pi-lens 4.4.1 → 4.4.3

package/dist/mcp/server.js

@@ -7,35 +7,35 @@ import {
   deadCodeIssues,
   formatDeadCodeDelta,
   stableFindingKey
-} from "../chunk-HSIRMK2D.js";
+} from "../chunk-OCAGUNBC.js";
 import {
   clearFormatterCache
-} from "../chunk-ZETYB3XG.js";
+} from "../chunk-3W7IEVVL.js";
 import {
   findNearestProjectRoot,
   isStartupScanVerdictFresh,
   resolveStartupScanContext
-} from "../chunk-6P54TMWL.js";
+} from "../chunk-3VPVG5SU.js";
 import {
   loadCallGraph
-} from "../chunk-WW5BLB74.js";
+} from "../chunk-WOA4LN2R.js";
+import {
+  isHardFailureSummary
+} from "../chunk-7U2IDNXN.js";
 import {
   RUNNERS,
   formatRunDurationMs,
   isExcludedTestTarget,
   isRunnerErrorResult
-} from "../chunk-3P4PF2BX.js";
+} from "../chunk-VCO24T4L.js";
 import {
   GovulncheckClient
-} from "../chunk-N7YNJE5R.js";
+} from "../chunk-SQ4TVJBR.js";
 import {
   GitleaksClient,
   classifyAndFilterFindings
-} from "../chunk-DMS52BEP.js";
-import "../chunk-2UMYMRI3.js";
-import {
-  isHardFailureSummary
-} from "../chunk-7U2IDNXN.js";
+} from "../chunk-SS36ZX4J.js";
+import "../chunk-ZGDGW2V3.js";
 import {
   resetManagedToolRefreshSession
 } from "../chunk-UXVNL3D7.js";
@@ -53,12 +53,13 @@ import {
   peekTurnEndFindings,
   snapshotAdvisoryProvenance,
   validateAdvisoryProvenance
-} from "../chunk-J6DFZDFA.js";
+} from "../chunk-KBG47GHP.js";
 import {
   CacheManager,
   DELTA_UNUSED_PROMOTION_NOTE,
   MCP_TURN_STATE_OWNER_ID,
   acquireWarmWordIndex,
+  admitsProjectWideFindings,
   analyzeFile,
   applyFindingPolicy,
   applyLspFindingPolicy,
@@ -98,56 +99,53 @@ import {
   resetPendingRunnerFindings,
   resetPsScriptAnalyzerAvailability,
   runProviders
-} from "../chunk-ZZUFZUQZ.js";
+} from "../chunk-H6MF6EVN.js";
 import {
   resetLazyInstallAttempts
-} from "../chunk-ZOEYVXSV.js";
+} from "../chunk-OXXKQCSV.js";
 import {
   isTestRoleCollateral
-} from "../chunk-KJN4IOEJ.js";
+} from "../chunk-EJIUXPBX.js";
+import {
+  findingsResult,
+  hasUsableResult
+} from "../chunk-2CD5RS6M.js";
 import "../chunk-FC4RP4I2.js";
+import "../chunk-UZ3TUTRV.js";
+import {
+  resetGoAvailability
+} from "../chunk-XMSXXAHW.js";
 import {
   TrivyClient
-} from "../chunk-YLN4K6WD.js";
-import "../chunk-J3FZR3YY.js";
-import "../chunk-5JHXUETW.js";
+} from "../chunk-77M37OKR.js";
+import "../chunk-CSHFH5IN.js";
+import "../chunk-VCHXCQFG.js";
+import "../chunk-3EFKIGZN.js";
 import {
   resetRustAvailability
-} from "../chunk-3MRXIJ6I.js";
-import {
-  findingsResult,
-  hasUsableResult
-} from "../chunk-TA5L5KWQ.js";
-import "../chunk-FGALODG3.js";
-import "../chunk-OC7LYAU5.js";
+} from "../chunk-MRXKYPCS.js";
+import "../chunk-7DYBLXYA.js";
+import "../chunk-AB3YYG6N.js";
 import {
   getSgCommand,
   resetDispatchAvailabilityState,
   resolveManagedToolClient
-} from "../chunk-NFXP47RV.js";
-import "../chunk-MGIWSROG.js";
-import "../chunk-WSEWKCXU.js";
-import "../chunk-MQA2YBAH.js";
-import "../chunk-TQFBZVCG.js";
-import "../chunk-WATC3IQR.js";
-import {
-  resetGoAvailability
-} from "../chunk-OYOB3ZFG.js";
-import "../chunk-XHSCVSOL.js";
+} from "../chunk-YSZNHOBY.js";
+import "../chunk-RPLINGVB.js";
+import "../chunk-XCJN5IJU.js";
+import "../chunk-76MWC2K6.js";
+import "../chunk-GXW6K4YJ.js";
+import "../chunk-2B73ZPOK.js";
 import {
   SYMBOL_KIND_NAMES,
   captureReviewGraphStructuralIr,
   formatReviewGraphRevisionDriftNote,
   publishReviewGraphFileIr,
   reviewGraphIrContentHash
-} from "../chunk-V5MEBST3.js";
+} from "../chunk-YYOIQFRS.js";
 import {
   buildSymbolId
 } from "../chunk-3MED75HT.js";
-import {
-  resolveGitCheckout,
-  resolveLinkedWorktreeOwner
-} from "../chunk-IMSQR4WO.js";
 import {
   DEPENDENCY_DRIFT_MAX_DELIVERIES,
   MAX_LATE_AUX_REARMS,
@@ -155,7 +153,6 @@ import {
   RUNTIME_CONFIG,
   ReadGuard,
   STALE_LINE_MARKER,
-  SWEEP_IDLE_SAFETY_MARGIN_MS,
   Text,
   TreeSitterSymbolExtractor,
   WriteOrderingGuard,
@@ -186,7 +183,6 @@ import {
   getActiveSessionId,
   getDisposition,
   getFileDiagnosticSummaries,
-  getFullScanWallClockMs,
   getLSPService,
   getLspBudgetIdleTimeoutMs,
   getMutationBridge,
@@ -200,7 +196,6 @@ import {
   isBlocking,
   isPendingAuxiliaryPastRearmTtl,
   isWarmAttached,
-  isWorkspaceSweepActive,
   loadLspService,
   logBusEvent,
   markWidgetFileBlockersStale,
@@ -230,7 +225,6 @@ import {
   retireScope,
   retireWidgetDependencyDriftBlockers,
   runPerServerGroups,
-  runWhenWorkspaceSweepIdle,
   scopeCell,
   setSessionLanguages,
   shouldShortenLspIdleTimeout,
@@ -243,22 +237,19 @@ import {
   widgetDiagnosticUri,
   workspaceEditTextPaths,
   writeOrderToken
-} from "../chunk-MTDRLSI7.js";
-import {
-  emitBounded,
-  resetBoundedTelemetry
-} from "../chunk-OZJINN4O.js";
+} from "../chunk-M6HSLBWY.js";
 import {
   hashText,
   normalizeMessage,
   primePersistedMutationAttribution,
   resetMutationAttribution,
   stableFindingId
-} from "../chunk-3JSEWUWI.js";
+} from "../chunk-IBGIOBEE.js";
 import {
   mapWithConcurrency
 } from "../chunk-XIMYZ3JA.js";
 import {
+  canWriteAnalysisRoot,
   classifyCascadeWaitTier,
   customServerSpecsOf,
   describeRootFallback,
@@ -276,11 +267,32 @@ import {
   resetLSPCaseSensitivityState,
   resolveLspCwdForFile,
   shouldInitializeSessionRoot
-} from "../chunk-IQZXOZ7S.js";
+} from "../chunk-EU63SDCG.js";
+import "../chunk-VWCXW2E7.js";
 import {
-  hasAmbientPythonEnvironment
-} from "../chunk-LNOMA3MP.js";
-import "../chunk-U52SAGRM.js";
+  emitBounded,
+  hasAmbientPythonEnvironment,
+  resetBoundedTelemetry
+} from "../chunk-FCSOVF55.js";
+import {
+  resolveGitCheckout,
+  resolveLinkedWorktreeOwner
+} from "../chunk-PNQDPDRC.js";
+import {
+  PROJECT_SNAPSHOT_VERSION,
+  getProjectSnapshotLegacyPath,
+  getProjectSnapshotPath,
+  hydrateRuntimeFromProjectSnapshot,
+  hydrateRuntimeFromProjectSnapshotIfIdle,
+  isProjectSnapshotFresh,
+  isProjectSnapshotMetaStale,
+  loadProjectSnapshot,
+  loadProjectSnapshotExportsAndRules,
+  loadProjectSnapshotWithoutWordIndex,
+  readJsonCache,
+  readProjectSnapshotMeta,
+  saveRuntimeProjectSnapshot
+} from "../chunk-ZXYDQ3TZ.js";
 import "../chunk-5W3R6LFT.js";
 import {
   EXT_TO_LANG,
@@ -294,7 +306,7 @@ import {
   queryLoader,
   reportBundledResourceDirHealth,
   resolveTreeSitterLanguage
-} from "../chunk-UEAHAMEI.js";
+} from "../chunk-QHJ6DQ2R.js";
 import "../chunk-Z54ZSOBZ.js";
 import {
   SCAN_LANGUAGE_PRIORITY,
@@ -302,44 +314,35 @@ import {
   extensionsForLanguageToken,
   getUserRuleRoot,
   resolveLanguage
-} from "../chunk-KJCWXUUS.js";
+} from "../chunk-724UL2TJ.js";
 import {
   dump,
   resolvePackagePath
 } from "../chunk-QOZXJ4NA.js";
-import "../chunk-6XX5HCLK.js";
-import "../chunk-S6AMWKPC.js";
+import "../chunk-GBPP5P7X.js";
+import "../chunk-P7266HLM.js";
+import {
+  SWEEP_IDLE_SAFETY_MARGIN_MS,
+  getFullScanWallClockMs,
+  isWorkspaceSweepActive,
+  runWhenWorkspaceSweepIdle
+} from "../chunk-MQLUAEOC.js";
 import {
   HOOK_WALL_BUDGET_MS,
   bounded,
   combineAbortSignals,
   withDeadline
-} from "../chunk-F5VLZHUW.js";
-import {
-  PROJECT_SNAPSHOT_VERSION,
-  getProjectSnapshotLegacyPath,
-  getProjectSnapshotPath,
-  hydrateRuntimeFromProjectSnapshot,
-  hydrateRuntimeFromProjectSnapshotIfIdle,
-  isProjectSnapshotFresh,
-  isProjectSnapshotMetaStale,
-  loadProjectSnapshot,
-  loadProjectSnapshotExportsAndRules,
-  loadProjectSnapshotWithoutWordIndex,
-  readJsonCache,
-  readProjectSnapshotMeta,
-  saveRuntimeProjectSnapshot
-} from "../chunk-AXKPQ6ZI.js";
+} from "../chunk-52FUZI6K.js";
 import {
   centralityFromReverseDeps,
   getWordIndexBuildStatus,
   logWordIndex,
   searchWordIndex,
   triggerBackgroundWordIndexBuild
-} from "../chunk-7BX5DWSA.js";
+} from "../chunk-SAEFPSB6.js";
 import {
   getProjectDiagnosticsScannerMaxFiles
-} from "../chunk-IUKPRZER.js";
+} from "../chunk-GAEGEPOC.js";
 import {
   PathKeyedMap
 } from "../chunk-Z3CCVDUB.js";
@@ -352,30 +355,27 @@ import {
   readTurnEndStatus,
   resolveRunnerPath,
   toRunnerDisplayPath
-} from "../chunk-XGUL4SLQ.js";
+} from "../chunk-L3BLXZG7.js";
 import "../chunk-2BEMIWEW.js";
 import {
   commitDurableStore,
   resetResolvedPathCache,
   resetZizmorTokenAvailability
-} from "../chunk-LD7WFTRX.js";
+} from "../chunk-ACXEQZOU.js";
 import {
   resolveToolCwd
-} from "../chunk-IUR76K6A.js";
+} from "../chunk-Q7DUK4LX.js";
 import {
   _resetPackageManagerCache,
   findGlobalBinary,
   pmBinary,
   resolveNodePackageManager,
   runScriptArgs
-} from "../chunk-T4QZ6FEH.js";
-import {
-  isToolInstallAllowedByTrust,
-  projectTrustDenialReason
-} from "../chunk-D6YF5HKX.js";
+} from "../chunk-AW7R2GWG.js";
 import {
+  getIsolatedNpxSpawnOptions,
   probeToolAsync
-} from "../chunk-CMU4RMJB.js";
+} from "../chunk-RWWYJ623.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
@@ -383,20 +383,20 @@ import {
   logAvailabilityDecision,
   resetInstallRetryLatches,
   startHostStallSampler
-} from "../chunk-O7HZX7CA.js";
+} from "../chunk-VRZP76YM.js";
 import {
   canRunStartupHeavyScans,
   detectProjectLanguageProfile,
   getDefaultStartupTools
-} from "../chunk-VYKKMYVT.js";
-import "../chunk-BNKLYOOO.js";
+} from "../chunk-QOBUHWHX.js";
+import "../chunk-QILIYSJF.js";
 import {
   collectSourceFilesWithBudgetAsync,
   getSlowFsVerdict,
   isSlowFs,
   slowFsDegradationNotice
-} from "../chunk-USHG4DLH.js";
-import "../chunk-H5EV3VMF.js";
+} from "../chunk-6C7JWPCP.js";
+import "../chunk-5NGR67U5.js";
 import {
   displayProjectDataPath,
   drainProjectDataDirMigrations,
@@ -423,7 +423,7 @@ import {
   sweepDeadEphemeralDataDirs,
   updateHeartbeat,
   withGenerationLockSync
-} from "../chunk-T54VJRAD.js";
+} from "../chunk-C34ZXZ7O.js";
 import {
   createSingleFlight
 } from "../chunk-BW5KFIQC.js";
@@ -433,7 +433,7 @@ import {
 } from "../chunk-QYF5S6P6.js";
 import {
   detectFileKind
-} from "../chunk-64LU2OVH.js";
+} from "../chunk-PHDMFAKM.js";
 import {
   compareKeys,
   detectFileRole,
@@ -443,12 +443,18 @@ import {
   provenanceView,
   resolvePiLensConfig,
   summarizeConfigResolution
-} from "../chunk-N2IRDBZI.js";
+} from "../chunk-2BBLFX75.js";
 import {
   LSP_NAMESPACE_KEY,
   getPiLensGlobalConfigPath,
   resetWorkspaceTopology
-} from "../chunk-Z6BB4JLQ.js";
+} from "../chunk-XVF2VVXP.js";
+import {
+  getProjectTrustState,
+  isToolInstallAllowedByTrust,
+  projectTrustDenialReason,
+  setProjectTrustState
+} from "../chunk-ZANLILYD.js";
 import {
   DEFAULT_MAX_OUTPUT_BYTES,
   createBoundedOutputSink,
@@ -469,16 +475,17 @@ import {
   resolveLensToolEnabled,
   resolveLensToolName,
   toolRegistryEntryForMcp
-} from "../chunk-7ELY2CSM.js";
+} from "../chunk-JAU72XNY.js";
 import {
   createSubsystemLogger,
   flushExtensionLog,
   logExtension
-} from "../chunk-34OCDWOS.js";
+} from "../chunk-XTMJ7XDT.js";
+import "../chunk-JMYYOTQG.js";
 import {
   claimPhaseOncePerSession,
   logLatency
-} from "../chunk-3PNFWVHT.js";
+} from "../chunk-QQNQ7SJW.js";
 import {
   beginTurnContext,
   createNdjsonLogger,
@@ -487,11 +494,11 @@ import {
   isTestMode,
   runLogCleanup,
   setTurnContextSession
-} from "../chunk-VSMJK3ZJ.js";
+} from "../chunk-AOHZU2BM.js";
 import "../chunk-LJDODBBZ.js";
 import {
   FactStore
-} from "../chunk-UGSMCQ4D.js";
+} from "../chunk-CHOW74WE.js";
 import {
   BoundedFifoMap,
   BoundedLruCache
@@ -506,15 +513,16 @@ import {
   normalizeMapKey,
   pathsEqual,
   realpathOrResolve,
+  resolveHostToolPath,
   toProjectRelativePath,
   uriToPath
-} from "../chunk-G3RLJYA2.js";
+} from "../chunk-N2H3ZPZY.js";
 import "../chunk-NXL4FFQQ.js";
 
 // dist/mcp/server.js
 import * as fs25 from "node:fs";
 import * as net from "node:net";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // dist/tools/render-compact.js
@@ -978,6 +986,7 @@ var SgRunner = class {
   log;
   sgPath = null;
   sgArgsPrefix = [];
+  sgSpawnOptions;
   /**
    * Availability memo, backed by the shared transient-aware latch (#1476).
    *
@@ -1059,17 +1068,25 @@ var SgRunner = class {
     this.sweepFallbackCause = "probe-timeout";
     this.sweepHostStallMs = 0;
     this.sweepDurablyMissing = [];
+    const trustedProject = getProjectTrustState() === "trusted";
     const pathCommand = await this.probeCommandCandidates([
-      { cmd: "ast-grep", argsPrefix: [] },
-      { cmd: "sg", argsPrefix: [] },
-      // `npx --no -- ast-grep` starts a Node process before it can answer, so
+      ...trustedProject ? [
+        { cmd: "ast-grep", argsPrefix: [] },
+        { cmd: "sg", argsPrefix: [] }
+      ] : [],
+      // The scoped npx fallback starts a Node process before it can answer, so
       // it is the candidate most likely to blow a 5 s budget on a cold or busy
       // box. Marked a fallback so its timeout cannot veto the install.
-      { cmd: "npx", argsPrefix: ["--no", "--", "ast-grep"], fallback: true }
+      {
+        cmd: "npx",
+        argsPrefix: ["--no", "--package", "@ast-grep/cli", "--", "ast-grep"],
+        fallback: true
+      }
     ]);
     if (pathCommand) {
       this.sgPath = pathCommand.cmd;
       this.sgArgsPrefix = pathCommand.argsPrefix;
+      this.sgSpawnOptions = pathCommand.cmd === "npx" ? getIsolatedNpxSpawnOptions() : void 0;
       this.noteAvailable(startedAt, `ast-grep found on PATH: ${pathCommand.cmd}`);
       return true;
     }
@@ -1082,7 +1099,7 @@ var SgRunner = class {
         return true;
       }
     }
-    const platformBinary = await this.probePlatformPackageBinary();
+    const platformBinary = trustedProject ? await this.probePlatformPackageBinary() : void 0;
     if (platformBinary) {
       this.sgPath = platformBinary;
       this.sgArgsPrefix = [];
@@ -1115,6 +1132,7 @@ var SgRunner = class {
     if (installed.outcome === "success") {
       this.sgPath = installed.value;
       this.sgArgsPrefix = [];
+      this.sgSpawnOptions = void 0;
       this.noteAvailable(startedAt, `ast-grep auto-installed: ${installed.value}`);
       return true;
     }
@@ -1134,7 +1152,7 @@ var SgRunner = class {
    * sweep already asked, and the sweep returns at the first one that answers,
    * so at this point the flag means "a tier the winner is supposed to lose to
    * never got a fair hearing". Latching that pinned the session to
-   * `npx --no -- ast-grep` — a Node start per invocation — over a healthy
+   * `npx` — a Node start per invocation — over a healthy
    * ast-grep on PATH, until the next restart. Provisional instead: served now,
    * re-swept once the stalled tier's cooldown expires.
    *
@@ -1277,7 +1295,10 @@ var SgRunner = class {
     let result;
     let hostStallMs;
     try {
-      result = await probeToolAsync(cmd, [...argsPrefix, "--version"], {
+      result = cmd === "npx" ? await safeSpawnAsync(cmd, [...argsPrefix, "--version"], {
+        ...getIsolatedNpxSpawnOptions(),
+        timeout: PROBE_TIMEOUT_MS
+      }) : await probeToolAsync(cmd, [...argsPrefix, "--version"], {
         timeout: PROBE_TIMEOUT_MS
       });
     } finally {
@@ -1364,6 +1385,7 @@ Original error: ${stderr}`;
   async execRaw(args, timeout = DEFAULT_EXEC_TIMEOUT_MS, options = {}) {
     const command = this.getSgCommand();
     const result = await safeSpawnAsync(command.cmd, [...command.argsPrefix, ...args], {
+      ...this.sgSpawnOptions,
       timeout,
       deadlineAt: options.deadlineAt,
       signal: options.signal,
@@ -1392,6 +1414,7 @@ Original error: ${stderr}`;
     const hasBash = Boolean(process.env.MSYSTEM || process.env.GIT_SHELL);
     const useBash = isWindows && hasBash;
     const result = await safeSpawnAsync(useBash ? "bash" : command.cmd, useBash ? buildBashRunArgs(command.cmd, allArgs) : allArgs, {
+      ...this.sgSpawnOptions,
       timeout: DEFAULT_EXEC_TIMEOUT_MS,
       deadlineAt: options.deadlineAt,
       signal: options.signal,
@@ -1540,6 +1563,7 @@ Original error: ${stderr}`;
         ...sgExcludeArgsForProject(dir),
         dir
       ], {
+        ...sgCmd === "npx" ? getIsolatedNpxSpawnOptions() : {},
         timeout,
         deadlineAt: options.deadlineAt,
         signal: options.signal,
@@ -1577,6 +1601,7 @@ Original error: ${stderr}`;
         dir
       ];
       const spawnOptions = {
+        ...sgCmd === "npx" ? getIsolatedNpxSpawnOptions() : {},
         timeout,
         deadlineAt: options.deadlineAt,
         signal: options.signal,
@@ -2278,7 +2303,7 @@ message: found
 };
 
 // dist/clients/lens-engine.js
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 
 // dist/clients/project-diagnostics/scanner.js
 import * as fs6 from "node:fs";
@@ -2725,7 +2750,7 @@ function resolveRebuildScript(serverFilePath) {
   return serverFilePath.replace(/\\/g, "/").includes("/dist/") ? "build:dist" : "build";
 }
 function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4) {
-  return new Promise((resolve31) => {
+  return new Promise((resolve32) => {
     const args = [workerPath, `--file=${file}`, `--cwd=${cwd}`];
     if (options.flags)
       args.push(`--flags=${JSON.stringify(options.flags)}`);
@@ -2735,7 +2760,7 @@ function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4)
         stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (err) {
-      resolve31({
+      resolve32({
         error: `failed to fork worker: ${err instanceof Error ? err.message : String(err)}`
       });
       return;
@@ -2748,7 +2773,7 @@ function analyzeFileFresh(workerPath, file, cwd, options = {}, timeoutMs = 12e4)
         return;
       settled = true;
       clearTimeout(timer);
-      resolve31(outcome);
+      resolve32(outcome);
     };
     const timer = setTimeout(() => {
       child.kill();
@@ -2856,7 +2881,7 @@ function summarizeScan(diagnostics) {
 // dist/clients/mcp/session.js
 import * as crypto from "node:crypto";
 import * as fs18 from "node:fs";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 
 // dist/clients/bootstrap.js
 var residentClients = null;
@@ -2913,29 +2938,29 @@ async function buildBootstrapClients() {
     }
   }
   const [ruffClient, biomeClient, knipClient, todoScanner, jscpdClient, depChecker, testRunnerClient, metricsClient, complexityClient, goClient, govulncheckClient, gitleaksClient, trivyClient, opengrepClient, rustClient, agentBehaviorClient2, deadCodeClients] = await Promise.all([
-    load("ruff", async () => new (await import("../chunk-JONGANYH.js")).RuffClient()),
-    load("biome", async () => new (await import("../chunk-OEX24ECI.js")).BiomeClient()),
-    load("knip", async () => new (await import("../chunk-AFZYMAIV.js")).KnipClient()),
-    load("todo", async () => new (await import("../chunk-ELVWJYRV.js")).TodoScanner()),
-    load("jscpd", async () => new (await import("../chunk-H2W2AXD3.js")).JscpdClient()),
-    load("dependency-checker", async () => new (await import("../chunk-WPE5FPGR.js")).DependencyChecker()),
-    load("test-runner", async () => new (await import("../chunk-N77WFUL7.js")).TestRunnerClient()),
-    load("metrics", async () => new (await import("../chunk-HREZQCT3.js")).MetricsClient()),
-    load("complexity", async () => new (await import("../chunk-VZHJS6DR.js")).ComplexityClient()),
+    load("ruff", async () => new (await import("../chunk-T6CPIZNT.js")).RuffClient()),
+    load("biome", async () => new (await import("../chunk-ZWFS3OEF.js")).BiomeClient()),
+    load("knip", async () => new (await import("../chunk-YIUAVF7E.js")).KnipClient()),
+    load("todo", async () => new (await import("../chunk-JSQFTSC6.js")).TodoScanner()),
+    load("jscpd", async () => new (await import("../chunk-CMMHNUZ2.js")).JscpdClient()),
+    load("dependency-checker", async () => new (await import("../chunk-EC47DWFA.js")).DependencyChecker()),
+    load("test-runner", async () => new (await import("../chunk-XAGLWMJ4.js")).TestRunnerClient()),
+    load("metrics", async () => new (await import("../chunk-N3X6Q4YT.js")).MetricsClient()),
+    load("complexity", async () => new (await import("../chunk-VSSBEUFT.js")).ComplexityClient()),
     // The process-wide singleton, NOT a fresh instance (#2455 fix round 4,
     // F2). `handleSessionStart` reads this object for its "Active tools"
     // line while `resetGoAvailability` re-arms the singleton's latch; a
     // second instance here meant the reset never reached the surface a
     // user actually sees.
-    load("go", async () => (await import("../chunk-Z7QQA2KT.js")).goClient),
-    load("govulncheck", async () => new (await import("../chunk-RTQNRM5X.js")).GovulncheckClient()),
-    load("gitleaks", async () => new (await import("../chunk-IR6XFA5P.js")).GitleaksClient()),
-    load("trivy", async () => new (await import("../chunk-OYTMZXRF.js")).TrivyClient()),
-    load("opengrep", async () => new (await import("../chunk-D65GOCJB.js")).OpengrepClient()),
+    load("go", async () => (await import("../chunk-Z527N6YQ.js")).goClient),
+    load("govulncheck", async () => new (await import("../chunk-KDERNTCQ.js")).GovulncheckClient()),
+    load("gitleaks", async () => new (await import("../chunk-XIJZVPD5.js")).GitleaksClient()),
+    load("trivy", async () => new (await import("../chunk-FMSO6RDZ.js")).TrivyClient()),
+    load("opengrep", async () => new (await import("../chunk-MXGY6KPT.js")).OpengrepClient()),
     // The process-wide singleton, for the same reason as "go" above.
-    load("rust", async () => (await import("../chunk-EUT3B22Y.js")).rustClient),
-    load("agent-behavior", async () => (await import("../chunk-BJF25SUG.js")).agentBehaviorClient),
-    loadList("dead-code", async () => (await import("../chunk-NJF2X5XF.js")).getDeadCodeClients())
+    load("rust", async () => (await import("../chunk-BRGDSBJE.js")).rustClient),
+    load("agent-behavior", async () => (await import("../chunk-23WOO7TX.js")).agentBehaviorClient),
+    loadList("dead-code", async () => (await import("../chunk-6STA6Z7I.js")).getDeadCodeClients())
   ]);
   if (failures.length > 0)
     await logBootstrapFailures(failures);
@@ -3022,7 +3047,7 @@ function resetAnalyzerBootstrapSessionState() {
 }
 
 // dist/clients/formatters-lazy.js
-var lazyFormatters = createLazyImport(() => import("../chunk-3FERWMCH.js"));
+var lazyFormatters = createLazyImport(() => import("../chunk-RXCOMYPY.js"));
 function warmFormatters() {
   return lazyFormatters.get();
 }
@@ -4061,7 +4086,9 @@ var RuntimeCoordinator = class {
    * session; it is therefore required. `filePath` is the edited file the
    * compute belongs to, the subject of a dropped admission's ledger row.
    */
-  appendCascadePromise(p, generation, filePath) {
+  appendCascadePromise(p, generation, filePath, analysisRootMode = "session") {
+    if (!canWriteAnalysisRoot(analysisRootMode))
+      return;
     if (generation.guardedWrite(filePath, () => true) === void 0)
       return;
     if (this._pendingCascadeRuns.length < MAX_PENDING_CASCADE_RUNS) {
@@ -4123,8 +4150,8 @@ var RuntimeCoordinator = class {
         });
         return entry;
       });
-      const timeout = new Promise((resolve31) => {
-        setTimeout(resolve31, maxWaitMs).unref?.();
+      const timeout = new Promise((resolve32) => {
+        setTimeout(resolve32, maxWaitMs).unref?.();
       });
       await Promise.race([
         Promise.allSettled(tracked.map((t) => t.promise)),
@@ -4830,7 +4857,9 @@ var RuntimeCoordinator = class {
    * for a same-kind re-touch. Callers publish each kind's first transition
    * without spamming repeated edits before `agent_end`.
    */
-  deferMutation(filePath, cwd, toolName, turnStateCwd, kind, ownerSessionId, originCwd, readGuardBranchEpoch = this.readGuard.currentBranchEpoch) {
+  deferMutation(filePath, cwd, toolName, turnStateCwd, kind, ownerSessionId, originCwd, readGuardBranchEpoch = this.readGuard.currentBranchEpoch, analysisRootMode = "session") {
+    if (!canWriteAnalysisRoot(analysisRootMode))
+      return false;
     const key = path8.resolve(filePath);
     const now = Date.now();
     const resolvedOriginCwd = originCwd ?? turnStateCwd;
@@ -4865,8 +4894,8 @@ var RuntimeCoordinator = class {
     });
     return true;
   }
-  deferFormat(filePath, cwd, toolName, turnStateCwd, ownerSessionId, originCwd) {
-    return this.deferMutation(filePath, cwd, toolName, turnStateCwd, "format", ownerSessionId, originCwd);
+  deferFormat(filePath, cwd, toolName, turnStateCwd, ownerSessionId, originCwd, analysisRootMode = "session") {
+    return this.deferMutation(filePath, cwd, toolName, turnStateCwd, "format", ownerSessionId, originCwd, void 0, analysisRootMode);
   }
   /** Return the ownership identity of a queued format record for bus events. */
   deferredFormatIdentity(filePath) {
@@ -5005,7 +5034,7 @@ var RuntimeCoordinator = class {
 
 // dist/clients/runtime-session.js
 import * as nodeFs from "node:fs";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 
 // dist/clients/message-end-attribution.js
 var lastStableSessionId;
@@ -5283,6 +5312,38 @@ function emitSituationalDeadWeight() {
   });
 }
 
+// dist/clients/deferred-test-targets.js
+import * as path12 from "node:path";
+var TEST_RUNNER_MAX_PERSISTED_TARGETS = 64;
+function deferralEntryKey(entry) {
+  return `${entry.sessionId ?? ""}\0${normalizeMapKey(path12.resolve(entry.testFile))}`;
+}
+function mergeDeferredTargets(existing, incoming) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const entry of [...existing, ...incoming]) {
+    const key = deferralEntryKey(entry);
+    const prior = byKey.get(key);
+    if (prior && (prior.attempts ?? 0) >= (entry.attempts ?? 0))
+      continue;
+    byKey.set(key, entry);
+  }
+  return [...byKey.values()];
+}
+function boundDeferredTargets(entries, max, isOwn) {
+  const foreign = [];
+  const own = [];
+  for (const entry of entries) {
+    if (isOwn(entry))
+      own.push(entry);
+    else
+      foreign.push(entry);
+  }
+  const ordered = [...foreign, ...own];
+  if (ordered.length <= max)
+    return ordered;
+  return ordered.slice(-max);
+}
+
 // dist/clients/test-runner-delivery.js
 var pending = /* @__PURE__ */ new Map();
 function resetTestRunnerDelivery() {
@@ -5339,7 +5400,7 @@ function logHostReadyDelay(deps, cwd) {
   });
 }
 function resolveSnapshotRoot(cwd) {
-  const resolvedCwd = path12.resolve(cwd);
+  const resolvedCwd = path13.resolve(cwd);
   const nearest = findNearestProjectRoot(resolvedCwd);
   if (!nearest || isAtOrAboveHomeDir(nearest)) {
     return resolvedCwd;
@@ -5442,8 +5503,8 @@ async function readSequenceWithBudget(args) {
   const { snapshotRoot, base, cwd, runtime, sessionGeneration, dbg, onDeferredSequenceResolved } = args;
   const readPromise = readLatestProjectSequenceAsync(snapshotRoot, base);
   let timeoutHandle;
-  const timeoutPromise = new Promise((resolve31) => {
-    timeoutHandle = setTimeout(() => resolve31({ timedOut: true }), sequenceReadBudgetMs());
+  const timeoutPromise = new Promise((resolve32) => {
+    timeoutHandle = setTimeout(() => resolve32({ timedOut: true }), sequenceReadBudgetMs());
     timeoutHandle.unref();
   });
   const raced = await Promise.race([
@@ -5512,7 +5573,7 @@ async function igniteWarmFiles(cwd, warmFiles, runtime, sessionGeneration, dbg)
     for (const relPath of warmFiles) {
       if (!runtime.isCurrentSession(sessionGeneration))
         return;
-      const filePath = path12.isAbsolute(relPath) ? relPath : path12.resolve(cwd, relPath);
+      const filePath = path13.isAbsolute(relPath) ? relPath : path13.resolve(cwd, relPath);
       if (!nodeFs.existsSync(filePath)) {
         dbg(`session_start lsp-warm: not found: ${relPath}`);
         errors++;
@@ -5543,8 +5604,8 @@ async function igniteDominantLanguageWarm(cwd, runtime, sessionGeneration, dbg)
     if (!runtime.isCurrentSession(sessionGeneration))
       return;
     const lspService = (await loadLspService()).getLSPService();
-    const { collectSourceFilesAsync } = await import("../chunk-J7WJZ6W7.js");
-    const { CODE_KINDS, detectFileKind: detectFileKind2 } = await import("../chunk-CFYISHUW.js");
+    const { collectSourceFilesAsync } = await import("../chunk-4W4VLAPJ.js");
+    const { CODE_KINDS, detectFileKind: detectFileKind2 } = await import("../chunk-FLKWCIZH.js");
     const files = await collectSourceFilesAsync(cwd, {
       inspectGeneratedHeaders: false
     });
@@ -5578,7 +5639,7 @@ async function igniteDominantLanguageWarm(cwd, runtime, sessionGeneration, dbg)
         clientScope: "primary",
         maxClientWaitMs: 2e3
       });
-      dbg(`session_start lsp-warm: dominant=${kind} via ${path12.basename(sample)}`);
+      dbg(`session_start lsp-warm: dominant=${kind} via ${path13.basename(sample)}`);
       return;
     }
     dbg("session_start lsp-warm: no dominant-language LSP file found to warm");
@@ -5610,7 +5671,7 @@ function scheduleManagedToolRefresh(dbg) {
   const timer = setTimeout(() => {
     void (async () => {
       try {
-        const refresh = await import("../chunk-CBD2B5CP.js");
+        const refresh = await import("../chunk-5UCAH366.js");
         const outcome = await refresh.runManagedToolRefresh();
         if (outcome.skipped) {
           dbg(`session_start tool-refresh: skipped (${outcome.skipped})`);
@@ -5627,7 +5688,7 @@ function scheduleManagedToolRefresh(dbg) {
   timer.unref?.();
 }
 async function probePrettierInstall(ensureTool, dbg, analysisRoot) {
-  const pkgPath = path12.join(analysisRoot, "package.json");
+  const pkgPath = path13.join(analysisRoot, "package.json");
   try {
     const raw = await nodeFs.promises.readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
@@ -5657,7 +5718,7 @@ function scanOneTodoFile(scanner, filePath, items) {
 async function collectTodoBaselineItems(scanner, analysisRoot, stillCurrent) {
   const items = [];
   try {
-    const { getSourceFilesAsync } = await import("../chunk-KMGPUKFD.js");
+    const { getSourceFilesAsync } = await import("../chunk-IZSHAIJ7.js");
     const files = await getSourceFilesAsync(analysisRoot, true);
     if (!stillCurrent())
       return items;
@@ -5686,7 +5747,7 @@ async function buildOrRefreshWordIndex(args) {
   const snapshot = loadProjectSnapshot(snapshotRoot);
   const snapshotLoadMs = Date.now() - snapshotLoadStartMs;
   if (snapshot?.wordIndex) {
-    const { deserializeWordIndex, refreshWordIndexIncrementally, countWordIndexPostingEntries: countWordIndexPostingEntries2, estimateWordIndexResidentBytes: estimateWordIndexResidentBytes2 } = await import("../chunk-ZMOMPX2Z.js");
+    const { deserializeWordIndex, refreshWordIndexIncrementally, countWordIndexPostingEntries: countWordIndexPostingEntries2, estimateWordIndexResidentBytes: estimateWordIndexResidentBytes2 } = await import("../chunk-WU567RSC.js");
     const deserializeStartMs = Date.now();
     const index = deserializeWordIndex(snapshot.wordIndex);
     const deserializeMs = Date.now() - deserializeStartMs;
@@ -5758,7 +5819,7 @@ async function buildOrRefreshWordIndex(args) {
       }
     }
   }
-  const { buildWordIndexAsync, collectWordIndexDocs, countWordIndexPostingEntries, estimateWordIndexResidentBytes } = await import("../chunk-ZMOMPX2Z.js");
+  const { buildWordIndexAsync, collectWordIndexDocs, countWordIndexPostingEntries, estimateWordIndexResidentBytes } = await import("../chunk-WU567RSC.js");
   const docs = await collectWordIndexDocs(analysisRoot, () => runtime.isCurrentSession(sessionGeneration), rebuildPreflightFiles);
   if (!runtime.isCurrentSession(sessionGeneration))
     return;
@@ -5828,7 +5889,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
     const queuedAt = Date.now();
     dbg(`session_start task ${name}: scheduled`);
     runtime.markStartupScanInFlight(name, sessionGeneration);
-    const completion = new Promise((resolve31) => {
+    const completion = new Promise((resolve32) => {
       const fire = () => {
         const startedAt = Date.now();
         dbg(`session_start task ${name}: start queuedMs=${startedAt - queuedAt}`);
@@ -5840,7 +5901,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
         }).finally(() => {
           runtime.clearStartupScanInFlight(name, sessionGeneration);
           dbg(`session_start task ${name}: end`);
-          resolve31();
+          resolve32();
         });
       };
       const delay = taskDeferMsByName[name] ?? 0;
@@ -5917,7 +5978,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
     if (await jscpdClient.ensureAvailable()) {
       if (!runtime.isCurrentSession(sessionGeneration))
         return;
-      const isTsProject = nodeFs.existsSync(path12.join(analysisRoot, "tsconfig.json"));
+      const isTsProject = nodeFs.existsSync(path13.join(analysisRoot, "tsconfig.json"));
       const scannerKey = isTsProject ? "jscpd-ts" : "jscpd";
       const cached = cacheManager2.readCache(scannerKey, analysisRoot);
       if (cached) {
@@ -6123,9 +6184,9 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
   });
   let callGraphIdentity;
   const callGraphTask = runTask("call-graph", async () => {
-    const { FactStore: FactStore2 } = await import("../chunk-CULQYFLU.js");
-    const { buildOrUpdateGraph, extractSymbolsAndRefsFromGraph, getReviewGraphCacheIdentity } = await import("../chunk-3TTPKMEF.js");
-    const { buildCallGraph, saveCallGraph, loadCallGraph: loadCallGraph2 } = await import("../chunk-GAYGGICG.js");
+    const { FactStore: FactStore2 } = await import("../chunk-QGQ5CCCG.js");
+    const { buildOrUpdateGraph, extractSymbolsAndRefsFromGraph, getReviewGraphCacheIdentity } = await import("../chunk-2VUQMUMT.js");
+    const { buildCallGraph, saveCallGraph, loadCallGraph: loadCallGraph2 } = await import("../chunk-BKE7E7TC.js");
     if (!runtime.isCurrentSession(sessionGeneration))
       return;
     const startMs = Date.now();
@@ -6166,7 +6227,7 @@ function scheduleStartupScansWithClients(deps, runtime, sessionGeneration, analy
       return;
     if (!runtime.callGraph)
       return;
-    const { buildCodebaseModel, saveCodebaseModel, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET } = await import("../chunk-6UYA642J.js");
+    const { buildCodebaseModel, saveCodebaseModel, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET } = await import("../chunk-TYM6OUIT.js");
     if (!callGraphIdentity)
       return;
     const model = buildCodebaseModel(runtime.callGraph, analysisRoot, DEFAULT_CODEBASE_MODEL_TOKEN_BUDGET, callGraphIdentity);
@@ -6239,9 +6300,76 @@ function scheduleDeferredToolProbesWithClients(deps, languageProfile, startupDef
     dbg(`session_start tools (deferred probes complete, ${Date.now() - warmStart}ms): ${summary}`);
   })();
 }
-var SESSION_START_GUIDANCE = [
-  "\u{1F4CC} pi-lens active \u2014 automated checks run on every edit/write; blocking errors (including pre-existing) show inline and must be fixed.\nKey tools (see each tool's own description for args):\n\u2022 lens_diagnostics \u2014 source=session reads cache; empty cache \u2260 clean; use source=lsp scope=paths for changed files with absent or stale findings (aggregate hosts: lens(action=diagnostics)).\n\u2022 symbol_search \u2192 module_report \u2192 read_symbol/read_enclosing \u2014 ranked identifier search, then navigable outline/callback handles + exact body reads; cheaper than reading a whole file before editing.\n\u2022 Situational (activate via pi_lens_activate_tools): lsp_navigation, ast_grep_search, ast_grep_replace. Use ast_grep_search with dump=true to inspect AST nodes."
-];
+function readSubstituteGuidance(isEnabled) {
+  const units = [];
+  if (isEnabled("symbol_search")) {
+    units.push({ name: "symbol_search", role: "ranked identifier search" });
+  }
+  if (isEnabled("module_report")) {
+    units.push({
+      name: "module_report",
+      role: "navigable outline/callback handles"
+    });
+  }
+  const readSymbol2 = isEnabled("read_symbol");
+  const readEnclosing2 = isEnabled("read_enclosing");
+  if (readSymbol2 && readEnclosing2) {
+    units.push({
+      name: "read_symbol/read_enclosing",
+      role: "exact body reads"
+    });
+  } else if (readSymbol2) {
+    units.push({ name: "read_symbol", role: "exact body reads" });
+  } else if (readEnclosing2) {
+    units.push({ name: "read_enclosing", role: "exact body reads" });
+  }
+  if (units.length === 0)
+    return void 0;
+  const roles = units.map((unit) => unit.role);
+  const roleTail = roles.length === 1 ? roles[0] : roles.length === 2 ? `${roles[0]}, then ${roles[1]}` : `${roles[0]}, then ${roles[1]} + ${roles[2]}`;
+  return `\u2022 ${units.map((unit) => unit.name).join(" \u2192 ")} \u2014 ${roleTail}; cheaper than reading a whole file before editing.`;
+}
+function situationalGuidance(isEnabled) {
+  const active = [];
+  for (const name of [
+    "lsp_navigation",
+    "ast_grep_search",
+    "ast_grep_replace"
+  ]) {
+    if (isEnabled(name))
+      active.push(name);
+  }
+  if (active.length === 0)
+    return void 0;
+  let text = `\u2022 Situational (activate via pi_lens_activate_tools): ${active.join(", ")}.`;
+  if (isEnabled("ast_grep_search")) {
+    text += " Use ast_grep_search with dump=true to inspect AST nodes.";
+  }
+  return text;
+}
+function renderSessionStartGuidance(options = {}) {
+  const disabled = new Set(options.disabledToolNames ?? []);
+  const isEnabled = (name) => !disabled.has(name);
+  const requirePreExistingFixes = options.requirePreExistingFixes !== false;
+  const header = "\u{1F4CC} pi-lens active \u2014 automated checks run on every edit/write; " + (requirePreExistingFixes ? "blocking errors (including pre-existing) show inline and must be fixed." : "blocking errors you introduce must be fixed; pre-existing ones are only reported.");
+  const bullets = [];
+  if (isEnabled("lens_diagnostics")) {
+    bullets.push("\u2022 lens_diagnostics \u2014 source=session reads cache; empty cache \u2260 clean; use source=lsp scope=paths for changed files with absent or stale findings (aggregate hosts: lens(action=diagnostics)).");
+  }
+  const readSubstitute = readSubstituteGuidance(isEnabled);
+  if (readSubstitute)
+    bullets.push(readSubstitute);
+  const situational = situationalGuidance(isEnabled);
+  if (situational)
+    bullets.push(situational);
+  const lines = [header];
+  if (bullets.length > 0) {
+    lines.push("Key tools (see each tool's own description for args):");
+    lines.push(...bullets);
+  }
+  return [lines.join("\n")];
+}
+var SESSION_START_GUIDANCE = renderSessionStartGuidance();
 async function handleSessionStart(deps) {
   resetDegradationLedger();
   let sessionGenerationAtStart = deps.runtime.sessionGeneration;
@@ -6283,8 +6411,8 @@ async function handleSessionStart(deps) {
         try {
           warmupDbg("warmup: starting background warmup");
           const scanContextStartedAt = Date.now();
-          const startupScanModule = await import("../chunk-6B5I6ICN.js");
-          const languageProfileModule = await import("../chunk-7M4T5N3V.js");
+          const startupScanModule = await import("../chunk-ZHFZWTZV.js");
+          const languageProfileModule = await import("../chunk-R3PCY3YS.js");
           const warmupSnapshotRoot = resolveSnapshotRoot(warmupCwd);
           const cachedSnapshot = loadProjectSnapshot(warmupSnapshotRoot);
           warmupOwnSnapshotRead = cachedSnapshot ? {
@@ -6296,7 +6424,7 @@ async function handleSessionStart(deps) {
           const cachedVerdict = cachedSnapshot?.startupScan;
           let scan;
           if (cachedVerdict && startupScanModule.isStartupScanVerdictFresh(cachedVerdict)) {
-            scan = { ...cachedVerdict, cwd: path12.resolve(warmupCwd) };
+            scan = { ...cachedVerdict, cwd: path13.resolve(warmupCwd) };
             warmupDbg(`warmup: scan-context reused from cache (canWarm=${scan.canWarmCaches}${scan.reason ? `, reason=${scan.reason}` : ""})`);
           } else {
             scan = await startupScanModule.resolveStartupScanContextAsync(warmupCwd);
@@ -6490,7 +6618,7 @@ async function handleSessionStart(deps) {
   const cwd = ctxCwd ?? process.cwd();
   const projectDataDir = getProjectDataDir(cwd);
   for (const migration of drainProjectDataDirMigrations()) {
-    const targetName = path12.basename(migration.to);
+    const targetName = path13.basename(migration.to);
     const hash = targetName.match(/([0-9a-f]{8})$/)?.[1] ?? "unknown";
     if (migration.outcome === "ephemeral") {
       recordDegradationOnce({
@@ -6509,11 +6637,11 @@ async function handleSessionStart(deps) {
   const globalDir = getGlobalPiLensDir();
   void sweepAtomicWriteStages([
     projectDataDir,
-    path12.join(projectDataDir, "cache"),
-    path12.join(projectDataDir, "sessions"),
+    path13.join(projectDataDir, "cache"),
+    path13.join(projectDataDir, "sessions"),
     globalDir,
-    path12.join(globalDir, "bin"),
-    path12.join(globalDir, "tools")
+    path13.join(globalDir, "bin"),
+    path13.join(globalDir, "tools")
   ]).catch(() => {
   });
   void sweepDeadEphemeralDataDirs({ isPidAlive: realIsPidAlive }).catch(() => {
@@ -6662,7 +6790,7 @@ async function handleSessionStart(deps) {
   if (allowBootstrapTasks && !getFlag("no-lsp")) {
     const cleaned = cleanStaleTsBuildInfo(ctxCwd ?? process.cwd());
     if (cleaned.length > 0) {
-      notify(`\u{1F9F9} Deleted stale TypeScript build cache (${cleaned.map((f) => path12.basename(f)).join(", ")}) \u2014 phantom errors suppressed.`, "warning");
+      notify(`\u{1F9F9} Deleted stale TypeScript build cache (${cleaned.map((f) => path13.basename(f)).join(", ")}) \u2014 phantom errors suppressed.`, "warning");
       dbg(`session_start: cleaned stale tsbuildinfo: ${cleaned.join(", ")}`);
     }
   }
@@ -6747,7 +6875,7 @@ async function handleSessionStart(deps) {
   const startupScanSource = cachedStartupScan ? "snapshot" : "computed";
   let startupScan;
   if (cachedStartupScan) {
-    startupScan = { ...cachedStartupScan, cwd: path12.resolve(cwd) };
+    startupScan = { ...cachedStartupScan, cwd: path13.resolve(cwd) };
   } else {
     const scanContextStartedAt = Date.now();
     startupScan = resolveStartupScanContext(cwd);
@@ -6852,7 +6980,10 @@ async function handleSessionStart(deps) {
     tools.push("Rust (cargo)");
   log(`Active tools: ${tools.join(", ")}`);
   dbg(`session_start tools: ${tools.join(", ")}`);
-  const agentStartupGuidance = SESSION_START_GUIDANCE;
+  const agentStartupGuidance = renderSessionStartGuidance({
+    disabledToolNames: deps.disabledToolNames,
+    requirePreExistingFixes: deps.globalConfig?.contextInjection?.requirePreExistingFixes
+  });
   runtime.projectRulesScan = scanProjectRules(analysisRoot);
   saveRuntimeProjectSnapshot({
     cwd: snapshotRoot,
@@ -6952,18 +7083,18 @@ function emitSmellsSessionStartLine(dbg, sessionStartMs) {
 
 // dist/clients/runtime-turn.js
 import * as fs17 from "node:fs";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 
 // dist/clients/actionable-warnings.js
 import { createHash as createHash2 } from "node:crypto";
 import * as fs12 from "node:fs";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 
 // dist/clients/actionable-warnings-logger.js
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 var AW_LOG_DIR = getGlobalPiLensLogDir();
-var AW_LOG_FILE = path13.join(AW_LOG_DIR, "actionable-warnings.log");
-var AW_LOG_BACKUP_FILE = path13.join(AW_LOG_DIR, "actionable-warnings.log.1");
+var AW_LOG_FILE = path14.join(AW_LOG_DIR, "actionable-warnings.log");
+var AW_LOG_BACKUP_FILE = path14.join(AW_LOG_DIR, "actionable-warnings.log.1");
 var MAX_LOG_BYTES2 = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_AW_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
 var writer2 = createNdjsonLogger({
   filePath: AW_LOG_FILE,
@@ -6998,7 +7129,7 @@ function createActionableWarningId(args) {
   });
 }
 function legacyActionableWarningId(args) {
-  const rel = path14.relative(args.cwd, args.filePath).replace(/\\/g, "/");
+  const rel = path15.relative(args.cwd, args.filePath).replace(/\\/g, "/");
   const legacyRelativeFile = rel && !rel.startsWith("..") ? rel : normalizeMapKey(args.filePath);
   const parts = [
     legacyRelativeFile,
@@ -7044,7 +7175,7 @@ function deserializeSuppressionState(contents) {
   }
 }
 function readSuppressionState(cwd) {
-  const statePath = path14.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
+  const statePath = path15.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
   try {
     return deserializeSuppressionState(fs12.readFileSync(statePath, "utf8"));
   } catch {
@@ -7052,8 +7183,8 @@ function readSuppressionState(cwd) {
   }
 }
 function updateWarningState(cwd, warnings) {
-  const statePath = path14.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
-  fs12.mkdirSync(path14.dirname(statePath), { recursive: true });
+  const statePath = path15.join(getProjectDataDir(cwd), "cache", "actionable-warning-state.json");
+  fs12.mkdirSync(path15.dirname(statePath), { recursive: true });
   const hook = beforeWarningStateLockForTests;
   beforeWarningStateLockForTests = null;
   hook?.();
@@ -7198,7 +7329,7 @@ function boundedNumber(value, fallback) {
   return value !== void 0 && Number.isFinite(value) && value > 0 ? value : fallback;
 }
 async function buildActionableWarningsReport(args) {
-  const cwd = path14.resolve(args.cwd);
+  const cwd = path15.resolve(args.cwd);
   const records = [...args.dispatchWarnings];
   const lspService = getLSPService();
   const observedAtByPath = /* @__PURE__ */ new Map();
@@ -7220,7 +7351,7 @@ async function buildActionableWarningsReport(args) {
     const eligible = [];
     let outsideRoot = 0;
     for (const file of args.files) {
-      const filePath = path14.resolve(cwd, file);
+      const filePath = path15.resolve(cwd, file);
       if (normalizeMapKey(filePath) === normalizeMapKey(cwd) || !isUnderDir(filePath, cwd)) {
         outsideRoot++;
         logActionableWarningsEvent({
@@ -7330,7 +7461,7 @@ async function buildActionableWarningsReport(args) {
           }
         };
         const deferredWork = (async () => {
-          await new Promise((resolve31) => setTimeout(resolve31, 0));
+          await new Promise((resolve32) => setTimeout(resolve32, 0));
           const deferredRecords = [...carried];
           const deferredDeadline = Date.now() + ACTIONABLE_WARNINGS_DEFERRED_BUDGET_MS;
           deferredDeps.deadlineAt = deferredDeadline;
@@ -7707,7 +7838,7 @@ function publishActionableWarningsReport(cacheManager2, cwd, report, opts = {})
     const reason = `${merged.droppedFiles.length} carried-forward entries: findings are LOST on this channel; ${cause} (files: ${merged.droppedFiles.slice(0, 3).join(", ")}${merged.droppedFiles.length > 3 ? ", ..." : ""})`;
     incrementDegradationCount({
       kind: "actionable-warnings-inband-superseded",
-      subject: `${path14.resolve(cwd)}:inband-carry-superseded`,
+      subject: `${path15.resolve(cwd)}:inband-carry-superseded`,
       reason
     });
     opts.dbg?.(`actionable_warnings: in-band publish dropped ${merged.droppedFiles.length} superseded carried-forward file entry/entries (${merged.droppedFiles.slice(0, 3).join(", ")}${merged.droppedFiles.length > 3 ? ", ..." : ""})`);
@@ -7759,7 +7890,7 @@ function writeDeferredActionableWarningsReport(args) {
   if (droppedFiles.length > 0) {
     incrementDegradationCount({
       kind: "actionable-warnings-deferred-superseded",
-      subject: `${path14.resolve(args.cwd)}:deferred-file-superseded`,
+      subject: `${path15.resolve(args.cwd)}:deferred-file-superseded`,
       reason: `${droppedFiles.length} changed file(s): warnings are LOST; unchanged files were merged into the persisted report (files: ${droppedFiles.slice(0, 3).join(", ")}${droppedFiles.length > 3 ? ", ..." : ""})`
     });
     args.dbg?.(`turn_end: deferred actionable-warnings dropped ${droppedFiles.length} superseded file entry/entries`);
@@ -7768,7 +7899,7 @@ function writeDeferredActionableWarningsReport(args) {
   return { mergedFiles, droppedFiles: droppedFiles.length };
 }
 function getActionableWarningsHistoryPath(cwd) {
-  return path14.join(getProjectDataDir(cwd), "actionable-warnings.jsonl");
+  return path15.join(getProjectDataDir(cwd), "actionable-warnings.jsonl");
 }
 function appendActionableWarningsHistory(cwd, report) {
   const entries = [];
@@ -7807,7 +7938,7 @@ function appendActionableWarningsHistory(cwd, report) {
     return;
   const historyPath = getActionableWarningsHistoryPath(cwd);
   try {
-    fs12.mkdirSync(path14.dirname(historyPath), { recursive: true });
+    fs12.mkdirSync(path15.dirname(historyPath), { recursive: true });
     fs12.appendFileSync(historyPath, `${entries.map((entry) => JSON.stringify(entry)).join("\n")}
 `, "utf8");
   } catch {
@@ -7846,7 +7977,7 @@ ${fileList}${more}` : void 0,
 
 // dist/clients/code-quality-warnings.js
 import * as fs13 from "node:fs";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 var TIER_BUDGET_ORDER = [
   "warning",
   "info",
@@ -7860,7 +7991,7 @@ function lineInModifiedRanges2(line, ranges) {
   return ranges.some((range) => line >= range.start - 2 && line <= range.end + 2);
 }
 function buildCodeQualityWarningsReport(args) {
-  const cwd = path15.resolve(args.cwd);
+  const cwd = path16.resolve(args.cwd);
   const maxWarnings = Math.max(1, args.maxWarnings ?? 50);
   const byId = /* @__PURE__ */ new Map();
   for (const warning of args.warnings) {
@@ -7924,7 +8055,7 @@ function writeCodeQualityWarningsReport(cacheManager2, cwd, report) {
   cacheManager2.writeCache("code-quality-warnings", report, cwd);
 }
 function getCodeQualityWarningsHistoryPath(cwd) {
-  return path15.join(getProjectDataDir(cwd), "code-quality-warnings.jsonl");
+  return path16.join(getProjectDataDir(cwd), "code-quality-warnings.jsonl");
 }
 function appendCodeQualityWarningsHistory(cwd, report) {
   const warnings = report.files.flatMap((file) => file.warnings.map((warning) => ({
@@ -7949,7 +8080,7 @@ function appendCodeQualityWarningsHistory(cwd, report) {
     return;
   const historyPath = getCodeQualityWarningsHistoryPath(cwd);
   try {
-    fs13.mkdirSync(path15.dirname(historyPath), { recursive: true });
+    fs13.mkdirSync(path16.dirname(historyPath), { recursive: true });
     fs13.appendFileSync(historyPath, `${warnings.map((entry) => JSON.stringify(entry)).join("\n")}
 `, "utf8");
   } catch {
@@ -7981,7 +8112,7 @@ function formatCodeQualityWarningsAdvisory(report, cwd, host = "pi") {
 }
 
 // dist/clients/git-guard.js
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 
 // dist/clients/read-guard-tool-lines.js
 var MAX_FAILURE_TRACKER_SIZE = 200;
@@ -8056,7 +8187,7 @@ function readBytes(filePath) {
 
 // dist/clients/git-guard.js
 function resolveGuardPath(filePath, cwd) {
-  return path16.resolve(cwd, filePath);
+  return path17.resolve(cwd, filePath);
 }
 function guardPathKey(filePath, cwd) {
   return advisoryPathKey(filePath, cwd);
@@ -8179,7 +8310,9 @@ function resyncGitGuardAfterInlinePolicy(args) {
     return;
   args.runtime.updateGitGuardStatus(false, "");
 }
-function syncGitGuardRecord(runtime, cacheManager2, cwd, editedFilePath) {
+function syncGitGuardRecord(runtime, cacheManager2, cwd, editedFilePath, analysisRootMode = "session") {
+  if (!canWriteAnalysisRoot(analysisRootMode))
+    return;
   const entries = (runtime.getInlineBlockersSnapshot?.() ?? []).filter((entry) => !entry.policySuppressed);
   const inspection = cacheManager2.inspectCache("turn-end-findings", cwd);
   const existing = cacheRecord(cacheManager2, cwd);
@@ -8373,10 +8506,10 @@ function dedupeSecretFindings(findings) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/govulncheck.js
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 function govulncheckFindingToProjectDiagnostic(cwd, finding) {
   const frame = finding.trace?.find((f) => f.filename);
-  const filePath = frame?.filename ? path17.isAbsolute(frame.filename) ? frame.filename : path17.resolve(cwd, frame.filename) : cwd;
+  const filePath = frame?.filename ? path18.isAbsolute(frame.filename) ? frame.filename : path18.resolve(cwd, frame.filename) : cwd;
   const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
   return {
     filePath,
@@ -8449,12 +8582,12 @@ var govulncheckLane = {
 };
 
 // dist/clients/project-diagnostics/runner-adapters/gitleaks.js
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 function gitleaksFindingToProjectDiagnostic(cwd, finding) {
   const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
   const isBlocking2 = finding.pathStatus !== "scratch" && finding.pathStatus !== "ignored" && finding.pathStatus !== "nested-repository";
   return {
-    filePath: path18.isAbsolute(finding.file) ? finding.file : path18.resolve(cwd, finding.file),
+    filePath: path19.isAbsolute(finding.file) ? finding.file : path19.resolve(cwd, finding.file),
     line: finding.startLine,
     severity: isBlocking2 ? "error" : "info",
     semantic: isBlocking2 ? "blocking" : "none",
@@ -8472,9 +8605,9 @@ function gitleaksResultToProjectDiagnostics(cwd, result) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/trivy.js
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function trivyFindingToProjectDiagnostic(cwd, finding) {
-  const filePath = finding.target ? path19.isAbsolute(finding.target) ? finding.target : path19.resolve(cwd, finding.target) : cwd;
+  const filePath = finding.target ? path20.isAbsolute(finding.target) ? finding.target : path20.resolve(cwd, finding.target) : cwd;
   const version = finding.installedVersion ? `@${finding.installedVersion}` : "";
   const fix = finding.fixedVersion ? ` (fixed in ${finding.fixedVersion})` : "";
   return {
@@ -8491,7 +8624,7 @@ function trivyFindingToProjectDiagnostic(cwd, finding) {
 }
 function trivySecretFindingToProjectDiagnostic(cwd, finding) {
   return {
-    filePath: path19.isAbsolute(finding.file) ? finding.file : path19.resolve(cwd, finding.file),
+    filePath: path20.isAbsolute(finding.file) ? finding.file : path20.resolve(cwd, finding.file),
     line: finding.line,
     severity: "error",
     semantic: "blocking",
@@ -8705,7 +8838,7 @@ function stillReportedParked(parked, current, keyOf, offeredKeys) {
 }
 
 // dist/clients/knip-scan-roots.js
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 var MAX_KNIP_ROOTS_PER_TURN = 3;
 function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
   const session = resolveGitCheckout(sessionCwd);
@@ -8715,7 +8848,7 @@ function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
   let sessionOwnsEdit = false;
   const linked = [];
   for (const file of modifiedFiles) {
-    const owner = resolveLinkedWorktreeOwner(session, resolve12(sessionCwd, file));
+    const owner = resolveLinkedWorktreeOwner(session, resolve13(sessionCwd, file));
     if (owner === null) {
       sessionOwnsEdit = true;
     } else if (!linked.some((known) => pathsEqual(known.root, owner.root))) {
@@ -8731,7 +8864,7 @@ function resolveKnipScanRoots(sessionCwd, modifiedFiles) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/dead-code.js
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 function deadCodeRunnerId(language) {
   return `dead-code-${language}`;
 }
@@ -8747,7 +8880,7 @@ function deadCodeMessage(issue) {
 function deadCodeIssueToProjectDiagnostic(cwd, issue, language) {
   const blocking = issue.category === "unlisted";
   return {
-    filePath: issue.file ? path20.isAbsolute(issue.file) ? issue.file : path20.resolve(cwd, issue.file) : cwd,
+    filePath: issue.file ? path21.isAbsolute(issue.file) ? issue.file : path21.resolve(cwd, issue.file) : cwd,
     line: issue.line,
     severity: blocking ? "error" : "warning",
     semantic: blocking ? "blocking" : "warning",
@@ -8771,11 +8904,11 @@ function deadCodeResultToProjectDiagnostics(cwd, result) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/knip.js
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function knipIssueFile(cwd, issue) {
   if (!issue.file)
     return cwd;
-  return path21.isAbsolute(issue.file) ? issue.file : path21.resolve(cwd, issue.file);
+  return path22.isAbsolute(issue.file) ? issue.file : path22.resolve(cwd, issue.file);
 }
 function knipIssueMessage(issue) {
   if (issue.type === "unlisted") {
@@ -9120,7 +9253,7 @@ async function runPersistentReverify(args) {
 
 // dist/clients/inline-blocker-dispositions.js
 import * as fs16 from "node:fs";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 function readCurrentContent(filePath) {
   try {
     return fs16.readFileSync(filePath, "utf-8");
@@ -9148,7 +9281,7 @@ function applyInlineBlockerPolicy(record, cwd) {
   }
   const byFile = /* @__PURE__ */ new Map();
   for (const diagnostic of diagnostics) {
-    const owner = path22.resolve(cwd, diagnostic.filePath);
+    const owner = path23.resolve(cwd, diagnostic.filePath);
     const group = byFile.get(owner);
     if (group)
       group.push(diagnostic);
@@ -9287,21 +9420,6 @@ var TEST_RUNNER_MAX_TARGETS = 12;
 var TURN_END_SELECTION_ROOT_ROWS = 8;
 var TEST_RUNNER_BATCH_BUDGET_MS = 2e4;
 var TEST_RUNNER_MAX_DEFERRALS = 2;
-var TEST_RUNNER_MAX_PERSISTED_TARGETS = 64;
-function deferralEntryKey(entry) {
-  return `${entry.sessionId ?? ""}\0${normalizeMapKey(path23.resolve(entry.testFile))}`;
-}
-function mergeDeferredTargets(existing, incoming) {
-  const byKey = /* @__PURE__ */ new Map();
-  for (const entry of [...existing, ...incoming]) {
-    const key = deferralEntryKey(entry);
-    const prior = byKey.get(key);
-    if (prior && (prior.attempts ?? 0) >= (entry.attempts ?? 0))
-      continue;
-    byKey.set(key, entry);
-  }
-  return [...byKey.values()];
-}
 async function runTestTargetsBounded(args) {
   const results = [];
   if (args.targets.length === 0)
@@ -9344,7 +9462,7 @@ async function runTestTargetsBounded(args) {
   });
   void pool.catch(() => {
   });
-  await new Promise((resolve31) => {
+  await new Promise((resolve32) => {
     let settled = false;
     const finish = (reason) => {
       if (settled)
@@ -9356,7 +9474,7 @@ async function runTestTargetsBounded(args) {
       batchAbort.abort();
       clearTimeout(timer);
       args.signal?.removeEventListener("abort", onAbort);
-      resolve31();
+      resolve32();
     };
     const onAbort = () => finish("abort");
     const timer = setTimeout(() => finish("budget"), budgetMs);
@@ -9590,22 +9708,26 @@ async function handleTurnEnd(deps) {
       dbg(`turn_end: retaining newer turn state (dispatch=${turnIndexAtDispatch}, current=${runtime.turnIndex})`);
       return;
     }
-    cacheManager2.clearTurnState(cwd, currentOwner);
+    cacheManager2.clearTurnState(cwd, currentOwner, isSecondarySession ? sessionId : void 0);
   };
   void updateHeartbeat().catch(() => {
   });
   const cwd = ctxCwd ?? process.cwd();
-  let turnState = cacheManager2.readTurnState(cwd);
+  const isSecondarySession = deps.sessionScope?.role === "secondary";
+  const sessionRole = isSecondarySession ? "secondary" : "primary";
+  const allowProjectWideFindings = admitsProjectWideFindings(sessionRole);
+  const turnStateSessionId = isSecondarySession ? sessionId : void 0;
+  let turnState = cacheManager2.readTurnState(cwd, turnStateSessionId);
   const currentOwner = {
     ...owner ?? {
       kind: "pi",
-      id: runtime.telemetrySessionId,
+      id: sessionId ?? runtime.telemetrySessionId,
       pid: process.pid,
       lastSeen: (/* @__PURE__ */ new Date()).toISOString()
     },
     sessionStartedAt: owner?.sessionStartedAt ?? runtime.sessionStartedAt
   };
-  const access = cacheManager2.getTurnStateAccess(cwd, currentOwner);
+  const access = isSecondarySession ? "owned" : cacheManager2.getTurnStateAccess(cwd, currentOwner);
   const gateOwnerLabel = turnState.owner ? `${turnState.owner.kind}:${turnState.owner.id}` : turnState.sessionId ? `legacy:${turnState.sessionId}` : "none";
   const sameProcessPiSessionHandoff = access === "foreign-live" && currentOwner.kind === "pi" && turnState.owner?.kind === "pi" && turnState.owner.pid === process.pid && turnState.owner.id !== currentOwner.id;
   if (access === "foreign-live" && !sameProcessPiSessionHandoff) {
@@ -9615,9 +9737,10 @@ async function handleTurnEnd(deps) {
   if (access === "available" && (turnState.files || turnState.owner || turnState.sessionId)) {
     dbg("turn_end: evicting stale turn-state owner");
     clearOwnedTurnState();
-    turnState = cacheManager2.readTurnState(cwd);
+    turnState = cacheManager2.readTurnState(cwd, turnStateSessionId);
   }
-  const files = Object.keys(turnState.files);
+  const ownFiles = Object.keys(turnState.files);
+  const files = ownFiles;
   let widgetDemotedFindingsRetired = 0;
   for (const wPath of drainRenderedDependencyDriftFilePaths()) {
     const deliveryCount = incrementWidgetDependencyDriftDelivery(wPath);
@@ -9633,7 +9756,7 @@ async function handleTurnEnd(deps) {
       }
     }
   }
-  if (files.length === 0 && !runtime.hasCascadeRuns()) {
+  if (files.length === 0 && !runtime.hasCascadeRuns() && !isSecondarySession) {
     if (getFlag("lens-guard") && !runtime.gitGuardHasBlockers) {
       const guardRecord = cacheManager2.readCache("turn-end-findings", cwd)?.data;
       if (guardRecord?.sessionId === runtime.telemetrySessionId && guardRecord.testFailures !== true) {
@@ -9665,7 +9788,7 @@ async function handleTurnEnd(deps) {
     dbg("turn_end: cancelled pending LSP idle reset (active editing)");
   }
   dbg(`turn_end: ${files.length} file(s) modified, cycles: ${turnState.turnCycles}/${turnState.maxCycles}, access: ${access}, owner: ${gateOwnerLabel}`);
-  if (cacheManager2.isMaxCyclesExceeded(cwd)) {
+  if (cacheManager2.isMaxCyclesExceeded(cwd, turnStateSessionId)) {
     dbg("turn_end: max cycles exceeded, clearing state and forcing through");
     clearOwnedTurnState();
     runtime.fixedThisTurn.clear();
@@ -9708,7 +9831,14 @@ async function handleTurnEnd(deps) {
   const projectDiagnosticsDelta = [];
   const projectDiagnosticsSources = /* @__PURE__ */ new Set();
   const runnerFindingsStart = Date.now();
-  const pendingRunnerFindings = await drainPendingRunnerFindings(0);
+  const runnerDrainSignal = deps.signal;
+  const deliverySessionId = sessionId ?? runtime.telemetrySessionId;
+  const pendingRunnerFindings = await bounded(drainPendingRunnerFindings(0, runtime.sessionScope.capture(), deliverySessionId), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: runnerDrainSignal,
+    hook: "turn_end",
+    label: "drainPendingRunnerFindings"
+  }) ?? [];
   let runnerFindingsDelivered = 0;
   let runnerFindingsStale = 0;
   let runnerFindingsFailed = 0;
@@ -9933,7 +10063,16 @@ ${policy.body}`);
     });
   }
   const cascadeSettleStart = Date.now();
-  const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs(), { trackTurnEndClock: true, generation: holdScope });
+  const cascadeSettleSignal = deps.signal;
+  const { settled, timedOut } = await bounded(runtime.settleCascadeRuns(cascadeSettleWaitMs(), {
+    trackTurnEndClock: true,
+    generation: holdScope
+  }), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: cascadeSettleSignal,
+    hook: "turn_end",
+    label: "settleCascadeRuns"
+  }) ?? { settled: 0, timedOut: 0 };
   logLatency({
     type: "phase",
     toolName: "turn_end",
@@ -9950,11 +10089,11 @@ ${policy.body}`);
       const changedSince = runtime.getFilesChangedSince(originSeq);
       if (changedSince.length > 0) {
         const changedSet = new Set(changedSince);
-        const primaryKey = normalizeMapKey(path23.resolve(run.filePath));
+        const primaryKey = normalizeMapKey(path24.resolve(run.filePath));
         const neighborKeys = [
           ...(run.result?.neighbors ?? []).map((n) => n.filePath),
           ...run.selectedNeighborPaths ?? []
-        ].map((filePath) => normalizeMapKey(path23.resolve(filePath)));
+        ].map((filePath) => normalizeMapKey(path24.resolve(filePath)));
         const supersededByOwnFile = changedSet.has(primaryKey) || neighborKeys.some((k) => changedSet.has(k));
         if (supersededByOwnFile) {
           logCascade({
@@ -10660,15 +10799,15 @@ ${suffix}`;
   const govGate = scannerGates.govulncheck;
   const gitleaksGate = scannerGates.gitleaks;
   const trivySecretsGate = scannerGates["trivy-secrets"];
-  const govDelivery = govulncheckLane.render(govulncheckLane.gate({ govulncheck: govGate }, laneCtx), laneCtx);
+  const govDelivery = allowProjectWideFindings ? govulncheckLane.render(govulncheckLane.gate({ govulncheck: govGate }, laneCtx), laneCtx) : {};
   for (const [store, count] of Object.entries(govDelivery.dispositionSuppressed ?? {})) {
     recordDispositionSuppressed(store, count);
   }
   advisoryParts.push(...govDelivery.advisoryParts ?? []);
-  const secretsDelivery = secretsLane.render(secretsLane.gate({
+  const secretsDelivery = allowProjectWideFindings ? secretsLane.render(secretsLane.gate({
     gitleaks: gitleaksGate,
     "trivy-secrets": trivySecretsGate
-  }, laneCtx), laneCtx);
+  }, laneCtx), laneCtx) : {};
   for (const [store, count] of Object.entries(secretsDelivery.dispositionSuppressed ?? {})) {
     recordDispositionSuppressed(store, count);
   }
@@ -10735,16 +10874,22 @@ ${suffix}`;
   }
   const t3 = Date.now();
   let madgeStats;
-  if (getFlag("lens-turn-end-madge") && await depChecker.ensureAvailable()) {
-    const madgeFiles = cacheManager2.getFilesForMadge(cwd);
+  const madgeAvailabilitySignal = deps.signal;
+  if (getFlag("lens-turn-end-madge") && await bounded(depChecker.ensureAvailable(), {
+    ms: HOOK_WALL_BUDGET_MS.turn_end,
+    signal: madgeAvailabilitySignal,
+    hook: "turn_end",
+    label: "madge.ensureAvailable"
+  })) {
+    const madgeFiles = cacheManager2.getFilesForMadge(cwd, turnStateSessionId);
     if (madgeFiles.length > 0) {
       dbg(`turn_end: madge checking ${madgeFiles.length} file(s) for circular deps`);
-      const absFiles = madgeFiles.map((file) => path23.resolve(cwd, file));
+      const absFiles = madgeFiles.map((file) => path24.resolve(cwd, file));
       const batch = await depChecker.checkFilesBatch(absFiles, cwd);
       const depResults = batch.results;
       madgeStats = batch.stats;
       for (const file of madgeFiles) {
-        const absPath = path23.resolve(cwd, file);
+        const absPath = path24.resolve(cwd, file);
         const depResult = depResults.get(absPath);
         if (!depResult)
           continue;
@@ -10780,7 +10925,7 @@ ${suffix}`;
     }
     for (const result of cascadeResults) {
       for (const neighbor of result.neighbors) {
-        const abs = path23.isAbsolute(neighbor.filePath) ? neighbor.filePath : resolveRunnerPath(cwd, neighbor.filePath);
+        const abs = path24.isAbsolute(neighbor.filePath) ? neighbor.filePath : resolveRunnerPath(cwd, neighbor.filePath);
         const key = normalizeMapKey(abs);
         if (seenCandidateKeys.has(key))
           continue;
@@ -10792,20 +10937,17 @@ ${suffix}`;
     const carriedDeferred = priorTestCache?.deferredTargets ?? [];
     const turnSessionId = sessionId ?? runtime.telemetrySessionId;
     const isThisSession = (entry) => entry.sessionId === turnSessionId;
-    const entryPathKey = (entry) => normalizeMapKey(path23.resolve(cwd, entry.testFile));
+    const entryPathKey = (entry) => normalizeMapKey(path24.resolve(cwd, entry.testFile));
     const retiredCarry = (priorTestCache?.retiredTargets ?? []).filter(isThisSession);
     const retiredKeys = new Set(retiredCarry.map(entryPathKey));
     const resolvedDeferralKeys = /* @__PURE__ */ new Set();
     const heldDeferred = [];
     const boundPersisted = (entries, label) => {
-      const ordered = [
-        ...entries.filter((entry) => !isThisSession(entry)),
-        ...entries.filter(isThisSession)
-      ];
-      if (ordered.length <= TEST_RUNNER_MAX_PERSISTED_TARGETS)
-        return ordered;
-      dbg(`turn_end: ${label} test target list held ${ordered.length} entries, bounded to the newest ${TEST_RUNNER_MAX_PERSISTED_TARGETS} (oldest foreign-session rows dropped)`);
-      return ordered.slice(-TEST_RUNNER_MAX_PERSISTED_TARGETS);
+      const bounded2 = boundDeferredTargets(entries, TEST_RUNNER_MAX_PERSISTED_TARGETS, isThisSession);
+      if (bounded2.length !== entries.length) {
+        dbg(`turn_end: ${label} test target list held ${entries.length} entries, bounded to the newest ${TEST_RUNNER_MAX_PERSISTED_TARGETS} (oldest foreign-session rows dropped)`);
+      }
+      return bounded2;
     };
     const writeTestFindings = (record, ownDeferred) => {
       const live = cacheManager2.readCache("test-runner-findings", cwd)?.data;
@@ -10829,7 +10971,7 @@ ${suffix}`;
     let redispatchedDeferred = 0;
     let retiredThisTurn = 0;
     for (const carried of carriedDeferred) {
-      const testFile = path23.resolve(cwd, carried.testFile);
+      const testFile = path24.resolve(cwd, carried.testFile);
       const carriedKey = normalizeMapKey(testFile);
       if (!isThisSession(carried)) {
         foreignDeferred++;
@@ -10854,9 +10996,9 @@ ${suffix}`;
           incrementDegradationCount({
             kind: "test-runner-batch-capped",
             subject: `${cwd}:deferral-exhausted`,
-            reason: `test target was cut after ${attempts} turn(s) at the turn-end budget and is retired for this session \u2014 too slow for a per-turn batch; run it explicitly (target: ${path23.relative(cwd, testFile)})`
+            reason: `test target was cut after ${attempts} turn(s) at the turn-end budget and is retired for this session \u2014 too slow for a per-turn batch; run it explicitly (target: ${path24.relative(cwd, testFile)})`
           });
-          dbg(`turn_end: retiring deferred test target ${path23.relative(cwd, testFile)} after ${attempts} cut batch(es) \u2014 too slow for the turn-end budget, run it explicitly`);
+          dbg(`turn_end: retiring deferred test target ${path24.relative(cwd, testFile)} after ${attempts} cut batch(es) \u2014 too slow for the turn-end budget, run it explicitly`);
         }
         continue;
       }
@@ -10890,7 +11032,7 @@ ${suffix}`;
         testRoot: carriedRoot,
         deferralAttempts: attempts
       });
-      dbg(`turn_end: re-running deferred test target ${path23.relative(cwd, testFile)} (${carried.runner}) from the previous turn's cut batch`);
+      dbg(`turn_end: re-running deferred test target ${path24.relative(cwd, testFile)} (${carried.runner}) from the previous turn's cut batch`);
     }
     if (deadDeferred > 0) {
       dbg(`turn_end: dropped ${deadDeferred} deferred test target(s) that no longer resolve (missing file, excluded, or unknown runner)`);
@@ -10934,17 +11076,17 @@ ${suffix}`;
         seen.add(targetKey);
         if (retiredKeys.has(targetKey)) {
           retiredSkips++;
-          dbg(`turn_end: ${display} \u2192 test target retired earlier this session (outran the turn-end batch budget), skipping spawn (${path23.relative(cwd, target.testFile)})`);
+          dbg(`turn_end: ${display} \u2192 test target retired earlier this session (outran the turn-end batch budget), skipping spawn (${path24.relative(cwd, target.testFile)})`);
           continue;
         }
         if (isExcludedTestTarget(target.testFile, testRoot)) {
           excludedTargets++;
-          dbg(`turn_end: ${display} \u2192 test target excluded by the built-in turn-end policy, skipping spawn (${path23.relative(cwd, target.testFile)})`);
+          dbg(`turn_end: ${display} \u2192 test target excluded by the built-in turn-end policy, skipping spawn (${path24.relative(cwd, target.testFile)})`);
           continue;
         }
         if (!fs17.existsSync(target.testFile)) {
           missingTargetFiles++;
-          dbg(`turn_end: ${display} \u2192 test file missing, skipping spawn (${path23.relative(cwd, target.testFile)})`);
+          dbg(`turn_end: ${display} \u2192 test file missing, skipping spawn (${path24.relative(cwd, target.testFile)})`);
           continue;
         }
         if (targets.length >= TEST_RUNNER_MAX_TARGETS) {
@@ -10952,7 +11094,7 @@ ${suffix}`;
           continue;
         }
         targets.push({ ...target, sourceFile: abs, testRoot });
-        dbg(`turn_end: ${display} \u2192 test ${target.runner} ${path23.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
+        dbg(`turn_end: ${display} \u2192 test ${target.runner} ${path24.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
       } else if (!target) {
         noTestFile++;
         dbg(`turn_end: ${display} \u2192 no test file found${isNeighbor ? " (cascade-neighbor)" : ""}`);
@@ -11084,6 +11226,7 @@ ${suffix}`;
             {
               file: result.value.file,
               sourceFile: target.sourceFile,
+              runner: target.runner,
               fileSeq: target.fileSeqAtRun === void 0 ? {
                 state: "unknown",
                 reason: "sequence-unavailable"
@@ -11115,7 +11258,7 @@ ${suffix}`;
           });
           dbg(`turn_end: test batch stopped early (${stopReason ?? "incomplete"}), ${deferred.length} target(s) deferred to the next turn`);
         }
-        const deferralNote = deferred.length > 0 ? `${deferred.length} test target(s) did not finish within the turn-end batch budget and are deferred to the next turn (they run first): ${deferredTargets.map((t) => path23.relative(cwd, t.testFile)).join(", ")}` : "";
+        const deferralNote = deferred.length > 0 ? `${deferred.length} test target(s) did not finish within the turn-end batch budget and are deferred to the next turn (they run first): ${deferredTargets.map((t) => path24.relative(cwd, t.testFile)).join(", ")}` : "";
         const supersededByNewerGeneration = (label) => {
           const current = cacheManager2.readCache("test-runner-findings", cwd)?.data;
           const currentGeneration = current?.testRunGeneration;
@@ -11167,7 +11310,7 @@ ${suffix}`;
           const { file, runner, passed, failed, duration, error } = r.value;
           if (failed > 0)
             hasRealFailure = true;
-          const shortFile = path23.basename(file);
+          const shortFile = path24.basename(file);
           const elapsed = formatRunDurationMs(duration);
           const verdict = failed > 0 ? "FAIL" : "PASS";
           const summary = isRunnerErrorResult(r.value) ? passed > 0 ? `error: ${error} (${passed} passed before)` : `error: ${error}` : `${verdict} ${passed}p/${failed}f (${elapsed})`;
@@ -11331,8 +11474,8 @@ ${suffix}`;
     } else {
       const callGraphStart = Date.now();
       try {
-        const { impact, formatImpact, parseSymbolKey } = await import("../chunk-GAYGGICG.js");
-        const { callGraphImpactToProjectDiagnostics } = await import("../chunk-VPWKF3GN.js");
+        const { impact, formatImpact, parseSymbolKey } = await import("../chunk-BKE7E7TC.js");
+        const { callGraphImpactToProjectDiagnostics } = await import("../chunk-6GFRNVYR.js");
         const impactLines = [];
         let callGraphDispositionSuppressed = 0;
         const impactFindings = [];
@@ -11639,13 +11782,17 @@ ${impactLines.join("\n")}`;
       }
     });
   }
-  cacheManager2.incrementTurnCycle(cwd, currentOwner);
+  cacheManager2.incrementTurnCycle(cwd, currentOwner, turnStateSessionId);
   const lateAuxStart = Date.now();
-  const { drainedPairs, lateAuxCapEvicted } = holdScope.guardedWrite("turn-end:late-aux", () => ({
+  const lateAuxDrain = isSecondarySession ? {
+    drainedPairs: drainPendingAuxiliaryCoverage(),
+    lateAuxCapEvicted: drainPendingAuxCapEvictedCount()
+  } : holdScope.guardedWrite("turn-end:late-aux", () => ({
     drainedPairs: drainPendingAuxiliaryCoverage(),
     lateAuxCapEvicted: drainPendingAuxCapEvictedCount()
   })) ?? { drainedPairs: [], lateAuxCapEvicted: 0 };
-  const rearmLateAux = (pair) => holdScope.guardedWrite(
+  const { drainedPairs, lateAuxCapEvicted } = lateAuxDrain;
+  const rearmLateAux = (pair) => isSecondarySession ? (rearmPendingAuxiliaryCoverage(pair), true) : holdScope.guardedWrite(
     // One subject for the store (#4168 F3): the row's count carries how many.
     "turn-end:late-aux-rearm",
     () => {
@@ -11925,7 +12072,7 @@ ${lines.join("\n")}`;
       }
     });
   }
-  const unresolvedKeys = new Set(unresolvedBlockers.map((record) => normalizeMapKey(path23.resolve(record.filePath))));
+  const unresolvedKeys = new Set(unresolvedBlockers.map((record) => normalizeMapKey(path24.resolve(record.filePath))));
   const formatResolvedTail = (dropped) => `\u2026 and ${dropped} more`;
   const resolvedTailMax = formatResolvedTail(Number.MAX_SAFE_INTEGER).length;
   const resolvedShareChars = Math.floor(RUNTIME_CONFIG.turnEnd.maxChars * RESOLVED_SHARE_OF_CHARS) - resolvedTailMax;
@@ -11950,7 +12097,7 @@ ${lines.join("\n")}`;
   let resolvedChars = 0;
   let resolvedCount = 0;
   const { files: resolvedBlockerFileList, dropped: resolvedBlockerFilesDropped } = runtime.consumeResolvedBlockerFiles((entry) => {
-    if (unresolvedKeys.has(normalizeMapKey(path23.resolve(entry.filePath))))
+    if (unresolvedKeys.has(normalizeMapKey(path24.resolve(entry.filePath))))
       return true;
     const cost = formatResolvedLine(entry).length + 1;
     if (resolvedCount > 0 && (resolvedCount >= resolvedLineBudget || resolvedChars + cost > resolvedCharBudget))
@@ -12046,7 +12193,7 @@ ${raw}`
             projectSeqStart: runtime.turnStartProjectSeq,
             projectSeqEnd: runtime.projectSeq,
             fileSeqByPath: Object.fromEntries(runtime.getFileSeqEntries().map(([filePath, seq]) => [
-              normalizeMapKey(path23.resolve(filePath)),
+              normalizeMapKey(path24.resolve(filePath)),
               seq
             ])),
             fileContentHashes: {},
@@ -12063,7 +12210,7 @@ ${raw}`
     settleHolds(false);
     const fileSeqByPath2 = {};
     for (const [filePath, seq] of runtime.getFileSeqEntries()) {
-      fileSeqByPath2[normalizeMapKey(path23.resolve(filePath))] = seq;
+      fileSeqByPath2[normalizeMapKey(path24.resolve(filePath))] = seq;
     }
     if (getFlag("lens-guard")) {
       const existingGuard = cacheManager2.readCache("turn-end-findings", cwd)?.data;
@@ -12281,10 +12428,10 @@ var TurnEndQueue = class {
     if (this.pending.length >= 1) {
       return Promise.reject(new Error("turn_end queue is busy"));
     }
-    return new Promise((resolve31, reject) => {
+    return new Promise((resolve32, reject) => {
       const item = {
         work,
-        resolve: resolve31,
+        resolve: resolve32,
         reject,
         timer: setTimeout(() => {
           const index = this.pending.indexOf(item);
@@ -12328,7 +12475,7 @@ async function runTurnEndNowImpl(cwd, files = [], deferredDelivery = false) {
   const host = createMcpHost(void 0, cwd);
   let registered = 0;
   for (const file of files) {
-    const abs = path24.isAbsolute(file) ? file : path24.resolve(cwd, file);
+    const abs = path25.isAbsolute(file) ? file : path25.resolve(cwd, file);
     let lineCount3 = 1;
     try {
       lineCount3 = fs18.readFileSync(abs, "utf8").split("\n").length;
@@ -12472,7 +12619,7 @@ function acknowledgeTurnEnd(cwd, deliveryId) {
 
 // dist/clients/module-report.js
 import * as fs19 from "node:fs";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 
 // dist/clients/middle-man-analysis.js
 var SELF_TOKEN = {
@@ -13021,7 +13168,7 @@ function blastReadArgs(graph, normalizedFile) {
   return { path: normalizedFile, offset: 1, limit };
 }
 async function computeBlastRadius(graph, normalizedPath, projectRoot, maxDepth) {
-  const { computeTransitiveImpact } = await import("../chunk-PCHDGUKT.js");
+  const { computeTransitiveImpact } = await import("../chunk-4UNXBNE2.js");
   const result = computeTransitiveImpact(graph, normalizedPath, { maxDepth });
   const byFile = /* @__PURE__ */ new Map();
   for (const hit of result.hits) {
@@ -13611,7 +13758,7 @@ async function moduleReport(file, cwd, options) {
   const startedAt = Date.now();
   const maxRefs = normalizeMaxRefsPerSymbol(options?.maxRefsPerSymbol);
   const maxCallGraphEntries = Math.min(CALL_GRAPH_MAX_ENTRY_CAP, Math.max(1, Math.floor(options?.maxCallGraphEntries ?? CALL_GRAPH_DEFAULT_ENTRY_CAP)));
-  const absPath = path25.resolve(cwd, file);
+  const absPath = path26.resolve(cwd, file);
   const normalizedPath = normalizeMapKey(absPath);
   let content;
   try {
@@ -13638,7 +13785,7 @@ async function moduleReport(file, cwd, options) {
   let callGraphIdentity;
   let revisionDriftNote;
   try {
-    const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, getReviewGraphRevisionDrift, formatReviewGraphRevisionDriftNote: formatReviewGraphRevisionDriftNote2 } = await import("../chunk-3TTPKMEF.js");
+    const { getCachedReviewGraph, getReviewGraphCacheIdentity, getReviewGraphSizeSkipVerdict, getReviewGraphRevisionDrift, formatReviewGraphRevisionDriftNote: formatReviewGraphRevisionDriftNote2 } = await import("../chunk-2VUQMUMT.js");
     graph = getCachedReviewGraph(cwd);
     graphFileCap = getReviewGraphSizeSkipVerdict(cwd)?.maxFileCount;
     const drift = graph ? getReviewGraphRevisionDrift(cwd) : void 0;
@@ -13928,7 +14075,7 @@ function suggestSimilarNames(candidates, target) {
 async function readSymbol(file, symbolName, cwd, options = {}) {
   const { kind: symbolKindFilter } = options;
   const startedAt = Date.now();
-  const absPath = path25.resolve(cwd, file);
+  const absPath = path26.resolve(cwd, file);
   const log = (found) => {
     logLatency({
       type: "phase",
@@ -14103,7 +14250,7 @@ function enclosingOutline(selected, symbols, callbacks, filters, filePath) {
 }
 async function readEnclosing(file, line, cwd, options) {
   const startedAt = Date.now();
-  const absPath = path25.resolve(cwd, file);
+  const absPath = path26.resolve(cwd, file);
   const targetLine = Math.max(1, Math.floor(line));
   const log = (found) => {
     logLatency({
@@ -14279,7 +14426,7 @@ async function readEnclosing(file, line, cwd, options) {
 }
 
 // dist/clients/project-report.js
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 var DEFAULT_LIMIT = 10;
 var STALE_THRESHOLD_MS = 15 * 6e4;
 var LOW_COVERAGE_THRESHOLD = 0.8;
@@ -14422,7 +14569,7 @@ function roleFor(graph, filePath) {
   return top.length > 0 ? top.map((s) => s.name).join(", ") : void 0;
 }
 async function computeHubs(graph, degrees, cwd, limit, focusTerms) {
-  const { computeTransitiveImpact } = await import("../chunk-PCHDGUKT.js");
+  const { computeTransitiveImpact } = await import("../chunk-4UNXBNE2.js");
   const ranked = [...graph.fileNodes.entries()].map(([filePath, fileNodeId]) => ({
     filePath,
     fileNodeId,
@@ -14660,7 +14807,7 @@ function computeDeadWeight(graph, degrees, entryPointFiles, cwd, limit) {
 }
 var inFlightGraphBuilds = /* @__PURE__ */ new Set();
 function triggerBackgroundGraphBuild(cwd, deps) {
-  const key = normalizeMapKey(path26.resolve(cwd));
+  const key = normalizeMapKey(path27.resolve(cwd));
   if (inFlightGraphBuilds.has(key))
     return "already_running";
   const deduped = deps.isGraphBuildInFlight(key, []);
@@ -14674,7 +14821,7 @@ async function projectReport(cwd, options) {
   const limit = clampLimit(options?.limit);
   const focusTerms = normalizeFocus2(options?.focus);
   const view = options?.view;
-  const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, buildOrUpdateGraph, isGraphBuildInFlight, getReviewGraphRevisionDrift } = await import("../chunk-3TTPKMEF.js");
+  const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, buildOrUpdateGraph, isGraphBuildInFlight, getReviewGraphRevisionDrift } = await import("../chunk-2VUQMUMT.js");
   let graph;
   try {
     graph = getCachedReviewGraph(cwd);
@@ -14698,7 +14845,7 @@ async function projectReport(cwd, options) {
       };
     }
     const previousAttempt = getLastReviewGraphBuildAttempt(cwd);
-    const { FactStore: FactStore2 } = await import("../chunk-CULQYFLU.js");
+    const { FactStore: FactStore2 } = await import("../chunk-QGQ5CCCG.js");
     const trigger = triggerBackgroundGraphBuild(cwd, {
       buildOrUpdateGraph,
       isGraphBuildInFlight,
@@ -14800,7 +14947,7 @@ function renderCompactProjectReport(report) {
 
 // dist/clients/effective-config.js
 import * as os3 from "node:os";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 function isEffectiveFileViewError(file) {
   return "error" in file;
 }
@@ -14874,10 +15021,10 @@ async function effectiveConfig(options = {}) {
     globalConfigPath: getPiLensGlobalConfigPath(),
     homeDir
   });
-  const requestedFile = options.file === void 0 ? void 0 : path27.resolve(cwd, options.file);
+  const requestedFile = options.file === void 0 ? void 0 : path28.resolve(cwd, options.file);
   const fileOutsideCwd = requestedFile !== void 0 && !isSameOrWithin(cwd, requestedFile);
   const absolute = fileOutsideCwd ? void 0 : requestedFile;
-  const resolution = resolveAt(absolute === void 0 ? cwd : path27.dirname(absolute));
+  const resolution = resolveAt(absolute === void 0 ? cwd : path28.dirname(absolute));
   const resolved = {
     value: resolution.value,
     provenance: resolution.provenance
@@ -14911,7 +15058,7 @@ async function effectiveConfig(options = {}) {
         // `{ absolute, lspConfig }` struct (#2520): `absolute` is already
         // this branch's narrowed local, so the struct's own field was
         // carrying the same fact twice.
-        registerLSPConfig(lspConfigOf(resolution.value))
+        registerLSPConfig(lspConfigOf(resolution.value, void 0, resolution.provenance))
       )
     }
   };
@@ -15039,10 +15186,10 @@ function symbolSearchFileMatchesLang(file, lang) {
   const exts = extensionsForLanguageToken(lang);
   if (exts.length === 0)
     return false;
-  return exts.includes(path28.extname(file).toLowerCase());
+  return exts.includes(path29.extname(file).toLowerCase());
 }
 function fileMatchesPathGlobs(file, cwd, globs) {
-  const rel = path28.relative(cwd, file).split(path28.sep).join("/");
+  const rel = path29.relative(cwd, file).split(path29.sep).join("/");
   const options = { dot: true, nocase: process.platform === "win32" };
   return globs.some((raw) => {
     const pattern = raw.split("\\").join("/");
@@ -15064,7 +15211,7 @@ function buildSymbolSearchFileFilter(cwd, options) {
 }
 function annotateSymbolSearchHitsWithGraph(hits, centrality, graph) {
   for (const hit of hits) {
-    const normalized = normalizeMapKey(path28.resolve(hit.file));
+    const normalized = normalizeMapKey(path29.resolve(hit.file));
     const fanIn = centrality.get(hit.file) ?? 0;
     let complexity;
     for (const symbolId of graph.symbolNodesByFile.get(normalized) ?? []) {
@@ -15110,14 +15257,14 @@ async function symbolSearch(query, cwd, limit = 20, options = {}) {
   let centrality;
   let results;
   try {
-    centrality = centralityFromReverseDeps(index, snapshot?.reverseDeps, (file) => normalizeMapKey(path28.resolve(file)));
+    centrality = centralityFromReverseDeps(index, snapshot?.reverseDeps, (file) => normalizeMapKey(path29.resolve(file)));
     const fileFilter = buildSymbolSearchFileFilter(cwd, options);
     results = searchWordIndex(index, query, { limit, centrality, fileFilter });
   } finally {
     warmLease.release();
   }
   const hits = results.map(toSymbolSearchHit);
-  const { getCachedReviewGraph } = await import("../chunk-3TTPKMEF.js");
+  const { getCachedReviewGraph } = await import("../chunk-2VUQMUMT.js");
   const graph = getCachedReviewGraph(cwd);
   if (graph)
     annotateSymbolSearchHitsWithGraph(hits, centrality, graph);
@@ -15134,10 +15281,10 @@ async function symbolSearch(query, cwd, limit = 20, options = {}) {
 import { Type } from "typebox";
 
 // dist/clients/ast-grep-tool-logger.js
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 var AG_LOG_DIR = getGlobalPiLensLogDir();
-var AG_LOG_FILE = path29.join(AG_LOG_DIR, "ast-grep-tools.log");
-var AG_LOG_BACKUP_FILE = path29.join(AG_LOG_DIR, "ast-grep-tools.log.1");
+var AG_LOG_FILE = path30.join(AG_LOG_DIR, "ast-grep-tools.log");
+var AG_LOG_BACKUP_FILE = path30.join(AG_LOG_DIR, "ast-grep-tools.log.1");
 var MAX_LOG_BYTES3 = Math.max(128 * 1024, Number.parseInt(process.env.PI_LENS_AST_GREP_LOG_MAX_BYTES ?? "1048576", 10) || 1048576);
 var writer3 = createNdjsonLogger({
   filePath: AG_LOG_FILE,
@@ -15314,6 +15461,11 @@ function canonicalLanguage(lang) {
 }
 
 // dist/tools/shared.js
+function resolveAstGrepPaths(paths, cwd) {
+  const base = cwd || ".";
+  const requested = paths?.length ? paths : [base];
+  return requested.map((p) => resolveHostToolPath(p, base));
+}
 var LANGUAGES = [
   "bash",
   "c",
@@ -15450,7 +15602,7 @@ function createAstGrepReplaceTool(astGrepClient2, captureLineage) {
           details: {}
         };
       }
-      const searchPaths = paths?.length ? paths : [ctx.cwd || "."];
+      const searchPaths = resolveAstGrepPaths(paths, ctx.cwd);
       if (hasStructuralIntent({
         insideKind,
         hasKind,
@@ -16070,7 +16222,7 @@ function createAstGrepSearchTool(astGrepClient2) {
             details: {}
           };
         }
-        const searchPaths = paths?.length ? paths : [ctx.cwd || "."];
+        const searchPaths = resolveAstGrepPaths(paths, ctx.cwd);
         const PAGE_SIZE = Math.max(1, Math.min(MAX_PAGE_SIZE, Number.isFinite(maxMatches) ? Math.floor(maxMatches) : DEFAULT_PAGE_SIZE));
         let effectiveRule = hasRawRule ? rawRule : void 0;
         if (!effectiveRule && (hasNodeKind || hasStructuralIntent({
@@ -16262,7 +16414,7 @@ ${hint}` : `${output}${paginationNote}`;
 // dist/tools/lens-diagnostics.js
 import { promises as fs23 } from "node:fs";
 import * as fsSync from "node:fs";
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 
 // dist/clients/project-diagnostics/extractors.js
 var WARM_TRIGGER = {
@@ -16322,12 +16474,12 @@ function reasonFromAvailabilityVerdict(tool, verdict) {
 // dist/clients/project-diagnostics/fresh-fetch.js
 import * as fs21 from "node:fs";
 import * as os4 from "node:os";
-import * as path34 from "node:path";
+import * as path35 from "node:path";
 
 // dist/clients/project-diagnostics/runner-adapters/jscpd.js
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 function resolveClonePath(cwd, file) {
-  return path30.isAbsolute(file) ? file : path30.resolve(cwd, file);
+  return path31.isAbsolute(file) ? file : path31.resolve(cwd, file);
 }
 function jscpdCloneToProjectDiagnostics(cwd, clone) {
   const a = resolveClonePath(cwd, clone.fileA);
@@ -16340,7 +16492,7 @@ function jscpdCloneToProjectDiagnostics(cwd, clone) {
     tool: "jscpd",
     runner: "jscpd",
     rule: "jscpd:duplicate",
-    message: `Duplicate code (${clone.lines} lines) \u2014 also at ${path30.relative(cwd, otherFile)}:${otherLine}`,
+    message: `Duplicate code (${clone.lines} lines) \u2014 also at ${path31.relative(cwd, otherFile)}:${otherLine}`,
     source: "project-scan"
   });
   return [
@@ -16355,16 +16507,16 @@ function jscpdResultToProjectDiagnostics(cwd, result) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/madge.js
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 function resolveCyclePath(cwd, file) {
-  return path31.isAbsolute(file) ? file : path31.resolve(cwd, file);
+  return path32.isAbsolute(file) ? file : path32.resolve(cwd, file);
 }
 function cycleMembers(dep) {
   return dep.path.length > 0 ? dep.path : [dep.file];
 }
 function circularDepToProjectDiagnostics(cwd, dep) {
   const members = cycleMembers(dep);
-  const rendered = `${members.map((f) => path31.basename(f)).join(" \u2192 ")} \u2192 ${path31.basename(members[0] ?? "")}`;
+  const rendered = `${members.map((f) => path32.basename(f)).join(" \u2192 ")} \u2192 ${path32.basename(members[0] ?? "")}`;
   return members.map((file) => ({
     filePath: resolveCyclePath(cwd, file),
     severity: "warning",
@@ -16390,7 +16542,7 @@ function circularDepsToProjectDiagnostics(cwd, circular) {
 }
 
 // dist/clients/project-diagnostics/runner-adapters/opengrep.js
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 function severityFor(raw) {
   switch (raw.toUpperCase()) {
     case "ERROR":
@@ -16405,7 +16557,7 @@ function opengrepFindingToProjectDiagnostic(cwd, finding) {
   const { severity, blocking } = severityFor(finding.severity);
   const cweSuffix = finding.cwe?.length ? ` (${finding.cwe[0]})` : "";
   return {
-    filePath: path32.isAbsolute(finding.path) ? finding.path : path32.resolve(cwd, finding.path),
+    filePath: path33.isAbsolute(finding.path) ? finding.path : path33.resolve(cwd, finding.path),
     line: finding.startLine,
     column: finding.startCol,
     severity,
@@ -16425,7 +16577,7 @@ function opengrepResultToProjectDiagnostics(cwd, result) {
 
 // dist/clients/project-diagnostics/runner-adapters/runner-findings.js
 import * as fs20 from "node:fs";
-import * as path33 from "node:path";
+import * as path34 from "node:path";
 function failureMessage(failure) {
   const firstLine2 = failure.message.split("\n")[0]?.slice(0, 300) ?? "";
   return firstLine2 ? `${failure.name}: ${firstLine2}` : failure.name;
@@ -16491,7 +16643,7 @@ function testRunnerFindingsToProjectDiagnostics(cache, cwd, runtime) {
     return [];
   const validation = cwd ? validateAdvisoryProvenance(cache, cwd, runtime) : { status: "unknown", reasons: ["validation-context-missing"] };
   const root = cwd ?? process.cwd();
-  const missingKeys = new Set((cache.provenance?.files ?? []).filter((file) => !fs20.existsSync(path33.resolve(root, file.path))).map((file) => advisoryPathKey(file.path, root)));
+  const missingKeys = new Set((cache.provenance?.files ?? []).filter((file) => !fs20.existsSync(path34.resolve(root, file.path))).map((file) => advisoryPathKey(file.path, root)));
   const historical = cache.superseded === true || cache.stale === true || validation.status !== "current";
   return cache.results.filter((result) => !missingKeys.has(advisoryPathKey(result.file, root))).flatMap((result) => testResultToProjectDiagnostics(result, historical)).map((diagnostic) => historical ? {
     ...diagnostic,
@@ -16521,7 +16673,7 @@ function laneObservedAtMs(scannedAt, startedAtMs) {
   return parseScannedAtMs(scannedAt) ?? startedAtMs;
 }
 async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal, options = {}) {
-  const requestedRoot = options.analysisRoot === void 0 ? cwd : path34.resolve(cwd, options.analysisRoot);
+  const requestedRoot = options.analysisRoot === void 0 ? cwd : path35.resolve(cwd, options.analysisRoot);
   let analysisRoot;
   let analysisRootValidation;
   if (options.analysisRoot !== void 0) {
@@ -16688,7 +16840,7 @@ async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal,
         markCold("jscpd", reasonFromAvailabilityVerdict("jscpd", clients.jscpdClient.getAvailabilityVerdict?.()));
         return;
       }
-      const isTsProject = fs21.existsSync(path34.join(analysisRoot, "tsconfig.json"));
+      const isTsProject = fs21.existsSync(path35.join(analysisRoot, "tsconfig.json"));
       const scannerKey = isTsProject ? "jscpd-ts" : "jscpd";
       const startMs = Date.now();
       const result = await clients.jscpdClient.scan(analysisRoot, void 0, void 0, isTsProject);
@@ -16919,12 +17071,12 @@ async function fetchFreshProjectDiagnostics(cacheManager2, cwd, clients, signal,
   const allSettled = Promise.all(tasks).then(() => "completed").catch(() => "completed");
   const outcome = signal ? await Promise.race([
     allSettled,
-    new Promise((resolve31) => {
+    new Promise((resolve32) => {
       if (signal.aborted) {
-        resolve31("aborted");
+        resolve32("aborted");
         return;
       }
-      signal.addEventListener("abort", () => resolve31("aborted"), {
+      signal.addEventListener("abort", () => resolve32("aborted"), {
         once: true
       });
     })
@@ -17005,7 +17157,7 @@ function makeProgressReporter(onUpdate, label, throttleMs = 250) {
 
 // dist/tools/lsp-diagnostics.js
 import * as fs22 from "node:fs";
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 var MAX_FILES = 100;
 var MAX_BATCH_FILES = 100;
 var MAX_DIAGNOSTICS = 200;
@@ -17088,11 +17240,11 @@ async function collectFiles(dir, extensions, maxFiles, isIgnored = () => false)
         return;
       if (entry.isSymbolicLink())
         continue;
-      const full = path35.join(current, entry.name);
+      const full = path36.join(current, entry.name);
       if (entry.isDirectory()) {
         if (!isExcludedDirName(entry.name) && !isIgnored(full, true))
           await walk(full);
-      } else if (entry.isFile() && extensions.includes(path35.extname(full))) {
+      } else if (entry.isFile() && extensions.includes(path36.extname(full))) {
         if (isIgnored(full, false))
           continue;
         files.push(full);
@@ -17186,7 +17338,7 @@ function createLspDiagnosticsTool(nextWriteIndex, onConfirmedNoBlockers, getServ
           details: {}
         };
       }
-      const absPath = normalizeMapKey(path35.resolve(cwd, rawPath));
+      const absPath = normalizeMapKey(path36.resolve(cwd, rawPath));
       let stat;
       try {
         stat = fs22.statSync(absPath);
@@ -17843,12 +17995,12 @@ async function collectBatchDiagnostics(files, severity, lspService, options) {
       });
       const result = options.signal ? await Promise.race([
         bounded2,
-        new Promise((resolve31) => {
+        new Promise((resolve32) => {
           if (options.signal?.aborted) {
-            resolve31(void 0);
+            resolve32(void 0);
             return;
           }
-          options.signal?.addEventListener("abort", () => resolve31(void 0), {
+          options.signal?.addEventListener("abort", () => resolve32(void 0), {
             once: true
           });
         })
@@ -17907,7 +18059,7 @@ async function expandPathsToFiles(cwd, rawPaths) {
   const directories = [];
   const seenFileKeys = /* @__PURE__ */ new Set();
   for (const entry of rawPaths) {
-    const abs = normalizeMapKey(path35.resolve(cwd, entry));
+    const abs = normalizeMapKey(path36.resolve(cwd, entry));
     let stat;
     try {
       stat = fs22.statSync(abs);
@@ -18111,7 +18263,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
     outcome: result.outcome,
     reason: result.tooLargeReason ?? result.inconclusiveReason ?? result.error ?? result.unavailable
   }));
-  const tooLargeLines = renderBatchOutcomeLines(outcomeDetails, (file) => path35.relative(absPath, file));
+  const tooLargeLines = renderBatchOutcomeLines(outcomeDetails, (file) => path36.relative(absPath, file));
   let text;
   if (total === 0) {
     const cleanLine = unconfirmed > 0 ? `${clean} clean \xB7 ${unconfirmed} unconfirmed: ${unconfirmedReasonClause(unconfirmed, timedOut, rootFallbackReasons)} NOT the same as 0 diagnostics.` : "No diagnostics found.";
@@ -18143,7 +18295,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
     ];
     const toRelative = (d) => ({
       ...d,
-      file: path35.relative(absPath, d.file)
+      file: path36.relative(absPath, d.file)
     });
     if (primaryDisplay.length > 0) {
       lines.push(`Primary findings (${primaryDisplay.length}):`);
@@ -18174,7 +18326,7 @@ async function runDirectoryDiagnostics(absPath, severity, lspService, options) {
       filesScanned: filesToProcess.length,
       capped: wasCapped,
       diagnostics: display.map((d) => ({
-        file: path35.relative(absPath, d.file),
+        file: path36.relative(absPath, d.file),
         line: d.line,
         character: d.character,
         severity: d.severity,
@@ -18265,7 +18417,7 @@ async function findFullScanBindingMismatches(results) {
     sinceYield += 1;
     if (sinceYield >= FULL_SCAN_BINDING_YIELD_EVERY) {
       sinceYield = 0;
-      await new Promise((resolve31) => setImmediate(resolve31));
+      await new Promise((resolve32) => setImmediate(resolve32));
     }
   }
   return mismatched;
@@ -18304,7 +18456,7 @@ function createLensDiagnosticsTool(cacheManager2, getCwd, getLspService = getLSP
         const files2 = details.filesChecked ?? details.filesScanned ?? 0;
         const noun = count === 1 ? "diagnostic" : "diagnostics";
         const filePath = typeof details?.filePath === "string" ? details.filePath : Array.isArray(args?.paths) && args.paths.length === 1 && typeof args.paths[0] === "string" ? args.paths[0] : void 0;
-        const singleFile = (details?.mode === "file" || files2 === 1) && typeof filePath === "string" ? ` ${path36.basename(filePath)}` : "";
+        const singleFile = (details?.mode === "file" || files2 === 1) && typeof filePath === "string" ? ` ${path37.basename(filePath)}` : "";
         const scope = files2 > 1 ? ` across ${files2} files` : singleFile;
         if (isError)
           return `lens_diagnostics lsp \u2014 ${text.split("\n")[0] ?? "error"}`;
@@ -18550,7 +18702,7 @@ function appendProjectDiagnosticsDeltaLines(groups, cwd, report, severity, inclu
   const diagnostics = [...gated.live, ...gated.stale];
   const byFile = /* @__PURE__ */ new Map();
   for (const diagnostic of diagnostics) {
-    const filePath = path36.resolve(diagnostic.filePath);
+    const filePath = path37.resolve(diagnostic.filePath);
     const bucket = byFile.get(filePath) ?? [];
     bucket.push(diagnostic);
     byFile.set(filePath, bucket);
@@ -18610,7 +18762,10 @@ function filterDeltaReportDispositions(report, cwd, policyMap) {
   if (!report?.diagnostics.length)
     return report;
   const kept = report.diagnostics.filter((d) => applyCachedDispositions([projectDiagnosticToWidget(d, d.filePath)], cwd, d.filePath).length === 1);
-  const policyKept = applyRulePolicy(kept, policyMap);
+  const policyKept = applyRulePolicy(kept, policyMap, {
+    root: cwd,
+    filePath: cwd
+  });
   if (policyKept.length === report.diagnostics.length)
     return report;
   return { ...report, diagnostics: policyKept };
@@ -18674,7 +18829,7 @@ function applyDeltaFreshnessGate(files, cwd, generatedAt) {
   })).filter((file) => file.warnings.length > 0);
 }
 function getDeltaFileGroup(groups, cwd, filePath) {
-  const rel = path36.relative(cwd, filePath);
+  const rel = path37.relative(cwd, filePath);
   let group = groups.get(rel);
   if (!group) {
     group = {
@@ -18702,7 +18857,7 @@ function formatDeltaMode(cacheManager2, cwd, severity, pathsScope) {
     // #2504 r4 (F1): carried through, so a merged report's older
     // entries keep their own age all the way to the freshness gate.
     generatedAt: file.generatedAt,
-    warnings: applyRulePolicy(applyCachedDispositions(file.warnings ?? [], cwd, file.filePath), policyMap)
+    warnings: applyRulePolicy(applyCachedDispositions(file.warnings ?? [], cwd, file.filePath), policyMap, { root: cwd, filePath: file.filePath })
   })).filter((file) => file.warnings.length > 0);
   const actionableFiles = applyDeltaFreshnessGate(visibleWarningFiles(actionable?.files), cwd, actionable?.generatedAt);
   const qualityFiles = applyDeltaFreshnessGate(visibleWarningFiles(quality?.files), cwd, quality?.generatedAt);
@@ -18771,7 +18926,7 @@ function formatDeltaMode(cacheManager2, cwd, severity, pathsScope) {
     let text = `No ${severity === "all" ? "" : severity + " "}issues in the current turn delta.`;
     const carried = getFileDiagnosticSummaries().filter((f) => includeFile(f.filePath)).map((f) => ({
       ...f,
-      diagnostics: applyRulePolicy(applyCachedDispositions(f.diagnostics, cwd, f.filePath), policyMap)
+      diagnostics: applyRulePolicy(applyCachedDispositions(f.diagnostics, cwd, f.filePath), policyMap, { root: cwd, filePath: f.filePath })
     })).filter((f) => f.diagnostics.length > 0);
     const carriedIssues = carried.reduce((n, f) => n + f.diagnostics.length, 0);
     if (carried.length > 0) {
@@ -18798,7 +18953,7 @@ Summary (turn delta): ${aw} actionable warning${aw === 1 ? "" : "s"} \xB7 ${cq}
 function createCurrentIgnoreFilter(cwd) {
   try {
     const matcher = getProjectIgnoreMatcher(cwd);
-    return (filePath) => !matcher.isIgnored(path36.resolve(filePath), false);
+    return (filePath) => !matcher.isIgnored(path37.resolve(filePath), false);
   } catch {
     return () => true;
   }
@@ -18809,7 +18964,7 @@ function resolvePathsScope(cwd, rawPaths) {
   if (rawPaths.length > MAX_PATHS_ENTRIES) {
     throw new Error(`paths has ${rawPaths.length} entries, over the ${MAX_PATHS_ENTRIES} cap. Narrow the list or omit paths to scan without a restriction.`);
   }
-  const entries = rawPaths.filter((entry) => typeof entry === "string" && entry.trim().length > 0).map((entry) => path36.resolve(path36.isAbsolute(entry) ? entry : path36.resolve(cwd, entry)));
+  const entries = rawPaths.filter((entry) => typeof entry === "string" && entry.trim().length > 0).map((entry) => path37.resolve(path37.isAbsolute(entry) ? entry : path37.resolve(cwd, entry)));
   const missing = [];
   const fileEntries = [];
   const existingEntries = [];
@@ -18832,9 +18987,9 @@ function resolvePathsScope(cwd, rawPaths) {
   }
   const fileKeys = new Set(fileEntries.map((f) => normalizeFilePath(f)));
   const dirPrefixes = dirEntries.map((d) => normalizeFilePath(d));
-  const includeExplicitFile = (filePath) => fileKeys.has(normalizeFilePath(path36.resolve(filePath)));
+  const includeExplicitFile = (filePath) => fileKeys.has(normalizeFilePath(path37.resolve(filePath)));
   const includeFile = (filePath) => {
-    const key = normalizeFilePath(path36.resolve(filePath));
+    const key = normalizeFilePath(path37.resolve(filePath));
     if (fileKeys.has(key))
       return true;
     return dirPrefixes.some((prefix) => key === prefix || key.startsWith(`${prefix}/`));
@@ -18855,7 +19010,7 @@ function pathsScopeCacheOnlyNote(scope) {
 function pathsScopeMissingNote(scope) {
   if (!scope || scope.missing.length === 0)
     return "";
-  const shown2 = scope.missing.slice(0, 10).map((p) => path36.basename(p));
+  const shown2 = scope.missing.slice(0, 10).map((p) => path37.basename(p));
   const more = scope.missing.length > shown2.length ? ` (+${scope.missing.length - shown2.length} more)` : "";
   return `
 
@@ -18887,12 +19042,15 @@ function filterProjectDiagnosticsDeltaReport(report, includeFile) {
     diagnostics: report.diagnostics.filter((d) => includeFile(d.filePath))
   };
 }
-function applyProjectRulePolicy(value, policyMap) {
+function applyProjectRulePolicy(value, policyMap, root) {
   if (!value)
     return void 0;
   return {
     ...value,
-    diagnostics: applyRulePolicy(value.diagnostics, policyMap)
+    diagnostics: applyRulePolicy(value.diagnostics, policyMap, {
+      root,
+      filePath: value.diagnostics[0]?.filePath ?? root
+    })
   };
 }
 function isErrorLike(d) {
@@ -18983,7 +19141,7 @@ function projectDiagnosticToWidget(diagnostic, filePath) {
 }
 function diagnosticDedupKey(filePath, diagnostic) {
   const ruleId = normalizeRuleId(diagnostic.rule ?? diagnostic.tool ?? "");
-  return [path36.resolve(filePath), diagnostic.line ?? "?", ruleId].join(":");
+  return [path37.resolve(filePath), diagnostic.line ?? "?", ruleId].join(":");
 }
 function runnerIdOf(diagnostic) {
   return diagnostic.tool ?? diagnostic.rule?.split(":", 1)[0] ?? "";
@@ -18997,8 +19155,8 @@ function runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds,
   const realFilePath = realpathOrResolve(filePath);
   for (const entry of coverage) {
     const root = entry.root;
-    const relative9 = path36.relative(root, realFilePath);
-    const underRoot = relative9 === "" || !relative9.startsWith("..") && !path36.isAbsolute(relative9);
+    const relative9 = path37.relative(root, realFilePath);
+    const underRoot = relative9 === "" || !relative9.startsWith("..") && !path37.isAbsolute(relative9);
     if (!underRoot)
       continue;
     if (entry.files.has(realFilePath)) {
@@ -19122,7 +19280,7 @@ function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projec
   const byFile = /* @__PURE__ */ new Map();
   const seen = /* @__PURE__ */ new Set();
   for (const summary of widgetSummaries) {
-    const filePath = path36.resolve(summary.filePath);
+    const filePath = path37.resolve(summary.filePath);
     if (authoritativeLspFiles?.has(filePath))
       continue;
     const retained = summary.diagnostics ?? [];
@@ -19150,7 +19308,7 @@ function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projec
     byFile.set(filePath, summarizeDiagnostics(filePath, diagnostics, existing?.hasFinalSnapshot ?? true));
   };
   for (const result of lspResults) {
-    const filePath = path36.resolve(result.filePath);
+    const filePath = path37.resolve(result.filePath);
     for (const diagnostic of result.diagnostics ?? []) {
       addDiagnostic(filePath, {
         ...lspDiagnosticToWidget(diagnostic),
@@ -19170,12 +19328,12 @@ function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projec
     });
   }
   for (const diagnostic of projectSnapshot?.diagnostics ?? []) {
-    addDiagnostic(path36.resolve(diagnostic.filePath), projectDiagnosticToWidget(diagnostic, diagnostic.filePath));
+    addDiagnostic(path37.resolve(diagnostic.filePath), projectDiagnosticToWidget(diagnostic, diagnostic.filePath));
   }
   for (const diagnostic of deltaDiagnostics) {
     const widget = projectDiagnosticToWidget(diagnostic, diagnostic.filePath);
     const observedAt = widget.observedAt ?? deltaObservedAt;
-    addDiagnostic(path36.resolve(diagnostic.filePath), {
+    addDiagnostic(path37.resolve(diagnostic.filePath), {
       ...widget,
       ...observedAt !== void 0 && { observedAt }
     });
@@ -19190,7 +19348,10 @@ async function applyInlineSuppressionsToSummaries(summaries, cwd, policyMap) {
     try {
       content = await fs23.readFile(summary.filePath, "utf8");
     } catch {
-      const policyKept2 = applyRulePolicy(summary.diagnostics, policyMap);
+      const policyKept2 = applyRulePolicy(summary.diagnostics, policyMap, {
+        root: cwd,
+        filePath: summary.filePath
+      });
       return policyKept2.length === summary.diagnostics.length ? summary : summarizeDiagnostics(summary.filePath, policyKept2, summary.hasFinalSnapshot);
     }
     const { kept: policyKept } = applyFindingPolicy(summary.diagnostics, {
@@ -19375,20 +19536,20 @@ async function formatFullMode(cwd, severity, lspService, cacheManager2, options
         result2.observedAt
       );
       if (retired === true) {
-        authoritativeLspFiles.add(path36.resolve(result2.filePath));
+        authoritativeLspFiles.add(path37.resolve(result2.filePath));
       } else {
-        unreconciledFiles.add(path36.resolve(result2.filePath));
+        unreconciledFiles.add(path37.resolve(result2.filePath));
         recordDegradationOnce({
           kind: "diagnostic-retained-unreconciled",
-          subject: `${path36.resolve(result2.filePath)}:lsp`,
+          subject: `${path37.resolve(result2.filePath)}:lsp`,
           reason: "confirmed diagnostic result could not replace retained widget state"
         });
       }
     } catch {
-      unreconciledFiles.add(path36.resolve(result2.filePath));
+      unreconciledFiles.add(path37.resolve(result2.filePath));
       recordDegradationOnce({
         kind: "diagnostic-retained-unreconciled",
-        subject: `${path36.resolve(result2.filePath)}:lsp`,
+        subject: `${path37.resolve(result2.filePath)}:lsp`,
         reason: "confirmed diagnostic result failed during widget reconciliation"
       });
     }
@@ -19398,9 +19559,9 @@ async function formatFullMode(cwd, severity, lspService, cacheManager2, options
   const authoritativeRunnerIds = new Set(extracted.analyzed ?? []);
   const authoritativeRunnerCoverage = extracted.authoritativeCoverage ?? [];
   const foldedProjectSnapshot = foldExtraDiagnosticsIntoSnapshot(scannedSnapshot, extracted.diagnostics.filter((d) => includeFile(d.filePath)), extracted.runners, cwd);
-  const projectSnapshot = applyProjectRulePolicy(foldedProjectSnapshot, policyMap);
-  const projectDelta = applyProjectRulePolicy(filterProjectDiagnosticsDeltaReport(loadProjectDiagnosticsDeltaReport(cwd), includeFile), policyMap);
-  const authoritativeRetiredCount = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath) && authoritativeLspFiles.has(path36.resolve(summary.filePath)) && (summary.diagnostics?.length ?? 0) > 0).length;
+  const projectSnapshot = applyProjectRulePolicy(foldedProjectSnapshot, policyMap, cwd);
+  const projectDelta = applyProjectRulePolicy(filterProjectDiagnosticsDeltaReport(loadProjectDiagnosticsDeltaReport(cwd), includeFile), policyMap, cwd);
+  const authoritativeRetiredCount = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath) && authoritativeLspFiles.has(path37.resolve(summary.filePath)) && (summary.diagnostics?.length ?? 0) > 0).length;
   if (authoritativeRetiredCount > 0) {
     logLatency({
       type: "phase",
@@ -19455,7 +19616,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager2, options
   }
   let summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage), cwd, policyMap);
   if (unreconciledFiles.size > 0) {
-    summaries = summaries.map((summary) => unreconciledFiles.has(path36.resolve(summary.filePath)) ? summarizeDiagnostics(summary.filePath, markUnreconciledFindings(summary.diagnostics), summary.hasFinalSnapshot) : summary);
+    summaries = summaries.map((summary) => unreconciledFiles.has(path37.resolve(summary.filePath)) ? summarizeDiagnostics(summary.filePath, markUnreconciledFindings(summary.diagnostics), summary.hasFinalSnapshot) : summary);
   }
   const parsedProjectScanObservedAt = projectSnapshot?.scannedAt ? Date.parse(projectSnapshot.scannedAt) : void 0;
   const projectScanObservedAt = parsedProjectScanObservedAt !== void 0 && Number.isFinite(parsedProjectScanObservedAt) ? parsedProjectScanObservedAt : void 0;
@@ -19674,7 +19835,10 @@ async function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummari
   const dispositioned = isFullMode ? summaries : summaries.map((s) => {
     const diagnostics = s.diagnostics ?? [];
     const kept = applyCachedDispositions(diagnostics, cwd, s.filePath);
-    const policyKept = applyRulePolicy(kept, policyMap);
+    const policyKept = applyRulePolicy(kept, policyMap, {
+      root: cwd,
+      filePath: s.filePath
+    });
     if (policyKept.length === kept.length && kept.length === diagnostics.length)
       return s;
     return summarizeDiagnostics(s.filePath, policyKept, s.hasFinalSnapshot);
@@ -19719,7 +19883,7 @@ async function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummari
   let totalWarnings = 0;
   let totalAdvisories = 0;
   for (const s of rendered) {
-    const rel = path36.relative(cwd, s.filePath);
+    const rel = path37.relative(cwd, s.filePath);
     const parts = [];
     if (s.blocking > 0)
       parts.push(`\u{1F534} ${s.blocking} blocking`);
@@ -19787,7 +19951,7 @@ Summary (${visibleSummaries.length} files diagnosed this session):`,
 
 // dist/tools/lsp-navigation.js
 import * as nodeFs2 from "node:fs";
-import * as path37 from "node:path";
+import * as path38 from "node:path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from "node:url";
 
 // dist/tools/lsp-structured-output.js
@@ -20497,7 +20661,7 @@ function collectSearchReadsForOperation(operation, result, callHierarchyItem) {
 }
 function formatCapabilities(snapshots, filePath) {
   if (snapshots.length === 0) {
-    return filePath ? `No active LSP server for ${path37.basename(filePath)}. Open/touch the file first or run another LSP operation to start the server.` : "No active LSP servers in this session.";
+    return filePath ? `No active LSP server for ${path38.basename(filePath)}. Open/touch the file first or run another LSP operation to start the server.` : "No active LSP servers in this session.";
   }
   const rows = [
     ["definition", (s) => !!s.operationSupport.definition],
@@ -20527,7 +20691,7 @@ function formatCapabilities(snapshots, filePath) {
   ];
   const lines = [];
   for (const snapshot of snapshots) {
-    const label = filePath ? `${snapshot.serverId} (${path37.basename(filePath)})` : `${snapshot.serverId} (${snapshot.root})`;
+    const label = filePath ? `${snapshot.serverId} (${path38.basename(filePath)})` : `${snapshot.serverId} (${snapshot.root})`;
     lines.push(label);
     for (const [name, supported, note] of rows) {
       const suffix = note ? ` (${note})` : "";
@@ -20818,6 +20982,7 @@ function createLspNavigationTool(getFlag, mutationDeps) {
         const mutationSource = operation === "executeCommand" ? "lsp-execute-command" : "lsp-rename";
         mutationContext = {
           cwd,
+          sessionId: ctx.sessionManager?.getSessionId?.(),
           correlationId: newLspMutationCorrelationId(_toolCallId),
           // #4187 R4-1: the call whose `tool_call` licensed the paths it
           // named; the workspace edit's other files (a rename's importers)
@@ -20866,7 +21031,7 @@ function createLspNavigationTool(getFlag, mutationDeps) {
           resultCount: 0
         });
       }
-      const filePath = rawPath ? path37.isAbsolute(rawPath) ? rawPath : path37.resolve(ctx.cwd || ".", rawPath) : "";
+      const filePath = rawPath ? path38.isAbsolute(rawPath) ? rawPath : path38.resolve(ctx.cwd || ".", rawPath) : "";
       let filePathIsDirectory = false;
       if (filePath) {
         try {
@@ -20902,7 +21067,7 @@ function createLspNavigationTool(getFlag, mutationDeps) {
               content: [
                 {
                   type: "text",
-                  text: `No LSP server available for ${path37.basename(filePath)}. Check that the language server is installed.`
+                  text: `No LSP server available for ${path38.basename(filePath)}. Check that the language server is installed.`
                 }
               ],
               isError: true
@@ -21003,7 +21168,7 @@ ${JSON.stringify(result2)}`
           content: [
             {
               type: "text",
-              text: `No LSP server available for ${path37.basename(filePath)}. Check that the language server is installed.`
+              text: `No LSP server available for ${path38.basename(filePath)}. Check that the language server is installed.`
             }
           ],
           isError: true
@@ -21022,7 +21187,7 @@ ${JSON.stringify(result2)}`
             content: [
               {
                 type: "text",
-                text: `LSP server for ${path37.basename(filePath)} does not advertise support for ${operation}`
+                text: `LSP server for ${path38.basename(filePath)} does not advertise support for ${operation}`
               }
             ],
             isError: true,
@@ -21076,7 +21241,7 @@ ${JSON.stringify(result2)}`
           const msg = err instanceof Error ? err.message : String(err);
           if (rawPath && /No Project/i.test(msg)) {
             await openFileBestEffort(lspService, filePath);
-            await new Promise((resolve31) => setTimeout(resolve31, 120));
+            await new Promise((resolve32) => setTimeout(resolve32, 120));
             const retryRaw = await lspService.workspaceSymbol(query ?? "", filePath);
             const retrySymbols = (Array.isArray(retryRaw) ? retryRaw : [retryRaw]).filter((s) => typeof s === "object" && s !== null);
             return dedupeWorkspaceSymbols(retrySymbols);
@@ -21151,7 +21316,7 @@ ${JSON.stringify(result2)}`
             if (!newFilePath || newFilePath.trim().length === 0) {
               throw new Error("__BADINPUT__ newFilePath parameter required for rename_file");
             }
-            const resolvedNewFilePath = path37.isAbsolute(newFilePath) ? newFilePath : path37.resolve(ctx.cwd || ".", newFilePath);
+            const resolvedNewFilePath = path38.isAbsolute(newFilePath) ? newFilePath : path38.resolve(ctx.cwd || ".", newFilePath);
             const result2 = await lspService.renameFile(filePath, resolvedNewFilePath, {
               cwd: ctx.cwd || ".",
               apply: apply ?? false,
@@ -21295,7 +21460,7 @@ ${JSON.stringify(result2)}`
         }, { operation, filePath, failureKind: "lsp_error", resultCount: 0 });
       }
       const isEmpty = !result || Array.isArray(result) && result.length === 0;
-      const fileCtx = filePath ? " at " + path37.basename(filePath) : "";
+      const fileCtx = filePath ? " at " + path38.basename(filePath) : "";
       const lineCtx = line ? ":" + line + ":" + character : "";
       let output = isEmpty ? "No results for " + operation + fileCtx + lineCtx : JSON.stringify(result);
       if (isEmpty && operation === "workspaceSymbol" && !rawPath) {
@@ -21537,11 +21702,11 @@ function resolveDefaultCwd() {
   const fromArg = process.argv.find((arg) => arg.startsWith("--cwd="))?.slice("--cwd=".length);
   return fromArg ?? process.env.PI_LENS_MCP_CWD ?? process.cwd();
 }
-var DEFAULT_CWD = path38.resolve(resolveDefaultCwd());
+var DEFAULT_CWD = path39.resolve(resolveDefaultCwd());
 var lspReadyCwds = /* @__PURE__ */ new Set();
 var SERVER_FILE = fileURLToPath3(import.meta.url);
-var SERVER_DIR = path38.dirname(SERVER_FILE);
-var WORKER_PATH = path38.join(SERVER_DIR, "worker.js");
+var SERVER_DIR = path39.dirname(SERVER_FILE);
+var WORKER_PATH = path39.join(SERVER_DIR, "worker.js");
 var REBUILD_SCRIPT = resolveRebuildScript(SERVER_FILE);
 var STALENESS_STAT_PATH = process.env.PI_LENS_MCP_STALENESS_STAT_PATH ?? SERVER_FILE;
 var BUILD_STAMP = computeBuildStamp(STALENESS_STAT_PATH);
@@ -21563,7 +21728,7 @@ function isWarmBuildStale() {
 function findRepoRoot(start) {
   let dir = start;
   for (let depth = 0; depth < 6; depth++) {
-    const pkgPath = path38.join(dir, "package.json");
+    const pkgPath = path39.join(dir, "package.json");
     if (fs25.existsSync(pkgPath)) {
       try {
         const pkg = JSON.parse(fs25.readFileSync(pkgPath, "utf8"));
@@ -21572,16 +21737,16 @@ function findRepoRoot(start) {
       } catch {
       }
     }
-    const parent = path38.dirname(dir);
+    const parent = path39.dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  return path38.resolve(start, "..", "..");
+  return path39.resolve(start, "..", "..");
 }
-var REPO_ROOT = process.env.PI_LENS_MCP_REPO_ROOT ? path38.resolve(process.env.PI_LENS_MCP_REPO_ROOT) : findRepoRoot(SERVER_DIR);
+var REPO_ROOT = process.env.PI_LENS_MCP_REPO_ROOT ? path39.resolve(process.env.PI_LENS_MCP_REPO_ROOT) : findRepoRoot(SERVER_DIR);
 async function ensureReady(cwd) {
-  const normalized = path38.resolve(cwd);
+  const normalized = path39.resolve(cwd);
   if (!shouldInitializeSessionRoot(normalized, lspReadyCwds)) {
     return;
   }
@@ -21627,14 +21792,14 @@ function getAutoSessionStatus() {
 }
 var IPC_PATH = ipcPathForCwd(DEFAULT_CWD);
 function rejectForeignTurnCwd(route, cwd) {
-  const message = `${route} cwd outside this server's workspace: ${path38.resolve(cwd)} not within ${DEFAULT_CWD}`;
+  const message = `${route} cwd outside this server's workspace: ${path39.resolve(cwd)} not within ${DEFAULT_CWD}`;
   console.error(`[pi-lens-mcp] rejected ${message}`);
   return message;
 }
 function isWithinServerWorkspace(cwd) {
-  const target = path38.resolve(cwd);
-  const rel = path38.relative(DEFAULT_CWD, target);
-  return !rel.startsWith("..") && !path38.isAbsolute(rel);
+  const target = path39.resolve(cwd);
+  const rel = path39.relative(DEFAULT_CWD, target);
+  return !rel.startsWith("..") && !path39.isAbsolute(rel);
 }
 function startIpcServer() {
   if (process.platform !== "win32") {
@@ -21784,6 +21949,12 @@ function graphStalenessNote(builtAtIso, label) {
     return void 0;
   return `${label} last updated ${formatRelativeAge(ageMs)}; run pilens_analyze on recently-changed files, pilens_session_start, or pilens_rebuild to refresh it.`;
 }
+setProjectTrustState("trusted");
+logExtension({
+  subsystem: "project-trust",
+  level: "debug",
+  message: "mcp: workspace trust belongs to the MCP client; pi trust not consulted"
+});
 var cacheManager = new CacheManager();
 var isLensGuardEnabled = () => Boolean(createMcpHost(void 0, DEFAULT_CWD).getFlag("lens-guard"));
 var lensDiagnosticsTool = createLensDiagnosticsTool(
@@ -22123,7 +22294,7 @@ function enabledToolsForCwd(cwd) {
 }
 function formatAnalyze(result, cwd, mode, servedBy) {
   const lspNote = result.lsp ? ` \xB7 lsp ${result.lsp.diagnosticCount} (${result.lsp.status}${result.lsp.failureKind ? `: ${result.lsp.failureKind}` : ""}, ${result.lsp.durationMs}ms)` : "";
-  const summary = `${path38.relative(cwd, result.filePath) || result.filePath} [${mode}] \u2014 ${result.counts.blockers} blocking, ${result.counts.warnings} warning(s), ${result.counts.advisories} advisory(ies), ${result.counts.diagnostics} total` + (result.latency ? ` \xB7 ${result.latency.totalDurationMs}ms` : "") + lspNote + (result.counts.fixed > 0 ? ` \xB7 ${result.counts.fixed} auto-fixed` : "") + (servedBy ? `
+  const summary = `${path39.relative(cwd, result.filePath) || result.filePath} [${mode}] \u2014 ${result.counts.blockers} blocking, ${result.counts.warnings} warning(s), ${result.counts.advisories} advisory(ies), ${result.counts.diagnostics} total` + (result.latency ? ` \xB7 ${result.latency.totalDurationMs}ms` : "") + lspNote + (result.counts.fixed > 0 ? ` \xB7 ${result.counts.fixed} auto-fixed` : "") + (servedBy ? `
 
 servedBy: ${servedBy}` : "");
   return renderToolText(summary, servedBy ? { ...result, servedBy } : result);
@@ -22257,7 +22428,7 @@ ${outcome.output}`, {
     }
     const { deduped, byRule, byFile } = summarizeScan(snapshot.diagnostics);
     const topRules = Object.entries(byRule).sort((a, b) => b[1] - a[1]);
-    const topFiles = Object.entries(byFile).sort((a, b) => b[1] - a[1]).slice(0, 15).map(([file, count]) => ({ file: path38.relative(cwd, file), count }));
+    const topFiles = Object.entries(byFile).sort((a, b) => b[1] - a[1]).slice(0, 15).map(([file, count]) => ({ file: path39.relative(cwd, file), count }));
     const summaryLines = [
       `Scanned ${snapshot.filesScanned} file(s) [${snapshot.runners.join(", ")}] \u2192 ${deduped.length} unique diagnostic(s)` + (snapshot.diagnostics.length !== deduped.length ? ` (${snapshot.diagnostics.length} raw, ${snapshot.diagnostics.length - deduped.length} duplicate)` : ""),
       ...topRules.slice(0, 12).map(([rule, count]) => `  ${count}\xD7 ${rule}`)
@@ -22310,7 +22481,7 @@ ${stalenessNote}` : ""), {
     }
     const lines = [
       `Top ${results.length} file(s) for "${query}":`,
-      ...results.map((result, i) => `  ${i + 1}. ${path38.relative(cwd, result.file)} (score ${result.score.toFixed(2)}, ${result.hits} hit(s), line ${result.startLine})`),
+      ...results.map((result, i) => `  ${i + 1}. ${path39.relative(cwd, result.file)} (score ${result.score.toFixed(2)}, ${result.hits} hit(s), line ${result.startLine})`),
       ...stalenessNote ? ["", stalenessNote] : [],
       ...coverage ? [
         `Index covers ${coverage.files} files${coverage.truncated ? " (capped \u2014 results may be incomplete)" : ""}.`
@@ -22320,7 +22491,7 @@ ${stalenessNote}` : ""), {
       query,
       coverage,
       results: results.map((result) => {
-        const relFile = path38.relative(cwd, result.file);
+        const relFile = path39.relative(cwd, result.file);
         return {
           file: relFile,
           score: result.score,
@@ -22359,12 +22530,12 @@ ${stalenessNote}` : ""), {
     });
     if (!report.available) {
       return {
-        ...renderToolText(`No module report for ${path38.relative(cwd, path38.resolve(cwd, file))} \u2014 not a symbol-bearing file, or unreadable.`, report, true),
+        ...renderToolText(`No module report for ${path39.relative(cwd, path39.resolve(cwd, file))} \u2014 not a symbol-bearing file, or unreadable.`, report, true),
         isError: true
       };
     }
     const graphStaleness = graphStalenessNote(report.graphBuiltAt, "Review graph");
-    const summary = `${path38.relative(cwd, report.path) || report.path} [${report.staleness}] \u2014 ${report.summary.symbols} symbol(s), ${report.summary.exports} exported, ${report.api.length} in public API` + (graphStaleness ? `
+    const summary = `${path39.relative(cwd, report.path) || report.path} [${report.staleness}] \u2014 ${report.summary.symbols} symbol(s), ${report.summary.exports} exported, ${report.api.length} in public API` + (graphStaleness ? `
 
 ${graphStaleness}` : "");
     if (view === "compact") {
@@ -22425,7 +22596,7 @@ ${graphStaleness}` : "");
     if (!result.found) {
       const suggestionSuffix = result.suggestions?.length ? ` Did you mean: ${result.suggestions.join(", ")}?` : " Use pilens_module_report to list symbols.";
       return {
-        ...renderToolText(`Symbol "${symbol}" not found in ${path38.basename(file)}.${suggestionSuffix}`, {
+        ...renderToolText(`Symbol "${symbol}" not found in ${path39.basename(file)}.${suggestionSuffix}`, {
           found: false,
           ...result.suggestions ? { suggestions: result.suggestions } : {}
         }),
@@ -22434,7 +22605,7 @@ ${graphStaleness}` : "");
     }
     const sigSuffix = result.signature ? `  ${result.signature}` : "";
     const ambiguityNote = result.ambiguous ? ` (${result.ambiguous.count} matches \u2014 returned the ${result.kind}; pass \`kind\` to disambiguate: ${result.ambiguous.kinds.join(", ")})` : "";
-    const header = `${result.kind} ${result.name}${ambiguityNote}${sigSuffix}  ${path38.relative(cwd, result.path)}:${result.startLine}-${result.endLine}`;
+    const header = `${result.kind} ${result.name}${ambiguityNote}${sigSuffix}  ${path39.relative(cwd, result.path)}:${result.startLine}-${result.endLine}`;
     return {
       content: [
         {
@@ -22472,14 +22643,14 @@ ${result.source ?? ""}`
 
 Nested outline:
 ${JSON.stringify(result.outline)}` : "";
-      const text = result.error ? `Could not read enclosing range in ${path38.basename(file)}:${result.line}: ${result.error}${warningSuffix}${outlineSuffix}` : `No enclosing symbol/callback found in ${path38.basename(file)}:${result.line}.${warningSuffix}`;
+      const text = result.error ? `Could not read enclosing range in ${path39.basename(file)}:${result.line}: ${result.error}${warningSuffix}${outlineSuffix}` : `No enclosing symbol/callback found in ${path39.basename(file)}:${result.line}.${warningSuffix}`;
       return {
         ...renderToolText(text, { found: false, line: result.line }),
         isError: true
       };
     }
     const range = result.partial ? `${result.startLine}-${result.endLine} (partial of ${result.enclosingStartLine}-${result.enclosingEndLine})` : `${result.startLine}-${result.endLine}`;
-    const header = `${result.kind} ${result.name}  ${path38.relative(cwd, result.path)}:${range}`;
+    const header = `${result.kind} ${result.name}  ${path39.relative(cwd, result.path)}:${range}`;
     return {
       content: [
         {
@@ -22514,7 +22685,7 @@ ${result.source ?? ""}`
       ]),
       ...renderLspBrokenStatusLines(brokenServers),
       ...renderDegradationLines(degradations),
-      last ? `Last dispatch: ${path38.basename(last.filePath)} \u2014 ${last.totalDurationMs}ms, ${last.totalDiagnostics} diagnostic(s)` : "Last dispatch: none yet",
+      last ? `Last dispatch: ${path39.basename(last.filePath)} \u2014 ${last.totalDurationMs}ms, ${last.totalDiagnostics} diagnostic(s)` : "Last dispatch: none yet",
       `Diagnostics this session: ${stats.totalShown} shown \xB7 ${stats.totalAutoFixed} auto-fixed \xB7 ${stats.totalUnresolved} unresolved`,
       autoSession ? `Auto session_start: ${autoSession.succeeded ? "succeeded" : autoSession.error ? "FAILED" : autoSession.attempted ? "in progress" : "not yet attempted"}${autoSession.firedAt ? ` (fired ${autoSession.firedAt})` : ""}${autoSession.error ? ` \u2014 ${autoSession.error}` : ""}` : "Auto session_start: disabled (PI_LENS_MCP_AUTO_SESSION not set)",
       turnEnd ? `Stop-hook turn-end: ${turnEnd.ran} ran \xB7 ${turnEnd.skipped} skipped${turnEnd.lastRunAt ? ` (last ran ${turnEnd.lastRunAt})` : ""}${turnEnd.lastSkipReason ? ` \u2014 last skip: ${turnEnd.lastSkipReason}${turnEnd.lastSkipAt ? ` at ${turnEnd.lastSkipAt}` : ""}` : ""}` : "Stop-hook turn-end: no activity recorded (hook not installed, or no Stop yet)",
@@ -22580,7 +22751,7 @@ ${result.source ?? ""}`
     const limit = typeof args.limit === "number" && Number.isFinite(args.limit) ? Math.max(1, Math.floor(args.limit)) : 5;
     const fileFilter = typeof args.file === "string" ? args.file : void 0;
     const recent = recentLatency(limit, fileFilter);
-    const summary = recent.length === 0 ? "No dispatch latency reports yet." : recent.map((report) => `${path38.basename(report.filePath)}: ${report.totalDurationMs}ms (${report.totalDiagnostics} diag${report.stoppedEarly ? ", stopped early" : ""})`).join("\n");
+    const summary = recent.length === 0 ? "No dispatch latency reports yet." : recent.map((report) => `${path39.basename(report.filePath)}: ${report.totalDurationMs}ms (${report.totalDiagnostics} diag${report.stoppedEarly ? ", stopped early" : ""})`).join("\n");
     return renderToolText(summary, recent);
   }
   if (name === "pilens_session_start") {