) {
                 if (isExternalOrVendorFile(span.filePath, workspaceRoot))
                     continue;
                 if (isPathIgnoredByProject(span.filePath, workspaceRoot, false))
@@ -1029,6 +1154,74 @@ export async function handleToolResult(deps) {
             });
         }
     }
+    // Native read results are the authoritative read boundary. The tool_call
+    // input can request past EOF, and the host can cap bytes or lines before the
+    // result reaches the model. Register only the delivered range (#2802).
+    if (deps.readGuard &&
+        event.toolName === "read" &&
+        event.isError !== true &&
+        filePath &&
+        !getFlag("no-read-guard") &&
+        !isExternalOrVendorFile(filePath, workspaceRoot)) {
+        const deliveredFilePath = attribution?.resolvedPath && nodeFs.existsSync(attribution.resolvedPath)
+            ? attribution.resolvedPath
+            : filePath;
+        if (nodeFs.existsSync(deliveredFilePath)) {
+            const nativeReadToolCallId = resolveToolCallCorrelationId(event);
+            const input = event.input;
+            const requestedOffset = input.offset ?? 1;
+            const requestedLimit = input.limit;
+            const truncation = event.details?.truncation;
+            const available = Math.max(0, countFileLines(deliveredFilePath) - requestedOffset + 1);
+            const deliveredLimit = Math.min(available, truncation?.outputLines ?? requestedLimit ?? available);
+            if (deliveredLimit > 0) {
+                if (truncation?.truncated === true && deliveredLimit < available) {
+                    recordDegradationOnce({
+                        kind: "native-read-clipped",
+                        subject: deliveredFilePath,
+                        reason: "native read result was clipped before delivery",
+                    });
+                }
+                logReadGuardEvent({
+                    event: "read_pattern",
+                    sessionId: runtime.telemetrySessionId,
+                    filePath: deliveredFilePath,
+                    requestedOffset,
+                    requestedLimit: requestedLimit ?? deliveredLimit,
+                    effectiveOffset: requestedOffset,
+                    effectiveLimit: deliveredLimit,
+                    metadata: {
+                        totalLines: countFileLines(deliveredFilePath),
+                        isPartial: deliveredLimit < available,
+                        fileKind: detectFileKind(deliveredFilePath) ?? "unknown",
+                        fractionRead: available > 0
+                            ? Math.round((deliveredLimit / available) * 100) / 100
+                            : 1,
+                        expandedByTs: false,
+                    },
+                });
+                const deliveredRecord = {
+                    filePath: deliveredFilePath,
+                    requestedOffset,
+                    requestedLimit: requestedLimit ?? deliveredLimit,
+                    effectiveOffset: requestedOffset,
+                    effectiveLimit: deliveredLimit,
+                    expandedByLsp: false,
+                    turnIndex: runtime.turnIndex,
+                    writeIndex: runtime.peekWriteIndex(),
+                    timestamp: Date.now(),
+                };
+                if (nativeReadToolCallId) {
+                    deps.readGuard.recordRead(deliveredRecord, {
+                        supersedes: { toolCallId: nativeReadToolCallId },
+                    });
+                }
+                else {
+                    deps.readGuard.recordRead(deliveredRecord);
+                }
+            }
+        }
+    }
     // #2423: THE inbound gate. Everything below this line is the mutation
     // bookkeeping chain — read-guard staleness stamp, turn state, change-log
     // receipt, deferred autofix and format. Before the seam this compared
@@ -1198,14 +1391,36 @@ export async function handleToolResult(deps) {
             // "edit", so the un-receipted default is "deferred" either way.
             const observedAutofixMode = receiptOutcome?.autofixMode ??
                 (observedKind === "edit" ? "deferred" : "immediate");
-            // Analyse the file the observation actually RECORDED, not merely the
-            // one the tool named: a directory-target tool names a path that is not
-            // a file at all, and `runPipeline` on it is meaningless. `changedPaths`
-            // is already filtered by the `isRecordable` predicate handed to the
-            // settle above, so membership here also implies not-vendored and
-            // not-gitignored — the same two gates the classified chain applies
-            // before its own dispatch.
-            if (observedChangedPaths.some((candidate) => pathsEqual(candidate, filePath))) {
+            // Analyse the files the observation actually RECORDED, not merely the
+            // path the tool named. A directory is never a pipeline target.
+            const observedDispatchPaths = observedChangedPaths
+                .filter((candidate) => {
+                try {
+                    return !nodeFs.statSync(candidate).isDirectory();
+                }
+                catch {
+                    return false;
+                }
+            })
+                .slice(0, OBSERVED_DISPATCH_MAX_PATHS);
+            const observedDispatchDropped = observedChangedPaths.length - observedDispatchPaths.length;
+            if (observedDispatchDropped > 0) {
+                incrementDegradationCount({
+                    kind: "observed-mutation-dispatch-cap",
+                    subject: event.toolName,
+                    reason: `observed mutation dispatch capped at ${OBSERVED_DISPATCH_MAX_PATHS}; ${observedDispatchDropped} path(s) not dispatched`,
+                });
+            }
+            if (observedDispatchPaths.length > 0) {
+                const observedClients = ensureToolResultClients(deps);
+                if (observedClients !== true &&
+                    !(await bounded(Promise.resolve(observedClients), {
+                        ms: HOOK_WALL_BUDGET_MS.tool_result_edit,
+                        signal: deps.signal ?? undefined,
+                        hook: "tool_result_edit",
+                        label: "observed-tool-result-analysis",
+                    })))
+                    return;
                 const observedReadGuardCorrelationId = getReadGuardCorrelationId(event);
                 // #2464 review round 3 (F1): the SAME two pre-conditions the
                 // classified site consults, through the same shared claim. Round 2
@@ -1215,60 +1430,72 @@ export async function handleToolResult(deps) {
                 // second overwrote the first's registry entry, and the first's
                 // release then evicted the outer entry a live, unrelated classified
                 // pipeline had since re-created under it.
-                const observedClaim = claimPipelineDispatch({
-                    filePath,
-                    stateHash: observedStateHash,
-                    turnIndex: runtime.turnIndex,
-                    participantId: observedReadGuardCorrelationId,
-                    dbg,
-                });
-                if (!observedClaim.proceed) {
-                    if (observedClaim.joined) {
-                        await observedClaim.joined;
+                for (const observedPath of observedDispatchPaths) {
+                    const observedDispatchSignal = deps.signal;
+                    const observedJoinSignal = deps.signal;
+                    const observedStateHashForPath = getFileStateHash(observedPath);
+                    const observedClaim = claimPipelineDispatch({
+                        filePath: observedPath,
+                        stateHash: observedStateHashForPath,
+                        turnIndex: runtime.turnIndex,
+                        participantId: observedReadGuardCorrelationId,
+                        dbg,
+                    });
+                    if (!observedClaim.proceed) {
+                        if (observedClaim.joined) {
+                            await bounded(observedClaim.joined, {
+                                ms: HOOK_WALL_BUDGET_MS.tool_result_edit,
+                                signal: observedJoinSignal,
+                                hook: "tool_result_edit",
+                                label: "observed-tool-result-join",
+                            });
+                        }
+                        continue;
+                    }
+                    const observedDispatchOutcome = await bounded(dispatchPipelineAnalysis({
+                        deps,
+                        runtime,
+                        filePath: observedPath,
+                        dispatchCwd: resolveLanguageRootForFile(observedPath, workspaceRoot),
+                        turnStateCwd: path.resolve(workspaceRoot),
+                        autofixMode: observedAutofixMode,
+                        modifiedRanges: undefined,
+                        writeIndex: runtime.nextWriteIndex(),
+                        initialStateHash: observedStateHashForPath,
+                        readGuardCorrelationId: observedReadGuardCorrelationId,
+                        requestedEditIndexes: getRequestedEditIndexes(event, observedKind),
+                        requestedEditTotal: getRequestedEditCount(event, observedKind),
+                        isPartialApplyResult: (event.details ?? {})
+                            .piLensPartialApply === true,
+                        participantIds: [observedReadGuardCorrelationId],
+                        participantTotal: 1,
+                        toolResultStart,
+                        nativeAppliedPairs: observedAppliedPairs,
+                        // #2802 authorship rule (master): the observational
+                        // settle already recorded this edit through the
+                        // bridge, so the dispatch's read-guard write refresh
+                        // carries evidence and stays enabled on every
+                        // per-path dispatch.
+                        allowReadGuardWrites: true,
+                    }), {
+                        ms: HOOK_WALL_BUDGET_MS.tool_result_edit,
+                        signal: observedDispatchSignal,
+                        hook: "tool_result_edit",
+                        label: "observed-tool-result-analysis",
+                    });
+                    if (observedDispatchOutcome?.crashed) {
+                        // #2464 review round 2, S6: parity with the classified chain — a
+                        // pipeline crash surfaces its notice to the agent instead of being
+                        // swallowed into a dbg line the model never sees. The recorded
+                        // edit stands either way; only the analysis was lost.
+                        dbg(`tool_result: pipeline analysis crashed for the observed mutation on ${observedPath}; the recorded edit stands, analysis did not run this turn`);
+                        return observedDispatchOutcome.response;
                     }
-                    // Same terminal value as the block's own exit below: the bridge
-                    // already recorded this edit, and the analysis it would have asked
-                    // for is either running or already done.
-                    return syntheticWriteContent.length > 0
-                        ? { content: [...event.content, ...syntheticWriteContent] }
-                        : undefined;
-                }
-                const observedDispatchOutcome = await dispatchPipelineAnalysis({
-                    deps,
-                    runtime,
-                    filePath,
-                    dispatchCwd: resolveLanguageRootForFile(filePath, workspaceRoot),
-                    turnStateCwd: path.resolve(workspaceRoot),
-                    autofixMode: observedAutofixMode,
-                    // #2423: no adapter/diff ranges exist for a "learned" (unnamed)
-                    // tool — the classified chain below hits the same gap for this
-                    // provenance and also leaves `modifiedRanges` undefined, so the
-                    // dispatch runs unscoped (whole-file) exactly as it would there.
-                    modifiedRanges: undefined,
-                    writeIndex: runtime.nextWriteIndex(),
-                    initialStateHash: observedStateHash,
-                    readGuardCorrelationId: observedReadGuardCorrelationId,
-                    requestedEditIndexes: getRequestedEditIndexes(event, observedKind),
-                    requestedEditTotal: getRequestedEditCount(event, observedKind),
-                    isPartialApplyResult: (event.details ?? {})
-                        .piLensPartialApply === true,
-                    participantIds: [observedReadGuardCorrelationId],
-                    participantTotal: 1,
-                    toolResultStart,
-                    nativeAppliedPairs: observedAppliedPairs,
-                });
-                if (observedDispatchOutcome.crashed) {
-                    // #2464 review round 2, S6: parity with the classified chain — a
-                    // pipeline crash surfaces its notice to the agent instead of being
-                    // swallowed into a dbg line the model never sees. The recorded
-                    // edit stands either way; only the analysis was lost.
-                    dbg(`tool_result: pipeline analysis crashed for the observed mutation on ${filePath}; the recorded edit stands, analysis did not run this turn`);
-                    return observedDispatchOutcome.response;
                 }
                 dbg(`tool_result: the observational settle already recorded ${observedReplayed} mutation(s) for "${event.toolName}"; kept the applied-edit records, mutation receipt, cachedExports refresh, and ran the pipeline dispatch (#2464); skipped the bridge-covered staleness stamp / turn-state ranges / change-log receipt / deferred autofix+format`);
             }
             else {
-                dbg(`tool_result: the observational settle recorded ${observedReplayed} mutation(s) for "${event.toolName}", none of them ${filePath} — nothing to analyse under the named path`);
+                dbg(`tool_result: the observational settle recorded ${observedReplayed} mutation(s) for "${event.toolName}", but no dispatchable changed paths remained`);
             }
         }
         return syntheticWriteContent.length > 0
@@ -1379,7 +1606,8 @@ export async function handleToolResult(deps) {
     }
     // Refresh the read-guard's FileTime stamp so that the model's own write
     // doesn't trigger a spurious "file_modified" block on the next edit.
-    deps.readGuard?.recordWritten(filePath);
+    if (bashAuthorshipConfirmed)
+        deps.readGuard?.recordWritten(filePath);
     // Keep cachedExports in sync after each write/edit so the pre-write STOP
     // check doesn't fire on names that were removed from this file this session.
     refreshCachedExports(runtime, filePath);
@@ -1411,7 +1639,7 @@ export async function handleToolResult(deps) {
     // tool_result is emitted after write/edit has already been applied.
     // Asserting pre-write stamps here produces false positives on rapid edits.
     sessionFileTime.read(filePath);
-    if (!getFlag("no-read-guard")) {
+    if (!getFlag("no-read-guard") && bashAuthorshipConfirmed) {
         const readGuard = runtime.readGuard;
         readGuard?.recordWritten?.(filePath);
     }
@@ -1532,7 +1760,16 @@ export async function handleToolResult(deps) {
     // (defined above `handleToolResult`), shared with the observed-mutation
     // early return. This call site is otherwise unchanged — same arguments, same
     // crash-then-return / success-then-continue shape as before the split.
-    const dispatchOutcome = await dispatchPipelineAnalysis({
+    const classifiedClients = ensureToolResultClients(deps);
+    if (classifiedClients !== true &&
+        !(await bounded(Promise.resolve(classifiedClients), {
+            ms: HOOK_WALL_BUDGET_MS.tool_result_edit,
+            signal: deps.signal,
+            hook: "tool_result_edit",
+            label: "classified-tool-result-analysis",
+        })))
+        return;
+    const dispatchOutcome = await bounded(dispatchPipelineAnalysis({
         deps,
         runtime,
         filePath,
@@ -1550,7 +1787,15 @@ export async function handleToolResult(deps) {
         participantTotal,
         toolResultStart,
         nativeAppliedPairs,
+        allowReadGuardWrites: bashAuthorshipConfirmed,
+    }), {
+        ms: HOOK_WALL_BUDGET_MS.tool_result_edit,
+        signal: deps.signal || undefined,
+        hook: "tool_result_edit",
+        label: "pipeline-analysis",
     });
+    if (!dispatchOutcome)
+        return;
     if (dispatchOutcome.crashed) {
         return dispatchOutcome.response;
     }
@@ -1684,7 +1929,7 @@ export async function handleToolResult(deps) {
         // #1561: stamp the verdict with THIS dispatch's write token — the same
         // counter `lsp_diagnostics`' reconciliation seam draws from — so a later
         // confirmed-clean result can be ordered against it instead of racing it.
-        runtime.recordInlineBlockers(filePath, result.inlineBlockerSummary, writeIndex, result.inlineBlockerSources, result.inlineBlockerLines);
+        runtime.recordInlineBlockers(filePath, result.inlineBlockerSummary, writeIndex, result.inlineBlockerSources, result.inlineBlockerLines, result.inlineBlockerFileContent);
     }
     else {
         runtime.clearInlineBlockers(filePath);