loki-mode 10.10.3 → 10.10.5

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.10.3
+# Loki Mode v10.10.5
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.10.3 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v10.10.5 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-10.10.3
+10.10.5

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.10.3"
+__version__ = "10.10.5"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.10.3. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v10.10.5. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v10.10.3
+**Version:** v10.10.5
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/v10/BOARD.md

@@ -875,3 +875,9 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | CPE24-P4a | Legacy /api/control/* callers require ctx.local (or isLoopbackHost) like /v1 | packages/control-plane/src/server/legacy/routes-control.ts plus test | MEDIUM | non-loopback Host refused on legacy control | ready@2026-10-03T19:35Z | rv-trust3 advisory on P4. |
 | CP-NITS1 | CP run page nits from the 10.10.2 smoke: Wall row describes the Wall ("Wrote acceptance checks (n files)" or "skipped: no checks written"); local repo with no remote shows the folder name, not REPO UNMEASURED; receipt text read from receipt.json on disk like the derived diff; diffstat failures cached (F1); leading-dash sha fixture | packages/control-plane/src/server plus ui run page plus tests | MEDIUM | CP suite green; a signed receipt on disk renders its text; a no-remote repo shows its folder name | ready@2026-10-03T21:31Z | Peer smoke 21:27Z plus CP follow-up review F1. |
 | FC-01b | Monorepo visual-evidence skip reason: with backend/ and frontend/ package.json and no root manifest, say "no dev, preview or start script in backend/ or frontend/", not "no package.json" | visual evidence path in loki-ts/src plus test | LOW | monorepo fixture prints the per-package reason | ready@2026-10-03T21:31Z | FC-01 sibling (Engine Law L5). |
+| FC-19b | Spec-conflict resume near the stage limit: skip the resume when under about 60s of the implement window remains, or keep the first conflict when the resume is aborted, so the run ends BLOCKED with its question instead of a limit failure | loki-ts/src/util/conflict_resume.ts plus machine.ts plus test | MEDIUM | a fake first session that uses the window then conflicts ends BLOCKED with its question | ready@2026-10-03T21:56Z | review-fc19 non-blocking follow-up, from reading machine.ts runStage. |
+| CP-START | FC-20 (LATER list): root-cause the CP home Start "HTTP 404" (route mismatch, stale CP process serving a newer UI, or the loopback guard) and fix it at the shared layer (UI and server version match; a stale CP restarts or refuses a newer UI); never show a bare HTTP status, show a sentence with the next step; repo chip lists registered repos by name plus Browse; choosing a smaller model shows one muted line ("haiku: fastest, may be less accurate") and never blocks. The composer itself is redefined by CP-ASK (founder 22:03Z): greenfield-from-composer is dropped | packages/control-plane server and ui plus tests | MEDIUM | a forced 404 renders a sentence, a version-skewed UI gets the restart sentence | ready@2026-10-03T22:05Z | Founder bug via steering 22:01Z, rescoped by founder 22:03Z. Do not displace FC-15 or FC-16. |
+| CP-ASK | Founder 22:03Z: "we are not a vibe coding tool". The CP home box becomes Ask Loki: search, learn, compare runs, and ask anything about Loki Mode, past runs, receipts, repos and issues. Default provider claude (or any configured provider and model the user picks); the model gets all of that data (read-only tools or MCP over runs, receipts, events, METRICS, repos, gh issues and PRs); answers are async jobs the user can leave and come back to, listed in the CP. Read-only: Ask never edits a repo or starts a build | Architect slices first (10-40 slices, feature flag); packages/control-plane routes and ui, a read-only data layer, provider invocation | HIGH | the founder asks "compare my last two runs on FireLater" and gets a cited answer async in the CP; Ask cannot write to any repo | ready@2026-10-03T22:05Z | Founder direct directive 22:03Z. Architect plan first. |
+| FC-21 | FC-21: (a) a limit in implement still runs verify on the existing work plus the fix rounds the budget allows, never seal directly; (b) the run cap scales with task size (sizing and Project Model), with a generous subscription default set in loki.yaml; (c) implement is told its remaining time; (d) the CLI summary, CP and PR body read receipt.verdict (one outcome) | loki-ts/src/engine10 run orchestration, the budget and sizing modules, the CLI summary, plus tests | MEDIUM | a fake implement limit is followed by verify; CLI outcome equals receipt.verdict for 4 verdicts; a large task gets a larger cap; core cap under 5000 | merged@2026-10-03T22:55Z | FireLater#17 gate on 10.10.3 PARTIAL (steering 22:08Z). P0 tier with FC-16/FC-15. Built 21fec9deb; opus review-fc21 APPROVE on merge e80abc63a (suites 1719/0, budget 27/0, tsc rc=0 with real node_modules); merged 881f1275f. Advisories A1-A4 filed as FC-21b. Ships in one train with FC-15 and FC-16. |
+| FC-21b | FC-21 follow-ups, next train (steering 23:00Z): (1) an implement limit forces PARTIAL only while checks are red or unrun; if the fix rounds make the impacted checks green with n>0 the run earns VERIFIED (L3: what ran is the evidence, not how long implement took); (2) size the run cap from the Project Model and plan (packages and files touched) or a plan-session estimate, never from task-text character count (L0); (3) the CLI outcome must equal receipt.verdict, so a cap stop after a limit cannot print BUDGET_STOP over a PARTIAL or FAILED receipt (L7, was advisory A4); (A1) machine.ts:145 mustJump keys on reason limit only, require r.killed too; (A2) a spec-conflict resume gets the full original budget in the time note and limitS, and the note lands after FINISH_LINE; (A3) yamlRunCapS matches run_cap_s at any depth under budgets, CRLF yaml falls back silently, ls-files count off by one | loki-ts/src/engine10/machine.ts, stages/implement.ts, stages/seal.ts, output.ts, src/util/run_cap.ts, project_model sizing, plus tests | HIGH | a limit then fix-green with n>0 seals VERIFIED, a limit with a red or unrun check seals PARTIAL; the cap for a short task touching many packages exceeds the cap for one file; CLI outcome equals receipt.verdict on a cap stop after a limit; a thrown limit without a kill never reaches VERIFIED; nested per_stage run_cap_s is ignored; a resumed implement gets the remaining time | ready@2026-10-03T23:01Z | From review-fc21 22:53Z plus steering 23:00Z. HIGH because it changes the verdict rule (opus reviewer). Architect plan first for the sizing source. e10ext is 1 line under its 1500 cap. Queue after the FireLater#17 gate on 10.10.4. |
+| FC-16b | FC-16 follow-ups: package_suite.ts:33 detects go by first token only (make test, GOFLAGS=x go test fall to the generic path); go -json parsing; load_owner killTree process-group kill; unittest atexit forged trailer | loki-ts/src/engine10 package_suite, load_owner, test classify, plus tests | MEDIUM | make test wrapping go test classifies with runner go; a forged unittest trailer from atexit is not a pass | ready@2026-10-03T23:01Z | From review-fc16-fc02-integ rounds 4-6. package_suite results never feed seal proof today. Also owed: an end-to-end test running a go Wall file through RealBaseTestRunner (the seal.test.ts case does not guard wall.ts). |

package/docs/v10/DEPS.md

@@ -14,6 +14,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `loki-ts/package.json` | `@types/bun` | `latest` | `1.4.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
 | `loki-ts/package.json` | `typescript` | `^5.6.0` | `7.0.2` | MAJOR |  |
 | `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
+| `loki-ts/tests/fixtures/monorepo-fc01/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
 | `loki-ts/tests/fixtures/project-model/firelater-17/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
 | `package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
 | `package.json` | `@types/node` | `^25.2.0` | `26.6.4` | MAJOR |  |
@@ -72,6 +73,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `web-app/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR |  |
 | `web-app/package.json` | `typescript-eslint` | `^8.70.1` | `8.71.0` | minor |  |
 | `web-app/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR |  |
+| `loki-ts/tests/fixtures/monorepo-fc01/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
 | `loki-ts/tests/fixtures/project-model/firelater-17/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
 
 ## Python (requirements*.txt)

package/docs/v10/FAILURE-CLASSES.md

@@ -41,7 +41,10 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
   - vitest "No test files found, exiting with code 0" counts as a pass with n=0, when it should be not_run (EL-W1-06).
 - Mechanism: a result classifier with an owner (EL-W1-05). Only a FAIL owned by code drives fix and stall. Interim: EL-W0-02.
 - Fixture: tests/fixtures/runner-outputs/vitest/load-error.txt (from seq 56), plus siblings for each runner.
+- Status: FIXED (interim, FC-02 lane F). One shared classifier loki-ts/src/runner/runner_errors.ts (classifyRunnerOutput); verify.ts runCheck turns a load or collection error into not_run with owner harness (no rerun, no fix round, listed in verify not_proven); deep.ts runFullSuite does the same; wall.ts classify() already returned not_run for jest/vitest/bun with no parsed failure and is left unchanged. A real failed-test count in the same output keeps it a code failure; lint checks are never reclassified. Fixtures: loki-ts/tests/engine10/fixtures/runner-outputs/{vitest,pytest}, test loki-ts/tests/engine10/runner_errors.test.ts. Still open: the n=0 pass rule (EL-W1-06) and per-runner fixtures for jest, node:test, go, cargo.
+- Integration with FC-16 (2026-10-03): one mechanism identifies lint, typecheck and selector checks: `RunOpts.kind: "static"` (verify, deep and per-package paths alike); the FC-02 name-prefix exemption is removed. Load ownership is the single helper `harnessLoadReason` (runner/load_owner.ts), called from verify runCheck (kind test only), deep runFullSuite and project_model/package_suite.ts, which also routes results through FC-16 classifyCheck. Test: tests/engine10/monorepo_cwd.test.ts (FC-16 C1, lint kind blocks).
 - Sibling (2026-10-03): a change-introduced load error is a code fault. Base reproduction is necessary but not sufficient. The base rerun must be hermetic (an inherited editable install imports head code), and a check the task targets is never env-owned (7ad4a18b6, blocked in round 2). Superseded by L0-WAVE1 EL-W1-06: the harness gathers evidence and a separate reviewer call assigns the owner.
+- Ownership rule (2026-10-03, HIGH review of fd3ad2037): loki-ts/src/runner/load_owner.ts loadErrorIsHarnessOwned, one mechanism used by verify.ts runCheck AND deep.ts runFullSuite (sibling sweep done: wall.ts classify() already returns fail for a parsed failure). A load error is harness-owned not_run only when the same command reproduces a load error on a hermetic base worktree, no changed file is named in the output (path or module stem), the check is not a Wall or task-relevant test, and its target file is not itself changed; else it stays fail so fix rounds run. Patterns tightened (N1): command not found and Cannot find module match runner-load shapes only. Regressions: tests/engine10/runner_errors.test.ts (B1 SyntaxError in changed source, B2 Wall missing symbol, base-reproduced harness error, non-reproducing error, N1).
 
 ## FC-03 Scope control reverted in-scope route edits
 - User saw: the PR without the fix (routes/applications.ts, assets.ts and attachments.ts reverted).
@@ -207,28 +210,41 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
   - The repo default branch is used only when it is configured as `default`. Never hardcode "main" (L0).
   - The start line prints `base: <branch> (<flag, config or checkout>)`.
   - The PR target is the configured target, else the repo default branch, and the PR body names it.
-- Siblings: every outcome that compares against the base (ALREADY_SATISFIED, the Wall base run, the scope diff, the receipt delta).
-- Mechanism:
-  - Detect Loki's own unmerged work on the base from its run records (the loki/e10-* branch plus the run receipt), not from a branch-name regex.
-  - Report "this branch already has run <id>'s unmerged work (PR #N, <state>); resume or review it", never ALREADY_SATISFIED.
-  - A dirty or foreign checkout is noted in the output.
-- Fixture: owed. A repo whose checkout is a prior run's branch with a receipt must yield the unmerged-work outcome.
-
-## FC-16 ALREADY_SATISFIED with zero Loki-executed checks
-- User saw: the same run had verify "checks": [] and changed_files []. The verdict rested only on the implement agent's self-report ("10/10 named impacted tests pass ... via npx vitest run").
-- Law: L0 and L3 (the model never grades its own work), L5; Seal accuracy.
-- Siblings: every outcome that is reachable with an empty checks list.
-- Mechanism:
-  - A success-class outcome requires harness-executed evidence against the target base: the impacted tests run through the Project Model commands, plus each acceptance point of the issue checked.
-  - With zero executed checks the outcome is NOT VERIFIED.
-- Fixture: owed. A verify with checks [] and a self-reported pass must yield NOT VERIFIED.
+- Siblings (swept 2026-10-03; every place a base or diff is computed):
+  - loki-ts/src/engine10/stages/intake.ts: baseSha = rev-parse HEAD, the ALREADY_SATISFIED judge (checkAlreadyDone, closed-issue exit); FIXED, now refuses first;
+  - loki-ts/src/engine10/worker.ts:49: ctx.baseSha = rev-parse HEAD (inherits intake's refusal, runs after it in the same checkout);
+  - loki-ts/src/engine10/stages/seal.ts:111-116,190,256: staged diff, discardIfSatisfied, diff-tree and receipt base_sha, all against ctx.baseSha;
+  - loki-ts/src/engine10/stages/verify.ts:63-67,103,176,238,287: changedFiles, testConfigChanged, the pre_red worktree at ctx.baseSha (the engine's only worktree use), inBase;
+  - loki-ts/src/engine10/stages/deep.ts:134,236: council diff and changedFiles against ctx.baseSha;
+  - loki-ts/src/engine10/supervisor.ts:221-224: PR diff-vs-base from intake's base_sha;
+  - loki-ts/src/engine10/stages/wall.ts, modernize/presealed_wall.ts: Wall base run and already_satisfied count, fed by the same ctx.baseSha.
+  All of them consume ctx.baseSha, which is HEAD after intake; one guard at intake covers them.
+- Mechanism (shipped, redesigned 2026-10-03): the guard sits on the CLAIM, not the run. A run always starts from the base the user asked for and is never refused for carrying commits that are not on the PR target. loki-ts/src/util/base_guard.ts resolveBase resolves the PR TARGET (LOKI_E10_BASE else origin default branch, fetched with a 10s non-interactive fetch, else local main/master; never loki/* or HEAD). unmergedEvidence compares the ALREADY_SATISFIED evidence paths (AlreadyDoneResult.paths) with `git diff --name-only <target> HEAD`: evidence that exists only in target..HEAD voids the claim, and the run proceeds to implement. When those commits are really Loki's (one carries the engine's "Loki-Run:" commit trailer, or a local .loki/runs receipt sealed head_sha != base_sha with commits of its own there; a branch merely named loki/* or a zero-commit receipt does not count) intake records data.unmerged_loki_work with the harness-owned note "work exists on <branch>, not on <target>; open or resume it" (L5; informational, never a refusal, never VERIFIED). The note is visible in three places: a stderr line when intake finishes and the run goes on to implement, the terminal summary (renderMainOutput via unmergedLokiWorkNote), and a "- Note:" line under "How it was tested" in the real PR body (e10ext/reviewer_body.ts renderReviewerBody, called by stages/pr.ts), unclipped with the evidence path list capped at 3 plus "(+N more)". When the commits are not Loki's the claim is dropped with one stderr line saying the evidence is on <branch> but not on <target>. The start line prints "PR target: <ref>, base: <branch>". No reflog is read. Placed in util/ because engine10 core is at its size cap (budget.test.ts).
+- Review fix (HIGH F1-F3, superseded by the redesign): the earlier refusal path and its reflog counting (including the R1 fresh-clone hole, where the oldest reflog entry is the tip itself) are removed rather than patched; with no refusal there is no wrongly-allowed run to close.
+- Still owed: a --base CLI flag, loki.yaml base_branch, the PR-target wording in the PR body (the start line now prints "PR target: <ref>, base: <branch>"); resolveBase already takes the explicit value via LOKI_E10_BASE.
+- Fixture: loki-ts/tests/engine10/intake.test.ts describe "base is not Loki's unmerged work (FC-15)" (origin + clone, local loki/e10-* branch committing the fix; without the guard intake returned already_satisfied from that unmerged commit, with it the claim is voided, the run completes and implements, and unmerged_loki_work is reported; control on main is not satisfied). Regressions A, B, B2 (no refusal, no claim), D (fresh clone of a pushed loki/* branch, 1 Loki commit: not refused, no claim, unmerged_loki_work.commits 1), a feature branch in a fresh clone (no refusal, not labelled Loki's), a loki/*-named branch with only the user's commit and a zero-commit receipt (neither labelled Loki's), the note present in renderMainOutput and renderReviewerBody, ALREADY_SATISFIED still reached when the work is on the target, and C (LOKI_E10_BASE=feature/search).
+
+## FC-16 ALREADY_SATISFIED / VERIFIED with zero Loki-executed checks (n=0 counted as pass)
+- User saw: FireLater#17 on 10.7.1 recorded checks `"result":"pass","n":0` (zero tests executed counted as PASS). The same run had verify "checks": [] and changed_files []; the verdict rested only on the implement agent's self-report ("10/10 named impacted tests pass ... via npx vitest run").
+- Law: L0 and L3 (the model never grades its own work), L5 (not a pass: NOT PROVEN, owner harness); Seal accuracy.
+- Rule: a test check with n=0 executed, or a count that cannot be parsed, is not_run with reason "no tests executed". VERIFIED and ALREADY_SATISFIED require at least one Loki-executed check with n>0 and a pass; otherwise the seal verdict is PARTIAL (the engine's existing NOT PROVEN label) and `no tests executed` is listed in NOT PROVEN.
+- Mechanism (one shared module, loki-ts/src/util/check_result.ts): `testCount` (vitest, jest, bun test, pytest, go test -v (the engine passes -v; non-verbose is unmeasured), unittest, Playwright, cargo test, node --test, mocha; null = unknown), `classifyCheck` (kind test needs n>0 to pass; kind static = lint/typecheck/scan, decided by exit code), `hasExecutedProof`.
+- Sibling sweep (every site that set or consumed "pass"):
+  - stages/verify.ts runCheck (was `n: ran(out) ?? 0` on a pass, and a null count passed): now classifyCheck. Lint, tsc, eslint, ruff, bash -n, shellcheck and select-tests are kind static.
+  - stages/wall.ts classify (exit 0 was an unconditional pass, feeding base_run.pass and wallGreenOnBase): now classifyCheck; zero or unknown count is not_run.
+  - stages/deep.ts runFullSuite (exit 0 was a pass): now classifyCheck, not_run lists NOT PROVEN. Council and secret-scan pass entries are static (no tests exist to count).
+  - stages/seal.ts verdictOf (VERIFIED and every ALREADY_SATISFIED route: intake.already_satisfied, wallGreenOnBase, implement exit already_done): gated on `proof` (hasExecutedProof over verify's raw checks, or a Wall base run with n>0).
+  - Consumers unchanged and now correct by construction: e10ext/select.ts, e10ext/reviewer_body.ts, features/pr_criteria.ts (they read result "pass", which now implies n>0 for test checks).
+  - Not applicable: modernize/presealed_wall.ts (red-base proof, never a pass), runner/quality_gates.ts (gate stubs, not test runs).
+- Fixture: loki-ts/tests/engine10/check_result.test.ts (vitest `No test files found` and `Test Files 0`, pytest `no tests ran`, jest, cargo, mocha zero; go unparsed is unknown; real pass keeps n; verdict gate: VERIFIED and ALREADY_SATISFIED without proof are PARTIAL).
 
 ## FC-17 The Wall spends time and money and writes nothing
 - User saw: the same run's Wall produced "files": [] in 1m42s, with base_run 0/0/0. This is the D82-WALL0 class again.
 - Law: L5 (no work without evidence), cost.
 - Siblings: D82-WALL0 and any stage that can finish with zero artifacts and still bill.
 - Mechanism: if the Wall cannot write a check, it skips in under 10s with a NOT PROVEN note and never runs a model session to an empty result.
-- Fixture: owed. A repo with no runnable test command yields a Wall skip under 10s with NOT PROVEN.
+- Fixture: loki-ts/tests/engine10/runner_errors.test.ts (FC-17 block). A repo with no runnable test command yields a Wall skip under 10s.
+- Status: FIXED for the no-runner case (lane G). wall.ts runWall prechecks, before any model session: a detected test map with no runner and no .py or .go file in the repo map returns stage.skipped with reason "no runnable test command detected: the Wall cannot write a runnable check". Still open: a Wall that has runners but writes nothing still bills its session (the SessionRunner has no progress hook for a no-progress cutoff); needs a session.ts change.
 
 ## FC-19 Loki's own stage rules talk a capable model out of doing the job
 - User saw: FireLater#17 run e10-20261003T200907Z-fea1 on 10.9.1 ended BLOCKED in 6m58s with a draft PR. The model's reason: "spec conflict: the task asks for all 37 route files to be migrated, validated and covered 100%, but the stage rules limit me to the named files and a few tests". Raw Claude Code finishes the same task in about 2 minutes. The user was told their spec conflicted; it was Loki's brief.
@@ -242,3 +258,17 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
   - Fix briefs reuse buildImplementBrief, so they inherit the same fix.
 - Mechanism: one shared constant brief (full job, trust rules only) plus one resume. No code inspects the model's wording (L0): on any LOKI_SPEC_CONFLICT from implement, util/conflict_resume.ts resumes the session exactly once with a correction ("Loki imposes no file or test limits; if your conflict is only about Loki's own rules, finish the task. If the task itself conflicts, restate the conflict."). If the model still declares a conflict the outcome is the normal BLOCKED with its one question (A-110). User work always keeps its PR or draft PR (E-67, L6).
 - Fixture: tests/engine10/conflict_resume.test.ts (a conflict that clears continues; one that persists stays BLOCKED with its question), tests/e10ext/full_job_brief.test.ts (limiting phrases gone, trust rules present, plan and Wall briefs carry no full-job wording), tests/engine10/machine.test.ts (deep implement session gets 1800s), tests/engine10/supervisor_backstop.test.ts (a PARTIAL seal after a failed implement stage still opens its PR).
+
+## FC-20 The Control Plane home cannot start a new app and shows a bare "HTTP 404"
+- User saw: on the redesigned CP home the founder typed "create an async timezone page that gets time from a free source for the given location and displays sun movement for it in natural graphic generated as code", with the chips repo "server directory", provider claude and model haiku, and pressed Start. A red "HTTP 404" appeared under the composer, and no run started.
+- Law: L5 (an honest, harness-owned reason with a next step, never a raw status), L6 (a start request never fails silently), L1 (raw Claude Code starts a greenfield app from one sentence; Loki must too).
+- Siblings: every CP action that surfaces a raw HTTP status (start, stop, resume, retry, receipt fetch); a UI bundle served by an older CP process after an upgrade (version skew); the loopback guard rejecting a local request; any entry point that assumes a repo exists (CP composer, `loki start` with only a brief).
+- Mechanism: one shared CP request helper turns every non-2xx into a plain sentence (what failed, why, next step). The UI and server carry one version, and a stale CP process restarts, or refuses a newer UI with that sentence. Rescoped by the founder at 22:03Z: Loki is not a vibe coding tool, so the home box is not a build prompt; it becomes Ask Loki (BOARD CP-ASK), and greenfield-from-composer is dropped.
+- Fixture: owed. A forced 404 renders a sentence, not "HTTP 404"; a version-skewed UI gets the restart sentence.
+
+## FC-21 A large task hits the implement time limit and the run skips verify, then reports two different outcomes
+- User saw: FireLater#17 on 10.10.3 (run e10-20261003T220847Z-78fa, steering 22:08Z). The model did the whole migration (83 files, +3999/-2476) and the backend suite then had 5855 pass, 3 fail. But implement stopped at "limit" after 639s under a fixed 900s run cap on a subscription run with no dollar cap. The run skipped verify and fix and went straight to commit and seal. The CLI printed "Outcome: FAILED, Reason: limit" while the receipt and run.completed said PARTIAL.
+- Law: L1 (raw Claude Code would have kept going and fixed the 3 failures), L2 (fail open on work: the work that exists is verified, never abandoned), L5 (the limit is a harness-owned reason), L7 (one source of truth for the outcome).
+- Siblings: every stage that can end at "limit" (plan, wall, implement, fix, deep); every caller that jumps from a stage failure straight to seal; every outcome printer (CLI summary, CP run page, PR body, Slack) that derives the verdict itself instead of reading receipt.verdict; FC-19 (a fixed time handicap on implement).
+- Mechanism: (a) a limit in implement still runs verify on the work that exists, plus the fix rounds the remaining budget allows, and never jumps to seal; (b) the run time budget scales with task size (sizing and the Project Model: files, packages), and subscription runs default to a generous wall cap that can be set in loki.yaml; (c) the implement session is told its remaining time so it can checkpoint with tests passing; (d) every outcome printer reads receipt.verdict.
+- Fixture: owed. A fake implement that hits the limit is followed by a verify stage event; the CLI summary equals receipt.verdict for VERIFIED, PARTIAL, FAILED and BLOCKED; a large sized task gets a larger cap than a small one.

package/docs/v10/METRICS.md

@@ -585,3 +585,12 @@ Two of the four baseline losses were noise; two are real. Internal measurement,
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | 2026-10-03 | claude-sonnet-5-5 (and claude-sonnet-5, now the standard price) | 2 (was 3 in loki-ts/data/model-pricing.json) | 10 (was 15) | 0.20 | 2.50 | 1M, standard pricing | platform.claude.com/docs/en/about-claude/pricing, read 2026-10-03 |
 Cost per completed task for sonnet arms measured before this date used the old 3/15 table; they overstate by 1.5x and are not comparable without rescaling.
+
+
+## FireLater#17 rerun gate (real repo, fresh clone, --no-pr)
+| Version | Outcome | Cost | Notes |
+| --- | --- | --- | --- |
+| 10.6.14 | STALLED | $2.66 | |
+| 10.7.1 | false ALREADY_SATISFIED, then FAILED | $2.69 | FC-15 class |
+| 10.9.1 | BLOCKED | $0.75 | brief handicap, FC-19 class |
+| 10.10.3 | PARTIAL | $2.27 | 12m; full migration (83 files); backend 5855/5858 green; implement stopped at a 900s run cap and verify was skipped (FC-21); run e10-20261003T220847Z-78fa, main be0799f, reported by steering 22:08Z |

package/docs/v10/PROGRESS.md

@@ -2214,3 +2214,11 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - Usage reading relayed by Loki steering (`claude -p "/usage"`, peer-stamped about 18:10Z, recorded at 17:43Z local clock): session 28%, week 71%, resets Oct 7 12:59 ET. The pulse's 518% projection extrapolates today's burst rate; recalibrated from this reading.
 - Governor plan until Oct 7: ONE lane (sonnet builder, opus review only on trust paths), stop at 81% weekly (4% reserve below the 85% floor). Order: (1) 10.7.1 guard fix-forward and release, (2) EL-W1-01 Project Model, (3) EL-W1-06 failure ownership (absorbs FC-02), (4) EL-W1-00 static L0 guard. In-flight agents finish; no other dispatch. Pending reviews (FC-09, EL-W0-06, FC-10) wait for the reset.
 - Main 08bf593f2: L0 recorded (ENGINE-LAWS, L0-WAVE1.md, FC-11). Full bun test after merges: 3353 pass, 2 fail (the two known guards only).
+
+## 2026-10-03T22:26Z (CoS)
+- 10.10.3 published and promoted: release run 37156522424 success; `npm view loki-mode dist-tags` latest=10.10.3 next=10.10.3 (18:10 local).
+- FC-15 merged on main 87965225f after the scoped opus re-check APPROVE (c59035fbc); budget+intake 57/0, tsc rc=0 on the merge; e10ext 1499/1500. Pushed.
+- Founder 22:03Z: CP home box is Ask Loki (read-only async search/compare over runs, receipts, repos, issues, METRICS), not a build prompt. CP-START rescoped to the 404, CP-ASK row (HIGH, Architect first). 7b02aafa5.
+- FireLater#17 gate on 10.10.3 (steering): PARTIAL $2.27, full migration, 5855/5858 green; implement hit the 900s cap and verify was skipped. FC-21 filed (8d17b8c59); sonnet fix-fc21 seated 22:24Z under D87.
+- FC-16 narrowed (Go exit 0 always not_run) at 1f3c97831: 1504/0, red-then-green 4/6 against c35bc2d62; opus re-review in flight.
+- Next: FC-16 APPROVE + FC-21 green, then one train FC-15+FC-16+FC-21, then the gate rerun.