@herbertgao/pi-extensions 2026.9.6 → 2026.9.8

package/node_modules/pi-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -81,10 +81,13 @@
  * Refs: #585, #313 (the SecurityScanClient de-dupe prerequisite), #1004
  */
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
 import { getKnipIgnorePatterns } from "../file-utils.js";
-import { isAtOrAboveHomeDir } from "../path-utils.js";
+import { isAtOrAboveHomeDir, realpathOrResolve } from "../path-utils.js";
+import { isSameOrWithin } from "../lsp/server.js";
+import { incrementDegradationCount } from "../degradation-ledger.js";
 import { GitleaksClient } from "../gitleaks-client.js";
 import { GovulncheckClient } from "../govulncheck-client.js";
 import { isToolInstallAllowedByTrust, projectTrustDenialReason, } from "../project-trust.js";
@@ -134,7 +137,48 @@ function pushUnique(list, id) {
  * spawns).
  */
 export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, options = {}) {
-    const analysisRoot = path.resolve(cwd);
+    const requestedRoot = options.analysisRoot === undefined
+        ? cwd
+        : path.resolve(cwd, options.analysisRoot);
+    let analysisRoot;
+    let analysisRootValidation;
+    if (options.analysisRoot !== undefined) {
+        try {
+            if (!fs.statSync(requestedRoot).isDirectory()) {
+                throw new Error("is not a directory");
+            }
+            analysisRoot = fs.realpathSync(requestedRoot);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            const reason = `the explicit analysis root ${requestedRoot} is unavailable or ${detail}`;
+            analysisRootValidation = {
+                state: "undecided",
+                root: requestedRoot,
+                reason,
+            };
+            incrementDegradationCount({
+                kind: "lens-diagnostics-analysis-root-rejected",
+                subject: requestedRoot,
+                reason,
+            });
+            return {
+                analysisRootValidation,
+                diagnostics: [],
+                runners: [],
+                analyzed: [],
+                authoritativeCoverage: [],
+                cold: [...ANALYZER_IDS],
+                coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, reason])),
+                failed: [],
+                timings: {},
+                analysisRootError: reason,
+            };
+        }
+    }
+    else {
+        analysisRoot = realpathOrResolve(cwd);
+    }
     // #747: refuse to spawn any heavyweight analyzer when the analysis root is
     // at — or above — the home directory (the #250/#253 escape class). Every
     // analyzer here treats `analysisRoot` as a whole tree to walk; from $HOME
@@ -144,26 +188,58 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     // / review-graph's buildOrUpdateGraph; like the latter, there is no safe
     // substitute root to fall back to — the caller's `paths` scope only filters
     // REPORTED results, it never narrows what these analyzers walk.
-    const unsafeRootReason = "the working directory resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
-    if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
+    const unsafeRootReason = "the analysis root resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
+    const homeRoot = realpathOrResolve(options.homeDir ?? os.homedir());
+    if (options.analysisRoot !== undefined) {
+        const unsafeExplicitRoot = !isSameOrWithin(homeRoot, analysisRoot) ||
+            isSameOrWithin(analysisRoot, homeRoot);
+        analysisRootValidation = unsafeExplicitRoot
+            ? {
+                state: "unsafe",
+                root: analysisRoot,
+                reason: "explicit analysis root must be strictly contained by the canonical home directory",
+            }
+            : { state: "safe", root: analysisRoot };
+    }
+    else if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
+        analysisRootValidation = {
+            state: "unsafe",
+            root: analysisRoot,
+            reason: unsafeRootReason,
+        };
+    }
+    else {
+        analysisRootValidation = { state: "safe", root: analysisRoot };
+    }
+    if (analysisRootValidation.state !== "safe") {
+        incrementDegradationCount({
+            kind: "lens-diagnostics-analysis-root-rejected",
+            subject: analysisRoot,
+            reason: analysisRootValidation.reason,
+        });
         return {
+            analysisRootValidation,
             diagnostics: [],
             runners: [],
             analyzed: [],
+            authoritativeCoverage: [],
             cold: [...ANALYZER_IDS],
             coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
             failed: [],
             timings: {},
-            unsafeRoot: true,
+            unsafeRoot: analysisRootValidation.state === "unsafe",
         };
     }
     const diagnostics = [];
     const runners = [];
     const analyzed = [];
+    const authoritativeCoverage = [];
     const cold = [];
     // #1623: the specific reason each `cold` id was skipped, captured at the
     // gate that decided it — see FreshProjectDiagnosticsResult.coldReasons.
     const coldReasons = {};
+    const partial = [];
+    const partialReasons = {};
     const failed = [];
     const timings = {};
     // #1623: ms-old each id's data was when this call read it, for lanes that
@@ -190,6 +266,10 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         pushUnique(cold, id);
         coldReasons[id] = reason;
     }
+    function markPartial(id, reason) {
+        pushUnique(partial, id);
+        partialReasons[id] = reason;
+    }
     /**
      * `analysedRoot` is the client's own opt-in `AnalysedRootSignal` (#2154),
      * never a property of reaching this function: `success: true` is also what
@@ -198,9 +278,21 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
      * id that did not analyse the root simply carries no authority to retire a
      * retained finding.
      */
-    function record(id, adapted, elapsedMs, analysedRoot) {
-        if (analysedRoot)
+    function record(id, adapted, elapsedMs, analysedRoot, analysis) {
+        if (analysedRoot) {
             pushUnique(analyzed, id);
+            if (analysis?.analyzedFiles !== undefined &&
+                analysis.analyzedFiles.length > 0) {
+                const root = realpathOrResolve(analysisRoot);
+                authoritativeCoverage.push({
+                    runnerId: id,
+                    root,
+                    files: new Set(analysis.analyzedFiles.map((file) => {
+                        return realpathOrResolve(file);
+                    })),
+                });
+            }
+        }
         timings[id] = (timings[id] ?? 0) + elapsedMs;
         const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
         const suppressedHere = adapted.length - kept.length;
@@ -217,6 +309,9 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     function recordFailed(id, result) {
         failed.push({
             id,
+            ...("reason" in result && result.reason !== undefined
+                ? { reason: result.reason }
+                : {}),
             summary: "summary" in result && typeof result.summary === "string"
                 ? result.summary
                 : "analyzer reported an unsuccessful run",
@@ -245,7 +340,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("knip", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true);
+            record("knip", knipIssuesToProjectDiagnostics(analysisRoot, result.issues ?? []), Date.now() - startMs, true, result);
         }),
         // jscpd — duplicate code detection. Cache key varies with TS-project
         // detection, exactly mirroring session_start's own logic.
@@ -269,7 +364,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache(scannerKey, result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true);
+            record("jscpd", jscpdResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
         }),
         // madge — circular-dependency detection.
         task("madge", async () => {
@@ -282,7 +377,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("madge", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true);
+            record("madge", circularDepsToProjectDiagnostics(analysisRoot, result.circular ?? []), Date.now() - startMs, result.analyzed === true, result);
         }),
         // gitleaks — committed-secrets detection. session_start/per-edit stay
         // config-gated per #130's strict default (GitleaksClient.hasGitleaksSignal),
@@ -313,7 +408,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("gitleaks", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
+            record("gitleaks", gitleaksResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
         }),
         // govulncheck — Go module CVE detection. Go-module-gated per #132.
         task("govulncheck", async () => {
@@ -345,7 +440,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("govulncheck", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
+            record("govulncheck", govulncheckResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
         }),
         // opengrep — full-workspace semgrep-grade security/quality findings via a
         // single project-wide CLI scan (#584). Structurally always-on: mirrors
@@ -372,10 +467,31 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                 recordFailed("opengrep", result);
                 return;
             }
+            if (result.analyzed !== true) {
+                // A usable partial report with no scanned paths carries findings but
+                // no retirement authority. Keep those findings visible and mark the
+                // producer partial so the renderer does not call it cold/not-run.
+                const reason = result.summary ??
+                    result.reason ??
+                    "opengrep did not analyse this root";
+                if (result.partial)
+                    markPartial("opengrep", reason);
+                else
+                    markCold("opengrep", reason);
+                record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, false, result);
+                return;
+            }
+            if (result.partial) {
+                markPartial("opengrep", result.summary ??
+                    result.reason ??
+                    "opengrep scan coverage is incomplete");
+                record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, true, result);
+                return;
+            }
             cacheManager.writeCache("opengrep", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
+            record("opengrep", opengrepResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
         }),
         // trivy — dependency CVE detection. Explicit opt-in per #131.
         task("trivy", async () => {
@@ -396,7 +512,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             cacheManager.writeCache("trivy", result, analysisRoot, {
                 scanDurationMs: Date.now() - startMs,
             });
-            record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
+            record("trivy", trivyResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true, result);
         }),
         // dead-code — cross-file dead-code for non-JS/TS languages (#127).
         // Each client self-gates via detect(); only matching-language projects
@@ -415,10 +531,13 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
                     recordFailed("dead-code", result);
                     return;
                 }
-                cacheManager.writeCache(cacheKey, result, analysisRoot, {
-                    scanDurationMs: Date.now() - startMs,
-                });
-                record("dead-code", deadCodeResultToProjectDiagnostics(analysisRoot, result), Date.now() - startMs, result.analyzed === true);
+                if (result.analyzed === true) {
+                    cacheManager.writeCache(cacheKey, result, analysisRoot, {
+                        scanDurationMs: Date.now() - startMs,
+                    });
+                }
+                const adapted = deadCodeResultToProjectDiagnostics(analysisRoot, result);
+                record("dead-code", adapted, Date.now() - startMs, result.analyzed === true, result);
             }));
         }),
         // test-runner — CACHE-READ only, unlike every task above (#1004). Its
@@ -494,11 +613,15 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         for (const id of abortedIds)
             pushUnique(cold, id);
         return {
+            analysisRootValidation,
             diagnostics,
             runners,
             analyzed,
+            authoritativeCoverage,
             cold,
             coldReasons,
+            partial,
+            partialReasons,
             failed,
             timings,
             cachedAgeMs,
@@ -509,11 +632,15 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         };
     }
     return {
+        analysisRootValidation,
         diagnostics,
         runners,
         analyzed,
+        authoritativeCoverage,
         cold,
         coldReasons,
+        partial,
+        partialReasons,
         failed,
         timings,
         cachedAgeMs,

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/dead-code.js

@@ -1,4 +1,7 @@
 import * as path from "node:path";
+function deadCodeRunnerId(language) {
+    return `dead-code-${language}`;
+}
 function deadCodeMessage(issue) {
     if (issue.category === "unlisted")
         return `Unlisted dependency ${issue.name}`;
@@ -25,7 +28,7 @@ export function deadCodeIssueToProjectDiagnostic(cwd, issue, language) {
         severity: blocking ? "error" : "warning",
         semantic: blocking ? "blocking" : "warning",
         tool: "dead-code",
-        runner: `dead-code-${language}`,
+        runner: deadCodeRunnerId(language),
         rule: `dead-code:${issue.category}`,
         message: deadCodeMessage(issue),
         source: "project-scan",

package/node_modules/pi-lens/dist/clients/project-diagnostics/scanner.js

@@ -16,6 +16,7 @@ import { logTreeSitter, logTreeSitterCacheStats, } from "../tree-sitter-logger.j
 import { queriesForLanguage, queryLoader, } from "../tree-sitter-query-loader.js";
 import { EXT_TO_LANG, getSharedTreeSitterClient, isTreeSitterWasmAborted, } from "../tree-sitter-shared.js";
 import { PROJECT_DIAGNOSTICS_CACHE_VERSION, saveProjectDiagnosticsSnapshot, } from "./cache.js";
+import { hashDiagnosticContent } from "../lsp/diagnostic-binding.js";
 // Side-effect import: registers fact providers and fact rules.
 import "../dispatch/integration.js";
 // Skip files this large: matches the per-edit ast-grep runner's guard so a single
@@ -111,6 +112,7 @@ async function scanFileMajorRules(cwd, files, signal) {
     const treeSitter = [];
     const factRules = [];
     const astGrep = [];
+    const fingerprints = {};
     const sgModule = await loadSg();
     let phaseOneFilesScanned = 0;
     let astGrepFilesScanned = 0;
@@ -238,13 +240,34 @@ async function scanFileMajorRules(cwd, files, signal) {
                 continue;
             if (langId || factEligible)
                 phaseOneFilesScanned++;
+            // #2154 (#3060 round 2 F1): read the BYTES once, then decode. The
+            // fingerprint below must record the file's ON-DISK length, because
+            // that is what the reader compares against `statSync().size`. A
+            // length taken from the decoded STRING disagrees for every file
+            // holding a byte that is not valid UTF-8 — one such byte decodes to
+            // a 3-byte U+FFFD — so the size check could never match and every
+            // row from that file was retired on every cached read, for a file
+            // nobody touched. That is the DROP direction this store's own
+            // reconcile doc calls the worse one. `buf.length` equals
+            // `stat.size` for every file; both sides then hash the same lossy
+            // decode, so an unchanged file still matches exactly.
             let content;
+            let contentBytes;
             try {
-                content = fs.readFileSync(filePath, "utf-8");
+                const buf = fs.readFileSync(filePath);
+                contentBytes = buf.length;
+                content = buf.toString("utf-8");
             }
             catch {
                 content = null;
+                contentBytes = undefined;
             }
+            // #2154: how many rows existed BEFORE this file was scanned, so the
+            // fingerprint below is written only for files that actually produced
+            // one — the snapshot keeps no row for any other file, and an entry
+            // for a file with no row is dead weight in a record that is read on
+            // every `refreshRunners=cached` call.
+            const rowsBeforeFile = treeSitter.length + factRules.length + astGrep.length;
             try {
                 await scanTreeSitterFile(filePath, langId, content);
                 if (isTreeSitterWasmAborted()) {
@@ -293,6 +316,18 @@ async function scanFileMajorRules(cwd, files, signal) {
                         ...graphIr,
                     });
                 }
+                // #2154: bind this file's rows to the bytes they were computed
+                // from. Only reachable with `content` in hand, which is the point
+                // — the fingerprint must describe what the rules READ, never what
+                // disk holds by the time the scan ends.
+                if (content !== null &&
+                    contentBytes !== undefined &&
+                    treeSitter.length + factRules.length + astGrep.length > rowsBeforeFile) {
+                    fingerprints[filePath] = {
+                        sizeBytes: contentBytes,
+                        contentHash: hashDiagnosticContent(content),
+                    };
+                }
                 filesScanned++;
             }
             finally {
@@ -312,7 +347,14 @@ async function scanFileMajorRules(cwd, files, signal) {
     };
     if (!client) {
         await scan();
-        return { treeSitter, factRules, astGrep, filesScanned, wasmAborted };
+        return {
+            treeSitter,
+            factRules,
+            astGrep,
+            filesScanned,
+            wasmAborted,
+            fingerprints,
+        };
     }
     const startedAt = Date.now();
     await client.withParseCacheMeasurement(scan, (stats) => {
@@ -348,7 +390,14 @@ async function scanFileMajorRules(cwd, files, signal) {
     // `astGrepFilesScanned` still feed the `project_diagnostics_scan` record
     // above (`astGrep` sub-field), so this cost stays observable without a
     // second, always-zero record to carry it.
-    return { treeSitter, factRules, astGrep, filesScanned, wasmAborted };
+    return {
+        treeSitter,
+        factRules,
+        astGrep,
+        filesScanned,
+        wasmAborted,
+        fingerprints,
+    };
 }
 export async function scanProjectDiagnostics(options) {
     const cwd = path.resolve(options.cwd);
@@ -395,6 +444,7 @@ export async function scanProjectDiagnostics(options) {
     // scan stops promptly when the agent/user aborts (#341).
     const runners = [];
     const diagnostics = [];
+    let fileFingerprints = {};
     let wasmAborted = false;
     let filesScanned = files.length;
     if (!signal?.aborted) {
@@ -409,6 +459,11 @@ export async function scanProjectDiagnostics(options) {
             diagnostics.push(...scanned.astGrep);
             runners.push("ast-grep-napi");
         }
+        // #2154: keep a fingerprint only for a file that still has a row after
+        // the ast-grep discard above, so the record cannot claim to describe a
+        // file whose only rows were dropped.
+        const rowFiles = new Set(diagnostics.map((d) => d.filePath));
+        fileFingerprints = Object.fromEntries(Object.entries(scanned.fingerprints).filter(([file]) => rowFiles.has(file)));
     }
     const snapshot = {
         version: PROJECT_DIAGNOSTICS_CACHE_VERSION,
@@ -418,6 +473,7 @@ export async function scanProjectDiagnostics(options) {
         diagnostics,
         filesScanned,
         runners,
+        fileFingerprints,
     };
     // #760: only present when true — keeps existing snapshots/serializations
     // byte-identical for the untruncated (normal) case.

package/node_modules/pi-lens/dist/clients/project-lens-config.js

@@ -63,7 +63,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { toPositiveFinite } from "./env-utils.js";
 import { FRESHNESS_CADENCE_MS } from "./freshness-cadence.js";
-import { assignFlagConfigSection, flagConfigSectionKeys, GLOBAL_NON_FLAG_CONFIG_SECTIONS, LENS_FLAGS, PROJECT_FOREIGN_CONFIG_NAMESPACES, PROJECT_FOREIGN_NAMESPACE_HONORED_KEYS, PROJECT_NON_FLAG_CONFIG_SECTIONS, PROJECT_SCOPED_LENS_FLAGS, readFlagConfigValue, } from "./lens-flag-registry.js";
+import { assignFlagConfigSection, flagConfigSectionKeys, GLOBAL_NON_FLAG_CONFIG_SECTIONS, GLOBAL_ONLY_NON_FLAG_KEYS, hasFlagConfigPath, LENS_FLAGS, PROJECT_FOREIGN_CONFIG_NAMESPACES, PROJECT_FOREIGN_NAMESPACE_HONORED_KEYS, PROJECT_NON_FLAG_CONFIG_SECTIONS, PROJECT_SCOPED_LENS_FLAGS, readFlagConfigValue, } from "./lens-flag-registry.js";
 import { configSearchDirs, getPiLensGlobalConfigPath, PROJECT_CONFIG_BASENAMES, PROJECT_CONFIG_LOCATIONS, } from "./config-locations.js";
 import { deprecationRecords, ignoredRecordCollector, projectLocationFor, readConfigDocument, reportConfigReadFailure, reportPiLensConfigRecords, resolveOnePiLensConfigDocument, } from "./config-resolve.js";
 import { finalizeRecords, } from "./config-core/records.js";
@@ -704,6 +704,15 @@ function parseConfigFile(configPath) {
     // `lsp.enabled`.
     const projectScoped = new Set(PROJECT_SCOPED_LENS_FLAGS.map((spec) => spec.configKey));
     const globalScopeOnlyFlagKeys = LENS_FLAGS.map((spec) => spec.configKey).filter((configKey) => !projectScoped.has(configKey));
+    // Non-flag global-only keys sitting inside an otherwise project-recognized
+    // section (#3131) — `actionableWarnings.autoFix.maxFixes` is not a
+    // `LENS_FLAGS` entry (no CLI flag, not boolean), so it is invisible to the
+    // derivation above. `GLOBAL_ONLY_NON_FLAG_KEYS` is the single place that
+    // population is enumerated instead of a second hand-typed list here.
+    const globalScopeOnlyDottedKeys = [
+        ...globalScopeOnlyFlagKeys,
+        ...GLOBAL_ONLY_NON_FLAG_KEYS,
+    ];
     // The literal path is derived, not hand-typed (#2426 review round 3, S1):
     // under `PI_LENS_CONFIG_PATH` the canonical global config is NOT
     // `~/.pi-lens/config.json`, and a hardcoded string in this notice would name
@@ -735,9 +744,43 @@ function parseConfigFile(configPath) {
             if (honored.includes(key))
                 continue;
             const dotted = `${namespace}.${key}`;
-            warnUnhonoredKey(dotted, globalScopeOnlyFlagKeys.some((configKey) => configKey === dotted || configKey.startsWith(`${dotted}.`)));
+            warnUnhonoredKey(dotted, globalScopeOnlyDottedKeys.some((configKey) => configKey === dotted || configKey.startsWith(`${dotted}.`)));
         }
     }
+    // MIXED-SCOPE SECTIONS (#3112, #3131). A section can be project-scoped as a
+    // whole and still hold a global-only setting: `tools` carries the
+    // project-owned per-tool `enabled` leaves AND the global `tools.lazy`
+    // (`--no-lazy-tools`), the same split `lsp` has (#2426 review round 2, F3);
+    // `actionableWarnings` carries the project-owned `autoFix.enabled` AND the
+    // global-only `autoFix.maxFixes`, which is not even a flag (#3131). The
+    // top-level scan above sees only the SECTION name, so a global-only setting
+    // written inside a recognized project section was dropped with no signal at
+    // all — the thing `docs/configuration.md` promises never happens.
+    //
+    // WHICH sub-keys those are is DERIVED from the registry — `LENS_FLAGS` for
+    // flag keys, `GLOBAL_ONLY_NON_FLAG_KEYS` for the rest — never listed here,
+    // so there is no second scope table to drift from the first. A key whose
+    // SECTION is not recognized at project scope is skipped: the top-level
+    // scan already reported that whole section, and a second notice naming the
+    // same setting twice under two spellings is the duplicate-notice noise #2426
+    // review round 6 removed. Everything else under a recognized section is left
+    // to that section's own parser — `readToolConfig` reports an unknown tool
+    // name under its own code (`PILENS_CFG_0009`).
+    //
+    // An enumerated-honored-keys namespace (`lsp`) needs no skip here: the loop
+    // above reports the very same dotted key with the very same reason, and
+    // `warnIgnoredConfigOnce`'s latch collapses the two into one notice. A skip
+    // for it was written and then deleted — mutating it out changed no output.
+    for (const configKey of globalScopeOnlyDottedKeys) {
+        const dotIndex = configKey.indexOf(".");
+        if (dotIndex < 0)
+            continue;
+        if (!knownProjectKeys.has(configKey.slice(0, dotIndex)))
+            continue;
+        if (!hasFlagConfigPath(obj, configKey))
+            continue;
+        warnUnhonoredKey(configKey, true);
+    }
     return {
         config: {
             ...(toolConfig === undefined ? {} : { tools: toolConfig }),