v4.1.5

Added

• Dogfood knip on pi-lens's own source (closes #2698)
• PreToolUse Bash guard hook for the fixer/reviewer non-negotiables (closes #2699)
• Add per-analyzer knip.enabled, jscpd.enabled, madge.enabled, gitleaks.enabled, govulncheck.enabled, deadCode.enabled, and complexity.enabled keys plus startup.mode and startup.scans.enabled controls (refs #2721)

Changed

• Nightly tracking-issue updates share one reusable CLI (closes #2683)
• oxlint advisory tier (categories, plugins, type-aware) and publint on the packed tarball (refs #2700, refs #2697)
• Internal: 295 unused exports, 235 unused exported types and 4 duplicate exports removed, with the 85 declarations that became dead (refs #2708)
• knip advisory job green: the last three unused test-support exports are private, the dead `scripts/hooks/
• Cleared 51 of the 54 knip rows (23 of the 26 unused test exports; the 3 flake-shape rows stay for #2742) and 28 unused exported test types (refs #2708)
• Advisory CI adds jscpd, yamllint, typos, and taplo (refs #2706)
• Delegated-worker contract: handoff files for workers without Git authority (refs #2733, #2721)
• Reviewer contract diffs from the merge base

Fixed

• Keep admission registry ordering checks mutation-sensitive.
• Turn-end session test doubles use the shared runner-error predicate (closes #2673)
• yamllint, ruff, spellcheck, psscriptanalyzer, oxlint, and shellcheck now lint from the project's cwd, not the extension host's (closes #2691)
• Call-site sweeps now share the AST-backed sweep-kit.callSites seam (refs #2694)
• The sweep-floor meta-sweep now matches floor calls over comment- and string-blanked source (closes #2710)
• PHP LSP (intelephense) now installs (closes #2722)
• Custom LSP servers that never publish diagnostics are navigation-only, not timed out (closes #2765)
• Read-guard exemption globs and the file-utils directory glob no longer backtrack on adjacent wildcards (closes #2622)
• The install-time warm-loader log now honors PI_LENS_HOME (closes #2628)
• Require title close keywords to be repeated in the PR body, preventing the four 2026-09-06 incidents including #2610's merge …
• The flake-shape ratchet now sees child processes routed through test support helpers (refs #2653)
• Managed npm refreshes deduplicate shared packages (closes #2666)
• Hold the merge train for unconcluded gating checks (closes #2679)
• scripts/npm-retry.mjs annotates infra: registry unreachable only for network-shaped failures (closes #2684)
• LSP and smoke harness scratch directories use liveness-gated cleanup (closes #2688, closes #2687)
• Guard-bash preserves here-string boundaries and classifies heredoc substitutions the way bash expands them (closes #2705, refs #2726)
• Fail the oxlint advisory tier when type-aware support is unavailable (refs #2709)
• A red Tool smoke (nightly) run now notifies through a persistent tracking issue, on the failure path too (closes #2723)
• Heredoc bodies no longer leak into Bash command analysis (refs #2726)
• Turn-end test failures now reach the next model context without a terminal entry (closes #2733)
• Test ratchets now ignore comment and string laundering when matching source requirements (closes #2736)
• Formatters now run from the project root (closes #2756)
• Remove the unused scratch export and declaration, and fix oxfmt violations in two tests (refs #2759).
• Nightly tool smoke: the six --install steps share one tool tree again (refs #2762, refs #2687)
• Format smoke rows classify typed unavailable outcomes as skips (refs #2767)
• Ledger fields no longer read [object Object], and a rejected LSP push-wait no longer surfaces as an unhandled rejection (refs #2700)