@herbertgao/pi-extensions 2026.9.7 → 2026.9.9

package/node_modules/pi-lens/dist/index.js

@@ -2041,16 +2041,17 @@ function adoptCanonicalCasing(held, canonical) {
 function normalizeFilePath(filePath) {
   const normalized = filePath.replace(/\\/g, "/");
   if (process.platform !== "win32" && !isWindowsPath(normalized)) {
+    const folded = normalized === "" || normalized.startsWith("//") ? normalized : path2.posix.normalize(normalized);
     try {
-      const canonical = realpathSync.native(normalized);
-      if (canonical === normalized)
-        return normalized;
-      const adopted = adoptCanonicalCasing(normalized, canonical);
-      if (adopted === normalized)
-        return normalized;
-      return realpathSync.native(adopted) === canonical ? adopted : normalized;
+      const canonical = realpathSync.native(folded);
+      if (canonical === folded)
+        return folded;
+      const adopted = adoptCanonicalCasing(folded, canonical);
+      if (adopted === folded)
+        return folded;
+      return realpathSync.native(adopted) === canonical ? adopted : folded;
     } catch {
-      return normalized;
+      return folded;
     }
   }
   try {
@@ -3744,6 +3745,9 @@ function inCaptureWindow(fn) {
 function isCaptureSeam(prop) {
   return prop === "on" || typeof prop === "string" && prop.startsWith("register");
 }
+function isCallableSchema(value) {
+  return typeof value === "function" && typeof value.toJsonSchema === "function" && typeof value.assert === "function";
+}
 function wrapFunctionsInPlace(value) {
   if (typeof value === "function") {
     return inCaptureWindow(value);
@@ -3754,7 +3758,7 @@ function wrapFunctionsInPlace(value) {
   const obj = value;
   for (const key4 of Object.keys(obj)) {
     const propValue = obj[key4];
-    if (typeof propValue === "function") {
+    if (typeof propValue === "function" && !isCallableSchema(propValue)) {
       assignWrapped(obj, key4, propValue);
     }
   }
@@ -6413,7 +6417,7 @@ var require_parallel = __commonJS({
 var require_cpu = __commonJS({
   "node_modules/pidusage/lib/helpers/cpu.js"(exports, module) {
     var os37 = __require("os");
-    var fs134 = __require("fs");
+    var fs135 = __require("fs");
     var exec = __require("child_process").exec;
     var parallel = require_parallel();
     function updateCpu(cpu, next) {
@@ -6440,7 +6444,7 @@ var require_cpu = __commonJS({
     }
     module.exports = updateCpu;
     function getRealUptime(next) {
-      fs134.readFile("/proc/uptime", "utf8", function(err, uptime) {
+      fs135.readFile("/proc/uptime", "utf8", function(err, uptime) {
         if (err || uptime === void 0) {
           if (!process.env.PIDUSAGE_SILENT) {
             console.warn("[pidusage] We couldn't find uptime from /proc/uptime, using os.uptime() value");
@@ -6546,7 +6550,7 @@ var require_safe_buffer = __commonJS({
 // node_modules/pidusage/lib/procfile.js
 var require_procfile = __commonJS({
   "node_modules/pidusage/lib/procfile.js"(exports, module) {
-    var fs134 = __require("fs");
+    var fs135 = __require("fs");
     var path211 = __require("path");
     var updateCpu = require_cpu();
     var parallel = require_parallel();
@@ -6560,11 +6564,11 @@ var require_procfile = __commonJS({
       if (history2.fd) {
         return cb(null, history2.fd);
       }
-      fs134.open(path212, "r", cb);
+      fs135.open(path212, "r", cb);
     }
     function close(history2) {
       if (history2.fd) {
-        fs134.close(history2.fd, noop);
+        fs135.close(history2.fd, noop);
       }
     }
     function readUntilEnd(fd, buf, cb) {
@@ -6574,7 +6578,7 @@ var require_procfile = __commonJS({
         buf = Buffer2.alloc(SIZE);
         firstRead = true;
       }
-      fs134.read(fd, buf, 0, SIZE, 0, function(err, bytesRead, buffer) {
+      fs135.read(fd, buf, 0, SIZE, 0, function(err, bytesRead, buffer) {
         if (err) {
           cb(err);
           return;
@@ -6857,7 +6861,7 @@ var require_gwmi = __commonJS({
 var require_stats = __commonJS({
   "node_modules/pidusage/lib/stats.js"(exports, module) {
     "use strict";
-    var fs134 = __require("fs");
+    var fs135 = __require("fs");
     var os37 = __require("os");
     var spawn3 = __require("child_process").spawn;
     var requireMap = {
@@ -6881,7 +6885,7 @@ var require_stats = __commonJS({
       win: "wmic"
     };
     var platform = os37.platform();
-    if (fs134.existsSync("/etc/alpine-release")) {
+    if (fs135.existsSync("/etc/alpine-release")) {
       platform = "alpine";
     }
     if (platform.match(/^win/)) {
@@ -15822,8 +15826,8 @@ var init_path_keyed_map = __esm({
        * already-resident path is an update, and must not drop an unrelated file
        * to make room for a key that needs none.
        */
-      constructor(normalize3, maxEntries) {
-        this.normalize = normalize3;
+      constructor(normalize2, maxEntries) {
+        this.normalize = normalize2;
         this.store = maxEntries === void 0 ? /* @__PURE__ */ new Map() : new BoundedFifoMap(maxEntries);
       }
       get size() {
@@ -18256,7 +18260,7 @@ function createGenerationSource(name) {
 }
 function createGenerationMap(name, options = {}) {
   declare(name);
-  const normalize3 = options.normalizeKey ?? ((key4) => key4);
+  const normalize2 = options.normalizeKey ?? ((key4) => key4);
   const maxKeys = Math.max(1, options.maxKeys ?? DEFAULT_MAX_KEYS);
   const stamps = new BoundedFifoMap(maxKeys);
   let nextTicket = 0;
@@ -18272,25 +18276,25 @@ function createGenerationMap(name, options = {}) {
   return {
     name,
     current(key4) {
-      return read(normalize3(key4));
+      return read(normalize2(key4));
     },
     bump(key4) {
       invalidations += 1;
-      return issue(normalize3(key4));
+      return issue(normalize2(key4));
     },
     capture(key4) {
-      const normalized = normalize3(key4);
+      const normalized = normalize2(key4);
       const stamp2 = read(normalized) || issue(normalized);
       const capturedInvalidations = invalidations;
       return makeHandle(`${name}[${normalized}]`, stamp2, () => {
         if (invalidations === capturedInvalidations)
           return stamp2;
-        return read(normalize3(key4));
+        return read(normalize2(key4));
       });
     },
     forget(key4) {
       invalidations += 1;
-      stamps.delete(normalize3(key4));
+      stamps.delete(normalize2(key4));
     },
     clear() {
       invalidations += 1;
@@ -31632,13 +31636,13 @@ async function findAncestorFile(startDir, ...relativeSegments) {
   return findAncestorFileAmong(startDir, [relativeSegments]);
 }
 async function findAncestorFileAmong(startDir, candidateSegmentLists) {
-  const fs134 = await import("node:fs/promises");
+  const fs135 = await import("node:fs/promises");
   let currentDir = path50.resolve(startDir);
   while (!isAtOrAboveHomeDir(currentDir)) {
     for (const segments of candidateSegmentLists) {
       const candidate = path50.join(currentDir, ...segments);
       try {
-        await fs134.access(candidate);
+        await fs135.access(candidate);
         return candidate;
       } catch {
       }
@@ -31692,13 +31696,13 @@ async function typescriptVersionForTsc(tscPath) {
   return void 0;
 }
 async function findTsserverPath(root, allowInstall) {
-  const fs134 = await import("node:fs/promises");
+  const fs135 = await import("node:fs/promises");
   const ancestorHit = await findAncestorFile(root, "node_modules", "typescript", "lib", "tsserver.js");
   if (ancestorHit)
     return ancestorHit;
   const cwdCandidate = path50.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
   try {
-    await fs134.access(cwdCandidate);
+    await fs135.access(cwdCandidate);
     return cwdCandidate;
   } catch {
   }
@@ -31708,7 +31712,7 @@ async function findTsserverPath(root, allowInstall) {
     for (const dir of typescriptDirsForTsc(tscPath)) {
       const candidate = path50.join(dir, "lib", "tsserver.js");
       try {
-        await fs134.access(candidate);
+        await fs135.access(candidate);
         return candidate;
       } catch {
       }
@@ -32203,7 +32207,7 @@ var init_server = __esm({
       root: TypeScriptRoot,
       rootMarkers: TypeScriptRoot.rootMarkers,
       async spawn(root, options) {
-        const fs134 = await import("node:fs/promises");
+        const fs135 = await import("node:fs/promises");
         const nativeLsp = await findNativeTypeScriptLsp(root);
         if (nativeLsp) {
           const env2 = await getToolEnvironment();
@@ -32233,7 +32237,7 @@ var init_server = __esm({
         if (!tsserverPath) {
           const localCandidate = path50.join(path50.dirname(lspPath), "..", "typescript", "lib", "tsserver.js");
           try {
-            await fs134.access(localCandidate);
+            await fs135.access(localCandidate);
             tsserverPath = localCandidate;
           } catch {
           }
@@ -57915,7 +57919,7 @@ var require_main = __commonJS({
     ril_1.default.install();
     var path211 = __importStar(__require("path"));
     var os37 = __importStar(__require("os"));
-    var fs134 = __importStar(__require("fs"));
+    var fs135 = __importStar(__require("fs"));
     var crypto_1 = __require("crypto");
     var net_1 = __require("net");
     var api_1 = require_api();
@@ -58056,7 +58060,7 @@ var require_main = __commonJS({
       }
       let randomLength = 32;
       const fixedLength = "/lsp-.sock".length;
-      const tmpDir = fs134.realpathSync(XDG_RUNTIME_DIR ?? os37.tmpdir());
+      const tmpDir = fs135.realpathSync(XDG_RUNTIME_DIR ?? os37.tmpdir());
       const limit = safeIpcPathLengths.get(process.platform);
       if (limit !== void 0) {
         randomLength = Math.min(limit - tmpDir.length - fixedLength, randomLength);
@@ -66137,6 +66141,7 @@ var init_lsp = __esm({
           let auxUnconfirmedServerIds;
           let lateDeliveryServerIds;
           let tsserverSyncEligible = false;
+          const isWarmupTouch = source === "lsp_sweep_warmup";
           let tsserverSyncConfirmed;
           let diagnosticsUnsupportedServerIds = [];
           if (diagnosticsMode !== "none") {
@@ -66209,7 +66214,7 @@ var init_lsp = __esm({
               timeoutFor = () => callerCap ?? modeFloor;
             }
             const timeoutMs = Math.max(0, ...spawned.filter((e) => !deferredResyncServerIds.has(e.info.id)).map((e) => timeoutFor(e.client.serverId)));
-            if (!notifyWriteTimedOut && options.collectDiagnostics === true && clientScope === "primary" && spawned.length === 1 && spawned[0].client.serverId === "typescript" && getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
+            if (!notifyWriteTimedOut && (options.collectDiagnostics === true || isWarmupTouch) && clientScope === "primary" && spawned.length === 1 && spawned[0].client.serverId === "typescript" && getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
               try {
                 const snapshots = await this.getCapabilitySnapshots(filePath);
                 tsserverSyncEligible = classifyCascadeWaitTier(this, filePath, snapshots) === "tier3-silent";
@@ -66283,7 +66288,6 @@ var init_lsp = __esm({
               const serverTimeout = perServerWaitTimeouts[entryIndex];
               const baseline = diagnosticBaselines.get(entry.client);
               const pullOnly = classifyServerWaitTier(entry.client.serverId, pressureSnapshots.find((snapshot) => snapshot.serverId === entry.client.serverId)) === "pull-capable";
-              const isWarmupTouch = source === "lsp_sweep_warmup";
               const waitForDiagnostics = () => !notifySkippedServerIds.has(entry.info.id) && Number.isFinite(baseline) ? entry.client.waitForDiagnostics(filePath, serverTimeout, {
                 minVersion: baseline,
                 ...pullOnly && { pullOnly: true },
@@ -66712,7 +66716,17 @@ var init_lsp = __esm({
           if (diagnosticsTimedOut && // #1549: primary-scoped, like the aggregate gate. `spawned.length === 1`
           // below means the one server IS the primary, so this is the same condition
           // written in the vocabulary the rest of the merge now uses.
-          !primaryNotifyWriteTimedOut && !tsserverSyncEligible && clientScope === "primary" && spawned.length === 1 && getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
+          !primaryNotifyWriteTimedOut && // #3187: the warm-up is sync-ELIGIBLE now, and eligibility alone must
+          // not cost it this fallback. For a collecting touch the exclusion is
+          // #707's contract (the end-of-wait retry above is typescript's second
+          // chance, and failing it stays inconclusive); the warm-up collects
+          // nothing, so that retry's `collected !== undefined` precondition can
+          // never hold for it and the exclusion would leave a server whose
+          // `typescript.tsserverRequest` is unavailable stranded inconclusive —
+          // a #744 warm-up failure, its retry, and a SKIPPED sweep group, where
+          // today it is certified clean. Reaching here at all means the race
+          // produced no answer, so this decides nothing the sync already decided.
+          (!tsserverSyncEligible || isWarmupTouch) && clientScope === "primary" && spawned.length === 1 && getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
             try {
               const snapshots = await this.getCapabilitySnapshots(filePath);
               if (classifyCascadeWaitTier(this, filePath, snapshots) === "tier3-silent") {
@@ -68057,6 +68071,13 @@ var init_lsp = __esm({
           });
           const warmupAttempt = this.touchFile(representativeFile, content, {
             diagnostics: "document",
+            // #3187: stays FALSE. This touch wants a verdict, not findings: its
+            // `clientScope: "primary"` evidence does not speak for the auxiliaries
+            // the sweep's own `clientScope: "all"` touch waits on, so collecting
+            // here would prime this file's `lastKnownDiagnostics` from a narrower
+            // scope than the result that follows (and an empty confirm would delete
+            // a previously confirmed record). `touchFile`'s sync-confirm gates key
+            // off `source` instead, so the verdict still arrives at ~grace+RTT.
             collectDiagnostics: false,
             clientScope: "primary",
             source: "lsp_sweep_warmup",
@@ -71656,8 +71677,39 @@ var init_blocker_freshness = __esm({
   }
 });
 
-// dist/clients/disposition-logger.js
+// dist/clients/finding-identity.js
+import { createHash as createHash14 } from "node:crypto";
 import * as path101 from "node:path";
+function normalizeMessage(message) {
+  return message.replace(/\s+/g, " ").trim().toLowerCase();
+}
+function hashText(value, length = FINDING_ID_HASH_LENGTH) {
+  return createHash14("sha256").update(value).digest("hex").slice(0, length);
+}
+function relativeFile(filePath, cwd) {
+  const canonicalCwd = normalizeMapKey(cwd);
+  const canonicalFile = normalizeMapKey(filePath);
+  const rel = path101.relative(canonicalCwd, canonicalFile).replace(/\\/g, "/");
+  return rel && !rel.startsWith("..") ? rel : canonicalFile;
+}
+function stableFindingId(prefix, args) {
+  const joined = [
+    relativeFile(args.filePath, args.cwd),
+    ...args.parts.map((part) => part === void 0 || part === null ? "" : String(part))
+  ].join("|");
+  return `${prefix}${hashText(joined)}`;
+}
+var FINDING_ID_HASH_LENGTH;
+var init_finding_identity = __esm({
+  "dist/clients/finding-identity.js"() {
+    "use strict";
+    init_path_utils();
+    FINDING_ID_HASH_LENGTH = 12;
+  }
+});
+
+// dist/clients/disposition-logger.js
+import * as path102 from "node:path";
 function logDispositionEvent(entry) {
   if (isTestMode()) {
     return;
@@ -71672,8 +71724,8 @@ var init_disposition_logger = __esm({
     init_probe_home_state();
     init_ndjson_logger();
     DISPOSITION_LOG_DIR = getGlobalPiLensLogDir();
-    DISPOSITION_LOG_FILE = path101.join(DISPOSITION_LOG_DIR, "dispositions.log");
-    DISPOSITION_LOG_BACKUP_FILE = path101.join(DISPOSITION_LOG_DIR, "dispositions.log.1");
+    DISPOSITION_LOG_FILE = path102.join(DISPOSITION_LOG_DIR, "dispositions.log");
+    DISPOSITION_LOG_BACKUP_FILE = path102.join(DISPOSITION_LOG_DIR, "dispositions.log.1");
     MAX_LOG_BYTES2 = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_DISPOSITION_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
     writer7 = createNdjsonLogger({
       filePath: DISPOSITION_LOG_FILE,
@@ -71684,7 +71736,7 @@ var init_disposition_logger = __esm({
 });
 
 // dist/clients/bus-events-logger.js
-import * as path102 from "node:path";
+import * as path103 from "node:path";
 function bumpRollupCount(event, outcome) {
   const existing = eventRollupCounts.get(event) ?? {
     emitted: 0,
@@ -71727,7 +71779,7 @@ var init_bus_events_logger = __esm({
     init_ndjson_logger();
     init_log_cleanup();
     init_latency_logger();
-    BUS_EVENTS_LOG_FILE = path102.join(getGlobalPiLensLogDir(), "bus-events.log");
+    BUS_EVENTS_LOG_FILE = path103.join(getGlobalPiLensLogDir(), "bus-events.log");
     writer8 = createNdjsonLogger({
       filePath: BUS_EVENTS_LOG_FILE,
       maxBytes: getMaxLogSizeMB() * 1024 * 1024
@@ -71738,9 +71790,9 @@ var init_bus_events_logger = __esm({
 
 // dist/clients/recent-touches.js
 import * as fs81 from "node:fs";
-import * as path103 from "node:path";
+import * as path104 from "node:path";
 function recentTouchesPath(cwd) {
-  return path103.join(getProjectDataDir(cwd), "recent-touches.json");
+  return path104.join(getProjectDataDir(cwd), "recent-touches.json");
 }
 function isRecentTouchesEnabled() {
   if (_enabledCache2 === void 0) {
@@ -72294,37 +72346,6 @@ var init_disposition_publish = __esm({
   }
 });
 
-// dist/clients/finding-identity.js
-import { createHash as createHash14 } from "node:crypto";
-import * as path104 from "node:path";
-function normalizeMessage(message) {
-  return message.replace(/\s+/g, " ").trim().toLowerCase();
-}
-function hashText(value, length = FINDING_ID_HASH_LENGTH) {
-  return createHash14("sha256").update(value).digest("hex").slice(0, length);
-}
-function relativeFile(filePath, cwd) {
-  const canonicalCwd = normalizeMapKey(cwd);
-  const canonicalFile = normalizeMapKey(filePath);
-  const rel = path104.relative(canonicalCwd, canonicalFile).replace(/\\/g, "/");
-  return rel && !rel.startsWith("..") ? rel : canonicalFile;
-}
-function stableFindingId(prefix, args) {
-  const joined = [
-    relativeFile(args.filePath, args.cwd),
-    ...args.parts.map((part) => part === void 0 || part === null ? "" : String(part))
-  ].join("|");
-  return `${prefix}${hashText(joined)}`;
-}
-var FINDING_ID_HASH_LENGTH;
-var init_finding_identity = __esm({
-  "dist/clients/finding-identity.js"() {
-    "use strict";
-    init_path_utils();
-    FINDING_ID_HASH_LENGTH = 12;
-  }
-});
-
 // dist/clients/diagnostic-dispositions.js
 import * as fs82 from "node:fs";
 import * as path105 from "node:path";
@@ -72629,6 +72650,8 @@ function fileMapKey(filePath) {
   return normalizeEphemeralMapKey(filePath);
 }
 function isBlocking(d) {
+  if (d.disposition)
+    return false;
   if (d.stale)
     return false;
   if (d.semantic === "blocking")
@@ -72680,20 +72703,24 @@ function reconcileWidgetDisposition(cwd, target, _disposition, content) {
     }
   }
   const active = new Set(applyDispositions(current, cwd, target.filePath, source));
-  const normalized = current.map((diagnostic) => {
+  const normalized = current.flatMap((diagnostic) => {
     const { strict, weak } = anchorsForDiagnostic(cwd, target.filePath, diagnostic, source);
     const entry = getDisposition(cwd, strict) ?? getDisposition(cwd, weak);
     if (!active.has(diagnostic) && (entry?.disposition === "false-positive" || entry?.disposition === "suppress")) {
-      return { ...diagnostic, disposition: entry.disposition, flagged: false };
+      return [
+        { ...diagnostic, disposition: entry.disposition, flagged: false }
+      ];
     }
+    if (diagnostic.suppressedRetained)
+      return [];
     const { disposition: _disposition2, flagged: _flagged, ...baseDiagnostic } = diagnostic;
-    return entry?.disposition === "flagged" ? { ...baseDiagnostic, flagged: true } : baseDiagnostic;
+    return entry?.disposition === "flagged" ? [{ ...baseDiagnostic, flagged: true }] : [baseDiagnostic];
   });
   const rec = getOrCreate(target.filePath);
   const writeIndex = admitWidgetDiagnosticsWrite(target.filePath);
   if (!diagnosticsWriteGuard.shouldWrite(fileMapKey(target.filePath), writeIndex))
     return;
-  commitDiagnostics(rec, target.filePath, normalized, Date.now());
+  commitDiagnostics(rec, target.filePath, normalized, Date.now(), fileMapKey(target.filePath), false);
 }
 function admitWidgetDiagnosticsWrite(filePath, writeIndex) {
   const key4 = fileMapKey(filePath);
@@ -72858,7 +72885,35 @@ function normalizeDiagnostics(filePath, diagnostics, observedTs) {
     };
   });
 }
-function commitDiagnostics(rec, filePath, normalized, observedAt, key4 = fileMapKey(filePath)) {
+function retentionIdentity(d) {
+  return JSON.stringify([
+    d.tool ?? "",
+    d.rule ?? "",
+    normalizeMessage(d.message)
+  ]);
+}
+function retainSuppressedRows(previous, incoming, filePath) {
+  const tagged = previous.filter((d) => d.disposition !== void 0);
+  if (tagged.length === 0)
+    return incoming;
+  const reported = new Set(incoming.map(retentionIdentity));
+  const retained = tagged.filter((d) => !reported.has(retentionIdentity(d)));
+  if (retained.length > MAX_RETAINED_SUPPRESSED_PER_FILE) {
+    retained.sort((a, b) => (b.observedAt ?? 0) - (a.observedAt ?? 0));
+    recordDegradationOnce({
+      kind: "widget-suppressed-retention-capped",
+      subject: filePath,
+      reason: `${retained.length - MAX_RETAINED_SUPPRESSED_PER_FILE} suppressed row(s) beyond the ${MAX_RETAINED_SUPPRESSED_PER_FILE}-row per-file retention cap are no longer counted by the footer chip`
+    });
+    retained.length = MAX_RETAINED_SUPPRESSED_PER_FILE;
+  }
+  return [
+    ...incoming,
+    ...retained.map((d) => d.suppressedRetained ? d : { ...d, suppressedRetained: true })
+  ];
+}
+function commitDiagnostics(rec, filePath, incoming, observedAt, key4 = fileMapKey(filePath), retainSuppressed = true) {
+  const normalized = retainSuppressed ? retainSuppressedRows(rec.allDiagnostics, incoming, filePath) : incoming;
   rec.diagnosticCounts = countDiagnostics(normalized);
   rec.diagnostics = capStoredDiagnostics(normalized);
   rec.allDiagnostics = normalized;
@@ -73149,6 +73204,16 @@ function getFileDiagnosticSummaries() {
     };
   });
 }
+function countRetainedSuppressedRows(filePath) {
+  const rec = files.get(fileMapKey(filePath));
+  if (!rec)
+    return 0;
+  let n = 0;
+  for (const d of rec.allDiagnostics)
+    if (d.suppressedRetained)
+      n += 1;
+  return n;
+}
 function getFileDiagnostics(filePath) {
   const rec = files.get(fileMapKey(filePath));
   if (!rec)
@@ -73459,7 +73524,7 @@ function dedupeByBasename(recs) {
   }
   return [...seen.values()].sort((a, b) => b.touchedAt - a.touchedAt);
 }
-var files, sessionLanguages, requestRenderFn, diagnosticsWriteGuard, runnerWriteGuard, MAX_STORED_DIAGNOSTICS_PER_FILE, MAX_INACTIVE_FILE_RECORDS, ACTIVE_FILE_IDLE_MS, MAX_LSP_SERVER_RECORDS, lspServers, nextInactivePruneSize, renderedDependencyDriftFiles, WIDGET_STATE_VERSION, staleReconcileTimer, STALE_RECONCILE_DEBOUNCE_MS, HORIZONTAL_MIN_WIDTH;
+var files, sessionLanguages, requestRenderFn, diagnosticsWriteGuard, runnerWriteGuard, MAX_STORED_DIAGNOSTICS_PER_FILE, MAX_RETAINED_SUPPRESSED_PER_FILE, MAX_INACTIVE_FILE_RECORDS, ACTIVE_FILE_IDLE_MS, MAX_LSP_SERVER_RECORDS, lspServers, nextInactivePruneSize, renderedDependencyDriftFiles, WIDGET_STATE_VERSION, staleReconcileTimer, STALE_RECONCILE_DEBOUNCE_MS, HORIZONTAL_MIN_WIDTH;
 var init_widget_state = __esm({
   "dist/clients/widget-state.js"() {
     "use strict";
@@ -73470,6 +73535,7 @@ var init_widget_state = __esm({
     init_tui_fit();
     init_write_ordering_guard();
     init_blocker_freshness();
+    init_finding_identity();
     init_freshness();
     init_diagnostic_line_freshness();
     init_stale_marker();
@@ -73481,6 +73547,7 @@ var init_widget_state = __esm({
     diagnosticsWriteGuard = new WriteOrderingGuard();
     runnerWriteGuard = new WriteOrderingGuard();
     MAX_STORED_DIAGNOSTICS_PER_FILE = 12;
+    MAX_RETAINED_SUPPRESSED_PER_FILE = 12;
     MAX_INACTIVE_FILE_RECORDS = 1024;
     ACTIVE_FILE_IDLE_MS = 30 * 6e4;
     MAX_LSP_SERVER_RECORDS = 128;
@@ -76024,6 +76091,194 @@ var init_finding_policy = __esm({
   }
 });
 
+// dist/clients/finding-delivery-gate.js
+function markUnreconciledFindings(findings) {
+  return findings.map((finding) => ({ ...finding, stale: true }));
+}
+function formatCacheAgeLabel(scannedAt, nowMs = Date.now()) {
+  if (scannedAt === void 0 || scannedAt === null || scannedAt === "") {
+    return "scan age unknown";
+  }
+  const scannedAtMs = typeof scannedAt === "number" ? scannedAt : Date.parse(scannedAt);
+  if (!Number.isFinite(scannedAtMs))
+    return "scan age unknown";
+  const ageMs = Math.max(0, nowMs - scannedAtMs);
+  const ageMinutes = Math.round(ageMs / MS_PER_MINUTE);
+  if (ageMinutes < 1)
+    return "scanned <1m ago";
+  if (ageMinutes < 60)
+    return `scanned ${ageMinutes}m ago`;
+  const ageHours = Math.floor(ageMinutes / 60);
+  const remMinutes = ageMinutes % 60;
+  return remMinutes === 0 ? `scanned ${ageHours}h ago` : `scanned ${ageHours}h ${remMinutes}m ago`;
+}
+function gated(file, description, gates, evidence, extra = {}) {
+  return { mode: "gated", file, description, gates, evidence, ...extra };
+}
+function labeled(file, description, reason, ageSource, evidence = [], extra = {}) {
+  return {
+    mode: "labeled",
+    file,
+    description,
+    reason,
+    ageSource,
+    evidence,
+    ...extra
+  };
+}
+var MS_PER_MINUTE, RUNTIME_TURN_FILE, LENS_DIAGNOSTICS_FILE, DELIVERY_SURFACES;
+var init_finding_delivery_gate = __esm({
+  "dist/clients/finding-delivery-gate.js"() {
+    "use strict";
+    MS_PER_MINUTE = 6e4;
+    RUNTIME_TURN_FILE = "clients/runtime-turn.ts";
+    LENS_DIAGNOSTICS_FILE = "tools/lens-diagnostics.ts";
+    DELIVERY_SURFACES = {
+      "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F534} secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ['store: "gitleaks"']),
+      "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F534} secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ['store: "trivy-secrets"']),
+      "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F6E1}\uFE0F Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ['store: "govulncheck"']),
+      // Two tagged seams (the stale and live render branches below the same
+      // `sweepInlineBlockerFreshness` call) legitimately share one evidence
+      // occurrence — evidenceMin: 2 tells the exclusive-assignment check both
+      // are expected claimants, not a rogue seam contesting the real one.
+      "runtime-turn:unresolved-inline-blocker": gated(
+        RUNTIME_TURN_FILE,
+        "Turn-end re-surfaced unresolved inline blockers.",
+        ["sweepInlineBlockerFreshness"],
+        // #1790: the call now passes `additionalEntries` (widget-store rows) as a
+        // third argument, so the literal is the call's opening rather than the
+        // whole single-line invocation.
+        ["sweepInlineBlockerFreshness(runtime, cwd, {"],
+        { evidenceMin: 2 }
+      ),
+      // Same two gate calls as the live secrets tier — this tier renders their
+      // `.stale` arm, so it has no OWN gate call to point at.
+      "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F511} demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ['store: "gitleaks"', 'store: "trivy-secrets"']),
+      // The evidence below is the literal header FRAGMENT including the
+      // interpolation — proves the label is actually rendered, not merely
+      // computed and discarded (review round F1's "deleted the age
+      // interpolations" attack).
+      "runtime-turn:trivy-critical-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F534} CRITICAL dependency CVE blocker (trivy).", "Package-pinned finding with no cited file:line to stat \u2014 freshness has nothing to check drift against. The session_start cache can be arbitrarily old, so its age is stated instead. Also routes through `filterFindingsByDisposition` (#1625) first \u2014 a suppressed/false-positive finding never reaches this render, so the age label and the disposition filter compose rather than substitute for each other.", "TrivyResult.scannedAt", ["CRITICAL dependency CVEs (trivy, ${trivyAgeLabel}"]),
+      "runtime-turn:trivy-cve-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F6E1}\uFE0F non-critical dependency CVE advisory (trivy).", "Same package-pinned shape and #1625 disposition composition as the CRITICAL blocker above.", "TrivyResult.scannedAt", ["Dependency CVEs (trivy, ${trivyAgeLabel}"]),
+      "runtime-turn:trivy-license-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F4DC} dependency license-risk advisory (trivy).", "Same package-pinned shape as the CRITICAL blocker above.", "TrivyResult.scannedAt", ["Dependency license risk (trivy, ${trivyAgeLabel}"]),
+      "runtime-turn:dead-code-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end dead-code delta advisory (knip/vulture/etc).", "The delta shown is computed from THIS turn's own analyze() call, diffed against the previous cache \u2014 never a replay of a stale cache.", "live"),
+      "runtime-turn:knip-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F534} Knip unresolved-imports/deps blocker.", "Same shape as the dead-code advisory: `await knipClient.analyze(cwd, ...)` runs fresh THIS turn, diffed against the previous cache and filtered to files edited this turn \u2014 never a replay of a stale cache.", "live"),
+      "runtime-turn:knip-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u26A0\uFE0F Knip newly-unused-exports advisory.", "Same live-this-turn shape as the Knip blocker above.", "live"),
+      "runtime-turn:actionable-warnings-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end actionable-warnings advisory (ast-grep etc).", "`peekActionableWarnings` reads `_actionableWarningsThisTurn` \u2014 recorded fresh from this turn's own dispatch, never a cross-turn cache.", "live"),
+      "runtime-turn:code-quality-warnings-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end code-quality-warnings advisory.", "`peekCodeQualityWarnings` reads `_codeQualityWarningsThisTurn` \u2014 the same per-turn accumulator shape as actionable-warnings above.", "live"),
+      "runtime-turn:disposition-suppressed-notice": labeled(RUNTIME_TURN_FILE, "Turn-end running disposition-suppressed-count notice (#1616).", "A live running total accumulated from this turn's own gate/disposition calls above (`dispositionSuppressedTotal`) \u2014 telemetry ABOUT the other gated surfaces, not a cache of its own.", "live"),
+      // #2001/#2002 collect-later: findings an auxiliary LSP published AFTER its
+      // aux-grace window expired, probed from the client cache at the next
+      // turn_end. Gated on the mark timestamp: a cited file deleted or edited
+      // since the mark drops its findings (never delivered before, and the
+      // drifting edit already re-touched the file — a fresh pending pair
+      // supersedes this one), with both drop arms counted in the
+      // `late_auxiliary_findings` latency record rather than silenced.
+      //
+      // #3102: freshness is only half the gate. The survivors also take the shared
+      // `clients/dispatch/finding-policy.ts` stack (inline `pi-lens-ignore` →
+      // stored dispositions → `.pi-lens.json` rule policy) the per-edit dispatcher,
+      // `mode=full` and the `source=lsp` probe lane apply — without it a finding
+      // the agent marked `false-positive` re-reported on every drain. Per #3088
+      // round-2 F4, the evidence is the CALL TEXT of that filter, which exists
+      // nowhere else in this file: a bare `applyFindingPolicy` would also be
+      // satisfied by an import line or an unrelated caller.
+      "runtime-turn:late-auxiliary-findings": gated(RUNTIME_TURN_FILE, "Turn-end late-auxiliary LSP findings (collect-later probe of aux client caches whose grace window expired).", ["gateFindingsByPathFreshness", "applyFindingPolicy"], ['store: "late-auxiliary-findings"', "applyFindingPolicy(gate.live, {"]),
+      "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness"], ['store: "late-runner-findings"'], { evidenceMin: 2 }),
+      "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F9EA} cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible (`settleCascadeRuns`), but an unsettled compute can carry over to a later turn (bounded by a carry cap) \u2014 a carried-over result renders with an explicit `(carried N turns \xB7 scanned Xm ago)` label (#3167, #3168 F3), so the agent can tell it from a fresh observation.", "live", ["cascadeCarrySuffix("], { evidenceMin: 1 }),
+      "runtime-turn:cascade-coverage-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end cascade-coverage-gap advisories (graph/binding/budget).", "Explains what the cascade check could NOT confirm this turn \u2014 not a finding with a cited path, an absence-of-coverage disclosure computed from this turn's own indeterminate-run list. An advisory computed from a carried indeterminate run is labeled `(carried N turns \xB7 <age>)` (#3167, #3168 F4 \u2014 dropped on mixed carried/fresh buckets). The age half reads `scan age unknown` on this surface today: no indeterminate-run producer stamps `observedAt` (only the resolved-found plumb does, `clients/cascade-format.ts`), and one unstamped carried run collapses the whole bucket's age rather than claiming the stamped runs' (#3168 F13). The carry COUNT is always real.", "live", ["withCarryLabel("], { evidenceMin: 3 }),
+      // #3102: the cold-neighbour cascade run is BUILT here, in the quiet-window
+      // reconcile (`onResolvedFound` in index.ts), a turn earlier than the
+      // `runtime-turn:cascade-blocker` render that finally carries it — so it is
+      // its own delivery lane, and it was the one that rendered raw LSP findings
+      // with no policy filter at all. The evidence is the CALL TEXT of the shared
+      // filter (#3088 round-2 F4): a bare `applyFindingPolicy` would also be
+      // satisfied by the import line.
+      "cascade-format:resolved-found-run": gated("clients/cascade-format.ts", "Cold-neighbour ERROR diagnostics formatted into the turn-end cascade run by `buildResolvedFoundCascadeRun` (quiet-window reconcile of a cascade touch that skipped its in-lane wait).", ["applyFindingPolicy"], ["applyFindingPolicy(retained, {"]),
+      // #3157: the IN-LANE cascade — a different delivery lane from the
+      // quiet-window run above, and the one #3102's sweep cleared WRONGLY. Its four
+      // display sites (passive cold snapshot, fresh touch, touch-error fallback,
+      // degraded fallback) assemble `CascadeNeighborResult.diagnostics` and reach
+      // the agent through `formatCascadeNeighborDiagnostics` without ever entering
+      // the dispatcher's `applyOutputFilters` pipeline: the sweep's file-level
+      // verdict ("the per-edit dispatch path, which already filters in
+      // dispatcher.ts") was true only of the per-edit RUNNER output in
+      // `runners/lsp.ts`, which is a different call site in a different file.
+      //
+      // Evidence is the CALL TEXT (#3088 round-2 F4), counted: `cascadeDisplay(` is
+      // the one seam all four sites route through, so `evidenceMin: 4` is the count
+      // of display sites in the file and dropping ANY of them back to a raw
+      // `convertLspDiagnostics` reds this suite. Identity-stubbing the callee
+      // instead is caught behaviourally — it reds twelve cases in
+      // `tests/clients/inlane-cascade-finding-policy.test.ts`, which is a stronger
+      // signal than the R2 proximity heuristic. Residual, stated: a FIFTH display
+      // site that open-codes the conversion keeps the count at 4 and is caught by
+      // review, not by this row.
+      "dispatch-integration:in-lane-cascade": gated("clients/dispatch/integration.ts", "In-lane per-edit cascade neighbour ERROR diagnostics, rendered into the turn-end cascade block by `computeCascadeForFile`.", ["applyCascadeDisplayPolicy"], ["cascadeDisplay("], { evidenceMin: 4 }),
+      "runtime-turn:call-graph-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F4CA} call-graph impact advisory.", "`runtime.callGraph` is a session-lifetime in-memory structure; this round does not verify or gate ITS OWN freshness policy (how/when it incorporates edits made earlier in the session).", "live", [], {
+        status: "partial",
+        partialReason: "call-graph freshness/invalidation policy is out of this PR's scope \u2014 tracked as a follow-up, not silently assumed fresh."
+      }),
+      // #3088 round 2 F4: this row used to name `applyDispositions`/`applyRulePolicy`
+      // with whole-file evidence literals. Once #3088 folded mode=full's stack onto
+      // `applyFindingPolicy`, those two literals survived only in UNRELATED
+      // mode=delta helpers in the same file, so deleting the entire policy stack out
+      // of `applyInlineSuppressionsToSummaries` left this gate — and the ratchet —
+      // green while five behaviour cases redded. The evidence is now the call text
+      // of the merge's own filter, which exists nowhere else in the file.
+      "lens-diagnostics:mode-full": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=full` report.", ["applyFindingPolicy", "reconcileProjectDiagnosticsSnapshot"], [
+        "applyFindingPolicy(summary.diagnostics, {",
+        "reconcileProjectDiagnosticsSnapshot("
+      ]),
+      "lens-diagnostics:mode-all": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=all` report (widget-state read).", ["reconcileStaleWidgetFiles", "reconcileStaleWidgetDependencyBlockers"], ["reconcileStaleWidgetFiles(", "reconcileStaleWidgetDependencyBlockers("]),
+      // #1634 review round F3: this was the most important gap — the tool's
+      // DEFAULT mode rendered cached `file:line` findings with zero freshness
+      // check. `applyDeltaFreshnessGate` (this file's sibling in
+      // tools/lens-diagnostics.ts) now routes the actionable/quality-warnings
+      // caches through the shared gate using each report's own `generatedAt`.
+      // Round R3: mode=delta has a THIRD arm — the persisted project-diagnostics
+      // delta report, rendered by `appendProjectDiagnosticsDeltaLines` — which
+      // carried the identical unfixed shape. It now gates the same way, against
+      // its own `generatedAt`.
+      "lens-diagnostics:mode-delta": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=delta` report (the tool's DEFAULT mode) \u2014 re-serves the actionable-warnings/code-quality-warnings caches AND the persisted project-diagnostics delta report.", ["gateFindingsByPathFreshness"], [
+        'store: "lens-diagnostics-delta"',
+        "applyDeltaFreshnessGate(",
+        'store: "lens-diagnostics-delta-project"'
+      ]),
+      "widget-state:footer": gated("clients/widget-state.ts", "TUI footer blocking/error/warning tally.", ["reconcileStaleWidgetFiles", "isBlocking"], ["isBlocking(diagnostic)", "reconcileStaleWidgetFiles()"]),
+      "agent-nudge:context-message": labeled("clients/agent-nudge.ts", "Post-edit file-touch nudge injected via `context`.", "Not a scanner finding store: no severity, no cited line, no cache \u2014 the accumulator is drained and cleared at the moment of injection, so the content IS the current state by construction.", "live"),
+      "test-runner-delivery:custom-entry": labeled("clients/test-runner-delivery.ts", "Post-agent test-runner failures in a non-context custom entry.", "The cache remains authoritative for pull diagnostics and the commit guard; this surface appends only after provenance validation and an idle recheck.", "live"),
+      "project-diagnostics:persisted-snapshot": gated(LENS_DIAGNOSTICS_FILE, "Cross-session persisted project-diagnostics snapshot read.", ["reconcileProjectDiagnosticsSnapshot"], ["reconcileProjectDiagnosticsSnapshot("]),
+      // ── #2028: the remaining agent-facing surfaces ──────────────────────────
+      // Registered after #2028's root-cause review found the 🔴 STOP block
+      // rendering stale/deleted-file blockers because its surface was never in
+      // this registry — the exact "gated or labeled, never neither" gap this
+      // module exists to close.
+      "tool-call:stop-blocker": gated("clients/pipeline.ts", "Per-edit \u{1F534} STOP blocker output appended to the write/edit tool result.", ["dropFindingsForMissingPaths"], ['store: "stop-blocker"']),
+      // The freshness stack itself (own-file mtime + reverse-dependency mtimes
+      // via isEntryFresh, plus the #1095 content binding) lives inside
+      // clients/lsp/workspace-diagnostics-cache.ts; the two evidence calls are
+      // the tool's literal entry points into that gated path.
+      "lsp-diagnostics:tool-output": gated("tools/lsp-diagnostics.ts", "`lsp_diagnostics` batch/directory sweep results. Cache hits replay through the shared workspace-diagnostics cache: createWorkspaceDiagnosticsCacheContext is the tool's entry, and its lookup() applies the #671/#672 freshness stack (own-file mtime + reverse-dependency mtimes via isEntryFresh) plus the #1095 content binding. #3088: every route out of this tool \u2014 fresh, cache replay, single file, directory \u2014 also passes applyProbeFindingPolicy, the stored-disposition / .pi-lens.json rule-policy / inline pi-lens-ignore stack the per-edit dispatch path and mode=full apply.", [
+        "createWorkspaceDiagnosticsCacheContext",
+        "isEntryFresh",
+        "cacheCtx.lookup",
+        "applyProbeFindingPolicy"
+      ], [
+        "createWorkspaceDiagnosticsCacheContext(resolvedCwd)",
+        "cacheCtx.lookup(file, scopeKey)",
+        "applyProbeFindingPolicy("
+      ]),
+      "git-guard:commit-blocked": labeled("clients/git-guard.ts", "Git-guard commit/push \u{1F534} COMMIT BLOCKED verdict (--lens-guard).", "Synchronous preflight rejection returned inline with the failed git command \u2014 no stored state is delivered, so nothing can go stale between detection and delivery.", "live"),
+      "shared-checkout-guard:worktree-mutation-blocked": labeled("clients/shared-checkout-guard.ts", "Shared-checkout \u{1F534} WORKING-TREE CHANGE BLOCKED verdict (--lens-checkout-guard).", "Synchronous preflight rejection returned inline with the failed git command. Both inputs are read at decision time \u2014 the instance registry and `git status` \u2014 so no stored finding is replayed and nothing can go stale between detection and delivery.", "live"),
+      "read-guard-tool-lines:preflight-errors": labeled("clients/read-guard-tool-lines.ts", "Read-guard hashline BLOCKED / RE-READ REQUIRED / PARTIAL APPLY / ALREADY APPLIED preflight errors (#2402).", "Computed fresh per edit attempt and returned as that attempt's rejection \u2014 no cached findings are replayed, so there is no staleness window. The PARTIAL APPLY and ALREADY APPLIED variants describe the same attempt's commit outcome; applied-edit recognition reads RuntimeCoordinator's session-scoped record, which resets with the session.", "live"),
+      "mutating-tool:adapter-preflight-errors": labeled("clients/mutating-tool.ts", "Shape-adapter BLOCKED preflight errors for hashline edit inputs the adapter recognized but could not resolve to a range (#2423).", "Computed fresh from the tool input on each attempt and returned as that attempt's rejection, so there is no staleness window. The adapters read only the call's own arguments; nothing cached is replayed.", "live"),
+      "tool-call:duplicate-export-blocker": labeled("clients/runtime-tool-call.ts", "Duplicate-export STOP rejection returned inline with the failed edit.", "Synchronous preflight rejection computed per edit attempt; no stored state.", "live"),
+      "agent-behavior:thrashing-notice": labeled("clients/agent-behavior-client.ts", "In-result thrashing/blind-write detection notice.", "Ephemeral notice computed at detection time inside the same tool result \u2014 no persistence and no cache, so nothing can be stale.", "live")
+    };
+  }
+});
+
 // dist/clients/cascade-format.js
 import * as fs88 from "node:fs";
 function formatCascadeNeighborDiagnostics(cwd, neighbors, options = {}) {
@@ -76114,7 +76369,11 @@ suppressed by disposition: ${suppressed} finding(s) (marked false-positive or wo
       formatted
     },
     neighborCount: 1,
-    diagnosticCount: diagnostics.length
+    diagnosticCount: diagnostics.length,
+    // #3168 F3: the #1444 publish stamp — the run's own observation time, so
+    // the carried-render age label states the real age instead of claiming
+    // no stamp exists.
+    ...neighbor.publishedAt !== void 0 ? { observedAt: neighbor.publishedAt } : {}
   };
 }
 function applyCascadeDisplayPolicy(errors, options) {
@@ -76170,6 +76429,12 @@ function readNeighborContent(filePath) {
     return void 0;
   }
 }
+function cascadeCarrySuffix(carriedTurns, observedAt) {
+  if (carriedTurns === void 0 || carriedTurns < 1)
+    return void 0;
+  const noun = carriedTurns === 1 ? "turn" : "turns";
+  return `(carried ${carriedTurns} ${noun} \xB7 ${formatCacheAgeLabel(observedAt)})`;
+}
 var init_cascade_format = __esm({
   "dist/clients/cascade-format.js"() {
     "use strict";
@@ -76177,6 +76442,7 @@ var init_cascade_format = __esm({
     init_finding_policy();
     init_file_role();
     init_latency_logger();
+    init_finding_delivery_gate();
     init_lsp_diagnostics();
     init_runner_context();
   }
@@ -76457,7 +76723,8 @@ function registerCascadeTierReconcileTask(getLspService, options = {}) {
           options.onResolvedFound?.({
             filePath: o.filePath,
             serverId: o.serverId,
-            diagnostics: o.diagnostics
+            diagnostics: o.diagnostics,
+            ...o.publishedAt !== void 0 ? { publishedAt: o.publishedAt } : {}
           });
         } else if (o.outcome === "resolved-clean" && o.publishedAt != null) {
           options.onResolvedClean?.({
@@ -95750,7 +96017,7 @@ __export(lens_map_exports, {
   parseUntrackedIgnoredOutput: () => parseUntrackedIgnoredOutput,
   renderMapHtml: () => renderMapHtml
 });
-import * as fs132 from "node:fs";
+import * as fs133 from "node:fs";
 import * as path209 from "node:path";
 function aggregateGraphToFiles(graph, options) {
   const maxNodes = Math.max(1, options?.maxNodes ?? DEFAULT_MAX_MAP_NODES);
@@ -96701,9 +96968,9 @@ async function generateLensMap(cwd) {
   };
   const html = renderMapHtml(payload);
   const outDir = path209.join(getProjectDataDir(cwd), "reports");
-  fs132.mkdirSync(outDir, { recursive: true });
+  fs133.mkdirSync(outDir, { recursive: true });
   const filePath = path209.join(outDir, "lens-map.html");
-  fs132.writeFileSync(filePath, html, "utf-8");
+  fs133.writeFileSync(filePath, html, "utf-8");
   return {
     filePath,
     fileCount: aggregated.nodes.length,
@@ -96747,7 +97014,7 @@ __export(performance_report_exports, {
   resolveLogByteBudget: () => resolveLogByteBudget,
   summarizePhaseLatency: () => summarizePhaseLatency
 });
-import * as fs133 from "node:fs";
+import * as fs134 from "node:fs";
 import * as readline from "node:readline";
 function resolveLogByteBudget() {
   return getMaxLogSizeMB() * 1024 * 1024;
@@ -96879,7 +97146,7 @@ async function readPhaseLogTail(filePath, windowBytes, maxSamples, processId, se
   });
   let handle;
   try {
-    handle = await fs133.promises.open(filePath, "r");
+    handle = await fs134.promises.open(filePath, "r");
     const stat4 = await handle.stat();
     if (!stat4.isFile()) {
       const notAFile = new Error(`EISDIR: illegal operation on a directory, read '${filePath}'`);
@@ -99321,8 +99588,11 @@ function resolveSkillPaths(importMetaUrl) {
   });
   if (health.status !== "healthy") {
     const entryDir = path85.dirname(fileURLToPath6(importMetaUrl));
-    const reason = `${describeBundledResourceHealth(health, skillsDir, `no SKILL.md (or loadable .md) found under ${skillsDir}`)} (entry loaded from ${entryDir})`;
-    reportBundledResourceDirHealth(SKILLS_DIR_MISSING_KIND, skillsDir, health, "skills", reason, `pi-lens: registers zero skills \u2014 ${reason}.`);
+    const healthDescription = describeBundledResourceHealth(health, skillsDir, `no SKILL.md (or loadable .md) found under ${skillsDir}`);
+    const notifyReason = `${healthDescription} (entry loaded from ${entryDir})`;
+    const classification = health.status === "unreadable" ? `cannot read (${health.fsErrorCode})` : health.status === "empty" ? "no SKILL.md found" : "no such directory";
+    const ledgerReason = `${classification} (entry loaded from ${entryDir})`;
+    reportBundledResourceDirHealth(SKILLS_DIR_MISSING_KIND, skillsDir, health, "skills", ledgerReason, `pi-lens: registers zero skills \u2014 ${notifyReason}.`);
   }
   return [skillsDir];
 }
@@ -104075,7 +104345,19 @@ function mergeActionableWarningsReports(args) {
       continue;
     }
     mergedFiles++;
-    const merged = incumbent ? {
+    const merged = incumbent ? incumbent.reVerified || incumbent.reVerifyIncomplete ? (
+      // #3170: the runtime just RE-OBSERVED this file (the bounded
+      // persistent-reverify pass) — the fresh observation supersedes
+      // the carried entry instead of unioning with it: a converged
+      // finding would otherwise survive its own supersession via the
+      // id-union in `mergeWarnings`.
+      {
+        ...incumbent,
+        fileSeq: incumbent.fileSeq ?? entry.fileSeq,
+        generatedAt: olderStamp(incumbent.generatedAt ?? newerReport?.generatedAt, entry.generatedAt ?? olderReport?.generatedAt),
+        warnings: incumbent.warnings
+      }
+    ) : {
       ...incumbent,
       fileSeq: incumbent.fileSeq ?? entry.fileSeq,
       generatedAt: olderStamp(incumbent.generatedAt ?? newerReport?.generatedAt, entry.generatedAt ?? olderReport?.generatedAt),
@@ -104400,7 +104682,7 @@ function formatActionableWarningsAdvisory(report, cwd, host = "pi") {
   if (report.summary.unsuppressed === 0)
     return void 0;
   const files2 = report.files.filter((file) => file.warnings.some((warning) => !warning.suppressed));
-  const fileList = files2.slice(0, 5).map((file) => `  ${file.displayPath}: ${file.warnings.filter((warning) => !warning.suppressed).length}`).join("\n");
+  const fileList = files2.slice(0, 5).map((file) => `  ${file.displayPath}: ${file.warnings.filter((warning) => !warning.suppressed).length}${file.reVerifyIncomplete ? " (re-verify incomplete)" : ""}`).join("\n");
   const more = files2.length > 5 ? `
   ... and ${files2.length - 5} more file(s)` : "";
   const safe2 = report.summary.autoFixEligible > 0 ? ` ${report.summary.autoFixEligible} appear to have conservative preferred quickfixes.` : "";
@@ -105660,6 +105942,8 @@ async function runFormatPhase(filePath, getFormatService2, dbg2, signal, budgetM
   };
 }
 function buildEnrichedBlockerOutput(blockers, fileContent = "") {
+  if (blockers.length === 0)
+    return "";
   const fileLines = fileContent ? fileContent.split("\n") : [];
   const MAX_SNIPPET = 120;
   let out = `
@@ -105898,7 +106182,8 @@ async function runPipeline(ctx, deps) {
       const rest = dispatchResult.output.slice(dispatchResult.blockerOutput.length);
       if (rest)
         gatedOut += rest;
-      output += `
+      if (gatedOut)
+        output += `
 
 ${gatedOut}`;
     } else {
@@ -113944,7 +114229,7 @@ function wrapSessionEventHandlerWithResult(eventName, handler, options) {
 init_session_lifecycle();
 
 // dist/clients/runtime-turn.js
-import * as fs123 from "node:fs";
+import * as fs124 from "node:fs";
 import * as path187 from "node:path";
 init_cascade_budget();
 init_cascade_logger();
@@ -113952,196 +114237,7 @@ init_path_utils();
 init_string_utils();
 init_runner_context();
 init_file_utils();
-
-// dist/clients/finding-delivery-gate.js
-var MS_PER_MINUTE = 6e4;
-function markUnreconciledFindings(findings) {
-  return findings.map((finding) => ({ ...finding, stale: true }));
-}
-function formatCacheAgeLabel(scannedAt, nowMs = Date.now()) {
-  if (scannedAt === void 0 || scannedAt === null || scannedAt === "") {
-    return "scan age unknown";
-  }
-  const scannedAtMs = typeof scannedAt === "number" ? scannedAt : Date.parse(scannedAt);
-  if (!Number.isFinite(scannedAtMs))
-    return "scan age unknown";
-  const ageMs = Math.max(0, nowMs - scannedAtMs);
-  const ageMinutes = Math.round(ageMs / MS_PER_MINUTE);
-  if (ageMinutes < 1)
-    return "scanned <1m ago";
-  if (ageMinutes < 60)
-    return `scanned ${ageMinutes}m ago`;
-  const ageHours = Math.floor(ageMinutes / 60);
-  const remMinutes = ageMinutes % 60;
-  return remMinutes === 0 ? `scanned ${ageHours}h ago` : `scanned ${ageHours}h ${remMinutes}m ago`;
-}
-function gated(file, description, gates, evidence, extra = {}) {
-  return { mode: "gated", file, description, gates, evidence, ...extra };
-}
-function labeled(file, description, reason, ageSource, evidence = [], extra = {}) {
-  return {
-    mode: "labeled",
-    file,
-    description,
-    reason,
-    ageSource,
-    evidence,
-    ...extra
-  };
-}
-var RUNTIME_TURN_FILE = "clients/runtime-turn.ts";
-var LENS_DIAGNOSTICS_FILE = "tools/lens-diagnostics.ts";
-var DELIVERY_SURFACES = {
-  "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F534} secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ['store: "gitleaks"']),
-  "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F534} secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ['store: "trivy-secrets"']),
-  "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F6E1}\uFE0F Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ['store: "govulncheck"']),
-  // Two tagged seams (the stale and live render branches below the same
-  // `sweepInlineBlockerFreshness` call) legitimately share one evidence
-  // occurrence — evidenceMin: 2 tells the exclusive-assignment check both
-  // are expected claimants, not a rogue seam contesting the real one.
-  "runtime-turn:unresolved-inline-blocker": gated(
-    RUNTIME_TURN_FILE,
-    "Turn-end re-surfaced unresolved inline blockers.",
-    ["sweepInlineBlockerFreshness"],
-    // #1790: the call now passes `additionalEntries` (widget-store rows) as a
-    // third argument, so the literal is the call's opening rather than the
-    // whole single-line invocation.
-    ["sweepInlineBlockerFreshness(runtime, cwd, {"],
-    { evidenceMin: 2 }
-  ),
-  // Same two gate calls as the live secrets tier — this tier renders their
-  // `.stale` arm, so it has no OWN gate call to point at.
-  "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end \u{1F511} demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ['store: "gitleaks"', 'store: "trivy-secrets"']),
-  // The evidence below is the literal header FRAGMENT including the
-  // interpolation — proves the label is actually rendered, not merely
-  // computed and discarded (review round F1's "deleted the age
-  // interpolations" attack).
-  "runtime-turn:trivy-critical-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F534} CRITICAL dependency CVE blocker (trivy).", "Package-pinned finding with no cited file:line to stat \u2014 freshness has nothing to check drift against. The session_start cache can be arbitrarily old, so its age is stated instead. Also routes through `filterFindingsByDisposition` (#1625) first \u2014 a suppressed/false-positive finding never reaches this render, so the age label and the disposition filter compose rather than substitute for each other.", "TrivyResult.scannedAt", ["CRITICAL dependency CVEs (trivy, ${trivyAgeLabel}"]),
-  "runtime-turn:trivy-cve-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F6E1}\uFE0F non-critical dependency CVE advisory (trivy).", "Same package-pinned shape and #1625 disposition composition as the CRITICAL blocker above.", "TrivyResult.scannedAt", ["Dependency CVEs (trivy, ${trivyAgeLabel}"]),
-  "runtime-turn:trivy-license-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F4DC} dependency license-risk advisory (trivy).", "Same package-pinned shape as the CRITICAL blocker above.", "TrivyResult.scannedAt", ["Dependency license risk (trivy, ${trivyAgeLabel}"]),
-  "runtime-turn:dead-code-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end dead-code delta advisory (knip/vulture/etc).", "The delta shown is computed from THIS turn's own analyze() call, diffed against the previous cache \u2014 never a replay of a stale cache.", "live"),
-  "runtime-turn:knip-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F534} Knip unresolved-imports/deps blocker.", "Same shape as the dead-code advisory: `await knipClient.analyze(cwd, ...)` runs fresh THIS turn, diffed against the previous cache and filtered to files edited this turn \u2014 never a replay of a stale cache.", "live"),
-  "runtime-turn:knip-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u26A0\uFE0F Knip newly-unused-exports advisory.", "Same live-this-turn shape as the Knip blocker above.", "live"),
-  "runtime-turn:actionable-warnings-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end actionable-warnings advisory (ast-grep etc).", "`peekActionableWarnings` reads `_actionableWarningsThisTurn` \u2014 recorded fresh from this turn's own dispatch, never a cross-turn cache.", "live"),
-  "runtime-turn:code-quality-warnings-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end code-quality-warnings advisory.", "`peekCodeQualityWarnings` reads `_codeQualityWarningsThisTurn` \u2014 the same per-turn accumulator shape as actionable-warnings above.", "live"),
-  "runtime-turn:disposition-suppressed-notice": labeled(RUNTIME_TURN_FILE, "Turn-end running disposition-suppressed-count notice (#1616).", "A live running total accumulated from this turn's own gate/disposition calls above (`dispositionSuppressedTotal`) \u2014 telemetry ABOUT the other gated surfaces, not a cache of its own.", "live"),
-  // #2001/#2002 collect-later: findings an auxiliary LSP published AFTER its
-  // aux-grace window expired, probed from the client cache at the next
-  // turn_end. Gated on the mark timestamp: a cited file deleted or edited
-  // since the mark drops its findings (never delivered before, and the
-  // drifting edit already re-touched the file — a fresh pending pair
-  // supersedes this one), with both drop arms counted in the
-  // `late_auxiliary_findings` latency record rather than silenced.
-  //
-  // #3102: freshness is only half the gate. The survivors also take the shared
-  // `clients/dispatch/finding-policy.ts` stack (inline `pi-lens-ignore` →
-  // stored dispositions → `.pi-lens.json` rule policy) the per-edit dispatcher,
-  // `mode=full` and the `source=lsp` probe lane apply — without it a finding
-  // the agent marked `false-positive` re-reported on every drain. Per #3088
-  // round-2 F4, the evidence is the CALL TEXT of that filter, which exists
-  // nowhere else in this file: a bare `applyFindingPolicy` would also be
-  // satisfied by an import line or an unrelated caller.
-  "runtime-turn:late-auxiliary-findings": gated(RUNTIME_TURN_FILE, "Turn-end late-auxiliary LSP findings (collect-later probe of aux client caches whose grace window expired).", ["gateFindingsByPathFreshness", "applyFindingPolicy"], ['store: "late-auxiliary-findings"', "applyFindingPolicy(gate.live, {"]),
-  "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness"], ['store: "late-runner-findings"'], { evidenceMin: 2 }),
-  "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F9EA} cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible (`settleCascadeRuns`), but an unsettled compute can carry over to a later turn (bounded by a carry cap) \u2014 this round does not freshness-gate that carry-over window.", "live", [], {
-    status: "partial",
-    partialReason: "A carried-over cascade result (run.carriedTurns > 0) is rendered without an age label. Follow-up: surface carriedTurns as an explicit label when > 0, or route through formatCacheAgeLabel using the run's own timestamp."
-  }),
-  "runtime-turn:cascade-coverage-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end cascade-coverage-gap advisories (graph/binding/budget).", "Explains what the cascade check could NOT confirm this turn \u2014 not a finding with a cited path, an absence-of-coverage disclosure computed from this turn's own indeterminate-run list.", "live", [], {
-    status: "partial",
-    partialReason: "Same cascade carry-over caveat as runtime-turn:cascade-blocker."
-  }),
-  // #3102: the cold-neighbour cascade run is BUILT here, in the quiet-window
-  // reconcile (`onResolvedFound` in index.ts), a turn earlier than the
-  // `runtime-turn:cascade-blocker` render that finally carries it — so it is
-  // its own delivery lane, and it was the one that rendered raw LSP findings
-  // with no policy filter at all. The evidence is the CALL TEXT of the shared
-  // filter (#3088 round-2 F4): a bare `applyFindingPolicy` would also be
-  // satisfied by the import line.
-  "cascade-format:resolved-found-run": gated("clients/cascade-format.ts", "Cold-neighbour ERROR diagnostics formatted into the turn-end cascade run by `buildResolvedFoundCascadeRun` (quiet-window reconcile of a cascade touch that skipped its in-lane wait).", ["applyFindingPolicy"], ["applyFindingPolicy(retained, {"]),
-  // #3157: the IN-LANE cascade — a different delivery lane from the
-  // quiet-window run above, and the one #3102's sweep cleared WRONGLY. Its four
-  // display sites (passive cold snapshot, fresh touch, touch-error fallback,
-  // degraded fallback) assemble `CascadeNeighborResult.diagnostics` and reach
-  // the agent through `formatCascadeNeighborDiagnostics` without ever entering
-  // the dispatcher's `applyOutputFilters` pipeline: the sweep's file-level
-  // verdict ("the per-edit dispatch path, which already filters in
-  // dispatcher.ts") was true only of the per-edit RUNNER output in
-  // `runners/lsp.ts`, which is a different call site in a different file.
-  //
-  // Evidence is the CALL TEXT (#3088 round-2 F4), counted: `cascadeDisplay(` is
-  // the one seam all four sites route through, so `evidenceMin: 4` is the count
-  // of display sites in the file and dropping ANY of them back to a raw
-  // `convertLspDiagnostics` reds this suite. Identity-stubbing the callee
-  // instead is caught behaviourally — it reds twelve cases in
-  // `tests/clients/inlane-cascade-finding-policy.test.ts`, which is a stronger
-  // signal than the R2 proximity heuristic. Residual, stated: a FIFTH display
-  // site that open-codes the conversion keeps the count at 4 and is caught by
-  // review, not by this row.
-  "dispatch-integration:in-lane-cascade": gated("clients/dispatch/integration.ts", "In-lane per-edit cascade neighbour ERROR diagnostics, rendered into the turn-end cascade block by `computeCascadeForFile`.", ["applyCascadeDisplayPolicy"], ["cascadeDisplay("], { evidenceMin: 4 }),
-  "runtime-turn:call-graph-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \u{1F4CA} call-graph impact advisory.", "`runtime.callGraph` is a session-lifetime in-memory structure; this round does not verify or gate ITS OWN freshness policy (how/when it incorporates edits made earlier in the session).", "live", [], {
-    status: "partial",
-    partialReason: "call-graph freshness/invalidation policy is out of this PR's scope \u2014 tracked as a follow-up, not silently assumed fresh."
-  }),
-  // #3088 round 2 F4: this row used to name `applyDispositions`/`applyRulePolicy`
-  // with whole-file evidence literals. Once #3088 folded mode=full's stack onto
-  // `applyFindingPolicy`, those two literals survived only in UNRELATED
-  // mode=delta helpers in the same file, so deleting the entire policy stack out
-  // of `applyInlineSuppressionsToSummaries` left this gate — and the ratchet —
-  // green while five behaviour cases redded. The evidence is now the call text
-  // of the merge's own filter, which exists nowhere else in the file.
-  "lens-diagnostics:mode-full": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=full` report.", ["applyFindingPolicy", "reconcileProjectDiagnosticsSnapshot"], [
-    "applyFindingPolicy(summary.diagnostics, {",
-    "reconcileProjectDiagnosticsSnapshot("
-  ]),
-  "lens-diagnostics:mode-all": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=all` report (widget-state read).", ["reconcileStaleWidgetFiles", "reconcileStaleWidgetDependencyBlockers"], ["reconcileStaleWidgetFiles(", "reconcileStaleWidgetDependencyBlockers("]),
-  // #1634 review round F3: this was the most important gap — the tool's
-  // DEFAULT mode rendered cached `file:line` findings with zero freshness
-  // check. `applyDeltaFreshnessGate` (this file's sibling in
-  // tools/lens-diagnostics.ts) now routes the actionable/quality-warnings
-  // caches through the shared gate using each report's own `generatedAt`.
-  // Round R3: mode=delta has a THIRD arm — the persisted project-diagnostics
-  // delta report, rendered by `appendProjectDiagnosticsDeltaLines` — which
-  // carried the identical unfixed shape. It now gates the same way, against
-  // its own `generatedAt`.
-  "lens-diagnostics:mode-delta": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=delta` report (the tool's DEFAULT mode) \u2014 re-serves the actionable-warnings/code-quality-warnings caches AND the persisted project-diagnostics delta report.", ["gateFindingsByPathFreshness"], [
-    'store: "lens-diagnostics-delta"',
-    "applyDeltaFreshnessGate(",
-    'store: "lens-diagnostics-delta-project"'
-  ]),
-  "widget-state:footer": gated("clients/widget-state.ts", "TUI footer blocking/error/warning tally.", ["reconcileStaleWidgetFiles", "isBlocking"], ["isBlocking(diagnostic)", "reconcileStaleWidgetFiles()"]),
-  "agent-nudge:context-message": labeled("clients/agent-nudge.ts", "Post-edit file-touch nudge injected via `context`.", "Not a scanner finding store: no severity, no cited line, no cache \u2014 the accumulator is drained and cleared at the moment of injection, so the content IS the current state by construction.", "live"),
-  "test-runner-delivery:custom-entry": labeled("clients/test-runner-delivery.ts", "Post-agent test-runner failures in a non-context custom entry.", "The cache remains authoritative for pull diagnostics and the commit guard; this surface appends only after provenance validation and an idle recheck.", "live"),
-  "project-diagnostics:persisted-snapshot": gated(LENS_DIAGNOSTICS_FILE, "Cross-session persisted project-diagnostics snapshot read.", ["reconcileProjectDiagnosticsSnapshot"], ["reconcileProjectDiagnosticsSnapshot("]),
-  // ── #2028: the remaining agent-facing surfaces ──────────────────────────
-  // Registered after #2028's root-cause review found the 🔴 STOP block
-  // rendering stale/deleted-file blockers because its surface was never in
-  // this registry — the exact "gated or labeled, never neither" gap this
-  // module exists to close.
-  "tool-call:stop-blocker": gated("clients/pipeline.ts", "Per-edit \u{1F534} STOP blocker output appended to the write/edit tool result.", ["dropFindingsForMissingPaths"], ['store: "stop-blocker"']),
-  // The freshness stack itself (own-file mtime + reverse-dependency mtimes
-  // via isEntryFresh, plus the #1095 content binding) lives inside
-  // clients/lsp/workspace-diagnostics-cache.ts; the two evidence calls are
-  // the tool's literal entry points into that gated path.
-  "lsp-diagnostics:tool-output": gated("tools/lsp-diagnostics.ts", "`lsp_diagnostics` batch/directory sweep results. Cache hits replay through the shared workspace-diagnostics cache: createWorkspaceDiagnosticsCacheContext is the tool's entry, and its lookup() applies the #671/#672 freshness stack (own-file mtime + reverse-dependency mtimes via isEntryFresh) plus the #1095 content binding. #3088: every route out of this tool \u2014 fresh, cache replay, single file, directory \u2014 also passes applyProbeFindingPolicy, the stored-disposition / .pi-lens.json rule-policy / inline pi-lens-ignore stack the per-edit dispatch path and mode=full apply.", [
-    "createWorkspaceDiagnosticsCacheContext",
-    "isEntryFresh",
-    "cacheCtx.lookup",
-    "applyProbeFindingPolicy"
-  ], [
-    "createWorkspaceDiagnosticsCacheContext(resolvedCwd)",
-    "cacheCtx.lookup(file, scopeKey)",
-    "applyProbeFindingPolicy("
-  ]),
-  "git-guard:commit-blocked": labeled("clients/git-guard.ts", "Git-guard commit/push \u{1F534} COMMIT BLOCKED verdict (--lens-guard).", "Synchronous preflight rejection returned inline with the failed git command \u2014 no stored state is delivered, so nothing can go stale between detection and delivery.", "live"),
-  "shared-checkout-guard:worktree-mutation-blocked": labeled("clients/shared-checkout-guard.ts", "Shared-checkout \u{1F534} WORKING-TREE CHANGE BLOCKED verdict (--lens-checkout-guard).", "Synchronous preflight rejection returned inline with the failed git command. Both inputs are read at decision time \u2014 the instance registry and `git status` \u2014 so no stored finding is replayed and nothing can go stale between detection and delivery.", "live"),
-  "read-guard-tool-lines:preflight-errors": labeled("clients/read-guard-tool-lines.ts", "Read-guard hashline BLOCKED / RE-READ REQUIRED / PARTIAL APPLY / ALREADY APPLIED preflight errors (#2402).", "Computed fresh per edit attempt and returned as that attempt's rejection \u2014 no cached findings are replayed, so there is no staleness window. The PARTIAL APPLY and ALREADY APPLIED variants describe the same attempt's commit outcome; applied-edit recognition reads RuntimeCoordinator's session-scoped record, which resets with the session.", "live"),
-  "mutating-tool:adapter-preflight-errors": labeled("clients/mutating-tool.ts", "Shape-adapter BLOCKED preflight errors for hashline edit inputs the adapter recognized but could not resolve to a range (#2423).", "Computed fresh from the tool input on each attempt and returned as that attempt's rejection, so there is no staleness window. The adapters read only the call's own arguments; nothing cached is replayed.", "live"),
-  "tool-call:duplicate-export-blocker": labeled("clients/runtime-tool-call.ts", "Duplicate-export STOP rejection returned inline with the failed edit.", "Synchronous preflight rejection computed per edit attempt; no stored state.", "live"),
-  "agent-behavior:thrashing-notice": labeled("clients/agent-behavior-client.ts", "In-result thrashing/blind-write detection notice.", "Ephemeral notice computed at detection time inside the same tool result \u2014 no persistence and no cache, so nothing can be stale.", "live")
-};
-
-// dist/clients/runtime-turn.js
+init_finding_delivery_gate();
 init_workspace_sweep_hold();
 init_collateral_test_role();
 init_gitleaks_client();
@@ -114566,6 +114662,176 @@ init_lsp();
 init_pending_aux_coverage();
 init_lsp_diagnostics();
 init_auxiliary_lsp();
+
+// dist/clients/persistent-reverify.js
+import * as fs123 from "node:fs";
+init_deadline_utils();
+init_latency_logger();
+init_diagnostic_binding();
+init_auxiliary_lsp();
+var MAX_REVERIFY_FILES = 4;
+var REVERIFY_BUDGET_MS = 3e3;
+var TOUCH_SOURCE = "persistent_reverify";
+function selectPersistentReverifyFiles(report, nowMs = Date.now()) {
+  const candidates = [];
+  let skippedChanged = 0;
+  for (const entry of report.files) {
+    if (entry.origin !== "deferred")
+      continue;
+    if (entry.warnings.some((w) => findAuxiliaryProfileForSource(w.source ?? "") !== void 0)) {
+      continue;
+    }
+    const stamp2 = entry.generatedAt ? Date.parse(entry.generatedAt) : NaN;
+    if (!Number.isFinite(stamp2) || stamp2 > nowMs)
+      continue;
+    let mtimeMs;
+    try {
+      mtimeMs = fs123.statSync(entry.filePath).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (mtimeMs > stamp2) {
+      skippedChanged += 1;
+      continue;
+    }
+    if (candidates.length < MAX_REVERIFY_FILES)
+      candidates.push(entry);
+  }
+  return { candidates, skippedChanged };
+}
+async function runPersistentReverify(args) {
+  const started = Date.now();
+  const deadlineAt = started + (args.budgetMs ?? REVERIFY_BUDGET_MS);
+  const nowMs = args.nowMs ?? started;
+  const { candidates, skippedChanged } = selectPersistentReverifyFiles(args.report, nowMs);
+  const outcomes = [];
+  const replacementFiles = [];
+  let touched = 0;
+  const buildArgs = {
+    cwd: args.cwd,
+    sessionId: args.report.sessionId,
+    turnIndex: 0,
+    files: [],
+    modifiedRangesByFile: /* @__PURE__ */ new Map(),
+    dispatchWarnings: [],
+    includeLspCodeActions: true,
+    deltaOnly: false,
+    ...args.signal !== void 0 ? { signal: args.signal } : {},
+    lspBudgetMs: REVERIFY_BUDGET_MS,
+    dbg: () => {
+    }
+  };
+  let processed = 0;
+  for (const entry of candidates) {
+    if (args.signal?.aborted || Date.now() >= deadlineAt)
+      break;
+    processed += 1;
+    let content;
+    try {
+      content = fs123.readFileSync(entry.filePath, "utf-8");
+    } catch {
+      outcomes.push({
+        filePath: entry.filePath,
+        displayPath: entry.displayPath,
+        outcome: "unconfirmed",
+        dropped: 0,
+        kept: entry.warnings.length
+      });
+      replacementFiles.push({ ...entry, reVerifyIncomplete: true });
+      continue;
+    }
+    let touchedResult;
+    try {
+      touchedResult = await bounded(args.lspService.touchFile(entry.filePath, content, {
+        diagnostics: "document",
+        collectDiagnostics: true,
+        source: TOUCH_SOURCE,
+        clientScope: "primary"
+      }), {
+        ms: Math.max(250, deadlineAt - Date.now()),
+        signal: args.signal,
+        hook: "turn_end",
+        label: "persistent_reverify_touch"
+      });
+    } catch {
+      touchedResult = void 0;
+    }
+    if (touchedResult === void 0 || touchedResult.inconclusive === true || touchedResult.skipReason !== void 0 || (touchedResult.diagnosticsUnsupportedServerIds ?? []).length > 0 || !touchCompletedConfirmationPolicy(touchedResult)) {
+      outcomes.push({
+        filePath: entry.filePath,
+        displayPath: entry.displayPath,
+        outcome: "unconfirmed",
+        dropped: 0,
+        kept: entry.warnings.length
+      });
+      replacementFiles.push({ ...entry, reVerifyIncomplete: true });
+      continue;
+    }
+    touched += 1;
+    const freshRecords = await bounded(enrichFileFromLsp(args.cwd, buildArgs, { filePath: entry.filePath, cached: touchedResult.diags }, {
+      lspService: args.lspService,
+      pullTimeoutMs: 2e3,
+      deadlineAt,
+      ...args.signal !== void 0 ? { signal: args.signal } : {},
+      site: { hook: "turn_end", label: "persistent_reverify" }
+    }), {
+      ms: Math.max(250, deadlineAt - Date.now()),
+      signal: args.signal,
+      hook: "turn_end",
+      label: "persistent_reverify_enrich"
+    }) ?? [];
+    let dropped = 0;
+    let kept = 0;
+    for (const warning of entry.warnings) {
+      const stillThere = freshRecords.some((record6) => record6.rule === warning.rule && record6.message === warning.message);
+      if (stillThere)
+        kept += 1;
+      else
+        dropped += 1;
+    }
+    const outcome = freshRecords.length === 0 ? "clean" : dropped === 0 ? "reconfirmed" : "mixed";
+    outcomes.push({
+      filePath: entry.filePath,
+      displayPath: entry.displayPath,
+      outcome,
+      dropped,
+      kept
+    });
+    replacementFiles.push({
+      ...entry,
+      warnings: freshRecords,
+      reVerified: true,
+      generatedAt: new Date(nowMs).toISOString()
+    });
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: args.cwd,
+    phase: "persistent_reverify",
+    durationMs: Date.now() - started,
+    metadata: {
+      candidates: candidates.length,
+      touched,
+      clean: outcomes.filter((o) => o.outcome === "clean").length,
+      reconfirmed: outcomes.filter((o) => o.outcome === "reconfirmed").length,
+      mixed: outcomes.filter((o) => o.outcome === "mixed").length,
+      unconfirmed: outcomes.filter((o) => o.outcome === "unconfirmed").length,
+      skippedChanged,
+      skippedBudget: candidates.length - processed
+    }
+  });
+  return {
+    outcomes,
+    replacementFiles,
+    candidates: candidates.length,
+    touched,
+    skippedChanged
+  };
+}
+
+// dist/clients/runtime-turn.js
+init_cascade_format();
 init_finding_policy();
 init_file_role();
 init_pending_runner_findings();
@@ -115069,6 +115335,17 @@ ${summary}`);
     return true;
   });
   const cascadeResults = cascadeRuns.flatMap((r) => r.result ? [r.result] : []);
+  let carriedRunsRendered = 0;
+  let labeledAdvisories = 0;
+  const carriedMetaByResult = /* @__PURE__ */ new Map();
+  for (const r of cascadeRuns) {
+    if (r.result && (r.carriedTurns ?? 0) > 0 && r.carriedTurns !== void 0) {
+      carriedMetaByResult.set(r.result, {
+        carriedTurns: r.carriedTurns,
+        observedAt: r.observedAt
+      });
+    }
+  }
   const cascadeLogFilePath = cascadeResults[0]?.filePath ?? files2[0] ?? cwd;
   if (cascadeResults.length > 0) {
     const seen = /* @__PURE__ */ new Map();
@@ -115092,7 +115369,12 @@ ${summary}`);
       const pk = normalizeMapKey(result.filePath);
       const ownsAny = result.neighbors.some((n) => neighborOwner.get(normalizeMapKey(n.filePath)) === pk);
       if (ownsAny && result.formatted) {
-        parts.push(result.formatted);
+        const carryMeta = carriedMetaByResult.get(result);
+        const carrySuffix = cascadeCarrySuffix(carryMeta?.carriedTurns, carryMeta?.observedAt);
+        parts.push(carrySuffix ? `${result.formatted}
+${carrySuffix}` : result.formatted);
+        if (carrySuffix)
+          carriedRunsRendered += 1;
         injectedNeighborCount += result.neighbors.length;
         injectedDiagnosticCount += result.neighbors.reduce((s, n) => s + n.diagnostics.length, 0);
       } else if (!ownsAny && result.formatted) {
@@ -115181,19 +115463,35 @@ ${lines.join("\n")}`;
     const graphRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason !== "lsp_binding_rejected" && r.indeterminate?.reason !== "excluded_by_role" && r.indeterminate?.reason !== "budget_truncated" && r.indeterminate?.budget === void 0);
     const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected" && r.indeterminate?.budget === void 0);
     const budgetRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "budget_truncated" || r.indeterminate?.budget !== void 0);
-    const graphAdvisory = buildAdvisory(graphRuns, {
+    const withCarryLabel = (advisory, runs) => {
+      if (advisory === void 0)
+        return void 0;
+      const carried = runs.filter((r) => (r.carriedTurns ?? 0) > 0);
+      if (carried.length === 0 || carried.length !== runs.length) {
+        return advisory;
+      }
+      const stamps = carried.map((r) => r.observedAt);
+      const observedAt = stamps.every((s) => s !== void 0) ? Math.min(...stamps) : void 0;
+      const suffix = cascadeCarrySuffix(carried[0]?.carriedTurns, observedAt);
+      if (!suffix)
+        return advisory;
+      labeledAdvisories += 1;
+      return `${advisory}
+${suffix}`;
+    };
+    const graphAdvisory = withCarryLabel(buildAdvisory(graphRuns, {
       lead: (fileCount2, reasons) => `Cascade could not compute downstream impact for ${fileCount2} edited file(s) this turn \u2014 the review graph was unavailable (${reasons}), so their dependents were not cascade-checked and a clean cascade result does not cover them.`,
       fallbackDetail: (r) => r.indeterminate?.reason === "missing_node" ? "changed file not in the review graph" : "review graph unavailable"
-    });
+    }), graphRuns);
     if (graphAdvisory)
       advisoryParts.push(graphAdvisory);
-    const bindingAdvisory = buildAdvisory(bindingRuns, {
+    const bindingAdvisory = withCarryLabel(buildAdvisory(bindingRuns, {
       lead: (fileCount2, reasons) => `Cascade identified dependents for ${fileCount2} edited file(s) this turn, but their diagnostics could not be freshly confirmed (${reasons}) and were withheld \u2014 a clean cascade result does not cover them.`,
       fallbackDetail: () => "cascade diagnostics withheld (binding rejected)"
-    });
+    }), bindingRuns);
     if (bindingAdvisory)
       advisoryParts.push(bindingAdvisory);
-    const budgetAdvisory = buildAdvisory(budgetRuns, {
+    const budgetAdvisory = withCarryLabel(buildAdvisory(budgetRuns, {
       lead: (fileCount2, reasons) => `Cascade checked the selected neighbors for ${fileCount2} edited file(s) this turn, but some eligible dependents were not checked because the cascade budget was exhausted (${reasons}); a clean cascade result does not cover them.`,
       fallbackDetail: (r) => {
         const budget = r.indeterminate?.budget;
@@ -115202,7 +115500,7 @@ ${lines.join("\n")}`;
         const detail = `cascade budget checked ${budget.selectedCount} of ${budget.eligibleCount} eligible dependents (${budget.truncatedCount} omitted)`;
         return budget.transitiveTruncated ? `${detail}; transitive expansion was capped before all eligible dependents were enumerated` : detail;
       }
-    });
+    }), budgetRuns);
     if (budgetAdvisory)
       advisoryParts.push(budgetAdvisory);
     const fileCount = new Set(indeterminateRuns.map((r) => normalizeMapKey(r.filePath))).size;
@@ -115228,6 +115526,13 @@ ${lines.join("\n")}`;
       }
     });
   }
+  if (carriedRunsRendered > 0 || labeledAdvisories > 0) {
+    logCascade({
+      phase: "cascade_carry_rendered",
+      filePath: cascadeLogFilePath,
+      metadata: { carriedRunsRendered, labeledAdvisories }
+    });
+  }
   const cascadeSkipped = {
     blockers: 0,
     non_code: 0,
@@ -115761,7 +116066,7 @@ The cached line numbers are no longer trustworthy, so they are withheld. Re-run
         continue;
       }
       const config = RUNNERS[carried.runner];
-      if (!config || isExcludedTestTarget(testFile, cwd) || !fs123.existsSync(testFile)) {
+      if (!config || isExcludedTestTarget(testFile, cwd) || !fs124.existsSync(testFile)) {
         resolvedDeferralKeys.add(carriedKey);
         deadDeferred++;
         continue;
@@ -115836,7 +116141,7 @@ The cached line numbers are no longer trustworthy, so they are withheld. Re-run
           dbg2(`turn_end: ${display} \u2192 test target excluded (integration/e2e), skipping spawn (${path187.relative(cwd, target.testFile)})`);
           continue;
         }
-        if (!fs123.existsSync(target.testFile)) {
+        if (!fs124.existsSync(target.testFile)) {
           missingTargetFiles++;
           dbg2(`turn_end: ${display} \u2192 test file missing, skipping spawn (${path187.relative(cwd, target.testFile)})`);
           continue;
@@ -116238,7 +116543,25 @@ ${impactLines.join("\n")}`);
       fileSeqByPath.set(filePath, getFileSeq.call(runtime2, filePath));
     }
   }
+  let reverify;
   if (getFlag("lens-actionable-warnings")) {
+    const persistedReport = cacheManager2.readCache("actionable-warnings", cwd, Number.MAX_SAFE_INTEGER)?.data;
+    if (persistedReport?.files?.some((entry) => entry.origin === "deferred")) {
+      const reverifyLspService = getLSPService();
+      if (reverifyLspService) {
+        reverify = await bounded(runPersistentReverify({
+          report: persistedReport,
+          cwd,
+          lspService: reverifyLspService,
+          signal: getAmbientAbortSignal()
+        }), {
+          ms: HOOK_WALL_BUDGET_MS.turn_end,
+          signal: getAmbientAbortSignal(),
+          hook: "turn_end",
+          label: "persistent_reverify"
+        });
+      }
+    }
     try {
       const report = await buildActionableWarningsReport({
         cwd,
@@ -116281,6 +116604,19 @@ ${impactLines.join("\n")}`);
           }
         }
       });
+      if (reverify?.replacementFiles.length) {
+        const replacementByPath = new Map(reverify.replacementFiles.map((file) => [
+          normalizeMapKey(file.filePath),
+          file
+        ]));
+        const files3 = (report.files ?? []).map((file) => replacementByPath.get(normalizeMapKey(file.filePath)) ?? file);
+        for (const replacement of reverify.replacementFiles) {
+          if (!files3.some((file) => normalizeMapKey(file.filePath) === normalizeMapKey(replacement.filePath))) {
+            files3.push(replacement);
+          }
+        }
+        report.files = files3;
+      }
       const publishResult = publishActionableWarningsReport(cacheManager2, cwd, report, {
         origin: "in-band",
         getFileSeq: getFileSeq ? (filePath) => getFileSeq.call(runtime2, filePath) : void 0,
@@ -116484,7 +116820,7 @@ ${lines.join("\n")}`);
           if (!lateAuxContentRead) {
             lateAuxContentRead = true;
             try {
-              lateAuxContentValue = fs123.readFileSync(lateAuxPath, "utf-8");
+              lateAuxContentValue = fs124.readFileSync(lateAuxPath, "utf-8");
             } catch {
               lateAuxContentValue = void 0;
             }
@@ -116965,13 +117301,14 @@ function createActivateToolsTool(pi, lazyTools, options = {}) {
 
 // dist/tools/lens-diagnostics.js
 init_bounded_cache();
-import { promises as fs129 } from "node:fs";
+import { promises as fs130 } from "node:fs";
 import * as fsSync from "node:fs";
 import * as path200 from "node:path";
 init_diagnostic_dispositions();
 init_blocker_freshness();
 init_freshness();
 init_finding_policy();
+init_finding_delivery_gate();
 init_rule_id_normalize();
 init_rule_policy();
 init_deadline_utils();
@@ -117048,7 +117385,7 @@ init_gitleaks_client();
 init_govulncheck_client();
 init_project_trust();
 init_trivy_client();
-import * as fs125 from "node:fs";
+import * as fs126 from "node:fs";
 import * as os35 from "node:os";
 import * as path192 from "node:path";
 
@@ -117154,7 +117491,7 @@ function opengrepResultToProjectDiagnostics(cwd, result) {
 
 // dist/clients/project-diagnostics/runner-adapters/runner-findings.js
 init_test_runner_client();
-import * as fs124 from "node:fs";
+import * as fs125 from "node:fs";
 import * as path191 from "node:path";
 function failureMessage(failure) {
   const firstLine2 = failure.message.split("\n")[0]?.slice(0, 300) ?? "";
@@ -117221,7 +117558,7 @@ function testRunnerFindingsToProjectDiagnostics(cache2, cwd, runtime2) {
     return [];
   const validation = cwd ? validateAdvisoryProvenance(cache2, cwd, runtime2) : { status: "unknown", reasons: ["validation-context-missing"] };
   const root = cwd ?? process.cwd();
-  const missingKeys = new Set((cache2.provenance?.files ?? []).filter((file) => !fs124.existsSync(path191.resolve(root, file.path))).map((file) => advisoryPathKey(file.path, root)));
+  const missingKeys = new Set((cache2.provenance?.files ?? []).filter((file) => !fs125.existsSync(path191.resolve(root, file.path))).map((file) => advisoryPathKey(file.path, root)));
   const historical = cache2.superseded === true || cache2.stale === true || validation.status !== "current";
   return cache2.results.filter((result) => !missingKeys.has(advisoryPathKey(result.file, root))).flatMap((result) => testResultToProjectDiagnostics(result, historical)).map((diagnostic) => historical ? {
     ...diagnostic,
@@ -117253,10 +117590,10 @@ async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal,
   let analysisRootValidation;
   if (options.analysisRoot !== void 0) {
     try {
-      if (!fs125.statSync(requestedRoot).isDirectory()) {
+      if (!fs126.statSync(requestedRoot).isDirectory()) {
         throw new Error("is not a directory");
       }
-      analysisRoot = fs125.realpathSync(requestedRoot);
+      analysisRoot = fs126.realpathSync(requestedRoot);
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
       const reason = `the explicit analysis root ${requestedRoot} is unavailable or ${detail}`;
@@ -117407,7 +117744,7 @@ async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal,
         markCold("jscpd", reasonFromAvailabilityVerdict("jscpd", clients.jscpdClient.getAvailabilityVerdict?.()));
         return;
       }
-      const isTsProject = fs125.existsSync(path192.join(analysisRoot, "tsconfig.json"));
+      const isTsProject = fs126.existsSync(path192.join(analysisRoot, "tsconfig.json"));
       const scannerKey = isTsProject ? "jscpd-ts" : "jscpd";
       const startMs = Date.now();
       const result = await clients.jscpdClient.scan(analysisRoot, void 0, void 0, isTsProject);
@@ -117820,7 +118157,7 @@ init_source_filter();
 init_tree_sitter_logger();
 init_tree_sitter_query_loader();
 init_tree_sitter_shared();
-import * as fs126 from "node:fs";
+import * as fs127 from "node:fs";
 import * as path194 from "node:path";
 init_diagnostic_binding();
 init_integration();
@@ -117961,7 +118298,7 @@ async function scanFileMajorRules(cwd, files2, signal) {
       let astGrepLang;
       if (sgModule && canHandle(filePath)) {
         try {
-          if (fs126.statSync(filePath).size <= AST_GREP_MAX_FILE_BYTES) {
+          if (fs127.statSync(filePath).size <= AST_GREP_MAX_FILE_BYTES) {
             astGrepLang = getLang(filePath, sgModule);
           }
         } catch {
@@ -117974,7 +118311,7 @@ async function scanFileMajorRules(cwd, files2, signal) {
       let content;
       let contentBytes;
       try {
-        const buf = fs126.readFileSync(filePath);
+        const buf = fs127.readFileSync(filePath);
         contentBytes = buf.length;
         content = buf.toString("utf-8");
       } catch {
@@ -118237,7 +118574,7 @@ var turnEndQueue = new TurnEndQueue();
 // dist/clients/module-report.js
 init_file_kinds();
 init_latency_logger();
-import * as fs127 from "node:fs";
+import * as fs128 from "node:fs";
 import * as path195 from "node:path";
 
 // dist/clients/middle-man-analysis.js
@@ -119383,7 +119720,7 @@ async function moduleReport(file, cwd, options) {
   const normalizedPath = normalizeMapKey(absPath);
   let content;
   try {
-    content = fs127.readFileSync(absPath, "utf-8");
+    content = fs128.readFileSync(absPath, "utf-8");
   } catch {
     return unavailableReport(toDisplayPath(absPath, cwd));
   }
@@ -119708,7 +120045,7 @@ async function readSymbol(file, symbolName, cwd, options = {}) {
   };
   let content;
   try {
-    content = fs127.readFileSync(absPath, "utf-8");
+    content = fs128.readFileSync(absPath, "utf-8");
   } catch {
     log2(false);
     return { found: false, path: absPath, name: symbolName };
@@ -119884,7 +120221,7 @@ async function readEnclosing(file, line, cwd, options) {
   };
   let content;
   try {
-    content = fs127.readFileSync(absPath, "utf-8");
+    content = fs128.readFileSync(absPath, "utf-8");
   } catch {
     log2(false);
     return { found: false, path: absPath, line: targetLine };
@@ -120926,8 +121263,9 @@ init_wait_policy();
 init_tsserver_sync();
 init_lsp_diagnostics();
 init_inferred_project();
+init_path_utils();
 init_widget_state();
-import * as fs128 from "node:fs";
+import * as fs129 from "node:fs";
 import * as path199 from "node:path";
 init_warm_attach();
 init_language_registry();
@@ -120981,7 +121319,7 @@ async function collectFiles(dir, extensions, maxFiles, isIgnored = () => false)
       return;
     let entries;
     try {
-      entries = await fs128.promises.readdir(current, { withFileTypes: true });
+      entries = await fs129.promises.readdir(current, { withFileTypes: true });
     } catch {
       return;
     }
@@ -121051,7 +121389,7 @@ function createLspDiagnosticsTool(nextWriteIndex, onConfirmedNoBlockers, getServ
             details: { mode: "batch", filesChecked: 0 }
           };
         }
-        const absPaths = rawPaths.map((entry) => path199.normalize(path199.isAbsolute(entry) ? entry : path199.resolve(cwd, entry)));
+        const absPaths = rawPaths.map((entry) => normalizeMapKey(path199.resolve(cwd, entry)));
         return runBatchFileDiagnostics(absPaths, severity, lspService, {
           concurrency,
           waitMs,
@@ -121076,10 +121414,10 @@ function createLspDiagnosticsTool(nextWriteIndex, onConfirmedNoBlockers, getServ
           details: {}
         };
       }
-      const absPath = path199.isAbsolute(rawPath) ? rawPath : path199.resolve(cwd, rawPath);
+      const absPath = normalizeMapKey(path199.resolve(cwd, rawPath));
       let stat4;
       try {
-        stat4 = fs128.statSync(absPath);
+        stat4 = fs129.statSync(absPath);
       } catch {
         return {
           content: [
@@ -121110,7 +121448,7 @@ async function collectDiagnosticsForFile(absPath, lspService, scanRoot, waitMs,
   let content;
   let touched;
   try {
-    content = fs128.readFileSync(absPath, "utf-8");
+    content = fs129.readFileSync(absPath, "utf-8");
     if (isWarmAttached()) {
       const attachedBudgetMs = waitMs ?? 15e3;
       const attached = await tryWarmAttachedDiagnostics(absPath, content, attachedBudgetMs, "sweep");
@@ -121265,7 +121603,8 @@ function applyProbeFindingPolicy(file, diagnostics, cwd, content, severity) {
         durationMs: Date.now() - started,
         metadata: {
           suppressed,
-          total: inScopeBefore
+          total: inScopeBefore,
+          retainedSuppressed: countRetainedSuppressedRows(file)
         }
       });
     }
@@ -121283,7 +121622,7 @@ function replayContentForStrictMarks(file, cwd) {
   if (!hasStrictDispositionMarks(cwd))
     return void 0;
   try {
-    return fs128.readFileSync(file, "utf-8");
+    return fs129.readFileSync(file, "utf-8");
   } catch {
     return void 0;
   }
@@ -121309,7 +121648,7 @@ async function collectFileDiagnosticResult(file, severity, lspService, waitMs, n
   const writeIndex = nextWriteIndex?.();
   let stat4;
   try {
-    stat4 = fs128.statSync(file);
+    stat4 = fs129.statSync(file);
     if (!stat4.isFile()) {
       return { file, diagnostics: [], error: `${file}: not a file` };
     }
@@ -121957,7 +122296,7 @@ async function findFullScanBindingMismatches(results) {
       result.boundToCurrentDisk !== true && result.contentHash !== void 0
     ) {
       try {
-        const content = await fs129.readFile(result.filePath, "utf-8");
+        const content = await fs130.readFile(result.filePath, "utf-8");
         if (hashDiagnosticContent(content) !== result.contentHash) {
           mismatched.add(result);
         }
@@ -122232,7 +122571,7 @@ function formatProjectDeltaDiagnostic(diagnostic, stale) {
   const where = stale ? STALE_LINE_MARKER : `L${diagnostic.line ?? "?"}`;
   return `  ${marker} ${where}  ${rule}  ${diagnostic.message}`;
 }
-function appendProjectDiagnosticsDeltaLines(lines, cwd, report, severity, includeFile) {
+function appendProjectDiagnosticsDeltaLines(groups2, cwd, report, severity, includeFile) {
   const scoped = (report?.diagnostics ?? []).filter((diagnostic) => includeFile(diagnostic.filePath) && matchesSeverity(projectDiagnosticToWidget(diagnostic, diagnostic.filePath), severity));
   const gated2 = gateFindingsByPathFreshness({
     store: "lens-diagnostics-delta-project",
@@ -122252,11 +122591,9 @@ function appendProjectDiagnosticsDeltaLines(lines, cwd, report, severity, includ
     byFile.set(filePath, bucket);
   }
   for (const [filePath, fileDiagnostics] of byFile) {
-    const rel = path200.relative(cwd, filePath);
-    if (!lines.includes(rel))
-      lines.push(rel);
+    const group = getDeltaFileGroup(groups2, cwd, filePath);
     for (const diagnostic of fileDiagnostics) {
-      lines.push(formatProjectDeltaDiagnostic(diagnostic, staleSet.has(diagnostic)));
+      group.projectLines.push(formatProjectDeltaDiagnostic(diagnostic, staleSet.has(diagnostic)));
     }
   }
   return diagnostics.length;
@@ -122355,7 +122692,12 @@ function applyDeltaFreshnessGate(files2, cwd, generatedAt) {
   }
   for (const f of gated2.stale) {
     const arr = byFile.get(f.filePath) ?? [];
-    arr.push({ ...f.warning, stale: true, line: void 0 });
+    arr.push({
+      ...f.warning,
+      stale: true,
+      line: void 0,
+      staleAsOf: effectiveAt
+    });
     byFile.set(f.filePath, arr);
   }
   return files2.map((file) => ({
@@ -122363,9 +122705,25 @@ function applyDeltaFreshnessGate(files2, cwd, generatedAt) {
     warnings: byFile.get(file.filePath) ?? []
   })).filter((file) => file.warnings.length > 0);
 }
+function getDeltaFileGroup(groups2, cwd, filePath) {
+  const rel = path200.relative(cwd, filePath);
+  let group = groups2.get(rel);
+  if (!group) {
+    group = {
+      rel,
+      actionableLines: [],
+      qualityLines: [],
+      projectLines: [],
+      incomplete: false
+    };
+    groups2.set(rel, group);
+  }
+  return group;
+}
 function formatDeltaMode(cacheManager2, cwd, severity, pathsScope) {
   const actionableEntry = cacheManager2.readCache("actionable-warnings", cwd);
   const qualityEntry = cacheManager2.readCache("code-quality-warnings", cwd);
+  const reverifyIncompletePaths = new Set((actionableEntry?.data?.files ?? []).filter((file) => file.reVerifyIncomplete).map((file) => normalizeMapKey(file.filePath)));
   const actionable = actionableEntry?.data;
   const quality = qualityEntry?.data;
   const policyMap = loadProjectRulePolicyMap(cwd);
@@ -122389,29 +122747,54 @@ function formatDeltaMode(cacheManager2, cwd, severity, pathsScope) {
     ...file,
     warnings: matchingWarnings(file.warnings)
   })).filter((file) => file.warnings.length > 0);
-  const lines = [];
+  const groups2 = /* @__PURE__ */ new Map();
   if (filteredActionableFiles.length > 0) {
     for (const file of filteredActionableFiles) {
-      const rel = path200.relative(cwd, file.filePath);
-      lines.push(`${rel}`);
+      const group = getDeltaFileGroup(groups2, cwd, file.filePath);
       for (const w of file.warnings) {
         const where = w.stale ? STALE_LINE_MARKER : `L${w.line ?? "?"}`;
-        lines.push(`  \u26A0 ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
+        group.actionableLines.push(`  \u26A0 ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
+      }
+      const key4 = normalizeMapKey(file.filePath);
+      if (reverifyIncompletePaths.has(key4))
+        group.incomplete = true;
+      if (!group.staleRow) {
+        const staleWarning = file.warnings.find((w) => w.stale);
+        if (staleWarning)
+          group.staleRow = { staleAsOf: staleWarning.staleAsOf };
       }
     }
   }
   if (filteredQualityFiles.length > 0) {
     for (const file of filteredQualityFiles) {
-      const rel = path200.relative(cwd, file.filePath);
-      if (!lines.includes(rel))
-        lines.push(rel);
+      const group = getDeltaFileGroup(groups2, cwd, file.filePath);
       for (const w of file.warnings) {
         const where = w.stale ? STALE_LINE_MARKER : `L${w.line ?? "?"}`;
-        lines.push(`  \u2139 ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
+        group.qualityLines.push(`  \u2139 ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
+      }
+      const key4 = normalizeMapKey(file.filePath);
+      if (reverifyIncompletePaths.has(key4))
+        group.incomplete = true;
+      if (!group.staleRow) {
+        const staleWarning = file.warnings.find((w) => w.stale);
+        if (staleWarning)
+          group.staleRow = { staleAsOf: staleWarning.staleAsOf };
       }
     }
   }
-  const projectDeltaCount = appendProjectDiagnosticsDeltaLines(lines, cwd, projectDelta, severity, includeFile);
+  const projectDeltaCount = appendProjectDiagnosticsDeltaLines(groups2, cwd, projectDelta, severity, includeFile);
+  const lines = [];
+  for (const group of groups2.values()) {
+    lines.push(group.rel);
+    lines.push(...group.actionableLines);
+    lines.push(...group.qualityLines);
+    lines.push(...group.projectLines);
+    if (group.staleRow) {
+      lines.push(`  (${formatCacheAgeLabel(group.staleRow.staleAsOf)})`);
+    }
+    if (group.incomplete)
+      lines.push("  (re-verify incomplete)");
+  }
   const selectedActionableFiles = filteredActionableFiles;
   const selectedQualityFiles = filteredQualityFiles;
   const aw = selectedActionableFiles.reduce((count, file) => count + file.warnings.length, 0);
@@ -122811,7 +123194,7 @@ async function applyInlineSuppressionsToSummaries(summaries, cwd, policyMap) {
       return summary;
     let content;
     try {
-      content = await fs129.readFile(summary.filePath, "utf8");
+      content = await fs130.readFile(summary.filePath, "utf8");
     } catch {
       const policyKept2 = applyRulePolicy(summary.diagnostics, policyMap);
       return policyKept2.length === summary.diagnostics.length ? summary : summarizeDiagnostics(summary.filePath, policyKept2, summary.hasFinalSnapshot);
@@ -123407,7 +123790,7 @@ Summary (${visibleSummaries.length} files diagnosed this session):`,
 }
 
 // dist/tools/lens-diagnostic-mark.js
-import { promises as fs130 } from "node:fs";
+import { promises as fs131 } from "node:fs";
 import * as path202 from "node:path";
 init_diagnostic_dispositions();
 
@@ -123462,8 +123845,9 @@ function insertSuppressComment(content, filePath, line, rule) {
 }
 
 // dist/tools/lens-diagnostic-mark.js
-init_widget_state();
+init_path_utils();
 init_tool_config();
+init_widget_state();
 var DISPOSITIONS = [
   "false-positive",
   "suppress",
@@ -123477,7 +123861,7 @@ function isBlank(text) {
 function widgetCrossCheck(absPath, tool, rule, message, callerLine) {
   let diagnostics;
   try {
-    diagnostics = getFileDiagnostics(absPath);
+    diagnostics = getFileDiagnostics(normalizeMapKey(absPath));
   } catch {
     return void 0;
   }
@@ -123612,7 +123996,7 @@ function createLensDiagnosticMarkTool(getCwd, getIdentity) {
       const absPath = path202.isAbsolute(filePathArg) ? filePathArg : path202.resolve(cwd, filePathArg);
       let content;
       try {
-        content = await fs130.readFile(absPath, "utf-8");
+        content = await fs131.readFile(absPath, "utf-8");
       } catch (err) {
         return {
           content: [
@@ -123682,7 +124066,7 @@ function createLensDiagnosticMarkTool(getCwd, getIdentity) {
             details: {}
           };
         }
-        await fs130.writeFile(absPath, updated, "utf-8");
+        await fs131.writeFile(absPath, updated, "utf-8");
       }
       const anchor = markDisposition(cwd, {
         cwd,
@@ -128166,7 +128550,7 @@ init_env_utils();
 init_package_root();
 init_path_utils();
 init_git_identity();
-import * as fs131 from "node:fs";
+import * as fs132 from "node:fs";
 import * as path208 from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function resolveOwnedCommit(root) {
@@ -128180,7 +128564,7 @@ function resolveOwnedCommit(root) {
 }
 function readPackageVersion(root) {
   try {
-    const raw = fs131.readFileSync(path208.join(root, "package.json"), "utf-8");
+    const raw = fs132.readFileSync(path208.join(root, "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.version ?? "unknown";
   } catch {
@@ -128189,7 +128573,7 @@ function readPackageVersion(root) {
 }
 function statEntryMtime(entryImportMetaUrl) {
   try {
-    return fs131.statSync(fileURLToPath11(entryImportMetaUrl)).mtime.toISOString();
+    return fs132.statSync(fileURLToPath11(entryImportMetaUrl)).mtime.toISOString();
   } catch {
     return "unknown";
   }
@@ -129855,10 +130239,11 @@ ${degradationLines.join("\n")}` : "";
     });
   }
   registerCascadeTierReconcileTask(() => getLSPService(), {
-    onResolvedFound: ({ filePath, diagnostics }) => {
+    onResolvedFound: ({ filePath, diagnostics, publishedAt }) => {
       const run = buildResolvedFoundCascadeRun(runtime.projectRoot, {
         filePath,
-        diagnostics
+        diagnostics,
+        publishedAt
       });
       if (run)
         runtime.appendCascadeRun(run);