pi-lens 4.2.1 → 4.4.0

package/dist/clients/lsp/workspace-diagnostics-cache.js

@@ -1,639 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { getProjectDataDir } from "../file-utils.js";
-import { writeFileAtomic } from "../atomic-write.js";
-import { readJsonCache } from "../json-cache-read.js";
-import { createGenerationMap } from "../generation-guard.js";
-import { normalizeMapKey } from "../path-utils.js";
-import { loadReverseDependencyIndexFromSnapshot } from "../reverse-deps.js";
-import { freshnessFromMtime } from "../freshness.js";
-import { logLatency } from "../latency-logger.js";
-import { recordDegradationOnce } from "../degradation-ledger.js";
-import { compareOrdinal } from "../string-utils.js";
-import { workspaceDiagnosticsCacheSessionStart } from "./workspace-diagnostics-session.js";
-import { createDiskBindingCache, } from "./diagnostic-binding.js";
-/**
- * #671: per-file cache of the last CONFIRMED `runWorkspaceDiagnostics` sweep
- * result, so a repeat `lens_diagnostics mode=full` with no intervening edits
- * doesn't re-touch every file through the language server(s) again. Mirrors
- * `clients/project-diagnostics/cache.ts`'s load/save + mtime-staleness shape
- * (same `getProjectDataDir`-rooted `cache/` path, same version-guard +
- * fail-open-on-corrupt read), but keyed PER FILE with its own scan timestamp
- * rather than one global `scannedAt` — a workspace sweep can span many
- * seconds/minutes across thousands of files, each finishing at a different
- * time, so a single project-wide timestamp would either understate or
- * overstate every individual file's real staleness window.
- *
- * NEVER persist an inconclusive/timed-out `touchFile` result here — an
- * unconfirmed result read back as "cached clean" on a later sweep is exactly
- * the false-clean bug class #571/#630 already fixed for the live path; a
- * caching layer must not reintroduce that failure shape via a second
- * mechanism. Callers must only pass CONFIRMED results (see
- * `LSPWorkspaceDiagnosticResult.timedOut` in `./index.ts`) into
- * `WorkspaceDiagnosticsCacheEntry`.
- */
-// v3 (#2776): cached diagnostics must carry per-diagnostic `serverId`
-// provenance before replay, because primary/auxiliary partitioning is
-// server-owned rather than source-owned. v2 entries predate that contract and
-// are rejected so the owning server can re-collect them instead of silently
-// demoting old primary findings to auxiliary.
-// v2 (#1095): entries may carry an optional `contentHash` fingerprint of the
-// file bytes the cached diagnostics were computed against, so a `lookup` can
-// surface a content `binding` (boundToCurrentDisk) beyond the mtime proxy.
-// Legacy v1 entries are rejected by the version guard and re-scanned — a
-// deliberately clean break so no entry lacking the field is ever served.
-export const WORKSPACE_DIAGNOSTICS_CACHE_VERSION = 3;
-const CACHE_FILE = "lsp-workspace-diagnostics.json";
-function cachePath(cwd) {
-    return path.join(getProjectDataDir(cwd), "cache", CACHE_FILE);
-}
-// #1669 (review round): every cwd that has ever backed a
-// `createWorkspaceDiagnosticsCacheContext` call in this process — the ONLY
-// reliable record of which on-disk cache(s) are actually live. A
-// `workspace/diagnostic/refresh` reaches us at the per-LSP-client layer
-// (`client.ts`), which knows its own `state.root` — a per-SERVER identity
-// root that `resolveServerRoot` (`index.ts`) routinely nests BELOW the real
-// sweep cwd for a monorepo/multi-root project's nested-boundary-marker
-// subproject — but has no way to know which cwd(s) `runWorkspaceDiagnostics`/
-// `tools/lsp-diagnostics.ts` actually swept under. Clearing at `state.root`
-// would miss the real cache file entirely and write a stray empty one at a
-// fabricated path. Recording every real cwd here, at the one funnel both
-// callers already share, lets a refresh invalidate every cache that could
-// legitimately be affected without threading cwd knowledge into client.ts.
-// Bounded defensively: a session touching more than this many distinct sweep
-// roots is already pathological, and dropping new entries past the cap is
-// safe (a "not yet registered" cwd's cache was never able to receive a
-// pre-refresh entry in the first place).
-//
-// Known residual (#1707): a monorepo subproject this process has NOT swept
-// yet, under a cwd DIFFERENT from `state.root`, is reachable by neither this
-// registry nor the `state.root` fallback the refresh handler also applies
-// (`client.ts`) — a refresh arriving before that subproject's first sweep
-// clears nothing for it. Filed rather than silently claimed as solved; the
-// real fix needs `LSPService` to tell a client its actual sweep cwd(s), not
-// just its per-server root.
-const MAX_REGISTERED_CWDS = 64;
-const _registeredCwds = new Set();
-/** Drop every cache this process has ever swept under. Best-effort, matching
- *  `clearWorkspaceDiagnosticsCache`'s own fail-open posture. See the
- *  `_registeredCwds` doc comment above for the #1707 residual this does not
- *  cover. */
-export function clearAllWorkspaceDiagnosticsCaches() {
-    for (const cwd of _registeredCwds) {
-        clearWorkspaceDiagnosticsCache(cwd);
-    }
-}
-/**
- * Clear the client root and every ancestor up to the session workspace root.
- * A language server may identify a nested monorepo member while the sweep
- * stores that member's files in the enclosing workspace cache. The refresh
- * request knows the former, so walk only the bounded ancestor chain rather
- * than writing to unrelated filesystem roots.
- */
-export function clearWorkspaceDiagnosticsCacheAtAndAbove(cwd, ceiling = process.cwd()) {
-    const root = path.resolve(cwd);
-    const workspaceRoot = path.resolve(ceiling);
-    clearWorkspaceDiagnosticsCache(root);
-    const relative = path.relative(workspaceRoot, root);
-    if (relative.startsWith(".." + path.sep) ||
-        relative === ".." ||
-        path.isAbsolute(relative)) {
-        return;
-    }
-    if (normalizeMapKey(root) === normalizeMapKey(workspaceRoot))
-        return;
-    let ancestor = path.dirname(root);
-    while (true) {
-        clearWorkspaceDiagnosticsCache(ancestor);
-        if (normalizeMapKey(ancestor) === normalizeMapKey(workspaceRoot))
-            return;
-        const parent = path.dirname(ancestor);
-        if (parent === ancestor)
-            return;
-        ancestor = parent;
-    }
-}
-// #1669 (review round): per-cwd epoch, mirroring
-// `clients/review-graph/builder.ts`'s workspace-cache epoch shape — AGENTS.md's
-// canonical pattern for "a durable commit followed by an out-of-guard mirror
-// refresh" (shape 12). A sweep's `createWorkspaceDiagnosticsCacheContext` loads
-// the file ONCE and `persist()` blind-overwrites the whole map at the end; a
-// refresh landing mid-sweep would otherwise be UNDONE the moment that sweep's
-// own (now-stale) in-memory copy is written back. Capture the epoch at
-// context-creation (read) time; refuse to publish if it advanced before
-// `persist()` (write) time — the clear wins, and the next sweep starts clean.
-// Per N4, `lookup()` also checks it on every call, so an in-flight sweep
-// stops serving pre-refresh entries the moment its OWN epoch goes stale, not
-// only at `persist()` time.
-//
-// #1669 review R2: this map is IN-MEMORY ONLY, deliberately — a round-3
-// attempt to also persist it inside the cache file (a `generation` field)
-// was reverted here: nothing actually READ that field to invalidate entries
-// on load, so it was inert machinery (verified by the round-4 review:
-// replacing the disk read with a constant left every test green). A cwd
-// this process has never opened a context for — most concretely a monorepo
-// subproject a sweep hasn't reached yet — still has no epoch here at all;
-// see the `state.root` fallback's doc comment on `clearWorkspaceDiagnosticsCache`
-// below and #1707 for that residual gap, tracked rather than silently
-// claimed as solved.
-//
-// #1754: the per-cwd epochs are the shared `GenerationMap` primitive rather
-// than a hand-rolled Map, so the capture-before-load/check-before-write shape
-// here is the same code the dispatch-availability guards run, and a dropped
-// write is visible in the degradation ledger instead of silent.
-//
-// Two properties this file relies on, both documented on the primitive:
-//
-// - The map issues stamps from ONE monotonic ticket counter, so a cwd dropped
-//   at the retained-key bound reads 0 — a stamp no live handle holds — and its
-//   outstanding contexts report stale. Fail-closed, which for this cache means
-//   "recompute", the same outcome a real refresh produces. The pre-#1754 map
-//   was unbounded; the bound is new and costs at most one extra sweep for a
-//   cwd that fell off the end.
-// - `normalizeMapKey` runs `realpathSync.native` on Windows and, since #3098,
-//   on POSIX as well. A handle re-runs
-//   it only after the map has been invalidated, so an uninterrupted sweep pays
-//   that syscall once at context creation rather than once per `lookup()`, and
-//   an interrupted one pays it per check to stay correct if the cwd's realpath
-//   answer moved.
-const _cacheEpochs = createGenerationMap("workspace-diagnostics-cache", {
-    normalizeKey: normalizeMapKey,
-});
-/** Fail-safe on any read/parse/shape problem: return `undefined` so the
- * caller treats a stale/missing/corrupt cache as "nothing cached" — every
- * file then falls through to a fresh touch, same fail-open posture as
- * `loadProjectDiagnosticsSnapshot`. */
-export function loadWorkspaceDiagnosticsCache(cwd) {
-    return readJsonCache(cachePath(cwd), (parsed) => {
-        if (!parsed || typeof parsed !== "object")
-            return undefined;
-        const cache = parsed;
-        if (cache.version !== WORKSPACE_DIAGNOSTICS_CACHE_VERSION) {
-            if (cache.version === 1 || cache.version === 2) {
-                recordDegradationOnce({
-                    kind: "lsp-workspace-cache-migration",
-                    subject: path.resolve(cwd),
-                    reason: `rejected v${cache.version} cache with ${cache.entries && typeof cache.entries === "object"
-                        ? Object.keys(cache.entries).length
-                        : 0} entries during provenance migration`,
-                });
-            }
-            return undefined;
-        }
-        if (!cache.entries || typeof cache.entries !== "object")
-            return undefined;
-        const validEntries = {};
-        for (const [key, entry] of Object.entries(cache.entries)) {
-            if (!entry || typeof entry !== "object")
-                continue;
-            if (!Array.isArray(entry.diagnostics) ||
-                entry.diagnostics.some((diagnostic) => !diagnostic ||
-                    typeof diagnostic !== "object" ||
-                    typeof diagnostic.serverId !== "string" ||
-                    diagnostic.serverId.length === 0)) {
-                continue;
-            }
-            validEntries[key] = entry;
-        }
-        return { ...cache, entries: validEntries };
-    });
-}
-export function saveWorkspaceDiagnosticsCache(cwd, cache) {
-    const filePath = cachePath(cwd);
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    // bestEffort: false — persist()'s catch is the error policy here, and it
-    // must observe the failure so `dirty` stays set and the next sweep retries.
-    writeFileAtomic(filePath, JSON.stringify(cache, null, 2), {
-        bestEffort: false,
-    });
-}
-/**
- * Drop every entry from the persisted cache so the next sweep from either
- * call site (`runWorkspaceDiagnostics` or `tools/lsp-diagnostics.ts`) pays for
- * a fresh pull instead of replaying entries the server just told us to
- * distrust. Used by the `workspace/diagnostic/refresh` handler (#1669) — a
- * server-initiated signal (typically a project-wide config change) that
- * everything it has already reported may be stale, so this on-disk cache must
- * not survive it either.
- *
- * Best-effort, matching `persist()`'s fail-open policy: a write failure just
- * means the next sweep may reuse stale entries once more, never worth
- * crashing the caller (a live LSP request handler) over.
- */
-export function clearWorkspaceDiagnosticsCache(cwd) {
-    const root = path.resolve(cwd);
-    // Bump FIRST: any sweep context already loaded (whose own `persist()`
-    // hasn't run yet) must observe an epoch mismatch regardless of exactly
-    // when its write lands relative to this clear.
-    _cacheEpochs.bump(root);
-    try {
-        saveWorkspaceDiagnosticsCache(root, {
-            version: WORKSPACE_DIAGNOSTICS_CACHE_VERSION,
-            entries: {},
-        });
-    }
-    catch {
-        // best-effort — see doc comment above.
-    }
-}
-// ---------------------------------------------------------------------------
-// #1782: serve-time freshness bound on entries that ASSERT findings
-// ---------------------------------------------------------------------------
-/**
- * Ceiling on how long a finding-bearing entry may keep serving INSIDE one
- * session. The session bound alone leaves a multi-day session replaying hour-one
- * findings forever; four hours is short enough that a stale blocker cannot
- * outlive the work that caused it, and long enough that a normal working
- * session re-touches a finding-bearing file only a handful of times.
- */
-export const WORKSPACE_DIAGNOSTICS_FINDING_MAX_AGE_MS = 4 * 60 * 60_000;
-/**
- * #1782: decide whether an entry has aged out of its right to be SERVED.
- *
- * The bound applies only to entries that assert findings. That asymmetry is
- * deliberate, not an oversight:
- *
- * - A finding-bearing entry makes a POSITIVE claim ("this file has errors
- *   right now"). Replayed after the config that produced it changed, it renders
- *   as a current blocking gate failure that no gate ever ran — the #1782
- *   defect, where five `typescript:2339` errors born under inferred settings
- *   (#1640) were still rendered as fresh `blocking` rows 28 hours and one
- *   session later, because no newer pull ever re-answered those files and
- *   nothing expired them.
- * - A clean entry makes only a NEGATIVE claim: "the file and its dependencies
- *   are unchanged". Expiring clean entries too would force a full re-touch of
- *   every swept file on the first sweep of every session, which is the exact
- *   cost #671 built this cache to avoid, while the harm it would prevent is a
- *   missing finding rather than a fabricated blocker.
- *
- * So the re-touch volume this policy adds is bounded by the number of files
- * that previously REPORTED something, not by the size of the repo.
- *
- * #1786 review F4, closed by #1793: `isEntryFresh` used to fail OPEN to
- * mtime-only whenever `getImports` returned `undefined` — no
- * reverse-dependency index this session, which is the normal state of a cold
- * session before the cascade has built one — for EVERY clean entry,
- * regardless of what it had asserted when it was recorded. #1793 closes that
- * for any entry recorded WHILE a dependency index was available
- * (`depIndexAtScan`): such an entry now refuses to serve on a later,
- * index-less session instead of falling back to mtime-only, and the refused
- * entry is evicted rather than left to be refused again forever (see the
- * `lookup` doc comment on the deletion below).
- *
- * ACCEPTED, not residual: an entry recorded on an EQUALLY cold session
- * (`depIndexAtScan` false/absent, including every entry on disk from before
- * this fix) keeps the mtime-only fallback. It never asserted more than
- * mtime-only could verify in the first place, so there is nothing stronger
- * to hold it to — this is exactly the population #1793's acceptance
- * criteria left alone, not a gap this policy silently reopens. #1814 closed
- * a narrower, adjacent gap in the per-file dependency check itself: a
- * session WITH a warm index could still fail-open per-file for a file
- * outside that index's own coverage (see `getImports`'s doc comment below).
- *
- * Pure and exported so the policy is unit-testable without a filesystem.
- */
-export function classifyWorkspaceDiagnosticsCacheExpiry(entry, now, sessionStartedAt) {
-    const findings = Array.isArray(entry.diagnostics)
-        ? entry.diagnostics.length
-        : 0;
-    if (findings === 0)
-        return undefined;
-    if (entry.scannedAt < sessionStartedAt)
-        return "pre-session";
-    if (now - entry.scannedAt > WORKSPACE_DIAGNOSTICS_FINDING_MAX_AGE_MS) {
-        return "max-age";
-    }
-    return undefined;
-}
-/**
- * True when `filePath`'s cached entry is still trustworthy enough to reuse
- * instead of paying for a fresh `touchFile`.
- *
- * Two invalidation layers:
- * 1. The file's OWN mtime must be unchanged since it was scanned (exact
- *    match against `entry.mtimeMs`) — any drift, or a stat failure
- *    (deleted/unreadable), invalidates. #2300: when the entry also carries a
- *    `sizeBytes`, the current size must match too — an external rewrite that
- *    lands in the same mtime bucket with a different length is otherwise
- *    invisible to mtime alone. A pre-#2300 entry without `sizeBytes` fails
- *    OPEN to the mtime-only check (see the field's doc comment).
- * 2. When a reverse-dependency index is available (`getImports` returns an
- *    array rather than `undefined`), every file THIS file imports must not
- *    have changed after `entry.scannedAt` either — this is the fix for the
- *    cross-file blind spot plain mtime-checking has: a TypeScript diagnostic
- *    on file A can change purely because a dependency B's exported shape
- *    changed, with zero edits to A's own bytes/mtime.
- *
- * `getImports` returning `undefined` means "this file's dependency claim
- * can't be verified this session" — either no dependency graph is available
- * at all (no cascade/session-start has built `clients/reverse-deps.ts`'s
- * persisted index yet), OR an index IS available but was never told about
- * THIS file (#1814: the index exists and covers other files, just not this
- * one — `getImports` used to mask that second case with `?? []`, coercing it
- * to an empty array and letting the loop below iterate zero times and report
- * fresh, indistinguishable from a file the index actually confirmed has zero
- * imports). Both are real, expected states — we fail OPEN per-file to
- * mtime-only invalidation in that case, UNLESS the entry itself was recorded
- * while a dependency index WAS available for THIS file (`entry.depIndexAtScan`
- * — see its doc comment for the per-file vs whole-session distinction, #1793
- * review F2). #1793/#1814: such an entry asserted a stronger claim than
- * mtime-only can back up, so serving it through the weaker check just
- * because THIS session can't verify it (whole-session cold, or this file
- * just outside coverage) would resurrect the exact blind spot #1786's
- * review flagged (F4) — a project-wide dependency change invisible for as
- * long as the file's own bytes stay untouched. `lookup` (the sole caller)
- * DELETES an entry this function refuses for that reason, rather than
- * leaving it to be refused again on every later cold sweep (#1793 review
- * F3) — see its own doc comment for why eviction, not a stamp downgrade,
- * bounds the repeat cost. An entry recorded on an equally cold session
- * (`depIndexAtScan` false/absent) never made that stronger claim, so it
- * keeps the mtime-only fallback — matching the same blind spot the
- * cheap-tier `project-diagnostics.json` cache already accepts today; that is
- * accepted design for #1793's acceptance criteria, not a gap this function
- * reopens. Once a reverse-deps index covers this file, this function
- * upgrades to using it automatically — no separate cache format/version
- * needed.
- *
- * #1708 sweep: the dependency check below compares a captured `scannedAt`
- * against each dependency's mtime, the same shape `findingPathFreshness`
- * under-tolerated. `MTIME_DRIFT_TOLERANCE_MS` (`blocker-freshness.ts`) keeps
- * it from over-invalidating on the same host mtime-vs-`Date.now()` skew
- * (#1491/#1498) rather than just a redundant re-touch.
- */
-export function isEntryFresh(filePath, entry, getImports) {
-    let ownStat;
-    try {
-        ownStat = fs.statSync(filePath);
-    }
-    catch {
-        return false; // deleted / unreadable
-    }
-    if (ownStat.mtimeMs !== entry.mtimeMs)
-        return false;
-    // #2300: same axis reused from the stat above — no extra syscall.
-    if (entry.sizeBytes !== undefined && ownStat.size !== entry.sizeBytes) {
-        return false;
-    }
-    const imports = getImports(filePath);
-    if (imports === undefined) {
-        // #1793: an entry recorded WITH dependency knowledge must not fall
-        // back to the weaker mtime-only check just because this session is
-        // cold — see the doc comment above. An entry that never had that
-        // knowledge (false/absent) keeps the existing fail-open behavior.
-        return entry.depIndexAtScan !== true;
-    }
-    for (const dep of imports) {
-        let mtimeMs;
-        try {
-            mtimeMs = fs.statSync(dep).mtimeMs;
-        }
-        catch {
-            return false; // dependency deleted/unreadable: fail closed
-        }
-        const verdict = freshnessFromMtime({
-            mtimeMs,
-            referenceMs: entry.scannedAt,
-        });
-        if (verdict.verdict === "stale")
-            return false;
-    }
-    return true;
-}
-/** Cache-map key helper — every read/write of `WorkspaceDiagnosticsCache.entries`
- * must go through this so `/`↔`\` and casing differences (#210's read-guard
- * bug class) can never produce a false cache miss OR a false cache hit. */
-export function cacheKeyFor(filePath) {
-    return normalizeMapKey(filePath);
-}
-/**
- * Fingerprint identifying "what a touch actually covered" — see the
- * `scopeKey` doc on `WorkspaceDiagnosticsCacheEntry`. Both sweep call sites
- * (`runWorkspaceDiagnostics` and `tools/lsp-diagnostics.ts`'s batch/directory
- * scan) build this from the same two inputs (`touchFile`'s `clientScope` and
- * `excludeServerIds`) so an entry is only ever reused where its coverage is
- * IDENTICAL to what the new lookup is asking for.
- */
-export function buildScopeKey(clientScope, excludeServerIds) {
-    const excluded = excludeServerIds
-        ? [...excludeServerIds].sort(compareOrdinal)
-        : [];
-    return `${clientScope}|${excluded.join(",")}`;
-}
-export function createWorkspaceDiagnosticsCacheContext(cwd) {
-    const root = path.resolve(cwd);
-    if (_registeredCwds.size < MAX_REGISTERED_CWDS || _registeredCwds.has(root)) {
-        _registeredCwds.add(root);
-    }
-    // #1669: captured at load time — see the epoch doc comment above.
-    const epoch = _cacheEpochs.capture(root);
-    const existing = loadWorkspaceDiagnosticsCache(root);
-    const entries = {
-        ...existing?.entries,
-    };
-    const reverseDepsIndex = loadReverseDependencyIndexFromSnapshot({
-        cwd: root,
-    });
-    // #1814: `getImports` returns `undefined` for TWO distinct situations —
-    // no reverse-deps index loaded this session at all, OR an index IS loaded
-    // but doesn't cover this specific file (never seen by the
-    // cascade/session-start scan that built it). #1793/#1800 only closed the
-    // first: `?? []` used to coerce the second into an empty array, so
-    // `isEntryFresh`'s dependency loop iterated zero times and returned
-    // fresh — a file the index never saw was indistinguishable from a file
-    // the index confirmed has zero imports (the #1800 review's probe F). Not
-    // coercing here lets `isEntryFresh`'s existing `imports === undefined`
-    // branch (and its own `entry.depIndexAtScan` check) treat both cases
-    // alike, with no separate branch needed.
-    const getImports = (filePath) => reverseDepsIndex?.imports[cacheKeyFor(filePath)];
-    // #1793 review F2, extended by #1814: per-FILE knowledge is exactly
-    // "`getImports` returned something", so it is DERIVED from `getImports`
-    // rather than re-checking `reverseDepsIndex.imports[key] !== undefined`
-    // in parallel — a hand-duplicated copy of the same coverage check is
-    // exactly the kind of drift #1814 fixed (`?? []` masked one of the two
-    // call sites but not the other, pre-fix). `record` stamps THIS.
-    const hasDepKnowledge = (filePath) => getImports(filePath) !== undefined;
-    // #1095: per-sweep disk-fingerprint memo (per file+mtime) for binding verify.
-    const diskBindingCache = createDiskBindingCache();
-    let dirty = false;
-    // #1782 (AC4): one BOUNDED record per context, not one per expired entry —
-    // a sweep that ages out 400 ghosts emits a single line carrying the count,
-    // the oldest age, and the per-reason split. Flushed from `persist()`, the
-    // end-of-sweep hook both call sites already run.
-    //
-    // #1786 review F6: the counters DRAIN on flush rather than hiding behind a
-    // once-only latch. A latch is correct only while every call site persists
-    // exactly once; draining stays correct when one does not, and it still emits
-    // nothing on a repeat `persist()` with no new expiries, because the count is
-    // back to zero. Bounded either way: one record per batch of expiries, never
-    // one per entry.
-    let expiredCount = 0;
-    let oldestExpiredAgeMs = 0;
-    const expiredByReason = { "pre-session": 0, "max-age": 0 };
-    // #1793: a bounded counter for the NEW refusal path — an entry recorded
-    // with dependency knowledge that this (cold) session can't revalidate.
-    // Folded into the same expiry-telemetry record/flush shape rather than a
-    // second event kind, so a sweep's whole "what did I refuse to serve"
-    // picture stays in one line.
-    let depIndexColdRefusalCount = 0;
-    const flushExpiryTelemetry = () => {
-        if (expiredCount === 0 && depIndexColdRefusalCount === 0)
-            return;
-        logLatency({
-            type: "phase",
-            phase: "lsp_workspace_diagnostics_cache_expiry",
-            filePath: root,
-            durationMs: 0,
-            metadata: {
-                expiredEntries: expiredCount,
-                oldestExpiredAgeMs,
-                preSession: expiredByReason["pre-session"],
-                maxAge: expiredByReason["max-age"],
-                depIndexColdRefusals: depIndexColdRefusalCount,
-                sessionStartedAt: workspaceDiagnosticsCacheSessionStart(),
-                maxAgeMs: WORKSPACE_DIAGNOSTICS_FINDING_MAX_AGE_MS,
-            },
-        });
-        expiredCount = 0;
-        oldestExpiredAgeMs = 0;
-        expiredByReason["pre-session"] = 0;
-        expiredByReason["max-age"] = 0;
-        depIndexColdRefusalCount = 0;
-    };
-    return {
-        importsFor(filePath) {
-            return getImports(filePath);
-        },
-        lookup(filePath, scopeKey) {
-            // #1669 review N4: the epoch guarded `persist()` but not `lookup()` —
-            // an in-flight sweep kept REPLAYING disowned entries into its OWN
-            // served results for the rest of its run even though the on-disk
-            // cache was already correctly cleared (disk stayed clean, but the
-            // user still saw stale results for the remainder of THIS sweep).
-            // Check on every call, not just at load time: a refresh landing
-            // mid-sweep must stop lookups from serving pre-refresh entries
-            // immediately, not only prevent them from being written back.
-            // `cacheEpoch` is in-memory only (see its doc comment) — this runs
-            // per file, and a same-process clear always updates memory
-            // synchronously, so this needs no disk read to be authoritative.
-            if (!epoch.isCurrent())
-                return undefined;
-            const key = cacheKeyFor(filePath);
-            const entry = entries[key];
-            if (!entry || entry.scopeKey !== scopeKey)
-                return undefined;
-            // #1782: age gate BEFORE the mtime/dependency gate — it is two number
-            // comparisons and no syscalls, so an expired entry costs strictly less
-            // than a served one did. An entry that asserts findings and predates
-            // this session (or has aged past the in-session ceiling) is DROPPED,
-            // not served: the caller falls through to a fresh touch, and that
-            // re-touch is what re-subjects the file to every live-publish gate,
-            // including the #1640 inferred-project demote (which needs a live
-            // tsserver for the file and therefore cannot fire on a pure cache hit).
-            // Deleting rather than merely refusing keeps the on-disk file from
-            // carrying ghosts forever: the #1782 cache was rewritten hours after
-            // the entries went stale and still contained them.
-            const now = Date.now();
-            const expiry = classifyWorkspaceDiagnosticsCacheExpiry(entry, now, workspaceDiagnosticsCacheSessionStart());
-            if (expiry) {
-                delete entries[key];
-                dirty = true;
-                expiredCount += 1;
-                expiredByReason[expiry] += 1;
-                oldestExpiredAgeMs = Math.max(oldestExpiredAgeMs, Math.max(0, now - entry.scannedAt));
-                return undefined;
-            }
-            // #1793, widened by #1814: an entry that asserted dependency
-            // knowledge this session can't revalidate is DELETED, not merely
-            // refused — mirroring the #1782 age gate just above. Refusing
-            // without deleting (the #1793 review's F3 finding) would leave
-            // the same stale entry to be refused again on every LATER cold
-            // sweep too, and both `record()` call sites (`index.ts`,
-            // `tools/lsp-diagnostics.ts`) skip recording an unconfirmed
-            // (`timedOut`/`error`) touch — so a file whose forced re-touch
-            // happens to time out would pay that timeout budget on EVERY
-            // sweep forever, whereas pre-fix it served instantly. Deleting
-            // bounds the repeat cost to exactly what a file that was NEVER
-            // cached already costs: one re-touch attempt per sweep until a
-            // CONFIRMED result lands — a real, accepted, pre-existing cost
-            // class, not a new one. The first confirmed re-touch (this
-            // session or a later one) re-records the file stamped against
-            // THAT session's own dependency knowledge, healing it either
-            // way. `!hasDepKnowledge(filePath)` (#1814) covers BOTH "no
-            // index this session at all" (#1793's original population) AND
-            // "an index exists but doesn't cover this file" (#1814's
-            // addition, the probe F gap) — one check for both, since both
-            // mean the same thing to this entry: nothing here can revalidate
-            // the stronger claim it made when it was recorded.
-            if (entry.depIndexAtScan === true && !hasDepKnowledge(filePath)) {
-                delete entries[key];
-                dirty = true;
-                depIndexColdRefusalCount += 1;
-                return undefined;
-            }
-            if (!isEntryFresh(filePath, entry, getImports))
-                return undefined;
-            return {
-                diagnostics: entry.diagnostics,
-                count: entry.count,
-                binding: {
-                    contentHash: entry.contentHash,
-                    boundToCurrentDisk: diskBindingCache.boundToCurrentDisk(filePath, {
-                        contentHash: entry.contentHash,
-                    }),
-                },
-                scannedAt: entry.scannedAt,
-            };
-        },
-        record(filePath, scopeKey, diagnostics, mtimeMs, contentHash, sizeBytes) {
-            const scanGeneration = Date.now();
-            entries[cacheKeyFor(filePath)] = {
-                diagnostics,
-                count: diagnostics.length,
-                mtimeMs,
-                scannedAt: scanGeneration,
-                scopeKey,
-                // #1793: stamp whether THIS FILE actually had dependency
-                // knowledge this sweep (not just whether SOME index was
-                // loaded — see `hasDepKnowledge`'s doc comment), so a later
-                // cold session can refuse to revalidate this entry via the
-                // weaker mtime-only path only when that refusal is warranted.
-                depIndexAtScan: hasDepKnowledge(filePath),
-                ...(contentHash !== undefined && { contentHash }),
-                ...(sizeBytes !== undefined && { sizeBytes }),
-            };
-            dirty = true;
-        },
-        persist() {
-            // #1782: emit the expiry record even when nothing new was recorded —
-            // a sweep whose only outcome was aging out ghosts is exactly the run a
-            // dogfood needs to see in `latency.log`.
-            flushExpiryTelemetry();
-            if (!dirty)
-                return;
-            // #1669: a refresh invalidated this cwd's cache after we loaded it —
-            // publishing this sweep's (now-stale-relative-to-the-refresh) in-memory
-            // copy would resurrect exactly what the refresh cleared. Drop the
-            // write; the next sweep loads clean and recomputes.
-            const published = epoch.guardedWrite(root, () => {
-                try {
-                    saveWorkspaceDiagnosticsCache(root, {
-                        version: WORKSPACE_DIAGNOSTICS_CACHE_VERSION,
-                        entries,
-                    });
-                    return true;
-                }
-                catch {
-                    // Best-effort: a failed cache write just means the next sweep pays
-                    // the full cost again — never worth failing the sweep itself over.
-                    return false;
-                }
-            });
-            // `undefined` means the guard dropped the write as stale: this
-            // in-memory copy is worthless, so stop advertising it as pending.
-            // `false` means the write itself failed, so `dirty` stays set and the
-            // next sweep retries. Same three outcomes as the pre-#1754 guard.
-            if (published !== false)
-                dirty = false;
-        },
-    };
-}

package/dist/clients/lsp/workspace-diagnostics-session.js

@@ -1,30 +0,0 @@
-/**
- * #1782: the session clock the workspace-diagnostics cache measures entry age
- * against, in a module of its own.
- *
- * It lives here rather than in `workspace-diagnostics-cache.ts` for one
- * measured reason (#1786 review F5): `handleSessionStart` must re-arm it, and
- * importing the cache module to do so drags `reverse-deps.ts`,
- * `blocker-freshness.ts`, and the generation-guard machinery into the EAGER
- * session-start module graph — 17 ms, about 9% of cold session start. This file
- * imports nothing, so the re-arm stays a plain synchronous call with no await
- * inserted into the middle of the reset sequence and no import cost.
- *
- * The default is module-import time so the very first sweep in a cold extension
- * host already treats every entry written by a PREVIOUS process as pre-session
- * (fail-closed). It must still be re-armed per session: a pi extension host
- * survives `session_start`, so a process-lifetime value would pin the first
- * session's clock for the life of the process (AGENTS.md's
- * session-signal-vs-latch screen). Registered in
- * `tests/support/session-state-registry.ts`, whose conformance suite proves the
- * reset is reachable from `handleSessionStart`.
- */
-let _sessionStartedAt = Date.now();
-/** Re-arm the session clock. Called by `handleSessionStart`. */
-export function resetWorkspaceDiagnosticsCacheSession(startedAt = Date.now()) {
-    _sessionStartedAt = startedAt;
-}
-/** When the current session started, for entry-age comparisons. */
-export function workspaceDiagnosticsCacheSessionStart() {
-    return _sessionStartedAt;
-}