pi-lens 4.2.0 → 4.3.0

package/dist/clients/warm-attach.js

@@ -7,6 +7,7 @@ import { logLatency } from "./latency-logger.js";
 import { touchCoverageGap } from "./lsp/diagnostic-binding.js";
 import { loadLspService } from "./lsp-lazy.js";
 import { contentHash, createWarmIpcLineReader, diagnosticsIpcPathForCwd, requestWarmCodeActions, requestWarmDiagnostics, WARM_CODE_ACTION_LOOKUP_LIMIT, WARM_DIAGNOSTICS_SCHEMA_VERSION, } from "./mcp/ipc.js";
+import { incrementDegradationCount, recordDegradationOnce, } from "./degradation-ledger.js";
 import { normalizeFilePath } from "./path-utils.js";
 const state = { local: true, servedDiagnosticHashes: new Map() };
 function record(event, cwd, reason, pid, source) {
@@ -138,6 +139,33 @@ function startServer(cwd) {
     }
     const server = net.createServer((socket) => {
         socket.setEncoding("utf8");
+        // #3389: an ACCEPTED socket with no `error` listener rethrows, and
+        // `server.on("error")` below covers only the listener. A client that walks
+        // away while this incumbent is answering — every `requestWarmDiagnostics`
+        // timeout, schema refusal and validation refusal destroys its socket
+        // (`clients/mcp/ipc.ts:312`) — therefore turned a routine
+        // `read ECONNRESET` into an uncaught exception in THIS host, the same
+        // ending #3375 closed for an unbounded `data` handler. The handler does NOT
+        // tear the connection down: a real system failure has already destroyed the
+        // stream before this runs (measured: `destroyed` is true at entry), and an
+        // `error` emitted with no errno leaves a socket that is still answering
+        // (review round 1) — destroying that one would drop a live request. So the
+        // handler exists to keep the event catchable and to leave the peer's
+        // behavior visible in the ledger.
+        socket.on("error", (failure) => {
+            incrementDegradationCount({
+                // Subject is the errno, so one peer's repeated resets stay one row.
+                // No `?? "unknown"` fallback: `normalizeForLedger`
+                // (`clients/ledger-bounds.ts:29`) already maps a missing value to
+                // `"unknown"`, and a second copy of that rule here was a branch no
+                // mutation could red (#3389 review round 1, F3395-01) — an error
+                // emitted with no `code` is pinned end-to-end in
+                // `tests/clients/warm-attach-socket-error.test.ts`.
+                kind: "warm-attach-socket-error",
+                subject: failure.code,
+                reason: String(failure),
+            });
+        });
         // One-shot per connection (#1219 family): the same defect shape as the
         // MCP warm socket — clients write exactly one request and read one
         // reply, so a handler that kept re-reading the same buffered line
@@ -153,6 +181,11 @@ function startServer(cwd) {
                     socket.end(`${JSON.stringify({ error: String(error) })}\n`);
                 }
             })();
+        }, {
+            label: "warm-attach-server",
+            // #3383: an unterminated request line is answered like any other
+            // unusable request rather than buffered without a ceiling.
+            onOverflow: () => socket.end(`${JSON.stringify({ error: "warm request line exceeded the framing limit" })}\n`),
         }));
     });
     server.on("error", (error) => {
@@ -191,6 +224,20 @@ export async function tryWarmAttachedDiagnostics(file, content, timeoutMs, sourc
     }
     const result = await requestWarmDiagnostics(state.cwd, state.incumbentPid, file, content, timeoutMs);
     if (!result.available) {
+        // #3255 H1: a confirmed-alive incumbent whose endpoint has no listener is
+        // the upgrade-stranded shape — narrowing the workspace-id case fold
+        // renamed the socket, so a peer that registered before the upgrade is
+        // still serving the previous name. `promoteToLocal` alone left that in the
+        // latency log only; this is the entry `/lens-perf` renders. Bounded twice
+        // over: once per kind/subject by the ledger, and once per session by
+        // `promoteToLocal`'s latch, which returns early on every later call.
+        if (result.reason === "no-listener") {
+            recordDegradationOnce({
+                kind: "warm-ipc-endpoint-missing",
+                subject: diagnosticsIpcPathForCwd(state.cwd, state.incumbentPid),
+                reason: "the registry confirms this incumbent is alive but nothing is listening on its derived endpoint — if pi-lens was upgraded while it was running, restart it",
+            });
+        }
         promoteToLocal(result.reason);
     }
     else {
@@ -231,6 +278,18 @@ export function _resetWarmAttachForTests() {
     state.local = true;
     state.servedDiagnosticHashes.clear();
 }
+/**
+ * The live diagnostics server, exposed for tests (#3389 review round 1,
+ * F3395-01). The `error` handler on an ACCEPTED socket has exactly one input
+ * channel — an `error` event on that socket — and a test cannot reach the
+ * socket any other way: it is created by `net.createServer` inside the closure
+ * above, and Node's ESM namespace for `node:net` is not configurable, so the
+ * factory cannot be wrapped from a test either. A test observes the server's
+ * own `connection` event through this accessor; nothing in production reads it.
+ */
+export function _warmAttachServerForTests() {
+    return state.server;
+}
 export function _setWarmAttachForTests(cwd, incumbentPid) {
     state.cwd = path.resolve(cwd);
     state.incumbentPid = incumbentPid;

package/dist/clients/widget-state.js

@@ -9,10 +9,11 @@ import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
 import { fitLine } from "./tui-fit.js";
 import { WriteOrderingGuard } from "./write-ordering-guard.js";
 import { collectForwardImportMtimes } from "./blocker-freshness.js";
+import { normalizeMessage } from "./finding-identity.js";
 import { freshnessFromMtime } from "./freshness.js";
 import { PAST_EOF_STALE_MARKER } from "./diagnostic-line-freshness.js";
 import { STALE_LINE_MARKER } from "./stale-marker.js";
-import { anchorsForDiagnostic, applyDispositions, getDisposition, registerWidgetDispositionReconciler, } from "./diagnostic-dispositions.js";
+import { anchorsForDiagnostic, applyDispositions, getDisposition, registerWidgetDispositionReconciler, strictAnchorSpan, strictAnchorSpansIn, } from "./diagnostic-dispositions.js";
 import { recordDegradationOnce } from "./degradation-ledger.js";
 /**
  * Canonical key for the `files` map (and `diagnosticsWriteGuard`) — #1020.
@@ -49,6 +50,19 @@ function fileMapKey(filePath) {
  * from what the footer counts.
  */
 export function isBlocking(d) {
+    // #3158 round 2 F1: a finding the agent marked `false-positive`/`suppress` is
+    // not a hard stop — it is an explicitly dismissed one. Before this line only
+    // `countDiagnostics` knew that (it skips tagged entries), so the footer header
+    // counted zero errors while every consumer that asks THIS predicate still
+    // treated the row as blocking: `renderWidget` drew a red ● row for it,
+    // `capStoredDiagnostics` hoisted it ahead of live findings (evicting one at the
+    // display cap), and `getWidgetBlockingFilesForSweep`,
+    // `markWidgetFileBlockersStale` and `reconcileStaleWidgetDependencyBlockers`
+    // admitted it to the turn-end blocker sweep. The mismatch was latent while a
+    // tagged row lived only between a mark and the next scan; retention makes it
+    // durable, so the predicate has to answer for the tag.
+    if (d.disposition)
+        return false;
     // #1631: a dependency-drift-demoted finding is no longer a hard stop. The gate
     // sets `stale` rather than dropping the entry (#1419 demote-not-drop), so every
     // tally and render that asks "is this blocking?" must answer no once demoted.
@@ -82,6 +96,20 @@ const diagnosticsWriteGuard = new WriteOrderingGuard();
  */
 const runnerWriteGuard = new WriteOrderingGuard();
 const MAX_STORED_DIAGNOSTICS_PER_FILE = 12;
+/**
+ * #3158 / AGENTS.md shape 9: the per-file bound on
+ * {@link WidgetDiagnostic.suppressedRetained} rows. Retention is the only rule
+ * that lets a record hold findings the latest scan did not report, so it is the
+ * only axis of `allDiagnostics` that can grow while the live set shrinks — every
+ * other row is replaced wholesale by the next write. Its own constant rather
+ * than `MAX_STORED_DIAGNOSTICS_PER_FILE`: that one is the TUI's display cap
+ * (`capStoredDiagnostics`) and the two would drift the moment either policy
+ * moved. Twelve because the chip is a COUNT, not a list — past a dozen
+ * suppressed findings on one unchanged file the exact total stops informing the
+ * footer, and the truncation is stated once per file through the ledger rather
+ * than dropped silently.
+ */
+const MAX_RETAINED_SUPPRESSED_PER_FILE = 12;
 const MAX_INACTIVE_FILE_RECORDS = 1024;
 const ACTIVE_FILE_IDLE_MS = 30 * 60_000;
 export const MAX_LSP_SERVER_RECORDS = 128;
@@ -140,24 +168,53 @@ export function reconcileWidgetDisposition(cwd, target, _disposition, content) {
         }
     }
     const active = new Set(applyDispositions(current, cwd, target.filePath, source));
-    const normalized = current.map((diagnostic) => {
+    const normalized = current.flatMap((diagnostic) => {
         const { strict, weak } = anchorsForDiagnostic(cwd, target.filePath, diagnostic, source);
         const entry = getDisposition(cwd, strict) ?? getDisposition(cwd, weak);
         if (!active.has(diagnostic) &&
             (entry?.disposition === "false-positive" ||
                 entry?.disposition === "suppress")) {
-            return { ...diagnostic, disposition: entry.disposition, flagged: false };
+            // #3183: stamp the strict anchor's own SPAN so the row's lifetime can
+            // later ask the mark instead of the file's mtime. `source` is the content
+            // the anchors above were derived from, so the span is the one the mark
+            // itself binds to. Only the STRICT arm has a span — a weak `suppress`
+            // mark hashes no line — and re-tagging always re-derives it, so a stale
+            // span from an earlier tag can never survive into a new disposition.
+            const { anchorSpan: _previousSpan, ...base } = diagnostic;
+            const span = entry.disposition === "false-positive"
+                ? strictAnchorSpan(source, diagnostic.line)
+                : undefined;
+            return [
+                {
+                    ...base,
+                    disposition: entry.disposition,
+                    flagged: false,
+                    ...(span === undefined ? {} : { anchorSpan: span }),
+                },
+            ];
         }
-        const { disposition: _disposition, flagged: _flagged, ...baseDiagnostic } = diagnostic;
+        // #3158 retirement rule 3: a row the store holds ONLY because it was
+        // suppressed (`suppressedRetained`) has no live scan behind it — the last
+        // scan of this file did not report it. Once its mark stops suppressing it
+        // (a strict `false-positive` anchor whose marked line changed), retire it
+        // rather than re-arming it below as a finding the agent would read as
+        // currently present.
+        if (diagnostic.suppressedRetained)
+            return [];
+        const { disposition: _disposition, flagged: _flagged, 
+        // #3183: a row that is no longer disposition-tagged has no mark to
+        // anchor, so its span goes with the tag — leaving it would exempt a LIVE
+        // row from the sweep's mtime gate.
+        anchorSpan: _anchorSpan, ...baseDiagnostic } = diagnostic;
         return entry?.disposition === "flagged"
-            ? { ...baseDiagnostic, flagged: true }
-            : baseDiagnostic;
+            ? [{ ...baseDiagnostic, flagged: true }]
+            : [baseDiagnostic];
     });
     const rec = getOrCreate(target.filePath);
     const writeIndex = admitWidgetDiagnosticsWrite(target.filePath);
     if (!diagnosticsWriteGuard.shouldWrite(fileMapKey(target.filePath), writeIndex))
         return;
-    commitDiagnostics(rec, target.filePath, normalized, Date.now());
+    commitDiagnostics(rec, target.filePath, normalized, Date.now(), fileMapKey(target.filePath), false);
 }
 /** Reserve a widget write for a producer that has no runtime write index. */
 export function admitWidgetDiagnosticsWrite(filePath, writeIndex) {
@@ -473,11 +530,175 @@ function normalizeDiagnostics(filePath, diagnostics, observedTs) {
         };
     });
 }
+/**
+ * The identity a retained suppressed row is matched against a later scan's
+ * entries by (#3158), so a scan that reports the finding AGAIN replaces the
+ * retained row instead of standing beside it as a duplicate.
+ *
+ * These are the WEAK ANCHOR's identity parts — `computeWeakAnchor`
+ * (`clients/diagnostic-dispositions.ts`) hashes `[tool, rule,
+ * normalizeMessage(message)]` over the file — deliberately, because the weak
+ * anchor is how the disposition store itself decides which findings a mark
+ * covers. Matching at any finer granularity means the store can disagree with
+ * the mark that created the row.
+ *
+ * Round 2 F2: `line` USED to be part of it, and that was the finer granularity
+ * the paragraph above forbids. A writer that re-reports the marked finding one
+ * line down — `clients/pipeline.ts`'s per-edit `recordDiagnostics`, or
+ * `reconcileCascadeNeighborLspErrors`, neither of which runs
+ * `reconcileStaleWidgetFiles` — left the retained row standing beside the live
+ * one, so a single finding was counted live AND in `suppressed: N`.
+ *
+ * `computeWeakAnchor` itself is not called here: it needs `cwd` to build its
+ * path component, which `commitDiagnostics` does not have and could only get by
+ * widening `recordDiagnostics`, `reconcileScanDiagnostics` and
+ * `reconcileCorrelatedScanDiagnostics` up through `tools/`. That component is
+ * constant across one file record — both sides of this comparison are the same
+ * file — so it would discriminate nothing. `normalizeMessage` is the shared
+ * derivation from `clients/finding-identity.ts` that the anchor uses, imported
+ * rather than re-spelled.
+ *
+ * #3183: this identity is OCCURRENCE-BLIND, and for a STRICT (`false-positive`)
+ * row that is not enough on its own. Two findings of one rule with identical
+ * messages on different lines collapse onto it, so a scan reporting only the
+ * UNMARKED one matched the marked row and replaced it — the chip lost a mark
+ * that was still applying. A collision is therefore resolved by the second half
+ * of {@link WidgetDiagnostic.anchorSpan}'s contract, in `retainSuppressedRows`:
+ * only a colliding incoming finding sitting ON the marked line is the same
+ * finding. That test, not this one, is what keeps the round-2 F2 case above
+ * closed — the marked line's TEXT moved, so its span still matches.
+ */
+function retentionIdentity(d) {
+    return JSON.stringify([
+        d.tool ?? "",
+        d.rule ?? "",
+        normalizeMessage(d.message),
+    ]);
+}
+/** `filePath`'s current content, or `undefined` when it cannot be read. */
+function readContentOrUndefined(filePath) {
+    try {
+        return readFileSync(filePath, "utf8");
+    }
+    catch {
+        // Only reached once this module has established there IS a span-carrying row
+        // to ask about, so the record is bounded by that population — and worth
+        // making: with no content both callers fall back to the pre-#3183 rules (the
+        // per-entry mtime gate, the coarse retention identity), which is the
+        // conservative direction but can retire a mark that still stands.
+        recordDegradationOnce({
+            kind: "widget-mark-anchor-unreadable",
+            subject: filePath,
+            reason: "the marked file could not be read, so its suppressed rows fall back to the file-mtime retirement gate and the footer chip may under-count it",
+        });
+        return undefined;
+    }
+}
+/**
+ * {@link strictAnchorSpansIn} over `filePath`'s current content (#3183), or
+ * `undefined` when it cannot be read.
+ *
+ * Synchronous in both callers, matching `applyCachedDispositions`
+ * (`tools/lens-diagnostics.ts`) — the seam that asks the very same question on
+ * the very same read path, with `statSync`/`readFileSync`. An async read here
+ * would add two unbounded awaits to a module a registered hook handler imports
+ * directly (`tests/config/hook-await-bounds.test.ts`) for no behavioural gain.
+ */
+function readAnchorSpans(filePath) {
+    const content = readContentOrUndefined(filePath);
+    return content === undefined ? undefined : strictAnchorSpansIn(content);
+}
+/**
+ * #3158: carry the record's disposition-tagged rows across a whole-replace
+ * write when the incoming set no longer reports them, so a `false-positive` /
+ * `suppress` mark keeps contributing to the footer's `suppressed: N` chip. See
+ * {@link WidgetDiagnostic.suppressedRetained} for the full lifetime statement.
+ *
+ * Retained rows are APPENDED after the incoming ones: `capStoredDiagnostics`
+ * fills the TUI's display list from the front, so a retained row never evicts a
+ * live finding from the rendered set.
+ *
+ * The tagged-row check comes FIRST so a project with no disposition marks — the
+ * overwhelmingly common case, and this runs on the per-edit write path — pays
+ * one predicate per stored row and never builds the identity set.
+ */
+function retainSuppressedRows(previous, incoming, filePath) {
+    const tagged = previous.filter((d) => d.disposition !== undefined);
+    if (tagged.length === 0)
+        return incoming;
+    const reported = new Map();
+    for (const d of incoming) {
+        const id = retentionIdentity(d);
+        const bucket = reported.get(id);
+        if (bucket)
+            bucket.push(d);
+        else
+            reported.set(id, [d]);
+    }
+    // #3183: the ONE file read on this path, and only for the state the coarse
+    // identity genuinely cannot resolve — a strict-anchored row whose identity an
+    // incoming finding collides with. Every other write (no marks at all, a mark
+    // with no collision, a weak `suppress` mark) stays zero-I/O, which is what
+    // keeps this off the per-edit `recordDiagnostics` cost.
+    const content = tagged.some((d) => d.anchorSpan !== undefined && reported.has(retentionIdentity(d)))
+        ? readContentOrUndefined(filePath)
+        : undefined;
+    const spans = content === undefined ? undefined : strictAnchorSpansIn(content);
+    const retained = tagged.filter((d) => {
+        const collisions = reported.get(retentionIdentity(d));
+        // Nothing re-reported this finding, so retention rule 2 has nothing to say.
+        if (collisions === undefined)
+            return true;
+        // No span to ask (a weak `suppress` mark, or a row from an older build), or
+        // the file is unreadable: fall back to the pre-#3183 coarse rule. The safe
+        // direction is to UNDER-count, never to leave a phantom duplicate standing
+        // beside a live finding.
+        if (d.anchorSpan === undefined || spans === undefined)
+            return false;
+        // The mark stopped applying — its line is gone from the file — so the
+        // colliding finding IS this one, re-reported now that the filter no longer
+        // drops it (retirement rule 2, and the same verdict the sweep reaches).
+        if (!spans.has(d.anchorSpan))
+            return false;
+        // The mark still applies. Only a collision sitting ON the marked line is
+        // the same finding (its line number may have shifted under an edit — #3158
+        // round 2 F2); any other is a DIFFERENT occurrence this strict anchor never
+        // covered, and replacing the row with it loses a live mark (#3183).
+        return !collisions.some((i) => strictAnchorSpan(content, i.line) === d.anchorSpan);
+    });
+    if (retained.length > MAX_RETAINED_SUPPRESSED_PER_FILE) {
+        // Freshest observations win the cap. One record per FILE, never one per
+        // dropped row (AGENTS.md "bounded observability"): the chip under-counts
+        // by exactly `dropped` for this file until its content changes.
+        retained.sort((a, b) => (b.observedAt ?? 0) - (a.observedAt ?? 0));
+        recordDegradationOnce({
+            kind: "widget-suppressed-retention-capped",
+            subject: filePath,
+            reason: `${retained.length - MAX_RETAINED_SUPPRESSED_PER_FILE} suppressed row(s) beyond the ${MAX_RETAINED_SUPPRESSED_PER_FILE}-row per-file retention cap are no longer counted by the footer chip`,
+        });
+        retained.length = MAX_RETAINED_SUPPRESSED_PER_FILE;
+    }
+    return [
+        ...incoming,
+        ...retained.map((d) => d.suppressedRetained ? d : { ...d, suppressedRetained: true }),
+    ];
+}
 /** Store `normalized` as the record's complete diagnostic set: recompute counts,
  * cap the display list, stamp `touchedAt` (at `observedAt` when given, else now
  * — #1093), persist, and re-render. The caller decides what `normalized`
  * contains (a full replace, or a merge — see `reconcileCascadeNeighborLspErrors`). */
-function commitDiagnostics(rec, filePath, normalized, observedAt, key = fileMapKey(filePath)) {
+function commitDiagnostics(rec, filePath, incoming, observedAt, key = fileMapKey(filePath), 
+/**
+ * #3158: apply the suppressed-row retention rule to this write. True for
+ * every seam that hands in a fresh SCAN of the file (`recordDiagnostics` and
+ * both reconciles), false for `reconcileWidgetDisposition`, which re-maps the
+ * record's own current rows and is the seam that RETIRES a retained row —
+ * re-adding what it just dropped would make retirement rule 3 inert.
+ */
+retainSuppressed = true) {
+    const normalized = retainSuppressed
+        ? retainSuppressedRows(rec.allDiagnostics, incoming, filePath)
+        : incoming;
     rec.diagnosticCounts = countDiagnostics(normalized);
     rec.diagnostics = capStoredDiagnostics(normalized);
     rec.allDiagnostics = normalized;
@@ -765,13 +986,24 @@ export async function reconcileStaleWidgetFiles() {
         // at dispatch/integration.ts). A missing per-entry stamp (a migrated
         // pre-#1186 record) inherits the record's `touchedAt`. Tolerance matches
         // the Windows host-clock skew rationale above.
-        const survivors = rec.allDiagnostics.filter((d) => {
-            const v = freshnessFromMtime({
-                mtimeMs,
-                referenceMs: d.observedAt ?? rec.touchedAt,
-            });
-            return v.verdict !== "stale";
-        });
+        const mtimeStale = (d) => freshnessFromMtime({
+            mtimeMs,
+            referenceMs: d.observedAt ?? rec.touchedAt,
+        }).verdict === "stale";
+        // #3183: a disposition-tagged row carrying a strict anchor span is gated
+        // on its MARK, not on the file's mtime (retirement rule 1 — see
+        // `WidgetDiagnostic.suppressedRetained`): it survives while the marked
+        // LINE is still somewhere in the file, and is retired when it is not.
+        // The content read is gated on a span-carrying row the mtime gate WOULD
+        // have dropped — the only state where reading can change an outcome — so
+        // the debounced render sweep stays off the disk both for a file with no
+        // marks and for a marked file nothing has touched.
+        const spans = rec.allDiagnostics.some((d) => d.anchorSpan !== undefined && mtimeStale(d))
+            ? readAnchorSpans(rec.filePath)
+            : undefined;
+        const survivors = rec.allDiagnostics.filter((d) => d.anchorSpan !== undefined && spans !== undefined
+            ? spans.has(d.anchorSpan)
+            : !mtimeStale(d));
         if (survivors.length === rec.allDiagnostics.length) {
             return { mapKey, action: "keep" }; // nothing stale
         }
@@ -1064,21 +1296,66 @@ export function scheduleStaleReconcile() {
  * Used by lens_diagnostics tool (mode: "all"). Exposes the FULL per-file
  * diagnostic set — decoupled from the widget's display cap — so the agent sees
  * everything, not just the 12 the TUI keeps for rendering.
+ *
+ * #3183: "everything" means every row a live scan stands behind.
+ * `disposition`-tagged rows are the store's own bookkeeping for a mark — the
+ * scan that produced this record did not report them — and they are excluded
+ * here. That is the same predicate `countDiagnostics` and `isBlocking` have
+ * always used, so this makes the projected array agree with the counts beside
+ * it; before #3183 the array disagreed, and once retirement rule 1 let a row
+ * outlive the file's mtime, `applyCachedDispositions` reached it in the
+ * WEAK-fallback branch — which can never match a STRICT `false-positive`
+ * anchor — and `mode=all` served a marked finding as a live warning (#3158 AC3).
+ * The exclusion lives HERE, at the one projection every cache-only surface and
+ * the mode=full merge read, rather than as a second disposition rule inside
+ * `summarizeDiagnostics`' tally: that tally still skips `stale` only, and the
+ * disposition filter still reaches it pre-applied through the shared
+ * `applyCachedDispositions` seam.
+ *
+ * Deliberately NOT applied to {@link getFileDiagnostics}, the per-file read:
+ * `reconcileWidgetDisposition` needs the tagged rows to enforce retirement
+ * rule 3, and `lens_diagnostic_mark`'s cross-check re-marks through them.
  */
 export function getFileDiagnosticSummaries() {
     return [...files.values()].map((rec) => {
         applyPastEofGate(rec);
+        const live = rec.allDiagnostics.filter((d) => d.disposition === undefined);
         return {
             filePath: rec.filePath,
             blocking: rec.diagnosticCounts.blocking,
             errors: rec.diagnosticCounts.errors,
             warnings: rec.diagnosticCounts.warnings,
-            advisories: countAdvisories(rec.allDiagnostics),
+            advisories: countAdvisories(live),
             hasFinalSnapshot: rec.hasFinalDiagnosticsSnapshot,
-            diagnostics: rec.allDiagnostics.map((d) => ({ ...d })),
+            diagnostics: live.map((d) => ({ ...d })),
         };
     });
 }
+/**
+ * How many {@link WidgetDiagnostic.suppressedRetained} rows this file's record
+ * is currently carrying (#3158 round 2 F4).
+ *
+ * The success-path counterpart of `widget-suppressed-retention-capped`: the
+ * ledger only hears about retention when the per-file cap TRUNCATES it, so
+ * nothing observed the healthy case. `tools/lsp-diagnostics.ts` folds this into
+ * the `lsp_probe_disposition_filter` phase it already emits once per filtered
+ * file per scan, so the count is bounded by that record's existing cardinality
+ * — never one row per retained finding.
+ *
+ * Deliberately not {@link getFileDiagnostics}: that applies the past-EOF gate,
+ * which can `stat` the file. This is a map lookup plus a count over rows the
+ * caller's own scan just filtered, so it adds no I/O to the probe path.
+ */
+export function countRetainedSuppressedRows(filePath) {
+    const rec = files.get(fileMapKey(filePath));
+    if (!rec)
+        return 0;
+    let n = 0;
+    for (const d of rec.allDiagnostics)
+        if (d.suppressedRetained)
+            n += 1;
+    return n;
+}
 /**
  * Return the current FULL (uncapped) diagnostic set for a single file, as
  * last recorded by {@link recordDiagnostics} — the same `allDiagnostics`

package/dist/clients/workspace-topology.js

@@ -39,7 +39,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { PROJECT_CONFIG_BASENAMES } from "./config-locations.js";
+import { PROJECT_CONFIG_BASENAMES, isResolvedGlobalConfigPath, } from "./config-locations.js";
 import { logLatency } from "./latency-logger.js";
 import { isAtOrAboveHomeDir, nameMatchesMarkerGlob, walkUpDirs, } from "./path-utils.js";
 /** Depth cap on any upward marker walk — mirrors `findNearestMarkerRoot`'s bound. */
@@ -214,9 +214,53 @@ export function getDirectoryMarkers(dir) {
 function walkCacheKey(startDir, markerKey) {
     return `${path.resolve(startDir)}\0${markerKey}`;
 }
-function walkStillFresh(dirMtimes) {
+export function dirMtimesStillFresh(dirMtimes) {
     return dirMtimes.every(({ dir, mtimeMs }) => safeDirMtimeMs(dir) === mtimeMs);
 }
+/**
+ * Async arm of `dirMtimesStillFresh` — same records, same comparison, stats
+ * issued in parallel. It exists for the async marker walk in
+ * `clients/lsp/server.ts`'s `NearestRoot`, whose own marker probes are
+ * `fs/promises` and which runs on the per-file LSP touch path: a `statSync` per
+ * directory there would block the event loop the walk deliberately keeps free.
+ * Both arms live here so "is this recorded walk still current" has one owner
+ * (#3412).
+ *
+ * Written with promise combinators rather than `await`, along with the two
+ * readers below, so the ONLY place that waits on these stats is the caller's
+ * `await bounded(...)` — a hook-path await that a later editor cannot leave
+ * unbounded, instead of an inner await bounded only by a registry admission
+ * (#3412 review round 1, M-3421-02).
+ */
+export function dirMtimesStillFreshAsync(dirMtimes) {
+    return Promise.all(dirMtimes.map(({ dir }) => dirMtimeMsAsync(dir))).then((current) => dirMtimes.every(({ mtimeMs }, index) => current[index] === mtimeMs));
+}
+/**
+ * Current mtime of `dir`, or `-1` when it cannot be stat'ed — the async arm of
+ * `safeDirMtimeMs`. A recorder and `dirMtimesStillFreshAsync` MUST read through
+ * the same function so the absent-directory sentinel is the same value on both
+ * sides: `prisma/` not existing yet is a recordable state, and the record must
+ * compare unequal once it is created (#3412).
+ */
+function dirMtimeMsAsync(dir) {
+    return fs.promises.stat(dir).then((stats) => stats.mtimeMs, () => -1);
+}
+/** One freshness record per directory, read in parallel (#3412). */
+export function dirMtimeRecordsAsync(dirs) {
+    return Promise.all(dirs.map((dir) => dirMtimeMsAsync(dir).then((mtimeMs) => ({ dir, mtimeMs }))));
+}
+/**
+ * Records for directories whose mtime could NOT be read — because the caller's
+ * bound fired, so the answer is unknown rather than absent. `NaN` compares
+ * unequal to every mtime including itself, so an entry carrying one of these
+ * can never be served: the walk's answer is still returned, it is simply not
+ * memoized. Unknown must never be spelled as a number a directory could
+ * actually have, and dropping the directory from the signature (recording
+ * nothing) would hide every later change in it (#3412 review round 1, S9).
+ */
+export function unknownDirMtimeRecords(dirs) {
+    return dirs.map((dir) => ({ dir, mtimeMs: Number.NaN }));
+}
 /**
  * Shared core of the two nearest-marker walkers below: the cache check, the
  * home-guarded/depth-capped upward loop, per-directory mtime recording, and
@@ -229,7 +273,7 @@ function walkStillFresh(dirMtimes) {
 function walkToNearestMatch(startDir, cacheSuffix, matches, capMetadata, homeDir) {
     const key = walkCacheKey(startDir, cacheSuffix);
     const cached = walkCache.get(key);
-    if (cached && walkStillFresh(cached.dirMtimes)) {
+    if (cached && dirMtimesStillFresh(cached.dirMtimes)) {
         touchWalk(key, cached);
         return cached.dir;
     }
@@ -339,11 +383,21 @@ export function findNearestDirWithAnyBasename(startDir, basenames, homeDir = os.
  * `.pi-lens.json`/`pi-lens.json` directly IN `dir` — no upward walk. The
  * shared-index equivalent of `project-lens-config.ts`'s old private
  * `findPiLensConfigInDir` probe loop.
+ *
+ * A candidate that IS the resolved global config path is refused
+ * (global-config-location PR, refs #2457): the global tier reads that file by
+ * absolute path, and discovering it here a second time made the nested ignore
+ * layering full-validate it and warn that its global-only keys are "not
+ * honored in a project config" — including the notice advising the user to
+ * set them in the very file being ignored. The refusal is observable through
+ * the marker staying absent, the same shape as a directory with no marker.
  */
 export function findPiLensConfigMarkerInDir(dir) {
     const markers = getDirectoryMarkers(dir);
     if (!markers.piLensConfigPath)
         return undefined;
+    if (isResolvedGlobalConfigPath(markers.piLensConfigPath))
+        return undefined;
     const stat = (() => {
         try {
             return fs.statSync(markers.piLensConfigPath);