loki-mode 11.3.0 → 11.3.1

package/docs/v10/DEPS.md

@@ -151,9 +151,16 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `.github/workflows/coverage.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
 | `.github/workflows/coverage.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/coverage.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/first-run-gate.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/first-run-gate.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
-| `.github/workflows/first-run-gate.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/docker-build-check.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/docker-build-check.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
+| `.github/workflows/docker-build-check.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/docker-build-check.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
+| `.github/workflows/full-suite.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/full-suite.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/integrity-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/integrity-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/integrity-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
@@ -210,10 +217,6 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
 | `.github/workflows/test.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
 | `.github/workflows/test.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/workflows/test.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/tier-a.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/tier-a.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
-| `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
-| `.github/workflows/tier-a.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
 | `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
 | `.github/actions/receipt-check/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
@@ -243,14 +246,12 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.8 (cycle
 
 | File | Name | Current | Latest stable | Bump | Note |
 |---|---|---|---|---|---|
-| `Dockerfile` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
-| `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}-slim` | `oven/bun:${BUN_VERSION}-slim` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `Dockerfile.purplelab-test` | `node:22-slim` | `node:22-slim` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
-| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
-| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
-| `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `docker/Dockerfile` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
+| `docker/Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}-slim` | `oven/bun:${BUN_VERSION}-slim` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
+| `docker/Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
 | `artifacts/observability/Dockerfile` | `nginx:1.27-alpine` | `nginx:1.27-alpine` | `1.27.5 (newest line 1.31.6)` | EOL | EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6 |
 | `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
 | `web-app/Dockerfile` | `node:22-alpine` | `node:22-alpine` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
@@ -259,14 +260,13 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.8 (cycle
 | `deploy/docker-compose/docker-compose.yml` | `asklokesh/loki-mode:latest` | `asklokesh/loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
 | `deploy/docker-compose/docker-compose.yml` | `otel/opentelemetry-collector-contrib:0.96.0` | `otel/opentelemetry-collector-contrib:0.96.0` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
 | `deploy/docker-compose/docker-compose.yml` | `jaegertracing/all-in-one:1.54` | `jaegertracing/all-in-one:1.54` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `chromadb/chroma:latest` | `chromadb/chroma:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
-| `docker-compose.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
+| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `chromadb/chroma:latest` | `chromadb/chroma:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker/docker-compose.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
 | `web-app/docker-compose.purple-lab.yml` | `postgres:16-alpine` | `postgres:16-alpine` | `16.15 (newest line 18.6)` | MAJOR | EOL 2028-11-09 (not yet); minor in line; MAJOR to newest line |
 | `web-app/docker-compose.purple-lab.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
-| `docker-compose.test.yml` | `(none found)` | `` | `-` | n/a | no `FROM` / `image:` line found (build-context-only service, or a multi-stage FROM this pass did not match) |
 
 ## Helm (every `Chart.yaml` found via `git ls-files`, any directory)
 
@@ -367,7 +367,7 @@ Counts are all from the single `Bump` column (current line vs newest line in the
 | Python (pyproject) | 0 | 0 | 1 | 1 | 0 | 0 | 1 | 1 | 0 |
 | GitHub Actions | 0 | 11 | 0 | 59 | 0 | 0 | 2 | 2 | 2 |
 | Runtimes | 0 | 4 | 0 | 2 | 2 | 0 | 1 | 0 | 0 |
-| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 11 | 0 | 1 |
+| Docker/Compose | 0 | 2 | 0 | 7 | 1 | 0 | 11 | 0 | 0 |
 | Helm | 0 | 0 | 0 | 0 | 0 | 3 | 5 | 0 | 42 |
 | Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
 | Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |

package/docs/v10/ENGINE.md

@@ -107,7 +107,7 @@ Every claim below comes from reading main at 84c22568. I edited no files.
   - The dry-run list contains the three files.
 - **Deps:** E-14, E-TG.
 
-### E-33: EV-6 gate report generator
+### E-33: gate report generator (EV-6)
 - **Files:** `eval/loki10/gate_report.py` (new), `eval/loki10/test-gate-report.sh` (new), `eval/loki10/fixtures/gate/` (new subdir).
 - **Tier:** HIGH. Its marker controls E-31.
 - **Contents:**

package/docs/v10/FAILURE-CLASSES.md

@@ -304,6 +304,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Fixture: a bun test that plants core.fsmonitor and a canary GH_TOKEN, then calls resolveRunCapS and asserts the plant never ran; and the moat case P9.injection-cannot-reach-token passes locally (`bash tests/moat/run.sh`, P9 line).
 - FC-25b (sibling, found in the opus review, 2026-10-04T01:02Z): the hooks, fsmonitor and sshCommand flag set alone still lets three plant classes run holding the canary token (git 2.55.0). (1) filter.<drv>.clean or process, declared in .gitattributes or .git/info/attributes, fires on status --porcelain, diff --name-only HEAD, add and commit. (2) diff.<drv>.textconv fires on log -p and on a diff with patch output. (3) gpg.program with commit.gpgSign=true fires on commit. A scrubbed env does not close the hole, because a running plant can still read the gh hosts file or the keyring. Execution itself has to be stopped. Mechanism: the same safeGit helper blanks each configured filter and textconv key, and sets diff.external=, commit.gpgSign=false, core.attributesFile=/dev/null and GIT_ATTR_SOURCE=<empty tree>. Fixture: fc25_safe_git.test.ts adds one plant per class.
 - FC-25c (follow-ups from the opus review of d82aec15a, 2026-10-04T01:15Z; not reachable with a real token today). (a) The allowToken path still honors repo-local core.sshCommand, remote.*.uploadpack and receivepack, and a repo-scope credential.helper; the canary fired on an ssh origin and on a local-path uploadpack. Its only caller is the base_guard fetch, reached from intake in the worker with the sentinel env, and supervisor.ts baseLine passes fetchRemote=false. Fix: harden allowToken itself, or add a guard that pins it to that single worker-side caller. (b) The raw-spawn guard misses an indirect argv (`const GIT = "git"`) and does not scan packages/control-plane. ship_hook.ts reaches control-plane shipper/discover.ts gitOrigin (`git config --get`, real-token env) from the supervisor. Fix: convert it to safeGit and widen the guard. (c) preflight's safeGitArgv path does not set GIT_CONFIG_NOSYSTEM. Low risk, because system config is root-owned.
+- FC-25d (moat P9 [planted] red on main after v11.3.0, 2026-10-08; v11.3.0 itself passes). User saw: "[planted] a plant in the agent's repo config ran holding the real GitHub token: fsmonitor,fsmonitor,fsmonitor,fsmonitor" plus the SSH agent socket finding. Culprit: 93f22d197 (cost preview v1, merged via 939ca2992): supervisor.ts calls encodeEstimate(process.env, repoDir) before the worker spawns. Root cause: the supervisor now runs the cost preview (runner/router/cost_preview.ts estimateFor -> history.ts shapeKeyForRepo), which reached project_model/gather.ts listShallow (`git ls-files -z`, line 30) and isGitTracked (`git ls-files --error-unmatch`, line 107), both raw execFileSync with env: process.env. Each fired fsmonitor twice (trace2 parent sid: the top-level bun supervisor). The raw-spawn guard had gather.ts on its allowlist ("follow-up: confirm every caller is worker-side"). Law: L2 and moat P9 Rule of Two; the allowlist was a per-file trust claim that a later caller broke. Siblings: 41 raw git spawn sites across 21 files (the new guard on main e2f9c49ca) (engine10 stages, e10ext, runner, features, cli/completions, github_token); and preflight.ts and xreview.ts passed safeGitEnv() to util/shell.ts run(), which merges opts.env over process.env, so the token survived there too. Mechanism: util/safe_git.ts is the only way to spawn git (safeGit, safeGitSpawn for status/Buffer/stdin, safeGitRun async with the exact env, never merged); the guard tests/util/fc25_raw_spawn_guard.test.ts has NO allowlist, scans loki-ts/src, bin/ and autonomy/ JS/TS (multi-line, Bun.spawn, argv literals, `const X = "git"`), and fails on safeGitEnv/safeGitArgs used outside safe_git.ts. Content-writing worker calls (add, checkout, worktree add) opt in to repoDrivers so repo filters (local LFS) and the user's core.attributesFile still apply; the seal commit also opts in to userHooks (user hooks and commit signing, refused with allowToken). The token stays stripped and fsmonitor stays off on all of them. HIGH review B2: a core.fsmonitor plant cannot tell a token-free env from one merged over process.env (the -c flag disables it either way), so the env fixture records through a repoDrivers clean filter safe_git keeps live, for all three entry points, with an allowToken positive control. Patch commands get --no-ext-diff --no-textconv (FC-41, 7cf8028b0). Same mechanism, swept here: DRIVER_KEY_RE also blanks repo-scope diff.<drv>.command, and the subcommand finder skips the values of --config-env and --attr-source. Fixture: tests/util/fc25_supervisor_git_fsmonitor.test.ts (a child bun with a start-env canary calls shallowDirs, isGitTracked, gather, shapeKeyForRepo, estimateFor and the three helpers; the plant must never see the canary, while an explicit-env control must). Out of scope here: bash/python git calls in bin/ and autonomy/ (no JS/TS git spawns exist there), and packages/control-plane discover.ts/diffstat.ts/checkpoints.ts (FC-25c b).
 
 ## FC-26 Free text in the Control Plane starts a run in HOME that dies in 0.13s, and the run page says "did not pass verification"
 - User saw: runs cc22 and e606 on the founder's CP, both FAILED in about 0.13s, with a summary that blamed verification. The founder had typed "whats going on so far" in the home box. Raw `loki start` refuses a non-repo dir with a clear message.
@@ -360,8 +361,13 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - User saw: Tier B run 37706008817 on main 6a01413bd failed two suites: "no hardcoded home-directory paths in tests" (and its cascade, "Structural checks catch planted defects (D44-C)") and "Loki control plane wiring (CP-04)". Both slices had passed tsc and the full bun test.
 - Law: L2 (a verdict is about the tree it names; a gate that did not run the guarding suites says nothing about them).
 - Cause (measured): faf1d0ace added tests/test-parity-goal-score.sh with hardcoded /opt/homebrew/bin and /usr/local/bin grep paths (flagged by tests/test-no-hardcoded-paths.sh). The R1 router slices (0f3e3d55a, c15b8157b, 1b9e479c1) added loki-ts/src/engine10/cost.ts, runner/router/flag.ts and runner/router/route_block.ts to the control-plane value-import closure, but Dockerfile.control-plane lists its COPY files by hand. RC-SLICE-SHELL-GATE: the FC-31 impacted gate selected neither shell structural guard, including for a touched tests/*.sh.
-- Mechanism (this slice, minimal): the parity test discovers greps with `type -ap grep ggrep` (no absolute paths); the three files are added to Dockerfile.control-plane. 11.2.2 follow-up (root fix): replace the hand-maintained COPY list with a directory COPY or a generated list, make CP-04 build the image and import the bundle, and extend scripts/select-tests.sh so a touched tests/*.sh selects the hardcoded-path and structural-checks suites and a loki-ts/src file reachable from packages/control-plane selects CP-04.
+- Mechanism (P0 slice, interim): the parity test discovers greps with `type -ap grep ggrep` (no absolute paths); the three missing files were added to Dockerfile.control-plane.
+- Mechanism (root fix, 11.2.2 FC-32-ROOT): Dockerfile.control-plane now COPYs the whole loki-ts/src tree (2.4MB; the root Dockerfile already did). CP-04 (tests/test-control-plane.sh) no longer compares a list to the import graph: it stages exactly what the Dockerfile build stage COPYs (WORKDIR and relative or absolute destinations honored) and runs the real `bun build` of the server and ask-tools bundles there. Docker is not needed.
+- Why not the import-graph generator: a whole-tree COPY is viable (size 2.4MB, evidence: `du -sh loki-ts/src`), so the CTO's option 1 applies.
+- Regression fixtures (CP-04): the legacy per-file list (tests/fixtures/cp04-legacy-copy-list.txt) bundles the unmodified tree, goes RED when a brand-new loki-ts file is imported (needs a list edit), while the tree COPY passes with no edit; a really missing import target and a deleted loki-ts COPY both go red.
+- Gate selection (RC-SLICE-SHELL-GATE): scripts/select-tests.sh now selects tests/test-no-hardcoded-paths.sh and tests/test-structural-checks.sh for any changed tests/*.sh, and tests/test-control-plane.sh for any loki-ts/src file in the control-plane import closure (computed at selection time; python3 missing selects it for all loki-ts/src). Fixtures in tests/test-impacted-gate.sh (red before the fix: 2 failed on tests/*.sh; CP-04 red once the test stopped naming the files by accident).
 - Siblings swept: tests/test-no-hardcoded-paths.sh scans every tests/ file (3 passed, 0 failed after the fix); the CP-04 closure guard covers every loki-ts/src value import (25 passed, 0 failed); no other hits.
+- Sweep of hand-kept lists (root slice): package.json files[] has hand-listed web-app/{server,auth,models,crypto}.py and Dockerfile:146 the same four (a new web-app module would not ship; follow-up, change both to a glob together). tests/test-runtime-libs-are-packaged.sh hand-lists tools/*.py and autonomy/lib/*.py to assert (drift means a new tool is unasserted, not unshipped; follow-up: derive from the directory). tests/test-detectors-are-packaged.sh derives its list from run.sh (already the right shape). action.yml and .github/actions/*: no file lists. tests/test-release-dist-guard.sh: checks map content, no list.
 - Fixture: the two existing guards, red on 6a01413bd and green here.
 
 ## FC-33 Duplicate implementations kept in sync by tests (FC-DUP)
@@ -381,3 +387,114 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: grep of loki-ts/tests and loki-ts/test for in-process dynamic imports from tmp/mkdtemp roots and for cpSync tests that import. Only route_matrix_lib.ts (lines 57-60, 178-179) imports from a variable root. graph.test.ts and providers.test.ts copy fixtures, not src; providers.test.ts imports real src inside a spawned script. route_matrix.test.ts passes the real src dir, which coverage tracks normally. No other hits.
 - Mechanism: the mutation test evaluates each copy through `Bun.spawn([process.execPath, route_matrix_child.ts, root])` (no --coverage), reading violations as JSON. A non-zero exit or unparsable output throws, so a crashed child can never pass a red case or the control case vacuously.
 - Fixture: the "FC-34 guard" describe block in loki-ts/tests/engine10/route_matrix_mutation.test.ts (red when the file imports route_matrix_lib in-process or does `await import(join(root` against a temp root; verified red by reverting the fix locally).
+
+## FC-35 The router start line, receipt and plan disagree about the route
+- User saw: CTO smoke with LOKI_ROUTER=1 on a node off-by-one fixture. The start line said "route: executor haiku-5.5, advisor opus: Opus routes at plan time", the receipt said routed:false, units:[], executor:null, "no route recorded by implement", every session ran claude-sonnet-5-5, no plan-scope.json was written (plan logged "plan sonnet (fast tier)"), and shape_key was null.
+- Law: L7 (what is advertised is what is recorded); also L2 (a null shape key feeds no history, R1-16) and founder design (Opus routes; Sonnet is the default executor; Haiku only when Opus assigns it).
+- Cause (measured): routeStartLine ignored all run data and defaulted the executor to haiku; the plan stage skipped small tasks even with the router on and ran the router-on plan on the fast tier (Sonnet) unless the advisor was unavailable; nothing recorded a route when the plan returned none, and the receipt read only implement.route, which no stage writes; shapeKeyForRepo was never called and ignores the run's project-model.answer.json.
+- Mechanism (one shared): runner/router/route_record.ts. The plan stage always writes <runDir>/route.json (a route, or routed:false with the reason) while the router is on. The receipt route block (buildRouteBlock, via plan output or route.json) and the PR line derive from that one record; the start line is printed before any stage, so it states the pre-plan state only ("decided at plan time, per-unit executors not applied") and never names an executor. The routing decision runs on Opus (Sonnet only after an Opus failure, recorded as NOT PROVEN) and no longer skips small tasks; since D93 the routing decision is one short structured-output Opus call and the full plan session is conditional (see Amended). shape_key comes from shapeKeyForRun (the run's project-model.answer.json, then the repo model). The "plan sonnet (fast tier)" downgrade is not printed while the router pins the plan to Opus.
+- Siblings swept: routeStartLine (supervisor.ts), buildRouteBlock (seal.ts), routePrLine/withSealRoute (pr.ts, via the sealed route_line), modelDowngrades (start line and run.started), doctor.ts router check (reads no executor); all other prints of an executor name go through modelLabel in route_block.ts. Router-off output is byte-identical (router_optout_golden plus the new off assertions).
+- Parked: implement does not yet apply per-unit executors (R1-11 wiring). The record carries applied:false (PER_UNIT_EXECUTORS_APPLIED), so the receipt and PR line say "<run model> (per-unit assignment not applied)", list units as "assigned haiku-5.5 (not applied)" and add a route.executor NOT PROVEN line; none claims haiku ran. plan_model records the model the fast tier really resolves to (fastTierModel), and the plan downgrade is suppressed only when the plan is really pinned to Opus.
+- Fixture: loki-ts/tests/engine10/route_record_agreement.test.ts (red before the fix).
+- Amended (D93, CTO, 2026-10-08): under LOKI_ROUTER=1 Opus ALWAYS makes the routing decision, as one short structured-output call (cache-stable prefix, effort low, output {size: trivial|small|medium|large, units[], needs_full_plan: bool}, measured target under $0.01). The full Opus plan session runs only when needs_full_plan is true; trivial and small tasks go straight to the routed executor on the lean path. The implement LOKI_NEED_PLAN marker is a second input to the same plan gate (it can raise the gate, never lower it). R-B is unchanged: the plan stage always emits a route (route.json) or a recorded reason; a failed or malformed routing call records routed:false with the reason and falls back to the full plan. Slice: COST-HALF LD-01 (docs/v11/COST-HALF.md); its Wall check requires the routing call below 10% of total cost on the trivial-sum B9 row.
+
+## FC-39 A hand-kept file list drifts from the import graph (second instance, in a fixture)
+- User saw: train-11.3.1 red at 1613125eb: tests/test-control-plane.sh "legacy fixture sanity failed" (24 passed, 1 failed). The RABC and T1 slices added loki-ts imports (route_record.ts, cost_preview.ts, pr_lessons.ts and their closure) that tests/fixtures/cp04-legacy-copy-list.txt did not list.
+- Law: L2 (a verdict is about the tree it names). FC-32-ROOT removed the hand-kept list from the product Dockerfile but left the same class alive in the test fixture.
+- Cause (measured): the fixture was a hand-kept per-file COPY list; a sweep of the import closure of its entry points found 11 unlisted files (cache, repomap, provider_failover, runner/types, cost_preview, history, history_store, atomic, engine_origin, pr_lessons plus route_record).
+- Mechanism (one shared): the legacy list is derived at fixture time from the import closure of serve.ts and tools_server.ts (legacy_copy_list in tests/test-control-plane.sh); the checked-in list file is deleted. The red-first case still holds because plant_import runs after derivation.
+- Siblings swept (tests/ and scripts/): the derived walk itself must not drop files: it maps .js/.mjs specifiers to .ts (latent class: no file in the serve.ts/tools_server.ts closure imports a .js or .mjs specifier today, so this guards future imports; the real tree list is unchanged), skips comment-only lines, and fails loudly naming any relative specifier it cannot resolve (fixtures in tests/test-control-plane.sh, red when the .js mapping is removed). No other hand-kept loki-ts/src file list. Remaining lists are not source-closure lists: tests/detect-test-mutations.sh HARNESS_FILES, tests/test-registration-nonstandard.sh CORPUS_FILES, scripts/license-audit.sh PACKAGE_FILES, tests/managed_memory/test_sdk_isolation.sh ALLOWLIST. Open (from FC-32, unchanged): Dockerfile:146 and package.json files[] hand-list web-app/{server,auth,models,crypto}.py.
+- Fixture: tests/test-control-plane.sh (25 passed, 0 failed; the sanity case is green by construction and cannot drift).
+
+## FC-37 A flag accepted on one route is silently dropped on another
+- User saw: `loki start "<task>" --no-pr --attempts 2` returned rc 0 and VERIFIED but ran ONE attempt, with no attempts receipt and no second worktree. `bin/loki` sent the positional task to engine10 before the --attempts diversion, and engine10 glued `--attempts 2` onto the task text. The same shape hid `--budget`: engine10 has no such flag, so `--budget 3` became task words and no cap applied.
+- Law: L0 (a flag the user typed is honored or refused, never ignored), L2 (one dispatch point owns each flag).
+- Siblings (sweep of start flags by route; routes: engine10 positional, Bun start.ts, bash cmd_start, attempts engine10 child):
+  - `--attempts`: engine10 positional was DROPPED (fixed); Bun route honored; bash route accepted only 1; attempts child n/a. Now parsed once in bin/loki before any route split: 1 is stripped, 2-5 exec the Bun start command, anything else or a missing value exits 2, N>=2 without bun exits 1.
+  - `--budget` / `--budget-limit`: engine10 positional was DROPPED into the task (fixed: translated to `--max-cost`); Bun and bash routes honored; attempts child DROPPED it (fixed: passes `--max-cost`).
+  - `--no-pr`: engine10 honored; Bun route rejected it as unknown (fixed: accepted as a no-op, the Bun loop opens no PR); bash route refuses it with `Unknown option` and exit 1 (loud, kept); attempts child always passes it.
+  - `--provider`: engine10, Bun and bash routes honored; attempts child forwards it.
+- Mechanism: one flag block ahead of the route split in `bin/loki` (`# FC-37`), plus the engine10 arm's budget translation and the attempts child argv in loki-ts/src/commands/start.ts.
+- Known gap: a new start flag still needs an entry in each route; the sweep is a table here, not a generated check.
+- Fixture: loki-ts/tests/runner/attempts-dispatch.test.ts (stub engine; red on ffe808687 with 0 pass 3 fail, green here with 3 pass 0 fail).
+
+## FC-38 Legacy loop reachable from a user command
+- User saw: `loki start "<task>" --attempts 2` exited rc 0 but the attempts receipt showed requested 2, ran 1, winner null, governor "hold: governor unknown or unreadable". The one run was the legacy RARV loop (runAutonomous), which seals no receipt, so a start returned success with nothing to verify. The swarm usage governor, absent in a clean environment, forced the fallback.
+- Law: L0 (a user command that says it verified must have run the verifying engine), L2 (one engine behind `start`).
+- Siblings (sweep of every `start` route):
+  - `bin/loki` engine10 arm (issue refs, multi-word tasks): engine10, kept; now also hard (never falls through to bash).
+  - `bin/loki` Bun start (PRD path, one-word brief, flags): ran runAutonomous (fixed: runs engine10 per attempt, N=1 included).
+  - `bin/loki` no-bun and early fallbacks to `$BASH_CLI`: ran the bash loop (fixed: `_loki_bash_or_refuse` and the no-bun check refuse `start` with exit 1).
+  - `bin/loki` legacy-only flags (--parallel, --github, --sandbox, --issue, --dry-run, --detach) and the opencode provider: diverted to the bash loop (fixed: refused, exit 2).
+  - `LOKI_SDK_LOOP` branch in `bin/loki`: removed.
+  - attempts child (loki-ts/src/commands/start.ts): engine10 only; the governor (`LOKI_ATTEMPTS_GOVERNOR_MAX`, usage files) is deleted from product code, N attempts run as N (1-5).
+  - `loki start` flags only the legacy loop honored (--max-iterations, --max-retries, --completion-promise, --base-wait, --max-wait, --simple, --complex, --allow-haiku, --regen*, --skip-memory, --aider-model, --aider-flags, --cline-model): were accepted by the Bun start and dropped (FC-37 class). Now refused with exit 2; the accepted set (--provider, --budget, --session-model, --prd, --brief, --attempts, --no-pr, no-op --yes/--no-plan/--no-mirofish/--no-dashboard) all reach engine10.
+  - `autonomy/loki` `cmd_start` callers (quick and run at 11335/11337/11826, demo at 15382, the `start` dispatch at 20928, 29705/29716), `autonomy/run.sh` run directly, and the dashboard spawns of run.sh (dashboard/control.py:572, dashboard/server.py:4356, 4640, 5226): NOT a `loki start` route, still reach the legacy loop. OPEN: requires a CTO waiver or a follow-up slice; ~dozens of shell suites drive cmd_start/run.sh directly with stubs, so refusing there is its own slice.
+- Mechanism: `bin/loki` start block (`# FC-38`) plus `_loki_bash_or_refuse`; `runStart` always goes through `runAttempts` with an engine10 runner; `formatAttemptsSummary` prints requested, ran, winner and losers from the attempts receipt.
+- Scoping (11.3.1, FC38-SCOPE): the refusals above apply only to `start --attempts` (in any form). Plain `loki start` keeps the 11.3.0 routing (bash fallbacks, `LOKI_LEGACY_BASH`, opencode and legacy-only flags on bash) because the unscoped change regressed P5.egress-blocked-start-seal-verify and P5.local-provider-no-claude-sidecalls. `--attempts N` (2-5) is checked for legacy-only flags and unsupported providers before it execs the Bun start. Fixtures: tests/test-engine10-dispatch.sh and loki-ts/tests/runner/attempts-dispatch.test.ts.
+- Missed sibling (FC38-SCOPE2): FC38-SCOPE scoped only `bin/loki`. The Bun start (loki-ts/src/commands/start.ts) still refused the runner flags (--max-iterations and the rest) and ran engine10 on every plain start, so P9's bun legs (`dist/loki.js start injected-prd.md --max-iterations 2`) exited 2. Fixed: start.ts is the 11.3.0 file for every plain start (`startEngine` returns "runner", runAutonomous); the refusal, the 1-5 check, the FC-40 --no-pr rule and the token-free env apply only when --attempts is present. Fixture: loki-ts/tests/commands/start.test.ts ("FC-38 scope" block) and the two `--budget` pins in tests/test-engine10-dispatch.sh.
+- Separate finding (not FC-38, OPEN): P9.injection-cannot-reach-token still fails on the planted leg with start.ts restored. The fsmonitor plant runs holding the real GitHub token and the real SSH agent socket on `bin/loki start octocat/hello#42` (the engine10 issue route), before engine10 withholds tokens. Passes on bee8ac363, fails on 4b24c4f55; the regressing commit is in that 49-commit range, not yet bisected.
+- Sweep closed (T5-D2): `--attempts` (any value, either form) is refused with exit 2 and a pointer to `loki start --attempts N --no-pr` by `bin/loki` for quick, run, demo and tour (before any route split), by `autonomy/loki` main() for start, run, quick, demo and tour (so every `cmd_start` caller, including quick/run/demo and the dispatch at 29705/29716, is covered), and by the `autonomy/run.sh` argument parser (the target of the dashboard spawns in dashboard/control.py and dashboard/server.py, which carry no attempts field and now cannot forward one). Plain invocations without `--attempts` are unchanged. Fixture: tests/test-engine10-dispatch.sh section 4b (stub provider marker, one case per entry point).
+- Fixture: loki-ts/tests/runner/attempts-dispatch.test.ts and loki-ts/tests/runner/attempts.test.ts (red on e7be7289b: dispatch 1 pass 6 fail, unit 16 pass 10 fail; green here).
+
+## FC-DOCTOR-COUNT Doctor's failure count changed between identical runs (provisional id; Release Manager renumbers)
+- User saw: `loki doctor` printed "2 failed" on one run and "1 failed" on the next, same environment. Raw cause: the Claude login row depended on a live `claude auth status` subprocess (5s timeout, no retry). When it returned nothing, doctor fell back to a clock-dependent check of the cached OAuth access token's expiry and printed FAIL "login has EXPIRED" (an expired access token is normal; a refresh renews it). Reproduced on 11.2.2 with a claude shim whose probe prints nothing plus an expired credentials file: "19 passed, 2 failed"; probe answering: "1 failed".
+- Law: L5 (an inconclusive probe was reported as a user fault) and L3 (a heuristic on the clock beat executed evidence).
+- Siblings swept: text Summary vs `--json` summary (two separate hand-kept counters), 39 hand-written `tally.X++` sites, and the Blocking (N) trailer (read the same counters). Other probes checked: tool version probes (a timeout leaves version null, which passes, so no count change), readEffectiveProvider (deterministic; failure degrades to warn), disk, skills, detectors, PATH installs (all local and deterministic). Under 16 concurrent doctor runs the counts were identical, so the flip needs an inconclusive login probe. Not touched: run.sh claude_login_state, which has its own fixture (tests/test-claude-login-state.sh).
+- Mechanism: one counting function, `summarizeStatuses(list)` in loki-ts/src/commands/doctor.ts. The text tally is now a list of recorded statuses (`makeTally`, `bump`) with pass/fail/warn derived from it, and `--json` builds its summary from the same function. The login row goes through the pure `evaluateClaudeLogin`: one retry on an empty probe, then an explicit UNKNOWN that is always a counted warning and never a fail, independent of the clock.
+- Fixture: loki-ts/tests/commands/doctor_count.test.ts (claude shim: yes / empty / flaky-first-call, with an expired credentials file; asserts failed equals the number of FAIL lines, is equal across probe modes, and that `--json` summary.failed equals the text count).
+
+## FC-36 The harness parses ecosystem manifests itself (L0)
+- User saw: the supply guard's own pyproject/requirements/package-lock parsers misfired into false FAILED verdicts: a ruff rule or keyword read as a dependency "e501", a new npm workspace key "packages/web" probed on npmjs, PEP 508 git/file references and poetry path deps probed on PyPI, private-registry 404s read as nonexistent. Each fix exposed the next format quirk.
+- Law: L0 (hardcoded ecosystem knowledge in the harness will keep misfiring; the ecosystem's own tool is the authority), L2 (one verdict has one author).
+- Siblings (sweep of loki-ts/src for harness-side manifest reads): runner/repo_profile.ts, runner/quality_gates.ts (package.json scripts.test), engine10/testmap.ts, engine10/modernize/inventory.ts, features/wall_manifest.ts, engine10/stages/verify.ts, commands/doctor.ts read manifests for detection or test commands; none of them issues a FAILED verdict on a parsed dependency name. Not changed here.
+- Mechanism: loki-ts/src/supply/supply_guard.ts. The implement session DECLARES new registry deps in <repo>/.loki/supply-declared.json (bounded reader, brief instruction only while the guard is on); the harness only proves each declared name with the ecosystem resolver (npm view, pip index versions, cargo search, go list) under the user's own config. A manifest or lockfile change with no declaration is a warning, never FAILED. Only a declared dep that does not resolve is FAILED; any tool or network failure is NOT PROVEN.
+- Known gap: resolver commands are a small table in supply_guard.ts, not read from the Project Model.
+- Fixture: loki-ts/tests/engine10/supply_guard.test.ts (R1 new npm workspace, R2 PEP 508 git/file refs and poetry path, none FAILED).
+
+## FC-40 A child is spawned with the full parent env
+- User saw: nothing yet. Raw: every `--attempts` engine10 child inherited the parent's GH_TOKEN, GITHUB_TOKEN and SSH_AUTH_SOCK although attempts force `--no-pr` and never push, and the winner's PR push read `origin` from the shared .git/config AFTER the agents ran, so an attempt could `git remote set-url origin <attacker>` and receive the credentialed push.
+- Law: moat P9 (the token reaches only the harness's own push, to a destination fixed before any agent ran), L2 (one credential path).
+- Siblings swept: loki-ts/src/commands/start.ts attempt child (fixed), runner/attempts.ts git helper and gh pr create (fixed: safeGit, explicit env), engine10/supervisor.ts worker env (already withholdGithubTokens on a copy), engine10/stages/pr.ts push script (pinned origin, already correct), util/pr_lessons.ts and commands/proof.ts gh spawns (credentialed by design, explicit env), engine10/preflight.ts (env passed), runner/checkpoint.ts, council.ts, quality_gates.ts and engine10/session.ts and verify.ts git spawns (read-only local git; session.ts and verify.ts still pass process.env and are NOT converted here). OPEN gap: under allowToken the repo-local credential.helper, core.sshCommand, url.*.insteadOf and pushInsteadOf are still honored (CREDENTIAL_CONFIG keeps the user's helper and ssh command), so a hostile attempt can write them into the shared .git/config; a helper receives the token on store and sshCommand runs code with the token in its env. 11.3.1 therefore refuses `start --attempts N` (N>1) without --no-pr (exit 2, before any pin, worktree or spawn). The 11.3.2 fix (T5-PUSHPATH) is to push from a fresh temp bare repo with clean config, or to pass explicit -c overrides plus GIT_CONFIG_GLOBAL only.
+- Mechanism: `tokenFreeEnv` / `safeGit` (loki-ts/src/util/safe_git.ts); attempts pin `remote.origin.url` in memory in productionDeps before the first attempt and push to that literal URL with allowToken, deriving `gh --repo` from it (no GitHub parse, no PR).
+- Fixture: loki-ts/tests/runner/attempts-env-token.test.ts (attempt child env token-free), attempts-git-token.test.ts (only the push keeps the token), attempts-origin-pin.test.ts (rewritten origin cannot redirect the push), attempts-pr-refused.test.ts (11.3.1 refusal).
+
+## FC-41 safeGit blanks diff.external, so every patch-producing call dies
+- User saw: nothing yet. Raw: `diff.external=` (blank, set to stop a repo-planted external diff) made git try to run an empty program, so any `diff`, `show -p` or `log -p` through safeGit failed with "external diff died" unless the caller remembered `--no-ext-diff`.
+- Law: moat P9 (no repo-chosen command runs in the token-holding process), L2 (one mechanism, not per-caller flags).
+- Siblings swept: reviewer_brief.ts, engine10/supervisor.ts, engine10/stages/xreview.ts, runner/attempts.ts (all carried a private --no-ext-diff workaround, removed); stash show and other non-patch commands do not use an external diff and pass through unchanged; GIT_EXTERNAL_DIFF in the caller env is now stripped.
+- Mechanism: `safeGitArgs` / `safeGitEnv` in loki-ts/src/util/safe_git.ts inject `--no-ext-diff --no-textconv` after diff, show, log and whatchanged, drop a caller `--ext-diff` / `--textconv`, and delete GIT_EXTERNAL_DIFF. A user-configured external diff or textconv is never re-enabled.
+- Fixture: loki-ts/tests/util/safe_git_extdiff.test.ts (configured marker script never runs; output is a real patch).
+
+## FC-42 A tracked file the task's own setup wrote is refused as an operator change (FC-15 family)
+- User saw: D50 baseline (docs/v10/METRICS.md:565-566), aiq-52-searchbar, Loki+haiku and Loki+sonnet: the engine refused to start in 0.7-1.3s with "dirty tracked tree: M frontend/package-lock.json" (the task `setup` ran npm install). No model call, so the no_change_needed outcome was unreachable. Raw: the raw arm has no tree check and finished the task.
+- Law: L1 (never below raw), L5 (a harness refusal is not the user's problem), L2 (the refusal must be keyed on the thing that makes it unsafe, not on a hand-kept list).
+- Cause (measured): intake.ts:69-71 refuses any dirty tracked file. E-164 (7b0ba4122, landed 10 minutes after the baseline commit) already allows lockfile-only dirt, but preexisting_dirty.ts LOCKFILE is a hand-kept list of 7 names (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock/b, poetry.lock, Cargo.lock, go.sum). Every other generated lockfile (Gemfile.lock, composer.lock, Pipfile.lock, uv.lock, pubspec.lock, mix.lock, flake.lock, npm-shrinkwrap.json, Package.resolved, deno.lock, gradle.lockfile, packages.lock.json) still refuses the run the same way.
+- What separates setup output from an operator's work (the only line the engine can draw from the tree alone): a lockfile is machine-written, never hand-edited, and never part of the run's change. The protection that makes allowing it safe is already in place and is path-generic: splitDirty records the blob at intake, Seal/Commit drop recorded paths from staging (seal.ts dropSet), and untouchedSinceIntake attributes a path to the run only if its bytes changed. Anything that is not a lockfile (source, config, docs, a manifest such as package.json) is operator-shaped work and still refuses with the file named, because a run that edits the same file would mix its change with the operator's unrecorded intent.
+- Siblings swept: intake.ts dirtyTrackedFiles is the only refusal in engine10/e10ext/commands (treeswap.ts:314 is a different, primary-checkout guard). stop_restore.ts and commit_filter.ts already honour preexisting_dirty.
+- Mechanism: one shared predicate `isLockfile` in loki-ts/src/e10ext/preexisting_dirty.ts, matching the lockfile family by name pattern (`*.lock`, `*-lock.json|yaml|yml`, `*.lockb`, `*.lockfile`, `lockfile`, go.sum, npm-shrinkwrap.json, Package.resolved), used by splitDirty. No new engine path. The `*-lock.*` branch is a deliberate trade: a hand-written src/door-lock.yaml would match, and the byte-based intake protection (the blob recorded at intake, dropped from staging) bounds the risk.
+- Fixture: loki-ts/tests/engine10/intake.test.ts describe "FC-42" (nested frontend/package-lock.json as in aiq-52, plus Gemfile.lock and uv.lock; each red before the fix where the name was unlisted; a dirty source file or package.json alongside still refuses).
+
+## FC-43 A model that ends LOKI_DONE with an empty diff is failed without one correction (FC-19 family)
+- User saw: D50 baseline (METRICS.md:566, PROGRESS.md:1871), pub-humanize-174, Loki+sonnet: "implement ran 95s and produced an empty diff with no already_done marker; FAILED, no PR". Raw sonnet completed the same task (2/3 on rerun). The user got a FAILED receipt for a session that simply stopped.
+- Law: L1 (never below raw), L5 (a harness verdict must not be the first and only reaction to a recoverable stop). The false BLOCKED "spec conflict against existing tests" in the same row is FC-19 plus D50-F2-S3 (40ca5f378): the brief's append-only test rule had no exception for a spec-stated assertion value; both are already on main (context.ts:23-24, conflict_resume.ts), so the conflict half is not reproduced on main here.
+- Cause (measured): implement.ts classifies a marker-less or LOKI_DONE exit 0 as "done" without looking at the tree; verify.ts:252 then fails "empty diff without an already_done marker" and seal.ts:152 seals FAILED. FC-19 resumes a spec-conflict exit once; the done-with-nothing exit had no equivalent. Every stage rule is correct (empty diff is not VERIFIED); the gap is that nothing asked the model to either change the code or claim LOKI_ALREADY_DONE with evidence before the verdict.
+- Siblings swept: LOKI_SPEC_CONFLICT (resumed, FC-19); LOKI_ALREADY_DONE (honoured, then confirmed by already_done.ts evidence); fix.ts rounds reuse buildImplementBrief but do not go through this stage's classification, so they are unchanged.
+- Mechanism: one shared resume, util/conflict_resume.ts `resumeAfterEmptyDone`, called from implement.ts when the final exit is "done" and `git diff <base>` plus untracked (the exact set verify.ts changedFiles uses) is empty. One correction: "your tree has no changes; make the change, or finish with LOKI_ALREADY_DONE: <file:line evidence>, or LOKI_SPEC_CONFLICT: <reason>". No wording of the model's output is inspected (L0). A resume that errors, is killed, or ends without a marker keeps the first result, so the verdict is never worse than before. Cost: one extra turn, only on empty-diff done exits.
+- Fixture: loki-ts/tests/engine10/empty_done_resume.test.ts (empty tree + done resumes once with the correction; a resumed session that edits the tree completes as done; no resume when the tree has changes; no second resume; a failed resume keeps the first result).
+
+## FC-45 A TL review ran a narrower suite than the files the slice touched (PRICE-TRUTH left 7 red tests on main)
+- User saw: nothing yet. Raw: PRICE-TRUTH (84d601721) changed loki-ts/src/runner/budget.ts and loki-ts/data/model-pricing.json, but its review ran only tests/util; tests/runner/budget.test.ts and budget_haiku55.test.ts went red on main 7e6692a8b (58 pass, 7 fail) and blocked the 11.3.1 cut.
+- Law: evidence or it did not happen (OPERATING-MODEL discipline): a review verdict covers only the suites it ran.
+- Causes (each decided against the pricing page, read 2026-10-08): CODE bug, no claude-haiku-4-5 row, so the exact id fell through to the haiku alias (now Haiku 5.5, $0.10) while the page prices Haiku 4.5 at $1/$5 (fixed: exact-id row in model-pricing.json and the budget.ts fallback). TEST stale: opus 5/25 (page: Opus 5.5 $4/$20), haiku alias 1/5 (alias = claude-haiku-5-5 per model_catalog.json cli_aliases), rounding case, immutable-table row without cache tiers, over_100k without cache_write_5m/1h, source date 2026-10-07 vs the 2026-10-08 read.
+- Siblings swept and fixed in the same slice: the bash route (run.sh check_budget_limit) keys by exact string with a sonnet fallback, so claude-haiku-4-5 AND claude-haiku-5-5 priced at the sonnet row there (12.0 per 1M in+out, measured red); run.sh _write_pricing_json lacked 4-5; dashboard _DEFAULT_PRICING lacked both. All id-keyed tables now carry both ids. autonomy/loki is title-case family keyed.
+- Mechanism (CTO ruling): a TL review runs `scripts/select-tests.sh` on the slice diff plus the always-run guards, and pastes the command and its rc in the verdict. A review without the selector output is incomplete.
+- Fixture: loki-ts/tests/runner/budget_haiku55.test.ts (claude-haiku-4-5 stays $1/$5, red before the row existed) and the bash-route section of tests/test-pricing-parity.sh (claude-haiku-4-5 6.0 and claude-haiku-5-5 0.6 per 1M in+out through the real check_budget_limit).
+
+## FC-46 Suites deferred to nightly let train drift reach main (D90 family)
+- User saw: the 11.3.1 cut blocked on run 37737159605 (main 7e6692a8b) with six red full-tier suites, none of which the fast gate had run on the trains that introduced the drift. Raw: each train was green at merge.
+- Law: evidence or it did not happen (OPERATING-MODEL.md Discipline); a verdict covers only the suites it ran.
+- Cause (measured): D90 (699d4ed25) moved suites over 80s to nightly, so DEP-01 (docker-build-check.yml, full-suite.yml rows), DOC-02 (future-slice cards in docs/v11/MARKET-SLICES.md), agent-types-loaded (README rewrite dropped the reviewer-selection sentence), analytics-toggle (a new bin/loki case guard shifted a brittle grep anchor), train-verdict-reuse (first-run-gate.yml deleted) and shellcheck SC2148 on tests/real-run/scenarios drifted with no gate in front of them.
+- Siblings swept: every one of the six suites was run individually red then green; the fast tier covers the same files only through select-tests.sh diff selection.
+- Mechanism: a change that touches a file a deferred suite reads (workflows, README, docs/v11, bin/loki, tests/real-run) must name that suite in its slice card Wall checks and run it before merge; the nightly is the backstop, not the first detector.
+- Fixture: the six suites themselves (tests/test-dep-inventory.sh, tests/test-docs-cli-drift.sh, tests/test-agent-types-loaded.sh, tests/test-telemetry-analytics-toggle.sh, tests/test-train-verdict-reuse.sh, shellcheck -S error tests/real-run/scenarios/*.sh).

package/docs/v10/FOUNDER-QUEUE.md

@@ -25,3 +25,4 @@ this file; each item says what the loop does meanwhile.
 | 18 | 2026-10-03 | Screenshot veto for the 10.8.0 Control Plane rebuild (D83): the ground colour #F1F2F6 from the legacy dashboard, and keeping the legacy mascot in the sidebar brand. Also: light-theme status text uses AA-safe companion ink tokens (darker than the legacy hex) because the legacy success, warning, info and muted text fail WCAG AA on #F1F2F6. | Brand and visual design. | Builds with the legacy ground and mascot plus the AA ink tokens (D83 point 6); screenshots go in PROGRESS when CPE-02 lands. | open |
 | 19 | 2026-10-03 | FC-21b and FC-22 (docs/v10/FC21B-FC22-PLAN.md): (a) after an implement time limit, VERIFIED also requires a Wall or task-named test to pass with n>0; (b) dependency install runs by default, only when a selected check fails with a harness-owned load error, opt-out LOKI_E10_INSTALL=0 or loki.yaml verify.install_deps false; (c) exit code 3 (BUDGET_STOP) is dropped whenever a receipt is sealed, outcome and exit follow receipt.verdict. | Behavior and exit-code changes users see. | Decided by the CoS under the standing mandate: (a) yes, (b) yes as stated, (c) yes with a CHANGELOG Changed entry. Founder may reverse. | open |
 | 20 | 2026-10-04 | CP-ASK (docs/v10/CP-ASK-PLAN.md): (a) with LOKI_CP_ASK on, the home box is Ask only, with a "Start a build" link to Compose; (b) defaults $1.00 per ask and 600s, configurable, Ask spend shown on the Cost page apart from run budgets; (c) CP-level runs, receipts and events across all repos always available, per-repo memory and code tools scoped to one repo chip per ask. | Product shape and spend defaults. | Decided by the CoS under the standing mandate as stated. Founder may reverse. | open |
+| 21 | 2026-10-07 | Enable GitHub private vulnerability reporting in the repo settings (Settings, Code security, Private vulnerability reporting). SECURITY.md already tells reporters to use Security tab, "Report a vulnerability". | Public repo settings; agents never change them. | SECURITY.md ships as written; until enabled the "Report a vulnerability" button is absent. | open |

package/docs/v10/GUARDS.md

@@ -837,3 +837,16 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   `tests/test-cp-redesign-images.sh` builds a fixture with an unlisted image,
   a ui-refs image and a banned name and asserts each fails.
   Run: `bash tests/test-cp-redesign-images.sh`.
+
+## D91 finding guards (review BLOCK classes become tests)
+
+- **Incident:** the same six review BLOCK classes recurred across trains and were caught only by human or agent reviewers.
+- **Guards** (all in `loki-ts/tests/util/`, each under 2s, picked up by `bun test tests/util`; allowlists in `loki-ts/tests/util/guard-allowlists/`, one `path | reason` per line (full-env-spawn and model-output-regex use `path@N` per-site counts, so a new site in a listed file fails), stale entries and missing reasons fail):
+  1. `raw_gh_spawn_guard.test.ts` (FC-25, FC-40): raw `gh` spawn in loki-ts/src, and raw `git push` / `gh pr create` in autonomy bash, outside the allowlist. Raw `git` in TS stays with `fc25_raw_spawn_guard.test.ts`. Known follow-up: autonomy/loki auto-PR paths push raw.
+  2. `start_flag_parity_guard.test.ts` (FC-37, FC-38): the `loki start` flag sets of bash `cmd_start` and Bun `start.ts` against the declared table `start-flags.txt`. Three real divergences are recorded (`--budget-limit`, `--no-pr`, `--session-model` are Bun-only).
+  3. `registration_list_guard.test.ts` (FC-32, FC-39): every module under src/commands and src/engine10/stages is imported somewhere, and every literal package.json files[] entry exists. Test-runner and shard lists stay with `scripts/structural-checks.sh` and `tests/test-shard-coverage.sh`. Known orphan: commands/status.ts.
+  4. `swarm_internal_read_guard.test.ts`: product code (loki-ts/src, autonomy/) naming docs/v10/BOARD.md, scripts/v10-* or .loki/v10-leader. Zero exceptions today.
+  5. `full_env_spawn_guard.test.ts` (FC-40): a spawn call site with no env or a bare process.env copy, unless the file is baselined. The baseline groups WORKER, UTILITY and SWEEP; SWEEP entries are the conversion backlog. Limit: an env variable built earlier than 14 lines above the call is not seen.
+  6. `model_output_regex_guard.test.ts` (L0, FC-36 family): regex exec/match on model-output variables under engine10. Baselined: xreview VERDICT and session sentinel parsing (follow-up to schema-checked JSON).
+- **The test that proves it fires:** each file plants a violation in the working tree during review (mutation run recorded in the slice report); `full_env_spawn_guard` and `model_output_regex_guard` also carry in-file detector self-tests.
+  Run: `cd loki-ts && bun test tests/util`.

package/docs/v10/LEGACY-REMOVAL.md

@@ -40,13 +40,12 @@ One-word bash commands (autonomy/loki main(), line 21621) and their fate:
 ## 2. Docs and help surface (existing Wave 1, no new work)
 
 `grep -rlE "run.sh|LOKI_ENGINE|loki legacy|legacy engine"` counts (files / mentions):
-- Root: README.md 19, SKILL.md 10, ARCHITECTURE.md 9, COMPONENTS.md 4, AGENTS.md 2, CONTRIBUTING.md 2, TESTING.md 2, CLAUDE.md 1, SETUP.md 1, Dockerfile 1.
+- Root: README.md 19, SKILL.md 10, AGENTS.md 2, CONTRIBUTING.md 2, CLAUDE.md 1, Dockerfile 1. ARCHITECTURE.md (9), COMPONENTS.md (4) and TESTING.md (2) live under docs/; there is no root SETUP.md.
 - docs/: 109 files, 1200 mentions. Shipped (package.json `docs/**/*.md`). Heaviest: v10/BOARD.md 72, BUG-AUDIT-v6.61.0.md 61, ONE-RUN-AUDIT.md 44, BRANCH-LIFECYCLE-PLAN.md 44, CONFIG-FILE-PLAN.md 41, architecture/STATE-MACHINES.md 33, test-scenarios/edge-cases.md 32, v10/ENGINE.md 30, V8-AGENT-SDK-PLAN.md 28, dev/project-structure.md 14. Most are legacy plans: delete, not edit. Keep docs/v10/ (internal records; exclude from `files`).
 - wiki/: 6 files, 13 mentions (Quality-Gates, Enterprise-Features, Enterprise, Contributing, Checkpoints, API-Reference). Quality-Gates and Checkpoints are legacy features: delete pages.
-- skills/ 9 files 33, references/ 7 files 16, vscode-extension/ 3 files 4, integrations/ 2 files 3, templates/ 1 file 2, agent-skills/ 1, packages/loki-seal 4 files 4 (wording only; loki-seal stays).
+- skills/ 9 files 33, references/ 7 files 16, vscode-extension/ 3 files 4, integrations/ 2 files 3, templates/ 1 file 2, examples/agent-skills/ 1, packages/loki-seal 4 files 4 (wording only; loki-seal stays).
 - CLI help: autonomy/loki help (goes with the file), loki-ts/src/cli.ts HELP, engine10/cli.ts USAGE, bin/loki error strings (lines 81, 92, 382, 388).
 - completions/_loki, completions/loki.bash: 0 pattern hits but list every bash command; regenerate from the v10 command list.
-- website/: 0 hits.
 
 ## 3. Directory classification
 
@@ -194,16 +193,15 @@ Row count: 6 rows, decisions: 4 DELETE, 1 KEEP, 1 MOVE.
 |---|---|---|---|
 | README.md version/legacy refs | README.md:3 (3 mentions of v8, v9, legacy), lines mentioning LOKI_ENGINE and `loki legacy` | public docs, npm landing page | DELETE LOKI_ENGINE=legacy hint; rewrite "legacy engine" sections to v10 info or migration note (MOVE history to docs/history/v9-engine.md) |
 | SKILL.md version refs | SKILL.md:28 (old command list, legacy engine description) | Claude Code CLI skill | REPLACE with v10 command list generated from registry (see J below); DELETE legacy engine section |
-| ARCHITECTURE.md | ARCHITECTURE.md:9 mentions | internal docs | audit and DELETE legacy references; KEEP v10 architecture |
+| docs/ARCHITECTURE.md | docs/ARCHITECTURE.md:9 mentions | internal docs | audit and DELETE legacy references; KEEP v10 architecture |
 | CLAUDE.md | CLAUDE.md:1 (v10 references) | developer instructions | KEEP; no cleanup needed |
 | docs/alternative-installations.md | mentions LOKI_ENGINE, legacy engine | shipped docs | DELETE or MOVE to history; rewrite for v10 only |
 | docs/exit-codes.md | mentions legacy command behavior | public API docs | REPLACE with v10 exit codes |
 | docs/ plan files (BUG-AUDIT, ONE-RUN-AUDIT, BRANCH-LIFECYCLE-PLAN, etc., 44 mentions) | grep -l "legacy\|LOKI_ENGINE\|run.sh" docs/ | team reference | MOVE to docs/history/ with dated header (use `git log -1 --format=%cs <file>`) |
 | wiki/ (6 files, 13 mentions) | wiki/Quality-Gates.md, wiki/Checkpoints.md | team docs | DELETE Quality-Gates, Checkpoints (legacy features); audit others |
 | version strings in CLI help | autonomy/loki help output (v8, v9, v10 mentions) | users | DELETE or hand-write to match package.json VERSION |
-| site/docs (if shipped) | website/ (0 legacy hits) | web presence | KEEP; audit for stale info |
 
-Row count: 11 rows, decisions: 3 KEEP, 5 DELETE, 3 MOVE to history, 1 REPLACE (SKILL.md).
+Row count: 10 rows, decisions: 2 KEEP, 5 DELETE, 3 MOVE to history, 1 REPLACE (SKILL.md).
 
 ## 12. I. Tests of legacy surfaces
 

package/docs/v10/METRICS.md

@@ -262,7 +262,7 @@ Misses: pub-click-3059 (hidden tests failed: wrong metavar bracketing), pub-huma
 
 pub-more-itertools-1192 through the E-14 glue entry, real claude, --no-pr: 30s wall (intake 0s, plan 16s, implement 12s, verify 3s, commit and seal under 1s), hidden test passes, $0.4486 over 2 sessions (plan $0.2264, implement $0.2223), verdict PARTIAL only because ruff is not installed. Raw claude on the same task: 15s, $0.1290. The planner session costs as much as the implement session.
 
-## Loki 10 gate report, small tier (2026-09-28, D30; v10.0.0 decision)
+## Loki 10 report on the gates, small tier (2026-09-28, D30; v10.0.0 decision)
 
 All arms on claude-opus-5-5, 29 small tasks with hidden tests, fresh clone per run, provider-sourced cost only. D30 targets vs raw: completion 96.5% or higher, cost per completed task $0.118 or lower, time to a correct result at most raw.
 
@@ -279,7 +279,7 @@ All arms on claude-opus-5-5, 29 small tasks with hidden tests, fresh clone per r
 - Lean-session evidence, 5 tasks (EV-8 D/E, not the full arm): opus lean 4/5 at $0.1571 per completed, p50 28s; sonnet lean 4/5 at $0.1519, p50 27.5s; raw opus on the same 5: 5/5, $0.2161, p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). The lean small path is not the default yet (E-64 in rework).
 - Medium and large tiers: not built (EV-11 3 of 15 verified, EV-12 in rework). No "2-5x" claim.
 
-## Loki 10 gate report, medium tier (upstream tests, deletion-mutant audited, not shortcut audited) (2026-09-28, D38; EV-14)
+## Loki 10 report on the gates, medium tier (upstream tests, deletion-mutant audited, not shortcut audited) (2026-09-28, D38; EV-14)
 
 Evidence note (Chief of Staff, 18:00Z): the per-run result files (eval/loki10/results/ev14-medium-{raw,v10}-r{1,2}/results.jsonl, gitignored) were lost when the EV-14 worktree was force-removed in the 17:36Z pruning incident (PROGRESS.md, E-96). The table below is the run agent's report from those files before removal (commit 0afef9e4); it cannot be re-audited. EV-15 re-runs the tier with results kept outside any worktree.
 

package/docs/v10/MODERNIZE.md

@@ -236,7 +236,7 @@ The report never states more than the equivalence data proves. It is sealed and
 **COBOL to Java**
 - It needs a GnuCOBOL or mainframe runtime and file or copybook I/O capture. It also has no in-process boundary, and Legacy-Bench scores run 16.9-42.5% (V10-RESEARCH section 7).
 - The research gives a method (witness search, symbolic execution plus delta debugging) but no tooling we have.
-- It starts after the first two targets meet the section 12 gates.
+- It starts after the first two targets meet the gates in section 12.
 
 **AngularJS to React** follows COBOL. It needs browser-level capture (Playwright traces) as the oracle.
 

package/docs/v10/OPERATING-MODEL.md

@@ -18,6 +18,7 @@ The CEO is Lokesh Mure (Loki), the founder. Everyone else is an agent. The compa
 - Non-leader sessions act as extra engineers or reviewers on BOARD.md slices, or answer Loki. They never push, bump VERSION, release or rewrite BOARD.md.
 
 ## Nobody sits idle
+- Ready queue >= 30 specced slices (features, enhancements, fixes evenly; D91). Seat cap 14 while weekly usage < 50%.
 - The Chief of Staff keeps 8-16 engineers busy whenever ready slices exist. When anyone finishes, the next slice is assigned in the same turn.
 - The ready queue never drops below 2x the number of engineers; PMs and POs refill it.
 - Idle seats while work exists, or an empty ready queue, is a P0 violation.
@@ -31,7 +32,7 @@ The CEO is Lokesh Mure (Loki), the founder. Everyone else is an agent. The compa
 - Tier A fast gate on every change (target 60-120s): syntax checks, changed-file shellcheck, diff-selected tests, moat suite split per property. It is feedback, not release authority.
 - Tier B: every main commit has a full Tier B verdict on its exact tree, run on main or on the train that produced it (D55); never cancelled on main.
 - Release = a lookup: publish a commit whose tree already has a Tier B pass. A VERSION-only bump reuses its parent's verdict. Target: 2 min from verified to npm.
-- Trains: the Release Manager batches merged slices; one push per train; releases when verified; the next train opens immediately. Never hold a train for one HIGH slice.
+- Clock cuts (D91): one release every 45 min from whatever is approved and green on main; no cut waits for a slice. Target per cut: >=3 features and >=5 enhancements or fixes, user-facing CHANGELOG. Approved slices merge to main continuously (tsc, impacted tests, global guards, P9); risky work merges flag-gated. A moat regression still blocks a cut.
 - If Tier B fails on main: stop releases, open a P0 fix-forward slice. Never unpublish; npm deprecate is allowed.
 
 ## Large tasks (for example "rebuild the dashboard")

package/docs/v10/PROGRESS.md

@@ -2268,3 +2268,32 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - Tests run 37173985482 on 22a5701e1: the cap held but FC-19 read 1799.999 on the first session; 559d3e604 asserts 1799 < limit <= 1800. Tests run 37174422458 on 559d3e604: success (all jobs).
 - 11.0.1 = the bump commit on top of 559d3e604 (release.sh patch --bump-only rc=0). Check `gh run list --workflow release.yml --limit 1` and `npm view loki-mode dist-tags` on resume.
 - Branch and worktree cleanup (founder ask, one agent): 177 merged worktrees removed (187 kept: 150 unmerged, 25 dirty, 8 locked, live, protected), 1015 merged local branches deleted (338 kept), 119 merged remote branches deleted. Unmerged remote branches left for the founder: auto/model-catalog-probe (1 ahead), dep-wave1 (5), slice-A-121b (1), train/66 (1).
+
+## 2026-10-08T05:35Z (CoS) 11.3.1 held on SEC-FSMON; local main 743d7ee2f unpushed
+- origin/main = bee8ac363 = v11.3.0 (npm latest). 11.3.1 is held ONLY on SEC-FSMON: since bee8ac363, the cost preview runs in the supervisor and spawns raw git (project_model/gather.ts listShallow/isGitTracked) with the token, so the P9 fsmonitor plant ran holding GH_TOKEN. v11.3.0 is not affected (P9 PASS on bee8ac363).
+- SEC-FSMON fix 464c6d4a6 (41 git spawn sites routed through util/safe_git.ts, zero-allowlist fc25 guard, canary fixture, red then green). It conflicts with main in safe_git.ts and xreview.ts; the engineer is rebasing onto the main tip. HIGH review (high-sec-fsmon, opus) is in flight. Open ruling: worker git now runs with hooks off and gpgSign off, including the seal commit.
+- Merged locally since bee8ac363 (unpushed): FC38-SCOPE2, COST-HALF rev 3 docs (D93), COMPACT-ONLY-HAIKU, CH-02, FINDING-GUARDS (reverted at fbcde1dcf for start-flag parity, re-landed rebased with start-flags.txt fixed; tests/util 99/0), MCP-A (node protocol tests rc=0, test-mcp-server rc=0).
+- Hermeticity defect: attempts-dispatch "no bun on PATH" fails only in the main checkout; git-archive of the same SHA passes 14/0. Queued as TEST-HERMETIC.
+- In review or rework: MASS-1 250940c67 (only the SDK route runs triage; HIGH re-review), RECEIPT-TRUTH (HIGH BLOCK B1-B5 plus modelUsage scope; uncommitted), JUDGE-DEFAULTS 5d7ab2b9d (rebase plus tsc gaps, then TL re-review), WC-01a 8c528d66b (TL), EVAL-LOSSES (aiq-52 dirty-tree class, humanize-174; CTO accuracy directive).
+- Ship steps after SEC-FSMON approves: merge, rebuild dist in the main checkout, run moat P5/P9/full on the final SHA, push (fetch plus ancestry check, no active release), Tests green, release.sh patch --bump-only plus the CHANGELOG from scratchpad changelog-1131.md (add the SEC-FSMON and FINDING-GUARDS/MCP-A lines).
+
+## 2026-10-08T07:10Z (CoS) 11.3.1 train: FULL-DRIFT merged; PRICE-TRUTH-2 and PLAN-TIMEOUT pending
+- origin/main = 7e6692a8b. Tests on it was cancelled: the D90 plan job hit its 5-min cap before `|| true`, and the full fallback was red on six drift suites plus 7 budget tests.
+- FULL-DRIFT merged locally as cdbec7679 at the approved SHA 0382cad94 (TL APPROVE 9d5c0350e plus delta APPROVE 0382cad94; tree equal to 0382cad94; tests/util 110/0). An earlier merge by branch name picked up the unreviewed 0382cad94 and was undone with `git reset --keep` before any push; lesson saved: merge the approved SHA.
+- PRICE-TRUTH-2 884d22be1 (claude-haiku-4-5 at $1/$5 on every exact-id table; bash check_budget_limit also priced claude-haiku-5-5 as sonnet; parity test runs the real function; FC-45): TL review with tl-fix1131, selector output required (CTO rule).
+- PLAN-TIMEOUT (sec-fsmonitor): building under the CTO conditions (fail-safe full=true, never cancelled, under 30s for 100 commits, cheap drift checks always-run under 60s). FC-47 reserved.
+- RECEIPT-TRUTH 66931a217 (11.3.2): HIGH round 5 with high-receipt-truth; branch frozen.
+- Next: merge PRICE-TRUTH-2 and PLAN-TIMEOUT by SHA, dist rebuild if needed, moat on the final SHA, push, Tests green on that SHA, then release.sh patch --bump-only with scratchpad changelog-1131.md.
+
+## 2026-10-08 07:43Z CoS
+- PRICE-TRUTH-2 merged by SHA 884d22be1 as 82eb1ad31 (FC-45/FC-46 rows conflict resolved, both kept); post-merge util+budget 175/0, test-pricing-parity rc 0; git diff 884d22be1 HEAD^2 empty.
+- 11.3.1 now blocked only on PLAN-TIMEOUT: high-cifast parity byte-identical (236s->2s, 455s->4s), 169-commit plan 15s; P1 timeout-minutes 8, P2 timing test, P3 always-run set, P4 rebase onto 82eb1ad31 sent to sec-fsmonitor.
+- 11.3.2 approved queue (hold until 11.3.1 cut, merge by SHA): 132-E2 057b332e9, 132-B4 36284ebb5, 132-F1 82837ec9f. In review: 132-E3, 132-F3, 133-E2, GOV-FORMULA 76afb31a8. 132-E4 31b5c304b built, target missed (4x 23.7s vs 12s at load 20-26), TL deferred until load drops.
+- Found: tests/cli/test-alias-forwarding.sh fails 3 cases on cdbec7679 (help count 27 vs [12,23], local-ci parity rule missing, report export json kpis exit parity); check in the FULL tier run before the cut.
+
+## 2026-10-08 08:17Z CoS
+- RECEIPT-TRUTH round 6 APPROVED by HIGH at 1b5bbaef5 (R5-1/2/4 mutations red, moat rc 0 with P9 PROVEN, CP 519/0); queued for 11.3.2.
+- FC-47 (CTO ruling): select-tests --run is a no-op on R0 and docs diffs (early exits before DO_RUN). Interim rule: TLs on R0 diffs name and run suites explicitly and report the number of suites executed. Fix slice SEL-RUN-FC47 goes after PLAN-TIMEOUT, then a one-shot audit of the R0 merges since v11.3.0.
+- PLAN-TIMEOUT engineer had no edits from 07:40Z to 08:14Z; re-pinged with a commit-now instruction.
+
+- 2026-10-08T10:27Z CoS: PLAN-TIMEOUT-1 merged by SHA b43536756 (TL APPROVE: fast-gate 10, train-verdict-reuse 40, select-tests 42, rc 0; git diff approved..HEAD^2 empty). Full local tier on 82eb1ad31 hit the 45-min cap (rc 124); reds classified env-only (receipt_attest needs cryptography; indexer + typecheck worktree-path only, green in main). bun 2004/0, util 175/0, moat rc 0 5/9. Lost ~1h: TL verdict sat in an idle teammate; next time read the subagent transcript after 10 min instead of waiting. Pushing the 11.3.1 train now.