@herbertgao/pi-extensions 2026.9.6 → 2026.9.8

package/node_modules/grok-mermaid/src/width.ts

@@ -0,0 +1,74 @@
+import { WIDTHS } from './width-data.ts'
+
+/**
+ * Display width, measured in grapheme clusters.
+ *
+ * A cluster is the unit both of measuring and of painting, so a box is always
+ * sized for exactly what gets drawn into it. Splitting those two — sizing by
+ * cluster but painting by code point — is what makes `👨‍👩‍👧` overflow its
+ * border in the Rust original.
+ *
+ * Clustering comes from `Intl.Segmenter` (UAX #29), which already handles ZWJ
+ * sequences, skin-tone modifiers, variation selectors, keycaps, flags and
+ * Hangul. Per-code-point widths are generated from the `unicode-width` crate.
+ */
+
+const segmenter = new Intl.Segmenter('en', { granularity: 'grapheme' })
+
+const VS16 = 0xfe0f
+const isRegionalIndicator = (cp: number): boolean => cp >= 0x1f1e6 && cp <= 0x1f1ff
+
+/** Width of one code point; the table covers the whole code point space. */
+function codePointWidth(cp: number): number {
+  let lo = 0
+  let hi = WIDTHS.length - 1
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1
+    const run = WIDTHS[mid]
+    if (cp < run[0]) hi = mid - 1
+    else if (cp > run[1]) lo = mid + 1
+    else return run[2]
+  }
+  return 1
+}
+
+/**
+ * Columns occupied by one grapheme cluster.
+ *
+ * The widest code point wins, so a base plus its combining marks measures as
+ * the base. Two adjustments: a variation selector requesting emoji
+ * presentation forces two columns, as does a regional indicator pair (a flag).
+ *
+ * Zero is a real answer — a soft hyphen or zero-width space occupies nothing,
+ * and callers skip painting such a cluster rather than reserving a cell.
+ */
+export function clusterWidth(cluster: string): number {
+  let w = 0
+  let vs16 = false
+  let regional = 0
+  for (const ch of cluster) {
+    const cp = ch.codePointAt(0) as number
+    if (cp === VS16) vs16 = true
+    if (isRegionalIndicator(cp)) regional++
+    const cw = codePointWidth(cp)
+    if (cw > w) w = cw
+  }
+  return vs16 || regional >= 2 ? 2 : w
+}
+
+/** Iterate grapheme clusters, so no loop can split one. */
+export function* clusters(s: string): Generator<string> {
+  for (const { segment } of segmenter.segment(s)) yield segment
+}
+
+/** Iterate clusters paired with their display width. */
+export function* measured(s: string): Generator<[string, number]> {
+  for (const { segment } of segmenter.segment(s)) yield [segment, clusterWidth(segment)]
+}
+
+/** Display columns of a string. */
+export function stringWidth(s: string): number {
+  let w = 0
+  for (const { segment } of segmenter.segment(s)) w += clusterWidth(segment)
+  return w
+}

package/node_modules/pi-lens/CHANGELOG.md

@@ -16,6 +16,245 @@ All notable changes to pi-lens will be documented in this file.
 
 ### Security
 
+## [4.2.0] - 2026-09-16
+
+### Added
+
+- **Add Typst language support (refs #3037)** — Tinymist provides LSP diagnostics and typstyle provides formatting for `.typ` and `.typc`, with managed GitHub-release installation for both tools.
+
+- **Opt-in compact LSP status line (`ui.compactLspStatus`, `--lens-compact-lsp-status`) (refs #3099)** — the `pi-lens-lsp` footer status can now render one state glyph per group (`LSP ✓` green, `LSP ✗` red, dim `LSP ✗` when nothing is warm) instead of the active server names (#267). Default off: the published string is byte-identical when the flag is unset. Server ids stay reachable through `/lens-tools` and `lens_health`.
+
+- **Opt-in off mode for the LSP status line (`ui.hideLspStatus`, `--lens-hide-lsp-status`) (closes #3099)** — the `pi-lens-lsp` footer status can now be suppressed entirely: `updateLspStatus` publishes `undefined` instead of any text, so a host that renders extension statuses stops showing the key at all. Outranks `ui.compactLspStatus` when both are set (nothing to render compactly once the key itself is gone). Default off: unset, the published string is unchanged. Server ids stay reachable through `/lens-tools` and `lens_health`.
+
+- **Allow an explicit analysis root below the home ceiling (closes #2053)** — `lens_diagnostics mode=full` can run heavyweight analyzers for a named, existing project directory when the session cwd is `$HOME` or higher, while retaining the #749 refusal for unsafe roots.
+
+- **Detect tests that drive the registry against the run-shared `PI_LENS_HOME` (refs #3042, #3050)** — `tests/clients/pi-lens-home-hermeticity.test.ts` now walks `clients/` for best-effort-locked `getGlobalPiLensDir()` writers and `tests/` for files that call one of their hazardous exports (or reach a producer's target file directly) without pinning their own home or mocking the writer away; it caught `tests/clients/instance-reaper-backstop.test.ts` racing the shared `orphan-backstop.json`/`.lock` on a stale per-worker-isolation assumption, fixed in the same change.
+
+- **Opt Typst (tinymist) into the nightly LSP clean-gate (refs #3037, #3164)** — `tests/fixtures/tool-smoke/typst/main.typ` now carries a deliberate `#undefined_function(answer)` call and the `typst` `LSP_FIXTURES` entry in `scripts/smoke-tools.mjs` sets `lspGate: true` with `lspGateMarker: "#undefined_function"`, following the typescript entry's shape; `--lsp-gate typst` now proves tinymist surfaces a real primary diagnostic instead of only handshaking, and `tests/scripts/smoke-tools-lsp-gate-fixtures.test.ts` was updated for the seven-fixture gated population.
+
+### Changed
+
+- **Auto-rerun the second infra kill on one head, and sweep master-only workflow lanes (refs #2042, #3043)** — the infra-kill rerun lane now classifies attempts 1 and 2 (`run_attempt <= 2`) and keys its once-per-head rerun guard on sha *and* run attempt with a two-rerun cap, so a runner that 137-kills the same head twice no longer needs a hand-pressed attempt 3; `finalize-rerun` moves to the terminal attempt. A new registered-or-fail sweep over every `.github/workflows/*.yml` fails any job whose `if:` no pull_request context can satisfy unless it is registered with a reason, and `install-smoke`'s `smoke` and `mise-repro` each gain one pull_request cell instead of their master-only gate.
+
+- **Record per-cgroup memory/PID/PSI samples and a 200ms watch cadence in CI (refs #2042)** — the Unit-tests job now writes a bounded on-disk tail of `memory.current`/`memory.peak`/`pids.current` and PSI stall totals every 200ms, read back by an `if: always()` step so a killed run still yields its last ~60s of samples; the `Runner capacity` step now resolves its own cgroup for `memory.max` instead of the unpopulated root.
+
+- **Clarify merge-time defect-shape catalog allocation and add two contract screens (refs #2996)** — Keep concurrent documentation lanes from creating invalid numbered-list gaps, and record retry-list and fallback-direction failure shapes for future reviews.
+
+- **Merge-train and reviewer contracts gain five rules from the 2026-09-12 train (refs #2996)** — catalog numbers are reserved at dispatch instead of discovered at write time; `action_required` on a fork PR is distinguished from an absent check; advisory rows are read before merge even though they never gate; a verify probes the inverted direction whenever a round retunes a threshold or tier; and a clean local run is recorded as "did not reproduce", not "fixed", when a deferred producer or another worker is involved.
+
+- **External reports are assessed against the code and their load-bearing questions answered before dispatch (refs #3001)** — AGENTS.md's issue-triage rule now requires verifying a report's claims in the source, asking the facts that would change the design, not dispatching work that depends on an unanswered one, mirroring the answer on the issue so a worker can verify it, and citing the reporter's reasoning as authority rather than paraphrasing it.
+
+- **Deny `TMPDIR=.probe-home` in the Bash guard hook and forbid raw commit-ish Git spawns under `tests/` (refs #3026, #3050)** — `scripts/hooks/guard-bash.mjs` gains a fifth deny rule (`tmpdirCollision`) that rejects a `TMPDIR`/`TMP`/`TEMP` assignment aimed at the vitest harness's own `PI_LENS_HOME`, the mistake that produced a false "16 suites red on origin/master" report; `tests/config/git-fixture-governance.test.ts` gains a row that fails any `tests/` Git spawn naming a commit from this repository's history, which CI's depth-1 checkout cannot reach.
+
+- **Skip unchanged PR-body lint on synchronize (refs #3030)** — the advisory PR-body validator now runs on body-relevant pull-request events instead of every source-code update.
+
+- **Fold the ast-grep catalog source-walk onto one effective-catalog helper (refs #3053)** — The NAPI runner and the LSP-seam rule-ignore matcher now both read `buildEffectiveAstGrepCatalog`, replacing two independent copies of the same source-walk and precedence resolution that had already drifted once (#3046).
+
+- **Fold the tree-sitter query loader onto `js-yaml` (refs #3054)** — replace the hand-rolled line-regex YAML scanner in `clients/tree-sitter-query-loader.ts` with `yaml.load`, the same real parser `clients/dispatch/runners/yaml-rule-parser.ts` already uses for ast-grep rules, removing the duplicated inline-array/multi-line-list/nested-object branches that caused #3046's `ignore_paths` quoting bug.
+
+- **Cut the two heaviest test files' peak memory by 8.4 GB and gate the budget (refs #3058)** — `bounded-container-guard` re-parsed and re-walked each source up to six times per container occurrence (9,207 → 812 MB peak RSS) and the `vi.mock` export detector re-parsed production modules once per call site (5,646 → 1,800 MB); the `[mem-file]` hook now fails any file that exceeds `WORKER_PEAK_RSS_BUDGET_MB` without a measured admission.
+
+- **Enforce the DegradationKind union against every emitted kind (refs #3071)** — a new governance sweep (`tests/config/degradation-kind-coverage.test.ts`) scans every `recordDegradationOnce` / `incrementDegradationCount` / `logDurableDegradation` call site for its `kind:` literal and fails if it is not a declared `DegradationKind` union member; `clients/degradation-ledger.ts` now declares the 15 kinds that were emitted in production without a union member (`actionable-warnings-cap`, `gitleaks_classification_timeout`, `gradle-ktlint-scan-budget-exceeded`, `instance-registry-identity-fallback`, `instance-registry-lock-timeout`, `instance-registry-registration-missing`, `lsp-document-drift`, `lsp-probe-finding-policy`, `managed-tool-install`, `pipeline-post-write-hash-unavailable`, `review-graph-memory-cap`, `review-graph-memory-cap-floor`, `sgconfig-baseline-cap-evict`, `test-runner-batch-capped`, `tree-sitter-query-parse-failed`).
+
+- **Bound the Unit tests job with `timeout-minutes` (refs #3111)** — `test` (Unit tests) in `.github/workflows/ci.yml` carried no `timeout-minutes`, so a reader that is alive but never drains (e.g. an unbounded stdout stall in the mem-watch wrapper, #3106) could hold the runner for GitHub's 360-minute default; the job now caps at 26 minutes, sized at 2x the measured longest Unit run (12m42s) across 9 successful master runs.
+
+- **Bound every remaining workflow job with a measured `timeout-minutes` (refs #3111, closes #3123)** — the ~50 jobs across 18 workflow files left unbounded by #3111's `test` (Unit tests) fix now each carry a `timeout-minutes` sized from the job's own measured history (last 10 successful runs, `~2x max + margin`, floored at 10 minutes), so a stalled-but-alive job can no longer hold a runner for GitHub's 360-minute default; a job with no successful run in the search window (a `pull_request`/`repository_dispatch`-gated job that the master-branch sample structurally excludes, or one that has never once succeeded) gets a stated default with the reason recorded in a YAML comment above the line.
+
+- **Close two gaps in the DegradationKind coverage sweep (refs #3071, #3138, closes #3140)** — `clients/degradation-ledger.ts` now declares `process-singleton-reset` (live at `getDegradationSummary()`'s read-time fold since #2146, previously undeclared); `tests/config/degradation-kind-coverage.test.ts` now also walks that same read-time fold's own `summary.push({ kind: ... })` emitters in `degradation-ledger.ts`, and resolves a bare-identifier `kind:` value (`TRUST_REFUSAL_KIND` at `clients/config-core/process-spec.ts`) against a same-file `const` binding rather than silently returning `[]` — an identifier the scan still cannot resolve now fails loud as `"<file>:<line> kind: <identifier> is unresolvable"` unless the site is named in the new `AUDITED_IDENTIFIER_KIND_SITES` list.
+
+- **Check PR-body claims with Markdown-aware sentence units (refs #2904)** — Block-level Markdown and bounded source evidence keep citations and master-red claims tied to the text they describe.
+
+- **Verify PR-body code citations (refs #2904)** — Check cited source lines, offered evidence, lexer-derived test identifiers, and master-red transcripts against the head tree. Reject backwards citation ranges before source resolution, keep valid-table master claims outside transcript checks, shield regex literals at every expression-start boundary, reuse only immutable HEAD-tree corpora within a bounded cache, and rebuild working-tree corpora so mutable trees cannot launder removed or fabricated titles.
+
+- **Recognise PR test references by shape and placement (refs #2904)** — Test IDs, test paths, citations, and titles are checked only where their Markdown placement identifies them as test evidence. Malformed pipe blocks remain visible Markdown, while valid tables retain column-specific filtering. Local body lint tolerates shallow or single-commit histories by requiring Test assessment when changed-file scope is unavailable.
+
+- **Keep PR-body fixture setup in process (refs #3016)** — short-ID coverage uses the existing Git callback seam without adding real child processes to the checker test.
+
+- **Contracts from the 2026-09-10 merge train.** AGENTS.md catalog shapes 46 (a parser fed by a double whose shape the tool never emits), 47 (a detector whose corpus includes its own fixtures), 48 (check-then-act on a shared durable directory) and test screen 13 (a detector pinned only in the accept direction); the fixer contract adds "authority words are claims", "facts about master come from a fetched origin/master", "never assert CI", "a detector test has two directions", "tool output is a fixture, not a guess"; the merge-train skill adds five mistake rows (design question left to the fixer; guessed branch names; the ignored-path exclude in `git add`; `ci-verdict` exit 70 on API outages; a registry-membership guard changing other lanes' requirements). (refs #2900, #2913, #2921, #2924, #2929, #2930)
+
+- **Retro 2026-09-15 outputs**: eleven mistake rows in the merge-train skill, a reviewer rule for net-count folds, a routing rule for governance-sweep briefs, and five steering lines deleted from the role contracts and `AGENTS.md` because they had an occasion this session and changed no decision (record in `HISTORY.md`).
+
+- **Retrospective contract**: `docs/pi-lens-retro.md` and the `retro` skill turn a session, an incident, or a merged bug fix into environment changes — checks with a red transcript for mechanical mistakes, one contract line for judgement calls, deletion for steering lines that changed no decision — and `AGENTS.md` names the triggers.
+
+- **Keep incomplete observation evidence separate from mutation attribution (refs #2984)** — hashless observational captures, including size-only changes, remain visible as unverifiable and never enter mutation replay, attribution, or the clean-observation latch.
+
+- Pin the availability gate's three known text-anchoring blind spots.
+
+### Removed
+
+- **`decideClassifierAction` in `ci-failure-classifier.mjs` (refs #3086)** — a pure duplicate of `runClassifier`'s carry-forward rule (rerun eligibility, `rerunState`, which run attempt a carried-forward marker belongs to) with no production caller; #3079 had needed a twin test case to keep both writers honest after a mutation on `runClassifier`'s copy alone stayed green. `runClassifier` is now the sole writer of the rule, and its existing test covers the mutation on its own.
+
+### Fixed
+
+- **Never signal a pid pi-lens does not own (refs #2042)** — `safeSpawnAsync` verified nothing before putting a child's pid into the process-wide lifetime registry, so a `node:child_process` test double's invented pid (`2468`) was registered, never removed, and SIGKILLed at host exit; on ~10 % of CI runners that pid belonged to the job itself, which is where the unexplained exit-137 "infra kills" came from. One ownership predicate (`isOwnLiveChild`) now gates registration, the timeout process-group kill, and the LSP POSIX/Windows tree kills — folding away three sibling sign/exited guards — reading `/proc/<pid>/status` on Linux and requiring `PPid` to be this process; a live pid under another parent is refused and recorded once per call site in the degradation ledger.
+
+- **Bind cached project findings to the bytes they were scanned from (refs #2154)** — a cheap-tier finding whose file changed while the scan was running used to be served as a current blocking error in every later session; rows now carry the size and hash of the content the rules read, so a second session sees the finding retired instead.
+
+- **Keep advisory tool names host-aware (refs #2535)** — Agent-facing diagnostics and guidance use callable pi or MCP tool names, including generated-skip and quick-mode notices.
+
+- **Add explicit fake LSP pull/push ordering controls (refs #2824)** — LSP tests can drive push ordering, document versions, pull outcomes, and completion through the real fixture wire.
+
+- **Scope project-diagnostics runner retirement by analyzed file coverage (refs #2887)** — opengrep findings retire only when the retained file appears in its reported `paths.scanned` set; other runners keep the conservative runner-id fallback.
+
+- **Isolate registry consumers and restore probe-home state (refs #2912)** — prevent later tests from inheriting the #2992 probe registry and keep PID-scoped root assertions independent of worker history.
+
+- **Drain and track lens-map fixtures (refs #2912)** — route lens-map temporary roots through the shared environment registry so deferred graph writes cannot recreate an untracked `/tmp` root after teardown.
+
+- **Handle PEP 668 pip hosts (closes #2916)** — pip-backed tools use pipx, a pi-lens-owned venv, or a private user base before falling back to a normal user install.
+
+- **Complete slice-2 session guard cleanup (refs #2939)** — tool-result edit classification uses one predicate, and stale-handler crash forwarding no longer carries dead options.
+
+- **Guard long-lived containers against unbounded growth (refs #2981, refs #2988)** — add an AST-backed registered-or-fail inventory with nested-root coverage, content-keyed exemptions, and honest key-axis classification.
+
+- **Keep bridge bookkeeping alive across session transitions (closes #2992)** — stale extension contexts no longer make read or mutation bridge flag checks throw or drop their records.
+
+- **Discover monorepo-root ESLint and Oxlint configs across nested `package.json` boundaries (refs #3017)** — flat `eslint.config.{js,mjs,cjs,ts,mts,cts}` files and Oxlint configs now resolve from every ancestor directory like the tools themselves, so the jsts lint lane defers Biome with the machine-readable `configured-non-biome-linter` skip reason instead of running the smart default; legacy `.eslintrc.*` and `package.json#eslintConfig` keep per-package semantics.
+
+- **Install managed archive tools with format-aware extraction (refs #3020)** — ZIP-based clangd and PowerShell bundles, plus platform-varying Lua archives, now use the matching extractor while failed replacements preserve the installed tree.
+
+- **Make the formatter's no-config indentation fallback stable (refs #3038)** — infer the unit from structural lines only (block-comment interiors are alignment, not nesting), decline ambiguous nested-only evidence, and honor ancestor `.editorconfig` files, so repeated formatting neither amplifies nor shrinks a file's indentation.
+
+- **Honor a rule's own `ignores` paths over LSP (refs #3041)** — `lens_diagnostics` with `source: "lsp"` or `mode: "full"` no longer re-surfaces ast-grep findings on paths the rule's own YAML carves out, and a stored disposition now matches an auxiliary finding in `mode: "full"`.
+
+- Fixed `tests/index-vanished-instance-wiring.test.ts` reddening in the CI Unit
+  lane on unrelated pull-request heads. The test drove the run-shared
+  `PI_LENS_HOME` registry, so the reaper's best-effort prune had to win a 500 ms
+  `withInstanceRegistryLock` deadline against every other concurrently running
+  test file; losing it is silent, left the seeded dead-pid entry in place, and
+  leaked it into the next case. Each case now runs against its own
+  `PI_LENS_HOME` (refs #3042).
+
+- **Stop indent-retarget from basing deeper nesting on a block comment's alignment (closes #3052)** — the edit-tool indentation-mismatch autopatch no longer picks its extrapolation base unit from a JSDoc/block-comment continuation line; it now excludes comment interiors from that pick with the same lexer `indent-detect.ts` uses (#3039), so a comment's alignment ratio can no longer silently mis-scale a deeper-nested replacement. A comment-interior indent still resolves by direct lookup when a replacement reintroduces it.
+
+- **Exclude template-literal interiors from the formatter's indentation fallback (closes #3059)** — a multi-line template literal's interior lines (a help-text string, say) were still counted as indentation evidence after #3039 excluded block-comment interiors for the same alignment-not-nesting shape, so a 4-space file whose template literal happened to be 2-space indented got re-indented to 2 on its first format. `indent-detect.ts` now excludes template interiors with the same lexical discipline as the block-comment rule, tracking `${ … }` nesting and escaped backticks so neither closes the tracked template early.
+
+- **Re-arm the tree-sitter query parse-failure record every session (refs #3070)** — `TreeSitterQueryLoader.loadQueries` short-circuited on its `loaded`/`loadedRoot` memo before re-parsing, so a broken custom rule's `tree-sitter-query-parse-failed` degradation record only ever reached the first session that parsed it; the shared loader instance is deliberately kept across sessions, so every later session's `resetDegradationLedger()` silently dropped the row to zero. Per-file parse failures are now remembered and replayed once per ledger generation on a memoized reload, and cleared whenever a rule is actually re-parsed so a fix on disk stops replaying a stale failure. Also adds regression coverage for the existing `str()` guard against a mapping-valued `message` field, which had none.
+
+- **Governance sweeps no longer race a scratch test file written into `tests/` (closes #3082, closes #3092)** — the `#3050` registry-isolation detector's red-first proof wrote a real `tests/scratch-3050-pre-3048-vanished-wiring.test.ts` into the repo's own test tree for the length of one assertion, so any sibling sweep that was mid-enumeration died with `ENOENT` on a file that exists on no branch (`sweep-floor-coverage`, `vacuous-skip-coverage`, `latency-logger-mock-shape` and `lsp-spawn-heavy-coverage` took the hit on rotating runs). The proof now walks a private `mkdtemp` root through the same walker and options; every walk-then-read over the `tests/` tree goes through sweep-kit's new `readWalkedFile`, which drops a path that vanished between the walk and the read, records it once, and never counts it as a finding; and a recursive-watch guard installed from `globalSetup` (once per activated Vitest project, not per test-file fork) fails the run, naming the path, if any test creates a source file inside `tests/` again.
+
+- **Isolate test orphan-backstop state (refs #3083)** — pin the backstop lock and cooldown stamp once in the test harness so real session-start timers cannot contaminate the run-shared home, while preserving explicit test homes and production machine-wide coordination.
+
+- **`lens_diagnostics source=lsp` honors your marks, rule policy and inline ignores (closes #3088, closes #3041, refs #3047)** — the probe lane behind `source: "lsp"`, the legacy `lsp_diagnostics` tool and the MCP `pilens_lsp_diagnostics` shim returned raw LSP findings with no stored-disposition filter, no `.pi-lens.json` `rules.<id>.disable`/`select` policy and no inline `pi-lens-ignore` suppression, while `mode=delta` and `mode=full` applied all three — so a finding an agent marked `false-positive` was hidden everywhere except the lane `skills/pi-lens-lsp-navigation` steers agents to as PRIMARY, and the probe's footer reconcile then overwrote the mark-time demotion on every check. `mode=full`'s three open-coded filter calls are folded onto one shared `clients/dispatch/finding-policy.ts` stack that the probe lane now calls once per file, for the rendered text, the counts and the widget footer alike. A mark converges whichever surface it was made from (the probe renders `[source] (code)` where the footer renders the canonical `tool`/`rule`), a `blocking` finding still drops only on a strict content-bound match, cache replays filter exactly like fresh probes, and every drop is stated as a `suppressed by disposition: N` count instead of reading as clean.
+
+- **Drain stdin to EOF in the guard-bash PreToolUse hook instead of a single `readFileSync(0)` (#3089)** — `spawnSync`'s own `input` pump sets the child's stdin pipe non-blocking, so a `read(2)` issued before the next chunk lands can throw `EAGAIN`; `readFileSync(0, "utf8")` does not retry that, the throw was swallowed as "no payload", and the hook failed OPEN (exit 0) on a command — like `git stash` — it would otherwise have denied, measured reproducible from ~500 KB of JSON payload. `readStdin` now loops `fs.readSync` into a buffer list, retrying `EAGAIN` with an `Atomics.wait` park (the same mechanism `scripts/with-memory-watch.mjs` uses on its write side) and stopping only on a true EOF (`bytesRead === 0`); a read error or a genuinely empty stream is still "no payload".
+
+- **`with-memory-watch` survives a full stdout pipe instead of dying on it (closes #3097)** — the wrapper writes every record with `fs.writeSync` so `process.exit` cannot discard it, but fd 1 is not reliably blocking: `stdio: "inherit"` shares one open file description with the wrapped command, and libuv sets `O_NONBLOCK` on it as soon as that child initialises its own `process.stdout` on a pipe. A sampler tick that landed while a slow log reader held the 64 KB pipe full then threw `EAGAIN` out of the `setInterval` callback with nothing to catch it, and the wrapper exited 1 under exactly the backpressure it exists to survive (CI run 35067086859). `emit` now retries on `EAGAIN`, parking 5 ms per attempt, which is what a blocking write would have done; any other write error is permanent, so it is recorded once on stderr and the child's exit code is still forwarded.
+
+- **A mis-cased path and a normalized read now share one anchor on POSIX (refs #3098, refs #3090)** — `normalizeFilePath` canonicalized casing only on Windows, so on a case-insensitive POSIX filesystem (macOS APFS, `nocase` vfat/ntfs3/cifs) a raw mis-cased `lens_diagnostic_mark` write and the dispatcher's `normalizeMapKey` read derived two anchors for one file and the agent's own false-positive/flagged mark silently never applied — the #1024 defect, live on every macOS install. The POSIX arm now adopts the on-disk casing `realpath(3)` reports for the trailing segments of an existing path, stopping at the first segment that differs by more than case, so casing is fixed while a symlinked prefix (macOS's `/var/folders` tmpdir, a symlinked monorepo package) is still never resolved; a path that does not exist stays case-preserving, because on a case-sensitive filesystem `SUB/a.ts` and `sub/a.ts` are two different files. A rewrite is adopted only once the filesystem confirms it still names the file the caller held, so a symlink whose name is a case variant of its target's (`node_modules/Foo` → `../pkgs/foo`) keeps its own spelling rather than keying under a sibling — or under nothing. The #1024 regression test now runs unskipped on the Linux CI lane instead of skipping there and failing on macOS.
+
+- **The turn-end late-auxiliary advisory and the cold-neighbour cascade run honor a disposition mark (#3102)** — both rendered LSP findings straight to the agent with no stored-disposition filter, no `.pi-lens.json` `rules.<id>.disable`/`select` policy and no inline `pi-lens-ignore`, so a finding marked `false-positive` came back on every turn that drained a late auxiliary pair and on every quiet-window cascade reconcile. Both now take the same `clients/dispatch/finding-policy.ts` stack the per-edit dispatcher, `mode=full` and the `source=lsp` probe lane apply, after their own freshness gate and over the canonical identity (`convertLspDiagnostics` + `retagAuxiliaryDiagnostics`) every other surface anchors a mark against — so an auxiliary finding is filtered under its real tool id instead of a hardcoded `lsp`, and its own native `# nosemgrep`-style suppression is honored here too. Each lane reads the cited file once per delivery, only when there is something to render; an unreadable file degrades to the content-free half rather than hiding a finding. Drops are counted in the `late_auxiliary_findings` and `cascade_finding_policy` latency records, and a delivery that still has findings states `suppressed by disposition: N finding(s)`.
+
+- **Vanished-file diagnostic reaches the run log on a passing suite (refs #3107)** — `tests/support/sweep-kit.ts`'s `readWalkedFile` and its `scripts/lib/win32-gate-population.mjs` twin recorded a walked file that vanished between list and read with `console.warn`, but Vitest's default reporter (every `npm test` script uses it) intercepts and can drop a worker's `console.warn` on a green run, so the record never actually reached CI's job log despite the docstring's claim that it does. Both sites now emit through a raw `process.stderr.write`, matching the same interception fix already documented at `tests/support/vitest-setup.ts`'s peak-RSS reporting. The `.mjs` twin's hand-rolled `Set` with `clear()`-on-overflow eviction — which its own parity comment falsely claimed was "identical" to the TypeScript seam — now shares the TypeScript seam's `BoundedSet` (oldest-first eviction), making the claim true.
+
+- **Reclaim stale `tmp-hygiene-baseline-<run>.json` files on the existing backstop stale arm (refs #3109, #2912, #3100)** — the #2912 hygiene owner writes one baseline record per run and only ever removed the one it wrote itself, so every owner-less (targeted) run in a persistent dev-box checkout left its own file behind for ever; `removeRunBackstopDirs` now reclaims a `tmp-hygiene-baseline-*` file older than the same six-hour `BACKSTOP_STALE_MS` window it already used for abandoned backstop directories and root-level `orphan-backstop*` residue, leaving the active run's own file untouched until the owner consumes it.
+
+- **Retry the mem-watch write-failure note through the same channel that retries every other line, with a bound of its own (closes #3110, closes #3115)** — `noteWriteFailureOnce` used to write its once-only stderr note with a raw, un-retried `fs.writeSync` in a bare catch, so a stdout that had died (EPIPE) alongside a stderr that was merely full (EAGAIN, a slow reader) dropped the note for good; it now goes through the wrapper's own retrying `emit()`, capped at 400ms for the note only (the verdict line keeps its unbounded retry) so a stderr that never drains at all degrades the note instead of hanging the wrapper and losing the wrapped command's exit code, when the wrapped command outlives the retry window (a command that exits inside it still blocks on the inherited fd; see #3141). `tests/scripts/with-memory-watch.test.ts`'s `runWrapper` helper also pins `PI_LENS_MEM_WATCH_SAMPLE_FILE` to a scratch path by default, so the file's cases stop leaking the wrapper's shared `pi-lens-mem-watch-samples.log` fallback into TMPDIR and redding `tmp-fixture-hygiene` in a shared batch.
+
+- **Nested agent-data trees no longer cost a project its startup scan, and a project-scope `tools.<name>.enabled` is no longer called invalid (fixes #3112)** — `.omp` (the same coding agent's rebranded config directory: pi derives its config-dir name as `pkg.piConfig?.configDir || ".pi"`, so `.omp/agent/sessions` is the history `.pi/agent/sessions` holds) joins the shared scan-exclusion list, so a project-local session history is no longer walked entry-by-entry against the startup entry budget — a small source tree beside one came back `too-many-entries` and never warmed its caches. Excluding it by NAME during recursion leaves a `.omp` directory chosen as the workspace root scanned as usual, and an ordinary oversized tree keeps its `too-many-entries`/`too-many-source-files` verdict. Separately, the project-config loader derived its accepted top-level keys from the flag registry alone, so the documented project-scope `tools.<name>.enabled` override was announced as `"tools" is a global-only pi-lens setting … ignored` (`PILENS_CFG_0001`) on every load; `tools` is now a recognized project section, and the one genuinely global key under it (`tools.lazy`, `--no-lazy-tools`) is still reported at project scope by a registry-derived mixed-scope sub-key scan rather than being dropped in silence.
+
+- **Stop indent-retarget from basing deeper nesting on a template literal's alignment (closes #3116)** — the edit-tool indentation-mismatch autopatch no longer picks its extrapolation base unit from a multi-line template literal's interior line; it now excludes template interiors from that pick with the same lexer `indent-detect.ts` uses (#3059), so a template literal's own alignment ratio can no longer silently mis-scale a deeper-nested replacement, the same way #3052 fixed the analogous block-comment case. A template-interior indent still resolves by direct lookup when a replacement reintroduces it.
+
+- **Recognise regex literals in the indentation template-lexer's conservative state (refs #3120)** — `advanceTemplateState` had no notion of a regex literal, so a backtick inside one (`` /`/ ``) opened a phantom template frame and a `/*` inside one (`` /[/*]/ ``) pushed a phantom block frame that never finds its closing `*/`; both silently disabled template-interior masking for the rest of the file. `/` is now recognised as a regex opener only in unambiguous grammar positions (after `(`, `,`, `=`, `:`, `[`, `!`, `&`, `|`, `?`, a `return`/`typeof`/`case` keyword, or line start — `{`, `}`, `;` were tried and dropped as vacuous, `}` additionally grammatically unsound) and skipped whole to a closing `/` that is itself followed by an unescaped `` ` ``-honouring, `[...]`-honouring scan and then zero or more regex flag letters and a non-identifier terminator — division stays division everywhere else, unchanged from before. A 25,553-file corpus re-run (own tree plus `node_modules`, every extension biome/prettier/ruff/shfmt format) shows zero files newly declined and no new `width 1` verdicts; the `decline` count falls from 7 to 4 and 9 files change verdict overall — 8 of those lose all surviving indentation evidence to now-correctly-recognised regex/template spans and fall through to the existing hardcoded default, and one in-tree file (`clients/ast-grep-client.ts`) is a genuine correction from a stray-regex-corrupted `space/2` to its real `space/4`.
+
+- **A global-only `actionableWarnings.autoFix.maxFixes` written in a project `.pi-lens.json` is no longer dropped in silence (fixes #3131)** — `#3112`'s mixed-scope sub-key scan derived its population from the flag registry alone (`LENS_FLAGS`, booleans only), so a global-only setting with no CLI flag counterpart — `actionableWarnings.autoFix.maxFixes`, documented global, read only through `getGlobalActionableWarningMaxFixes()` — was invisible to it even though its section (`actionableWarnings`) is recognized at project scope for its sibling `autoFix.enabled`. A new single-source registry, `GLOBAL_ONLY_NON_FLAG_KEYS` beside `LENS_FLAGS` in `clients/lens-flag-registry.ts`, names non-flag global-only dotted keys the same way the flag registry names flag ones; the scan now derives its full population from both, so a project file setting `maxFixes` gets the same one-time `PILENS_CFG_0001` global-only notice `tools.lazy` does, and the value still is not honored at project scope.
+
+- **The in-lane per-edit cascade block honors a disposition mark (#3157)** — the four sites that build the agent-facing cascade neighbour list in `clients/dispatch/integration.ts` (passive cold snapshot, fresh in-lane touch, touch-error fallback, degraded fallback) rendered raw language-server findings: no inline `pi-lens-ignore`, no stored disposition, no `.pi-lens.json` `rules.<id>.disable`/`select` policy, and no auxiliary re-tag. So a neighbour ERROR the agent had marked `false-positive` was hidden by `mode=delta`/`mode=full`/the per-edit dispatcher/the probe lane/the quiet-window cascade run (#3102) and still came back on every edit that cascaded to that neighbour. All four now route through one shared `applyCascadeDisplayPolicy` seam — the same `clients/dispatch/finding-policy.ts` stack over the canonical `convertLspDiagnostics` + `retagAuxiliaryDiagnostics` identity — which the quiet-window cascade run now shares too, so the two cascade lanes agree on auxiliary findings as well: both honor the profile's own native `# nosemgrep`-style suppression and `skipTestFiles` gate instead of one lane rendering what the other drops. The disposition store and the rule policy are read from the PROJECT root rather than the cascade's language root, so a mark still applies in a monorepo. The per-neighbour display cap now applies to the SURVIVORS rather than to the raw list, so a suppressed finding can no longer consume a display slot — before this, a neighbour whose first 20 errors were all marked rendered nothing at all while genuine unmarked errors sat below the cap. The neighbour is read once, and only when it actually has an ERROR to render (measured: 0.14 ms per delivering neighbour with no marks in the store, 1.3 ms with marks, worst case 4.7 ms at the bounded input of 80 findings, against the cascade's ~100 ms-per-neighbour walk budget); an unreadable neighbour degrades to the content-free half rather than hiding a finding. Drops are counted in one `cascade_finding_policy` latency row per cascade run, and a block that still has findings states `suppressed by disposition: N finding(s)`. When the per-neighbour policy input bound leaves findings unevaluated, the cascade block says so to the agent (`⚠️ Cascade did not evaluate N finding(s) … no findings does NOT mean clean here`) instead of rendering an empty block that reads as a clean verdict — a single `.pi-lens.json` rule disable over a neighbour with many findings of that rule was enough to reach it.
+
+- **A file created under a spelling the filesystem re-cases keeps its write record (refs #3163)** — the read guard announced a pending creation while the file was still absent and looked the announcement up after it landed, both times through `normalizeFilePath`, whose answer depends on that very existence. Any spelling whose key moved as the file appeared (on Windows every new file with an upper-case letter in its name; on POSIX a parent directory reached through a case-variant symlink) orphaned the announcement, so the synthetic creation read was never injected and the just-written file lost the outstanding-read protection that keeps it editable across an idle session. The announcement is now keyed by the existence-independent syntactic spelling the guard already uses for its post-delete index.
+
+- **The release workflow's publish toolchain is now exercised before a release (closes #2940)** — `release.yml`'s publish job runs npm through the version pinned in `package.json`'s `packageManager`; since the pin moved to `npx`, a bare `npm publish` silently used the runner's bundled npm, which has no OIDC trusted-publishing support, and the v4.1.6 release created its tag and GitHub release before the registry answered E404. The publish job now asserts the pinned npm's version in the step immediately before publishing, `prepare`'s dry-run publish goes through the same pinned invocation, a governance test reds on any bare `npm <verb>` in either job, and the release-QA matrix gained a `publish-toolchain-pinned` row that runs that toolchain against the candidate before a tag exists. The row treats npm's already-published response as a toolchain witness, records registry-unreachable failures as inconclusive, and reports the underlying npm cause instead of its log path. Round 3 records that the existing `npm()` and `pinnedNpm()` wrappers cannot be folded without changing `execFileSync` buffering: only the pinned wrapper sets `maxBuffer: 10 * 1024 * 1024` (refs #2963).
+
+- **PR-body test-reference check stops flagging commands, output, and prose (closes #3013)** — Recognise test references positively instead of treating every backticked phrase as one.
+
+- **Keep fork pull requests out of token-capped CI writes (closes #2993)** — stale verdict-label cleanup is advisory and skips fork heads; merged-PR close-keyword comments use the uncapped target trigger.
+
+- **Widget disposition reconciliation is admission-ordered (refs #1616)** — Marking a diagnostic disposition immediately reconciles the widget counts and retains suppressed findings as a visible bucket. Reconciliation now shares the same admission-ordered write tokens as dispatch, so a dispatch that was already in flight can no longer commit its pre-mark counts afterwards.
+
+- **Share explicit analysis-root validation across heavyweight diagnostics consumers (refs #2053).**
+
+- **Preserve the analysed file state across concurrent writes (refs #2499)** — The dispatch latch now records the state the pipeline actually analysed. The LSP batch pool preserves its abort contract: unstarted files do not add placeholder outcomes to aggregate diagnostics.
+
+- **Directory-target observed codemods are analysed over rewritten files (closes #2500)** — Dispatch same-turn pipeline analysis for the recorded files inside a directory, with a bounded fan-out and visible truncation counts.
+
+- **Measure stale async test-runner verdicts (refs #2542)** — delivered verdicts record their run and delivery file sequences, and the log analyzer reports known-verdict stale rates with unknown counts per session.
+
+- **Pin backstop assertions to their sweep row (closes #2669)** — Grace retries no longer make the orphan backstop regression test read metadata from a later sweep.
+
+- **Register only the read range the host delivered (refs #2802)** — Read-guard registration now uses the lines the host actually returned, including output-cap and EOF-clamped reads. A native read's provisional record is replaced by correlated tool-call identity rather than by position, so two reads of one file no longer leave the wider requested span behind and an unrelated search credit is never consumed. A delivered file that has disappeared no longer aborts the rest of the result chain, and an opaque write that leaves content identical no longer marks the file agent-authored. When bash observation evidence is unavailable, synthetic writes preserve authoritative content handling without granting read-guard authorship or edit permission.
+
+- **Keep CI verdict labels fresh across pushes (refs #2856)** — Clear verdict labels when a pull-request head changes, explicitly scope checkout-free `gh` calls to the repository, and ignore incidental exit-137 log text as test-failure evidence.
+
+- **Project data directory slug carries a path hash (closes #2874)** — Projects whose paths differ only in separator placement versus a hyphen no longer share one data directory; on first use after upgrade, the existing directory is renamed once so caches and session state carry over.
+
+- **Require a SQL sink signal for TypeScript SQL injection findings (closes #2909)** — Ignore unrelated child-process and task-runner template calls while retaining blocking diagnostics for imported database clients and SQL-leading templates.
+
+- **Marker-root freshness (refs #2922)** — Resolve the nearest marker with one synchronous walk per lookup, preserving visibility of nearer, created, and deleted markers without charging a redundant positive-cache rewalk.
+
+- **Unify test filename classification (refs #2928)** — Apply the shared classifier to runner skip gates and word-index relevance, including Go, PHP and Ruby test names. Preserve vendor penalties and fixture/mock skip rules; recognize direct children of `__tests__`. `isTestFile` (secrets scanner, dispatcher, tree-sitter runner, and the pass-through-wrappers/async-noise/placeholder-comments rule gates) now also applies file-role's directory policy — `/spec/`, `/specs/`, and a bare `test`/`tests`/`spec`/`specs` directory segment (`my-test/`, `integration-test/`, `e2e_tests/`), case-insensitively — which its own deleted arms never covered.
+
+- **Opengrep scan refusal reporting (closes #2943)** — Canonicalize symlinked workspace roots, preserve findings from partial-parsing warnings, classify every report and spawn failure once, and surface refused scans as cold diagnostics with machine-readable reasons. The outcome matrix now pins clean non-zero exits, every report discriminator, and the cached empty-coverage shape.
+
+- **Anchor the test-runner child on the module its command runs in (refs #2944)** — every runner's spawn-cwd markers must name one of the runner's own manifests or the launcher its command actually invokes; the contract is now derived and tested over the whole runner table, and the stale claim that Maven's `mvn` command anchors on its `mvnw` wrapper is corrected. The Maven anchor itself landed with the #2965 marker-seam fix.
+
+- **Keep side-effect autofixes out of target identity (refs #2957)** — Pipeline results no longer claim a post-write hash for the target when an autofix changed only another file.
+
+- **Harden backstop retry regression coverage (refs #2958)** — Seed prior latency rows and await the unref'd grace retry through a bounded completion seam.
+
+- **Keep findings when a partial scan has no coverage paths (refs #2962)** — a warning-level partial Opengrep report remains visible with an incomplete-coverage note and never retires retained findings as if it were a clean empty scan.
+
+- **Share language markers across runner cwd resolution (closes #2965, closes #2966, closes #2964)** — runner fallbacks use the language marker vocabulary, cwd resolution returns its anchoring marker, and one dispatch pass reuses only its `.git` fallback.
+
+- **Bound the spawn usage sampler's concurrency, rate and lifetime (refs #2968)** — a poll tick no longer starts while the previous one is still querying the process table, the interval backs off once a child outlives the short-lived window, and polling stops at a cap derived from the spawn's own deadline; on Windows this ends the `powershell.exe`/`taskkill.exe` pile-up behind a child that never exits, and skipped ticks and capped samplers are counted on the degradation ledger.
+
+- **Classify CUDA/HIP `.cuh` headers (refs #2986)** — Route community-standard `.cuh` headers through the C++ language, grammar, file kind, and clangd server projections.
+
+- **Decline ktlint autofix when project agreement is unavailable (refs #3000)** — when pi-lens cannot establish agreement with a Gradle- or Spotless-managed CLI, including convention plugins in `buildSrc` or included builds, it leaves the file unchanged and records one bounded session notice. The Gradle convention-plugin ownership walk stops at 10,000 directory entries; an exceeded scan is an indeterminate ownership result, declines before command resolution, and records one `gradle-ktlint-scan-budget-exceeded` notice per session.
+
+- **Require project tool agreement before autonomous writes (refs #3005)** — autofix, formatting, and deferred LSP quickfixes use one cached agreement seam and a complete declarative tool population. Node agreement follows each resolver's package identity, including markdownlint-cli2. Missing, unreadable, unparseable, and unsupported project evidence declines conservatively, with bounded degradation records. Lockfile evidence declines with distinct reasons when a version is unparseable or a legal shape is unsupported. LSP quickfix agreement preserves the diagnostic producer from `source`, falling back to `serverId`, while unsupported identities remain fail-closed.
+
+- **Confirm same-size all-LSP blocker rewrites (refs #3011)** — all-LSP blocker baselines now use content hashes even when a rewrite does not advance the recorded mtime.
+
+- **Adopt NDJSON rotation bounds across extension reloads (closes #3012)** — an older unbounded writer adopts incoming bounds during module-graph re-evaluation, while conflicting bounded policies retain first-writer ownership and emit one bounded health record.
+
+- **Compile against `@types/node` 26.5.1 (refs #3026)** — `node:perf_hooks` no longer exports the `IntervalHistogram` type, which broke `tsc` (TS2305) and with it every CI lane that builds. The event-loop monitor now infers the histogram type from `monitorEventLoopDelay`; emitted JavaScript and runtime behaviour are unchanged.
+
+- **Require chart topology for Helm YAML classification (refs #3034)** — YAML files under `templates/` remain ordinary YAML unless an ancestor contains `Chart.yaml`; explicit `.tpl` helpers retain their Helm classification.
+
+- **Stale inline blockers from non-LSP analyzers (closes #2982)** — The turn-end freshness sweep skipped every record whose provenance was not all-`lsp`, so a tree-sitter or ast-grep blocker was never checked against its own file. Combined with a retire path that can only claim coverage for registered language servers, such a record could not be cleared by any number of clean diagnostics runs and re-served every turn for the rest of the session. The sweep now checks the record's own file for any entry that carries provenance, keeping the forward-import walk for LSP-sourced records only; records with no recorded sources stay fail-closed. The check is confirmed against content at two tiers, size then a content hash, so a `touch`, a checkout restoring identical bytes, or a no-op formatter pass no longer demotes a finding while a same-length edit still does. It re-arms, so bytes that come back un-demote the record, and self-drift demotions sit outside the repeated-delivery cap that retires dependency-drift records, which keeps a security finding from being retired out of turn-end rendering. The content baseline is carried beside the inline-blocker evidence from the pipeline's existing file read and stamped synchronously with the record. All sweep filesystem work is bounded by the turn-end hook's own signal. Missing baselines and expired bounds emit bounded, file-identified ledger records, while aggregate hash-budget exhaustion stays sweep metadata. A demoted record still gates a commit, unchanged.
+
+- **Classify YAML files under Helm `templates/` directories as Helm templates** — pi-lens no longer sends raw Helm Go templates to the YAML language server, eliminating cascading false-positive YAML parse diagnostics while retaining Helm lint and render validation.
+
+- Put pnpm 11's resolved global bin directory (`$PNPM_HOME/bin`) on PATH in
+  install-smoke's pnpm setup, and run one `pi-load` pnpm-global cell on
+  pull requests so the lane cannot ship untested again.
+
+- Fix install-smoke's pnpm global-bin setup for pnpm 11 projects declaring npm by writing the setting globally in both pi-load and mise-repro.
+
+- Restrict install-smoke pull-request runs to the `master` base branch and
+  keep the parsed workflow contract aligned with that gate.
+
+- Fix per-hook tool-result budget classification, formatter attribution, and deferred-format delivery.
+
+- **Keep lifecycle hooks within per-hook wall budgets (refs #2523)** — bound aggregate formatter work and preserve unfinished diagnostics through off-hook delivery.
+
+- **Keep latency-logger test mocks faithful to production exports (refs #2281)** — latency-logger mocks preserve the real module surface, and a conformance sweep catches omitted exports.
+
+- **vi-mock export sweep reads `importOriginal<T>()` as a pass-through** (closes #2881) — a `vi.mock` factory spreading `await importOriginal<typeof import("…")>()` no longer reports every export as dropped; the parser also recognises `as`/`satisfies` casts, parenthesised spreads, and the two-statement `const actual = await importOriginal<T>()` binding as the same complete pass-through.
+
+- **Stop the /lens-perf occupancy guard flaking under CI contention (closes #2886)** — The wall-clock occupancy assertion moves into the serialized `wall-clock-budget` lane with the flake-shape ratchet's admission, and a deterministic yield-count assertion is added beside it: the count pins the parser's cadence, the lane keeps the real measurement honest.
+
+- **Keep deferred fixture roots tracked until their final drained cleanup pass (refs #2912)** — shared per-family cleanup drains deferred producers before untracking roots.
+
+- **Drain deferred jscpd fixture cleanup (refs #2912)** — jscpd test teardown keeps the shared `pi-lens-jscpd-` owner stem registered across bounded macrotask drains, covering every jscpd output-root prefix in the suite.
+
+- **Remove test scratch directories on exit (refs #2912)** — the generic process-wide fixture sweep was attempted twice and reverted after broad suite breakage; proven per-family sweeps remain, and unresolved prefixes enter an environment-independent prefix-set ratchet with named producers. The serialized hygiene owner records and removes newly-created `pi-lens-*` fixtures, the MCP harness removes IPC endpoints after child exit, release-QA accepts an owned `--scratch-root` with signal cleanup, ast-grep baseline scratch is bounded, generated ast-grep scan directories are collision-proof with preparation cleanup on partial setup failure, reverse-deps and agent-end summary fixtures drain several macrotasks before cleanup, and the session-start full-mode producer remains explicitly admitted.
+
+- **Spawn-cwd scanner derives one vocabulary from the seam and freezes (closes #2927)** — the scan's site rule and the sweep's population predicate both derive from the `SPAWN_NAMES` / seven-name `NODE_SPAWN_NAMES` tuples, with per-name parity tests; the `// cwd-exempt:` channel is deleted with its self-tests after #2911 removed its last production tags; the scanner header states the simplify-not-extend freeze policy.
+
+- **Keep the #2992 regression probe out of system temp (refs #2912)** — the read-bridge lifecycle test stores its ledger home under the ignored worktree-local `.probe-home` directory, so asynchronous bookkeeping cannot recreate a leaked top-level `/tmp` fixture.
+
+- **Isolate `instance-reaper-unref` from the run-shared `PI_LENS_HOME` (refs #3050)** — `sweepUntrackedOrphans` takes `<PI_LENS_HOME>/orphan-backstop.lock` and reads the 30-minute `orphan-backstop.json` cooldown stamp before it enumerates anything, so a sibling Vitest fork's real `session_start` (`tests/index-integration.test.ts` arms 37 `scheduleUntrackedOrphanSweep()` timers through `index.js`) left a fresh stamp and the unref test's sweep returned `cooldown` with zero spawns — master 038e28b's only Unit failure. Each case now pins its own `mkdtemp` home, and `#3050`'s detector, which had recorded a two-character body for every declaration with a braced default parameter value and so never saw `sweepUntrackedOrphans`, now finds a body brace past the parameter list.
+
 ## [4.1.6] - 2026-09-10
 
 ### Added

package/node_modules/pi-lens/config/dependency-cruiser-eager-allowlist.json

@@ -1,6 +1,7 @@
 [
   "./clients/agent-nudge.js",
   "./clients/ast-grep-client.js",
+  "./clients/bash-file-access.js",
   "./clients/bootstrap.js",
   "./clients/bounded-cache.js",
   "./clients/bounded-telemetry.js",
@@ -11,6 +12,7 @@
   "./clients/cache-observability.js",
   "./clients/cascade-format.js",
   "./clients/console-guard-install.js",
+	"./clients/deadline-utils.js",
   "./clients/debug-handles.js",
   "./clients/debug-heap.js",
   "./clients/degradation-ledger.js",
@@ -26,6 +28,7 @@
   "./clients/format-events-publish.js",
   "./clients/format-service.js",
   "./clients/formatters-lazy.js",
+	"./clients/hook-budgets.js",
   "./clients/host-ports.js",
   "./clients/installer/index.js",
   "./clients/instance-reaper.js",

package/node_modules/pi-lens/dist/clients/actionable-warnings.js

@@ -13,6 +13,8 @@ import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 import { logActionableWarningsEvent } from "./actionable-warnings-logger.js";
 import { displayProjectDataPath, getProjectDataDir } from "./file-utils.js";
 import { commitDurableStore } from "./durable-store.js";
+import { establishToolAgreement } from "./tool-agreement.js";
+import { resolveLensToolName } from "./tool-config.js";
 let beforeWarningStateLockForTests = null;
 /** Test seam for a sibling process commit immediately before lock acquisition. */
 export function _setBeforeWarningStateLockForTests(hook) {
@@ -252,11 +254,15 @@ function lineInModifiedRanges(line, ranges) {
 function recordFromLspDiagnostic(diag, filePath, cwd) {
     const line = diag.range.start.line + 1;
     const column = diag.range.start.character + 1;
+    // Keep agreement keyed to the producer that supplied the diagnostic. The
+    // generic `lsp` label is only a last-resort identity: treating it as a
+    // registered writer would establish every LSP quickfix without evidence.
+    const producer = diag.source && diag.source !== "lsp" ? diag.source : diag.serverId;
     const source = diag.source ?? "lsp";
     const code = diag.code === undefined ? undefined : String(diag.code);
     const identityArgs = {
         filePath,
-        tool: "lsp",
+        tool: producer ?? "lsp",
         source,
         code,
         message: diag.message,
@@ -271,7 +277,7 @@ function recordFromLspDiagnostic(diag, filePath, cwd) {
         line,
         column,
         severity: "warning",
-        tool: "lsp",
+        tool: producer ?? "lsp",
         source,
         code,
         rule: code ? `${source}:${code}` : source,
@@ -1428,6 +1434,19 @@ export async function applyConservativeActionableWarningFixes(args) {
                 continue;
             }
             summary.considered++;
+            const agreement = establishToolAgreement(warning.tool, args.cwd);
+            if (agreement.decision === "decline") {
+                recordDegradationOnce({
+                    kind: "autofix-agreement-unavailable",
+                    subject: agreement.subject,
+                    reason: agreement.reason,
+                });
+                summary.skipped.push({
+                    id: warning.id,
+                    reason: "tool_agreement_unavailable",
+                });
+                continue;
+            }
             if (!warning.line || !warning.column) {
                 summary.skipped.push({ id: warning.id, reason: "missing_position" });
                 continue;
@@ -1516,7 +1535,7 @@ export async function applyConservativeActionableWarningFixes(args) {
  * unread under `~/.pi-lens/projects/<slug>/cache/`. An OPTIONAL `cwd` would
  * have kept that bug alive behind a default, so callers must pass it.
  */
-export function formatActionableWarningsAdvisory(report, cwd) {
+export function formatActionableWarningsAdvisory(report, cwd, host = "pi") {
     if (report.summary.unsuppressed === 0)
         return undefined;
     const files = report.files.filter((file) => file.warnings.some((warning) => !warning.suppressed));
@@ -1543,10 +1562,17 @@ export function formatActionableWarningsAdvisory(report, cwd) {
     // reading the transcript, rendered through the one helper that cannot
     // disagree with the writer.
     const reportPath = displayProjectDataPath(cwd, "cache", "actionable-warnings.json");
+    // #2535 F3: a known tool with no mapping on this host resolves to
+    // undefined — omit the instruction rather than naming a dead tool.
+    // `lens_diagnostics` is pinned available on both hosts, so this is
+    // defensive only.
+    const diagnosticsTool = resolveLensToolName("lens_diagnostics", host);
     return [
         `🟡 Fixable warnings introduced this turn: ${report.summary.unsuppressed}.${safe}`,
         tierLine,
-        "Use lens_diagnostics with mode=delta to inspect these warnings.",
+        diagnosticsTool
+            ? `Use ${diagnosticsTool} with mode=delta to inspect these warnings.`
+            : undefined,
         fileList ? `Files:\n${fileList}${more}` : undefined,
         "If continuing in these files, resolve warnings that are safe and relevant. Do not apply broad refactors unless requested.",
         `Raw report (only if you need the JSON): ${reportPath}`,

package/node_modules/pi-lens/dist/clients/agent-behavior-client.js

@@ -143,3 +143,5 @@ export class AgentBehaviorClient {
         this.fileEditCount.clear();
     }
 }
+/** Process-wide behaviour history, independent of analyzer bootstrap residency. */
+export const agentBehaviorClient = new AgentBehaviorClient();

package/node_modules/pi-lens/dist/clients/bash-file-access.js

@@ -17,6 +17,7 @@
 import * as nodeFs from "node:fs";
 import * as path from "node:path";
 import { isReadableSourceFile } from "./file-kinds.js";
+import { classifyMutatingTool } from "./mutating-tool.js";
 import { countFileLines } from "./read-guard-tool-lines.js";
 import { stripAnsi } from "./sanitize.js";
 function stripQuotes(token) {
@@ -1028,3 +1029,28 @@ export function extractDeletedPathsFromCommand(command, cwd) {
     }
     return Array.from(out);
 }
+/**
+ * One edit-class predicate for the `tool_result` path (#2939 F3).
+ *
+ * `index.ts` used to answer "is this an edit-class result" twice — once in
+ * the handler body (gated on `toolName === "bash"`) and once in the
+ * `budgetKey` callback (no tool gate) — and the copies disagreed on the
+ * first third-party case tried (`mcp__acme__shell` with `input.command`:
+ * wrapper said edit, handler said read-only). Both call sites now share
+ * this function, so the answer is written once — but the call sites
+ * themselves are not yet pinned (W4/M8, #2939), so a future tool-name gate
+ * re-introduced at one of them would still pass the suite.
+ *
+ * A result is edit-class when the mutation seam classifies it, or when its
+ * `input.command` names written files. The command half carries no tool-name
+ * gate on purpose: a shell that wrote files runs the same pipeline whatever
+ * its tool is named, and the edit budget must cover that work.
+ */
+export function isEditClassToolResult(event, cwd) {
+    if (classifyMutatingTool(event, { recognizeOnly: true }) !== undefined) {
+        return true;
+    }
+    const command = event?.input?.command;
+    return (typeof command === "string" &&
+        extractWrittenPathsFromCommand(command, cwd).length > 0);
+}

package/node_modules/pi-lens/dist/clients/biome-client.js

@@ -325,7 +325,7 @@ export class BiomeClient {
             const before = await fs.promises.readFile(absolutePath, "utf-8");
             const configCwd = resolveToolCwd("runner", "biome", absolutePath, {
                 ...(cwd !== undefined && { cwd }),
-            });
+            }).cwd;
             // Shared config-args seam (#1247): the lint runner consumes the same
             // builder, so `lint --write` can never drift to biome's default
             // config when a user config or the package fallback exists.