pi-lens 4.2.0 → 4.3.0

package/dist/clients/persistent-reverify.js

@@ -0,0 +1,271 @@
+/**
+ * #3170 — the bounded persistent-reverify pass.
+ *
+ * A finding whose own file is unchanged is re-delivered turn after turn from
+ * the persisted actionable-warnings report without ever being re-observed
+ * against the live server: the in-band publish carries forward DEFERRED-origin
+ * file entries while their file has not moved
+ * (`mergeActionableWarningsReports`'s scope guard), and the delta freshness
+ * gate passes them because the file's mtime has not moved either. When the
+ * root cause was fixed in a DIFFERENT file, the carried finding is stale in
+ * fact but fresh by every on-disk axis.
+ *
+ * This module re-observes those files at turn_end, BEFORE the advisory
+ * assembles, and the replacement entries fold into the turn's SINGLE in-band
+ * publish (#3176 F1: a separate replacement publish spends the carry marker
+ * and the main publish then drops the entries at the scope guard — the
+ * blocker the review caught).
+ *
+ * Review-round contracts (#3176):
+ * - **F2**: the fresh observation converts through the PRODUCER's own
+ *   pipeline (`enrichFileFromLsp` — severity-2, code-action enrichment,
+ *   fixable-only, the per-file caps), fed the touch's collected diagnostics
+ *   as the cached arm so no second pull happens. No re-implementation.
+ * - **F3**: an empty result is clean ONLY when the touch itself answers
+ *   `confirmation: "confirmed"` — the silent-on-clean rule (#240/#533/#1253).
+ *   A bare `{diags: []}` (the house double's silent empty, a tier-3 server
+ *   still analyzing, a `skipReason`) is UNCONFIRMED: the carried warnings are
+ *   kept verbatim and the render labels the gap. `touched.inconclusive` is
+ *   `resolveTouchVerdict`'s output computed service-side and is honored
+ *   directly.
+ * - **F4**: every await is bound-wrapped (`bounded()`); `maxClientWaitMs` is
+ *   only the spawn/ready budget, not a request ceiling.
+ * - **F6**: no skip guard — every deferred-origin entry re-verifies each
+ *   turn (re-arm), per the issue's failure table.
+ *
+ * Bounds: at most {@link MAX_REVERIFY_FILES} files per turn_end, a wall
+ * budget of {@link REVERIFY_BUDGET_MS}, the turn-end abort signal, and no
+ * new durable state — candidates come from the persisted report itself,
+ * which is what was delivered last turn.
+ */
+import * as fs from "node:fs";
+import { enrichFileFromLsp } from "./actionable-warnings.js";
+import { bounded } from "./deadline-utils.js";
+import { logLatency } from "./latency-logger.js";
+import { touchCompletedConfirmationPolicy, } from "./lsp/diagnostic-binding.js";
+import { findAuxiliaryProfileForSource } from "./dispatch/auxiliary-lsp.js";
+/** At most this many files are re-observed per turn_end (the drift backstop's
+ * own 4-resyncs-per-pass precedent). */
+export const MAX_REVERIFY_FILES = 4;
+/** Wall-clock budget for the whole pass; a touch that cannot answer inside
+ * its remaining slice is recorded unconfirmed, never waited out. */
+export const REVERIFY_BUDGET_MS = 3000;
+/** The touch options the `source=lsp` probe uses, with this pass's source. */
+const TOUCH_SOURCE = "persistent_reverify";
+/**
+ * Select the report's re-verify candidates: DEFERRED-origin file entries (the
+ * only population the in-band publish carries forward, so the only population
+ * that re-serves across turns — F6: with no skip guard, so every carried
+ * entry re-verifies each turn) whose file stat is UNCHANGED since the entry's
+ * own observation stamp. A file that changed is skipped and counted — the
+ * edit path already re-observed it. Missing files are skipped too: the delta
+ * freshness gate drops them outright.
+ */
+export function selectPersistentReverifyFiles(report, nowMs = Date.now()) {
+    const candidates = [];
+    let skippedChanged = 0;
+    for (const entry of report.files) {
+        if (entry.origin !== "deferred")
+            continue;
+        // F3 (population half): the pass re-observes through a PRIMARY-scope
+        // touch, so an auxiliary-lane finding can never be re-confirmed — an
+        // entry carrying aux-sourced warnings is skipped (kept verbatim),
+        // never scored dropped. The aux lookup is the one shared seam.
+        if (entry.warnings.some((w) => findAuxiliaryProfileForSource(w.source ?? "") !== undefined)) {
+            continue;
+        }
+        const stamp = entry.generatedAt ? Date.parse(entry.generatedAt) : NaN;
+        if (!Number.isFinite(stamp) || stamp > nowMs)
+            continue;
+        let mtimeMs;
+        try {
+            mtimeMs = fs.statSync(entry.filePath).mtimeMs;
+        }
+        catch {
+            continue;
+        }
+        if (mtimeMs > stamp) {
+            skippedChanged += 1;
+            continue;
+        }
+        if (candidates.length < MAX_REVERIFY_FILES)
+            candidates.push(entry);
+    }
+    return { candidates, skippedChanged };
+}
+/**
+ * Run the bounded re-verify pass over the report's candidates and build the
+ * replacement entries for the caller's single in-band publish. Never throws:
+ * an unexpected per-file failure degrades that file to `unconfirmed` (kept
+ * verbatim, labeled), which is the shape-48 direction — the harm reaching the
+ * user is a hidden real finding, worse than re-delivering a stale one.
+ */
+export async function runPersistentReverify(args) {
+    const started = Date.now();
+    const deadlineAt = started + (args.budgetMs ?? REVERIFY_BUDGET_MS);
+    const nowMs = args.nowMs ?? started;
+    const { candidates, skippedChanged } = selectPersistentReverifyFiles(args.report, nowMs);
+    const outcomes = [];
+    const replacementFiles = [];
+    let touched = 0;
+    // F2: the producer's own pipeline (enrichFileFromLsp) — constructed once,
+    // reused per candidate. deltaOnly: false (a re-observation is not gated on
+    // this turn's modified ranges — the file was not edited).
+    const buildArgs = {
+        cwd: args.cwd,
+        sessionId: args.report.sessionId,
+        turnIndex: 0,
+        files: [],
+        modifiedRangesByFile: new Map(),
+        dispatchWarnings: [],
+        includeLspCodeActions: true,
+        deltaOnly: false,
+        ...(args.signal !== undefined ? { signal: args.signal } : {}),
+        lspBudgetMs: REVERIFY_BUDGET_MS,
+        dbg: () => { },
+    };
+    // R3-4: every candidate the budget or the abort cut, so the phase row
+    // distinguishes "the pass ran out of time" from "the server answered
+    // nothing". Counted from what the loop actually reached, never predicted.
+    let processed = 0;
+    for (const entry of candidates) {
+        if (args.signal?.aborted || Date.now() >= deadlineAt)
+            break;
+        processed += 1;
+        let content;
+        try {
+            content = fs.readFileSync(entry.filePath, "utf-8");
+        }
+        catch {
+            outcomes.push({
+                filePath: entry.filePath,
+                displayPath: entry.displayPath,
+                outcome: "unconfirmed",
+                dropped: 0,
+                kept: entry.warnings.length,
+            });
+            replacementFiles.push({ ...entry, reVerifyIncomplete: true });
+            continue;
+        }
+        // F4: the touch is bound-wrapped — `maxClientWaitMs` bounds the
+        // spawn/ready window, `bounded()` is the request ceiling.
+        let touchedResult;
+        try {
+            touchedResult = await bounded(args.lspService.touchFile(entry.filePath, content, {
+                diagnostics: "document",
+                collectDiagnostics: true,
+                source: TOUCH_SOURCE,
+                clientScope: "primary",
+            }), {
+                ms: Math.max(250, deadlineAt - Date.now()),
+                signal: args.signal,
+                hook: "turn_end",
+                label: "persistent_reverify_touch",
+            });
+        }
+        catch {
+            // The never-throws contract: a wedged touch degrades to unconfirmed
+            // (kept verbatim, labeled), never an escaped error.
+            touchedResult = undefined;
+        }
+        // F3 (#3176): an empty result is clean ONLY when the touch COMPLETED
+        // its confirmation policy — the silent-on-clean rule (#240/#533/#1253).
+        // A bare `{diags: []}` (the house double's silent empty, a tier-3
+        // server still analyzing) or a `skipReason` is UNCONFIRMED: the carried
+        // warnings are kept verbatim and the render labels the gap.
+        // `touched.inconclusive` is resolveTouchVerdict's output, computed
+        // service-side, and is honored directly.
+        // R3-3: read the policy through `touchCompletedConfirmationPolicy`, the
+        // #1470 seam, NOT the literal `confirmation !== "confirmed"` that
+        // `diagnostic-binding.ts:274-288` exists to forbid: `partial` means
+        // every server except the named cut-off auxiliaries answered, so the
+        // primary's silent-clean gates ran to completion and its observation is
+        // as trustworthy as a full confirmation. The literal labels a file the
+        // primary fully answered and keeps a finding the touch just re-derived.
+        if (touchedResult === undefined ||
+            touchedResult.inconclusive === true ||
+            touchedResult.skipReason !== undefined ||
+            (touchedResult.diagnosticsUnsupportedServerIds ?? []).length > 0 ||
+            !touchCompletedConfirmationPolicy(touchedResult)) {
+            outcomes.push({
+                filePath: entry.filePath,
+                displayPath: entry.displayPath,
+                outcome: "unconfirmed",
+                dropped: 0,
+                kept: entry.warnings.length,
+            });
+            replacementFiles.push({ ...entry, reVerifyIncomplete: true });
+            continue;
+        }
+        touched += 1;
+        // F2: the touch's collected diagnostics feed the producer's pipeline
+        // as the cached arm — no second pull, the producer's filters and
+        // caps are reused verbatim.
+        // F4: the outer await is bound-wrapped too — the module carries ZERO
+        // syntactic unbounded awaits (#2523 slice-3 worklist), and the hard
+        // ceiling composes with enrichFileFromLsp's own internal deadline.
+        const freshRecords = (await bounded(enrichFileFromLsp(args.cwd, buildArgs, { filePath: entry.filePath, cached: touchedResult.diags }, {
+            lspService: args.lspService,
+            pullTimeoutMs: 2000,
+            deadlineAt,
+            ...(args.signal !== undefined ? { signal: args.signal } : {}),
+            site: { hook: "turn_end", label: "persistent_reverify" },
+        }), {
+            ms: Math.max(250, deadlineAt - Date.now()),
+            signal: args.signal,
+            hook: "turn_end",
+            label: "persistent_reverify_enrich",
+        })) ?? [];
+        let dropped = 0;
+        let kept = 0;
+        for (const warning of entry.warnings) {
+            const stillThere = freshRecords.some((record) => record.rule === warning.rule && record.message === warning.message);
+            if (stillThere)
+                kept += 1;
+            else
+                dropped += 1;
+        }
+        const outcome = freshRecords.length === 0
+            ? "clean"
+            : dropped === 0
+                ? "reconfirmed"
+                : "mixed";
+        outcomes.push({
+            filePath: entry.filePath,
+            displayPath: entry.displayPath,
+            outcome,
+            dropped,
+            kept,
+        });
+        replacementFiles.push({
+            ...entry,
+            warnings: freshRecords,
+            reVerified: true,
+            generatedAt: new Date(nowMs).toISOString(),
+        });
+    }
+    logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: args.cwd,
+        phase: "persistent_reverify",
+        durationMs: Date.now() - started,
+        metadata: {
+            candidates: candidates.length,
+            touched,
+            clean: outcomes.filter((o) => o.outcome === "clean").length,
+            reconfirmed: outcomes.filter((o) => o.outcome === "reconfirmed").length,
+            mixed: outcomes.filter((o) => o.outcome === "mixed").length,
+            unconfirmed: outcomes.filter((o) => o.outcome === "unconfirmed").length,
+            skippedChanged,
+            skippedBudget: candidates.length - processed,
+        },
+    });
+    return {
+        outcomes,
+        replacementFiles,
+        candidates: candidates.length,
+        touched,
+        skippedChanged,
+    };
+}

package/dist/clients/pipeline.js

@@ -25,6 +25,7 @@ import { loadDispatchIntegration } from "./dispatch/lazy.js";
 import { toRunnerDisplayPath } from "./dispatch/runner-context.js";
 import { classifyProbeFailure, createAvailabilityChecker, createAvailabilityLatch, describeProbeEvidence, logAvailabilityDecision, startHostStallSampler, resolveAvailableOrInstall, resolveCommandArgsWithInstallFallback, resolveToolCommand, resolveToolCommandWithInstallFallback, } from "./dispatch/runners/utils/runner-helpers.js";
 import { findDetektConfig } from "./dispatch/runners/detekt.js";
+import { formatDiagnostics } from "./dispatch/utils/format-utils.js";
 import { detectFileKind, getFileKindLabel } from "./file-kinds.js";
 import { detectFileChangedAfterCommand, getProjectIgnoreMatcher, isExcludedDirName, } from "./file-utils.js";
 import { logLatency } from "./latency-logger.js";
@@ -40,12 +41,11 @@ import { probeToolAsync } from "./tool-probe.js";
 import { bounded } from "./deadline-utils.js";
 import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import { enabledAuxiliaryLspServerIds } from "./dispatch/auxiliary-lsp.js";
-import { recordDegradationOnce } from "./degradation-ledger.js";
+import { incrementDegradationCount, recordDegradationOnce, } from "./degradation-ledger.js";
 import { establishToolAgreement } from "./tool-agreement.js";
 import { dropFindingsForMissingPaths } from "./advisory-provenance.js";
 import { getAutofixPolicyForFile, getPreferredAutofixTools, getRubocopCommand, hasBiomeConfig, hasDetektConfig, hasEslintConfig, hasGolangciConfig, hasKtfmtConfig, hasKtlintConfig, hasOxlintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, markdownlintConfigArgs, } from "./tool-policy.js";
-const LSP_MAX_FILE_BYTES = RUNTIME_CONFIG.pipeline.lspMaxFileBytes;
-const LSP_MAX_FILE_LINES = RUNTIME_CONFIG.pipeline.lspMaxFileLines;
+import { exceedsLspSyncLimits } from "./lsp/content-limits.js";
 const LSP_SPAWN_BUDGET_MS = RUNTIME_CONFIG.pipeline.lspSpawnBudgetMs;
 const AUTOFIX_CHANGED_FILE_SCAN_LIMIT = 5000;
 /**
@@ -60,10 +60,6 @@ function lspSyncBudgetMs() {
     const raw = Number(process.env.PI_LENS_LSP_SYNC_BUDGET_MS);
     return Number.isFinite(raw) && raw > 0 ? raw : 3000;
 }
-// Scan one directory's entries into `snapshot`, pushing walkable subdirs onto
-// `stack`. Extracted from the walk loop to keep each function's cognitive
-// complexity low. Excluded/ignored dirs are not descended; ignored/vanished
-// files are skipped.
 // Files stat'd between event-loop yields. The walk stays on the tool_result
 // hot path; yielding every N keeps its longest synchronous stretch well under
 // the <50ms hook-burst budget even at the AUTOFIX_CHANGED_FILE_SCAN_LIMIT cap.
@@ -144,23 +140,6 @@ async function diffProjectSnapshot(root, before) {
     }
     return [...changed].sort((a, b) => a.localeCompare(b));
 }
-function exceedsLspSyncLimits(_filePath, content) {
-    const sizeBytes = Buffer.byteLength(content, "utf-8");
-    if (sizeBytes > LSP_MAX_FILE_BYTES) {
-        return {
-            tooLarge: true,
-            reason: `${Math.round(sizeBytes / 1024)}KB exceeds ${Math.round(LSP_MAX_FILE_BYTES / 1024)}KB`,
-        };
-    }
-    const lineCount = content.split("\n").length;
-    if (lineCount > LSP_MAX_FILE_LINES) {
-        return {
-            tooLarge: true,
-            reason: `${lineCount} lines exceeds ${LSP_MAX_FILE_LINES}`,
-        };
-    }
-    return { tooLarge: false, reason: "" };
-}
 function createPhaseTracker(toolName, filePath) {
     const phases = [];
     return {
@@ -677,7 +656,13 @@ export async function resyncLspFile(filePath, fileContent, needsContentRefresh,
         return;
     if (!needsContentRefresh && lspSyncCompleted)
         return;
-    const limitCheck = exceedsLspSyncLimits(filePath, fileContent);
+    // #3405 r2: the bound is `clients/lsp/content-limits.ts` now, shared with the
+    // dispatch runner and the didSave payload. THIS call stays: a file past the
+    // bound is not synced to the server AT ALL, which is a stricter policy than
+    // the save seam's (drop the redundant text, still send the save) and the one
+    // a post-write sync owes — removing it would start writing whole-file
+    // didOpen frames for files this pipeline has always refused.
+    const limitCheck = exceedsLspSyncLimits(fileContent);
     if (limitCheck.tooLarge)
         return;
     try {
@@ -711,6 +696,11 @@ export async function resyncLspFile(filePath, fileContent, needsContentRefresh,
                 source: "lsp_sync",
                 clientScope: "primary",
                 maxClientWaitMs: LSP_SPAWN_BUDGET_MS,
+                // #3405: pi-lens just wrote these bytes to disk, so this is the one
+                // touch that is a save. A save-triggered server (Expert recompiles
+                // the project on didSave and on nothing else) publishes for the edit
+                // only because of this flag.
+                saved: true,
             })
                 .then(() => "done")
                 .catch((err) => {
@@ -923,6 +913,15 @@ export async function runFormatPhase(filePath, getFormatService, dbg, signal, bu
  *       → const randomInt = Math.floor(result);
  */
 function buildEnrichedBlockerOutput(blockers, fileContent = "") {
+    // #3188: no blockers, no banner. The delivery gate above can retract every
+    // blocker (all cited files deleted), and the header interpolates the count,
+    // so without this the agent reads "🔴 STOP — 0 issue(s) must be fixed:" with
+    // nothing under it. Same guard, same reason, as `formatDiagnostics` in
+    // dispatch/utils/format-utils.ts — it belongs to the renderer, not to each
+    // call site, because the #2028 branch below cannot gate on the count without
+    // falling through to the UNGATED raw output.
+    if (blockers.length === 0)
+        return "";
     // Empty fileContent (readback failed, e.g. deleted-file race) still
     // renders the gated blocker list - just without per-line snippets.
     const fileLines = fileContent ? fileContent.split("\n") : [];
@@ -952,6 +951,14 @@ function buildEnrichedBlockerOutput(blockers, fileContent = "") {
 export async function runPipeline(ctx, deps) {
     const { filePath, cwd, toolName, getFlag, getFlagSource, dbg } = ctx;
     const { getFormatService } = deps;
+    const allowAutonomousWriters = ctx.allowAutonomousWriters !== false;
+    if (!allowAutonomousWriters) {
+        incrementDegradationCount({
+            kind: "opaque-mutation-ownership-boundary",
+            subject: "pipeline",
+            reason: `observed mutation is not evidence of agent authorship (${filePath})`,
+        });
+    }
     admitWidgetDiagnosticsWrite(filePath, ctx.telemetry?.writeIndex);
     const phase = createPhaseTracker(toolName, filePath);
     const pipelineStart = Date.now();
@@ -975,8 +982,14 @@ export async function runPipeline(ctx, deps) {
     const piChangedFiles = new Set();
     const autoformatDisabled = !!getFlag("no-autoformat", filePath);
     const immediateFormat = !!getFlag("immediate-format");
-    const formatDeferred = !autoformatDisabled && !immediateFormat && !!fileContent;
-    if (!autoformatDisabled && immediateFormat && fileContent) {
+    const formatDeferred = allowAutonomousWriters &&
+        !autoformatDisabled &&
+        !immediateFormat &&
+        !!fileContent;
+    if (allowAutonomousWriters &&
+        !autoformatDisabled &&
+        immediateFormat &&
+        fileContent) {
         const formatResult = await runFormatPhase(filePath, getFormatService, dbg, ctx.signal);
         formatChanged = formatResult.formatChanged;
         formattersUsed = formatResult.formattersUsed;
@@ -1001,6 +1014,9 @@ export async function runPipeline(ctx, deps) {
     else if (formatDeferred) {
         dbg(`autoformat: deferred until agent_end for ${filePath}`);
     }
+    else if (!allowAutonomousWriters) {
+        dbg(`autoformat: skipped for ${filePath} (mutation ownership is unproven)`);
+    }
     else if (autoformatDisabled) {
         const source = getFlagSource?.("no-autoformat", filePath);
         dbg(`autoformat: skipped for ${filePath} (--no-autoformat${source ? `, source=${source}` : ""})`);
@@ -1018,7 +1034,11 @@ export async function runPipeline(ctx, deps) {
     let autofixChangedFiles = [];
     let fixRefresh = false;
     let autofixSkipReason;
-    if (ctx.autofixMode === "deferred") {
+    if (!allowAutonomousWriters) {
+        autofixSkipReason = "mutation_ownership_unproven";
+        dbg(`autofix: skipped for ${filePath} (mutation ownership is unproven)`);
+    }
+    else if (ctx.autofixMode === "deferred") {
         autofixSkipReason = "deferred_to_agent_end";
         dbg(`autofix: deferred until agent_end for ${filePath}`);
     }
@@ -1157,34 +1177,22 @@ export async function runPipeline(ctx, deps) {
             });
         }
     }
-    const hasBlockers = dispatchResult.hasBlockers;
-    const actionableWarnings = dispatchResult.warnings
-        .map((diagnostic) => recordFromDispatchDiagnostic(diagnostic, cwd))
-        .filter((warning) => Boolean(warning));
+    // Opaque recovery is a valid analysis input, but its bytes are not an agent
+    // authored surface. Keep diagnostics and advisory output visible while
+    // withholding the edit-directed channels that would tell the agent to mutate
+    // the observed artifact (#3226).
+    const hasBlockers = allowAutonomousWriters && dispatchResult.hasBlockers;
+    const actionableWarnings = allowAutonomousWriters
+        ? dispatchResult.warnings
+            .map((diagnostic) => recordFromDispatchDiagnostic(diagnostic, cwd))
+            .filter((warning) => Boolean(warning))
+        : [];
     const codeQualityWarnings = dispatchResult.warnings
         .map((diagnostic) => recordFromCodeQualityDiagnostic(diagnostic, cwd))
         .filter((warning) => Boolean(warning));
     if (dispatchResult.diagnostics.length > 0) {
-        const logger = getDiagnosticLogger();
         const tracker = getDiagnosticTracker();
         tracker.trackShown(dispatchResult.diagnostics);
-        const toKey = (d) => [
-            d.tool || "",
-            d.id || "",
-            d.rule || "",
-            d.filePath || "",
-            d.line || 0,
-            d.column || 0,
-        ].join("|");
-        const inlineKeys = new Set([...dispatchResult.blockers, ...dispatchResult.fixed].map(toKey));
-        for (const d of dispatchResult.diagnostics) {
-            logger.logCaught(d, {
-                model: ctx.telemetry?.model ?? "unknown",
-                sessionId: ctx.telemetry?.sessionId ?? "unknown",
-                turnIndex: ctx.telemetry?.turnIndex ?? 0,
-                writeIndex: ctx.telemetry?.writeIndex ?? 0,
-            }, inlineKeys.has(toKey(d)));
-        }
     }
     if (fixedCount > 0)
         getDiagnosticTracker().trackAutoFixed(fixedCount);
@@ -1198,15 +1206,48 @@ export async function runPipeline(ctx, deps) {
     // the deleted file's content), so it is dropped here rather than re-asserted.
     // One bounded stat per unique cited path, only when blockers exist — zero
     // cost on the clean/fast paths.
-    const deliverableBlockers = dispatchResult.hasBlockers
+    const deliverableBlockers = hasBlockers
         ? dropFindingsForMissingPaths({
             store: "stop-blocker",
             findings: dispatchResult.blockers,
             cwd,
             citedPath: (b) => b.filePath || undefined,
         })
-        : dispatchResult.blockers;
-    if (dispatchResult.hasBlockers && fileContent) {
+        : [];
+    // #3190: ONE gate, applied once here, for EVERY surface. The durable record
+    // this function hands `runtime.recordInlineBlockers` (and through it the
+    // turn-end `Unresolved from this turn` re-serve) used to be built from the
+    // UNGATED `dispatchResult.blockerOutput`/`blockers`, so a blocker retracted
+    // from the tool result above was re-delivered at turn end — and the ungated
+    // verdict still latched the commit gate through `updateGitGuardStatus`. It is
+    // exactly `hasBlockers && nothing-survived-the-gate` inverted: the gate
+    // returns `[]` whenever `hasBlockers` is false, so this one expression is the
+    // whole condition.
+    const hasDeliverableBlockers = deliverableBlockers.length > 0;
+    if (dispatchResult.diagnostics.length > 0) {
+        const logger = getDiagnosticLogger();
+        const toKey = (d) => [
+            d.tool || "",
+            d.id || "",
+            d.rule || "",
+            d.filePath || "",
+            d.line || 0,
+            d.column || 0,
+        ].join("|");
+        const inlineKeys = new Set([...deliverableBlockers, ...dispatchResult.fixed].map(toKey));
+        for (const d of dispatchResult.diagnostics) {
+            logger.logCaught(d, {
+                model: ctx.telemetry?.model ?? "unknown",
+                sessionId: ctx.telemetry?.sessionId ?? "unknown",
+                turnIndex: ctx.telemetry?.turnIndex ?? 0,
+                writeIndex: ctx.telemetry?.writeIndex ?? 0,
+            }, inlineKeys.has(toKey(d)));
+        }
+    }
+    const deliveredOutput = !allowAutonomousWriters && dispatchResult.hasBlockers
+        ? dispatchResult.output.slice(dispatchResult.blockerOutput.length)
+        : dispatchResult.output;
+    if (hasBlockers && fileContent) {
         // Enrich blocker output with a code snippet so the agent can see the
         // exact line it wrote that caused each violation — no re-read needed.
         if (deliverableBlockers.length > 0) {
@@ -1218,20 +1259,25 @@ export async function runPipeline(ctx, deps) {
         if (rest)
             output += rest;
     }
-    else if (dispatchResult.output) {
+    else if (deliveredOutput) {
         // #2028 review P3: this path fires when readback FAILED - raw output
         // still cites possibly-deleted files. Re-render from the gated set
         // (no snippets without fileContent) and keep the post-blocker slice.
-        if (dispatchResult.hasBlockers &&
+        if (hasBlockers &&
             deliverableBlockers.length !== dispatchResult.blockers.length) {
             let gatedOut = buildEnrichedBlockerOutput(deliverableBlockers);
             const rest = dispatchResult.output.slice(dispatchResult.blockerOutput.length);
             if (rest)
                 gatedOut += rest;
-            output += `\n\n${gatedOut}`;
+            // #3188: every blocker retracted and nothing after the blocker
+            // section leaves nothing to say — appending the separator alone would
+            // still deliver a (whitespace-only) tool-result block, because
+            // `handleToolResult` decides delivery on `output` truthiness.
+            if (gatedOut)
+                output += `\n\n${gatedOut}`;
         }
         else {
-            output += `\n\n${dispatchResult.output}`;
+            output += `\n\n${deliveredOutput}`;
         }
     }
     if (fixedCount > 0) {
@@ -1326,7 +1372,7 @@ export async function runPipeline(ctx, deps) {
         turnIndex: ctx.telemetry?.turnIndex ?? 0,
         writeIndex: ctx.telemetry?.writeIndex ?? 0,
         diagnostics: dispatchResult.diagnostics,
-        blockers: dispatchResult.blockers,
+        blockers: hasBlockers ? dispatchResult.blockers : [],
         warnings: dispatchResult.warnings,
         fixed: dispatchResult.fixed,
         resolvedCount: dispatchResult.resolvedCount,
@@ -1337,28 +1383,44 @@ export async function runPipeline(ctx, deps) {
     });
     return {
         output,
-        hasBlockers,
+        // #3190: the verdict every consumer reads — `updateGitGuardStatus`'s commit
+        // latch above all — is what was DELIVERED, not what the dispatch found. The
+        // two disagreed whenever the deleted-path gate retracted every blocker: the
+        // tool result said `✓ clean` while the commit gate stayed latched, its
+        // summary falling back to that very all-clear line. `emitLensAnalysisComplete`
+        // above deliberately keeps the raw dispatch counts — it records what was
+        // observed, not what was served.
+        hasBlockers: hasDeliverableBlockers,
         cascadePromise,
         isError: false,
         fileModified,
         postWriteStateHash,
         changedFiles,
-        inlineBlockerSummary: dispatchResult.hasBlockers
-            ? dispatchResult.blockerOutput.trim() || undefined
+        // #3190: re-rendered from the GATED set with `formatDiagnostics(...,
+        // "blocking")` — the very expression `dispatcher.ts:1409` builds
+        // `blockerOutput` with, over a subset of the very array it rendered. When
+        // the gate drops nothing the two are byte-identical (same renderer, same
+        // array, same display cap), so an unretracted record is unchanged; when it
+        // drops something the stored text can no longer disagree with the tool
+        // result, and `inline-blocker-dispositions.ts`' re-render at turn end still
+        // matches this string exactly.
+        inlineBlockerSummary: hasDeliverableBlockers
+            ? formatDiagnostics(deliverableBlockers, "blocking").trim() || undefined
             : undefined,
         // #1561 F1: taken from the very diagnostics `blockerOutput` was rendered
         // from, so the provenance can never disagree with the text it guards. An
         // untagged diagnostic contributes the literal "unknown", which no verdict
         // claims coverage for — it pins the entry rather than silently widening
         // what an LSP check is allowed to clear.
-        inlineBlockerSources: dispatchResult.hasBlockers
+        inlineBlockerSources: hasDeliverableBlockers
             ? [
-                ...new Set(dispatchResult.blockers.map((d) => d.tool?.trim() || "unknown")),
+                ...new Set(deliverableBlockers.map((d) => d.tool?.trim() || "unknown")),
             ]
             : undefined,
-        inlineBlockerLines: dispatchResult.hasBlockers
-            ? dispatchResult.blockers
-                // #1641 review F2: `dispatchResult.blockers` is NOT guaranteed to be
+        inlineBlockerLines: hasDeliverableBlockers
+            ? deliverableBlockers
+                // #1641 review F2: the blocker array (#3190: the deliverable subset
+                // of `dispatchResult.blockers`) is NOT guaranteed to be
                 // scoped to THIS file — a chart-wide runner (helm-lint, helm-render)
                 // reports blocking diagnostics against other files in the chart
                 // (e.g. `values.yaml`) alongside `ctx.filePath`. The precedent every
@@ -1404,8 +1466,15 @@ export async function runPipeline(ctx, deps) {
                 source: "autofix",
             }
             : undefined,
-        inlineBlockerFileContent: dispatchResult.hasBlockers
+        inlineBlockerFileContent: hasBlockers
             ? inlineBlockerFileContent
             : undefined,
+        // #3246: the very array `blockerOutput` above was rendered from, so the
+        // turn-end policy filter and its re-render can never disagree with the
+        // text they guard — the same provenance argument `inlineBlockerSources`
+        // makes one field up.
+        inlineBlockerDiagnostics: hasDeliverableBlockers
+            ? deliverableBlockers
+            : undefined,
     };
 }