@herbertgao/pi-extensions 2026.9.6 → 2026.9.8

package/node_modules/pi-lens/dist/clients/blocker-freshness.js

@@ -31,11 +31,66 @@
  * all runners, so an eslint, biome-check, or ast-grep security-rule (hardcoded
  * secret, CVE) finding can land here too. Only a language-server verdict is
  * actually invalidated by an IMPORT changing; an ast-grep secret match doesn't stop
- * being true because a file it imports was edited. The sweep therefore demotes an
- * entry only when its recorded `sources` (`InlineBlockerRecord.sources`) are ALL
- * `"lsp"` — a mixed or non-LSP-sourced blocker is left fully authoritative, the same
- * fail-closed shape `retireInlineBlockerOnConfirmedClean` already uses for
- * provenance it can't yet reason about.
+ * being true because a file it imports was edited.
+ *
+ * Self-drift axis (#1561 remainder). That reasoning covers the import axis and
+ * nothing else, but the original gate discarded BOTH axes for a non-LSP record:
+ * entries whose `sources` were not all `"lsp"` skipped the check entirely. A
+ * tree-sitter verdict about F's own syntax is emphatically invalidated by F's own
+ * bytes changing, and no other path could clear it —
+ * `retireInlineBlockerOnConfirmedClean` requires `coveredSources` to be a superset
+ * of the record's sources, `coveredSourcesForCheck` builds that set from the LSP
+ * server registry, and no registered server has id `"tree-sitter"`, so the retire
+ * could never fire however many clean checks ran. Live shape: a
+ * `ts-incomplete-assertion` blocker re-served every turn for the rest of a session
+ * against a file already proven clean by grep, LSP, and a passing test.
+ *
+ * So the sweep now runs over every entry that HAS recorded provenance, and picks
+ * the axis from the sources: all-`"lsp"` gets the own-file-plus-forward-imports
+ * walk, anything else (tree-sitter, ast-grep, mixed, or `"unknown"`) gets an
+ * own-file-only check. A record with NO recorded sources stays fail-closed and
+ * untouched, matching the test `retireInlineBlockerOnConfirmedClean` applies before
+ * it will retire.
+ *
+ * The self axis is CONTENT-CONFIRMED and RE-ARMING, and those two properties are
+ * why it carries its own `"self-drift"` reason rather than reusing
+ * `"dependency-drift"` (#2982 review).
+ *
+ * Content-confirmed: mtime moving is not evidence a byte moved. A `touch`, a
+ * `git checkout` restoring identical bytes, or a no-op formatter pass all move
+ * it. #2449 round 2 F7 settled this for `observed-mutation.ts` ("mtime-only
+ * drift has to be confirmed against content before anything is replayed"), and
+ * it binds harder here, where an unconfirmed demotion walks a finding out of the
+ * authoritative channel. `detectSelfDrift` applies that rule at both tiers:
+ * `size` first, then a sha256 of the bytes when size cannot separate a
+ * one-character edit from a `touch`. A same-LENGTH change is the common shape,
+ * not an exotic one (a renamed identifier of equal length, a flipped comparison,
+ * a changed digit), so a size-only tier would leave a genuinely changed record
+ * authoritative, which is #2982 arriving from the other side. The baseline is
+ * carried by `PipelineResult` beside the inline-blocker evidence and stamped
+ * synchronously by `recordInlineBlockers`. Every bound that expires, and every missing baseline, yields
+ * `unverifiable`, which changes no state in either direction and is counted so
+ * it is visible rather than silent.
+ *
+ * Re-arming: `setInlineBlockerSelfDriftStale` re-derives the verdict every turn
+ * and un-demotes a record whose bytes come back, exactly as
+ * `setInlineBlockerPastEofStale` does for a transient shrink-then-restore. That
+ * is what lets this axis stay OUT of the #1950 delivery cap. The cap retires a
+ * record permanently after `DEPENDENCY_DRIFT_MAX_DELIVERIES` stale deliveries,
+ * which suits recoverable LSP dependency drift; a self-drift record can carry
+ * ast-grep or tree-sitter security provenance, and retiring one because an
+ * advisory was shown three times would walk a hardcoded secret out of turn-end
+ * rendering with no dispatch to re-raise it. A record that heals on its own
+ * needs no bounded-noise retirement.
+ *
+ * Defect shape 24 is satisfied by composition, not by reusing a string: the new
+ * reason has per-writer semantics (re-arm, no cap), and like every sibling gate
+ * it never touches a demotion another gate made and never heals one it did not
+ * make. The commit gate is unaffected either way. `updateGitGuardStatus` counts
+ * `getInlineBlockersSnapshot().length` with no `stale` filter, so a demoted
+ * record still gates a commit; `tests/clients/blocker-freshness.test.ts` pins
+ * that, because it is what makes widening this sweep to security provenance
+ * safe at all.
  *
  * Resolution boundary (#1631 review F8): `extractForwardImportPaths` parses static
  * import/require syntax via tree-sitter. It does not, and cannot, resolve a
@@ -76,13 +131,29 @@
  * with this module is the one number both caps retire against,
  * `DEPENDENCY_DRIFT_MAX_DELIVERIES`, rather than inventing a second one.
  */
+import { createHash } from "node:crypto";
 import * as fs from "node:fs";
+import { bounded } from "./deadline-utils.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import { normalizeEphemeralMapKey } from "./path-utils.js";
+import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 import { resolveImportToFiles } from "./review-graph/import-resolvers.js";
 import { getSharedTreeSitterClient, resolveTreeSitterLanguage, } from "./tree-sitter-shared.js";
 import { TreeSitterSymbolExtractor } from "./tree-sitter-symbol-extractor.js";
 /** See the module doc's "Delivery cap (#1950)" section above. */
 export const DEPENDENCY_DRIFT_MAX_DELIVERIES = 3;
+/**
+ * #2982: total bytes the self-drift axis may hash in ONE sweep.
+ *
+ * Each read is individually bounded by `bounded()`, but a turn with many
+ * non-LSP blockers would still issue many whole-file reads on a hook path, which
+ * is defect shape 9 (bounded on one axis, growing on another). Once a sweep has
+ * spent this budget the remaining same-size records are reported `unverifiable`
+ * and left exactly as they are, the same fail-closed direction as a read that
+ * times out.
+ */
+const SELF_DRIFT_HASH_BUDGET_BYTES = 8 * 1024 * 1024;
 /**
  * Upper bound on the number of forward imports stat-checked for a single blocker.
  * Blocking entries are rare, but one file can import many modules; the sweep must
@@ -219,6 +290,95 @@ async function statMtimeMs(filePath) {
         return undefined;
     }
 }
+/**
+ * Confirm a self-axis record against content, not mtime alone.
+ *
+ * mtime moving is not evidence that content changed: a `touch`, a `git
+ * checkout` restoring identical bytes, a no-op formatter pass, or a `chmod`
+ * all move it while every byte stays put. #2449 round 2 F7 settled this for
+ * `observed-mutation.ts` ("a `touch` bumps it without a byte moving, so
+ * mtime-only drift has to be confirmed against content before anything is
+ * replayed"), and the same reasoning governs here, where an unconfirmed
+ * demotion would walk a finding out of the authoritative channel.
+ *
+ * Three gates, in cost order. `size` decides most cases from the stat already
+ * taken, and it runs BEFORE the mtime gate: an out-of-band write (a formatter,
+ * a checkout) can land at-or-before the `recordedAtMs` baseline, so mtime alone
+ * is blind to the own-file drift this axis exists to catch — the size gate fires
+ * regardless of the mtime relationship. When the size matches, the mtime gate is
+ * a fast path that skips the expensive hash tier for non-LSP records (size same
+ * AND mtime never moved → the file almost certainly did not change, so we do
+ * not read and hash every unchanged file on the hook path). All-LSP records
+ * with an available hash baseline force the hash tier after the size check, so
+ * a same-size rewrite at-or-before the baseline cannot remain authoritative.
+ * When hashing is not forced and mtime moved, the hash separates a one-character
+ * edit from a `touch`, reading the bytes and comparing against the baseline
+ * `setInlineBlockerContentBaseline` attached off the dispatch path.
+ *
+ * Both tiers fail toward `"unverifiable"`, never toward `"drift"`: a bound that
+ * expires, a baseline that never landed, or a file past the per-sweep hash
+ * budget all leave the record exactly as it is. Demoting on a verdict the tier
+ * could not actually reach is the failure this function exists to prevent, and
+ * `bounded()` returning `undefined` on timeout makes that an easy mistake to
+ * write, so every bound's result is checked explicitly.
+ */
+async function detectSelfDrift(args) {
+    const boundOptions = (label) => ({
+        ms: HOOK_WALL_BUDGET_MS.turn_end,
+        signal: args.signal,
+        hook: "turn_end",
+        label,
+    });
+    // EVERY bound that expires yields `undefined`, and every one of those maps to
+    // `unverifiable`, never to drift. A timed-out stat compared against the
+    // recorded size would read as a size change and demote the record, which is
+    // the exact failure this tier exists to prevent.
+    const stat = await bounded(fs.promises.stat(args.filePath), boundOptions("selfDriftStat"));
+    if (stat === undefined)
+        return { verdict: "unverifiable", unverifiableReason: "stat-unavailable" };
+    // Size gate FIRST, before the mtime gate. mtime is a blind signal for the
+    // out-of-band-rewrite case: an external write (a formatter, a checkout) can
+    // land at-or-before the `recordedAtMs` baseline, so `freshnessFromMtime`
+    // reports the own file unchanged even though its bytes differ. Size is cheap
+    // content confirmation from the same stat, and it fires regardless of the
+    // mtime relationship — the all-LSP own-file case the mtime gate alone misses.
+    if (args.recordedSize === undefined)
+        return { verdict: "unverifiable", unverifiableReason: "missing-baseline" };
+    if (stat.size !== args.recordedSize)
+        return { verdict: "drift" };
+    // Size matches. Non-LSP records retain the mtime fast path. All-LSP records
+    // with a hash baseline force content confirmation because a same-size rewrite
+    // can land at-or-before the baseline.
+    const freshness = freshnessFromMtime({
+        mtimeMs: stat.mtimeMs,
+        referenceMs: args.recordedAtMs,
+    });
+    if (!args.forceContent && freshness.verdict !== "stale")
+        return { verdict: "unchanged" };
+    // Same length AND mtime moved. Only the hash can separate a one-character
+    // edit from a `touch`, and a same-length edit is the common shape, not an
+    // exotic one. Forced all-LSP confirmation reaches this tier even when mtime
+    // did not move.
+    if (args.recordedHash === undefined)
+        return { verdict: "unverifiable", unverifiableReason: "missing-baseline" };
+    // Defect shape 9: each read is individually bounded, but N blockers in one
+    // turn is an unbounded AGGREGATE read on a hook path. The per-sweep byte
+    // budget bounds the other axis; past it the record is unverifiable, not
+    // drifted.
+    if (stat.size > args.budget.bytesLeft) {
+        args.budget.exhausted = true;
+        return {
+            verdict: "unverifiable",
+            unverifiableReason: "hash-budget-exhausted",
+        };
+    }
+    const content = await bounded(fs.promises.readFile(args.filePath), boundOptions("selfDriftHash"));
+    if (content === undefined)
+        return { verdict: "unverifiable", unverifiableReason: "hash-unavailable" };
+    args.budget.bytesLeft -= content.byteLength;
+    const hash = createHash("sha256").update(content).digest("hex");
+    return { verdict: hash === args.recordedHash ? "unchanged" : "drift" };
+}
 /**
  * Resolve `filePath`'s forward imports and stat each, returning the imports that
  * exist together with their mtime. Shared by the inline-blocker sweep and the
@@ -268,14 +428,18 @@ export async function collectForwardImportMtimes(cwd, filePath, resolveForwardIm
 // re-export preserves every existing importer's path.
 export { MTIME_DRIFT_TOLERANCE_MS } from "./freshness.js";
 import { freshnessFromMtime } from "./freshness.js";
-async function detectDrift(cwd, filePath, recordedAtMs, resolveForwardImports, turnIndex) {
+async function detectDrift(cwd, filePath, recordedAtMs, resolveForwardImports, turnIndex, 
+/** Skip the own-file mtime tier after content confirms it is unchanged. */
+skipOwnFile = false) {
     const drifted = [];
-    const ownFreshness = freshnessFromMtime({
-        mtimeMs: await statMtimeMs(filePath),
-        referenceMs: recordedAtMs,
-    });
-    if (ownFreshness.verdict === "stale")
-        drifted.push(filePath);
+    if (!skipOwnFile) {
+        const ownFreshness = freshnessFromMtime({
+            mtimeMs: await statMtimeMs(filePath),
+            referenceMs: recordedAtMs,
+        });
+        if (ownFreshness.verdict === "stale")
+            drifted.push(filePath);
+    }
     const { mtimes, truncated } = await collectForwardImportMtimes(cwd, filePath, resolveForwardImports, turnIndex);
     for (const { path: depPath, mtimeMs } of mtimes) {
         const verdict = freshnessFromMtime({
@@ -290,19 +454,53 @@ async function detectDrift(cwd, filePath, recordedAtMs, resolveForwardImports, t
 /**
  * Whether a population entry is eligible for the drift check at all — the same
  * three gates the main sweep loop applies (not already stale, has a timestamp
- * baseline, all-`"lsp"` sources). Factored out so the #1790 review F5 dedup
+ * baseline, HAS recorded provenance). Factored out so the #1790 review F5 dedup
  * decision below (chain vs. separate row) asks the IDENTICAL question the main
  * loop will ask, rather than a second hand-written approximation of it that
  * could drift from the real gates.
+ *
+ * The third gate reads "has provenance", not "is all-`lsp`": a non-LSP record is
+ * now eligible for the self-drift axis (own file only, no import walk). Widening
+ * it here and in the loop together is the point of the shared predicate — the
+ * loop still decides WHICH axis each eligible entry gets.
  */
 function isEligibleForDriftCheck(entry) {
     if (entry.stale)
         return false;
     if (entry.recordedAtMs === undefined)
         return false;
-    return (entry.sources !== undefined &&
-        entry.sources.length > 0 &&
-        entry.sources.every((source) => source === "lsp"));
+    return entry.sources !== undefined && entry.sources.length > 0;
+}
+/**
+ * All recorded sources are `"lsp"` — the record gets the full own-file PLUS
+ * forward-import walk. Anything else (tree-sitter, ast-grep, mixed, `"unknown"`)
+ * gets the self-only axis. One spelling, shared by the sweep loop and the
+ * chain decision below so the two can never disagree about which axis an entry
+ * is on.
+ */
+function isAllLspSourced(sources) {
+    return (sources !== undefined &&
+        sources.length > 0 &&
+        sources.every((source) => source === "lsp"));
+}
+/**
+ * Whether a duplicated widget row may be CHAINED onto this inline entry's single
+ * drift check instead of being given its own population row (#1790 review F5).
+ *
+ * Strictly stronger than {@link isEligibleForDriftCheck} since the self-drift
+ * axis landed, and deliberately so. A widget row from
+ * `getWidgetBlockingFilesForSweep` is pure-LSP by construction, so the check that
+ * speaks for it must walk forward imports. An inline entry on the self-only axis
+ * never consults imports, so chaining a widget row onto it would silently drop
+ * that row's import axis — the #1790 ghost, in a new disguise: the inline entry
+ * reports `kept`, the widget row is never independently checked, and its
+ * `isBlocking` stays true for a dependency that drifted.
+ *
+ * Such an inline entry is still drift-checked on its own axis. It just cannot
+ * answer another store's question.
+ */
+function canSubsumeLspWidgetRow(entry) {
+    return isEligibleForDriftCheck(entry) && isAllLspSourced(entry.sources);
 }
 /**
  * Freshness sweep over every blocking row the widget currently serves — the cached
@@ -347,6 +545,9 @@ export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
         revalidated: 0,
         alreadyStale: 0,
         truncatedImports: 0,
+        selfHealed: 0,
+        selfUnverifiable: 0,
+        hashBudgetExhausted: 0,
     };
     const resolveForwardImports = options?.resolveForwardImports ?? extractForwardImportPaths;
     let turnIndex;
@@ -368,7 +569,11 @@ export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
         stale: entry.stale ?? false,
         recordedAtMs: entry.recordedAtMs,
         sources: entry.sources,
+        staleReason: entry.staleReason,
+        recordedSize: entry.recordedSize,
+        recordedHash: entry.recordedHash,
         demote: () => runtime.markInlineBlockerStale(entry.filePath, "dependency-drift"),
+        setSelfDrift: (isSelfDrift) => runtime.setInlineBlockerSelfDriftStale(entry.filePath, isSelfDrift),
     }));
     // #1790 review F2: dedup key is `normalizeEphemeralMapKey`, not
     // `normalizeMapKey` — the latter realpaths a live file and walks up the
@@ -390,16 +595,22 @@ export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
         // drop, not a merge. The main loop below short-circuits BEFORE ever
         // calling `demote()` for an already-stale entry (the one-way
         // dependency-drift latch — a forever-ghost once it fires once), an
-        // unstamped legacy record, or a non-LSP/mixed-sources entry (e.g. an
-        // unrelated ast-grep finding on the same file). Any of those swallows a
-        // chained widget demote even though the widget row is pure-LSP by
-        // construction (`getWidgetBlockingFilesForSweep` only emits LSP-sourced
-        // rows) and carries its OWN baseline. Eligibility belongs to the STORE
-        // the row came from, not the file path two stores happen to share — so
-        // only chain when the inline entry would itself reach `demote()`;
-        // otherwise give the widget row its own population entry so its own
-        // gates and its own drift check decide its own fate.
-        if (inlineEntry && isEligibleForDriftCheck(inlineEntry)) {
+        // unstamped legacy record, or a record with no provenance at all. Any of
+        // those swallows a chained widget demote even though the widget row is
+        // pure-LSP by construction (`getWidgetBlockingFilesForSweep` only emits
+        // LSP-sourced rows) and carries its OWN baseline. Eligibility belongs to
+        // the STORE the row came from, not the file path two stores happen to
+        // share — so only chain when the inline entry would itself reach
+        // `demote()`; otherwise give the widget row its own population entry so
+        // its own gates and its own drift check decide its own fate.
+        //
+        // Since the self-drift axis landed, "would reach `demote()`" is no longer
+        // enough: a non-LSP inline entry IS drift-checked now, but only against
+        // its own file. It never consults imports, so it cannot speak for a
+        // pure-LSP widget row whose dependency drifted. `canSubsumeLspWidgetRow`
+        // carries that stronger test; the unrelated-ast-grep-finding case in the
+        // paragraph above is now excluded by the axis, not by ineligibility.
+        if (inlineEntry && canSubsumeLspWidgetRow(inlineEntry)) {
             // #1790 review F1: a duplicated path is counted and drift-checked ONCE
             // (via the inline entry above), but BOTH stores must record the
             // verdict — `markInlineBlockerStale` only ever touches
@@ -423,12 +634,31 @@ export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
             recordedAtMs: extra.recordedAtMs,
             sources: ["lsp"],
             demote: extra.demote,
+            // A widget row is pure-LSP by construction, so it takes the import
+            // axis and never reaches the self axis. No `setSelfDrift` (#2982):
+            // the widget store has no re-arming self-drift setter, and an entry
+            // without one is not eligible for that axis.
+            staleReason: undefined,
+            recordedSize: undefined,
+            recordedHash: undefined,
         });
     }
     counts.total = population.length;
+    // One budget for the whole sweep (defect shape 9), consumed by the self
+    // axis's hash tier as it goes.
+    const hashBudget = {
+        bytesLeft: SELF_DRIFT_HASH_BUDGET_BYTES,
+        exhausted: false,
+    };
     for (const entry of population) {
         try {
-            if (entry.stale) {
+            // #2982: a latched demotion belongs to the gate that made it and this
+            // loop leaves it alone. Its OWN self-drift demotion is re-armable, so
+            // it is re-derived every turn instead: bytes that come back must
+            // un-demote the record, which is what lets the self axis skip the
+            // #1950 delivery cap rather than retire a security finding for good.
+            const selfDriftDemoted = entry.stale && entry.staleReason === "self-drift";
+            if (entry.stale && !selfDriftDemoted) {
                 counts.alreadyStale += 1;
                 continue;
             }
@@ -439,17 +669,154 @@ export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
                 counts.kept += 1;
                 continue;
             }
-            // #1631 review F4: fail-closed on non-LSP (or unknown) provenance. Import
-            // drift only invalidates a language-server verdict; a mixed or non-`"lsp"`
-            // `sources` list is kept at full authority rather than demoted.
-            const isLspSourced = entry.sources !== undefined &&
-                entry.sources.length > 0 &&
-                entry.sources.every((source) => source === "lsp");
-            if (!isLspSourced) {
+            // #1631 review F4 kept every non-`"lsp"` record at full authority. Its
+            // stated reason is about the IMPORT axis only — "an ast-grep secret match
+            // doesn't stop being true because a file it imports was edited" — but the
+            // gate discarded the self axis with it. A record with NO provenance at all
+            // stays fail-closed here, the same test
+            // `retireInlineBlockerOnConfirmedClean` applies before it will retire.
+            const recordedSources = entry.sources !== undefined && entry.sources.length > 0
+                ? entry.sources
+                : undefined;
+            if (recordedSources === undefined) {
                 counts.kept += 1;
                 continue;
             }
-            const { drifted, truncated } = await detectDrift(cwd, entry.filePath, entry.recordedAtMs, resolveForwardImports, turnIndex);
+            // #2982 remainder: the record's OWN file is checked via the content-
+            // confirmed self-drift axis (size → hash, re-arming) for records that
+            // have a re-arming setter — shared by the non-LSP self axis below and
+            // the all-LSP axis. The mtime-only own-file check in `detectDrift` is
+            // blind to the out-of-band-rewrite case (an external write can land at-
+            // or-before the `recordedAtMs` baseline), so the content axis owns the
+            // own-file verdict when it can decide. One bounded() call site for both
+            // axes — the #2523 registry requires a single occurrence, so the two
+            // branches must not each wrap the identical call. Demotion, not deletion
+            // (#1419): a demoted entry is re-served in the advisory channel marked
+            // `[stale — re-run to confirm]` and retires through the existing #1950
+            // delivery cap.
+            const setSelfDrift = entry.setSelfDrift;
+            const isLspSourced = isAllLspSourced(recordedSources);
+            let ownVerdict;
+            if (setSelfDrift) {
+                // The outer bound too: an expired one yields `undefined`, and that
+                // means "could not decide", never "changed".
+                const hashBudgetWasExhausted = hashBudget.exhausted;
+                const selfDrift = (await bounded(detectSelfDrift({
+                    filePath: entry.filePath,
+                    recordedAtMs: entry.recordedAtMs,
+                    recordedSize: entry.recordedSize,
+                    recordedHash: entry.recordedHash,
+                    forceContent: isLspSourced &&
+                        entry.recordedSize !== undefined &&
+                        entry.recordedHash !== undefined,
+                    signal: options?.signal,
+                    budget: hashBudget,
+                }), {
+                    ms: HOOK_WALL_BUDGET_MS.turn_end,
+                    signal: options?.signal,
+                    hook: "turn_end",
+                    label: "detectSelfDrift",
+                })) ?? {
+                    verdict: "unverifiable",
+                    unverifiableReason: "bound-expired",
+                };
+                ownVerdict = selfDrift.verdict;
+                if (ownVerdict === "unverifiable") {
+                    // Decide nothing. Leave the record in whatever state it holds.
+                    counts.selfUnverifiable += 1;
+                    const reason = selfDrift.unverifiableReason ??
+                        (hashBudgetWasExhausted || hashBudget.exhausted
+                            ? "hash-budget-exhausted"
+                            : "hash-unavailable");
+                    recordDegradationOnce({
+                        kind: "self-drift-unverifiable",
+                        subject: `inline-blocker:${toRunnerDisplayPath(cwd, entry.filePath)}#${reason}`,
+                        reason: `the self-drift check was unverifiable: ${reason}`,
+                    });
+                    if (reason === "hash-budget-exhausted") {
+                        recordDegradationOnce({
+                            kind: "self-drift-hash-budget-exhausted",
+                            subject: `inline-blocker:${toRunnerDisplayPath(cwd, entry.filePath)}`,
+                            reason: "the aggregate self-drift hash budget was exhausted",
+                        });
+                    }
+                }
+            }
+            if (!isLspSourced) {
+                // The self axis. Content-confirmed, re-arming, and outside the
+                // #1950 delivery cap. A store with no re-arming setter is not
+                // eligible for it and stays authoritative (fail-closed).
+                if (!setSelfDrift || ownVerdict === undefined) {
+                    counts.kept += 1;
+                    continue;
+                }
+                if (ownVerdict === "unverifiable") {
+                    if (selfDriftDemoted)
+                        counts.alreadyStale += 1;
+                    else
+                        counts.kept += 1;
+                    continue;
+                }
+                const shouldDemote = ownVerdict === "drift";
+                const transitioned = setSelfDrift(shouldDemote);
+                if (shouldDemote) {
+                    if (transitioned)
+                        counts.revalidated += 1;
+                    else
+                        counts.alreadyStale += 1;
+                }
+                else if (transitioned) {
+                    counts.selfHealed += 1;
+                }
+                else {
+                    counts.kept += 1;
+                }
+                continue;
+            }
+            // The LSP axis (#1618). The own file is checked by the content axis
+            // above when a baseline was captured; without one it falls back to the
+            // mtime check (the pre-#2982 behavior, fail-open). The forward-import
+            // walk stays on the one-way dependency-drift axis.
+            let contentDecidedOwnFile = false;
+            if (setSelfDrift !== undefined &&
+                ownVerdict !== undefined &&
+                entry.recordedSize !== undefined) {
+                if (ownVerdict === "drift") {
+                    const transitioned = setSelfDrift(true);
+                    if (transitioned)
+                        counts.revalidated += 1;
+                    else
+                        counts.alreadyStale += 1;
+                    // Own file drifted; the record is out of the authoritative
+                    // channel, so the import walk is moot this turn.
+                    continue;
+                }
+                if (ownVerdict === "unchanged") {
+                    // Content confirms the own file is unchanged: skip the mtime check
+                    // below (a `touch` must not demote a still-valid record), and
+                    // un-demote a record self-drifted last turn.
+                    contentDecidedOwnFile = true;
+                    const transitioned = setSelfDrift(false);
+                    if (transitioned)
+                        counts.selfHealed += 1;
+                }
+                else {
+                    // "unverifiable": the content axis could not decide (a stat that
+                    // failed, or a size that matched but whose hash never landed). Fall
+                    // back to the mtime check below.
+                    if (selfDriftDemoted) {
+                        counts.alreadyStale += 1;
+                        continue;
+                    }
+                }
+            }
+            // Forward-import walk (one-way dependency-drift). Skip the own file ONLY
+            // when the content axis decided it "unchanged" — the one case where the
+            // mtime check would wrongly demote on a `touch`. A widget row (no setter)
+            // and an inline entry without a baseline never reach the content axis, so
+            // they still get the mtime own-file check (fail-open).
+            const skipOwnFile = contentDecidedOwnFile;
+            const { drifted, truncated } = await detectDrift(cwd, entry.filePath, entry.recordedAtMs, resolveForwardImports, turnIndex, skipOwnFile);
             if (truncated)
                 counts.truncatedImports += 1;
             if (drifted.length > 0) {
@@ -465,5 +832,6 @@ export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
             counts.kept += 1;
         }
     }
+    counts.hashBudgetExhausted = hashBudget.exhausted ? 1 : 0;
     return counts;
 }

package/node_modules/pi-lens/dist/clients/bootstrap.js

@@ -41,6 +41,7 @@ import { logLatency } from "./latency-logger.js";
 import { emitBounded } from "./bounded-telemetry.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
 import { createSingleFlight } from "./single-flight.js";
+import { agentBehaviorClient } from "./agent-behavior-client.js";
 /**
  * The clients of a COMPLETED load, or `null` while none has completed.
  *
@@ -56,6 +57,10 @@ import { createSingleFlight } from "./single-flight.js";
  * by the single-flight primitive's identity-guarded release).
  */
 let residentClients = null;
+/** Behaviour history remains available before analyzer bootstrap completes. */
+export function getAgentBehaviorClient() {
+    return agentBehaviorClient;
+}
 /**
  * Set by {@link markAnalyzerBootstrapShutdown} when the PRIMARY session tears
  * down. It refuses NEW loads only — a demand that already joined the in-flight
@@ -233,7 +238,7 @@ async function buildBootstrapClients() {
         load("opengrep", async () => new (await import("./opengrep-client.js")).OpengrepClient()),
         // The process-wide singleton, for the same reason as "go" above.
         load("rust", async () => (await import("./rust-client.js")).rustClient),
-        load("agent-behavior", async () => new (await import("./agent-behavior-client.js")).AgentBehaviorClient()),
+        load("agent-behavior", async () => (await import("./agent-behavior-client.js")).agentBehaviorClient),
         loadList("dead-code", async () => (await import("./dead-code-client.js")).getDeadCodeClients()),
     ]);
     if (failures.length > 0)