loki-mode 11.2.0 → 11.2.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.2.0
+# Loki Mode v11.2.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.2.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.2.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.2.0
+11.2.1

package/autonomy/lib/skill-link-heal.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# FC-30: keep the provider skill links Loki created pointing at the running
+# install. One shared mechanism, called from npm postinstall and from the bin/loki
+# shim (first invocation after an install or upgrade). Cost: a few lstat/readlink
+# calls, no network, no subprocess beyond readlink/ln/mv on the repair path.
+#
+# Opt out with LOKI_NO_SKILL_LINK_HEAL=1.
+#
+# A link is repointed only when ALL hold:
+#   - it is a symlink (a real directory or file is never touched)
+#   - its target is a Loki install path (…/node_modules/loki-mode, or a Homebrew
+#     Cellar/opt loki-mode dir), so a foreign link is never touched
+#   - its target is missing, or resolves to a different install than the running one
+#   - the running root is itself an install path with a SKILL.md, so a dev checkout
+#     or worktree never hijacks the user's global link
+
+_loki_skill_is_install_path() {
+    case "${1%/}" in
+        */node_modules/loki-mode | */Cellar/loki-mode/* | */opt/loki-mode | */opt/loki-mode/libexec) return 0 ;;
+    esac
+    return 1
+}
+
+loki_skill_link_heal() {
+    [ "${LOKI_NO_SKILL_LINK_HEAL:-}" = "1" ] && return 0
+    local root="${1:-}" home="${HOME:-}" root_p rel link tgt live_p tmp
+    [ -n "$root" ] && [ -n "$home" ] || return 0
+    [ -f "$root/SKILL.md" ] || return 0
+    root_p="$(cd "$root" 2>/dev/null && pwd -P)" || return 0
+    _loki_skill_is_install_path "$root_p" || _loki_skill_is_install_path "$root" || return 0
+
+    for rel in .claude .codex .cline .aider; do
+        link="$home/$rel/skills/loki-mode"
+        [ -L "$link" ] || continue
+        tgt="$(readlink "$link" 2>/dev/null)" || continue
+        case "$tgt" in /*) ;; *) tgt="$(dirname "$link")/$tgt" ;; esac
+        _loki_skill_is_install_path "$tgt" || continue
+        if [ -e "$link" ]; then
+            live_p="$(cd "$link" 2>/dev/null && pwd -P)" || live_p=""
+            [ "$live_p" = "$root_p" ] && continue
+        fi
+        tmp="${link}.heal.$$"
+        rm -f "$tmp" 2>/dev/null
+        ln -s "$root_p" "$tmp" 2>/dev/null || continue
+        # Atomic replace. -T (GNU) / -h (BSD) stop mv from descending into a
+        # link that points at a directory.
+        if mv -fT "$tmp" "$link" 2>/dev/null || mv -fh "$tmp" "$link" 2>/dev/null; then
+            printf 'loki: repointed skill link %s -> %s (was %s)\n' "$link" "$root_p" "$tgt" >&2
+        else
+            rm -f "$tmp" 2>/dev/null
+        fi
+    done
+    return 0
+}

package/autonomy/loki

@@ -1150,6 +1150,53 @@ except Exception:
 PY
 }
 
+# loki_verify_root: the ONE place that decides which tree the receipt verifier
+# hashes (FC-29). The verifier walks and digests the directory it is given, so
+# an ambient cwd (a huge checkout, $HOME, a non-project directory) must never be
+# the default. Order: explicit TARGET_DIR; the parent of an absolute LOKI_DIR;
+# the cwd if it holds .loki; the repo top-level if it holds .loki. Anything else
+# prints one plain sentence on stderr and returns 1 (callers report NOT CHECKED).
+loki_verify_root() {
+    # Helpers live inside so callers that extract this one function stay whole.
+    _loki_verify_trim() {
+        local p="$1"
+        while [ "${#p}" -gt 1 ] && [ "${p%/}" != "$p" ]; do p="${p%/}"; done
+        printf '%s' "$p"
+    }
+
+    _loki_verify_canon() {
+        local p r
+        p="$(_loki_verify_trim "$1")"
+        if [ -n "$p" ] && [ -d "$p" ] && r="$(cd "$p" 2>/dev/null && pwd -P)"; then p="$r"; fi
+        printf '%s' "$p"
+    }
+    local d="${TARGET_DIR:-}" top="" _cd _ch
+    d="$(_loki_verify_trim "$d")"
+    if [ -z "$d" ]; then
+        case "${LOKI_DIR:-}" in
+            /*) [ -d "$LOKI_DIR" ] && d="$(dirname "$LOKI_DIR")" ;;
+        esac
+    fi
+    if [ -z "$d" ]; then
+        if [ -d "$PWD/.loki" ]; then
+            d="$PWD"
+        else
+            top="$(git -C "$PWD" rev-parse --show-toplevel 2>/dev/null || true)"
+            if [ -n "$top" ] && [ -d "$top/.loki" ]; then d="$top"; fi
+        fi
+    fi
+    # Compare canonical paths: every trailing slash stripped, symlinks resolved,
+    # identically for the candidate and HOME (mirrored by resolveVerifyRoot in
+    # loki-ts/src/commands/proof.ts).
+    _cd="$(_loki_verify_canon "$d")"
+    _ch="$(_loki_verify_canon "${HOME:-}")"
+    if [ -z "$d" ] || [ "$_cd" = "/" ] || { [ -n "$_ch" ] && [ "$_cd" = "$_ch" ]; }; then
+        echo "Cannot tell which project tree to verify against: set TARGET_DIR or run from a project directory that contains .loki." >&2
+        return 1
+    fi
+    printf '%s\n' "$d"
+}
+
 loki_remote_verify_receipt() {
     local pj="$1"
     local verifier="${_LOKI_SCRIPT_DIR}/lib/proof-verify.py"
@@ -1181,7 +1228,9 @@ loki_remote_verify_receipt() {
     # empty for a local receipt, which simply means no attestation is checked.
     local _attest_url="${2:-}" _attest=""
     _attest="$(loki_remote_attestation_status "$pj" "$_attest_url")"
-    out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null)"
+    local _vroot
+    _vroot="$(loki_verify_root)" || { echo "  NOT VERIFIED: no project tree to check against" >&2; return 0; }
+    out="$(python3 -E "$verifier" "$pj" "$_vroot" 2>/dev/null)"
     hash_ok="$(printf '%s' "$out" | jq -r '.hash_ok // false' 2>/dev/null)"
     gpg_ok="$(printf '%s' "$out" | jq -r '.gpg_ok | tostring' 2>/dev/null)"
 
@@ -9547,8 +9596,9 @@ _deploy_receipt_verdict() {
         printf '%s' "UNCHECKED"; return 0
     fi
 
-    local out hash_ok
-    out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}" 2>/dev/null || true)"
+    local out hash_ok _vroot
+    _vroot="$(loki_verify_root 2>/dev/null)" || { printf '%s' "UNCHECKED"; return 0; }
+    out="$(python3 -E "$verifier" "$pj" "$_vroot" 2>/dev/null || true)"
 
     # "The verifier did not RUN" and "the verifier says the hash is bad" are
     # different facts and must not collapse. If they do, a broken python3
@@ -37656,7 +37706,11 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                 echo -e "${YELLOW}NOT CHECKED${NC}: python3 is not on PATH, so the verifier could not run (exit 2)." >&2
                 exit 2
             fi
-            local _pv_rc=0 _pv_out="" _pv_base_rc=0
+            local _pv_rc=0 _pv_out="" _pv_base_rc=0 _pv_root=""
+            _pv_root="$(loki_verify_root)" || {
+                echo -e "${YELLOW}NOT CHECKED${NC}: no project tree to verify against (exit 2)." >&2
+                exit 2
+            }
             # Captured, not printed directly, so that --jwks (below) can patch
             # it: BACKLOG 49 -- when --jwks later downgrades _pv_rc to 1
             # (ABSENT) or 2 (NOT CHECKED), this output's own "ok: true"/
@@ -37666,9 +37720,9 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
             # route (proof.ts verifyProof) -- ok already agrees with the exit
             # code there, so there is nothing to patch.
             if [ "$_pv_human" -eq 1 ]; then
-                _pv_out="$(python3 -E "$verifier" --human "$pj" "${TARGET_DIR:-.}")" || _pv_rc=$?
+                _pv_out="$(python3 -E "$verifier" --human "$pj" "$_pv_root")" || _pv_rc=$?
             else
-                _pv_out="$(python3 -E "$verifier" "$pj" "${TARGET_DIR:-.}")" || _pv_rc=$?
+                _pv_out="$(python3 -E "$verifier" "$pj" "$_pv_root")" || _pv_rc=$?
             fi
             _pv_base_rc="$_pv_rc"
 

package/autonomy/run.sh

@@ -22698,16 +22698,24 @@ build_prompt() {
     # configuration there), or LOKI_GOAL_SCORING=0. Advisory only: it never
     # blocks a build and never rewrites the user's goal.
     local goal_sharpening_instruction=""
-    if [ -n "${COMPLETION_PROMISE:-}" ] \
+    # Bash-native trim, matching (goal ?? "").trim() in goal_score.ts: a
+    # whitespace-only promise is an absent goal, not an unmeasurable one.
+    local _goal_trim="${COMPLETION_PROMISE:-}"
+    _goal_trim="${_goal_trim#"${_goal_trim%%[![:space:]]*}"}"
+    _goal_trim="${_goal_trim%"${_goal_trim##*[![:space:]]}"}"
+    if [ -n "$_goal_trim" ] \
        && [ "${LOKI_GOAL_SCORING:-}" != "0" ] \
        && [ "${AUTONOMY_MODE:-}" != "perpetual" ] \
        && [ "${PERPETUAL_MODE:-}" != "true" ] && [ "${PERPETUAL_MODE:-}" != "1" ]; then
         local _goal_lc _goal_dims
-        _goal_lc="$(printf '%s' "$COMPLETION_PROMISE" | tr '[:upper:]' '[:lower:]')"
+        _goal_lc="$(printf '%s' "$_goal_trim" | tr '[:upper:]' '[:lower:]')"
         _goal_dims=0
         # Mirrors the four DIMENSIONS regexes in goal_score.ts, in the same order.
         printf '%s' "$_goal_lc" | grep -qE '[0-9]+(\.[0-9]+)?[[:space:]]*(%|ms|s\b|sec|second|min|minute|hour|day|kb|mb|gb|rps|qps|req|x\b|users?|items?|rows?)' && _goal_dims=$((_goal_dims + 1))
-        printf '%s' "$_goal_lc" | grep -qE '\b(under|below|less than|no more than|at most|over|above|greater than|at least|within|between|<=?|>=?)\b' && _goal_dims=$((_goal_dims + 1))
+        # The symbol alternatives (<, <=, >, >=) cannot use grep's \b: BSD and GNU
+        # disagree on it next to a non-word character. TS \b(<=?)\b means a word
+        # character on BOTH sides of the symbol, so spell that out explicitly.
+        printf '%s' "$_goal_lc" | grep -qE -e '\b(under|below|less than|no more than|at most|over|above|greater than|at least|within|between)\b' -e '[A-Za-z0-9_](<=?|>=?)[A-Za-z0-9_]' && _goal_dims=$((_goal_dims + 1))
         printf '%s' "$_goal_lc" | grep -qE '\b(latency|throughput|p50|p95|p99|uptime|error rate|conversion|coverage|score|accuracy|precision|recall|bundle size|load time|response time|memory|cpu|cost)\b' && _goal_dims=$((_goal_dims + 1))
         printf '%s' "$_goal_lc" | grep -qE '\b(tests? pass|builds? clean|endpoint|returns? [0-9]{3}|exit code|schema|migration|deploys?|renders?|compiles?)\b' && _goal_dims=$((_goal_dims + 1))
         # Only a goal with ZERO measurable dimensions is flagged (score == 0),

package/bin/loki

@@ -115,6 +115,14 @@ else
     exec "$BASH_CLI" "$@"
 fi
 
+# FC-30: an install artifact must not outlive the install that made it. If a provider
+# skill link Loki created is dangling or points at another Loki install, repoint it
+# to this one. A few lstat/readlink calls, no network, silent when already correct.
+if [ -f "$REPO_ROOT/autonomy/lib/skill-link-heal.sh" ]; then
+    # shellcheck source=../autonomy/lib/skill-link-heal.sh
+    source "$REPO_ROOT/autonomy/lib/skill-link-heal.sh" 2>/dev/null && loki_skill_link_heal "$REPO_ROOT" || true
+fi
+
 # Shell completions install themselves: once per VERSION, on the first interactive
 # run after an install or upgrade (stamp: ~/.loki/completions-version). Never needed
 # by the user; skipped under CI, LOKI_NO_COMPLETIONS=1 and non-TTY stdout. Failure

package/bin/loki-postinstall.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-// npm postinstall: install shell completions. Must never fail the install.
+// npm postinstall: repoint stale skill links (FC-30) and install shell completions. Must never fail the install.
 try {
   const { spawnSync } = require("node:child_process");
   const path = require("node:path");
+  const root = path.join(__dirname, "..");
+  spawnSync("bash", ["-c", '. "$1/autonomy/lib/skill-link-heal.sh" && loki_skill_link_heal "$1"', "_", root], { stdio: ["ignore", "ignore", "inherit"], timeout: 10000 });
   if (!process.env.CI && process.env.LOKI_NO_COMPLETIONS !== "1") {
     spawnSync(path.join(__dirname, "loki"), ["completion", "--postinstall"], { stdio: "ignore", timeout: 20000 });
   }

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.2.0"
+__version__ = "11.2.1"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.2.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.2.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v11.2.0
+**Version:** v11.2.1
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/v10/DECISIONS.md

@@ -731,3 +731,5 @@ PROGRESS.md (the FC-25 P9 entry) cites a D88 CI waiver that was never recorded i
 10. Accepted risk (CTO, 2026-10-07): B9 measures about 5 of the 14 or more Repo Shape Matrix shapes, so an unmeasured shape starts on Haiku without shape-level parity evidence; the backstops are the in-run escalation ladder (Haiku -> Sonnet 5.5 before STALLED, so a miss costs time and money, not correctness) and the H4 history floor, the receipt records shape parity as NOT PROVEN for any shape with no B9 row, and each matrix shape gains a B9 row as it becomes runnable.
 
 Amendment to D89 (2026-10-07 21:40Z, CTO decision, refined by the founder at 21:45Z, CoS records). This amends only R1-19, the default-on flip that follows the CTO gate; 11.1.0 and 11.2.0 still ship the router OFF. (1) The default executor is Sonnet 5.5; Haiku 5.5 per work unit when Opus assigns it. (2) Roles: Opus 5.5 is the architect, router and advisor, plans and assigns each unit, and is consulted on hard calls. Sonnet is the senior engineer and the default for implementation and fixes. Haiku does tests, docs and small low-risk changes only when Opus assigns them in the plan. Haiku is never the blanket default. (3) L0 holds: the harness never routes by task type or path regex; it only executes, verifies and escalates. (4) The route schema is `units: [{id, kind, executor, reason}]` plus a run default of sonnet; a missing or invalid unit route goes to sonnet with NOT PROVEN. A haiku unit that fails a code-owned check is redone on sonnet, then escalates to opus; a Wall assigned to haiku gets an Opus review before implement. The receipt lists the executor, assigner and reason per unit. The per-unit schema lands in 11.2.0 or 11.2.1 depending on what is merged. (5) Escalation stays evidence-gated (haiku -> sonnet -> opus, and sonnet -> opus), and `LOKI_ROUTER=0` equals pre-router behavior exactly (the R1-21 golden). (6) The R1-16 shape-defaults semantics are inverted (a shape is listed as `haiku` once it has earned it; an absent listing means Sonnet), and R1-16 history is an input to Opus, not a harness rule. Rationale: a wrong PR costs the user far more than the token savings, B9 covers only about 5 of 14 shapes (item 10), and under L0 a model earns the cheaper tier with evidence. Items 3, 5, 7 and 9 above are read with this amendment; their text is kept as recorded. See docs/v11/ROUTER-1.md sections 4.1, 4.3 and 4.6.
+
+Amendment 2 to D89 (2026-10-08 00:15Z, steering finding, CoS records; tightens a gate, so it binds until the CTO relaxes it). R1-19 gains one more gate line: on the trivial fixture (the steering Node off-by-one fixture), router-on cost must be <= router-off cost x 1.05, measured with n>=3 per arm and recorded per arm as cache-read input tokens, fresh input tokens, output tokens, dollars and wall time (R1-17 B9). Evidence that prompted it (n=1, may be variance): 11.2.0 smoke, router on cost +15% tokens, +27% dollars and +38s with zero advisor calls and no route change. If the advisor tool definition costs tokens on sessions that never consult it, the advisor is enabled only on the sessions Opus marks as needing it (plan and fix rounds), not on every stage. Measure before changing code.

package/docs/v10/FAILURE-CLASSES.md

@@ -331,6 +331,32 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - User saw: tests/test-proof-verify-jwks.sh passed 108/0 in 33s in a fresh worktree and hung until killed when run from the main checkout. The CI-style run was green and the founder's own run was red, so the suite read as flaky.
 - Mechanism (measured): `loki proof verify` and `loki_remote_verify_receipt` run `proof-verify.py "$pj" "${TARGET_DIR:-.}"`. With TARGET_DIR unset the verifier runs `compute_tree_digest` on the caller's cwd, whose filesystem walk visited 1,054,266 paths (13.3s just to enumerate, then it hashes them) because `.claude/worktrees` (190 worktrees, 32G) sits inside the checkout. A fresh worktree has a few thousand files.
 - Law: L2 (a verdict is about the tree it names, never an ambient one), and the test hermeticity rule: a test owns its fixture tree.
-- Siblings: swept every tests/*.sh spawn of `proof verify` and `loki_remote_verify_receipt`; only the jwks test lacked TARGET_DIR. Direct `proof-verify.py` runs pass the repo as an argument. Other `${TARGET_DIR:-.}` readers in autonomy/loki (HANDOFF.md, failover.json, .loki dir) are not swept yet.
+- Siblings: swept every tests/*.sh spawn of `proof verify` and `loki_remote_verify_receipt`; only the jwks test lacked TARGET_DIR. Direct `proof-verify.py` runs pass the repo as an argument. Sibling sweep (11.2.0 lane 10): of every `${TARGET_DIR:-.}` reader in autonomy/, five spawn sites were unsafe: the Bun `loki proof verify` (loki-ts/src/commands/proof.ts, the default route for a plain `verify <id>`), the bash `loki proof verify` (human and JSON, reached by flags or LOKI_LEGACY_BASH), `loki_remote_verify_receipt` and `_deploy_receipt_verdict` all handed the verifier the caller's cwd (it digests the tree when cwd is a repo). Safe, each reads or writes fixed paths and walks nothing: cmd_deploy detectors (test -f on named files), cmd_failover (one failover.json), `loki handoff --md` (writes one HANDOFF.md), crash.sh (writes .loki/crash), spec-interrogation.sh (five named manifests). app-runner.sh and completion-council.sh run only inside a `loki start` run, where run.sh sets TARGET_DIR to the project.
 - Mechanism of the fix: every verifier spawn in the jwks test sets TARGET_DIR to its fixture; tests/test-verifier-spawn-sets-target-dir.sh fails any test that spawns the verifier without TARGET_DIR or a cd into an owned directory.
+- Shared mechanism for the sweep: `loki_verify_root` in autonomy/loki and its port `resolveVerifyRoot` in loki-ts/src/commands/proof.ts are the one resolver (TARGET_DIR, parent of an absolute LOKI_DIR, cwd or repo top-level holding .loki, else a plain refusal and exit 2 NOT CHECKED; HOME and / are never roots, a trailing slash is normalized first). The first sweep fixed only the bash copy; the HIGH review found the Bun route still defaulting to ".".
+- Sweep fixture: tests/test-verifier-root-not-ambient-cwd.sh (runs `proof verify` through bin/loki on both the default and legacy routes; source guards cover autonomy/loki and loki-ts/src) and loki-ts/tests/commands/proof_verify_root.test.ts (the TS resolver, red before the port). The bash source guard goes red when a spawn passes `${TARGET_DIR:-.}` again.
 - Fixture: tests/test-verifier-spawn-sets-target-dir.sh, mutated against the pre-fix jwks test (7 hits). tests/test-proof-verify-jwks.sh run with cwd = the main checkout.
+
+## FC-30 An install artifact outlives the install that made it
+- User saw: after upgrading to 11.1.0, ~/.claude/skills/loki-mode was a symlink to ~/.bun/install/global/node_modules/loki-mode, which no longer existed. `loki doctor` FAILed and told the user to run `loki setup-skill`, an extra command the product should never ask for.
+- Mechanism (measured): `cmd_setup_skill` creates the provider skill links once and only on request. Nothing re-checked them on install, upgrade or first run, so a package-manager move or reinstall left a dangling link (or one to the previous install). Raw cause is a one-shot writer with no owner for the link's lifetime.
+- Law: L0 (the harness repairs what it can verify is its own instead of delegating to the user), L2 (the doctor verdict is about the host as it is, and the fix must make that true without a command).
+- Siblings: swept every place Loki writes an install-time path. Provider skill links ~/.claude, ~/.codex, ~/.cline, ~/.aider skills/loki-mode (all four covered by the shared mechanism); `cmd_remote` ln -sf of the Claude skill link in autonomy/loki (only creates when SKILL.md is absent, covered by the same repair on the next run); shell completions via `completion --postinstall` and the shim (already self-healing, stamped by VERSION in ~/.loki/completions-version); no PATH shims or bin links are written by Loki (the package manager owns bin/loki). Real directories and foreign links are deliberately left to doctor.
+- Mechanism of the fix: autonomy/lib/skill-link-heal.sh `loki_skill_link_heal` repoints a symlink only when its target is a Loki install path (node_modules/loki-mode or a Homebrew loki-mode dir) that is missing or is a different install than the running one, and only when the running root is itself an install path. Atomic temp link plus rename, one stderr line, silent no-op when correct, LOKI_NO_SKILL_LINK_HEAL=1 opts out. Called from bin/loki-postinstall.js (install and upgrade) and the bin/loki shim (first run).
+- Fixture: tests/test-skill-link-heal.sh (dangling, other install, real dir, foreign link, correct link, opt-out, dev checkout), red before autonomy/lib/skill-link-heal.sh existed.
+
+## FC-31 A slice gate skips the suites that guard its own files, and main goes red in Tier B
+- User saw: main 27447cf46 failed Tier B on tests/test-doctor-blocker-parity.sh (run 37697291383). The slice R1-20 (8ff988516) changed loki-ts/src/commands/doctor.ts and gated only on tsc and bun test. The local-ci fast tier had timed out (rc=124) on a loaded host, so no shell suite ran.
+- Law: L2 (a verdict is about the tree it names; a gate that did not run the guarding suites says nothing about them) and the evidence rule (a timeout is not a pass).
+- Cause (measured): scripts/select-tests.sh rule R4 handled loki-ts/src files with `continue` after selecting bun tests, so rule R3 (shell suites that reference the file) never ran for them. test-doctor-blocker-parity.sh runs `bin/loki doctor`, never the string doctor.ts, so no path or basename match could have found it anyway.
+- Mechanism: one shared mapping, scripts/select-tests.sh. R4 now also selects shell suites that name the full path, and for loki-ts/src/commands/X.ts those that run `loki X`. One gate command, `bash scripts/local-ci.sh --impacted <base>` (scripts/impacted-gate.sh), runs only the selected shell and moat suites, each under `timeout -k`, prints per-suite rc, and exits non-zero on any failure or timeout.
+- Siblings swept (file-to-suite mapping by source tree): loki-ts/src was the only tree whose rule skipped the shell grep (fixed). mcp/, providers/, autonomy/ (other than run.sh and loki), scripts/ get R3 path and basename grep. dashboard/ gets R3 plus the R5 pytest area. web-app/ gets R3 plus R5. Still thin: a loki-ts/src file that is not a command module (runner/, util/) maps to shell suites by full path only, not by the subcommand a suite drives; dashboard and web-app shell suites that drive an API route by URL are not mapped to the handler file; mcp/server.py tools are not mapped to suites that call the tool by name. Follow-up: a per-tree needle table once a second miss appears.
+- Fixture: tests/test-select-tests.sh, "FC-31: doctor.ts selects doctor parity shell suite" (red before the fix: 39 passed, 1 failed).
+
+## FC-32 Hand-maintained file lists drift from the import graph
+- User saw: Tier B run 37706008817 on main 6a01413bd failed two suites: "no hardcoded home-directory paths in tests" (and its cascade, "Structural checks catch planted defects (D44-C)") and "Loki control plane wiring (CP-04)". Both slices had passed tsc and the full bun test.
+- Law: L2 (a verdict is about the tree it names; a gate that did not run the guarding suites says nothing about them).
+- Cause (measured): faf1d0ace added tests/test-parity-goal-score.sh with hardcoded /opt/homebrew/bin and /usr/local/bin grep paths (flagged by tests/test-no-hardcoded-paths.sh). The R1 router slices (0f3e3d55a, c15b8157b, 1b9e479c1) added loki-ts/src/engine10/cost.ts, runner/router/flag.ts and runner/router/route_block.ts to the control-plane value-import closure, but Dockerfile.control-plane lists its COPY files by hand. RC-SLICE-SHELL-GATE: the FC-31 impacted gate selected neither shell structural guard, including for a touched tests/*.sh.
+- Mechanism (this slice, minimal): the parity test discovers greps with `type -ap grep ggrep` (no absolute paths); the three files are added to Dockerfile.control-plane. 11.2.2 follow-up (root fix): replace the hand-maintained COPY list with a directory COPY or a generated list, make CP-04 build the image and import the bundle, and extend scripts/select-tests.sh so a touched tests/*.sh selects the hardcoded-path and structural-checks suites and a loki-ts/src file reachable from packages/control-plane selects CP-04.
+- Siblings swept: tests/test-no-hardcoded-paths.sh scans every tests/ file (3 passed, 0 failed after the fix); the CP-04 closure guard covers every loki-ts/src value import (25 passed, 0 failed); no other hits.
+- Fixture: the two existing guards, red on 6a01413bd and green here.