loki-mode 11.17.6 → 11.17.13

package/docs/v10/FAILURE-CLASSES.md

@@ -137,7 +137,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: one verdict-display function that returns TAMPERED whenever the run is tampered or its seal is invalid (CPE-27).
 - Fixture: an ingested run with tamper.detected never shows VERIFIED in any surface.
 - Sibling follow-up (EL-FC08b): redact at source in the engine before hashing. Today the shipper (redactEvent) and the server (redactSecrets) rewrite event data before the CP can hash it, so an honest signed run holding a token reads UNVERIFIED ("log redacted before ingest; seal not checkable"), never TAMPERED and never VERIFIED. Redacting before the engine hashes and signs would make such runs checkable end to end.
-- Sibling follow-up (deferred, not built in EL-FC08b): the shipper should send the sha256 of each line before redaction (alongside the redacted line). The CP could then check the seal over the original hashes and tell a genuine redaction from a downgrade (a FAILED log edited to PARTIAL plus a planted [REDACTED]); today such a log can only read "<verdict> (unattested)" or UNVERIFIED. This is the lasting fix for placeholder downgrades.
+- Sibling follow-up (deferred, not built in EL-FC08b): the shipper should send the sha256 of each line before redaction (alongside the redacted line). The CP could then check the seal over the original hashes and tell a genuine redaction from a downgrade (a FAILED log edited to PARTIAL plus a planted [REDACTED]); today such a log can only read "<verdict> (unattested)" or UNVERIFIED. This is the lasting fix for placeholder downgrades. REJECTED 2026-10-17 (Q17-05, HIGH r1 on 36524784d): a client-supplied original hash cannot be checked by the server, so a forger copies log.sealed events_sha256 into the shipped chain and a FAILED run displays VERIFIED; the chain is also unbound to the run id, so any signed seal replays onto any log. Rule: the CP never accepts a client-supplied hash in place of recomputing one over the bytes it received. The lasting fix is the line above: redact in the engine before hashing and signing (Q17-05b).
 - Sibling follow-up: the Slack summary, PR status and `loki status` do not yet read the CP effective_verdict.
 
 ## FC-09 A test-config edit outside scope can make broken code VERIFIED
@@ -152,6 +152,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Status (FC-09r): mechanism in `loki-ts/src/features/runner_config.ts`, read by verify.ts (testConfigChanged, base vs working tree) and seal.ts (runnerConfigNotes, base vs head, adds a NOT PROVEN line so the verdict cannot be VERIFIED). Fixtures: `loki-ts/tests/engine10/runner_config.test.ts` (real commit + seal stages).
 - Covered: bunfig.toml; vitest, vite, jest config and vitest.workspace; .mocharc; pytest.ini, tox.ini, conftest.py; pyproject.toml and setup.cfg pytest sections; .cargo/config.toml; preload, setupFiles, globalSetup and exact-file moduleNameMapper targets (jest rootDir resolved, explicit rootDir fails closed); `__mocks__/`; package.json scripts and resolution redirects; go.mod and go.work replace; Cargo.toml patch and replace; tsconfig paths; a changed config that fails to parse is capped, an unchanged broken one is not.
 - Deferred: transitive imports of setup files, pytest `-p` plugins and `pytest_plugins`, .mocharc `require`/`spec` targets, setupFiles given as identifiers or globs, Makefile go test flags.
+- FC-09w (P1, reproduced 2026-10-17 by the FC-09v r2 HIGH review): every RUNNER_CONFIGS pattern is case-sensitive, but macOS filesystems are case-insensitive, so adding `PNPM-Workspace.yaml` or `.YARNRC.yml` is not capped (notes 0) while real pnpm 11.1.3 reads the capitalized file. Siblings: every registry row (jest, vitest, bunfig, conftest and the rest). Mechanism: match case-insensitively across the whole registry in one place. Fixture: capitalized variants of each row cap in loki-ts/tests/engine10 runner_config tests. Also open (P2): patchedDependencies targets outside patches/ with non-.patch names, and .npmrc (registry=) are not in the registry.
 
 ## FC-10 Live line truncated to ~20 columns on a pty with no size
 - User saw: on a pty with no column size (script -q, CI, tmux before a resize, IDE terminals) the quiet-mode live status line was cut to about 20 characters, for example "[implement] implemen". Raw: the stage events were complete; only the rendering was wrong.
@@ -642,6 +643,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Law: evidence or it did not happen; a green that cannot go red is not a gate. Guard class: the root cause is FC-67 (WALL-NOTRUN holds that row); this row is the detection layer.
 - Siblings: any other check a receipt could lose without a failing exit (lint, mutation proof, cross review) is not yet counted; the guard asserts only checks[] executed >= 2 and the Wall test.
 - Mechanism: scripts/assert-wall-executed.sh reads the keys seal.ts writes (checks[].result, wall.files, wall.passed, not_proven[]). scripts/real-run.sh applies it to scenarios with SC_WALL_EXECUTED=1 (trivial-sum, two-bug). Post-Release Smoke npm-smoke runs it as a blocking step.
+- Q17-04 sibling guard: a scenario sets SC_EXPECT_CHECKS=lint,mutation,review and assert-wall-executed.sh (3rd arg) fails when a named check is absent or not_run in checks[]; unset keeps today's behavior.
 - Limit: the real trivial-sum and two-bug runs are billed and CI has no provider key, so Post-Release Smoke cannot run them unattended; the blocking step proves the guard logic on the released commit and runs the real scenario when a key is supplied.
 - Fixture: tests/test-wall-executed-guard.sh (11.3.1 shape passes, 11.3.2 shape fails, each leg alone fails).
 
@@ -853,7 +855,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: verify.ts already reruns once and marks fail-then-pass "flaky" (the evidence source); retry_class.ts classifyFailure is unchanged; the permanent-failure stop and the repeated-signature breaker still run before any new class.
 - Mechanism: recovery_policy.ts adds RecoverySignals rerun (same non-empty tree on fail and pass), protocolError and conflictingRequirements. Results: flaky -> retry, protocol_error -> revise, conflicting_requirements -> escalate. util/failure_memory.ts recordFingerprints (extends the existing failure-memory owner; flaky.json and failures.jsonl keep no per-run rows) appends fingerprints to .loki/state/fingerprints.jsonl (append-only, newest 200 kept) and supervisor.ts feeds verify's flaky list into it and the summary.
 - Fixture: loki-ts/tests/runner/harness_intelligence.test.ts "P12-11 recovery classes (FC-REQ)" (classifier table, fingerprints across two runs, bound).
-- Known limits: protocolError and conflictingRequirements have no producer wired yet (callers must set them from structured signals); fingerprints are recorded for flaky only and not yet read back by a policy rule; verify's flaky list is not yet fed to decideRecovery as a rerun signal (follow-up); engine10 renderMainOutput still passes flaky: [] (names reach the user via seal notProven); the bounding rewrite is best effort and a concurrent append can lose a row.
+- Known limits: protocolError and conflictingRequirements have no producer wired yet (callers must set them from structured signals); fingerprints are recorded for flaky only and not yet read back by a policy rule; verify's flaky list reaches decideRecovery as the rerun signal (P12-11b) and Q17-03 adds failedChecks so a real failure beside a flaky check still revises (failedChecks has no production producer yet, so absent data keeps flaky-wins); engine10 renderMainOutput still passes flaky: [] (names reach the user via seal notProven); the bounding rewrite is best effort and a concurrent append can lose a row.
 
 ## FC-P12-32 Router cost objective is built but dark in production (RESOLVED by P12-32b)
 - User-visible vs raw: no route decision changes today; the expected accepted-outcome cost ranking (history.ts routeScore, rankExecutorsByCost, haikuFloorExecutor) has no production caller.
@@ -872,3 +874,105 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings to sweep: every name in the modernize types.ts event list must have at least one producer in loki-ts/src; cost has no per-unit producer either (only budget.hit spent_usd at scheduler.ts:203).
 - Mechanism: the coordinator (loki-ts/src/util/modernize_coordinator.ts) calls writeReport once at the end of a run; reslice.ts appends unit.resliced; a guard test asserts every declared event name has a producer.
 - Fixture: loki-ts/tests/engine10/modernize/e2e.test.ts asserts report.json exists after the stub run; a new producer-coverage case in the existing modernize test file.
+
+## FC-M25W-b Modernize events unit.planned and codemod.skipped are declared with no producer (MODERNIZE-EVENT-DARK)
+- User-visible vs raw: the modernize event log never shows which units were planned or why a codemod was skipped, so a user cannot see the plan or a missing-tool reason; the raw cause is two names in the types.ts event list with no append call.
+- Law broken: a control nobody reads is theatre (event declared with no producer).
+- Cause (measured 2026-10-16, M-25w build): `grep -rn "unit.planned\|codemod.skipped" loki-ts/src` finds only types.ts:8-9 and comments in codemod.ts:4,10; the M-25w producer guard allowlists both names.
+- Siblings to sweep: every name in the modernize types.ts event list; the allowlist in the M-25w producer guard must shrink to empty.
+- Mechanism: the planner appends unit.planned once per unit; the codemod caller appends codemod.skipped with the reason codemod.ts already returns; then delete both allowlist entries so the existing guard covers them.
+- Fixture: the M-25w producer-coverage case with an empty allowlist.
+
+## FC-COST-PARTIAL A cost total built from ledger lines alone is reported as complete when the main records carry tokens but no dollar figure (COST-PARTIAL-HIDDEN)
+- User-visible vs raw: `loki` cost and the C-F1 benchmark show a small total with cost_partial false, so a run looks cheaper than it was and the 2x cost claim could rest on an understated number.
+- Law broken: a total that omits unpriced spend must say it is a lower bound.
+- Cause (measured 2026-10-17, COST-WALL HIGH review F1): autonomy/lib/efficiency_cost.py lines 316-325; a main efficiency record with tokens and no cost_usd plus one priced child-ledger line gives usd 0.01, cost_partial False. engine10 omits cost_usd when a session reports no dollar figure.
+- Siblings to sweep: every reader of cost_partial (autonomy/lib/cost-summary.py, the C-F1 benchmark row_true_spend, dashboard cost views).
+- Mechanism: when main records exist and cost_available is false, set cost_partial true in the one reader; siblings consume that flag.
+- Fixture: tests/test_efficiency_cost_availability.py case with token-only main record plus a priced ledger line asserts cost_partial true.
+
+## FC-REALRUN-FIXTURE A pinned scenario expectation changed without the fixture receipt that the harness self-test checks it against (REALRUN-FIXTURE-DRIFT)
+- User-visible vs raw: v11.17.8 never published; Tests run 38986362613 failed only "real-run harness scenarios, dry install, doctored receipt" with `FAIL wall-guard: expected check "node:sum.test.js" executed in checks[]`.
+- Law broken: a change to an expectation must update every fixture that exercises it in the same slice.
+- Cause (measured 2026-10-17): Q17-04b (e1bdde7d3) set SC_EXPECT_CHECKS=node:sum.test.js in tests/real-run/scenarios/trivial-sum.sh; tests/test-real-run.sh good.json still named its checks "a" and "b". The slice gate ran tests/test-wall-executed-guard.sh but not tests/test-real-run.sh.
+- Siblings to sweep: every user of --check-receipt or SC_EXPECT_CHECKS (grep finds only tests/test-real-run.sh, tests/test-wall-executed-guard.sh, scripts/real-run.sh).
+- Mechanism: the fixture names the pinned check; slice cards touching tests/real-run/scenarios list tests/test-real-run.sh in their commands.
+- Fixture: tests/test-real-run.sh good receipt passes (13 PASS, rc=0 locally after the fix).
+
+## FC-COST-PARTIAL-b Partial cost still readable as complete in sibling consumers (COST-PARTIAL-SIBLINGS)
+- User-visible vs raw: a run whose cost is only partly measured can still be shown as a complete number in the runner equivalence report, the bench-run report, or a spend-cap message without its lower-bound label.
+- Law broken: one shared mechanism (FC-COST-PARTIAL fixed attribution.py only; siblings read cost without the partial flag).
+- Cause (COST-WALL-d HIGH reviews 2026-10-17): equivalence_report.py:334-374 and report.py:280 ignore adapter.provenance.cost_partial; row_spend_is_partial returns False for cost_usd None with true_cost_usd set; efficiency_cost.py counts ledger_invalid_lines without setting cost_partial; a stored cost_usd 0.0 with a larger true_cost_usd renders complete.
+- Mechanism: one helper decides partial (null cost, cost below ledger or true cost, invalid ledger lines, unpriced lines) and every cost consumer calls it.
+- Fixture: cases in benchmarks/bench/tests/test_attribution.py and tests/test_efficiency_cost_availability.py for each sibling.
+
+## FC-25c-ci Git env overrides leaked by an earlier suite silence repo-config controls (GIT-ENV-LEAK)
+- User-visible vs raw: v11.17.9 never published; Tests run 38988194257 failed 2 FC-25c(a) controls on ubuntu while they passed locally per file.
+- Law broken: a test must be hermetic; a control that depends on process-wide state is not a control.
+- Cause (reproduced 2026-10-17): runAutonomous (autonomous.ts:448) and issues_run.ts:512 call withholdGithubTokens on process.env inside the shared bun process, leaving GIT_SSH_COMMAND=false and a GIT_CONFIG_COUNT credential.helper reset; both override repo config. Running the old file with those four variables set reproduces exactly the 2 CI failures.
+- Siblings to sweep: every test that asserts a repo-local git config value runs (fsmonitor, filter, ssh, credential, uploadpack).
+- Mechanism: hermeticGit wrapper in fc25_safe_git.test.ts removes GIT_SSH, GIT_SSH_COMMAND, GIT_CONFIG_PARAMETERS and GIT_CONFIG_COUNT/KEY/VALUE for the test and restores them after.
+- Fixture: the same file run with GIT_SSH_COMMAND=false GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=credential.helper GIT_CONFIG_VALUE_0= passes 14/0.
+
+## FC-TEN-QUALITY-01 The fix session gets a bare check name with no assertion text (FIX-BRIEF-BLIND)
+- User-visible vs raw: the user saw fix rounds repeat or stall on a failing test. Raw pytest printed `E assert 4 == 5`; the fix brief carried only the check name and the rerun command.
+- Law broken: L4 (the fixer must see the evidence the verifier saw).
+- Siblings: every runner whose decisive block differs: pytest `E ` lines, jest/vitest Expected/Received, node AssertionError, go `--- FAIL`, tsc/ruff diagnostics; holdout checks must stay hidden.
+- Mechanism: one failureExcerpt() in util/check_result.ts (redacted, repo-relative, at most 1500 bytes per check, 6 KB total), held in a stage-local map in verify.ts. It is never part of the check signature, never emitted in test.result, never computed for holdout checks.
+- Fixture: fix.test.ts (failing pytest `assert add(2,2) == 5`), check_result.test.ts (one fixture per runner plus size cap and AKIA redaction), wall_holdout.test.ts (holdout text absent from failures_grouped, events and brief).
+
+## FC-TEN-QUALITY-02 Pre-existing lint cannot be told apart from lint the change introduced (LINT-NO-BASELINE)
+- User-visible vs raw: the user saw a fix loop spending rounds on lint that was already in the repo. Raw base output showed the same diagnostics before the change.
+- Law broken: L4 (attribution must compare head to base, as tests already do via attribute()).
+- Siblings: ruff concise, shellcheck gcc, eslint unix parsers; tsc is out of scope; a file new on head has no base.
+- Mechanism: one pure attributeStatic(tool, headOut, baseOut) in runner/repo_profile.ts next to attribute() and attributeFullSuite(). Multiset keyed path/code/message (line and column dropped). Fails closed: unparseable head, empty parse with non-zero exit, missing base and unknown tool all count as introduced.
+- Fixture: harness_intelligence.test.ts cases for same, extra, changed-message, shifted-line, garbage and null-base inputs, plus a recorded real sample per parser.
+
+## FC-TEN-QUALITY-03 A pre-existing lint failure drives fix rounds because verify never asks the baseline (LINT-DRIVES-FIX)
+- User-visible vs raw: the user saw lint:ruff in failures_grouped for a file whose base already failed it. Raw base content run through the same tool gave the same diagnostics.
+- Law broken: L4, and the one-mechanism rule (tests already excuse pre-existing failures via attr.preExistingChecks / preRed.names).
+- Siblings: ruff, shellcheck, eslint per-file checks; tsc stays untouched; files new on head are never excused.
+- Mechanism: runLintChecks in verify.ts feeds base content on stdin to the tool and calls attributeStatic from QUALITY-02, joining the existing preExistingChecks path (at most 4 core lines).
+- Fixture: verify_lint.test.ts with a repo fixture and a stub ruff: base has the unused import (excused), head adds a new one (still reported), a new-file F401 (never excused).
+
+## FC-TEN-QUALITY-07 The fix brief says the diff is unavailable because its only reader has no writer (DEAD-DIFF-STAT)
+- User-visible vs raw: every real fix brief read "(diff stat is not available)". The working tree had the changed files.
+- Law broken: reader/writer key contract: fix.ts:62 reads prior.implement.diff_stat and no stage writes it.
+- Siblings: buildFixBrief and buildFixResumeBrief both consume the diff; any other reader of implement.diff_stat.
+- Mechanism: one currentDiff(repoDir, baseSha, maxBytes=6000) in runner/session_resume.ts via safeGit, computed fresh each fix round; excludes .loki/, names untracked files without touching the index, truncates with an explicit note.
+- Fixture: fix.test.ts and fix_resume.test.ts: temp repo with a modified file and no diff_stat shows "1 file changed"; round 2 shows the hunk; .loki/ never appears; a 50 KB diff cuts at 6000 bytes with the note.
+
+## FC-TEN-COST-06 The xreview claude judge spends tokens with lean flags off and no ledger line (XREVIEW-UNMETERED)
+- User-visible vs raw: cost totals omitted the cross-review judge. Raw claude calls ran with full settings and no child-session line.
+- Law broken: cost accounting must cover every model call (see FC-COST-PARTIAL).
+- Siblings: the codex argv (unchanged); other stages that spawn claude children and already use withChildLedger.
+- Mechanism: reviewArgv adds leanReviewerFlags() and --output-format json for claude; the run is wrapped in withChildLedger(run, lokiDir, 'xreview'). Verdict rules unchanged: no VERDICT line or bad JSON is not_run, never PASS.
+- Fixture: xreview.test.ts: argv contains the lean flags and json format; a stubbed run writes a phase xreview line to .loki/metrics/child-sessions.jsonl; JSON `VERDICT: BLOCK` parses to block; non-JSON gives not_run.
+
+## FC-TEN-DEPLOY-08 The web app reports a deployed URL it never obtained and stages everything on push (DEPLOY-FABRICATED-URL)
+- User-visible vs raw: a deploy with no URL in its output returned `https://vercel.app` as success. Raw provider output had no URL, and no receipt gate ran.
+- Law broken: a success claim must key on a parsed confirmation (fallback success is a false ack); the CLI deploy gate is the only path.
+- Siblings: deploy_session and github_push_session in web-app/server.py; hardcoded netlify.app and github.io fallbacks; the bulk-stage and `--public` push path; web-app consumers of url.
+- Mechanism: both handlers call the gated CLI (`loki deploy --execute --dir <dir>`, `loki github publish`) as argv lists and read the newest .loki/deploys record; url is deployed_url or null; refusals return 4xx with reasons.
+- Fixture: web-app/tests/test_server.py with monkeypatched subprocess; a grep for the three fallback URLs in server.py must exit 1.
+
+## FC-TEN-STABILITY-01 bench-suite builds VAR=1 hyperfine commands that hyperfine 1.20 refuses (BENCH-ARGV-ENV)
+- User-visible vs raw: the v11.17.6 backstop went red. Raw hyperfine 1.20 refused any positional command matching ^[A-Z_]+=, and the script skipped those commands without failing.
+- Law broken: a gate that skips its own work must fail, not pass quietly.
+- Siblings: benchPair and benchRoute call sites in loki-ts/scripts/bench-suite.ts; fixed /tmp/bench-*.json export paths; partial SKIP exit code.
+- Mechanism: one exported pure argv builder emits `env LOKI_LEGACY_BASH=1 <shim> <cmd>` (works on hyperfine 1.18 and 1.20); exports go under a mkdtemp dir; any SKIPPED command exits non-zero.
+- Fixture: loki-ts/tests/scripts/bench_suite_argv.test.ts with a fake hyperfine on PATH that exits 1 with the 1.20 message on a VAR= command.
+
+## FC-TEN-STABILITY-05 wall_concurrent races the 5s bun test timeout (WC-TIMEOUT-RACE)
+- User-visible vs raw: nightly 38938949858 failed. Raw duration was 5004.82ms against the 5000ms default; assertions were correct.
+- Law broken: a test must be hermetic and not depend on machine speed.
+- Siblings: other engine10 suites that init, add and commit a repo per test.
+- Mechanism: build the repo fixture once in beforeAll and copy it per test; give the concurrency case an explicit timeout sized from measured CI duration; every assertion unchanged.
+- Fixture: `bun test --timeout 1500 tests/engine10/wall_concurrent.test.ts` under CPU load, and a 20-run loop of the plain command.
+
+## FC-TEN-UX-02 Every failed start prints the same generic Next line (NEXT-NOT-SPECIFIC)
+- User-visible vs raw: auth failure, credit exhaustion, a failed check, a spec conflict and a stall all told the user `loki doctor` or `loki undo`. Raw reason strings from output.ts reasonOf name the actual cause.
+- Law broken: the failure message must name the exact fix for the cause that happened.
+- Siblings: every literal reason produced by reasonOf (output.ts:74); the supervisor call site that passes the reason.
+- Mechanism: nextOf in util/run_summary.ts takes reason and outcome and maps each failure class to one command; verified, done-unverified, budget and stopped output stays byte-identical.
+- Fixture: run_summary.test.ts table rows copied from the real reason literals, a pin of the old outputs, and a source scan that every reasonOf literal has a mapping; tests/features/contract.test.ts covers fatal:auth end to end.

package/docs/v10/MODERNIZE.md

@@ -327,6 +327,7 @@ The report never states more than the equivalence data proves. It is sealed and
 - V10-RESEARCH cites Legacy-Bench only through a vendor report.
 - The slice first confirms that a public task set exists and records its URL and license. If none exists, the pilot uses 10 public py2 and Java 8 repos under 20K lines, each with a suite, and says so.
 - Gate: the equivalence rate on the pilot is published, and the sizing cap is calibrated from it.
+- Calibration factors (eval/modernize/pilot-manifest.json): raise x1.25 at 90% or higher, lower x0.75 below, clamp 300-6000 lines, round to 50; hold when any run failed or was skipped.
 
 **2. 200K-line scale test (M-28)**
 - Chosen candidate: Mercurial at its last Python 2 only release, 4.x (py2 to 3).
@@ -337,6 +338,11 @@ The report never states more than the equivalence data proves. It is sealed and
   - the license (GPL) allows running it.
 - Why: it is a real Python 2 codebase with a large suite of its own (`run-tests.py`), and upstream later completed the Python 3 port, so a human reference exists.
 - The line count is UNVERIFIED offline. M-28 measures it first with `--dry-run` inventory and `cloc`. If the count is under 200K or the suite is unbounded, the named fallback is Calibre before its Python 3 port, and the choice is recorded again.
+- Operator notes (`eval/modernize/scale.py`, M-28; extends pilot.py, no separate SCALE.md):
+  - `python3 eval/modernize/scale.py --target hg --dry-run-first [--source PATH] [--fallback-source PATH]` is the default and spends nothing. It resolves the source (a local `--source` is read in place and copied for the estimate; otherwise it clones Mercurial 4.9.1 with `hg` or Calibre v3.48.0 with the Git CLI; both refs UNVERIFIED offline), counts lines per language excluding vendored directories, runs `loki modernize --to python3 --dry-run`, and prints JSON: planned units, waves, estimated cost, the unit line cap (pilot manifest `cap.start_lines`), the spend cap (null until `--budget-usd`), and a suggested budget of 1.5x the estimate.
+  - Selection: hg unavailable (no `hg`, clone failure, bad `--source`) or under `--min-lines` (default 200000) falls back to Calibre. Each step is logged to stderr and to `selection_log`. If no candidate meets the floor the run exits 2.
+  - The paid run needs `--execute` AND `--budget-usd` greater than 0, else exit 2 before any clone or spend. It runs through `pilot.execute_repo`, so cost, status and calibration follow the M-27b rules (cost is a lower bound; unmeasured spend is charged at the full budget). Results: `eval/modernize/results/pilot-scale-<ts>.json`.
+  - Known limit: `source_lines` in the paid result comes from pilot's counter and includes vendored code, so cost per 1K lines is understated against the measured plan figure.
 
 **3. 1M lines (M-29)**
 - Chosen candidate: Apache Hadoop 2.x (Java 8 to 21). It is Java 8, multi-module, and has an extensive JUnit suite.
@@ -386,7 +392,7 @@ The report never states more than the equivalence data proves. It is sealed and
 | M-25 | Final report and verdict (COMPLETE only if all proven), sealed | mod/report.ts, T/report.test.ts | HIGH | Wb T/report.test.ts | M-13, M-21 |
 | M-26 | End-to-end: py2 fixture repo modernized with stub provider | T/e2e.test.ts, T/fixtures/e2e_py2/ | MEDIUM | Wb T/e2e.test.ts | M-08, M-22, M-25 |
 | M-27 | Legacy-Bench pilot harness; confirm public set; calibrate cap | eval/modernize/pilot.py, eval/modernize/test-pilot.sh | HIGH | bash eval/modernize/test-pilot.sh | M-26 |
-| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py, eval/modernize/SCALE.md | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | M-27 |
+| M-28 | 200K scale run (Mercurial 4.x, measured first, fallback Calibre) | eval/modernize/scale.py (notes in section 12) | HIGH | python3 eval/modernize/scale.py --target hg --dry-run-first | M-27 |
 | M-29 | 1M scale run (Hadoop 2.x Java 8 to 21, measured first) | eval/modernize/scale_1m.py, eval/modernize/SCALE-1M.md | HIGH | python3 eval/modernize/scale_1m.py --dry-run-first | M-28, M-11 |
 | M-30 | User docs for loki modernize, no dashes, commands match USAGE | docs/v10/GUIDE-MODERNIZE.md, tests/test-modernize-docs.sh | LOW | bash tests/test-modernize-docs.sh | M-07 |
 

package/docs/v10/PROGRESS.md

@@ -2400,3 +2400,13 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - 2026-10-16T23:05Z M-27 parked per D98: round 2 opus HIGH review BLOCK on fc2a7e90 (test-pilot.sh 26 passed 0 failed, but repro of a 10-unit plan with 1 PROVEN unit then budget.hit gave status ok, equivalence 1.0, calibrate_cap action raise). Carried as M-27b (building). FC-09u built as 12a4c80a (runner_config.test.ts 135 pass 0 fail, typecheck no error TS), in opus HIGH review. v11.17.5 (99b96ffcc) Tests and Release running.
 - 2026-10-16T23:15Z drift audit (last 6h vs CONTROL.md): 299 commits, 6 release cuts (v11.17.0-v11.17.5), but `npm view loki-mode dist-tags` shows next=11.17.1 only; 11.17.2, 11.17.3 and 11.17.4 never published, each red on a CI-only guard that release.sh skips under LOKI_RELEASE_ALLOW_RED=1. Drift: cut cadence met, publish cadence 1 of 6. Fix dispatched as REL-GUARD (release.sh runs the select-tests.sh --guards-only rows even under ALLOW_RED). Also: S11 run2 measured stale global v11.3.9; stopped, rerun as run3 on repo bin (v11.17.5); COST-BIN merged a05462951.
 - 2026-10-16T23:25Z v11.17.6: v11.17.5 published (npm next 11.17.5, gh release v11.17.5 draft=false, Tests and Release completed success on 99b96ffcc). Ships COST-BIN (bench tests 79 pass) and D101. Drift audit vs CONTROL.md: M-27b round 1 BLOCK (F1 no modernize.completed producer), round 2 fix 7fc7c886 test-pilot 32/0 in HIGH review; FC-09v round 1 BLOCK cebe5641 (block-scalar bypass reproduced with pnpm install), round 2 fail-closed per D101 building; REL-GUARD and M-25w in flight; S11 run3 on repo v11.17.5 in progress. Cost goal still unproven.
+- 2026-10-16T23:31Z drift audit vs CONTROL.md: v11.17.6 pushed d84ef9568 (COST-BIN, REL-GUARD, D101), Tests/Release in flight. M-27b APPROVE round 2 7fc7c886 merged aa0bb8971 (ships 11.17.7). In flight: FC-09v round 2 (D101 fail-closed), M-25w HIGH review of 8836ea62, REL-GUARD-b, run3 diagnosis. S11 run3 result: loki about 0.57x raw-configured per accepted task but 24/24 loki runs rc 1, coord-1 and longspec-1 fail in 0.2s, raw-bare 24/24 unmeasured; cost goal stays unproven. Pruned 4 merged clean worktrees.
+- 2026-10-16T23:37Z run3 diagnosis (read-only, no spend): loki rc 1 on every run because seeds have no executable test, so FC-16 gives PARTIAL (exit 1) even when the held-out test accepts; coord-1 and longspec-1 fail in 0.2s at run_group.ts:177/216 (materialize_seed adds no origin remote); raw-bare unmeasured (no ANTHROPIC_API_KEY); loki cost omits v10 Wall-stage child sessions (18 loki-e15-wall-* transcripts, about $1.18). Corrected loki about $0.184 per accepted vs raw-configured $0.195: the 2x cost goal is NOT proven. Dispatched COST-HARN (bench rc, remote, v10 evidence) and COST-WALL (child-session ledger).
+- 2026-10-17T00:05Z v11.17.7: ships M-27b pilot accounting, COST-HARN benchmark fixes, M-25w sealed modernize report and producer guard, REL-GUARD-b/c release guard worktree. Bump via scripts/release.sh patch --bump-only rc=0 (~/loki-ci-logs/bump-11177.log).
+- 2026-10-17T00:22Z drift audit (last 6h vs CONTROL.md): 281 commits, releases 11.17.6 and 11.17.7 only, so the :00/:20/:40 cadence (D37) is missed; cause is serial HIGH review rounds, not red CI. D12/D98 held: Q17-04 parked after HIGH r2 BLOCK (B2 reproduced) and re-sliced as Q17-04b; M-28 merged only after HIGH r2 APPROVE. Ready queue 8, at the CONTROL floor but under the OPERATING-MODEL 30; PO refill dispatched. M-28 and Q17-06 merged-unreleased; v11.17.8 cut follows the v11.17.7 publish.
+- 2026-10-17T00:22Z v11.17.8: v11.17.7 never published (Tests run 38984591460 red on e66c51a09, sole failing suite Tier A test selector FC-89: log.test.ts walks loki-ts/src without the walk-all-src marker; Release failed at required-ci). Fixed in c6faaa885 (test-select-tests.sh 95 passed, 0 failed). Ships v11.17.7 content plus M-28, Q17-06, Q17-04b, Q18-09. Bumped with LOKI_RELEASE_ALLOW_RED=1 because HEAD had no Tests run yet; global guard rows ran in the clean worktree (bump rc=0).
+- 2026-10-17T00:50Z v11.17.9: v11.17.8 never published (Tests run 38986362613 red on 7fc08f186, only suite tests/test-real-run.sh, fixture receipt lacked the pinned node:sum.test.js check). Fixed in 500b71e85; test-real-run.sh rc=0 (13 PASS), test-wall-executed-guard.sh rc=0. Also merges Q17-03 (TL APPROVE 3dec444fa, 4157 pass 0 fail), COST-WALL-b (HIGH APPROVE ddab3e714, pytest 15 passed, mutation caught) and Q18-01 (HIGH APPROVE dbb93205a, bun test 289 pass, guard mutations 6/6 caught). Bumped with LOKI_RELEASE_ALLOW_RED=1 (HEAD had no green Tests run). C-F1 2x cost claim still unproven: benchmark adapter ignores cost_partial (follow-up COST-WALL-d).
+- 2026-10-17T01:10Z v11.17.10: v11.17.9 never published (Tests run 38988194257 red on bf3d2ae24: 2 FC-25c(a) controls failed because withholdGithubTokens callers left GIT_SSH_COMMAND=false and a GIT_CONFIG_COUNT credential.helper reset in process.env). Fixed in 3c3f2c9e0 (hermeticGit wrapper); old file under those 4 vars reproduces 2 fail, fixed file 14 pass 0 fail. Ships Q17-01, COST-WALL-c, COST-WALL-d, M-25w-b, M-25w-c, FC-09w, Q18-06 (HIGH r2 APPROVE), Q18-05 (HIGH APPROVE). Pending: Q18-03b and FC-09x approved, merge next; COST-WALL-e and Q17-02 blocked r1, fixing; 2x cost claim still unproven.
+- 2026-10-17T01:30Z v11.17.11: ships Q18-03b (merge 31e4f4b47) FC-09x (merge b97c1e635, dist 2eeec3851) and COST-WALL-e (HIGH r2 APPROVE 439ed90e3, 132 passed). Founder asked for 10/10 on every competitive axis; architect workflow wrixi4afj is slicing COST, QUALITY, DEPLOY, UX, GATES, STABILITY and ADOPTION into board rows. Q17-02 r1 fix 11eac46fa in TL r2 review.
+- 2026-10-17T02:00Z v11.17.12: v11.17.11 published (npm next 11.17.11, Tests and Release green on df98addc8). Ships Q18-05b (TL APPROVE 82058ff97, merge ae90c2875) and COST-WALL-f (HIGH r2 APPROVE ef9979ad8, merge 3d0587f4f). Q18-03c parked after 2 rounds (regex-literal strip regression), continued as Q18-03d. 64 TEN rows on BOARD; wave 1 batches A and B building.
+- 2026-10-17T02:30Z v11.17.13: v11.17.12 (42315dc52) Tests red on one stale assertion in tests/test_cost_summary.py (1 failed, 3825 passed on Python 3.10 and 3.13), so Release skipped publish; fix-forward f5b1d1681. First v11.17.13 bump refused on 2 red global guard rows (l0 allowlist after CORE-TRIM, completions coverage newly promoted by STABILITY-04), fixed 6f2355aa7. TEN-UX-02b merged 672b74c79; TEN-DEPLOY-01b conflicts with DEPLOY-01, back to ready. Ships v11.17.12 content plus Q18-07, Q18-11, Q17-02, Q18-03d and 12 TEN wave 1 rows (DEPLOY-01, UX-02, COST-02, COST-03, STABILITY-01/04/05/08, FC-ROWS, CORE-TRIM, SECURE-SCAN-UTIL, BADGE-UTIL), each with a TL or HIGH APPROVE. Batches E, F, G and Q18-04/Q18-02b r2 building.