loki-mode 11.17.6 → 11.17.11

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.6
+# Loki Mode v11.17.11
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.6 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.11 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.6
+11.17.11

package/autonomy/lib/efficiency_cost.py

@@ -295,12 +295,19 @@ def _merge_child_ledger(loki_dir, cost):
     cost["ledger"] = "present"
     cost["ledger_records"] = len(records)
     cost["ledger_invalid_lines"] = invalid
+    if invalid > 0:
+        # A line that could not be parsed is spend we cannot see: lower bound.
+        cost["cost_partial"] = True
     if not records:
         if by_phase:
             cost["cost_by_phase"] = by_phase
         return
     ledger_usd, priced, unpriced = 0.0, 0, 0
     main_known = bool(cost.get("available"))
+    # Main records exist but none carried a dollar figure (cost_available is
+    # False, set only by the token-only branch): the ledger-only total is a
+    # lower bound, never complete.
+    main_unpriced = main_known and cost.get("cost_available") is False
     tokens = {k: cost.get(k) for k in _LEDGER_TOKEN_KEYS}
     if not main_known:
         tokens = {k: 0 for k in _LEDGER_TOKEN_KEYS}
@@ -321,7 +328,7 @@ def _merge_child_ledger(loki_dir, cost):
     if priced:
         cost["usd"] = round((main_usd or 0.0) + ledger_usd, 4)
         cost["cost_available"] = True
-    partial = bool(cost.get("cost_partial")) or unpriced > 0 or not main_known
+    partial = bool(cost.get("cost_partial")) or unpriced > 0 or not main_known or main_unpriced
     cost["cost_partial"] = partial
     cost["cost_unpriced_records"] = int(cost.get("cost_unpriced_records") or 0) + unpriced
     if by_phase:

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.6"
+__version__ = "11.17.11"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.6. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.11. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.6
+**Version:** v11.17.11
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -404,10 +404,44 @@ set is declared to avoid overlap with those and with each other.
 | M-25 | Final report and verdict (COMPLETE only if all proven), sealed | loki-ts/src/engine10/modernize/report.ts, loki-ts/tests/engine10/modernize/report.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/report.test.ts | released@2026-10-16T02:40Z | Source: MODERNIZE.md (D30). Depends on M-13, M-21. |
 | M-26 | End-to-end: py2 fixture repo modernized with stub provider | loki-ts/tests/engine10/modernize/e2e.test.ts, loki-ts/tests/engine10/modernize/fixtures/e2e_py2/ | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/e2e.test.ts | released@2026-10-16T22:45Z | Source: MODERNIZE.md (D30). Depends on M-08, M-22, M-25. Reconciled 2026-10-16: shipped as ea6d2eef8 (ancestor of main c89555bce). |
 | M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | parked@2026-10-16T23:05Z | Source: MODERNIZE.md (D30). Depends on M-26. D34: absorbs the D30 large-tier legacy coverage. D98 park after round 2: round 2 opus BLOCK on fc2a7e90 (F1, budget-skipped units vanish, partial run counts ok). Carried forward as M-27b on top of fc2a7e90. |
-| M-27b | M-27 carry-forward: pilot counts planned units from wave.started/estimate.printed, unrun units are not proven, missing modernize.completed or non-zero exit is not ok, cost per 1K lines labelled lower bound | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | building@2026-10-16T23:05Z | Base fc2a7e90 (M-27 round 1 fixes). Source: M-27 round 2 HIGH review F1. Unblocks M-28. Round 1 BLOCK (no producer for modernize.completed, spend undercount, planned units); round 2 fix 7fc7c886 (test-pilot 32/0) in HIGH round 2 review. |
-| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/SCALE.md | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-27b (M-27 parked). |
+| M-27b | M-27 carry-forward: pilot counts planned units from wave.started/estimate.printed, unrun units are not proven, missing modernize.completed or non-zero exit is not ok, cost per 1K lines labelled lower bound | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | merged@2026-10-16T23:30Z | Base fc2a7e90 (M-27 round 1 fixes). Source: M-27 round 2 HIGH review F1. Unblocks M-28. Round 1 BLOCK (no producer for modernize.completed, spend undercount, planned units); round 2 fix 7fc7c886 (test-pilot 32/0) in HIGH round 2 review. Round 2 APPROVE 7fc7c886 (test-pilot 32/0, structural 25/0), merged; ships in 11.17.7. |
+| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/MODERNIZE.md section 12 | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | merged@2026-10-17T00:10Z | Merged 90f48b846 (fix ac1edf2e8, HIGH r2 APPROVE; test-pilot 48/0). 6db850558 HIGH r1 BLOCK (B1: scratch copy has no .git, so git ls-files sees 0 units); fixing for r2. Source: MODERNIZE.md (D30). Depends on M-27b (M-27 parked; M-27b merged 23:30Z). Dry-run harness only; the paid run needs --execute and --budget-usd. |
 | M-29 | 1M scale run (Hadoop 2.x Java 8 to 21, measured first) | eval/modernize/scale_1m.py, eval/modernize/SCALE-1M.md | HIGH | python3 eval/modernize/scale_1m.py --dry-run-first | ready@2026-09-28T02:45Z | Source: MODERNIZE.md (D30). Depends on M-28, M-11. |
-| M-25w | Modernize report and reslice event wired in production (FC-M25W): coordinator calls writeReport at run end, reslice.ts emits unit.resliced, and a guard asserts every declared modernize event has a producer | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/e2e.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | ready@2026-10-16T22:55Z | Source: M-27 HIGH review B2/B3 (FAILURE-CLASSES FC-M25W). Engine10 core is at 4999 of 5000 lines; the coordinator lives in src/util, keep engine10 edits net zero. |
+| M-25w | Modernize report and reslice event wired in production (FC-M25W): coordinator calls writeReport at run end, reslice.ts emits unit.resliced, and a guard asserts every declared modernize event has a producer | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/reslice.ts, loki-ts/tests/engine10/modernize/e2e.test.ts | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | merged@2026-10-16T23:45Z | Source: M-27 HIGH review B2/B3 (FAILURE-CLASSES FC-M25W). Engine10 core is at 4999 of 5000 lines; the coordinator lives in src/util, keep engine10 edits net zero. HIGH round 1 APPROVED 8836ea62 (engine10 2600 pass 0 fail, typecheck clean, 9 Seal probes fail closed). Ships in 11.17.7. |
+| M-25w-b | M-25w follow-ups: producer guard requires the event name inside an append( call (review mutations M2-M4 fooled it); coordinator calls reslice() so unit.resliced is emitted in real runs; unit.planned and codemod.skipped get producers and leave the allowlist (FC-M25W-b); pilot.py docstring no longer says no writer emits unit.resliced | loki-ts/src/util/modernize_coordinator.ts, loki-ts/src/engine10/modernize/, loki-ts/tests/engine10/modernize/, eval/modernize/pilot.py | HIGH | cd loki-ts && bun test tests/engine10/modernize/ | merged@2026-10-17T01:00Z | HIGH APPROVE 90868d3af (modernize 527 pass 0 fail, tsc 0, pilot 32/0; guard red on all 3 producer deletions) |
+| M-25w-c | Modernize producer guard hardening: hasProducer requires a word boundary before append( and ignores strings and comments; each declared modernize event has a behavioral producer test; pilot.py:425 stale "no writer emits unit.resliced" comment fixed; a codemod tool that exits non-zero logs an event | loki-ts/tests/engine10/modernize/log.test.ts, eval/modernize/pilot.py, loki-ts/src/util/modernize_coordinator.ts | MEDIUM | cd loki-ts && bun test tests/engine10/modernize/ | merged@2026-10-17T01:04Z | merge of 46df77c54 after TL APPROVE: 565 pass rc=0, pilot 48 passed, 2 mutations red |
+| REL-GUARD-b | REL-GUARD follow-ups: guard rows run in a clean detached worktree of HEAD, fail closed on missing tsv or zero suites, timeout 300, env -u LOKI_RUN_TMP | scripts/release.sh, scripts/impacted-gate.sh, tests/test-release-sh.sh, tests/test-impacted-gate.sh | HIGH | bash tests/test-release-sh.sh | merged@2026-10-16T23:46Z | Round 1 BLOCK 729cb804 (dirty-tree refusal blocked every main-checkout release); round 2 8d28a3a47 in final HIGH review (D98). Round 2 APPROVED (release-sh 43/0, dry run against the real global-guards.tsv with a dirty red row: PASS 23 suites rc 0 in 196s). Ships in 11.17.7. |
+| REL-GUARD-c | REL-GUARD-b follow-ups: an interrupted release leaves a registered guard worktree (prune does not reclaim it while the dir exists), so remove stale loki-guard.* registrations at function start or via a scoped trap; prune after the rm; log the chmod 700 failure branch | scripts/release.sh, tests/test-release-sh.sh | LOW | bash tests/test-release-sh.sh | merged@2026-10-16T23:51Z | c78236338+7fa0b91d9, LOW approved; release-sh 49/0, no-tmp-sweep 8/0, sigpipe 4/0.  Source: REL-GUARD-b HIGH round 2 non-blocking notes 1-3. |
+| Q17-01 | Slack "Run finished" message shows the stored receipt verdict, with TAMPERED or UNVERIFIED when the integrity check says so, not only the outcome. It also says "(unattested)" when no verdict is available. | loki-ts/src/util/slack_events.ts, loki-ts/src/engine10/supervisor.ts (the finished-event call site only), loki-ts/tests/engine10/slack_events.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/slack_events.test.ts tests/engine10/output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:57Z | merge of e2f197d94 after TL APPROVE (47 pass rc=0, mutation red 2 fail); follow-up: supervisor-level tampered test |
+| Q17-02 | engine10 console `Cost` line adds "N% of cap $X" when a run cap is set (`--max-cost` or `LOKI_E10_MAX_COST_USD`), so users see how close a `loki start` run came to its cap. Without a cap the line is byte-identical to today. | loki-ts/src/engine10/output.ts (costLine only), loki-ts/src/engine10/supervisor.ts (pass the resolved cap into the summary input), loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/output_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:07Z | TL BLOCK ff4c80939: no supervisor-level test for the capUsd pass-through; r1 fix building. |
+| Q17-03 | Verify's flaky list becomes a rerun signal in `decideRecovery`. A fail-then-pass check no longer burns a fix round, while a real failure still does. The fail-safe default is kept. | loki-ts/src/runner/recovery_policy.ts, loki-ts/tests/runner/harness_intelligence.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/harness_intelligence.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:52Z | TL APPROVE 3dec444fa (bun test runner+engine10+util 4157 pass 0 fail, 3/3 mutations red) |
+| Q17-04 | FC-68 siblings: `assert-wall-executed.sh` also fails the release smoke when an expected non-Wall check (lint, mutation proof, cross review) is missing from the receipt `checks[]` without a failing exit. | scripts/assert-wall-executed.sh, scripts/real-run.sh (SC_* knob in the existing scenario parser), tests/test-real-run-guards.sh | HIGH | `bash tests/test-real-run-guards.sh`; `bash -n scripts/assert-wall-executed.sh scripts/real-run.sh` | parked@2026-10-17T00:20Z | D98 park after HIGH r2 BLOCK on b617d3e1f: B1 fixed, B2 not; SC_EXPECT_CHECKS=node is met by the Wall check node:loki_wall_* alone (verify.ts:277, wall.ts:22), so a dropped non-Wall test still passes. Re-sliced as Q17-04b. r2 fix b617d3e1f (wall guard 36/0); HIGH r2 review running. FAILURE-CLASSES.md:643 FC-68 "Siblings: any other check a receipt could lose without a failing exit ... is not yet counted". Release gate, so HIGH. Needs red-then-green: a receipt with the lint check dropped must go red. |
+| Q17-04b | Q17-04 re-slice: real-run scenarios pin the exact non-Wall check names (trivial-sum node:sum.test.js, two-bug node:lib.test.js) on top of b617d3e1f, plus a guard test where only the Wall test is a node check and token node:sum.test.js fails | tests/real-run/scenarios/trivial-sum.sh, tests/real-run/scenarios/two-bug.sh, tests/test-wall-executed-guard.sh | MEDIUM | `bash tests/test-wall-executed-guard.sh`; `bash tests/test-sigpipe-guard.sh` | merged@2026-10-17T00:34Z | TL APPROVE e1bdde7d3 (bare-node mutation caught by structural check); merged with Q17-04 commits. Built e1bdde7d3 (wall guard 0 FAIL, shellcheck rc 0, sigpipe 4/0); TL review running. Source: Q17-04 HIGH r2 finding, fix option 1. Base b617d3e1f (branch q17-04). |
+| Q17-05 | Shipper sends the sha256 of each event line before redaction, so the Control Plane can tell a genuine redaction from a downgrade (FAILED edited to PARTIAL plus a planted [REDACTED]). Today such a log reads only "(unattested)" or UNVERIFIED. | loki-ts/src/util/redact.ts, packages/control-plane/src/server/integrity.ts, packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/integrity.test.ts`; `cd loki-ts && bun test tests/util/redact.test.ts` | rejected@2026-10-17T00:38Z | HIGH r1 BLOCK on 36524784d, design unsound (D12): client-supplied pre-redaction chain is trusted, so copying log.sealed events_sha256 makes a FAILED-to-VERIFIED forgery read attested and sig-checked; chain not bound to run id (cross-run replay). Not patchable in place; re-sliced as Q17-05b (engine-side redaction). Branch q17-05 kept. Built 36524784d (control-plane integrity 61/0, loki-ts util 286/0); HIGH r1 review running. FAILURE-CLASSES.md:140 deferred sibling of EL-FC08b. Delivered accuracy and Seal. A forged downgrade must read TAMPERED. Test file paths are the nearest existing ones; the engineer confirms by `ls`. |
+| Q17-05b | EL-FC08b at source: the engine redacts secrets in event data before it hashes the log and signs the seal, so an honest run holding a token ships byte-identical lines that the Control Plane hashes itself and reads VERIFIED; the shipper redaction becomes a no-op on already-redacted lines, and any later edit (including a planted [REDACTED]) reads TAMPERED. No client-supplied hash is ever trusted. | loki-ts/src/util/redact.ts, the engine event-log writer that computes events_sha256 (locate via git grep events_sha256 loki-ts/src), packages/control-plane/test/integrity.test.ts | HIGH | `cd packages/control-plane && bun test test/server/`; `cd loki-ts && bun test tests/util/ tests/engine10/` | ready@2026-10-17T00:38Z | Source: Q17-05 HIGH r1 (FAILURE-CLASSES.md:139-140). Architect pass first: confirm the writer call site and the parity with run.sh before building; forgery fixtures A-D from the Q17-05 review must read TAMPERED or UNVERIFIED, never VERIFIED. |
+| Q18-01 | FC-25c(b) remainder: control-plane shipper gitOrigin runs raw execFileSync("git") with a real-token env; convert to safeGit and make the raw-spawn guard scan packages/control-plane | packages/control-plane/src/shipper/discover.ts, loki-ts/tests/util/fc25_raw_spawn_guard.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_raw_spawn_guard.test.ts tests/util/fc25_safe_git.test.ts`; `cd packages/control-plane && bun test`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:50Z | HIGH APPROVE dbb93205a (bun test util 289 pass, 6/6 guard mutations caught); follow-up: comment integrations.ts:85 key-path split |
+| Q18-02 | FC-25c(a): allowToken keeps repo-local core.sshCommand, remote.*.uploadpack/receivepack and repo-scope credential.helper; pin them off while the user global helper still works | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/fc25_safe_git.test.ts`; `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:35Z | HIGH r1 APPROVE 730f27460: tests/util 289/0 rc=0, p9 4 PASS, 2 mutations each fail 1 test; merged 38b6b4b13, dist 3a1c1255c. Reviewer ran no hostile-repo probes, so those go to Q18-02b. |
+| Q18-02b | FC-25c(b): run the hostile-repo probes against safe_git allowToken and close any that leak: credential.helper with a leading !, credential.<url>.helper (including = in the url), include.path and includeIf, insteadOf to ext:: or file::, http.proxy and TLS keys, core.askPass, GIT_CONFIG_COUNT, extensions.worktreeConfig | loki-ts/src/util/safe_git.ts, loki-ts/tests/util/fc25_safe_git.test.ts | HIGH | `cd loki-ts && bun test tests/util/`; `bash tests/moat/p9-rule-of-two.sh` | building@2026-10-17T01:17Z | Source: Q18-02 r1 reviewer follow-ups (none were tested). One test per probe; any reproduced leak gets the fix in the same slice. After Q18-03 if both touch the moat case. |
+| Q18-03 | FC-25c guard: moat case fails if allowToken is passed outside base_guard.ts and modernize_unit.ts (SAFEGIT-REPOCONFIG 1+2) | tests/moat/p9-rule-of-two.sh | HIGH | `bash tests/moat/p9-rule-of-two.sh`; `cd loki-ts && bunx tsc --noEmit` | parked@2026-10-17T01:03Z | D98 r2 BLOCK 9a22006f6: moat run.sh rc=0 P9 PROVEN, but fetch-only pin is a prefix match (allowToken: args[0] === "fetch" || ... passes) and positional safeGitEnv check is single-line and stops at nested parens. Re-sliced as Q18-03b. |
+| Q18-03b | Moat P9 allowToken guard closes r2 bypasses: fetch-only pin must end at the option boundary; positional safeGitEnv and safeGitArgs opt-in detected across lines and with nested-call first arguments, whole-file, outside safe_git.ts | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | merged@2026-10-17T01:16Z | HIGH r2 APPROVE 531ad3376; merged 31e4f4b47. Follow-up Q18-03c. || widen and same-line second allowToken pass the pin; r1 fix: whole-file pin, occurrence count, alias imports fail closed |
+| Q18-04 | Deep-stage council has no production runner (deep always records "council (not wired)"); add a default CouncilRunner running one read-only reviewer session via the existing session runner; failure or oversize stays NOT PROVEN | loki-ts/src/engine10/stages/deep.ts, loki-ts/tests/engine10/deep_wiring.test.ts | HIGH | `cd loki-ts && bun test tests/engine10/deep.test.ts tests/engine10/deep_wiring.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:17Z | PO refill 2026-10-17, grep-checked not shipped: deep.ts:34-35, :139-140. Architect cut if over 30 min; engine10 line budget applies. |
+| Q18-05 | AI-BOM writer hook (MARK-3 named in ai_bom.ts header): after seal write a CycloneDX AI-BOM next to the receipt listing only what ran | loki-ts/src/contrib/ai_bom.ts, loki-ts/src/contrib/index.ts, loki-ts/src/engine10/hooks.ts, loki-ts/tests/features/ai_bom.test.ts | HIGH | `cd loki-ts && bun test tests/features/ai_bom.test.ts tests/engine10/seal.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T01:07Z | HIGH APPROVE 3adc5461a; merged 4f7a447db, dist 4a1dc5e65. Follow-ups: leak filter misses github_pat_/glpat-/AIza/npm_/hf_ and is case-sensitive; SAFE_NAME drops provider/model ids with an interior slash; pass a frozen receipt to hooks.sealed. |
+| Q18-06 | Stalled session never killed: session.stalled has no consumer; kill after LOKI_E10_STALL_KILL_S idle (default 0, off) and emit session.ended reason stalled | loki-ts/src/engine10/session.ts, loki-ts/src/runner/watchdog.ts, loki-ts/tests/engine10/session.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/session.test.ts tests/runner/watchdog.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T01:06Z | HIGH r2 APPROVE c612595ad; merged df0741e69, dist 538c04a41. |
+| Q18-07 | loki start heartbeat shows no ETA: estimateEtaS has no production caller; call it from the heartbeat line and record actuals at seal | loki-ts/src/engine10/output.ts, loki-ts/src/contrib/eta.ts, loki-ts/tests/engine10/output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output.test.ts tests/engine10/eta.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:17Z | PO refill 2026-10-17, grep-checked not shipped: grep estimateEtaS only output.ts:139. Wait for Q17-01/Q17-02 (output.ts overlap). |
+| Q18-08 | checkDecomposable (D61-09) has no production caller; call it in run_group after the DAG is written so a heavily overlapping DAG runs sequentially; invalid confirm keeps the deterministic DAG | loki-ts/src/features/speed/run_group.ts, loki-ts/tests/features/speed/group_output.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/decompose_check.test.ts tests/engine10/route_group.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:36Z | TL APPROVE 5a181823a: speed+seal_group+spawn_env_guard 61/0, tsc 0 non-control-plane errors, 3 mutations each red; merged 91264c08c, dist 64923228f. Report-only warning on stderr; forced sequential execution is out of scope. |
+| Q18-09 | Budget loader test: add the never-run mutation leg (drop one cache tier in the loader, must go red) | loki-ts/test/budget_cache_pricing.test.ts | LOW | `cd loki-ts && bun test test/budget_cache_pricing.test.ts`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:48Z | TL APPROVE ea65b07b7: real _loadPricing mutations cache_write_1h, cache_read, over_100k each red; baseline 10/0. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 195 follow-up. |
+| Q18-10 | select-tests.sh maps dashboard/web-app shell suites to handlers only by full path; add a route needle so a suite driving an API route by URL is selected when that handler changes | scripts/select-tests.sh, tests/test-select-tests.sh | MEDIUM | `bash tests/test-select-tests.sh`; `bash tests/test-select-tests-run.sh`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:30Z | TL APPROVE 24a708366: select-tests-run 14/0, sigpipe 4/0, route_needles mutation turns 2 new asserts red; merged ce7624e12. PO refill 2026-10-17, grep-checked not shipped: FAILURE-CLASSES line 360 still thin. |
+| Q18-11 | group.started/group.unit events and createGroupRenderer (D61-14) have no producer or caller; emit from backlog launcher callbacks and attach the renderer to group runs | loki-ts/src/features/speed/group_grid.ts, loki-ts/src/features/speed/group_output.ts, loki-ts/tests/engine10/output_group.test.ts | MEDIUM | `cd loki-ts && bun test tests/engine10/output_group.test.ts tests/features/speed/group_output.test.ts`; `cd loki-ts && bunx tsc --noEmit` | building@2026-10-17T01:17Z | PO refill 2026-10-17, grep-checked not shipped: Architect confirms file set apart from Q18-08 first; else hold until Q18-08 merges. |
+| Q18-03c | P9 allowToken guard residuals from Q18-03b r2: named re-export with as (export { safeGitEnv as x } from safe_git), indirect calls (const f = safeGitEnv; .apply; spread args), and a shadowed args default in a pinned file all give F=0 | tests/moat/p9-rule-of-two.sh | HIGH | bash tests/moat/run.sh | building@2026-10-17T01:17Z | Source: Q18-03b HIGH r2 notes 1, 2 and 4. Obfuscated key escapes (unicode escapes, computed concatenation) cannot be closed by grep; record as accepted residual. |
+| Q18-05b | AI-BOM filter gaps: secret filter misses github_pat_, glpat-, AIza, npm_, hf_, ASIA, sk_live_ and is case-sensitive; SAFE_NAME drops provider/model ids with one interior slash; hooks.sealed receives the live receipt (pass a frozen clone) | loki-ts/src/engine10/ai_bom.ts, loki-ts/src/engine10/stages/seal.ts, loki-ts/tests/engine10/ai_bom.test.ts | MEDIUM | cd loki-ts && bun test tests/engine10/ai_bom.test.ts tests/engine10/seal.test.ts | building@2026-10-17T01:17Z | Source: Q18-05 HIGH review notes. Keep engine10 core net zero. |
+| COST-WALL-f | Partial cost read as complete outside benchmarks: trust_trajectory cost_per_accepted_usd ignores cost.cost_partial; check cost-summary.py and proof-generator.py the same way, routing through one partial check | autonomy/lib/trust_trajectory.py, autonomy/lib/cost-summary.py, autonomy/lib/proof-generator.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest tests/test_efficiency_cost_availability.py -q | building@2026-10-17T01:17Z | Source: COST-WALL-e HIGH r1 note 4 (FC-COST-PARTIAL-b siblings). |
+| Q17-06 | COST-6 offline half: `attribution.py` dry-run prints a cost-per-accepted-task table with the ratio against raw Claude Code and against the 0.5x target, using existing result files, so the paid `--execute` run only has to plug in numbers. | benchmarks/bench/attribution.py, benchmarks/bench/test_attribution.py | MEDIUM | `python3 -I benchmarks/bench/attribution.py --dry-run`; `python3 -m pytest benchmarks/bench -k attribution -q` | merged@2026-10-17T00:10Z | Merged fe3a4e252 (6b9bd03d6; line-828 mutation caught: 1 failed 93 passed, restored 94 passed). COST-6 is parked as a paid eval needing a spend go. This re-slice needs no spend. Cost audit 2026-10-16: best measured run is 0.68x of raw, none reaches 0.5x. Report both floors (attribution.py:778). Confirm the test file name by `ls`. |
+| COST-HARN | C-F1 benchmark reports loki truthfully: real rc and stderr tail, origin remote for multi-unit seeds, v10 evidence readers, per-run evidence kept | benchmarks/bench/attribution.py, benchmarks/bench/adapters/loki.py, benchmarks/bench/adapters/_base.py | MEDIUM | python3 -m pytest benchmarks | merged@2026-10-16T23:42Z | Source: run3 diagnosis (PROGRESS 23:37Z). Round 1 BLOCK (fake origin let single-unit runs reach the PR stage); round 2 d1bb70593 APPROVED, pytest 86 passed rc=0. Ships in 11.17.7. |
+| COST-WALL | v10 child sessions (Wall stage and every other engine10 child spawn) append to .loki/metrics/child-sessions.jsonl so loki cost is not undercounted | loki-ts/src (shared spawn helper), autonomy/lib/efficiency_cost.py | HIGH | cd loki-ts && bun test | merged@2026-10-17T00:44Z | HIGH r1 APPROVE 10c040a70: 4 test files 180 pass 1 skip 0 fail, pytest 14 passed, ledger-write mutation red 2 tests, Wall counted once by stub test; merged, dist rebuilt. Follow-ups COST-WALL-b (reader F1) and COST-WALL-c (F2 wiring tests). F3: run3 Wall diagnosis unexplained, replay before any 2x claim. |
+| COST-WALL-b | FC-COST-PARTIAL: efficiency_cost reader marks cost_partial true when main records exist with tokens but no dollar figure, so a ledger-only total never reads as complete | autonomy/lib/efficiency_cost.py, tests/test_efficiency_cost_availability.py | HIGH | `python3 -m pytest tests/test_efficiency_cost_availability.py -q`; `bash tests/test-sigpipe-guard.sh` | merged@2026-10-17T00:50Z | HIGH APPROVE ddab3e714 (pytest 15 passed, mutation caught); follow-ups: C-F1 adapter ignores cost_partial (COST-WALL-d), unpriced count omits main records |
+| COST-WALL-c | Guard the child-ledger wiring: tests fail when quality_gates withChildLedger wrappers or the SDK ledger param are removed, and internal_sdk_judge cliLedger gets a test; record a ledger line when SDK messages.create throws after spending | loki-ts/src/commands/internal_sdk_judge.ts, loki-ts/tests/runner/quality_gates.test.ts, loki-ts/tests/runner/sdk_invoker.test.ts | MEDIUM | `cd loki-ts && bun test tests/runner/`; `cd loki-ts && bunx tsc --noEmit` | merged@2026-10-17T00:59Z | merge of e0a88304 after TL APPROVE: 219 pass rc=0, 2 mutations red |
+| COST-WALL-d | C-F1 benchmark honours cost_partial: the loki adapter passes cost_partial through and compute_metrics/row_true_spend treat it as a partial lower bound, never a complete measured cost | benchmarks/bench/adapters/loki.py, benchmarks/bench/attribution.py, its existing test file | HIGH | python3 -m pytest benchmarks -q -k attribution | merged@2026-10-17T01:02Z | merge of eef4e38b5 after HIGH r2 APPROVE: pytest 114 passed rc=0, fix revert turns test red; follow-ups in COST-WALL-e |
+| COST-WALL-e | One partial-cost helper used by every cost consumer (FC-COST-PARTIAL-b): equivalence_report.py and report.py honour cost_partial; row_spend_is_partial true for null cost with true cost set; invalid ledger lines and cost below ledger mark partial | benchmarks/bench/attribution.py, benchmarks/bench/equivalence_report.py, benchmarks/bench/report.py, autonomy/lib/efficiency_cost.py, benchmarks/bench/tests/test_attribution.py, tests/test_efficiency_cost_availability.py | HIGH | python3 -m pytest benchmarks/bench/tests/ tests/test_efficiency_cost_availability.py -q | merged@2026-10-17T01:30Z | HIGH r2 APPROVE 439ed90e3 (132 passed); merged into v11.17.11. Follow-ups in COST-WALL-f. |
 | M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | released@2026-09-28T21:01Z | Source: MODERNIZE.md (D30). Depends on M-07. Dispatched 18:58Z, sonnet engineer. Tech Lead REJECT r1 (--resume id failed MID_RE), APPROVE r2 5035984d; merged 8d568c66; test-modernize-docs.sh 25/0, shard coverage 19/0, durations drift 6/0. Released in v10.5.0 (merge 8d568c66 is an ancestor of v10.5.0). |
 | E-66 | "Already implemented" outcome: evidence search in code, tests, docs, CHANGELOG; no change needed verdict, receipt, issue comment, no PR | loki-ts/src/engine10 (intake or plan, implement marker path, seal, pr) | HIGH | fixture with the feature ends no change needed, no implement session; fixture without proceeds | released@2026-09-28T16:03Z | Source: D32 (augmentiq #52). Opus REJECT (reproduced): no test that ALREADY_SATISFIED opens no PR; evidence search matched 652 hits for an unrelated task on this repo; confirmation need not cite files. Rework dispatched. Rework 1c7e1b09 (branch worktree-wf_b707f4ab-24f-1): all 3 blockers fixed (no-PR test F5, 0 hits for both review sentences on this repo, citation must name an existing code or test hit; evidence in receipt). Opus CONCERN: the real-repo test uses listRepoFiles capped at 2000 of 4784 files, so removing STOP_WORDS still passes; the existsSync branch of the citation check is untested. Next: small fix (full file list in that test, one existsSync test). Wave E18 small fix (uncapped file list, existsSync test), branch slice-E-66-test-fixes. Opus APPROVE of 0a64ea98 (uncapped list, existsSync test). Merge onto main conflicts in seal.ts, supervisor.ts, types.ts, rule_of_two.test.ts after E-68/E-69; rebase dispatched (wave E19). D33: states its net core line delta; core must stay under 5,000 (92 lines of headroom shared by E-67, E-66, E-61, M-14, merge order E-67, E-66, E-61); offset any excess by deleting dead core code. Rework 135ba06b Opus APPROVE, but merged it takes core to 5,189 (D33 cap 5,000; `bun test tests/engine10/budget.test.ts`). Not merged. Next: offset about 190 core lines in the same slice (dead or duplicated core code), then merge. Wave E21 (wf_39ab3f7d-8f3). r3: D33 offset. Rework r3 605f33b0 Opus APPROVE (core under 5,000 after offset); merged into train E22 (9042e964): `bun test tests/engine10/` 547 pass 0 fail, tsc 0, `bash tests/test-v10-pulse.sh` 107 passed, `bash eval/loki10/test-harness.sh` 108 passed. Released in v10.2.1 (npm publish 2026-09-28T16:03Z; every cited commit is an ancestor of the v10.2.1 tag; `git merge-base --is-ancestor`). |
 | EV-13 | Eval expected_outcome no_change_needed; aiq-52 set to it | eval/loki10/harness.py, eval/loki10/tasks/aiq-52-searchbar, test-harness.sh | HIGH | bash eval/loki10/test-harness.sh | released@2026-09-28T05:00Z | Source: D32. Opus CONCERN: a correct v10 no-change run on aiq-52 is graded as a source change. Rework dispatched. Rework APPROVE (branch worktree-wf_b707f4ab-24f-5: 19224201, e0264724): v10 Wall side effect excluded from the diff check. Not merged yet. Merged c9c15f38 (trainE18); `bash eval/loki10/test-harness.sh` 103 passed 0 failed. Released in v10.1.0 (npm publish 2026-09-28T05:00Z; every cited commit is an ancestor of the v10.1.0 tag; `git merge-base --is-ancestor`). |
@@ -947,7 +981,9 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | COST-5 | Merge plan into implement via the plan chain resume (one fewer cold prefix) | loki-ts/src/engine10/stages/implement.ts | MEDIUM | conflict_resume tests | released@2026-10-16T01:20Z | Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | COST-6 | Measure cost per accepted task vs raw Claude Code: attribution.py --execute, 8 tasks, n=3, Sonnet 5.5, receipt cost.usd vs total_cost_usd; target ratio 0.5 | benchmarks/bench/attribution.py, docs/v10/METRICS.md | MEDIUM | attribution dry-run | parked@2026-10-16T00:12Z | paid eval, needs founder go on spend. Cost audit 2026-10-16: no measured run reaches 0.5x raw yet (best 0.68x lean config). |
 | FC-09u | FC-09 siblings: pnpm-workspace.yaml overrides/packageExtensions and .yarnrc.yml packageExtensions join RUNNER_CONFIGS | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | each probe caps | parked@2026-10-16T23:12Z | After FC-09t review. Built as 12a4c80a: runner_config.test.ts 135 pass 0 fail; typecheck clean. D98 park after round 2: opus BLOCK e07885d5, real pnpm 11.1.3 applied a link: override through a double BOM and a `? [foo]` explicit key while the check reported UNCAPPED (Bun.YAML vs js-yaml 4 divergence). Carried as FC-09v. |
-| FC-09v | FC-09u carry-forward: trust parsed YAML key comparison only when both sides are in a strict plain subset (no BOM, explicit ? keys, merge keys, anchors, aliases, tags, directives, doc markers, CR, tabs); any other byte change caps | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | both FC-09u reviewer probes print CAPPED for every bypass; plain unrelated-key edit does not cap | building@2026-10-16T23:12Z | Base e07885d5. Source: FC-09u round 2 HIGH review. Round 1 BLOCK cebe5641 (block-scalar parser differential reproduced with pnpm 11.1.3); round 2 per D101 caps on any byte change, building. |
+| FC-09v | FC-09u carry-forward: trust parsed YAML key comparison only when both sides are in a strict plain subset (no BOM, explicit ? keys, merge keys, anchors, aliases, tags, directives, doc markers, CR, tabs); any other byte change caps | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | both FC-09u reviewer probes print CAPPED for every bypass; plain unrelated-key edit does not cap | merged@2026-10-17T00:36Z | HIGH r2 APPROVE ea0a60c5: r1 bypass closed, 60 fuzz disagreement docs all cap, red-first 159/5 to 164/0, tsc rc=0; merged 14a6f92f0, dist bd008596d. Base e07885d5. Source: FC-09u round 2 HIGH review. Round 1 BLOCK cebe5641 (block-scalar parser differential reproduced with pnpm 11.1.3); round 2 per D101 caps on any byte change, building. |
+| FC-09w | Runner config registry matches case-insensitively, so a capitalized PNPM-Workspace.yaml or .YARNRC.yml (read by pnpm on macOS) caps trust; sweep every RUNNER_CONFIGS row; add .npmrc and patchedDependencies targets outside patches/ | loki-ts/src/features/runner_config.ts, the existing runner_config test file under loki-ts/tests/engine10 | HIGH | cd loki-ts && bun test tests/engine10/ | merged@2026-10-17T01:05Z | HIGH APPROVE 14aa30cc2 (runner_config 204 pass 0 fail, tsc 0, mutations 34 and 4 red, 11 bypass probes capped) |
+| FC-09x | Runner config trust gaps from the FC-09w review: top-level patchedDependencies (Bun form) compared by mapping like pnpm.patchedDependencies (add to PKG_KEYS); pnpm-workspace.yaml read with CRLF-safe line split; a multi-line yaml flow map for patchedDependencies is parsed or fails closed | loki-ts/src/features/runner_config.ts, loki-ts/tests/engine10/runner_config.test.ts | HIGH | cd loki-ts && bun test tests/engine10/runner_config.test.ts | merged@2026-10-17T01:16Z | TL APPROVE 437afd115; merged b97c1e635, dist 2eeec3851. |
 | CPE24-P2a | Checkpoint rollback restores only an allowlist (session.json, dashboard-state.json, CONTINUITY.md, autonomy-state.json, state, queue) and refuses nested symlinks | packages/control-plane/src/server/routes/checkpoints.ts plus test | MEDIUM | planted audit/ in a checkpoint does not overwrite .loki/audit | released@2026-10-15T23:55Z | rv-trust3 advisory on P2. |
 | CPE24-P4a | Legacy /api/control/* callers require ctx.local (or isLoopbackHost) like /v1 | packages/control-plane/src/server/legacy/routes-control.ts plus test | MEDIUM | non-loopback Host refused on legacy control | released@2026-10-15T23:55Z | rv-trust3 advisory on P4. |
 | CP-NITS1 | CP run page nits from the 10.10.2 smoke: Wall row describes the Wall ("Wrote acceptance checks (n files)" or "skipped: no checks written"); local repo with no remote shows the folder name, not REPO UNMEASURED; receipt text read from receipt.json on disk like the derived diff; diffstat failures cached (F1); leading-dash sha fixture | packages/control-plane/src/server plus ui run page plus tests | MEDIUM | CP suite green; a signed receipt on disk renders its text; a no-remote repo shows its folder name | released@2026-10-15T23:55Z | Peer smoke 21:27Z plus CP follow-up review F1. |

package/docs/v10/FAILURE-CLASSES.md

@@ -137,7 +137,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: one verdict-display function that returns TAMPERED whenever the run is tampered or its seal is invalid (CPE-27).
 - Fixture: an ingested run with tamper.detected never shows VERIFIED in any surface.
 - Sibling follow-up (EL-FC08b): redact at source in the engine before hashing. Today the shipper (redactEvent) and the server (redactSecrets) rewrite event data before the CP can hash it, so an honest signed run holding a token reads UNVERIFIED ("log redacted before ingest; seal not checkable"), never TAMPERED and never VERIFIED. Redacting before the engine hashes and signs would make such runs checkable end to end.
-- Sibling follow-up (deferred, not built in EL-FC08b): the shipper should send the sha256 of each line before redaction (alongside the redacted line). The CP could then check the seal over the original hashes and tell a genuine redaction from a downgrade (a FAILED log edited to PARTIAL plus a planted [REDACTED]); today such a log can only read "<verdict> (unattested)" or UNVERIFIED. This is the lasting fix for placeholder downgrades.
+- Sibling follow-up (deferred, not built in EL-FC08b): the shipper should send the sha256 of each line before redaction (alongside the redacted line). The CP could then check the seal over the original hashes and tell a genuine redaction from a downgrade (a FAILED log edited to PARTIAL plus a planted [REDACTED]); today such a log can only read "<verdict> (unattested)" or UNVERIFIED. This is the lasting fix for placeholder downgrades. REJECTED 2026-10-17 (Q17-05, HIGH r1 on 36524784d): a client-supplied original hash cannot be checked by the server, so a forger copies log.sealed events_sha256 into the shipped chain and a FAILED run displays VERIFIED; the chain is also unbound to the run id, so any signed seal replays onto any log. Rule: the CP never accepts a client-supplied hash in place of recomputing one over the bytes it received. The lasting fix is the line above: redact in the engine before hashing and signing (Q17-05b).
 - Sibling follow-up: the Slack summary, PR status and `loki status` do not yet read the CP effective_verdict.
 
 ## FC-09 A test-config edit outside scope can make broken code VERIFIED
@@ -152,6 +152,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Status (FC-09r): mechanism in `loki-ts/src/features/runner_config.ts`, read by verify.ts (testConfigChanged, base vs working tree) and seal.ts (runnerConfigNotes, base vs head, adds a NOT PROVEN line so the verdict cannot be VERIFIED). Fixtures: `loki-ts/tests/engine10/runner_config.test.ts` (real commit + seal stages).
 - Covered: bunfig.toml; vitest, vite, jest config and vitest.workspace; .mocharc; pytest.ini, tox.ini, conftest.py; pyproject.toml and setup.cfg pytest sections; .cargo/config.toml; preload, setupFiles, globalSetup and exact-file moduleNameMapper targets (jest rootDir resolved, explicit rootDir fails closed); `__mocks__/`; package.json scripts and resolution redirects; go.mod and go.work replace; Cargo.toml patch and replace; tsconfig paths; a changed config that fails to parse is capped, an unchanged broken one is not.
 - Deferred: transitive imports of setup files, pytest `-p` plugins and `pytest_plugins`, .mocharc `require`/`spec` targets, setupFiles given as identifiers or globs, Makefile go test flags.
+- FC-09w (P1, reproduced 2026-10-17 by the FC-09v r2 HIGH review): every RUNNER_CONFIGS pattern is case-sensitive, but macOS filesystems are case-insensitive, so adding `PNPM-Workspace.yaml` or `.YARNRC.yml` is not capped (notes 0) while real pnpm 11.1.3 reads the capitalized file. Siblings: every registry row (jest, vitest, bunfig, conftest and the rest). Mechanism: match case-insensitively across the whole registry in one place. Fixture: capitalized variants of each row cap in loki-ts/tests/engine10 runner_config tests. Also open (P2): patchedDependencies targets outside patches/ with non-.patch names, and .npmrc (registry=) are not in the registry.
 
 ## FC-10 Live line truncated to ~20 columns on a pty with no size
 - User saw: on a pty with no column size (script -q, CI, tmux before a resize, IDE terminals) the quiet-mode live status line was cut to about 20 characters, for example "[implement] implemen". Raw: the stage events were complete; only the rendering was wrong.
@@ -642,6 +643,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Law: evidence or it did not happen; a green that cannot go red is not a gate. Guard class: the root cause is FC-67 (WALL-NOTRUN holds that row); this row is the detection layer.
 - Siblings: any other check a receipt could lose without a failing exit (lint, mutation proof, cross review) is not yet counted; the guard asserts only checks[] executed >= 2 and the Wall test.
 - Mechanism: scripts/assert-wall-executed.sh reads the keys seal.ts writes (checks[].result, wall.files, wall.passed, not_proven[]). scripts/real-run.sh applies it to scenarios with SC_WALL_EXECUTED=1 (trivial-sum, two-bug). Post-Release Smoke npm-smoke runs it as a blocking step.
+- Q17-04 sibling guard: a scenario sets SC_EXPECT_CHECKS=lint,mutation,review and assert-wall-executed.sh (3rd arg) fails when a named check is absent or not_run in checks[]; unset keeps today's behavior.
 - Limit: the real trivial-sum and two-bug runs are billed and CI has no provider key, so Post-Release Smoke cannot run them unattended; the blocking step proves the guard logic on the released commit and runs the real scenario when a key is supplied.
 - Fixture: tests/test-wall-executed-guard.sh (11.3.1 shape passes, 11.3.2 shape fails, each leg alone fails).
 
@@ -853,7 +855,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: verify.ts already reruns once and marks fail-then-pass "flaky" (the evidence source); retry_class.ts classifyFailure is unchanged; the permanent-failure stop and the repeated-signature breaker still run before any new class.
 - Mechanism: recovery_policy.ts adds RecoverySignals rerun (same non-empty tree on fail and pass), protocolError and conflictingRequirements. Results: flaky -> retry, protocol_error -> revise, conflicting_requirements -> escalate. util/failure_memory.ts recordFingerprints (extends the existing failure-memory owner; flaky.json and failures.jsonl keep no per-run rows) appends fingerprints to .loki/state/fingerprints.jsonl (append-only, newest 200 kept) and supervisor.ts feeds verify's flaky list into it and the summary.
 - Fixture: loki-ts/tests/runner/harness_intelligence.test.ts "P12-11 recovery classes (FC-REQ)" (classifier table, fingerprints across two runs, bound).
-- Known limits: protocolError and conflictingRequirements have no producer wired yet (callers must set them from structured signals); fingerprints are recorded for flaky only and not yet read back by a policy rule; verify's flaky list is not yet fed to decideRecovery as a rerun signal (follow-up); engine10 renderMainOutput still passes flaky: [] (names reach the user via seal notProven); the bounding rewrite is best effort and a concurrent append can lose a row.
+- Known limits: protocolError and conflictingRequirements have no producer wired yet (callers must set them from structured signals); fingerprints are recorded for flaky only and not yet read back by a policy rule; verify's flaky list reaches decideRecovery as the rerun signal (P12-11b) and Q17-03 adds failedChecks so a real failure beside a flaky check still revises (failedChecks has no production producer yet, so absent data keeps flaky-wins); engine10 renderMainOutput still passes flaky: [] (names reach the user via seal notProven); the bounding rewrite is best effort and a concurrent append can lose a row.
 
 ## FC-P12-32 Router cost objective is built but dark in production (RESOLVED by P12-32b)
 - User-visible vs raw: no route decision changes today; the expected accepted-outcome cost ranking (history.ts routeScore, rankExecutorsByCost, haikuFloorExecutor) has no production caller.
@@ -872,3 +874,42 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings to sweep: every name in the modernize types.ts event list must have at least one producer in loki-ts/src; cost has no per-unit producer either (only budget.hit spent_usd at scheduler.ts:203).
 - Mechanism: the coordinator (loki-ts/src/util/modernize_coordinator.ts) calls writeReport once at the end of a run; reslice.ts appends unit.resliced; a guard test asserts every declared event name has a producer.
 - Fixture: loki-ts/tests/engine10/modernize/e2e.test.ts asserts report.json exists after the stub run; a new producer-coverage case in the existing modernize test file.
+
+## FC-M25W-b Modernize events unit.planned and codemod.skipped are declared with no producer (MODERNIZE-EVENT-DARK)
+- User-visible vs raw: the modernize event log never shows which units were planned or why a codemod was skipped, so a user cannot see the plan or a missing-tool reason; the raw cause is two names in the types.ts event list with no append call.
+- Law broken: a control nobody reads is theatre (event declared with no producer).
+- Cause (measured 2026-10-16, M-25w build): `grep -rn "unit.planned\|codemod.skipped" loki-ts/src` finds only types.ts:8-9 and comments in codemod.ts:4,10; the M-25w producer guard allowlists both names.
+- Siblings to sweep: every name in the modernize types.ts event list; the allowlist in the M-25w producer guard must shrink to empty.
+- Mechanism: the planner appends unit.planned once per unit; the codemod caller appends codemod.skipped with the reason codemod.ts already returns; then delete both allowlist entries so the existing guard covers them.
+- Fixture: the M-25w producer-coverage case with an empty allowlist.
+
+## FC-COST-PARTIAL A cost total built from ledger lines alone is reported as complete when the main records carry tokens but no dollar figure (COST-PARTIAL-HIDDEN)
+- User-visible vs raw: `loki` cost and the C-F1 benchmark show a small total with cost_partial false, so a run looks cheaper than it was and the 2x cost claim could rest on an understated number.
+- Law broken: a total that omits unpriced spend must say it is a lower bound.
+- Cause (measured 2026-10-17, COST-WALL HIGH review F1): autonomy/lib/efficiency_cost.py lines 316-325; a main efficiency record with tokens and no cost_usd plus one priced child-ledger line gives usd 0.01, cost_partial False. engine10 omits cost_usd when a session reports no dollar figure.
+- Siblings to sweep: every reader of cost_partial (autonomy/lib/cost-summary.py, the C-F1 benchmark row_true_spend, dashboard cost views).
+- Mechanism: when main records exist and cost_available is false, set cost_partial true in the one reader; siblings consume that flag.
+- Fixture: tests/test_efficiency_cost_availability.py case with token-only main record plus a priced ledger line asserts cost_partial true.
+
+## FC-REALRUN-FIXTURE A pinned scenario expectation changed without the fixture receipt that the harness self-test checks it against (REALRUN-FIXTURE-DRIFT)
+- User-visible vs raw: v11.17.8 never published; Tests run 38986362613 failed only "real-run harness scenarios, dry install, doctored receipt" with `FAIL wall-guard: expected check "node:sum.test.js" executed in checks[]`.
+- Law broken: a change to an expectation must update every fixture that exercises it in the same slice.
+- Cause (measured 2026-10-17): Q17-04b (e1bdde7d3) set SC_EXPECT_CHECKS=node:sum.test.js in tests/real-run/scenarios/trivial-sum.sh; tests/test-real-run.sh good.json still named its checks "a" and "b". The slice gate ran tests/test-wall-executed-guard.sh but not tests/test-real-run.sh.
+- Siblings to sweep: every user of --check-receipt or SC_EXPECT_CHECKS (grep finds only tests/test-real-run.sh, tests/test-wall-executed-guard.sh, scripts/real-run.sh).
+- Mechanism: the fixture names the pinned check; slice cards touching tests/real-run/scenarios list tests/test-real-run.sh in their commands.
+- Fixture: tests/test-real-run.sh good receipt passes (13 PASS, rc=0 locally after the fix).
+
+## FC-COST-PARTIAL-b Partial cost still readable as complete in sibling consumers (COST-PARTIAL-SIBLINGS)
+- User-visible vs raw: a run whose cost is only partly measured can still be shown as a complete number in the runner equivalence report, the bench-run report, or a spend-cap message without its lower-bound label.
+- Law broken: one shared mechanism (FC-COST-PARTIAL fixed attribution.py only; siblings read cost without the partial flag).
+- Cause (COST-WALL-d HIGH reviews 2026-10-17): equivalence_report.py:334-374 and report.py:280 ignore adapter.provenance.cost_partial; row_spend_is_partial returns False for cost_usd None with true_cost_usd set; efficiency_cost.py counts ledger_invalid_lines without setting cost_partial; a stored cost_usd 0.0 with a larger true_cost_usd renders complete.
+- Mechanism: one helper decides partial (null cost, cost below ledger or true cost, invalid ledger lines, unpriced lines) and every cost consumer calls it.
+- Fixture: cases in benchmarks/bench/tests/test_attribution.py and tests/test_efficiency_cost_availability.py for each sibling.
+
+## FC-25c-ci Git env overrides leaked by an earlier suite silence repo-config controls (GIT-ENV-LEAK)
+- User-visible vs raw: v11.17.9 never published; Tests run 38988194257 failed 2 FC-25c(a) controls on ubuntu while they passed locally per file.
+- Law broken: a test must be hermetic; a control that depends on process-wide state is not a control.
+- Cause (reproduced 2026-10-17): runAutonomous (autonomous.ts:448) and issues_run.ts:512 call withholdGithubTokens on process.env inside the shared bun process, leaving GIT_SSH_COMMAND=false and a GIT_CONFIG_COUNT credential.helper reset; both override repo config. Running the old file with those four variables set reproduces exactly the 2 CI failures.
+- Siblings to sweep: every test that asserts a repo-local git config value runs (fsmonitor, filter, ssh, credential, uploadpack).
+- Mechanism: hermeticGit wrapper in fc25_safe_git.test.ts removes GIT_SSH, GIT_SSH_COMMAND, GIT_CONFIG_PARAMETERS and GIT_CONFIG_COUNT/KEY/VALUE for the test and restores them after.
+- Fixture: the same file run with GIT_SSH_COMMAND=false GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=credential.helper GIT_CONFIG_VALUE_0= passes 14/0.

package/docs/v10/MODERNIZE.md

@@ -327,6 +327,7 @@ The report never states more than the equivalence data proves. It is sealed and
 - V10-RESEARCH cites Legacy-Bench only through a vendor report.
 - The slice first confirms that a public task set exists and records its URL and license. If none exists, the pilot uses 10 public py2 and Java 8 repos under 20K lines, each with a suite, and says so.
 - Gate: the equivalence rate on the pilot is published, and the sizing cap is calibrated from it.
+- Calibration factors (eval/modernize/pilot-manifest.json): raise x1.25 at 90% or higher, lower x0.75 below, clamp 300-6000 lines, round to 50; hold when any run failed or was skipped.
 
 **2. 200K-line scale test (M-28)**
 - Chosen candidate: Mercurial at its last Python 2 only release, 4.x (py2 to 3).
@@ -337,6 +338,11 @@ The report never states more than the equivalence data proves. It is sealed and
   - the license (GPL) allows running it.
 - Why: it is a real Python 2 codebase with a large suite of its own (`run-tests.py`), and upstream later completed the Python 3 port, so a human reference exists.
 - The line count is UNVERIFIED offline. M-28 measures it first with `--dry-run` inventory and `cloc`. If the count is under 200K or the suite is unbounded, the named fallback is Calibre before its Python 3 port, and the choice is recorded again.
+- Operator notes (`eval/modernize/scale.py`, M-28; extends pilot.py, no separate SCALE.md):
+  - `python3 eval/modernize/scale.py --target hg --dry-run-first [--source PATH] [--fallback-source PATH]` is the default and spends nothing. It resolves the source (a local `--source` is read in place and copied for the estimate; otherwise it clones Mercurial 4.9.1 with `hg` or Calibre v3.48.0 with the Git CLI; both refs UNVERIFIED offline), counts lines per language excluding vendored directories, runs `loki modernize --to python3 --dry-run`, and prints JSON: planned units, waves, estimated cost, the unit line cap (pilot manifest `cap.start_lines`), the spend cap (null until `--budget-usd`), and a suggested budget of 1.5x the estimate.
+  - Selection: hg unavailable (no `hg`, clone failure, bad `--source`) or under `--min-lines` (default 200000) falls back to Calibre. Each step is logged to stderr and to `selection_log`. If no candidate meets the floor the run exits 2.
+  - The paid run needs `--execute` AND `--budget-usd` greater than 0, else exit 2 before any clone or spend. It runs through `pilot.execute_repo`, so cost, status and calibration follow the M-27b rules (cost is a lower bound; unmeasured spend is charged at the full budget). Results: `eval/modernize/results/pilot-scale-<ts>.json`.
+  - Known limit: `source_lines` in the paid result comes from pilot's counter and includes vendored code, so cost per 1K lines is understated against the measured plan figure.
 
 **3. 1M lines (M-29)**
 - Chosen candidate: Apache Hadoop 2.x (Java 8 to 21). It is Java 8, multi-module, and has an extensive JUnit suite.
@@ -386,7 +392,7 @@ The report never states more than the equivalence data proves. It is sealed and
 | M-25 | Final report and verdict (COMPLETE only if all proven), sealed | mod/report.ts, T/report.test.ts | HIGH | Wb T/report.test.ts | M-13, M-21 |
 | M-26 | End-to-end: py2 fixture repo modernized with stub provider | T/e2e.test.ts, T/fixtures/e2e_py2/ | MEDIUM | Wb T/e2e.test.ts | M-08, M-22, M-25 |
 | M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | M-26 |
-| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/SCALE.md | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | M-27 |
+| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py (notes in section 12) | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | M-27 |
 | M-29 | 1M scale run (Hadoop 2.x Java 8 to 21, measured first) | eval/modernize/scale_1m.py, eval/modernize/SCALE-1M.md | HIGH | python3 eval/modernize/scale_1m.py --dry-run-first | M-28, M-11 |
 | M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | M-07 |
 

package/docs/v10/PROGRESS.md

@@ -2400,3 +2400,11 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - 2026-10-16T23:05Z M-27 parked per D98: round 2 opus HIGH review BLOCK on fc2a7e90 (test-pilot.sh 26 passed 0 failed, but repro of a 10-unit plan with 1 PROVEN unit then budget.hit gave status ok, equivalence 1.0, calibrate_cap action raise). Carried as M-27b (building). FC-09u built as 12a4c80a (runner_config.test.ts 135 pass 0 fail, typecheck no error TS), in opus HIGH review. v11.17.5 (99b96ffcc) Tests and Release running.
 - 2026-10-16T23:15Z drift audit (last 6h vs CONTROL.md): 299 commits, 6 release cuts (v11.17.0-v11.17.5), but `npm view loki-mode dist-tags` shows next=11.17.1 only; 11.17.2, 11.17.3 and 11.17.4 never published, each red on a CI-only guard that release.sh skips under LOKI_RELEASE_ALLOW_RED=1. Drift: cut cadence met, publish cadence 1 of 6. Fix dispatched as REL-GUARD (release.sh runs the select-tests.sh --guards-only rows even under ALLOW_RED). Also: S11 run2 measured stale global v11.3.9; stopped, rerun as run3 on repo bin (v11.17.5); COST-BIN merged a05462951.
 - 2026-10-16T23:25Z v11.17.6: v11.17.5 published (npm next 11.17.5, gh release v11.17.5 draft=false, Tests and Release completed success on 99b96ffcc). Ships COST-BIN (bench tests 79 pass) and D101. Drift audit vs CONTROL.md: M-27b round 1 BLOCK (F1 no modernize.completed producer), round 2 fix 7fc7c886 test-pilot 32/0 in HIGH review; FC-09v round 1 BLOCK cebe5641 (block-scalar bypass reproduced with pnpm install), round 2 fail-closed per D101 building; REL-GUARD and M-25w in flight; S11 run3 on repo v11.17.5 in progress. Cost goal still unproven.
+- 2026-10-16T23:31Z drift audit vs CONTROL.md: v11.17.6 pushed d84ef9568 (COST-BIN, REL-GUARD, D101), Tests/Release in flight. M-27b APPROVE round 2 7fc7c886 merged aa0bb8971 (ships 11.17.7). In flight: FC-09v round 2 (D101 fail-closed), M-25w HIGH review of 8836ea62, REL-GUARD-b, run3 diagnosis. S11 run3 result: loki about 0.57x raw-configured per accepted task but 24/24 loki runs rc 1, coord-1 and longspec-1 fail in 0.2s, raw-bare 24/24 unmeasured; cost goal stays unproven. Pruned 4 merged clean worktrees.
+- 2026-10-16T23:37Z run3 diagnosis (read-only, no spend): loki rc 1 on every run because seeds have no executable test, so FC-16 gives PARTIAL (exit 1) even when the held-out test accepts; coord-1 and longspec-1 fail in 0.2s at run_group.ts:177/216 (materialize_seed adds no origin remote); raw-bare unmeasured (no ANTHROPIC_API_KEY); loki cost omits v10 Wall-stage child sessions (18 loki-e15-wall-* transcripts, about $1.18). Corrected loki about $0.184 per accepted vs raw-configured $0.195: the 2x cost goal is NOT proven. Dispatched COST-HARN (bench rc, remote, v10 evidence) and COST-WALL (child-session ledger).
+- 2026-10-17T00:05Z v11.17.7: ships M-27b pilot accounting, COST-HARN benchmark fixes, M-25w sealed modernize report and producer guard, REL-GUARD-b/c release guard worktree. Bump via scripts/release.sh patch --bump-only rc=0 (~/loki-ci-logs/bump-11177.log).
+- 2026-10-17T00:22Z drift audit (last 6h vs CONTROL.md): 281 commits, releases 11.17.6 and 11.17.7 only, so the :00/:20/:40 cadence (D37) is missed; cause is serial HIGH review rounds, not red CI. D12/D98 held: Q17-04 parked after HIGH r2 BLOCK (B2 reproduced) and re-sliced as Q17-04b; M-28 merged only after HIGH r2 APPROVE. Ready queue 8, at the CONTROL floor but under the OPERATING-MODEL 30; PO refill dispatched. M-28 and Q17-06 merged-unreleased; v11.17.8 cut follows the v11.17.7 publish.
+- 2026-10-17T00:22Z v11.17.8: v11.17.7 never published (Tests run 38984591460 red on e66c51a09, sole failing suite Tier A test selector FC-89: log.test.ts walks loki-ts/src without the walk-all-src marker; Release failed at required-ci). Fixed in c6faaa885 (test-select-tests.sh 95 passed, 0 failed). Ships v11.17.7 content plus M-28, Q17-06, Q17-04b, Q18-09. Bumped with LOKI_RELEASE_ALLOW_RED=1 because HEAD had no Tests run yet; global guard rows ran in the clean worktree (bump rc=0).
+- 2026-10-17T00:50Z v11.17.9: v11.17.8 never published (Tests run 38986362613 red on 7fc08f186, only suite tests/test-real-run.sh, fixture receipt lacked the pinned node:sum.test.js check). Fixed in 500b71e85; test-real-run.sh rc=0 (13 PASS), test-wall-executed-guard.sh rc=0. Also merges Q17-03 (TL APPROVE 3dec444fa, 4157 pass 0 fail), COST-WALL-b (HIGH APPROVE ddab3e714, pytest 15 passed, mutation caught) and Q18-01 (HIGH APPROVE dbb93205a, bun test 289 pass, guard mutations 6/6 caught). Bumped with LOKI_RELEASE_ALLOW_RED=1 (HEAD had no green Tests run). C-F1 2x cost claim still unproven: benchmark adapter ignores cost_partial (follow-up COST-WALL-d).
+- 2026-10-17T01:10Z v11.17.10: v11.17.9 never published (Tests run 38988194257 red on bf3d2ae24: 2 FC-25c(a) controls failed because withholdGithubTokens callers left GIT_SSH_COMMAND=false and a GIT_CONFIG_COUNT credential.helper reset in process.env). Fixed in 3c3f2c9e0 (hermeticGit wrapper); old file under those 4 vars reproduces 2 fail, fixed file 14 pass 0 fail. Ships Q17-01, COST-WALL-c, COST-WALL-d, M-25w-b, M-25w-c, FC-09w, Q18-06 (HIGH r2 APPROVE), Q18-05 (HIGH APPROVE). Pending: Q18-03b and FC-09x approved, merge next; COST-WALL-e and Q17-02 blocked r1, fixing; 2x cost claim still unproven.
+- 2026-10-17T01:30Z v11.17.11: ships Q18-03b (merge 31e4f4b47) FC-09x (merge b97c1e635, dist 2eeec3851) and COST-WALL-e (HIGH r2 APPROVE 439ed90e3, 132 passed). Founder asked for 10/10 on every competitive axis; architect workflow wrixi4afj is slicing COST, QUALITY, DEPLOY, UX, GATES, STABILITY and ADOPTION into board rows. Q17-02 r1 fix 11eac46fa in TL r2 review.