pi-lens 4.1.2 → 4.1.4

package/dist/clients/lsp-mutation.js

@@ -1,6 +1,37 @@
 import * as path from "node:path";
+import { BoundedSet } from "./bounded-cache.js";
 import { createReadGuardEditBatchSummary, getReadGuardCorrelationId, logReadGuardEvent, } from "./read-guard-logger.js";
 import { normalizeMapKey } from "./path-utils.js";
+import { getMutationBridge } from "./mutation-bridge.js";
+import { noteMutationHandled } from "./observed-mutation.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+// #2450 fix round 3 (minor): gates the "bridge unavailable" dbg line to fire
+// once per session, not once per FILE — a rename that touches many files in
+// a bridge-less process (e.g. the MCP server) would otherwise spam the same
+// line once per touched file. `recordDegradationOnce` itself has no
+// first-occurrence return value (unlike `incrementDegradationCount`), so this
+// tiny local latch is the minimal way to mirror that "once" intent onto the
+// dbg line without changing the ledger's own once-per-(kind,subject) record.
+//
+// Catalog shape 17 (a process-lifetime latch must re-arm at session_start):
+// wired into `handleSessionStart` (`clients/runtime-session.ts`) directly,
+// NOT into `resetDegradationLedger()` — that lives in `degradation-ledger.ts`,
+// which this module already imports, and reaching back from there to here
+// would be a cycle.
+let noBridgeDbgLogged = false;
+export function resetLspMutationNoBridgeDbgLatch() {
+    noBridgeDbgLogged = false;
+}
+/**
+ * Test-only peek at the latch's current value (#2450 fix round 5, F2) — lets
+ * the session-state registry probe the actual internal state instead of
+ * inferring it from captured dbg messages, the same pattern every other
+ * process-private-scalar probe in `tests/support/session-state-registry.ts`
+ * uses (e.g. `_observedMutationStateForTests`).
+ */
+export function _lspMutationNoBridgeDbgLoggedForTests() {
+    return noBridgeDbgLogged;
+}
 const MAX_SAMPLES = 100;
 const MAX_SUMMARIES_PER_CONTEXT = 100;
 export function newLspMutationCorrelationId(toolCallId) {
@@ -52,8 +83,22 @@ function combineResults(results) {
 }
 function uniqueDetails(files, fileDetails) {
     const byPath = new Map();
+    // #2016: `files` and `fileDetails` name the same paths, so without this the
+    // map-build loop and the lookup below each pay `realpathSync.native` for the
+    // same path (~200 microseconds per call on Windows; POSIX short-circuits, so
+    // CI cannot see it). The memo lives for one call, so it has no staleness
+    // window at all and needs no freshness design.
+    const keyMemo = new Map();
+    const keyFor = (filePath) => {
+        let key = keyMemo.get(filePath);
+        if (key === undefined) {
+            key = normalizeMapKey(path.resolve(filePath));
+            keyMemo.set(filePath, key);
+        }
+        return key;
+    };
     for (const detail of fileDetails) {
-        const key = normalizeMapKey(path.resolve(detail.filePath));
+        const key = keyFor(detail.filePath);
         const previous = byPath.get(key);
         if (!previous) {
             byPath.set(key, detail);
@@ -70,7 +115,7 @@ function uniqueDetails(files, fileDetails) {
             importsChanged: previous.importsChanged || detail.importsChanged,
         });
     }
-    return files.map((filePath) => byPath.get(normalizeMapKey(path.resolve(filePath))) ?? {
+    return files.map((filePath) => byPath.get(keyFor(filePath)) ?? {
         filePath,
         // Resource operations have no already-computed text range. A small
         // range is still enough to invalidate the touched-file turn state;
@@ -81,8 +126,35 @@ function uniqueDetails(files, fileDetails) {
 }
 function bookkeepLspMutation(context, files, fileDetails) {
     const details = uniqueDetails(files, fileDetails);
+    // The direct path below needs `context.runtime` (the receipt) and
+    // `context.cacheManager` (the turn-state entry) threaded in by the caller.
+    // One caller structurally cannot: `workspace/applyEdit`'s server-initiated-edit
+    // handler (clients/lsp/client.ts) builds its own fallback `LspMutationContext`
+    // with neither, because there is no live reference to the runtime/cache-manager
+    // singletons at that call site. Rather than silently drop bookkeeping for that
+    // write, fall back to the mutation bridge (#2423) — mounted once at extension
+    // activation with live getters closing over the SAME singletons — which is
+    // exactly the seam built for "a producer that cannot reach the bookkeeping
+    // surfaces directly". This keeps `recordLspMutation` the ONE call site every
+    // LSP-applied edit bookkeeps through; the bridge is this function's OWN
+    // fallback, not a second seam other code reaches for on its behalf (#2450).
+    // Only the receipt (recordProjectMutation) and the turn-state entry
+    // (cacheManager.addModifiedRange) need the bridge fallback: the read-guard
+    // stamp is independent of them and already tolerates either being absent.
+    const useBridgeFallback = !context.runtime || !context.cacheManager;
     for (const detail of details) {
         const filePath = path.resolve(detail.filePath);
+        // #2450 review round 2 (F4): the SAME recordability gate the bridge
+        // fallback below already applies internally (`isRecordable`, mounted in
+        // index.ts). Applied here too so the direct (deps-threaded) branch
+        // cannot record a write the fallback branch would have silently
+        // dropped for the exact same reason (`no-read-guard` / ignored /
+        // vendor) — the two branches must agree on which files count as
+        // project source, not just on how they bookkeep the ones that do.
+        if (context.isRecordable && !context.isRecordable(filePath)) {
+            context.dbg?.(`lsp mutation not recordable, skipping ${filePath}`);
+            continue;
+        }
         if (context.readGuard) {
             try {
                 context.readGuard.recordWritten(filePath);
@@ -91,34 +163,118 @@ function bookkeepLspMutation(context, files, fileDetails) {
                 context.dbg?.(`lsp mutation read-guard stamp failed for ${filePath}: ${err}`);
             }
         }
-        const runtime = context.runtime;
-        // One mutation seam (#2000 phase 1): bump + receipt + change-log live in
-        // RuntimeCoordinator.recordProjectMutation.
-        runtime?.recordProjectMutation?.({
-            filePath,
-            source: context.source,
-            cwd: context.cwd,
-            changedRange: detail.range,
-            onAppendError: (err) => context.dbg?.(`lsp mutation project change append failed for ${filePath}: ${err}`),
-        });
-        if (context.cacheManager) {
-            try {
-                context.cacheManager.addModifiedRange(filePath, detail.range ?? { start: 1, end: 1 }, detail.importsChanged ?? true, context.cwd, runtime?.telemetrySessionId);
+        if (useBridgeFallback) {
+            const bridge = getMutationBridge();
+            if (!bridge) {
+                // #2450 review round 2 (F4)/round 3 (minor): the MCP server process
+                // (`mcp/server.ts`) builds `lsp_navigation` with no
+                // `mutationDeps` AND never mounts the bridge (that only happens
+                // inside pi's own in-process extension activation, `index.ts`) —
+                // every LSP-applied edit in that process is unrecorded. Once per
+                // session (not once per file — a rename can touch many files in
+                // one call, and a session can issue many renames), not once per
+                // process lifetime silently. `subject` is a fixed, one-word
+                // degradation-ledger key (round 3: was `context.tool`, which
+                // varies per LSP operation — "lsp_navigation:rename" vs
+                // "...executeCommand" — so the SAME session could log this
+                // degradation once per operation kind instead of truly once).
+                recordDegradationOnce({
+                    kind: "lsp-mutation-bridge-unmounted",
+                    subject: "lsp-mutation:no-bridge",
+                    reason: "workspace/applyEdit bookkeeping fell back to the mutation " +
+                        "bridge, but no bridge is mounted in this process (e.g. the " +
+                        "MCP server, which never runs pi's extension activation) — " +
+                        "the write is unrecorded (no read-guard stamp, no turn-state " +
+                        "entry, no change-log receipt).",
+                });
+                if (!noBridgeDbgLogged) {
+                    noBridgeDbgLogged = true;
+                    context.dbg?.(`lsp mutation bridge unavailable, dropping bookkeeping for ${filePath}`);
+                }
             }
-            catch (err) {
-                context.dbg?.(`lsp mutation modified-range tracking failed for ${filePath}: ${err}`);
+            else {
+                try {
+                    const recorded = bridge.recordMutation({
+                        filePath,
+                        kind: "edit",
+                        editRanges: detail.range
+                            ? [[detail.range.start, detail.range.end]]
+                            : undefined,
+                        consumer: context.tool,
+                        // Real value threaded through, not the bridge's own
+                        // historical `false` default (#2450 review round 2, F1) —
+                        // the tsserver organize-imports/add-import case is exactly
+                        // the import-changing one.
+                        importsChanged: detail.importsChanged ?? true,
+                        // Equivalence with the direct branch below, which never
+                        // enqueues a deferred autofix/format pass for an LSP-applied
+                        // edit (#2450 review round 2, F3).
+                        deferAutofix: false,
+                    });
+                    if (!recorded) {
+                        context.dbg?.(`lsp mutation bridge dropped ${filePath} (recordMutation() ` +
+                            "returned false — see the mutation_bridge debug output " +
+                            "for the reason: malformed entry, out-of-scope path, or " +
+                            "a bookkeeping error)");
+                    }
+                }
+                catch (err) {
+                    context.dbg?.(`lsp mutation bridge fallback failed for ${filePath}: ${err}`);
+                }
             }
         }
+        else {
+            const runtime = context.runtime;
+            // One mutation seam (#2000 phase 1): bump + receipt + change-log live in
+            // RuntimeCoordinator.recordProjectMutation.
+            runtime?.recordProjectMutation?.({
+                filePath,
+                source: context.source,
+                cwd: context.cwd,
+                changedRange: detail.range,
+                onAppendError: (err) => context.dbg?.(`lsp mutation project change append failed for ${filePath}: ${err}`),
+            });
+            if (context.cacheManager) {
+                try {
+                    context.cacheManager.addModifiedRange(filePath, detail.range ?? { start: 1, end: 1 }, detail.importsChanged ?? true, context.cwd, runtime?.telemetrySessionId, undefined, 
+                    // #2504 review round 2 (F1). #2504 added a containment
+                    // filter to `addModifiedRange` and gave it `cwd` as the
+                    // project root. On THIS path `cwd` is the calling
+                    // directory, which `tools/lsp-navigation.ts` scopes to a
+                    // sub-package while the LSP client's root spans the whole
+                    // monorepo — so a server-initiated edit on a sibling
+                    // package (#2450) and every edit whose context carries a
+                    // separate bookkeeping cwd (#2479) were silently dropped
+                    // from the worklist. Same root the `isRecordable` gate a
+                    // few frames up already uses: `runtime.projectRoot`,
+                    // falling back to `cwd` when no runtime is threaded.
+                    runtime?.projectRoot ?? context.cwd);
+                }
+                catch (err) {
+                    context.dbg?.(`lsp mutation modified-range tracking failed for ${filePath}: ${err}`);
+                }
+            }
+            // #2465: the bridge-fallback branch above gets this for free —
+            // `recordMutationThroughSeam` calls `noteMutationHandled` for every
+            // entry it takes. The DIRECT branch bypasses the bridge entirely, so
+            // it has to say so itself, or the #2430 `agent_settled` sweep finds
+            // bytes on disk it has no baseline for and reports every
+            // `lsp_navigation` rename as drift no tool call explains. Placed
+            // after `addModifiedRange` and OUTSIDE its `try`: the mark is about
+            // "pi-lens wrote this file", which is true whether or not the
+            // turn-state insert threw.
+            noteMutationHandled(filePath);
+        }
+        // #2450 review round 2 (Partial-deps): its own surface, independent of
+        // whether the receipt/turn-state used the direct path or the bridge
+        // fallback above — a half-threaded caller (one that provides
+        // `recordAutofix` but not `runtime`/`cacheManager`) must not lose its
+        // turn-summary publisher just because SOME other surface fell back.
         if (context.recordAutofix && context.source === "autofix") {
             const key = normalizeMapKey(filePath);
-            const seen = context.autofixRecordedPaths ?? new Set();
+            const seen = context.autofixRecordedPaths ?? new BoundedSet(MAX_SAMPLES);
             context.autofixRecordedPaths = seen;
             if (!seen.has(key)) {
-                if (seen.size >= MAX_SAMPLES) {
-                    const oldest = seen.values().next().value;
-                    if (oldest)
-                        seen.delete(oldest);
-                }
                 seen.add(key);
                 context.recordAutofix(filePath);
             }

package/dist/clients/map-with-concurrency.js

@@ -0,0 +1,36 @@
+/**
+ * Bounded worker pool — the repo's one shared `mapWithConcurrency`.
+ *
+ * Lived in `dependency-checker.ts` (its first caller) and was exported from
+ * there for `dispatch/runners/biome-check.ts`. #2504 added a third caller,
+ * `runtime-turn.ts`'s bounded test-runner batch — and runtime-turn must not
+ * drag an ANALYZER client into its eager import graph for a 15-line helper
+ * (that is exactly the eager-bootstrap cost #2467 removed). So the value moved
+ * to this zero-dependency leaf and `dependency-checker.ts` re-exports it: every
+ * existing importer keeps its specifier, and a consumer that only needs the
+ * pool no longer loads madge.
+ *
+ * Same shape as `ledger-bounds.ts` (#2426) for the degradation ledger's bound.
+ *
+ * NOT consolidated here: `lsp/client.ts` keeps its own file-local copy on
+ * purpose (see its comment) — that is a documented decision, not drift.
+ */
+/**
+ * Run `mapper` over `items` with at most `concurrency` in flight at once.
+ */
+export async function mapWithConcurrency(items, concurrency, mapper) {
+    if (items.length === 0)
+        return;
+    let nextIndex = 0;
+    const workerCount = Math.max(1, Math.min(concurrency, items.length));
+    const worker = async () => {
+        while (true) {
+            const index = nextIndex++;
+            if (index >= items.length)
+                return;
+            await mapper(items[index]);
+        }
+    };
+    const workers = Array.from({ length: workerCount }, () => worker());
+    await Promise.all(workers);
+}

package/dist/clients/mcp/analyze.js

@@ -23,8 +23,8 @@ import { PathKeyedMap } from "../path-keyed-map.js";
 import { normalizeMapKey } from "../path-utils.js";
 import { loadProjectSnapshot } from "../project-snapshot.js";
 import { buildOrUpdateGraph } from "../review-graph/service.js";
-import { recordDiagnostics } from "../widget-state.js";
-import { deserializeWordIndex, removeWordIndexDocument, scheduleWordIndexPersist, updateWordIndexDocument, WORD_INDEX_MAX_BYTES, } from "../word-index.js";
+import { classifyDiagnosticTier, recordDiagnostics } from "../widget-state.js";
+import { deserializeWordIndex, removeWordIndexDocumentAsync, scheduleWordIndexPersist, updateWordIndexDocumentForEdit, WORD_INDEX_MAX_BYTES, } from "../word-index.js";
 import { logWordIndex } from "../word-index-logger.js";
 import { createMcpHost } from "./host-shim.js";
 // #536: module-scoped FactStore for the warm-analyze graph seam, mirroring the
@@ -33,7 +33,9 @@ import { createMcpHost } from "./host-shim.js";
 // tiers key off a stable FactStore instance across calls, so a fresh FactStore
 // per call would defeat that reuse. Scoped separately from integration.ts's
 // singleton since this file has no dependency on that module's internal state.
-const warmGraphFacts = new FactStore();
+// Subject labels this store's capacity-eviction telemetry distinctly from
+// the other five production FactStore instances (#2243 review round 3, F1).
+const warmGraphFacts = new FactStore("mcp-analyze");
 // #536 rider (issue body: "when #348 phase 2 lands, the word-index per-edit
 // update should ride the SAME seam so both indexes stay warm together"):
 // MCP has no RuntimeCoordinator/`runtime.wordIndex` to hold a live index the
@@ -168,6 +170,28 @@ export function _getWarmWordIndexCacheStateForTests() {
 // is the persistent warm server's job (see the `lsp` honesty signal + Tier 2).
 const WARMUP_CLIENT_WAIT_MS = 10_000;
 const WARMUP_DIAGNOSTICS_WAIT_MS = 6_000;
+/** One diagnostic, flattened to the fields an MCP consumer needs. */
+/**
+ * Split the dispatch `warnings` bucket into real warnings vs advisories using
+ * the ONE severity-projection policy ({@link classifyDiagnosticTier}, #2414/
+ * #2417) so the model-facing counts never present a `hint`/`info`-tier finding
+ * as a warning (#2420, remainder of #2414). The dispatch `semantic` axis (which
+ * also drives blocking) is intentionally NOT consulted or mutated here: this is
+ * a display-count split, not a blocking-decision change. `blockers`
+ * (`semantic:"blocking"`) are computed upstream and never enter this bucket, so
+ * nothing that blocks can stop blocking through this seam. A non-advisory entry
+ * in the bucket (an `error`/`warning`-tier finding routed here as
+ * `semantic:"warning"`/`"none"`) stays counted as a warning exactly as before,
+ * so a mixed file's real warning count is unchanged.
+ */
+export function summarizeWarningTiers(warnings) {
+    let advisories = 0;
+    for (const w of warnings) {
+        if (classifyDiagnosticTier(w) === "advisory")
+            advisories++;
+    }
+    return { warnings: warnings.length - advisories, advisories };
+}
 function toMcpDiagnostic(diagnostic) {
     return {
         line: diagnostic.line,
@@ -233,7 +257,7 @@ export async function analyzeFile(filePath, cwd, options = {}) {
         : path.resolve(cwd, filePath);
     // no-delta by default → a full snapshot every call (not delta-filtered);
     // caller flags win over the default.
-    const host = createMcpHost({ "no-delta": true, ...(options.flags ?? {}) }, cwd);
+    const host = createMcpHost({ "no-delta": true, ...options.flags }, cwd);
     if (options.warmLsp !== false) {
         await warmLspForFile(absPath, host);
     }
@@ -295,8 +319,9 @@ export async function analyzeFile(filePath, cwd, options = {}) {
         // index with no `forward` map (or none loaded) ⇒ no-op (no incremental
         // primitive available — the eventual full rebuild covers it); an
         // oversized file is REMOVED, never partially indexed; the update is
-        // synchronous (no interleaving hazard — MCP is single-process, same as
-        // pi); a successful update schedules the SAME debounced persist
+        // cooperative and serialized through the index's own operation queue
+        // (#2067 AC4), so this seam no longer holds the event loop for a whole
+        // replacement either; a successful update schedules the SAME debounced persist
         // (`scheduleWordIndexPersist`, `PI_LENS_WORD_INDEX_PERSIST_DEBOUNCE_MS`)
         // pi's path uses — no second persist mechanism.
         //
@@ -313,10 +338,13 @@ export async function analyzeFile(filePath, cwd, options = {}) {
                     const content = fs.readFileSync(absPath, "utf8");
                     const byteLength = Buffer.byteLength(content, "utf-8");
                     if (byteLength > WORD_INDEX_MAX_BYTES) {
-                        removeWordIndexDocument(warmIndex, absPath);
+                        await removeWordIndexDocumentAsync(warmIndex, absPath);
                     }
                     else {
-                        updateWordIndexDocument(warmIndex, { path: absPath, content });
+                        await updateWordIndexDocumentForEdit(warmIndex, {
+                            path: absPath,
+                            content,
+                        });
                     }
                     scheduleWordIndexPersist(cwd, warmIndex);
                 }
@@ -339,7 +367,9 @@ export async function analyzeFile(filePath, cwd, options = {}) {
     const lspRunner = latencyReport?.runners.find((runner) => runner.runnerId === "lsp");
     const lsp = lspRunner
         ? {
-            ran: lspRunner.status !== "skipped" && lspRunner.status !== "when_skipped",
+            ran: lspRunner.status !== "skipped" &&
+                lspRunner.status !== "when_skipped" &&
+                lspRunner.status !== "test_file_skipped",
             status: lspRunner.status,
             diagnosticCount: lspRunner.diagnosticCount,
             durationMs: lspRunner.durationMs,
@@ -354,7 +384,12 @@ export async function analyzeFile(filePath, cwd, options = {}) {
         counts: {
             diagnostics: result.diagnostics.length,
             blockers: result.blockers.length,
-            warnings: result.warnings.length,
+            // #2420: `result.warnings` is the dispatch warnings bucket
+            // (`semantic:"warning"|"none"`), which still carries `hint`/`info`-tier
+            // findings folded in by the runner's severity→semantic map. Project
+            // them out through the shared tier policy so the model sees real
+            // warnings and advisories separately.
+            ...summarizeWarningTiers(result.warnings),
             fixed: result.fixed.length,
         },
         lsp,

package/dist/clients/mcp/session.js

@@ -20,7 +20,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { AstGrepClient } from "../ast-grep-client.js";
-import { loadBootstrapClients } from "../bootstrap.js";
+import { loadBootstrapClients, residentBootstrapAccess, } from "../bootstrap.js";
 import { CacheManager, MCP_TURN_STATE_OWNER_ID, } from "../cache-manager.js";
 import { resetDispatchBaselines } from "../dispatch/integration.js";
 import { resetFormatService } from "../format-service.js";
@@ -96,23 +96,12 @@ export async function runSessionStart(cwd) {
         dbg: noop,
         log: noop,
         runtime: ctx.runtime,
-        metricsClient: ctx.clients.metricsClient,
         cacheManager: ctx.cacheManager,
-        todoScanner: ctx.clients.todoScanner,
         astGrepClient: ctx.astGrepClient,
-        biomeClient: ctx.clients.biomeClient,
-        ruffClient: ctx.clients.ruffClient,
-        knipClient: ctx.clients.knipClient,
-        jscpdClient: ctx.clients.jscpdClient,
-        deadCodeClients: ctx.clients.deadCodeClients,
-        govulncheckClient: ctx.clients.govulncheckClient,
-        gitleaksClient: ctx.clients.gitleaksClient,
-        trivyClient: ctx.clients.trivyClient,
-        opengrepClient: ctx.clients.opengrepClient,
-        depChecker: ctx.clients.depChecker,
-        testRunnerClient: ctx.clients.testRunnerClient,
-        goClient: ctx.clients.goClient,
-        rustClient: ctx.clients.rustClient,
+        // The MCP server has already loaded the analyzer graph (an MCP call has
+        // nothing to defer to), so it hands the handler the same one-shape seam
+        // every other caller uses rather than a second, field-by-field shape.
+        bootstrap: residentBootstrapAccess(ctx.clients),
         ensureTool: async (name) => (await import("../installer/index.js")).ensureTool(name),
         cleanStaleTsBuildInfo: () => [],
         resetDispatchBaselines: (cwdArg) => resetDispatchBaselines(cwdArg ?? cwd),
@@ -309,8 +298,13 @@ export function runTurnEndForIpc(cwd) {
     const inFlight = inFlightIpcTurnEnds.get(cwd);
     if (inFlight)
         return inFlight;
+    // Identity-guarded release (#1968's pattern): delete only if THIS run is
+    // still the registered one. A bare delete-by-key lets a late-settling run
+    // evict a live successor a second writer registered under the same cwd
+    // mid-flight, after which the next caller starts a duplicate Stop-hook pass.
     const run = runTurnEndForIpcNow(cwd).finally(() => {
-        inFlightIpcTurnEnds.delete(cwd);
+        if (inFlightIpcTurnEnds.get(cwd) === run)
+            inFlightIpcTurnEnds.delete(cwd);
     });
     inFlightIpcTurnEnds.set(cwd, run);
     return run;
@@ -374,3 +368,11 @@ export function _resetTurnEndChain() {
     pendingTurnEndDeliveries.clear();
     inFlightIpcTurnEnds.clear();
 }
+/**
+ * Test hook — read the `runTurnEndForIpc` in-flight map directly (#1968's
+ * ABA regression: a second writer replacing an entry mid-flight, then a
+ * late-settling first run evicting it with a bare delete-by-key).
+ */
+export function _peekInFlightIpcTurnEnds() {
+    return inFlightIpcTurnEnds;
+}

package/dist/clients/memory-sampler.js

@@ -29,9 +29,11 @@
  * `arrayBuffers` is used as the process-wide proxy instead — WASM linear
  * memory backs an ArrayBuffer, so it is already included there.
  */
+import { countPostingEntries, estimateWordIndexStoreBytes, } from "./word-index-store.js";
 import { getSharedTreeSitterClient } from "./tree-sitter-shared.js";
 import { getReviewGraphWorkspaceCacheSnapshot } from "./review-graph/builder.js";
 import { getDispatchCascadeCacheStats } from "./dispatch/integration.js";
+import { getLspDocumentTextRetentionSnapshot } from "./lsp/client.js";
 /** Every N turns, emit one `memory_sample` latency.log line (#1123 item 2). */
 export const MEMORY_SAMPLE_TURN_INTERVAL = 10;
 /** True on turn 10, 20, 30, ... — never on turn 0 (nothing meaningful is
@@ -104,6 +106,13 @@ export function toMemoryProcessUsage(mem, resourceUsage) {
  * process-global singletons) but every individual read is a `.size`/`.length`
  * access — see the module docstring's hard constraint.
  */
+/** Byte attribution for `dispatchCaches`, from measured per-entry costs: three
+ *  isolated-store runs put a recently-clean neighbor entry at 320 bytes, and
+ *  #2282 measured a 500-file batch's 1,000 session-fact entries at 439,560
+ *  bytes (~440 each). O(1) — the cache key and Map bookkeeping are included. */
+export function estimateDispatchCacheBytes(stats) {
+    return (stats.recentlyCleanNeighborCacheSize * 320 + stats.sessionFactEntries * 440);
+}
 export function collectMemorySampleSubsystems(wordIndex) {
     const reviewGraph = getReviewGraphWorkspaceCacheSnapshot();
     const treeSitterClient = getSharedTreeSitterClient();
@@ -121,16 +130,34 @@ export function collectMemorySampleSubsystems(wordIndex) {
         : null;
     const dispatchCaches = getDispatchCascadeCacheStats();
     return {
+        lsp: (() => {
+            const retention = getLspDocumentTextRetentionSnapshot();
+            return {
+                clients: retention.clients,
+                clientRoots: retention.roots,
+                incrementalTextEntries: retention.entries,
+                incrementalTextBytes: retention.bytes,
+            };
+        })(),
         reviewGraph,
         wordIndex: wordIndex
             ? {
                 docs: wordIndex.docLengths.size,
+                fileTable: wordIndex.fileTable.size,
                 postings: wordIndex.postings.size,
+                // O(distinct tokens), reading only `.length`/`.byteLength` per
+                // list — no posting ELEMENT is touched, so this stays inside the
+                // module docstring’s bounded-read constraint.
+                postingEntries: countPostingEntries(wordIndex),
+                residentBytes: estimateWordIndexStoreBytes(wordIndex),
                 forwardEntries: wordIndex.forward?.size ?? 0,
             }
             : null,
         treeSitter,
-        dispatchCaches,
+        dispatchCaches: {
+            ...dispatchCaches,
+            estimatedBytes: estimateDispatchCacheBytes(dispatchCaches),
+        },
     };
 }
 /** Assemble one full sample. `mem` is injectable for tests; defaults to a

package/dist/clients/message-end-attribution.js

@@ -0,0 +1,30 @@
+/** Session-local attribution captured before a stale message_end can drain. */
+let lastStableSessionId;
+let previousSessionId;
+/** Remember the stable id used by a live message_end's own cache row. */
+export function noteLiveMessageEndSessionId(sessionId) {
+    lastStableSessionId = sessionId;
+}
+/** Return the newest usable id for a stale message_end attribution. */
+export function getLastLiveMessageEndSessionId() {
+    return lastStableSessionId ?? previousSessionId;
+}
+/**
+ * Rotate the attribution anchor at the real session boundary. A queued stale
+ * message_end from the session being replaced may drain after this boundary,
+ * so retain exactly one prior anchor while making room for the replacement.
+ */
+export function rotateMessageEndAttribution() {
+    // Keep the prior anchor when no live message_end arrived this session:
+    // two back-to-back boundaries (reload/resume re-announcing) must not
+    // erase the only id a still-queued stale drain can use (#1956 R10).
+    if (lastStableSessionId !== undefined) {
+        previousSessionId = lastStableSessionId;
+    }
+    lastStableSessionId = undefined;
+}
+/** Full reset seam used by the session-state registry and test isolation. */
+export function resetMessageEndAttribution() {
+    lastStableSessionId = undefined;
+    previousSessionId = undefined;
+}

package/dist/clients/metrics-history.js

@@ -34,14 +34,31 @@ function isInsideGitRepo(startDir) {
 /**
  * Get current git commit hash (short)
  */
-function getCurrentCommit() {
-    if (!isInsideGitRepo(process.cwd())) {
+function getCurrentCommit(startDir) {
+    const repoStartDir = path.resolve(startDir);
+    if (!isInsideGitRepo(repoStartDir)) {
         return "unknown";
     }
+    let spawnDir = repoStartDir;
+    while (!fs.existsSync(spawnDir)) {
+        const parent = path.dirname(spawnDir);
+        if (parent === spawnDir)
+            return "unknown";
+        spawnDir = parent;
+    }
     try {
+        // #2095: execSync inherits the child's stderr to THIS process by
+        // default (only stdout is captured for the return value), so a
+        // failing `git rev-parse` prints its raw "fatal: ..." line straight
+        // into the pi TUI — the catch below only ever sees the thrown
+        // non-zero-exit error, never the already-inherited stream. The
+        // explicit stdio array pipes stderr instead, so a failure is fully
+        // contained: silent here, same as the "unknown" fallback it feeds.
         return execSync("git rev-parse --short HEAD", {
             encoding: "utf-8",
             timeout: 5000,
+            stdio: ["ignore", "pipe", "ignore"],
+            cwd: spawnDir,
         }).trim();
     }
     catch {
@@ -99,7 +116,7 @@ export function captureSnapshot(filePath, metrics) {
         pendingHistory = loadHistory();
     }
     const relativePath = path.relative(process.cwd(), filePath);
-    const commit = getCurrentCommit();
+    const commit = getCurrentCommit(path.dirname(filePath));
     const snapshot = {
         commit,
         timestamp: new Date().toISOString(),
@@ -152,7 +169,7 @@ export function captureSnapshots(files) {
     const history = loadHistory();
     for (const file of files) {
         const relativePath = path.relative(process.cwd(), file.filePath);
-        const commit = getCurrentCommit();
+        const commit = getCurrentCommit(path.dirname(file.filePath));
         const snapshot = {
             commit,
             timestamp: new Date().toISOString(),

package/dist/clients/middle-man-analysis.js

@@ -27,6 +27,7 @@
  * slice can add them once middle-man analysis has an AST-node entry point
  * rather than this text-based one.
  */
+import { escapeRegExp } from "./string-utils.js";
 /** Self-reference token + member-access separator, per languageId. Both the
  * self→field and field→method hops use the SAME separator in every language
  * covered here (true even for PHP's `$this->field->method()`). */
@@ -65,9 +66,6 @@ const MIN_CANDIDATE_METHODS = 2;
  * "mostly" — a class with a couple of forwarding convenience methods among
  * real logic must NOT flag (the exact distinction #325 asks for). */
 const DELEGATION_RATIO_THRESHOLD = 0.9;
-function escapeRegExp(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function buildForwardRegex(token, sep) {
     const t = escapeRegExp(token);
     const s = escapeRegExp(sep);
@@ -98,7 +96,7 @@ function paramNamesFromSignature(signature, languageId) {
         .map((raw) => {
         let name = raw;
         // Rest/spread params forward as themselves textually (`...args`).
-        const isRest = /^\.\.\./.test(name);
+        const isRest = name.startsWith("...");
         name = name.replace(/^\.\.\./, "");
         name = name.split("=")[0].trim(); // strip default value
         name = name.split(":")[0].trim(); // strip type annotation