pi-lens 4.2.0 → 4.2.1

package/CHANGELOG.md

@@ -16,6 +16,51 @@ All notable changes to pi-lens will be documented in this file.
 
 ### Security
 
+## [4.2.1] - 2026-09-17
+
+### Added
+
+- **Carried cascade advisories and demoted delta rows now render with explicit age labels (refs #3167)** — a cascade result carried across a turn boundary renders `(carried 1 turn · scanned Xm ago)` from the run's own observation stamp (#1444's `publishedAt`, threaded to `CascadeRun.observedAt`), a coverage advisory computed entirely from carried indeterminate runs is labeled the same way on its own line, and a demoted delta file group closes with one scan-age line under that file's own header through `formatCacheAgeLabel` — so an agent can tell a just-observed finding from one re-served from cache. An absent or partial stamp renders `scan age unknown`, never a fabricated number. The two `partial` delivery-gate entries naming this gap resolve to full, and each carrying turn emits one bounded `cascade_carry_rendered` record.
+
+- **Stale carried findings are now re-verified against the live server before re-delivery (refs #3170)** — a deferred-origin finding whose file has not moved re-served turn after turn even when the root cause was fixed elsewhere (the #1093 cross-file class on the advisory lane). At turn_end, up to four such files per turn are re-observed through the probe's `touchFile` path (bounded by a wall budget and the turn's abort signal, both of which re-arm the rest for the next turn). A carried finding is dropped only when the touch itself completed its confirmation policy and no longer reports it; a silent, skipped or wedged answer keeps the finding verbatim and renders an explicit "(re-verify incomplete)" label in the turn-end advisory and in `lens_diagnostics` delta output — never a false clean. Findings sourced from an auxiliary scanner are left to their own lane rather than scored against a primary-scope answer. One `persistent_reverify` latency record per pass, carrying the candidate, touched, outcome and skip counts.
+
+### Fixed
+
+- **The widget `suppressed: N` chip keeps counting a marked finding (refs #3158)** — A finding marked `false-positive` or `suppress` stopped contributing to the pi-lens footer's `suppressed: N` chip as soon as any fresh `lens_diagnostics source=lsp` probe ran, because the probe hands the widget store the post-disposition filtered set and the store replaces a file's entries wholesale. Suppressed rows the latest scan no longer reports are now retained, and a suppressed row is no longer treated as a blocker anywhere — it cannot draw a red footer row, displace a live finding, or enter the turn-end blocker sweep. Known window: the retained row is retired by the file's next edit, even one that leaves the marked line unchanged and the mark still applying, and nothing re-creates it; the chip therefore counts a mark until that file is next edited rather than for as long as the mark stands.
+
+- **`lens_diagnostic_mark` widget cross-check missed mis-cased paths on case-insensitive filesystems (refs #3160)** — the #802 line-reanchor
+  cross-check looked up the raw, possibly mis-cased, mark target against
+  widget state, which is keyed case-preservingly on POSIX; on a
+  case-insensitive filesystem (macOS APFS, `nocase` vfat/ntfs3/cifs) this
+  silently missed the live diagnostic and fell back to the fuzzy line guess.
+  The lookup now normalizes the path to on-disk casing before checking
+  widget state. `pilens_analyze` also recorded diagnostics under the raw,
+  un-normalized spelling of its agent-supplied `file` argument, so it now
+  normalizes on write too — both sides key on-disk casing consistently. The
+  `lsp_diagnostics`/`lens_diagnostics(source: "lsp", scope: "paths")`
+  explicit-`paths` batch had the same raw-key write for a mis-cased entry
+  (refs #3182); it now normalizes on write as well.
+
+- **`guard-bash` refuses `git worktree remove` on a tree whose `node_modules` is a symlink into another checkout (refs #3173)** — twice on 2026-09-16 a fixer removed a worktree whose `node_modules` was symlinked to the shared checkout (the fixer playbook's own speed convention), and git followed the link and emptied the shared install, breaking every other agent building or testing in that window. The PreToolUse hook now denies (exit 2) ANY `git worktree remove <tree>` — force or not — when `<tree>` is a real linked git worktree and its `node_modules` entry is a symlink whose target resolves outside `<tree>`; the stderr note names the fix (`rm <tree>/node_modules`, then retry). A path that does not exist, is not a git worktree, or whose `node_modules` is a real directory (or a symlink that stays inside the worktree) is left to git.
+
+- **The tests-tree write guard no longer crashes the Unit tests job on a scratch-directory race (refs #3179)** — `tests/support/tests-tree-write-guard-setup.ts` armed a recursive `fs.watch` over `tests/` with no `'error'` listener. On Linux, node's recursive watch is a JS polyfill that re-scans a changed subfolder with a synchronous `readdirSync`; when `tests/index-2992-integration.test.ts` removed its own exempt scratch directory (`tests/support/.index-2992-scratch`) between the change event and that rescan, the polyfill emitted an unhandled `'error'` event and killed the whole vitest process with exit 1 and no failing test. The guard now attaches an `'error'` handler that swallows ENOENT for paths under its existing exempt prefixes and records any other error once via `console.warn`, never per event.
+
+- **A tool path with `/../` in it no longer orphans its own diagnostics record (refs #3184)** — `normalizeMapKey`, the canonical map-key normalizer, passed dot segments through unchanged on macOS and Linux whenever the path's casing was already right, so an absolute path containing `/../` (or `/./`, or a doubled separator) keyed under a spelling no other writer or reader ever derives. A `lens_diagnostic_mark`, `pilens_analyze` or `lens_diagnostics {source:"lsp"}` call typed that way produced an orphan widget row, a missed line reanchor and a split disposition anchor. The POSIX arm now folds dot segments before it looks at casing, so every consumer inherits one key per file; the fold is pure string algebra, so a relative path is still never resolved against the process working directory. The `lsp_diagnostics` single-`path` mode, which derives its key without that normalizer, was folded onto the same expression its `paths` batch already uses.
+
+- **`tmp-fixture-hygiene`'s governance owner attributed another test file's async-recreated directory to itself (refs #3186)** — PR #3168's CI run redded `tests/config/tmp-fixture-hygiene.test.ts` over `pi-lens-tool-policy-conventions-*` directories owned by `tests/clients/tool-policy-conventions.test.ts`. That file's `afterEach` removed its `setupTestEnvironment` directory synchronously while `saveProjectSnapshot` (called from within the test) was still mid-flight: its body persist is dispatched to a worker thread / main-thread fallback the caller never awaited, and that persist's write path recreates the just-removed directory via a recursive `mkdir` — measured directly landing ~10-50ms later, unforced, on a bare invocation of the real function. Fixed at the producer: the `afterEach` now awaits the repo's own `waitForProjectSnapshotPersistsForTests()` drain seam before cleanup, the same seam five other test files already use for this, closing the race instead of admitting its symptom in the tmp-hygiene baseline.
+
+- **A cold diagnostics sweep no longer burns its whole warm-up budget on a silent TypeScript server (closes #3187)** — The shared pre-sweep warm-up (`LSPService.ensureWarmForSweep`) touches a representative file to prove the server can answer, and that touch collects nothing. The tsserver sync clean-confirm race was gated on a collecting touch, so on a project whose classic typescript-language-server publishes nothing for clean files the warm-up could only reach a verdict by waiting out its entire cold-start budget — measured on a real session at 6,972 ms of a 20,000 ms budget, and on a fake tier3-silent server through the real service at 4,509 ms (initial attempt plus the retry) against 308 ms after the fix. The warm-up is now eligible for the sync confirm on its own identity while still collecting nothing, so it neither primes nor erases the file's last-known diagnostics, and a server that does not offer the sync commands still certifies through the existing silent-clean fallback instead of failing warm-up and skipping the sweep group.
+
+- **No more `🔴 STOP — 0 issue(s) must be fixed:` with nothing under it (refs [#3188](https://github.com/apmantza/pi-lens/issues/3188))** — When #2028's deleted-path gate retracted *every* blocker — the common shape being a bash command that writes a file and deletes it again (`cat > probe.py … ; rm probe.py`), whose recovered path the per-edit pipeline still analyses — the readback-failed re-render path emitted the STOP header with a count of zero and an empty body, so the agent read a "must be fixed" imperative naming no finding and no file. The external reporter measured 154 of 159 of their banners in that zero form. The blocker renderer now returns nothing when it has no blockers (the same guard `formatDiagnostics` already carries), and the re-render path no longer appends a bare separator, which would still have been delivered as a whitespace-only tool-result block. A partial retraction is unchanged: the surviving blockers render with their own count, and the coverage/auto-fix tail after the blocker section is still delivered. The existing bounded `finding_dead_path_drop` record (`store=stop-blocker`, `deliveredCount=0`) is unchanged and remains the way a total retraction is observed.
+
+- **Tool schemas survive registration on hosts with callable schemas (closes #3195)** — On a host whose `typebox` specifier resolves to an ArkType-style builder — `@oh-my-pi/pi-coding-agent` (the `@oh-my-pi/omptype` shim it rewrites an extension's `typebox` import to), and any other host whose schema builders return callables — every pi-lens tool lost its parameter schema at registration: the console-capture seam replaced each function-valued property of a tool definition with a capture wrapper, and a schema is itself a function there. All 13 tools then rendered `type Args = unknown;` and rejected every `xd://` call with `root: schema must be an object or boolean`. Callable schemas are now handed to the host untouched, using the host's own `isArkSchema` test, while `execute`, `renderResult` and command handlers keep their console-capture window. Hosts whose schemas are plain objects (`@earendil-works/pi-coding-agent`) are unaffected.
+
+- **`mode=delta` no longer renders a file's quality (or project-diagnostics) rows under another file's header (refs #3196)** — `formatDeltaMode`'s quality loop and `appendProjectDiagnosticsDeltaLines` both suppressed a file's header with `if (!lines.includes(rel)) lines.push(rel)`, true whenever an earlier tier already pushed that exact path — but each tier's rows were appended to the END of the shared buffer, not under that earlier header. A file present in more than one report (actionable, quality, or project) had its later tier's rows, and any age/re-verify-incomplete label describing them, land under whichever OTHER file's header happened to be last in the buffer, misdirecting an agent acting on the finding. The render is now a single pass grouped by file: every tier appends into that file's own bucket, which makes the header-membership guess (and #3168's label-prediction dedupe) unnecessary — both are removed.
+
+- **`mutation (advisory)` no longer false-reds on `scripts/with-memory-watch.mjs` (closes #3108)** — its two source-text pins in `tests/scripts/with-memory-watch.test.ts` matched only the un-instrumented wrapper, so Stryker's in-place `// @ts-nocheck` + switch-mutant scaffolding (added even with no mutant active) failed the dry run on every PR that edited the file. The pins now tolerate that optional wrapper and still red when the pinned code is genuinely removed.
+
+- **The skills-directory degradation record no longer drops which entry file triggered it (refs #3175)** — when `resources_discover`'s `skills/` lookup misses, the ledger's `reason` field concatenated a classification that repeats `skillsDir` (already recorded verbatim in `subject`) ahead of the entry file's directory — the one fact the record uniquely carries for diagnosing a managed-cache-relocated entry (#2587). Once the shared root was long enough that the two exceeded the ledger's 200-char cap (a real dry-roll/CI-lane TMPDIR shape), the head-preserving truncation kept the redundant path and silently dropped the entry directory. The ledger's copy of the reason now uses a short, path-free classification tag instead, leaving room for the entry directory to survive intact; the user-facing notification is unaffected.
+
 ## [4.2.0] - 2026-09-16
 
 ### Added

package/dist/clients/actionable-warnings.js

@@ -251,7 +251,7 @@ function lineInModifiedRanges(line, ranges) {
         return true;
     return ranges.some((range) => line >= range.start - 2 && line <= range.end + 2);
 }
-function recordFromLspDiagnostic(diag, filePath, cwd) {
+export function recordFromLspDiagnostic(diag, filePath, cwd) {
     const line = diag.range.start.line + 1;
     const column = diag.range.start.character + 1;
     // Keep agreement keyed to the producer that supplied the diagnostic. The
@@ -736,7 +736,7 @@ export async function buildActionableWarningsReport(args) {
  * off-hook loop run byte-identical logic — the deferral must not become a
  * second, drifting copy of the enrichment.
  */
-async function enrichFileFromLsp(cwd, args, target, deps) {
+export async function enrichFileFromLsp(cwd, args, target, deps) {
     const { lspService } = deps;
     const { filePath } = target;
     const out = [];
@@ -1110,12 +1110,24 @@ export function mergeActionableWarningsReports(args) {
         }
         mergedFiles++;
         const merged = incumbent
-            ? {
-                ...incumbent,
-                fileSeq: incumbent.fileSeq ?? entry.fileSeq,
-                generatedAt: olderStamp(incumbent.generatedAt ?? newerReport?.generatedAt, entry.generatedAt ?? olderReport?.generatedAt),
-                warnings: mergeWarnings([...incumbent.warnings, ...entry.warnings]),
-            }
+            ? incumbent.reVerified || incumbent.reVerifyIncomplete
+                ? // #3170: the runtime just RE-OBSERVED this file (the bounded
+                    // persistent-reverify pass) — the fresh observation supersedes
+                    // the carried entry instead of unioning with it: a converged
+                    // finding would otherwise survive its own supersession via the
+                    // id-union in `mergeWarnings`.
+                    {
+                        ...incumbent,
+                        fileSeq: incumbent.fileSeq ?? entry.fileSeq,
+                        generatedAt: olderStamp(incumbent.generatedAt ?? newerReport?.generatedAt, entry.generatedAt ?? olderReport?.generatedAt),
+                        warnings: incumbent.warnings,
+                    }
+                : {
+                    ...incumbent,
+                    fileSeq: incumbent.fileSeq ?? entry.fileSeq,
+                    generatedAt: olderStamp(incumbent.generatedAt ?? newerReport?.generatedAt, entry.generatedAt ?? olderReport?.generatedAt),
+                    warnings: mergeWarnings([...incumbent.warnings, ...entry.warnings]),
+                }
             : { ...entry };
         if (deferredPublish) {
             // Mark it, so the next in-band publish carries it forward across the
@@ -1541,7 +1553,7 @@ export function formatActionableWarningsAdvisory(report, cwd, host = "pi") {
     const files = report.files.filter((file) => file.warnings.some((warning) => !warning.suppressed));
     const fileList = files
         .slice(0, 5)
-        .map((file) => `  ${file.displayPath}: ${file.warnings.filter((warning) => !warning.suppressed).length}`)
+        .map((file) => `  ${file.displayPath}: ${file.warnings.filter((warning) => !warning.suppressed).length}${file.reVerifyIncomplete ? " (re-verify incomplete)" : ""}`)
         .join("\n");
     const more = files.length > 5 ? `\n  ... and ${files.length - 5} more file(s)` : "";
     const safe = report.summary.autoFixEligible > 0

package/dist/clients/cascade-format.js

@@ -3,6 +3,7 @@ import { retagAuxiliaryDiagnostics } from "./dispatch/auxiliary-lsp.js";
 import { applyFindingPolicy, loadProjectRulePolicyMap, renderedRuleIdentities, } from "./dispatch/finding-policy.js";
 import { detectFileRole } from "./file-role.js";
 import { logLatency } from "./latency-logger.js";
+import { formatCacheAgeLabel } from "./finding-delivery-gate.js";
 import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
 import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 export function formatCascadeNeighborDiagnostics(cwd, neighbors, options = {}) {
@@ -140,6 +141,12 @@ export function buildResolvedFoundCascadeRun(cwd, neighbor) {
         },
         neighborCount: 1,
         diagnosticCount: diagnostics.length,
+        // #3168 F3: the #1444 publish stamp — the run's own observation time, so
+        // the carried-render age label states the real age instead of claiming
+        // no stamp exists.
+        ...(neighbor.publishedAt !== undefined
+            ? { observedAt: neighbor.publishedAt }
+            : {}),
     };
 }
 /**
@@ -289,3 +296,20 @@ function readNeighborContent(filePath) {
         return undefined;
     }
 }
+/**
+ * Fix B (#3167/#3168): the carry label for a cascade run re-rendered at a
+ * later turn_end. The carry is bounded to ONE turn (`RuntimeCoordinator.beginTurn`
+ * drops anything that would reach 2), so the honest label names the carry
+ * count. #3168 F3 corrected this docstring's earlier claim that no stamp
+ * exists: the run DOES carry one (`observedAt`, threaded from #1444's
+ * `publishedAt` through the resolved-found plumb), so the age half renders
+ * from it via `formatCacheAgeLabel`. The deferred-compute re-park arm has no
+ * stamp and correctly falls to the neutral wording. Returns `undefined` for
+ * non-carried runs: no label noise on fresh observations.
+ */
+export function cascadeCarrySuffix(carriedTurns, observedAt) {
+    if (carriedTurns === undefined || carriedTurns < 1)
+        return undefined;
+    const noun = carriedTurns === 1 ? "turn" : "turns";
+    return `(carried ${carriedTurns} ${noun} · ${formatCacheAgeLabel(observedAt)})`;
+}

package/dist/clients/extension-log.js

@@ -211,6 +211,48 @@ function inCaptureWindow(fn) {
 function isCaptureSeam(prop) {
     return (prop === "on" || (typeof prop === "string" && prop.startsWith("register")));
 }
+/**
+ * True for a host SCHEMA value that happens to be callable.
+ *
+ * A tool definition's `parameters` is DATA the host reads, not a pi-lens
+ * callback — but the schema builder pi-lens imports is host-provided
+ * (`clients/deps/typebox.ts`: the host resolves the bare `typebox`
+ * specifier), and on a host whose builders are ArkType-style the schema is a
+ * FUNCTION. `@oh-my-pi/pi-coding-agent` rewrites an extension's `typebox`
+ * import to its own `src/extensibility/legacy-typebox.ts`, which re-exports
+ * `@oh-my-pi/omptype`'s builders; those return a callable whose prototype
+ * carries `toJsonSchema`/`assert`. `inCaptureWindow` returns a plain rest
+ * wrapper with neither, so the host falls off its ark branch, the wire schema
+ * degrades to `undefined`, and every xd:// device renders `type Args =
+ * unknown` and rejects every call with `root: schema must be an object or
+ * boolean` (#3195).
+ *
+ * The predicate IS the host's own, copied from `@oh-my-pi/pi-ai@18.2.4`
+ * `src/utils/schema/wire.ts:21-27` (`isArkSchema`) — the same test the host's
+ * `applyToolProxy` (`@oh-my-pi/pi-coding-agent@18.2.4`
+ * `src/extensibility/tool-proxy.ts:26`) uses to leave a callable schema
+ * unbound for exactly this hazard ("`bind()` … drops the schema surface …
+ * so a bound schema later stringifies to `undefined`"). Matching it means
+ * pi-lens declines to wrap precisely the values the host reads as schemas,
+ * and still wraps everything else.
+ * `tests/clients/pi-host-callable-schema-contract.test.ts` asserts against
+ * that upstream predicate (and against a fixture measured from a real
+ * `@oh-my-pi/omptype@18.2.4` schema), not against this copy of it.
+ *
+ * Deliberately NOT an allow-list of handler keys (`execute`, `renderResult`,
+ * `handler` — the measured set today): that is `isCaptureSeam`'s #1434 S1a
+ * mistake one level down (defect shape 34, spelling enumerator). The host's
+ * own `ToolDefinition` already declares `onSession`, `renderCall` and
+ * `shellEnv`, and `registerCommand` takes `getArgumentCompletions`; the day
+ * pi-lens adopts one of those, an allow-list drops its console capture
+ * SILENTLY — the #1333 regression this seam exists to prevent — while this
+ * predicate keeps wrapping it.
+ */
+function isCallableSchema(value) {
+    return (typeof value === "function" &&
+        typeof value.toJsonSchema === "function" &&
+        typeof value.assert === "function");
+}
 /**
  * Wrap every function value found in `value`, in place. Handles the two
  * shapes a `register*`/`on` call takes today: a function passed directly
@@ -218,6 +260,11 @@ function isCaptureSeam(prop) {
  * function ONE level inside a plain options/definition object
  * (`options.handler`, `tool.execute`).
  *
+ * Only the property walk screens for a callable schema (#3195): every
+ * function pi-lens passes as a register argument DIRECTLY is a handler
+ * (`on`, `registerMessageRenderer`), measured across the whole activation,
+ * so a schema can only ever arrive as a property of a definition object.
+ *
  * Deliberately NOT recursive past that one level (#1434 perf review): a tool
  * definition's `parameters`/`schema` is a large, deeply nested TypeBox object
  * that holds no functions, but walking its full tree on every `registerTool`
@@ -249,7 +296,7 @@ function wrapFunctionsInPlace(value) {
     const obj = value;
     for (const key of Object.keys(obj)) {
         const propValue = obj[key];
-        if (typeof propValue === "function") {
+        if (typeof propValue === "function" && !isCallableSchema(propValue)) {
             assignWrapped(obj, key, propValue);
         }
     }

package/dist/clients/finding-delivery-gate.js

@@ -284,20 +284,19 @@ export const DELIVERY_SURFACES = {
     "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness"], ['store: "late-runner-findings"'], { evidenceMin: 2 }),
     "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end 🧪 cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible " +
         "(`settleCascadeRuns`), but an unsettled compute can carry over to a " +
-        "later turn (bounded by a carry cap) — this round does not freshness-" +
-        "gate that carry-over window.", "live", [], {
-        status: "partial",
-        partialReason: "A carried-over cascade result (run.carriedTurns > 0) is rendered " +
-            "without an age label. Follow-up: surface carriedTurns as an explicit " +
-            "label when > 0, or route through formatCacheAgeLabel using the run's " +
-            "own timestamp.",
-    }),
+        "later turn (bounded by a carry cap) — a carried-over result renders " +
+        "with an explicit `(carried N turns · scanned Xm ago)` label (#3167, " +
+        "#3168 F3), so the agent can tell it from a fresh observation.", "live", ["cascadeCarrySuffix("], { evidenceMin: 1 }),
     "runtime-turn:cascade-coverage-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end cascade-coverage-gap advisories (graph/binding/budget).", "Explains what the cascade check could NOT confirm this turn — not a " +
         "finding with a cited path, an absence-of-coverage disclosure computed " +
-        "from this turn's own indeterminate-run list.", "live", [], {
-        status: "partial",
-        partialReason: "Same cascade carry-over caveat as runtime-turn:cascade-blocker.",
-    }),
+        "from this turn's own indeterminate-run list. An advisory computed from " +
+        "a carried indeterminate run is labeled `(carried N turns · <age>)` " +
+        "(#3167, #3168 F4 — dropped on mixed carried/fresh buckets). The age " +
+        "half reads `scan age unknown` on this surface today: no indeterminate-" +
+        "run producer stamps `observedAt` (only the resolved-found plumb does, " +
+        "`clients/cascade-format.ts`), and one unstamped carried run collapses " +
+        "the whole bucket's age rather than claiming the stamped runs' (#3168 " +
+        "F13). The carry COUNT is always real.", "live", ["withCarryLabel("], { evidenceMin: 3 }),
     // #3102: the cold-neighbour cascade run is BUILT here, in the quiet-window
     // reconcile (`onResolvedFound` in index.ts), a turn earlier than the
     // `runtime-turn:cascade-blocker` render that finally carries it — so it is

package/dist/clients/lsp/cascade-tier.js

@@ -344,6 +344,9 @@ export function registerCascadeTierReconcileTask(getLspService, options = {}) {
                         filePath: o.filePath,
                         serverId: o.serverId,
                         diagnostics: o.diagnostics,
+                        ...(o.publishedAt !== undefined
+                            ? { publishedAt: o.publishedAt }
+                            : {}),
                     });
                 }
                 else if (o.outcome === "resolved-clean" && o.publishedAt != null) {

package/dist/clients/lsp/index.js

@@ -3955,6 +3955,12 @@ export class LSPService {
             // (undefined = the race didn't produce an answer; the end-of-wait
             // fallback below may still fill it in on a timed-out empty result).
             let tsserverSyncEligible = false;
+            // #1639/#3187: `ensureWarmForSweep`'s readiness probe (`source:
+            // "lsp_sweep_warmup"`) is the one touch that is single-server,
+            // `clientScope: "primary"` and NON-collecting at the same time. Both
+            // sync-confirm gates below and the per-server wait's settle-source tag
+            // read the same fact, so it is derived once, here.
+            const isWarmupTouch = source === "lsp_sweep_warmup";
             let tsserverSyncConfirmed;
             let diagnosticsUnsupportedServerIds = [];
             if (diagnosticsMode !== "none") {
@@ -4128,8 +4134,19 @@ export class LSPService {
                 // synchronous gate and pays ZERO extra work — not even the snapshot
                 // read; a non-typescript `silentOnClean` server instead gets the
                 // generic (non-racing) clean-confirm fallback further below.
+                // #3187: the warm-up touch is eligible too, though it collects
+                // nothing. `collectDiagnostics` is here because a touch that discards
+                // its diagnostics has nothing to carry a confirm INTO — but the warm-up
+                // is not after diagnostics at all, it is after a VERDICT, and the sync
+                // commands are the only thing that can hand a tier3-silent server one
+                // before its whole cold-start budget lapses (measured: 6,972 ms of a
+                // 20,000 ms warm-up budget, then the sweep touched the same file again
+                // in 113 ms). It stays non-collecting on purpose: a collecting warm-up
+                // would write this file's `lastKnownDiagnostics` from primary-scope-only
+                // evidence — and an empty confirm would DELETE a previously confirmed
+                // record — which is the #1470/#1493 prime hazard from a new direction.
                 if (!notifyWriteTimedOut &&
-                    options.collectDiagnostics === true &&
+                    (options.collectDiagnostics === true || isWarmupTouch) &&
                     clientScope === "primary" &&
                     spawned.length === 1 &&
                     spawned[0].client.serverId === "typescript" &&
@@ -4279,8 +4296,8 @@ export class LSPService {
                     // consumer can tell them apart instead of double-counting. Omitted
                     // (rather than passed as "pull") on the common path — the client
                     // already defaults to "pull", and existing tests assert the exact
-                    // argument list `waitForDiagnostics` is called with.
-                    const isWarmupTouch = source === "lsp_sweep_warmup";
+                    // argument list `waitForDiagnostics` is called with. #3187: derived
+                    // once above, next to the sync-confirm gate that reads the same fact.
                     // #743: per-server — a server we DID push to still gets the
                     // version-baseline wait even when a sibling was debounced away.
                     const waitForDiagnostics = () => !notifySkippedServerIds.has(entry.info.id) &&
@@ -5127,9 +5144,9 @@ export class LSPService {
             // ever double-deciding typescript's own touches — when the sync race
             // was attempted and failed/was unavailable, typescript's existing
             // "falls through to inconclusive, unchanged" contract (#707) is
-            // preserved exactly; typescript touches that never enter that gate
-            // (e.g. `collectDiagnostics: false`, like `ensureWarmForSweep`'s own
-            // warm-up call) are still eligible here as a genuine bonus fix. Scoped
+            // preserved exactly for a COLLECTING touch; #3187 re-admits the
+            // non-collecting warm-up, which has no end-of-wait retry to fall
+            // through to (see the exclusion's own comment below). Scoped
             // to `clientScope === "primary"`/`spawned.length === 1` exactly like
             // the sync-eligible gate above (and like `ensureWarmForSweep`'s own
             // `clientScope: "primary"` warm-up touch) so a multi-server
@@ -5149,7 +5166,17 @@ export class LSPService {
                 // below means the one server IS the primary, so this is the same condition
                 // written in the vocabulary the rest of the merge now uses.
                 !primaryNotifyWriteTimedOut &&
-                !tsserverSyncEligible &&
+                // #3187: the warm-up is sync-ELIGIBLE now, and eligibility alone must
+                // not cost it this fallback. For a collecting touch the exclusion is
+                // #707's contract (the end-of-wait retry above is typescript's second
+                // chance, and failing it stays inconclusive); the warm-up collects
+                // nothing, so that retry's `collected !== undefined` precondition can
+                // never hold for it and the exclusion would leave a server whose
+                // `typescript.tsserverRequest` is unavailable stranded inconclusive —
+                // a #744 warm-up failure, its retry, and a SKIPPED sweep group, where
+                // today it is certified clean. Reaching here at all means the race
+                // produced no answer, so this decides nothing the sync already decided.
+                (!tsserverSyncEligible || isWarmupTouch) &&
                 clientScope === "primary" &&
                 spawned.length === 1 &&
                 getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
@@ -6824,6 +6851,13 @@ export class LSPService {
             });
             const warmupAttempt = this.touchFile(representativeFile, content, {
                 diagnostics: "document",
+                // #3187: stays FALSE. This touch wants a verdict, not findings: its
+                // `clientScope: "primary"` evidence does not speak for the auxiliaries
+                // the sweep's own `clientScope: "all"` touch waits on, so collecting
+                // here would prime this file's `lastKnownDiagnostics` from a narrower
+                // scope than the result that follows (and an empty confirm would delete
+                // a previously confirmed record). `touchFile`'s sync-confirm gates key
+                // off `source` instead, so the verdict still arrives at ~grace+RTT.
                 collectDiagnostics: false,
                 clientScope: "primary",
                 source: "lsp_sweep_warmup",

package/dist/clients/mcp/analyze.js

@@ -273,8 +273,15 @@ export async function analyzeFile(filePath, cwd, options = {}) {
     const durationMs = Date.now() - start;
     if (options.record !== false) {
         // Mirror pipeline.ts's recording so pilens_diagnostics (mode=all) and
-        // pilens_health see what this analysis found.
-        recordDiagnostics(absPath, result.diagnostics);
+        // pilens_health see what this analysis found. #3160 F1: `absPath` here
+        // is derived raw from the agent-supplied `file` arg (path.resolve above)
+        // — unlike pipeline.ts, which always records ctx.filePath, already
+        // canonicalized to on-disk casing by createDispatchContext (#2016/
+        // #3098). Normalize before recording so a mis-cased analyze call lands
+        // under the SAME widget-state key a canonical per-edit write already
+        // uses, instead of an orphaned key no reader (raw or normalized) can
+        // reach.
+        recordDiagnostics(normalizeMapKey(absPath), result.diagnostics);
         if (result.diagnostics.length > 0) {
             getDiagnosticTracker().trackShown(result.diagnostics);
         }

package/dist/clients/path-utils.js

@@ -161,6 +161,7 @@ function adoptCanonicalCasing(held, canonical) {
  *   (needed for new files where we haven't written yet)
  *
  * On POSIX:
+ * - Folds `.`, `..` and duplicate separators first (#3184, see below).
  * - If the file exists: adopts the on-disk CASING of the trailing segments
  *   (see `adoptCanonicalCasing`) — no lowercasing, no symlink resolution.
  * - If the file doesn't exist: returns the path as-is, case-PRESERVING. On a
@@ -169,6 +170,26 @@ function adoptCanonicalCasing(held, canonical) {
  *   answer for a path that EXISTS can tell the two apart, and for a path that
  *   does not exist there is no such answer to ask for.
  *
+ * Why the POSIX arm folds dot segments (#3184): the casing arm returns the
+ * caller's own spelling whenever `adoptCanonicalCasing` changes nothing, and
+ * for `<base>/src/../src/a.ts` it always changes nothing — `realpath` answers
+ * a string with FEWER segments, which a casing-only rewrite cannot express, so
+ * it declines and the caller's un-folded spelling came back as the map key.
+ * Every canonical writer keys through `path.resolve` first (`ctx.filePath` =
+ * `normalizeMapKey(resolveAgainstAncestors(...))`, `clients/dispatch/
+ * runner-context.ts:49`), so a consumer that passes an ALREADY-absolute
+ * agent-typed path straight in (`tools/lens-diagnostic-mark.ts`,
+ * `clients/mcp/analyze.ts`) derived an orphan key that no reader could reach.
+ * Folding here is pure string algebra — no cwd, no filesystem — so a relative
+ * path stays relative (`src/../x` → `x`, `../x` → `../x`, never resolved
+ * against `process.cwd()`; refs #2490, where a cwd fold broke every monorepo)
+ * and a symlinked package still keys under the path the caller held. These
+ * are `path.resolve`'s own TEXTUAL `..` semantics, which is exactly what
+ * makes a folded reader key equal to the canonical writer's key: where a
+ * `..` sits right after a symlinked directory, textual folding and the
+ * kernel disagree, and both sides of every comparison take the textual
+ * answer because every canonical writer already resolved that way.
+ *
  * Why POSIX canonicalizes casing at all (#3098, the #1024 defect's live half):
  * a case-insensitive POSIX filesystem — macOS's default APFS, `nocase` vfat /
  * ntfs3 / cifs mounts — makes `SUB/a.ts` and `sub/a.ts` ONE file, so a raw
@@ -194,16 +215,37 @@ export function normalizeFilePath(filePath) {
     // Convert backslashes to forward slashes first
     const normalized = filePath.replace(/\\/g, "/");
     if (process.platform !== "win32" && !isWindowsPath(normalized)) {
+        // #3184. `path.posix`, not the host default: this branch is already
+        // committed to POSIX parsing of a slash-folded string (shape 2). Only
+        // the POSIX arm needs this — the win32 arm below reaches `realpath` or
+        // `win32.resolve`/`win32.normalize` on every path, all of which fold
+        // dot segments already (measured: `C:\repo\src\..\src\a.ts` →
+        // `c:/repo/src/a.ts` on this POSIX host, before this change) — and
+        // folding BEFORE the arms would also move which arm a degenerate
+        // drive-letter path selects (`path.posix.normalize("C:/repo/../..")`
+        // is `"."`, no longer Windows-shaped).
+        // Two inputs keep the caller's spelling instead:
+        // - "" is a non-path sentinel in this codebase's path-typed fields
+        //   (see `normalizeLoggedPath`'s doc); `posix.normalize("")` invents
+        //   ".", the process cwd.
+        // - a UNC root (`\\server\share`, slash-folded to `//server/share`)
+        //   reaches THIS arm on a POSIX host, because `isWindowsPath` tests
+        //   the already-folded string and sees no backslash; POSIX
+        //   `normalize` collapses its leading `//` to `/`, renaming the path
+        //   to an unrelated local one.
+        const folded = normalized === "" || normalized.startsWith("//")
+            ? normalized
+            : path.posix.normalize(normalized);
         try {
-            const canonical = realpathSync.native(normalized);
-            // Fast path, not a guard: both arms answer `normalized` when the
+            const canonical = realpathSync.native(folded);
+            // Fast path, not a guard: both arms answer `folded` when the
             // strings match, but skipping the two `split`s there is a measured
             // 1.9 vs 2.3 microseconds per call on the per-edit seam (#3098).
-            if (canonical === normalized)
-                return normalized;
-            const adopted = adoptCanonicalCasing(normalized, canonical);
-            if (adopted === normalized)
-                return normalized;
+            if (canonical === folded)
+                return folded;
+            const adopted = adoptCanonicalCasing(folded, canonical);
+            if (adopted === folded)
+                return folded;
             // The rewrite is string algebra and can land on a DIFFERENT file
             // (#3159 review round 2, F1 — see `adoptCanonicalCasing`). Adopt it
             // only once the filesystem agrees it still names the file the caller
@@ -213,11 +255,11 @@ export function normalizeFilePath(filePath) {
             // never on an already-canonical path. A throw here (the rewritten
             // path does not exist, the #2490 monorepo case) lands in the catch
             // below and keeps the caller's spelling, which is the same answer.
-            return realpathSync.native(adopted) === canonical ? adopted : normalized;
+            return realpathSync.native(adopted) === canonical ? adopted : folded;
         }
         catch {
             // Does not exist (or is unreadable): case-preserving, as above.
-            return normalized;
+            return folded;
         }
     }
     // Windows: try realpathSync.native() for canonical casing