pi-lens 4.1.5 → 4.2.0

package/dist/tools/lsp-diagnostics.js

@@ -6,13 +6,17 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { Type } from "../clients/deps/typebox.js";
 import { getProjectIgnoreMatcher, isExcludedDirName, } from "../clients/file-utils.js";
 import { getLSPService, groupFilesByPrimaryServer, runPerServerGroups, } from "../clients/lsp/index.js";
 import { buildScopeKey, createWorkspaceDiagnosticsCacheContext, } from "../clients/lsp/workspace-diagnostics-cache.js";
 import { getServersForFileWithConfig, primaryServerId, } from "../clients/lsp/config.js";
+import { mapWithConcurrency } from "../clients/map-with-concurrency.js";
 import { combineAbortSignals, withDeadline, } from "../clients/deadline-utils.js";
 import { applyAuxiliarySuppressions, retagAuxiliaryDiagnostics, } from "../clients/dispatch/auxiliary-lsp.js";
+import { applyLspFindingPolicy, loadProjectRulePolicyMap, } from "../clients/dispatch/finding-policy.js";
+import { hasStrictDispositionMarks } from "../clients/diagnostic-dispositions.js";
+import { recordDegradationOnce } from "../clients/degradation-ledger.js";
+import { logLatency } from "../clients/latency-logger.js";
 import { detectFileRole } from "../clients/file-role.js";
 import { hashDiagnosticContent, touchCompletedConfirmationPolicy, touchCoverageGap, } from "../clients/lsp/diagnostic-binding.js";
 import { classifyCascadeWaitTier } from "../clients/lsp/wait-policy/index.js";
@@ -20,23 +24,26 @@ import { attemptTsserverSyncDiagnostics } from "../clients/lsp/tsserver-sync.js"
 import { convertLspDiagnostics } from "../clients/dispatch/utils/lsp-diagnostics.js";
 import { demoteInferredProjectDiagnostics } from "../clients/lsp/inferred-project.js";
 import { isBlocking, reconcileScanDiagnostics, } from "../clients/widget-state.js";
-import { baseName, compactRenderResult } from "./render-compact.js";
-import { makeProgressReporter, scanningSummaryLine } from "./scan-progress.js";
+import { makeProgressReporter } from "./scan-progress.js";
 import { isWarmAttached, tryWarmAttachedDiagnostics, } from "../clients/warm-attach.js";
 import { extensionsForLanguage, SCAN_LANGUAGE_PRIORITY, } from "../clients/language-registry.js";
 const MAX_FILES = 100;
-const MAX_BATCH_FILES = 100;
+export const MAX_BATCH_FILES = 100;
 const MAX_DIAGNOSTICS = 200;
 const DEFAULT_BATCH_CONCURRENCY = 8;
 const MAX_BATCH_CONCURRENCY = 16;
 const DEFAULT_BATCH_FILE_DEADLINE_MS = 15_000;
 // LSP severities: 1=Error, 2=Warning, 3=Information, 4=Hint
-const SEVERITY_NAMES = {
+export const SEVERITY_NAMES = {
     1: "error",
     2: "warning",
     3: "information",
     4: "hint",
 };
+export const LSP_SEVERITY_FILTERS = [
+    ...Object.values(SEVERITY_NAMES),
+    "all",
+];
 function batchFileDeadlineMs() {
     const raw = Number(process.env.PI_LENS_LSP_BATCH_FILE_MS);
     return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_BATCH_FILE_DEADLINE_MS;
@@ -98,46 +105,6 @@ function boundedPositiveInt(value, fallback, min, max) {
  * for THIS tool's batch/directory sweep the same way #667 fixed it for the
  * workspace-diagnostics sweep.
  */
-async function mapWithConcurrency(items, concurrency, mapper, lspService, signal, onProgress) {
-    const results = [];
-    let completed = 0;
-    // Multiple original indices can map to the same file path (duplicate
-    // entries in an explicit `paths` batch) — track them as a per-file queue
-    // so each occurrence still lands in its own original slot.
-    const pendingIndices = new Map();
-    items.forEach((item, index) => {
-        const queue = pendingIndices.get(item);
-        if (queue)
-            queue.push(index);
-        else
-            pendingIndices.set(item, [index]);
-    });
-    const groups = groupFilesByPrimaryServer(items);
-    await runPerServerGroups(groups, concurrency, async (group) => {
-        if (signal?.aborted)
-            return;
-        const first = group.files[0];
-        if (first &&
-            lspService &&
-            !isWarmAttached() &&
-            typeof lspService.ensureWarmForSweep === "function") {
-            await lspService.ensureWarmForSweep(first, { signal });
-            if (signal?.aborted)
-                return;
-        }
-        for (const item of group.files) {
-            // Honor cancellation (Escape / turn abort): stop pulling new items
-            // rather than grind the whole batch. Completed entries are returned.
-            if (signal?.aborted)
-                return;
-            const index = pendingIndices.get(item).shift();
-            results[index] = await mapper(item, index);
-            completed += 1;
-            onProgress?.(completed, items.length);
-        }
-    }, signal);
-    return results;
-}
 /**
  * Project-ignore predicate rooted at `root`, fail-open. Lets a directory scan
  * honor the user's `.pi-lens.json` / `.gitignore` patterns — not just the
@@ -216,102 +183,8 @@ nextWriteIndex,
 // injecting "Unresolved from this turn" for three more turns after answering
 // "confirmed clean" for the same file. index.ts injects
 // `runtime.retireInlineBlockerOnConfirmedClean`. Optional/undefined in tests.
-onConfirmedNoBlockers) {
+onConfirmedNoBlockers, getService = getLSPService) {
     return {
-        name: "lsp_diagnostics",
-        label: "LSP Diagnostics",
-        description: "Get errors, warnings, and hints from language servers for a file or directory. " +
-            "Use BEFORE running builds to proactively check for issues. " +
-            "Works on directories by auto-detecting file extensions and scanning all matching files.",
-        promptSnippet: "Get LSP diagnostics for a file or directory (use before builds)",
-        renderResult: compactRenderResult(({ details, args, isError, text }) => {
-            // Streaming progress partials render the live bar (see scanningSummaryLine).
-            const scanning = scanningSummaryLine(details, text);
-            if (scanning)
-                return scanning;
-            if (isError) {
-                return `lsp_diagnostics — ${text.split("\n")[0] ?? "error"}`;
-            }
-            const count = details?.totalDiagnostics ?? details?.diagnostics?.length ?? 0;
-            const target = baseName(details?.filePath ?? args.path) || "workspace";
-            const files = details?.filesChecked ?? details?.filesScanned;
-            const scope = typeof files === "number" && files > 1
-                ? ` across ${files} files`
-                : target
-                    ? ` ${target}`
-                    : "";
-            const noun = count === 1 ? "diagnostic" : "diagnostics";
-            // #533: a batch/directory result with any unconfirmed files must NEVER
-            // compact-render as a bare "N diagnostics" — that erases the fact some
-            // files' clean status was never actually confirmed by the server.
-            const unconfirmedFiles = details?.unconfirmedFiles ?? 0;
-            const navigationOnlyFiles = details?.navigationOnlyFiles ?? 0;
-            if (navigationOnlyFiles > 0) {
-                return `lsp_diagnostics${scope} — ${count} ${noun} · ${details?.cleanFiles ?? 0} clean · ${navigationOnlyFiles} navigation-only`;
-            }
-            if (unconfirmedFiles > 0) {
-                const cleanFiles = details?.cleanFiles ?? 0;
-                const timedOutFiles = details?.timedOutFiles ?? 0;
-                const suffix = timedOutFiles > 0 ? ` (${timedOutFiles} timed out)` : "";
-                return `lsp_diagnostics${scope} — ${count} ${noun} · ${cleanFiles} clean · ${unconfirmedFiles} unconfirmed${suffix}`;
-            }
-            const outcomeCounts = details?.outcomeCounts;
-            const notConfirmed = outcomeCounts
-                ? (outcomeCounts.inconclusive ?? 0) +
-                    (outcomeCounts.unavailable ?? 0) +
-                    (outcomeCounts.unsupported ?? 0) +
-                    (outcomeCounts.failed ?? 0)
-                : 0;
-            if (notConfirmed > 0) {
-                return `lsp_diagnostics${scope} — ${count} ${noun} · ${notConfirmed} checks not confirmed`;
-            }
-            if ((details?.incompleteFiles ?? 0) > 0) {
-                return `lsp_diagnostics${scope} — incomplete (${details?.incompleteFiles} files not confirmed)`;
-            }
-            // Single-file mode: 0 diagnostics from an unconfirmed result — either a
-            // silent-on-clean server or (#570) a timed-out check — is not a clean
-            // render either.
-            if (count === 0 && details?.unconfirmed) {
-                return details?.timedOut
-                    ? `lsp_diagnostics${scope} — timed out (result may be incomplete)`
-                    : `lsp_diagnostics${scope} — unconfirmed (server cannot confirm clean)`;
-            }
-            return `lsp_diagnostics${scope} — ${count} ${noun}`;
-        }),
-        parameters: Type.Object({
-            path: Type.Optional(Type.String({
-                description: "File or directory path to check. For directories, all matching source files are scanned.",
-            })),
-            paths: Type.Optional(Type.Array(Type.String(), {
-                minItems: 1,
-                maxItems: MAX_BATCH_FILES,
-                description: "Explicit files to check as a bounded-concurrency batch. When provided, path is ignored.",
-            })),
-            severity: Type.Optional(Type.String({
-                enum: ["error", "warning", "information", "hint", "all"],
-                description: "Filter by severity level (default: all)",
-            })),
-            concurrency: Type.Optional(Type.Number({
-                description: "Batch/directory concurrency, in distinct LSP server groups run in parallel " +
-                    "(default 8, max 16) — not individual files. Files sharing one server " +
-                    "(e.g. a same-language batch) are always processed one at a time against " +
-                    "that server regardless of this value; this caps how many DIFFERENT " +
-                    "servers run concurrently.",
-            })),
-            waitMs: Type.Optional(Type.Number({
-                description: "Optional per-file LSP wait budget for batch diagnostics. Uses server defaults when omitted.",
-            })),
-            serverScope: Type.Optional(Type.String({
-                enum: ["primary", "all"],
-                description: "'primary' (fast, low-noise): only the file's actual language " +
-                    "server (e.g. typescript) — for 'does this have real type " +
-                    "errors'. 'all' (default): also touches cross-cutting auxiliary " +
-                    "scanners (ast-grep, opengrep, zizmor, typos, marksman) attached " +
-                    "to this file, including findings for files not yet dispatched " +
-                    "this session. Primary confirmation is always reported " +
-                    "separately from auxiliary findings regardless of this setting.",
-            })),
-        }),
         async execute(_toolCallId, params, _signal, onUpdate, ctx) {
             // Escape aborts the turn via ctx.signal; honor both it and the tool-call
             // signal so a batch/directory scan cancels rather than grinding on.
@@ -327,7 +200,7 @@ onConfirmedNoBlockers) {
                 ? Math.floor(typedParams.waitMs)
                 : undefined;
             const serverScope = typedParams.serverScope === "primary" ? "primary" : "all";
-            const lspService = getLSPService();
+            const lspService = getService();
             if (!lspService) {
                 return {
                     content: [
@@ -423,7 +296,17 @@ onConfirmedNoBlockers) {
         },
     };
 }
-async function collectDiagnosticsForFile(absPath, lspService, waitMs, serverScope = "all") {
+async function collectDiagnosticsForFile(absPath, lspService, 
+/**
+ * #3041: project root the per-rule `ignores` globs (#965) are resolved
+ * against. ast-grep's LSP publishes per-document diagnostics without
+ * applying them, so this standalone `source=lsp` query has to — the same
+ * carve-out the NAPI runner applies on the same file. Positioned before the
+ * optional parameters so it is structurally REQUIRED: an optional
+ * `string | undefined` would silently disable the carve-out for whichever
+ * caller forgot to pass it.
+ */
+scanRoot, waitMs, serverScope = "all") {
     let timedOut = false;
     let content;
     // `touchFile` is the authoritative collection boundary for every scope: it
@@ -450,9 +333,13 @@ async function collectDiagnosticsForFile(absPath, lspService, waitMs, serverScop
             const attached = await tryWarmAttachedDiagnostics(absPath, content, attachedBudgetMs, "sweep");
             if (attached?.available) {
                 const scopedDiagnostics = serverScope === "primary"
-                    ? attached.response.diagnostics.filter((item) => item.source === primaryServerId(absPath))
+                    ? attached.response.diagnostics.filter((item) => item.serverId === primaryServerId(absPath))
                     : attached.response.diagnostics;
-                const filtered = applyAuxiliarySuppressions(scopedDiagnostics, content, { fileRole: detectFileRole(absPath, content) });
+                const filtered = applyAuxiliarySuppressions(scopedDiagnostics, content, {
+                    fileRole: detectFileRole(absPath, content),
+                    filePath: absPath,
+                    scanRoot,
+                });
                 return {
                     diagnostics: filtered,
                     timedOut: false,
@@ -512,6 +399,8 @@ async function collectDiagnosticsForFile(absPath, lspService, waitMs, serverScop
     const filtered = content !== undefined
         ? applyAuxiliarySuppressions(diagnostics, content, {
             fileRole: detectFileRole(absPath, content),
+            filePath: absPath,
+            scanRoot,
         })
         : diagnostics;
     // #1095: surface the touch's content binding (only a touch that resolved
@@ -546,6 +435,7 @@ function diagnosticsToFileDiags(file, diagnostics) {
         severity: d.severity,
         message: d.message,
         source: d.source,
+        serverId: d.serverId,
         code: d.code,
     }));
 }
@@ -679,6 +569,97 @@ function demoteInferredForFile(file, diagnostics, cwd, lspService) {
         service: lspService,
     });
 }
+/**
+ * #3088: the probe lane's stored-disposition / rule-policy / inline-suppression
+ * gate — the same `clients/dispatch/finding-policy.ts` stack `mode=full` and
+ * the per-edit dispatcher apply, called once per file at the position
+ * `demoteInferredForFile` already established: AFTER the confirmation verdict
+ * (which asks "did the server answer for this content" and must not be
+ * influenced by a policy drop) and BEFORE the rendered output, the severity
+ * filter and `reconcileWidgetFromLspResult`. One filtered set for all three, so
+ * the text, the counts and the widget footer cannot disagree — and so the
+ * footer reconcile can no longer re-arm a finding the mark-time
+ * `reconcileWidgetDisposition` demoted.
+ *
+ * Fails OPEN: a filter that throws returns the unfiltered set plus one bounded
+ * degradation record. A finding that stays visible is recoverable; one silently
+ * hidden by a broken filter is the harm this lane exists to prevent
+ * (AGENTS.md shape 48).
+ */
+function applyProbeFindingPolicy(file, diagnostics, cwd, content, 
+/**
+ * Round 2 F1: the caller's severity threshold. The count reported to the
+ * agent must be scoped to the SAME threshold the rendered result is, or a
+ * `severity: "error"` probe of a repo carrying warning-level marks prints
+ * "suppressed by disposition: N … Not a clean verdict" on a result that IS
+ * clean at that threshold — the skill's own folder-check recipe would emit
+ * the banner on every check. The threshold is applied HERE, in the tool that
+ * owns both the render and the record, rather than in the three call sites
+ * (three copies of one subtraction) or in
+ * `clients/dispatch/finding-policy.ts`, which must stay threshold-free: its
+ * other caller (`mode=full`) has no severity axis at all.
+ */
+severity) {
+    const started = Date.now();
+    try {
+        const result = applyLspFindingPolicy(diagnostics, {
+            cwd,
+            filePath: file,
+            content,
+            policyMap: loadProjectRulePolicyMap(cwd),
+            fileRole: detectFileRole(file, content),
+        });
+        const inScopeBefore = applySeverityFilter(diagnostics, severity).length;
+        const suppressed = inScopeBefore - applySeverityFilter(result.kept, severity).length;
+        if (suppressed > 0) {
+            // One record per FILE that actually dropped something the caller would
+            // otherwise have SEEN, never one per finding (AGENTS.md "bounded
+            // observability"). `total` is the in-scope population for the same
+            // reason the count is, so the record and the rendered line agree.
+            logLatency({
+                type: "phase",
+                toolName: "lsp_diagnostics",
+                filePath: file,
+                phase: "lsp_probe_disposition_filter",
+                durationMs: Date.now() - started,
+                metadata: {
+                    suppressed,
+                    total: inScopeBefore,
+                },
+            });
+        }
+        return { kept: result.kept, inlineKept: result.inlineKept, suppressed };
+    }
+    catch (err) {
+        recordDegradationOnce({
+            kind: "lsp-probe-finding-policy",
+            subject: cwd,
+            reason: err instanceof Error ? err.message : String(err),
+        });
+        return { kept: diagnostics, inlineKept: diagnostics, suppressed: 0 };
+    }
+}
+/**
+ * #3088 AC5/AC7: the content a cache REPLAY needs to evaluate STRICT
+ * (`false-positive`) disposition anchors, which hash the finding's own line.
+ * A cache hit means the file is unchanged since the entry was recorded, so this
+ * is the same content the recording touch read — but it is a disk read the
+ * replay path exists to avoid, so it is paid ONLY when the store actually holds
+ * a strict mark. With no marks (the overwhelmingly common case) the probe path
+ * adds zero I/O and the weak-anchored marks apply without content at all.
+ */
+function replayContentForStrictMarks(file, cwd) {
+    if (!hasStrictDispositionMarks(cwd))
+        return undefined;
+    try {
+        return fs.readFileSync(file, "utf-8");
+    }
+    catch {
+        // Fail open — an unreadable file degrades to the weak-anchored filter
+        // rather than hiding or dropping anything.
+        return undefined;
+    }
+}
 function reconcileWidgetFromLspResult(file, rawDiags, confirmation, writeIndex, cwd, content, 
 // #1095: true when the result's content binding demonstrably mismatches disk
 // (boundToCurrentDisk === false). Such a result — even a NON-EMPTY one, which
@@ -704,7 +685,9 @@ observedAt) {
             scanOrigin: "lsp_diagnostics",
         });
         const retagged = retagAuxiliaryDiagnostics(diagnostics, rawDiags, content ?? "", { cwd, fileRole: detectFileRole(file, content) });
-        reconcileScanDiagnostics(file, retagged, true, writeIndex, observedAt);
+        const reconciled = reconcileScanDiagnostics(file, retagged, true, writeIndex, observedAt);
+        if (!reconciled)
+            return { confirmed: false, blocking: true };
         // #1561: the blocking tally comes from the SAME `isBlocking` predicate the
         // footer counts with — no second severity rule for the blocker-retire
         // decision to drift away from.
@@ -759,7 +742,13 @@ onConfirmedNoBlockers) {
             // fresh touch does, so it gets the same demotion. Without this, replaying
             // yesterday's cached blocker would re-cement an orphan file as blocking
             // after mode=full had demoted it.
-            const cachedDiags = await demoteInferredForFile(file, cached.diagnostics, cwd, lspService);
+            const demotedCached = await demoteInferredForFile(file, cached.diagnostics, cwd, lspService);
+            // #3088 AC5: a replay is served to the agent exactly like a fresh
+            // observation, so it passes the same filter. The cached set is already
+            // inline-suppression-clean (the record below stores `inlineKept`), so
+            // only the revocable store/config filters run here.
+            const cachedPolicy = applyProbeFindingPolicy(file, demotedCached, cwd, replayContentForStrictMarks(file, cwd), severity);
+            const cachedDiags = cachedPolicy.kept;
             const filteredDiags = applySeverityFilter(cachedDiags, severity);
             // #692: cached.diagnostics were already suppression-/skipTestFiles-
             // filtered at write time (this same code path); no file content was
@@ -780,10 +769,13 @@ onConfirmedNoBlockers) {
                 diagnostics: diagnosticsToFileDiags(file, filteredDiags),
                 confirmation,
                 primaryServerId: primaryServerId(file),
+                ...(cachedPolicy.suppressed > 0 && {
+                    dispositionSuppressed: cachedPolicy.suppressed,
+                }),
             };
         }
     }
-    const { diagnostics: rawDiags, timedOut, confirmedByTouch, unconfirmedServerIds, diagnosticsUnsupportedServerIds, content: collectedContent, binding, skipReason, } = await collectDiagnosticsForFile(file, lspService, waitMs, serverScope);
+    const { diagnostics: rawDiags, timedOut, confirmedByTouch, unconfirmedServerIds, diagnosticsUnsupportedServerIds, content: collectedContent, binding, skipReason, } = await collectDiagnosticsForFile(file, lspService, cwd, waitMs, serverScope);
     const health = lspService.getDiagnosticsHealth?.(file);
     // #570: a timed-out priming check is never a confirmed "clean" — treat it
     // as unconfirmed without consulting the (unrelated) silent-tier
@@ -842,6 +834,9 @@ onConfirmedNoBlockers) {
     }
     // #1645 review F3: one demotion rule for every writer of the widget store.
     effectiveRawDiags = await demoteInferredForFile(file, effectiveRawDiags, cwd, lspService);
+    // #3088: one filter for the output, the counts and the footer reconcile.
+    const policy = applyProbeFindingPolicy(file, effectiveRawDiags, cwd, collectedContent, severity);
+    effectiveRawDiags = policy.kept;
     const filteredDiags = applySeverityFilter(effectiveRawDiags, severity);
     const verdict = reconcileWidgetFromLspResult(file, effectiveRawDiags, confirmation, writeIndex, cwd, collectedContent, boundMismatch);
     if (verdict.confirmed && !verdict.blocking) {
@@ -864,7 +859,14 @@ onConfirmedNoBlockers) {
         confirmation !== "unconfirmed" &&
         diagnosticsUnsupportedServerIds.length === 0 &&
         unconfirmedServerIds.length === 0) {
-        cacheCtx.record(file, scopeKey, effectiveRawDiags, stat.mtimeMs, collectedContent !== undefined
+        // #3088: the entry records the INLINE-suppressed set, never the
+        // disposition/rule-policy-filtered one. An inline `pi-lens-ignore` comment
+        // cannot change without invalidating this content-keyed entry, so baking it
+        // in is safe and makes every later replay consistent with a fresh probe; a
+        // disposition mark or a `.pi-lens.json` rule can be revoked at any moment,
+        // so caching THEIR effect would keep a finding hidden after its mark was
+        // removed. The replay branch above re-applies those two on every serve.
+        cacheCtx.record(file, scopeKey, policy.inlineKept, stat.mtimeMs, collectedContent !== undefined
             ? hashDiagnosticContent(collectedContent)
             : undefined, stat.size);
     }
@@ -877,6 +879,9 @@ onConfirmedNoBlockers) {
         ...(skipReason !== undefined && { skipReason }),
         primaryServerId: primaryServerId(file),
         diagnosticsUnsupported: diagnosticsUnsupportedServerIds.length > 0,
+        ...(policy.suppressed > 0 && {
+            dispositionSuppressed: policy.suppressed,
+        }),
     };
 }
 async function runFileDiagnostics(absPath, severity, lspService, waitMs, nextWriteIndex, serverScope = "all", cwd = process.cwd(), 
@@ -886,7 +891,7 @@ onConfirmedNoBlockers) {
     // Reserve the token before awaiting this file's LSP result. The direct-file
     // path performs its own confirmation/reconciliation below (#1198).
     const writeIndex = nextWriteIndex?.();
-    const { diagnostics: rawDiags, timedOut, confirmedByTouch, unconfirmedServerIds, diagnosticsUnsupportedServerIds, content: collectedContent, binding, skipReason, } = await collectDiagnosticsForFile(absPath, lspService, waitMs, serverScope);
+    const { diagnostics: rawDiags, timedOut, confirmedByTouch, unconfirmedServerIds, diagnosticsUnsupportedServerIds, content: collectedContent, binding, skipReason, } = await collectDiagnosticsForFile(absPath, lspService, cwd, waitMs, serverScope);
     const lspHealth = lspService.getDiagnosticsHealth?.(absPath);
     const unavailable = lspUnavailableMessage(absPath, lspHealth);
     // #533: an empty result needs a confirmed/unconfirmed verdict — a push-only,
@@ -946,6 +951,9 @@ onConfirmedNoBlockers) {
         confirmation = "unconfirmed";
     // #1645 review F3: one demotion rule for every writer of the widget store.
     effectiveRawDiags = await demoteInferredForFile(absPath, effectiveRawDiags, cwd, lspService);
+    // #3088: one filter for the output, the counts and the footer reconcile.
+    const policy = applyProbeFindingPolicy(absPath, effectiveRawDiags, cwd, collectedContent, severity);
+    effectiveRawDiags = policy.kept;
     const filtered = applySeverityFilter(effectiveRawDiags, severity);
     const total = filtered.length;
     const truncated = total > MAX_DIAGNOSTICS;
@@ -965,8 +973,8 @@ onConfirmedNoBlockers) {
         });
     }
     const primaryId = primaryServerId(absPath);
-    const primaryDiags = limited.filter((d) => d.source === primaryId);
-    const auxiliaryDiags = limited.filter((d) => d.source !== primaryId);
+    const primaryDiags = limited.filter((d) => d.serverId === primaryId);
+    const auxiliaryDiags = limited.filter((d) => d.serverId !== primaryId);
     // Primary confirmation is always its own line, independent of how many
     // auxiliary findings exist — a wall of ast-grep/opengrep noise must never
     // bury whether the actual language server confirmed the file clean.
@@ -999,8 +1007,12 @@ onConfirmedNoBlockers) {
     // this result does NOT speak for, so "no auxiliary findings" can never be read
     // as "the security scanners found nothing".
     const coverageLine = unconfirmedServerIds.length > 0
-        ? `Auxiliary coverage INCOMPLETE — ${[...unconfirmedServerIds].join(", ")} did not answer within the wait budget, so ${unconfirmedServerIds.length === 1 ? "its findings are" : "their findings are"} NOT included here. This is not a clean bill of health for ${unconfirmedServerIds.length === 1 ? "that scanner" : "those scanners"}; re-check after the next edit, or use waitMs to wait longer.`
+        ? `Auxiliary coverage INCOMPLETE — ${[...unconfirmedServerIds].join(", ")} did not answer within the wait budget, so ${unconfirmedServerIds.length === 1 ? "its findings are" : "their findings are"} NOT included here. This is not a clean bill of health for ${unconfirmedServerIds.length === 1 ? "that scanner" : "those scanners"}; re-check after the next edit. waitMs can extend an ordinary wait, but it cannot override a session-demoted scanner.`
         : undefined;
+    // #3088: the #1616 suppressed-bucket rule on this lane — a policy drop is
+    // stated as a count, never left to read as "nothing was wrong here"
+    // (AGENTS.md shape 10). Bounded: one line per call, whatever the count.
+    const suppressedLine = dispositionSuppressedLine(policy.suppressed);
     let text;
     if (total === 0) {
         text = [
@@ -1008,6 +1020,7 @@ onConfirmedNoBlockers) {
             "",
             unavailable ?? "No auxiliary findings.",
             ...(coverageLine ? [coverageLine] : []),
+            ...(suppressedLine ? [suppressedLine] : []),
         ].join("\n");
     }
     else {
@@ -1021,6 +1034,8 @@ onConfirmedNoBlockers) {
         }
         if (coverageLine)
             lines.push("", coverageLine);
+        if (suppressedLine)
+            lines.push("", suppressedLine);
         if (unavailable)
             lines.unshift(unavailable, "");
         if (truncated) {
@@ -1047,6 +1062,9 @@ onConfirmedNoBlockers) {
                 code: d.code,
             })),
             totalDiagnostics: total,
+            ...(policy.suppressed > 0 && {
+                dispositionSuppressed: policy.suppressed,
+            }),
             truncated,
             unconfirmed,
             timedOut: unconfirmed ? timedOut : undefined,
@@ -1172,32 +1190,67 @@ async function collectBatchDiagnostics(files, severity, lspService, options) {
     const resolvedCwd = options.cwd ?? process.cwd();
     const cacheCtx = createWorkspaceDiagnosticsCacheContext(resolvedCwd);
     const scopeKey = buildScopeKey(options.serverScope ?? "all");
-    const results = await mapWithConcurrency(files, options.concurrency, async (file) => {
-        const work = collectFileDiagnosticResult(file, severity, lspService, options.waitMs, options.nextWriteIndex, options.serverScope, cacheCtx, scopeKey, resolvedCwd, options.onConfirmedNoBlockers);
-        const bounded = withDeadline(work, {
-            ms: batchFileDeadlineMs(),
-            onTimeout: "undefined",
-            onReject: "undefined",
-        });
-        const result = options.signal
-            ? await Promise.race([
-                bounded,
-                new Promise((resolve) => {
-                    if (options.signal?.aborted) {
-                        resolve(undefined);
-                        return;
-                    }
-                    options.signal?.addEventListener("abort", () => resolve(undefined), {
-                        once: true,
-                    });
-                }),
-            ])
-            : await bounded;
-        return (result ??
-            inconclusiveBatchResult(file, options.signal?.aborted
-                ? "Batch aborted before this file completed."
-                : `File check exceeded ${batchFileDeadlineMs()}ms.`));
-    }, lspService, options.signal, options.onProgress);
+    const resultsByIndex = new Map();
+    let completed = 0;
+    const pendingIndices = new Map();
+    files.forEach((file, index) => {
+        const queue = pendingIndices.get(file);
+        if (queue)
+            queue.push(index);
+        else
+            pendingIndices.set(file, [index]);
+    });
+    const groups = groupFilesByPrimaryServer(files);
+    await runPerServerGroups(groups, options.concurrency, async (group) => {
+        if (options.signal?.aborted)
+            return;
+        const first = group.files[0];
+        if (first &&
+            lspService &&
+            !isWarmAttached() &&
+            typeof lspService.ensureWarmForSweep === "function") {
+            await lspService.ensureWarmForSweep(first, {
+                signal: options.signal,
+            });
+            if (options.signal?.aborted)
+                return;
+        }
+        await mapWithConcurrency(group.files, 1, async (file) => {
+            // Keep duplicate explicit paths in their original result slots.
+            const index = pendingIndices.get(file).shift();
+            const work = collectFileDiagnosticResult(file, severity, lspService, options.waitMs, options.nextWriteIndex, options.serverScope, cacheCtx, scopeKey, resolvedCwd, options.onConfirmedNoBlockers);
+            const bounded = withDeadline(work, {
+                ms: batchFileDeadlineMs(),
+                onTimeout: "undefined",
+                onReject: "undefined",
+            });
+            const result = options.signal
+                ? await Promise.race([
+                    bounded,
+                    new Promise((resolve) => {
+                        if (options.signal?.aborted) {
+                            resolve(undefined);
+                            return;
+                        }
+                        options.signal?.addEventListener("abort", () => resolve(undefined), {
+                            once: true,
+                        });
+                    }),
+                ])
+                : await bounded;
+            resultsByIndex.set(index, result ??
+                inconclusiveBatchResult(file, options.signal?.aborted
+                    ? "Batch aborted before this file completed."
+                    : `File check exceeded ${batchFileDeadlineMs()}ms.`));
+            completed += 1;
+            options.onProgress?.(completed, files.length);
+        }, options.signal);
+    }, options.signal);
+    // The retired local pool returned only slots whose mapper had run. Keep that
+    // dense abort contract while restoring the original file order for callers.
+    const results = [...resultsByIndex.entries()]
+        .sort(([left], [right]) => left - right)
+        .map(([, result]) => result);
     // Persist whatever was recorded, including a partial/aborted sweep's
     // already-completed files — same "don't throw away confirmed work"
     // posture as `runWorkspaceDiagnostics`.
@@ -1228,8 +1281,8 @@ async function collectBatchDiagnostics(files, severity, lspService, options) {
     // `clean`/`unconfirmed` above already reflect ONLY the primary server's
     // confirmation; this split does the same job for the listed diagnostics.
     const primaryIdByFile = new Map(results.map((r) => [r.file, r.primaryServerId]));
-    const primaryDisplay = display.filter((d) => d.source === primaryIdByFile.get(d.file));
-    const auxiliaryDisplay = display.filter((d) => d.source !== primaryIdByFile.get(d.file));
+    const primaryDisplay = display.filter((d) => d.serverId === primaryIdByFile.get(d.file));
+    const auxiliaryDisplay = display.filter((d) => d.serverId !== primaryIdByFile.get(d.file));
     return {
         results,
         fileErrors,
@@ -1256,6 +1309,9 @@ async function runBatchFileDiagnostics(absPaths, severity, lspService, options)
     }
     const { results, fileErrors, lspHealthWarnings, total, truncated, display, primaryDisplay, auxiliaryDisplay, clean, unconfirmed, timedOut, outcomeCounts, incompleteFiles, } = await collectBatchDiagnostics(absPaths, severity, lspService, options);
     const navigationOnly = results.filter((result) => result.diagnosticsUnsupported).length;
+    // #3088: the batch's own suppressed bucket — one summed line, never one per
+    // file or per finding.
+    const dispositionSuppressed = results.reduce((sum, result) => sum + (result.dispositionSuppressed ?? 0), 0);
     const lines = [
         `Files checked: ${results.length}`,
         `Total diagnostics: ${total}`,
@@ -1310,6 +1366,9 @@ async function runBatchFileDiagnostics(absPaths, severity, lspService, options)
             lines.push("", `... (${total - MAX_DIAGNOSTICS} more diagnostics not shown)`);
         }
     }
+    const suppressedLine = dispositionSuppressedLine(dispositionSuppressed);
+    if (suppressedLine)
+        lines.push("", suppressedLine);
     return {
         content: [{ type: "text", text: lines.join("\n") }],
         details: {
@@ -1323,6 +1382,7 @@ async function runBatchFileDiagnostics(absPaths, severity, lspService, options)
             primaryDiagnosticsCount: primaryDisplay.length,
             auxiliaryDiagnosticsCount: auxiliaryDisplay.length,
             totalDiagnostics: total,
+            ...(dispositionSuppressed > 0 && { dispositionSuppressed }),
             truncated,
             cleanFiles: clean,
             unconfirmedFiles: unconfirmed,
@@ -1332,8 +1392,8 @@ async function runBatchFileDiagnostics(absPaths, severity, lspService, options)
                 file: result.file,
                 outcome: result.outcome,
                 reason: result.inconclusiveReason ?? result.error ?? result.unavailable,
-                primaryDiagnosticsCount: result.diagnostics.filter((diagnostic) => diagnostic.source === result.primaryServerId).length,
-                auxiliaryDiagnosticsCount: result.diagnostics.filter((diagnostic) => diagnostic.source !== result.primaryServerId).length,
+                primaryDiagnosticsCount: result.diagnostics.filter((diagnostic) => diagnostic.serverId === result.primaryServerId).length,
+                auxiliaryDiagnosticsCount: result.diagnostics.filter((diagnostic) => diagnostic.serverId !== result.primaryServerId).length,
             })),
             outcomeCounts,
             incompleteFiles: incompleteFiles > 0 ? incompleteFiles : undefined,
@@ -1397,6 +1457,9 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
     const filesToProcess = collectedFiles.slice(0, MAX_FILES);
     const { results, fileErrors, lspHealthWarnings, total, truncated, display, primaryDisplay, auxiliaryDisplay, clean, unconfirmed, timedOut, } = await collectBatchDiagnostics(filesToProcess, severity, lspService, options);
     const navigationOnly = results.filter((result) => result.diagnosticsUnsupported).length;
+    // #3088: the directory scan's own suppressed bucket — one summed line.
+    const dispositionSuppressed = results.reduce((sum, result) => sum + (result.dispositionSuppressed ?? 0), 0);
+    const suppressedLine = dispositionSuppressedLine(dispositionSuppressed);
     let text;
     if (total === 0) {
         // #533/#570: an unconfirmed-containing directory result must never
@@ -1415,6 +1478,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
                     ...lspHealthWarnings.slice(0, 10),
                 ]
                 : [cleanLine]),
+            ...(suppressedLine ? ["", suppressedLine] : []),
         ].join("\n");
     }
     else {
@@ -1454,6 +1518,8 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
         if (truncated) {
             lines.push("", `... (${total - MAX_DIAGNOSTICS} more diagnostics not shown)`);
         }
+        if (suppressedLine)
+            lines.push("", suppressedLine);
         text = lines.join("\n");
     }
     return {
@@ -1477,6 +1543,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
             primaryDiagnosticsCount: primaryDisplay.length,
             auxiliaryDiagnosticsCount: auxiliaryDisplay.length,
             totalDiagnostics: total,
+            ...(dispositionSuppressed > 0 && { dispositionSuppressed }),
             truncated,
             cleanFiles: clean,
             unconfirmedFiles: unconfirmed,
@@ -1490,6 +1557,22 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
     };
 }
 // ── helpers ─────────────────────────────────────────────────────────────
+/**
+ * #3088: the one rendering of the probe lane's policy drop, shared by the
+ * single-file, batch and directory renders so the three cannot word the same
+ * fact differently. Returns `undefined` when nothing was dropped — the #1616
+ * rule asks for a count when there IS one, not a "0 suppressed" line on every
+ * clean probe.
+ */
+function dispositionSuppressedLine(suppressed) {
+    if (suppressed <= 0)
+        return undefined;
+    return (`suppressed by disposition: ${suppressed} finding(s) dropped from this ` +
+        "result because they're marked false-positive/won't-fix, disabled by " +
+        "`.pi-lens.json` rule policy, or suppressed by an inline `pi-lens-ignore` " +
+        "comment. Not a clean verdict for those locations — they were found, " +
+        "then intentionally hidden.");
+}
 function applySeverityFilter(diags, severity) {
     if (severity === "all")
         return diags;