pi-lens 4.1.2 → 4.1.4

package/dist/clients/process-singletons.js

@@ -0,0 +1,210 @@
+/**
+ * Process singletons — state that must exist ONCE PER PROCESS, not once per
+ * module evaluation (#2146).
+ *
+ * WHY THIS MODULE EXISTS. pi evaluates the pi-lens module graph more than once
+ * in a single process: dogfood pass 3 measured one pid emitting `host_boot`
+ * nine times, another four times. Source and compiled entries load through
+ * separate module graphs, in-process subagent sessions re-enter the extension
+ * loader, and vitest re-evaluates modules on `vi.resetModules()`. Every
+ * module-scope `let` therefore exists N times, and any state whose CORRECTNESS
+ * depends on being the process's only copy silently breaks:
+ *
+ *  - `session-lifecycle.ts`'s registered primary: evaluation 2 starts with an
+ *    empty registration, classifies a subagent temp root as `primary`, and runs
+ *    the full session_start battery the #473/#2129/#2133 guard exists to
+ *    decline. Measured cost: three identical word-index full rebuilds in one
+ *    90s burst, 240.8s of CPU for one index.
+ *  - `instance-registry.ts`'s mutation tail: N tails are N concurrent
+ *    read-modify-write cycles over one `instances.json`. Measured: three
+ *    `instance-registry-corrupt` records in a 9s window, with two project roots
+ *    and one live instance lost from the file.
+ *
+ * PRECEDENT, both in-repo and both cited rather than invented:
+ *  - `clients/runtime-session.ts:1826` hangs `__piLensFirstSessionDone` /
+ *    `__piLensWarmupScheduled` on `globalThis` for exactly this reason.
+ *  - `clients/ndjson-logger.ts:125` does the versioned form: a
+ *    `Symbol.for()` key, a schema string, a version number, and an explicit
+ *    adopt-or-decline decision for a state written by a different build.
+ *
+ * This module generalizes the second one so each state family gets the same
+ * treatment without re-deriving the protocol per site.
+ *
+ * WHAT BELONGS HERE. Only state that is WRONG when duplicated: process-wide
+ * registrations, serialization points, and once-per-process latches. A memo or
+ * cache that re-derives the same answer from a stable source (an env read, a
+ * host probe) is merely wasteful when duplicated, not wrong, and stays at
+ * module scope — see the class-sweep table in the #2146 PR body for the
+ * per-family verdicts.
+ *
+ * VERSIONING AND THE OLDER-SHAPE FALLBACK. Two builds can meet in one process:
+ * a stale `dist/` graph and a fresh source graph, or an extension reload after
+ * an upgrade. Each family carries its own `version`. The rule is
+ * adopt-if-compatible, reset otherwise:
+ *
+ *  - Same schema and same version -> ADOPT the existing value. This is the
+ *    common case and the whole point of the module.
+ *  - Anything else (missing schema, different schema, older version, NEWER
+ *    version) -> do NOT adopt. A shape this build cannot read is not safely
+ *    readable in either direction, so guessing is worse than starting clean.
+ *    The cell is replaced with a fresh value from `create()` and ONE bounded
+ *    `process-singleton-reset` entry is logged per family, so a nine-evaluation
+ *    process still reports at most one row per family. Behavior after a reset is
+ *    exactly today's module-scope behavior for that family, which is the
+ *    fail-safe direction.
+ *
+ * The container key itself is versioned (`SINGLETON_HOST_KEY`). A future change
+ * to the CONTAINER shape bumps the key, so an old container is simply not
+ * found rather than mis-read.
+ */
+/**
+ * STATIC IMPORTS: none, deliberately. This module is a dependency leaf.
+ *
+ * It cannot import the degradation ledger. `instance-registry.ts` imports this
+ * module, and the ledger reaches `instance-reaper.ts` (through `extension-log`
+ * -> `file-utils` -> `git-tracked-ignore` -> `safe-spawn` -> `resource-sampler`),
+ * and `instance-reaper` imports the registry back. Any edge from here to the
+ * ledger closes a `no-client-cycles` cycle, which CI's dependency-boundaries
+ * lane rejects. A dynamic import does not help: the rule excludes
+ * `dynamic-import` only on the edge it evaluates, not on the intermediate edges
+ * of the cycle it walks.
+ *
+ * So the direction is inverted, exactly as `ndjson-logger.ts` already does for
+ * its own sink-write failures: this module keeps a bounded reset log, and
+ * `degradation-ledger.ts` PULLS it at read time through
+ * {@link getProcessSingletonResets} and folds it into `getDegradationSummary()`.
+ * The record still reaches `pilens_health`, with no import from here.
+ */
+/** Bump only when the CONTAINER shape changes, never for a family's shape. */
+const SINGLETON_HOST_KEY = Symbol.for("pi-lens.process-singletons.v1");
+const SINGLETON_SCHEMA = "pi-lens.process-singletons";
+/** Degradation kind emitted when an incompatible cell is discarded. */
+export const PROCESS_SINGLETON_RESET_KIND = "process-singleton-reset";
+const singletonHost = globalThis;
+/**
+ * The process's one container. Deliberately created on first read rather than
+ * at module scope of a single graph: whichever evaluation runs first wins, and
+ * every later evaluation adopts it.
+ */
+function container() {
+    const existing = singletonHost[SINGLETON_HOST_KEY];
+    if (existing instanceof Map)
+        return existing;
+    const fresh = new Map();
+    singletonHost[SINGLETON_HOST_KEY] = fresh;
+    return fresh;
+}
+function isAdoptable(cell, version) {
+    if (!cell || typeof cell !== "object")
+        return false;
+    const candidate = cell;
+    return (candidate.schema === SINGLETON_SCHEMA &&
+        candidate.version === version &&
+        candidate.value !== undefined);
+}
+/** One bounded reset log per process, capped so a pathological build pair
+ * cannot grow it without limit. */
+export const PROCESS_SINGLETON_RESET_LOG_FAMILY = "process-singleton-reset-log";
+const RESET_LOG_FAMILY = PROCESS_SINGLETON_RESET_LOG_FAMILY;
+const RESET_LOG_VERSION = 1;
+const RESET_LOG_CAP = 16;
+function resetLog() {
+    return getProcessSingleton(RESET_LOG_FAMILY, RESET_LOG_VERSION, () => ({
+        entries: [],
+    }));
+}
+/**
+ * Record that an incompatible cell was discarded. Bounded twice: once per
+ * family (a nine-evaluation process logs at most one entry per family) and once
+ * overall by {@link RESET_LOG_CAP}.
+ */
+function recordIncompatibleCell(family, wantedVersion, found) {
+    // The reset log is itself a family, so recording ITS reset would recurse.
+    // Dropping that one record is correct: the log it would be written to is the
+    // thing being discarded.
+    if (family === RESET_LOG_FAMILY)
+        return;
+    const log = resetLog();
+    if (log.entries.some((entry) => entry.family === family))
+        return;
+    if (log.entries.length >= RESET_LOG_CAP)
+        return;
+    log.entries.push({
+        family,
+        reason: `incompatible process singleton discarded (found schema=${String(found.schema)} ` +
+            `version=${String(found.version)}, this build wants schema=${SINGLETON_SCHEMA} ` +
+            `version=${wantedVersion})`,
+    });
+}
+/**
+ * Read-time view for `degradation-ledger.ts` (see the header). Never performs
+ * I/O and never throws, so folding it into a health summary is free.
+ */
+export function getProcessSingletonResets() {
+    return resetLog().entries.map((entry) => ({ ...entry }));
+}
+/**
+ * Return the process-wide value for `family`, creating it on the first
+ * evaluation that asks and adopting it on every later one.
+ *
+ * `version` describes the SHAPE of the value `create()` builds. Bump it when a
+ * build changes that shape, so a graph carrying the old shape is discarded
+ * instead of mis-read (see the module docstring's fallback rules).
+ *
+ * `create()` runs at most once per process per family, unless an incompatible
+ * cell forced a reset.
+ *
+ * `onIncompatible` is for values that own external resources. It runs before
+ * the cell is replaced, so the owner can tear those resources down safely.
+ */
+export function getProcessSingleton(family, version, create, onIncompatible) {
+    const cells = container();
+    const existing = cells.get(family);
+    if (isAdoptable(existing, version))
+        return existing.value;
+    if (existing !== undefined) {
+        // An incompatible cell from another build. One bounded row per family:
+        // nine evaluations must not write nine records (AGENTS.md's bounded-record
+        // rule; `recordDegradationOnce` keys on kind + subject).
+        recordIncompatibleCell(family, version, existing);
+        onIncompatible?.(existing.value);
+    }
+    const value = create();
+    cells.set(family, { schema: SINGLETON_SCHEMA, version, value });
+    return value;
+}
+/**
+ * Test-only: drop the process-wide container so the next
+ * {@link getProcessSingleton} call rebuilds every family from `create()`.
+ *
+ * This clears the GLOBAL state, not a module-local copy — a reset that only
+ * cleared module scope would be the very defect this module fixes, and would
+ * make every suite that relies on isolation pass vacuously (catalog shape 7).
+ */
+export function _resetProcessSingletonsForTests() {
+    singletonHost[SINGLETON_HOST_KEY] = new Map();
+}
+/**
+ * Test-only: install a raw cell so a suite can exercise the older/newer-shape
+ * fallback without needing two real builds in one process.
+ */
+export function _seedProcessSingletonCellForTests(family, cell) {
+    container().set(family, cell);
+}
+// --- Module-evaluation ordinal (#2146 observability) ---
+const EVALUATION_ORDINAL_FAMILY = "module-evaluation-ordinal";
+const EVALUATION_ORDINAL_VERSION = 1;
+/**
+ * How many times this process has evaluated the pi-lens module graph, 1-based.
+ *
+ * Called once, at module scope of `clients/startup-timing.ts`, so the number it
+ * returns is the evaluation count of the graph that contains the extension
+ * entry. It is carried on `host_boot.metadata.evaluationOrdinal` so a multi-eval
+ * process is greppable from `latency.log` instead of having to be inferred by
+ * counting `host_boot` lines per pid — the observability gap #2146 names.
+ */
+export function nextModuleEvaluationOrdinal() {
+    const state = getProcessSingleton(EVALUATION_ORDINAL_FAMILY, EVALUATION_ORDINAL_VERSION, () => ({ evaluations: 0 }));
+    state.evaluations += 1;
+    return state.evaluations;
+}

package/dist/clients/process-snapshot.js

@@ -0,0 +1,68 @@
+/**
+ * The extension runtime's door onto the ONE process-table seam (#2443).
+ *
+ * `scripts/lib/process-scan.mjs` owns what a process listing IS: the field →
+ * platform-column table, the Windows CIM/WQL and POSIX `ps` command
+ * composition, the WQL escaping, and the row parser. This module owns how
+ * clients/ RUNS one, which is genuinely different from how a script runs one
+ * and stays different on purpose:
+ *
+ * - the child and its stdout pipe are `unref`'d (#1155) so a one-shot
+ *   `pi --print` can settle without waiting on a CIM query;
+ * - a child that blows its timeout is terminated through the caller's own
+ *   tree-kill-and-verify machinery (#1864 F3), injected as `onTimeout` — a
+ *   sweep that leaks its own scanner is the defect the sweep exists to fix;
+ * - the outcome carries a `SpawnCollectStatus`, so "the table is empty" and
+ *   "the query never ran" stay distinguishable and the caller can record the
+ *   degradation (#1857).
+ *
+ * WHY THE SEAM IS IMPORTED FROM scripts/ RATHER THAN LIVING HERE: the .mjs
+ * header argues it in full. Short version — `scripts/prune-agent-worktrees.mjs`
+ * is a SessionStart/SubagentStop hook that runs inside freshly created agent
+ * worktrees, where `clients/*.js` (gitignored build output) does not exist
+ * yet, so the shared half has to be the side that needs no build. This file
+ * is the single crossing point; nothing else in clients/ imports scripts/.
+ */
+import { spawnCollectStdoutResult, } from "./child-unref.js";
+import { buildProcessQuery, parseProcessTable, } from "../scripts/lib/process-scan.mjs";
+/**
+ * Re-exported, not redefined. `windowsExe` resolves an absolute System32
+ * interpreter path for a spawn this process is about to make (a bare
+ * `powershell.exe`/`taskkill.exe` is resolvable through a PATH a caller can
+ * shadow, and these spawns decide what gets killed) — one definition of that
+ * rule is the whole point of the seam.
+ */
+export { windowsExe } from "../scripts/lib/process-scan.mjs";
+/**
+ * Run one process-table query on the extension's spawn rails.
+ *
+ * Never throws and never rejects: an unbuildable query (a Windows-only column
+ * asked for on POSIX, an empty filter) resolves as `spawn-error` with no rows,
+ * the same shape every other failure takes, because every caller here is
+ * best-effort instrumentation or a best-effort sweep.
+ */
+export async function queryProcessTable(request, options) {
+    let query;
+    try {
+        query = buildProcessQuery(request.fields, {
+            filter: request.filter,
+            excludeSelfPid: request.excludeSelfPid,
+        });
+    }
+    catch {
+        return { rows: [], status: "spawn-error", serverSideFiltered: false };
+    }
+    const result = await spawnCollectStdoutResult(query.command, query.args, { shell: false, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }, { timeoutMs: options.timeoutMs, onTimeout: options.onTimeout });
+    return {
+        // Whatever the collector kept is parsed rather than discarded here: it
+        // drops stdout on a non-zero exit (that output is not evidence of what
+        // is NOT running) but KEEPS the partial table from a timed-out child,
+        // and the caller decides what a partial table is worth by reading
+        // `status`. Re-deciding that here would be a second policy.
+        rows: parseProcessTable(result.stdout, query.tabSeparated, query.fields),
+        status: result.status,
+        exitCode: result.exitCode,
+        timeoutKill: result.timeoutKill,
+        serverSideFiltered: query.serverSideFiltered,
+    };
+}

package/dist/clients/project-diagnostics/fresh-fetch.js

@@ -415,9 +415,10 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // Deliberately never calls `writeCache`: there is nothing fresher to write
         // back, only what turn_end already produced.
         //
-        // No double-count / honesty gap (#533): `consumeTestFindings`
-        // (`runtime-context.ts`) reads-and-clears this SAME cache key once, to
-        // inject a one-shot "fix before continuing" message into the NEXT turn.
+        // No double-count / honesty gap (#533): explicit `pilens_turn_end`
+        // delivery may call `consumeTestFindings` (`runtime-context.ts`) to
+        // read-and-clear this SAME cache key once. Automatic Pi delivery uses a
+        // non-context custom entry and never consumes this pull-diagnostics cache.
         // This task only ever reads (never clears) it, so it can't race that
         // consumption into re-delivering a message twice — at most it surfaces
         // the same underlying failures a second time, through a different

package/dist/clients/project-diagnostics/runner-adapters/madge.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { compareOrdinal } from "../../string-utils.js";
 function resolveCyclePath(cwd, file) {
     return path.isAbsolute(file) ? file : path.resolve(cwd, file);
 }
@@ -36,7 +37,7 @@ export function circularDepsToProjectDiagnostics(cwd, circular) {
     for (const dep of circular) {
         const key = cycleMembers(dep)
             .map((f) => resolveCyclePath(cwd, f))
-            .sort((a, b) => a.localeCompare(b))
+            .sort(compareOrdinal)
             .join("|");
         if (seen.has(key))
             continue;

package/dist/clients/project-diagnostics/runner-adapters/runner-findings.js

@@ -1,3 +1,4 @@
+import { isRunnerErrorResult, } from "../../test-runner-client.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { advisoryPathKey, validateAdvisoryProvenance, } from "../../advisory-provenance.js";
@@ -59,6 +60,31 @@ export function testResultToProjectDiagnostics(result, stale = false) {
             source: "project-scan",
         }));
     }
+    // #2532: a RUNNER error (timeout, missing provider/binary, a config
+    // failure — the suite itself never produced a verdict) is not a finding
+    // the agent introduced, exactly like the turn-end delivery framing
+    // (#2522) already treats it. `isRunnerErrorResult` is the single seam
+    // both surfaces read so the identical `TestResult` cannot classify
+    // differently here than it does in the turn-end message.
+    if (isRunnerErrorResult(result)) {
+        return [
+            {
+                filePath: result.file,
+                severity: "info",
+                semantic: "none",
+                tool: "test-runner",
+                runner: result.runner,
+                rule: `test:${result.runner}`,
+                message: `${stalePrefix}Test run error: ${result.error}`,
+                source: "project-scan",
+            },
+        ];
+    }
+    // #2532 review S3: a counted failure stays blocking even when `error` is
+    // ALSO set (pytest exit 2 "Interrupted" after `2 failed, 1 passed` — see
+    // `isRunnerErrorResult`'s doc). The pre-fix message mentioned `error`
+    // here via a ternary this PR's first version dropped; restored so the
+    // interruption is not silently lost from a still-blocking finding.
     return [
         {
             filePath: result.file,
@@ -67,9 +93,7 @@ export function testResultToProjectDiagnostics(result, stale = false) {
             tool: "test-runner",
             runner: result.runner,
             rule: `test:${result.runner}`,
-            message: `${stalePrefix}${result.error
-                ? `Test run error: ${result.error}`
-                : `${result.failed} test(s) failed`}`,
+            message: `${stalePrefix}${result.failed} test(s) failed${result.error ? ` (runner also reported: ${result.error})` : ""}`,
             source: "project-scan",
         },
     ];

package/dist/clients/project-diagnostics/scanner.js

@@ -5,6 +5,7 @@ import { evaluateRules } from "../dispatch/fact-rule-runner.js";
 import { runProviders } from "../dispatch/fact-runner.js";
 import { FactStore } from "../dispatch/fact-store.js";
 import { canHandle as astGrepCanHandle, getLang as astGrepGetLang, evaluateAstGrepRules, loadSg, } from "../dispatch/runners/ast-grep-napi.js";
+import { detectFileKind } from "../file-kinds.js";
 import { isTestFile } from "../file-utils.js";
 import { isAtOrAboveHomeDir } from "../path-utils.js";
 import { getProjectDiagnosticsScannerMaxFiles } from "../project-scale.js";
@@ -32,27 +33,30 @@ const FACT_RULE_EXTENSIONS = new Set([
     ".mjs",
     ".cjs",
 ]);
-// Which languages the scan runs tree-sitter rules for: every language that has
-// (a loadable grammar) AND (a non-disabled rules/tree-sitter-queries/<lang>/ dir).
+// Which languages the scan runs tree-sitter rules for. Identical to the shared
+// per-edit resolver (EXT_TO_LANG), which since #2424 is itself a projection of
+// the canonical language registry — so the scan and the per-edit path cannot
+// disagree about `.tsx`→tsx / `.jsx`→javascript / the c-vs-cpp header split.
+// (`.tsx` resolves to the tsx grammar, not typescript: the typescript grammar
+// ERRORs on JSX; typescript RULES still apply because `queriesForLanguage(...)`
+// below merges the typescript rule set onto tsx.)
 //
-// The base is the shared per-edit resolver (EXT_TO_LANG — the single
-// ext→grammar-id authority), so c/cpp/csharp/php/css and the .tsx→tsx /
-// .jsx→javascript nuances can never drift from the per-edit path. `.tsx` resolves
-// to the tsx grammar (not typescript: the typescript grammar ERRORs on JSX); // spellchecker:disable-line
-// typescript RULES still apply because `queriesForLanguage(...)` below merges the
-// typescript rule set onto tsx.
+// java + kotlin used to be layered on here because EXT_TO_LANG lacked them:
+// they have loadable grammars and rule dirs (java: 24 rules, kotlin: 1) but no
+// per-edit runner `appliesTo` entry, so only this broad project scan runs them.
+// The registry now owns their extensions, so the spread is gone and this is a
+// plain alias. scanner.test.ts asserts this map covers every non-disabled rule
+// dir whose grammar is loadable, so adding a language dir fails a test until
+// its extension is registered in the registry.
 //
-// java + kotlin are layered on here: they have loadable grammars and rule dirs
-// (java: 24 rules, kotlin: 1) but no per-edit runner `appliesTo` entry, so only
-// this broad project scan runs them. scanner.test.ts asserts this map covers
-// every non-disabled rule dir whose grammar is loadable, so adding a language dir
-// fails a test until its extension is registered here (or in EXT_TO_LANG).
-export const TREE_SITTER_EXT_TO_LANG = {
-    ...EXT_TO_LANG,
-    ".java": "java",
-    ".kt": "kotlin",
-    ".kts": "kotlin",
-};
+// This map is the scan's language RESOLVER, not its eligibility gate: it now
+// answers for grammars with no rule dir too (bash/dart/elixir/lua/ocaml/swift/
+// zig), and the pass gates each file on `hasTreeSitterRules` so a grammar
+// without rules costs no read (#2424 review, F2).
+// `Readonly` because the projection is `Object.freeze`d at the source (#2424
+// review, S4) — the mutable `Record` type is what let the pre-#2424 spread
+// layer java/kotlin on by hand in the first place.
+export const TREE_SITTER_EXT_TO_LANG = EXT_TO_LANG;
 function normalizeSeverity(severity) {
     if (severity === "error" || severity === "warning" || severity === "hint") {
         return severity;
@@ -100,7 +104,9 @@ async function scanFileMajorRules(cwd, files, signal) {
     const queryMap = treeSitterReady
         ? await queryLoader.loadQueries(cwd)
         : undefined;
-    const facts = new FactStore();
+    // Subject labels this store's capacity-eviction telemetry distinctly from
+    // the other five production FactStore instances (#2243 review round 3, F1).
+    const facts = new FactStore("project-diagnostics-scanner");
     const pi = { getFlag: () => undefined };
     const treeSitter = [];
     const factRules = [];
@@ -113,6 +119,29 @@ async function scanFileMajorRules(cwd, files, signal) {
     // file out, so the caller can report a truncated filesScanned honestly.
     let filesScanned = 0;
     let wasmAborted = isTreeSitterWasmAborted();
+    /**
+     * Does this project actually have ENABLED tree-sitter rules for `langId`?
+     *
+     * The gate below used to read "does the extension have a grammar", which was
+     * the same question only because the ext -> grammar map hand-listed exactly
+     * the twelve grammars that also ship a `rules/tree-sitter-queries/<lang>/`
+     * dir. #2424 projected that map from the registry's full grammar column, so
+     * bash/dart/elixir/lua/ocaml/swift/zig arrived WITHOUT rules and every such
+     * file started being read, walked and counted for a rule set that is empty
+     * (#2424 review, F2). Memoized per language: `queriesForLanguage` rebuilds
+     * and filters its array on every call, and the scan asks once per file.
+     */
+    const ruleCoverage = new Map();
+    const hasTreeSitterRules = (langId) => {
+        if (!queryMap || !client)
+            return false;
+        const memo = ruleCoverage.get(langId);
+        if (memo !== undefined)
+            return memo;
+        const covered = queriesForLanguage(queryMap, langId).length > 0;
+        ruleCoverage.set(langId, covered);
+        return covered;
+    };
     const scanTreeSitterFile = async (filePath, langId, content) => {
         if (!queryMap || !langId || !client || content === null)
             return;
@@ -141,7 +170,7 @@ async function scanFileMajorRules(cwd, files, signal) {
         }
     };
     const scanFactRulesFile = async (filePath, content) => {
-        facts.clearFileFactsFor(filePath);
+        facts.dropFileFacts(filePath);
         // Seed the exact bytes already supplied to tree-sitter so the file-content
         // provider is skipped by runProviders.
         facts.setFileFact(filePath, "file.content", content);
@@ -160,9 +189,11 @@ async function scanFileMajorRules(cwd, files, signal) {
         const startedAt = Date.now();
         try {
             const rootNode = lang.parse(content).root();
-            const fileDiagnostics = evaluateAstGrepRules(filePath, rootNode, cwd, "jsts", {
+            const fileDiagnostics = evaluateAstGrepRules(filePath, rootNode, cwd, detectFileKind(filePath), {
                 maxMatchesPerRule: AST_GREP_SCAN_MAX_MATCHES_PER_RULE,
                 maxTotalDiagnostics: AST_GREP_SCAN_MAX_DIAGNOSTICS_PER_FILE,
+                content,
+                sgModule,
             });
             for (const diagnostic of fileDiagnostics) {
                 astGrep.push(fromDispatchDiagnostic(diagnostic, "ast-grep-napi"));
@@ -187,7 +218,10 @@ async function scanFileMajorRules(cwd, files, signal) {
             if (isTestFile(filePath))
                 continue;
             const ext = path.extname(filePath);
-            const langId = TREE_SITTER_EXT_TO_LANG[ext];
+            // A grammar is not a consumer: only a language this project has
+            // ENABLED rules for can turn this file's bytes into a finding.
+            const grammarId = TREE_SITTER_EXT_TO_LANG[ext];
+            const langId = grammarId && hasTreeSitterRules(grammarId) ? grammarId : undefined;
             const factEligible = FACT_RULE_EXTENSIONS.has(ext);
             let astGrepLang;
             if (sgModule && astGrepCanHandle(filePath)) {
@@ -264,7 +298,10 @@ async function scanFileMajorRules(cwd, files, signal) {
             finally {
                 // This store belongs to the scan, and every consumer of this file's
                 // content and derived facts has completed by the end of the iteration.
-                facts.clearFileFactsFor(filePath);
+                // Drop without pinning: the scan is sequential and owns this store, so
+                // there is no concurrent walk to guard against, and pinning every
+                // scanned file would exempt it from the capacity cap (#2243).
+                facts.dropFileFacts(filePath);
             }
         }
         if (wasmAborted) {