loki-mode 11.3.0 → 11.3.2

package/docs/v10/FAILURE-CLASSES.md

@@ -304,6 +304,7 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Fixture: a bun test that plants core.fsmonitor and a canary GH_TOKEN, then calls resolveRunCapS and asserts the plant never ran; and the moat case P9.injection-cannot-reach-token passes locally (`bash tests/moat/run.sh`, P9 line).
 - FC-25b (sibling, found in the opus review, 2026-10-04T01:02Z): the hooks, fsmonitor and sshCommand flag set alone still lets three plant classes run holding the canary token (git 2.55.0). (1) filter.<drv>.clean or process, declared in .gitattributes or .git/info/attributes, fires on status --porcelain, diff --name-only HEAD, add and commit. (2) diff.<drv>.textconv fires on log -p and on a diff with patch output. (3) gpg.program with commit.gpgSign=true fires on commit. A scrubbed env does not close the hole, because a running plant can still read the gh hosts file or the keyring. Execution itself has to be stopped. Mechanism: the same safeGit helper blanks each configured filter and textconv key, and sets diff.external=, commit.gpgSign=false, core.attributesFile=/dev/null and GIT_ATTR_SOURCE=<empty tree>. Fixture: fc25_safe_git.test.ts adds one plant per class.
 - FC-25c (follow-ups from the opus review of d82aec15a, 2026-10-04T01:15Z; not reachable with a real token today). (a) The allowToken path still honors repo-local core.sshCommand, remote.*.uploadpack and receivepack, and a repo-scope credential.helper; the canary fired on an ssh origin and on a local-path uploadpack. Its only caller is the base_guard fetch, reached from intake in the worker with the sentinel env, and supervisor.ts baseLine passes fetchRemote=false. Fix: harden allowToken itself, or add a guard that pins it to that single worker-side caller. (b) The raw-spawn guard misses an indirect argv (`const GIT = "git"`) and does not scan packages/control-plane. ship_hook.ts reaches control-plane shipper/discover.ts gitOrigin (`git config --get`, real-token env) from the supervisor. Fix: convert it to safeGit and widen the guard. (c) preflight's safeGitArgv path does not set GIT_CONFIG_NOSYSTEM. Low risk, because system config is root-owned.
+- FC-25d (moat P9 [planted] red on main after v11.3.0, 2026-10-08; v11.3.0 itself passes). User saw: "[planted] a plant in the agent's repo config ran holding the real GitHub token: fsmonitor,fsmonitor,fsmonitor,fsmonitor" plus the SSH agent socket finding. Culprit: 93f22d197 (cost preview v1, merged via 939ca2992): supervisor.ts calls encodeEstimate(process.env, repoDir) before the worker spawns. Root cause: the supervisor now runs the cost preview (runner/router/cost_preview.ts estimateFor -> history.ts shapeKeyForRepo), which reached project_model/gather.ts listShallow (`git ls-files -z`, line 30) and isGitTracked (`git ls-files --error-unmatch`, line 107), both raw execFileSync with env: process.env. Each fired fsmonitor twice (trace2 parent sid: the top-level bun supervisor). The raw-spawn guard had gather.ts on its allowlist ("follow-up: confirm every caller is worker-side"). Law: L2 and moat P9 Rule of Two; the allowlist was a per-file trust claim that a later caller broke. Siblings: 41 raw git spawn sites across 21 files (the new guard on main e2f9c49ca) (engine10 stages, e10ext, runner, features, cli/completions, github_token); and preflight.ts and xreview.ts passed safeGitEnv() to util/shell.ts run(), which merges opts.env over process.env, so the token survived there too. Mechanism: util/safe_git.ts is the only way to spawn git (safeGit, safeGitSpawn for status/Buffer/stdin, safeGitRun async with the exact env, never merged); the guard tests/util/fc25_raw_spawn_guard.test.ts has NO allowlist, scans loki-ts/src, bin/ and autonomy/ JS/TS (multi-line, Bun.spawn, argv literals, `const X = "git"`), and fails on safeGitEnv/safeGitArgs used outside safe_git.ts. Content-writing worker calls (add, checkout, worktree add) opt in to repoDrivers so repo filters (local LFS) and the user's core.attributesFile still apply; the seal commit also opts in to userHooks (user hooks and commit signing, refused with allowToken). The token stays stripped and fsmonitor stays off on all of them. HIGH review B2: a core.fsmonitor plant cannot tell a token-free env from one merged over process.env (the -c flag disables it either way), so the env fixture records through a repoDrivers clean filter safe_git keeps live, for all three entry points, with an allowToken positive control. Patch commands get --no-ext-diff --no-textconv (FC-41, 7cf8028b0). Same mechanism, swept here: DRIVER_KEY_RE also blanks repo-scope diff.<drv>.command, and the subcommand finder skips the values of --config-env and --attr-source. Fixture: tests/util/fc25_supervisor_git_fsmonitor.test.ts (a child bun with a start-env canary calls shallowDirs, isGitTracked, gather, shapeKeyForRepo, estimateFor and the three helpers; the plant must never see the canary, while an explicit-env control must). Out of scope here: bash/python git calls in bin/ and autonomy/ (no JS/TS git spawns exist there), and packages/control-plane discover.ts/diffstat.ts/checkpoints.ts (FC-25c b).
 
 ## FC-26 Free text in the Control Plane starts a run in HOME that dies in 0.13s, and the run page says "did not pass verification"
 - User saw: runs cc22 and e606 on the founder's CP, both FAILED in about 0.13s, with a summary that blamed verification. The founder had typed "whats going on so far" in the home box. Raw `loki start` refuses a non-repo dir with a clear message.
@@ -360,8 +361,13 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - User saw: Tier B run 37706008817 on main 6a01413bd failed two suites: "no hardcoded home-directory paths in tests" (and its cascade, "Structural checks catch planted defects (D44-C)") and "Loki control plane wiring (CP-04)". Both slices had passed tsc and the full bun test.
 - Law: L2 (a verdict is about the tree it names; a gate that did not run the guarding suites says nothing about them).
 - Cause (measured): faf1d0ace added tests/test-parity-goal-score.sh with hardcoded /opt/homebrew/bin and /usr/local/bin grep paths (flagged by tests/test-no-hardcoded-paths.sh). The R1 router slices (0f3e3d55a, c15b8157b, 1b9e479c1) added loki-ts/src/engine10/cost.ts, runner/router/flag.ts and runner/router/route_block.ts to the control-plane value-import closure, but Dockerfile.control-plane lists its COPY files by hand. RC-SLICE-SHELL-GATE: the FC-31 impacted gate selected neither shell structural guard, including for a touched tests/*.sh.
-- Mechanism (this slice, minimal): the parity test discovers greps with `type -ap grep ggrep` (no absolute paths); the three files are added to Dockerfile.control-plane. 11.2.2 follow-up (root fix): replace the hand-maintained COPY list with a directory COPY or a generated list, make CP-04 build the image and import the bundle, and extend scripts/select-tests.sh so a touched tests/*.sh selects the hardcoded-path and structural-checks suites and a loki-ts/src file reachable from packages/control-plane selects CP-04.
+- Mechanism (P0 slice, interim): the parity test discovers greps with `type -ap grep ggrep` (no absolute paths); the three missing files were added to Dockerfile.control-plane.
+- Mechanism (root fix, 11.2.2 FC-32-ROOT): Dockerfile.control-plane now COPYs the whole loki-ts/src tree (2.4MB; the root Dockerfile already did). CP-04 (tests/test-control-plane.sh) no longer compares a list to the import graph: it stages exactly what the Dockerfile build stage COPYs (WORKDIR and relative or absolute destinations honored) and runs the real `bun build` of the server and ask-tools bundles there. Docker is not needed.
+- Why not the import-graph generator: a whole-tree COPY is viable (size 2.4MB, evidence: `du -sh loki-ts/src`), so the CTO's option 1 applies.
+- Regression fixtures (CP-04): the legacy per-file list (tests/fixtures/cp04-legacy-copy-list.txt) bundles the unmodified tree, goes RED when a brand-new loki-ts file is imported (needs a list edit), while the tree COPY passes with no edit; a really missing import target and a deleted loki-ts COPY both go red.
+- Gate selection (RC-SLICE-SHELL-GATE): scripts/select-tests.sh now selects tests/test-no-hardcoded-paths.sh and tests/test-structural-checks.sh for any changed tests/*.sh, and tests/test-control-plane.sh for any loki-ts/src file in the control-plane import closure (computed at selection time; python3 missing selects it for all loki-ts/src). Fixtures in tests/test-impacted-gate.sh (red before the fix: 2 failed on tests/*.sh; CP-04 red once the test stopped naming the files by accident).
 - Siblings swept: tests/test-no-hardcoded-paths.sh scans every tests/ file (3 passed, 0 failed after the fix); the CP-04 closure guard covers every loki-ts/src value import (25 passed, 0 failed); no other hits.
+- Sweep of hand-kept lists (root slice): package.json files[] has hand-listed web-app/{server,auth,models,crypto}.py and Dockerfile:146 the same four (a new web-app module would not ship; follow-up, change both to a glob together). tests/test-runtime-libs-are-packaged.sh hand-lists tools/*.py and autonomy/lib/*.py to assert (drift means a new tool is unasserted, not unshipped; follow-up: derive from the directory). tests/test-detectors-are-packaged.sh derives its list from run.sh (already the right shape). action.yml and .github/actions/*: no file lists. tests/test-release-dist-guard.sh: checks map content, no list.
 - Fixture: the two existing guards, red on 6a01413bd and green here.
 
 ## FC-33 Duplicate implementations kept in sync by tests (FC-DUP)
@@ -381,3 +387,208 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: grep of loki-ts/tests and loki-ts/test for in-process dynamic imports from tmp/mkdtemp roots and for cpSync tests that import. Only route_matrix_lib.ts (lines 57-60, 178-179) imports from a variable root. graph.test.ts and providers.test.ts copy fixtures, not src; providers.test.ts imports real src inside a spawned script. route_matrix.test.ts passes the real src dir, which coverage tracks normally. No other hits.
 - Mechanism: the mutation test evaluates each copy through `Bun.spawn([process.execPath, route_matrix_child.ts, root])` (no --coverage), reading violations as JSON. A non-zero exit or unparsable output throws, so a crashed child can never pass a red case or the control case vacuously.
 - Fixture: the "FC-34 guard" describe block in loki-ts/tests/engine10/route_matrix_mutation.test.ts (red when the file imports route_matrix_lib in-process or does `await import(join(root` against a temp root; verified red by reverting the fix locally).
+
+## FC-35 The router start line, receipt and plan disagree about the route
+- User saw: CTO smoke with LOKI_ROUTER=1 on a node off-by-one fixture. The start line said "route: executor haiku-5.5, advisor opus: Opus routes at plan time", the receipt said routed:false, units:[], executor:null, "no route recorded by implement", every session ran claude-sonnet-5-5, no plan-scope.json was written (plan logged "plan sonnet (fast tier)"), and shape_key was null.
+- Law: L7 (what is advertised is what is recorded); also L2 (a null shape key feeds no history, R1-16) and founder design (Opus routes; Sonnet is the default executor; Haiku only when Opus assigns it).
+- Cause (measured): routeStartLine ignored all run data and defaulted the executor to haiku; the plan stage skipped small tasks even with the router on and ran the router-on plan on the fast tier (Sonnet) unless the advisor was unavailable; nothing recorded a route when the plan returned none, and the receipt read only implement.route, which no stage writes; shapeKeyForRepo was never called and ignores the run's project-model.answer.json.
+- Mechanism (one shared): runner/router/route_record.ts. The plan stage always writes <runDir>/route.json (a route, or routed:false with the reason) while the router is on. The receipt route block (buildRouteBlock, via plan output or route.json) and the PR line derive from that one record; the start line is printed before any stage, so it states the pre-plan state only ("decided at plan time, per-unit executors not applied") and never names an executor. The routing decision runs on Opus (Sonnet only after an Opus failure, recorded as NOT PROVEN) and no longer skips small tasks; since D93 the routing decision is one short structured-output Opus call and the full plan session is conditional (see Amended). shape_key comes from shapeKeyForRun (the run's project-model.answer.json, then the repo model). The "plan sonnet (fast tier)" downgrade is not printed while the router pins the plan to Opus.
+- Siblings swept: routeStartLine (supervisor.ts), buildRouteBlock (seal.ts), routePrLine/withSealRoute (pr.ts, via the sealed route_line), modelDowngrades (start line and run.started), doctor.ts router check (reads no executor); all other prints of an executor name go through modelLabel in route_block.ts. Router-off output is byte-identical (router_optout_golden plus the new off assertions).
+- Parked: implement does not yet apply per-unit executors (R1-11 wiring). The record carries applied:false (PER_UNIT_EXECUTORS_APPLIED), so the receipt and PR line say "<run model> (per-unit assignment not applied)", list units as "assigned haiku-5.5 (not applied)" and add a route.executor NOT PROVEN line; none claims haiku ran. plan_model records the model the fast tier really resolves to (fastTierModel), and the plan downgrade is suppressed only when the plan is really pinned to Opus.
+- Fixture: loki-ts/tests/engine10/route_record_agreement.test.ts (red before the fix).
+- Amended (D93, CTO, 2026-10-08): under LOKI_ROUTER=1 Opus ALWAYS makes the routing decision, as one short structured-output call (cache-stable prefix, effort low, output {size: trivial|small|medium|large, units[], needs_full_plan: bool}, measured target under $0.01). The full Opus plan session runs only when needs_full_plan is true; trivial and small tasks go straight to the routed executor on the lean path. The implement LOKI_NEED_PLAN marker is a second input to the same plan gate (it can raise the gate, never lower it). R-B is unchanged: the plan stage always emits a route (route.json) or a recorded reason; a failed or malformed routing call records routed:false with the reason and falls back to the full plan. Slice: COST-HALF LD-01 (docs/v11/COST-HALF.md); its Wall check requires the routing call below 10% of total cost on the trivial-sum B9 row.
+
+## FC-39 A hand-kept file list drifts from the import graph (second instance, in a fixture)
+- User saw: train-11.3.1 red at 1613125eb: tests/test-control-plane.sh "legacy fixture sanity failed" (24 passed, 1 failed). The RABC and T1 slices added loki-ts imports (route_record.ts, cost_preview.ts, pr_lessons.ts and their closure) that tests/fixtures/cp04-legacy-copy-list.txt did not list.
+- Law: L2 (a verdict is about the tree it names). FC-32-ROOT removed the hand-kept list from the product Dockerfile but left the same class alive in the test fixture.
+- Cause (measured): the fixture was a hand-kept per-file COPY list; a sweep of the import closure of its entry points found 11 unlisted files (cache, repomap, provider_failover, runner/types, cost_preview, history, history_store, atomic, engine_origin, pr_lessons plus route_record).
+- Mechanism (one shared): the legacy list is derived at fixture time from the import closure of serve.ts and tools_server.ts (legacy_copy_list in tests/test-control-plane.sh); the checked-in list file is deleted. The red-first case still holds because plant_import runs after derivation.
+- Siblings swept (tests/ and scripts/): the derived walk itself must not drop files: it maps .js/.mjs specifiers to .ts (latent class: no file in the serve.ts/tools_server.ts closure imports a .js or .mjs specifier today, so this guards future imports; the real tree list is unchanged), skips comment-only lines, and fails loudly naming any relative specifier it cannot resolve (fixtures in tests/test-control-plane.sh, red when the .js mapping is removed). No other hand-kept loki-ts/src file list. Remaining lists are not source-closure lists: tests/detect-test-mutations.sh HARNESS_FILES, tests/test-registration-nonstandard.sh CORPUS_FILES, scripts/license-audit.sh PACKAGE_FILES, tests/managed_memory/test_sdk_isolation.sh ALLOWLIST. Open (from FC-32, unchanged): Dockerfile:146 and package.json files[] hand-list web-app/{server,auth,models,crypto}.py.
+- Fixture: tests/test-control-plane.sh (25 passed, 0 failed; the sanity case is green by construction and cannot drift).
+
+## FC-37 A flag accepted on one route is silently dropped on another
+- User saw: `loki start "<task>" --no-pr --attempts 2` returned rc 0 and VERIFIED but ran ONE attempt, with no attempts receipt and no second worktree. `bin/loki` sent the positional task to engine10 before the --attempts diversion, and engine10 glued `--attempts 2` onto the task text. The same shape hid `--budget`: engine10 has no such flag, so `--budget 3` became task words and no cap applied.
+- Law: L0 (a flag the user typed is honored or refused, never ignored), L2 (one dispatch point owns each flag).
+- Siblings (sweep of start flags by route; routes: engine10 positional, Bun start.ts, bash cmd_start, attempts engine10 child):
+  - `--attempts`: engine10 positional was DROPPED (fixed); Bun route honored; bash route accepted only 1; attempts child n/a. Now parsed once in bin/loki before any route split: 1 is stripped, 2-5 exec the Bun start command, anything else or a missing value exits 2, N>=2 without bun exits 1.
+  - `--budget` / `--budget-limit`: engine10 positional was DROPPED into the task (fixed: translated to `--max-cost`); Bun and bash routes honored; attempts child DROPPED it (fixed: passes `--max-cost`).
+  - `--no-pr`: engine10 honored; Bun route rejected it as unknown (fixed: accepted as a no-op, the Bun loop opens no PR); bash route refuses it with `Unknown option` and exit 1 (loud, kept); attempts child always passes it.
+  - `--provider`: engine10, Bun and bash routes honored; attempts child forwards it.
+- Mechanism: one flag block ahead of the route split in `bin/loki` (`# FC-37`), plus the engine10 arm's budget translation and the attempts child argv in loki-ts/src/commands/start.ts.
+- Known gap: a new start flag still needs an entry in each route; the sweep is a table here, not a generated check.
+- Fixture: loki-ts/tests/runner/attempts-dispatch.test.ts (stub engine; red on ffe808687 with 0 pass 3 fail, green here with 3 pass 0 fail).
+
+## FC-38 Legacy loop reachable from a user command
+- User saw: `loki start "<task>" --attempts 2` exited rc 0 but the attempts receipt showed requested 2, ran 1, winner null, governor "hold: governor unknown or unreadable". The one run was the legacy RARV loop (runAutonomous), which seals no receipt, so a start returned success with nothing to verify. The swarm usage governor, absent in a clean environment, forced the fallback.
+- Law: L0 (a user command that says it verified must have run the verifying engine), L2 (one engine behind `start`).
+- Siblings (sweep of every `start` route):
+  - `bin/loki` engine10 arm (issue refs, multi-word tasks): engine10, kept; now also hard (never falls through to bash).
+  - `bin/loki` Bun start (PRD path, one-word brief, flags): ran runAutonomous (fixed: runs engine10 per attempt, N=1 included).
+  - `bin/loki` no-bun and early fallbacks to `$BASH_CLI`: ran the bash loop (fixed: `_loki_bash_or_refuse` and the no-bun check refuse `start` with exit 1).
+  - `bin/loki` legacy-only flags (--parallel, --github, --sandbox, --issue, --dry-run, --detach) and the opencode provider: diverted to the bash loop (fixed: refused, exit 2).
+  - `LOKI_SDK_LOOP` branch in `bin/loki`: removed.
+  - attempts child (loki-ts/src/commands/start.ts): engine10 only; the governor (`LOKI_ATTEMPTS_GOVERNOR_MAX`, usage files) is deleted from product code, N attempts run as N (1-5).
+  - `loki start` flags only the legacy loop honored (--max-iterations, --max-retries, --completion-promise, --base-wait, --max-wait, --simple, --complex, --allow-haiku, --regen*, --skip-memory, --aider-model, --aider-flags, --cline-model): were accepted by the Bun start and dropped (FC-37 class). Now refused with exit 2; the accepted set (--provider, --budget, --session-model, --prd, --brief, --attempts, --no-pr, no-op --yes/--no-plan/--no-mirofish/--no-dashboard) all reach engine10.
+  - `autonomy/loki` `cmd_start` callers (quick and run at 11335/11337/11826, demo at 15382, the `start` dispatch at 20928, 29705/29716), `autonomy/run.sh` run directly, and the dashboard spawns of run.sh (dashboard/control.py:572, dashboard/server.py:4356, 4640, 5226): NOT a `loki start` route, still reach the legacy loop. OPEN: requires a CTO waiver or a follow-up slice; ~dozens of shell suites drive cmd_start/run.sh directly with stubs, so refusing there is its own slice.
+- Mechanism: `bin/loki` start block (`# FC-38`) plus `_loki_bash_or_refuse`; `runStart` always goes through `runAttempts` with an engine10 runner; `formatAttemptsSummary` prints requested, ran, winner and losers from the attempts receipt.
+- Scoping (11.3.1, FC38-SCOPE): the refusals above apply only to `start --attempts` (in any form). Plain `loki start` keeps the 11.3.0 routing (bash fallbacks, `LOKI_LEGACY_BASH`, opencode and legacy-only flags on bash) because the unscoped change regressed P5.egress-blocked-start-seal-verify and P5.local-provider-no-claude-sidecalls. `--attempts N` (2-5) is checked for legacy-only flags and unsupported providers before it execs the Bun start. Fixtures: tests/test-engine10-dispatch.sh and loki-ts/tests/runner/attempts-dispatch.test.ts.
+- Missed sibling (FC38-SCOPE2): FC38-SCOPE scoped only `bin/loki`. The Bun start (loki-ts/src/commands/start.ts) still refused the runner flags (--max-iterations and the rest) and ran engine10 on every plain start, so P9's bun legs (`dist/loki.js start injected-prd.md --max-iterations 2`) exited 2. Fixed: start.ts is the 11.3.0 file for every plain start (`startEngine` returns "runner", runAutonomous); the refusal, the 1-5 check, the FC-40 --no-pr rule and the token-free env apply only when --attempts is present. Fixture: loki-ts/tests/commands/start.test.ts ("FC-38 scope" block) and the two `--budget` pins in tests/test-engine10-dispatch.sh.
+- Separate finding (not FC-38, OPEN): P9.injection-cannot-reach-token still fails on the planted leg with start.ts restored. The fsmonitor plant runs holding the real GitHub token and the real SSH agent socket on `bin/loki start octocat/hello#42` (the engine10 issue route), before engine10 withholds tokens. Passes on bee8ac363, fails on 4b24c4f55; the regressing commit is in that 49-commit range, not yet bisected.
+- Sweep closed (T5-D2): `--attempts` (any value, either form) is refused with exit 2 and a pointer to `loki start --attempts N --no-pr` by `bin/loki` for quick, run, demo and tour (before any route split), by `autonomy/loki` main() for start, run, quick, demo and tour (so every `cmd_start` caller, including quick/run/demo and the dispatch at 29705/29716, is covered), and by the `autonomy/run.sh` argument parser (the target of the dashboard spawns in dashboard/control.py and dashboard/server.py, which carry no attempts field and now cannot forward one). Plain invocations without `--attempts` are unchanged. Fixture: tests/test-engine10-dispatch.sh section 4b (stub provider marker, one case per entry point).
+- Fixture: loki-ts/tests/runner/attempts-dispatch.test.ts and loki-ts/tests/runner/attempts.test.ts (red on e7be7289b: dispatch 1 pass 6 fail, unit 16 pass 10 fail; green here).
+
+## FC-DOCTOR-COUNT Doctor's failure count changed between identical runs (provisional id; Release Manager renumbers)
+- User saw: `loki doctor` printed "2 failed" on one run and "1 failed" on the next, same environment. Raw cause: the Claude login row depended on a live `claude auth status` subprocess (5s timeout, no retry). When it returned nothing, doctor fell back to a clock-dependent check of the cached OAuth access token's expiry and printed FAIL "login has EXPIRED" (an expired access token is normal; a refresh renews it). Reproduced on 11.2.2 with a claude shim whose probe prints nothing plus an expired credentials file: "19 passed, 2 failed"; probe answering: "1 failed".
+- Law: L5 (an inconclusive probe was reported as a user fault) and L3 (a heuristic on the clock beat executed evidence).
+- Siblings swept: text Summary vs `--json` summary (two separate hand-kept counters), 39 hand-written `tally.X++` sites, and the Blocking (N) trailer (read the same counters). Other probes checked: tool version probes (a timeout leaves version null, which passes, so no count change), readEffectiveProvider (deterministic; failure degrades to warn), disk, skills, detectors, PATH installs (all local and deterministic). Under 16 concurrent doctor runs the counts were identical, so the flip needs an inconclusive login probe. Not touched: run.sh claude_login_state, which has its own fixture (tests/test-claude-login-state.sh).
+- Mechanism: one counting function, `summarizeStatuses(list)` in loki-ts/src/commands/doctor.ts. The text tally is now a list of recorded statuses (`makeTally`, `bump`) with pass/fail/warn derived from it, and `--json` builds its summary from the same function. The login row goes through the pure `evaluateClaudeLogin`: one retry on an empty probe, then an explicit UNKNOWN that is always a counted warning and never a fail, independent of the clock.
+- Fixture: loki-ts/tests/commands/doctor_count.test.ts (claude shim: yes / empty / flaky-first-call, with an expired credentials file; asserts failed equals the number of FAIL lines, is equal across probe modes, and that `--json` summary.failed equals the text count).
+
+## FC-36 The harness parses ecosystem manifests itself (L0)
+- User saw: the supply guard's own pyproject/requirements/package-lock parsers misfired into false FAILED verdicts: a ruff rule or keyword read as a dependency "e501", a new npm workspace key "packages/web" probed on npmjs, PEP 508 git/file references and poetry path deps probed on PyPI, private-registry 404s read as nonexistent. Each fix exposed the next format quirk.
+- Law: L0 (hardcoded ecosystem knowledge in the harness will keep misfiring; the ecosystem's own tool is the authority), L2 (one verdict has one author).
+- Siblings (sweep of loki-ts/src for harness-side manifest reads): runner/repo_profile.ts, runner/quality_gates.ts (package.json scripts.test), engine10/testmap.ts, engine10/modernize/inventory.ts, features/wall_manifest.ts, engine10/stages/verify.ts, commands/doctor.ts read manifests for detection or test commands; none of them issues a FAILED verdict on a parsed dependency name. Not changed here.
+- Mechanism: loki-ts/src/supply/supply_guard.ts. The implement session DECLARES new registry deps in <repo>/.loki/supply-declared.json (bounded reader, brief instruction only while the guard is on); the harness only proves each declared name with the ecosystem resolver (npm view, pip index versions, cargo search, go list) under the user's own config. A manifest or lockfile change with no declaration is a warning, never FAILED. Only a declared dep that does not resolve is FAILED; any tool or network failure is NOT PROVEN.
+- Known gap: resolver commands are a small table in supply_guard.ts, not read from the Project Model.
+- Fixture: loki-ts/tests/engine10/supply_guard.test.ts (R1 new npm workspace, R2 PEP 508 git/file refs and poetry path, none FAILED).
+
+## FC-40 A child is spawned with the full parent env
+- User saw: nothing yet. Raw: every `--attempts` engine10 child inherited the parent's GH_TOKEN, GITHUB_TOKEN and SSH_AUTH_SOCK although attempts force `--no-pr` and never push, and the winner's PR push read `origin` from the shared .git/config AFTER the agents ran, so an attempt could `git remote set-url origin <attacker>` and receive the credentialed push.
+- Law: moat P9 (the token reaches only the harness's own push, to a destination fixed before any agent ran), L2 (one credential path).
+- Siblings swept: loki-ts/src/commands/start.ts attempt child (fixed), runner/attempts.ts git helper and gh pr create (fixed: safeGit, explicit env), engine10/supervisor.ts worker env (already withholdGithubTokens on a copy), engine10/stages/pr.ts push script (pinned origin, already correct), util/pr_lessons.ts and commands/proof.ts gh spawns (credentialed by design, explicit env), engine10/preflight.ts (env passed), runner/checkpoint.ts, council.ts, quality_gates.ts and engine10/session.ts and verify.ts git spawns (read-only local git; session.ts and verify.ts still pass process.env and are NOT converted here). OPEN gap: under allowToken the repo-local credential.helper, core.sshCommand, url.*.insteadOf and pushInsteadOf are still honored (CREDENTIAL_CONFIG keeps the user's helper and ssh command), so a hostile attempt can write them into the shared .git/config; a helper receives the token on store and sshCommand runs code with the token in its env. 11.3.1 therefore refuses `start --attempts N` (N>1) without --no-pr (exit 2, before any pin, worktree or spawn). The 11.3.2 fix (T5-PUSHPATH) is to push from a fresh temp bare repo with clean config, or to pass explicit -c overrides plus GIT_CONFIG_GLOBAL only.
+- Mechanism: `tokenFreeEnv` / `safeGit` (loki-ts/src/util/safe_git.ts); attempts pin `remote.origin.url` in memory in productionDeps before the first attempt and push to that literal URL with allowToken, deriving `gh --repo` from it (no GitHub parse, no PR).
+- Fixture: loki-ts/tests/runner/attempts-env-token.test.ts (attempt child env token-free), attempts-origin-pin.test.ts (rewritten origin cannot redirect the push), attempts-push-pr.test.ts (winner pushed only via engine10-push.sh push-pr; hostile worktree config sees no credential), util/credentialed_push_guard.test.ts (no credentialed push in loki-ts/src outside push-pr).
+
+## FC-41 safeGit blanks diff.external, so every patch-producing call dies
+- User saw: nothing yet. Raw: `diff.external=` (blank, set to stop a repo-planted external diff) made git try to run an empty program, so any `diff`, `show -p` or `log -p` through safeGit failed with "external diff died" unless the caller remembered `--no-ext-diff`.
+- Law: moat P9 (no repo-chosen command runs in the token-holding process), L2 (one mechanism, not per-caller flags).
+- Siblings swept: reviewer_brief.ts, engine10/supervisor.ts, engine10/stages/xreview.ts, runner/attempts.ts (all carried a private --no-ext-diff workaround, removed); stash show and other non-patch commands do not use an external diff and pass through unchanged; GIT_EXTERNAL_DIFF in the caller env is now stripped.
+- Mechanism: `safeGitArgs` / `safeGitEnv` in loki-ts/src/util/safe_git.ts inject `--no-ext-diff --no-textconv` after diff, show, log and whatchanged, drop a caller `--ext-diff` / `--textconv`, and delete GIT_EXTERNAL_DIFF. A user-configured external diff or textconv is never re-enabled.
+- Fixture: loki-ts/tests/util/safe_git_extdiff.test.ts (configured marker script never runs; output is a real patch).
+
+## FC-42 A tracked file the task's own setup wrote is refused as an operator change (FC-15 family)
+- User saw: D50 baseline (docs/v10/METRICS.md:565-566), aiq-52-searchbar, Loki+haiku and Loki+sonnet: the engine refused to start in 0.7-1.3s with "dirty tracked tree: M frontend/package-lock.json" (the task `setup` ran npm install). No model call, so the no_change_needed outcome was unreachable. Raw: the raw arm has no tree check and finished the task.
+- Law: L1 (never below raw), L5 (a harness refusal is not the user's problem), L2 (the refusal must be keyed on the thing that makes it unsafe, not on a hand-kept list).
+- Cause (measured): intake.ts:69-71 refuses any dirty tracked file. E-164 (7b0ba4122, landed 10 minutes after the baseline commit) already allows lockfile-only dirt, but preexisting_dirty.ts LOCKFILE is a hand-kept list of 7 names (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock/b, poetry.lock, Cargo.lock, go.sum). Every other generated lockfile (Gemfile.lock, composer.lock, Pipfile.lock, uv.lock, pubspec.lock, mix.lock, flake.lock, npm-shrinkwrap.json, Package.resolved, deno.lock, gradle.lockfile, packages.lock.json) still refuses the run the same way.
+- What separates setup output from an operator's work (the only line the engine can draw from the tree alone): a lockfile is machine-written, never hand-edited, and never part of the run's change. The protection that makes allowing it safe is already in place and is path-generic: splitDirty records the blob at intake, Seal/Commit drop recorded paths from staging (seal.ts dropSet), and untouchedSinceIntake attributes a path to the run only if its bytes changed. Anything that is not a lockfile (source, config, docs, a manifest such as package.json) is operator-shaped work and still refuses with the file named, because a run that edits the same file would mix its change with the operator's unrecorded intent.
+- Siblings swept: intake.ts dirtyTrackedFiles is the only refusal in engine10/e10ext/commands (treeswap.ts:314 is a different, primary-checkout guard). stop_restore.ts and commit_filter.ts already honour preexisting_dirty.
+- Mechanism: one shared predicate `isLockfile` in loki-ts/src/e10ext/preexisting_dirty.ts, matching the lockfile family by name pattern (`*.lock`, `*-lock.json|yaml|yml`, `*.lockb`, `*.lockfile`, `lockfile`, go.sum, npm-shrinkwrap.json, Package.resolved), used by splitDirty. No new engine path. The `*-lock.*` branch is a deliberate trade: a hand-written src/door-lock.yaml would match, and the byte-based intake protection (the blob recorded at intake, dropped from staging) bounds the risk.
+- Fixture: loki-ts/tests/engine10/intake.test.ts describe "FC-42" (nested frontend/package-lock.json as in aiq-52, plus Gemfile.lock and uv.lock; each red before the fix where the name was unlisted; a dirty source file or package.json alongside still refuses).
+
+## FC-43 A model that ends LOKI_DONE with an empty diff is failed without one correction (FC-19 family)
+- User saw: D50 baseline (METRICS.md:566, PROGRESS.md:1871), pub-humanize-174, Loki+sonnet: "implement ran 95s and produced an empty diff with no already_done marker; FAILED, no PR". Raw sonnet completed the same task (2/3 on rerun). The user got a FAILED receipt for a session that simply stopped.
+- Law: L1 (never below raw), L5 (a harness verdict must not be the first and only reaction to a recoverable stop). The false BLOCKED "spec conflict against existing tests" in the same row is FC-19 plus D50-F2-S3 (40ca5f378): the brief's append-only test rule had no exception for a spec-stated assertion value; both are already on main (context.ts:23-24, conflict_resume.ts), so the conflict half is not reproduced on main here.
+- Cause (measured): implement.ts classifies a marker-less or LOKI_DONE exit 0 as "done" without looking at the tree; verify.ts:252 then fails "empty diff without an already_done marker" and seal.ts:152 seals FAILED. FC-19 resumes a spec-conflict exit once; the done-with-nothing exit had no equivalent. Every stage rule is correct (empty diff is not VERIFIED); the gap is that nothing asked the model to either change the code or claim LOKI_ALREADY_DONE with evidence before the verdict.
+- Siblings swept: LOKI_SPEC_CONFLICT (resumed, FC-19); LOKI_ALREADY_DONE (honoured, then confirmed by already_done.ts evidence); fix.ts rounds reuse buildImplementBrief but do not go through this stage's classification, so they are unchanged.
+- Mechanism: one shared resume, util/conflict_resume.ts `resumeAfterEmptyDone`, called from implement.ts when the final exit is "done" and `git diff <base>` plus untracked (the exact set verify.ts changedFiles uses) is empty. One correction: "your tree has no changes; make the change, or finish with LOKI_ALREADY_DONE: <file:line evidence>, or LOKI_SPEC_CONFLICT: <reason>". No wording of the model's output is inspected (L0). A resume that errors, is killed, or ends without a marker keeps the first result, so the verdict is never worse than before. Cost: one extra turn, only on empty-diff done exits.
+- Fixture: loki-ts/tests/engine10/empty_done_resume.test.ts (empty tree + done resumes once with the correction; a resumed session that edits the tree completes as done; no resume when the tree has changes; no second resume; a failed resume keeps the first result).
+
+## FC-45 A TL review ran a narrower suite than the files the slice touched (PRICE-TRUTH left 7 red tests on main)
+- User saw: nothing yet. Raw: PRICE-TRUTH (84d601721) changed loki-ts/src/runner/budget.ts and loki-ts/data/model-pricing.json, but its review ran only tests/util; tests/runner/budget.test.ts and budget_haiku55.test.ts went red on main 7e6692a8b (58 pass, 7 fail) and blocked the 11.3.1 cut.
+- Law: evidence or it did not happen (OPERATING-MODEL discipline): a review verdict covers only the suites it ran.
+- Causes (each decided against the pricing page, read 2026-10-08): CODE bug, no claude-haiku-4-5 row, so the exact id fell through to the haiku alias (now Haiku 5.5, $0.10) while the page prices Haiku 4.5 at $1/$5 (fixed: exact-id row in model-pricing.json and the budget.ts fallback). TEST stale: opus 5/25 (page: Opus 5.5 $4/$20), haiku alias 1/5 (alias = claude-haiku-5-5 per model_catalog.json cli_aliases), rounding case, immutable-table row without cache tiers, over_100k without cache_write_5m/1h, source date 2026-10-07 vs the 2026-10-08 read.
+- Siblings swept and fixed in the same slice: the bash route (run.sh check_budget_limit) keys by exact string with a sonnet fallback, so claude-haiku-4-5 AND claude-haiku-5-5 priced at the sonnet row there (12.0 per 1M in+out, measured red); run.sh _write_pricing_json lacked 4-5; dashboard _DEFAULT_PRICING lacked both. All id-keyed tables now carry both ids. autonomy/loki is title-case family keyed.
+- Mechanism (CTO ruling): a TL review runs `scripts/select-tests.sh` on the slice diff plus the always-run guards, and pastes the command and its rc in the verdict. A review without the selector output is incomplete.
+- Fixture: loki-ts/tests/runner/budget_haiku55.test.ts (claude-haiku-4-5 stays $1/$5, red before the row existed) and the bash-route section of tests/test-pricing-parity.sh (claude-haiku-4-5 6.0 and claude-haiku-5-5 0.6 per 1M in+out through the real check_budget_limit).
+
+## FC-46 Suites deferred to nightly let train drift reach main (D90 family)
+- User saw: the 11.3.1 cut blocked on run 37737159605 (main 7e6692a8b) with six red full-tier suites, none of which the fast gate had run on the trains that introduced the drift. Raw: each train was green at merge.
+- Law: evidence or it did not happen (OPERATING-MODEL.md Discipline); a verdict covers only the suites it ran.
+- Cause (measured): D90 (699d4ed25) moved suites over 80s to nightly, so DEP-01 (docker-build-check.yml, full-suite.yml rows), DOC-02 (future-slice cards in docs/v11/MARKET-SLICES.md), agent-types-loaded (README rewrite dropped the reviewer-selection sentence), analytics-toggle (a new bin/loki case guard shifted a brittle grep anchor), train-verdict-reuse (first-run-gate.yml deleted) and shellcheck SC2148 on tests/real-run/scenarios drifted with no gate in front of them.
+- Siblings swept: every one of the six suites was run individually red then green; the fast tier covers the same files only through select-tests.sh diff selection.
+- Mechanism: a change that touches a file a deferred suite reads (workflows, README, docs/v11, bin/loki, tests/real-run) must name that suite in its slice card Wall checks and run it before merge; the nightly is the backstop, not the first detector.
+- Fixture: the six suites themselves (tests/test-dep-inventory.sh, tests/test-docs-cli-drift.sh, tests/test-agent-types-loaded.sh, tests/test-telemetry-analytics-toggle.sh, tests/test-train-verdict-reuse.sh, shellcheck -S error tests/real-run/scenarios/*.sh).
+
+## FC-44 The receipt understates facts the console measured
+- User saw: a billed trivial-sum run printed 40s and 107k tokens on the console while its receipt said time.wall_s 8.3 and cost.input_tokens 24.
+- Raw: seal summed `duration_s` from stage outputs, but machine.ts put it only on the emitted event, so only implement carried one; the receipt cost block omitted cache tokens (the bulk of input) and supervisor.ts's summary tokens omitted them too, disagreeing with the E-59 total. Cache keys no result file carried were also written and summed as 0, which reads as a measured zero, and a cache total from only some sessions was published as the run total.
+- Law: L2 (one fact has one author: the receipt and the console must read the same measurement), evidence-or-it-did-not-happen (a receipt figure that contradicts the console is a false claim).
+- Author of total_s: the first line of events.jsonl, the earliest timestamp the supervisor writes, so it precedes worker boot and preflight; the end is the seal clock. The result-line duration_ms is carried separately as cost.sdk_duration_ms (model time only) and is never used as total_s.
+- Reconciliation (1%): `time.stages` is a disjoint partition of total_s: setup (first event to machine start), each stage, a parallel group such as plan||wall as ONE bucket ("plan+wall", union of its intervals), orchestration (gaps) and seal. Per-member seconds are in `time.stage_s`. Any consumer may add the buckets. `reconciledTotalS` (loki-ts/src/engine10/receipt_time.ts) returns total_s only when the buckets are non-negative numbers summing to it within 1%; a gap or a clock fault reads NOT RECORDED downstream (receipt.md Total line, recordRun history, receiptBlock actual), never a number. total_s ends at seal, so the PR stage is excluded and the receipt.md line says "to seal".
+- Siblings swept: engine10/pr_body.ts stageTimes (same reduction, now fed), runner/router/cost_preview.ts receiptBlock/recordRun/estimateFromHistory (reconciled total only; null wall reads NOT RECORDED), history_store.ts (version marker wallKind "total-v1"; unmarked old rows hold the stage sum and are ignored for time estimates, still used for dollars), autonomy/lib/proof-template.html (reads the cache keys, now populated), stages/seal.ts renderReceiptMd, supervisor.ts summary.cost.tokens (summaryTokens), control-plane packages/control-plane/src/server/runs.ts:37 (inputTokens now includes cache read and creation), routes/cost.ts:24 (sums that column), ui/src/pages/cost/index.tsx (tile and column relabelled "Tokens in (incl. cache)"). Not changed: control-plane ingest and mcp/cp_tools.py read the run.completed event wall_s (already true elapsed), not receipt.time.
+- Mechanism: machine.ts records duration_s on every completed stage output and a per-run timeline; receipt_time.ts builds and checks the time block; sdk_stream_parser writes a cache key only when usage carries it, and cost.ts sumResultCosts marks a cache total seen only when EVERY session carried the key and costTotalsOf maps them, so an unseen key is omitted from the receipt. All additive: absent means NOT RECORDED, old receipts still verify (receipt hash covers the whole body).
+- COST-RECORDS: the SDK result `usage` is main-loop only while `total_cost_usd` covers the whole pipeline. writeResultCost now also records `modelUsage` (per-model tokens and costUSD), `num_turns`, the main-loop 5m/1h cache split, `session_id` and `resumed_from`. When the per-model costs sum to total_cost_usd within 1%, cost.tokens_scope is "all-models", tokens come from modelUsage and cost.per_model is published; otherwise tokens_scope is "main-loop" and no per_model. cost.cache_creation_main_loop is always labelled main-loop scope (modelUsage has no split).
+- FIX-RESUME: the SDK says a resumed session's total is cumulative only when its transcript saved one. A resumed result whose total is below its predecessor's is provably separate and is summed (cost.resume "separate"); an equal-or-higher total fits both cases, so the iteration joins `missing`, usd reads NOT RECORDED and cost.resume is "ambiguous". Never subtracted, never guessed. An ambiguous file is excluded from every summed figure (measuredCount, partial dollars, tokens, cache, per_model, turns, sdk_duration_ms), and input_tokens/output_tokens (required numbers) then sum only the sessions that count, with cost.tokens_measured {k, n} written only when k < n (receipt.md prints "Tokens: partial: X input / Y output for k of n sessions"; real-run.sh prints NA for them; the per-session cost event omits its token keys). The control-plane fold counts the cost events that carried usage against all cost events (below). And per_model/turns/cache split/all-models tokens are published only when every session in the run produced a non-ambiguous file carrying them. Reachability: ambiguous is reachable in DEFAULT runs, no flag: resumeAfterConflict (FC-19, conflict_resume.ts) and resumeAfterEmptyDone (FC-43, the "-e" iteration) pass resumeSessionId on claude, and LOKI_E10_FIX_RESUME=1 adds the CH-03 plan->implement->fix chain on top; each is covered by a test. The real resumed-session capture (LOKI_E10_FIX_RESUME=1) was attempted once on the trivial-sum fixture (claude-sonnet-5-5, CH-03 chain on): the task was solved on the first implement attempt, so no fix round ran and no session was resumed (4 sessions, none with resumed_from). Cumulative vs separate is therefore UNMEASURED and "ambiguous" stays the shipped rule. That run did validate the rest of the receipt: total_s 39.687 equals the sum of time.stages, and per_model costs reconcile to total_cost_usd. Fixtures for the resume branch are shaped from sdk.d.ts.
+- Readers of unrecorded usage (sibling sweep, R4): the ambiguous session's efficiency record (cost.ts writeEfficiencyRecord) now omits cost_usd and every token key and carries tokens_measured:false (a resume provably below its predecessor, found among the sibling result-cost files, keeps its numbers). Every reader treats the flag as NOT RECORDED, never a partial sum: loki-ts/src/metrics/kpis.ts (recordsMeasured gate, unmeasured_iterations only when >0), loki-ts/src/commands/stats.ts (JSON null, text "NOT RECORDED", per-iteration rows), autonomy/lib/efficiency_cost.py collect_efficiency (token fields None, tokens_partial and tokens_unmeasured_records only when >0), dashboard/server.py /api/cost (totals and by_phase/by_model None, unmeasured_sessions only when >0; the context-tracker fallback is skipped), while _compute_budget_snapshot and _compute_cost_timeline already count a record with no measured field as unmeasured. Control plane: runs.ts stores token_sessions (nullable, migration 0006, null on rows ingested earlier) = cost events that carried usage; cost routes add token_sessions and token_sessions_total only when some session lacked usage; the cost tile, the cost table and the run page print "partial: k of n sessions". loki-ts/src/runner/budget.ts calculateCostFromRecords reads cost_usd or prices tokens, so an unrecorded session adds $0 to the budget breaker exactly as any unpriced session did before; not changed. Tests: tests/engine10/cost.test.ts R4-1, kpis.test.ts, stats.test.ts, tests/test_efficiency_cost_availability.py, tests/dashboard/test_cost_endpoint_honesty.py, packages/control-plane/test/server/runs-cache-tokens.test.ts. The cost event (loki-ts/src/engine10/session.ts recordCost) shares the tokensUnmeasured predicate (cost.ts) with writeEfficiencyRecord (CostResult.tokens_measured set, or an ambiguous resume): such a session emits no token keys, so the control plane never reads a missing session as 0 (R5-1; test in tests/engine10/cost.test.ts, plus the FC-19 "-r" case). budget.ts recordPartialStreamCost (a killed session with no partial-usage file) sets tokens_measured {k:0,n:1}, so its efficiency record and cost event carry no zero token keys (R5-2; tests in tests/engine10/cost.test.ts). Migration 0006 leaves pre-existing runs at NULL, pinned by ask_schema.test.ts (R5-4).
+- Fixture: loki-ts/tests/engine10/seal.test.ts (real-shaped boot/stages/seal stream reconciles at total_s 35; gap and 1% boundary read null; parallel overlap), tests/engine10/cost.test.ts (cache keys through the real reader and worker mapping), tests/runner/cost_preview.test.ts (old unmarked entry ignored for time).
+
+## FC-49 Weekly integrity audit ran the gitleaks-dependent suites without installing gitleaks (issue 223)
+- User saw: issue 223 "Weekly Integrity Audit Failed - 2026-10-05". Raw: run 37311758053 (head dee1553234d4), pytest 6 failed / 3637 passed, and the shell suite "security-audit.yml gitleaks config isolation" FAILED (21 passed, 1 failed).
+- Law: evidence or it did not happen; a guard that silently does not run is an absent measurement (_require_gitleaks fails under CI by design).
+- Cause (measured): integrity-audit.yml had no install-gitleaks.sh step, unlike test.yml, full-suite.yml and release.yml. Failing tests: tests/test_release_required_ci.py::PollLoopPriorityIsExercisedForReal::{test_e157_clean_range_still_reuses, test_e157_eligible_bump_reuses_parent_security_audit_success, test_e157_hex_debugid_is_still_eligible, test_e157_merge_release_hiding_a_leak_in_second_parent_is_not_reused, test_e157_secret_in_allowlisted_changelog_block_is_not_reused, test_e160_parent_main_stubs_plus_one_train_success_still_reuses), all "gitleaks is not installed in CI"; shell: "no gitleaks binary under CI".
+- Siblings swept: every workflow with a bare `python3 -m pytest` step (only integrity-audit.yml lacked the install).
+- Mechanism: install step added before the test steps; a pytest guard requires the install in every workflow that runs bare pytest.
+- Fixture: tests/test_release_required_ci.py::EveryWorkflowThatRunsThePythonSuiteInstallsGitleaks (red before the step existed).
+
+- Sibling instance (ALIAS-FWD): tests/cli/test-alias-forwarding.sh carried 3 stale reds on main: help entry bound 23 vs 27 shipped commands (test stale, no decision caps the page), a local-ci Dashboard-normalizer assertion for the bun-parity matrix removed in 5adff01a9 (test stale, assertion retired), and the main-parity export case whose extracted main script could not locate the skill dir (harness stale, fixed with SKILL_DIR). Product had not drifted in any of the three; the suite is not in the fast tier.
+
+## FC-47 select-tests --run returned success having run nothing (SEL-RUN-FC47)
+- User saw: nothing yet. Raw: `scripts/select-tests.sh --run` on an R0 diff (package.json, tests/run-all-tests.sh, unparseable, unknown shape) exited 0 with no suites executed, because every early `emit ...; exit 0` returned before the DO_RUN check.
+- Law: Engine Laws (a gate that can pass by doing nothing is theatre); FC-16 class (green with zero work).
+- Siblings swept: R0 broad-blast, R0 unparseable, R0 unknown shape, docs-only, empty diff and --guards-only all exited before the run step (all fixed).
+- Mechanism: one finish() function that every exit path calls; with --run it executes the selection, prints "suites executed: N", and exits nonzero with "NOTHING RUN" when N is 0, except the documented empty diff.
+- Fixture: tests/test-select-tests-run.sh (fake repo with a stub full suite; mutation: restore the broad-blast `exit 0` and the test goes red).
+
+## FC-48 The diff-selected gate skipped the repo-wide guards
+- User saw: nothing yet. Raw: a slice touching only loki-ts/src/runner/attempts.ts was gated by the impacted-test planner, which selects by diff, so fc25_raw_spawn_guard and the other repo-wide guards never ran; a raw git spawn passed 3 reviews.
+- Law: Engine Laws (a guard that only runs when its own file changes is a checklist, not a guard); D26 guard 5.
+- Siblings swept: scripts/select-tests.sh (fixed, rule R8), scripts/ci/fast-gate.sh plan (fixed, appends --guards-only even when every path is R0-class), scripts/impacted-gate.sh (fixed, runs R8 bun guards), scripts/local-ci.sh --impacted (goes through impacted-gate.sh).
+- Mechanism: scripts/global-guards.tsv is the one declared list; select-tests.sh emits it as R8 on every non-empty diff (docs-only included) and via --guards-only.
+- Fixture: tests/test-select-tests.sh (attempts.ts-only diff and docs-only diff both select every declared guard; --guards-only lists them).
+
+## FC-50 Cold wasm render inside bun's default 5s test budget reddens the nightly (NIGHTLY-COCKPIT)
+- User saw: the 11.3.1 cut blocked by D90 because Nightly was red since 10-04. Raw: run 37686475225, job "Bun tests on macos-latest bun=1.3.13 (nightly)", `(fail) cockpit render orchestration > renders a real inline image on a graphics terminal via the bundled wasm [5479.10ms]` followed by `this test timed out after 5000ms`; the next wasm test in the same file passed in 2142ms once warm.
+- Law: evidence or it did not happen (a red gate is read from the log, then reproduced); never weaken the assertion or skip on macOS to turn a timeout green.
+- Cause (measured): the first test in the file to rasterize pays the one-time cost of importing @resvg/resvg-wasm, reading the vendored .wasm, initWasm and loading the font (raster.ts caches all three per process), and a cold macOS runner spends over 5000ms on it, which is bun's default per-test timeout. No logic failed.
+- Siblings swept: grep for rasterize, resvg and render( across loki-ts/tests finds only tests/cockpit.test.ts; its two real-render tests (inline image, font-bearing PNG) both got the explicit timeout. All other cockpit tests are pure string work.
+- Mechanism: the cold one-time init is warmed in a beforeAll with its own 60s budget, and every test that performs a real rasterize passes an explicit RENDER_TIMEOUT_MS (30s); a test that does real wasm work must not rely on the 5s default.
+- Fixture: loki-ts/tests/cockpit.test.ts. Red evidence: with RENDER_TIMEOUT_MS=1 and the warm disabled both render tests fail "timed out after 1ms"; with the fix 26 pass, 0 fail.
+
+## FC-51 A publish-path change silently dropped a field a later gate depends on (PROMOTE-GITHEAD)
+- User saw: 11.3.1 stuck on the npm `next` tag; Promote run 37784566223 failed "FATAL: loki-mode@11.3.1 has no gitHead on npm", so the release never reached latest, Docker latest or Homebrew. Every later release would stick the same way.
+- Law: evidence or it did not happen; a change to one stage must keep every field a downstream stage reads.
+- Cause (measured): D90 (6247695f5) changed release.yml to `npm pack` then `npm publish <tgz>`. A tarball publish records no gitHead (only a directory publish reads .git); 11.3.0 and 11.2.0 have it, 11.3.1 does not. promote.yml requires gitHead to prove the build is an ancestor of origin/main.
+- Siblings swept: grep of .github/workflows and scripts for gitHead finds only promote.yml (reader). The other publish in release.yml (loki-mode-sdk, `npm publish` from sdk/typescript, a directory publish) still records gitHead and promote does not read it, so it is unaffected. sbom.yml packs but does not publish.
+- Mechanism: (1) release.yml stamps `git rev-parse HEAD` into the manifest before `npm pack`, restores package.json, and asserts the packed manifest gitHead equals HEAD. (2) promote.yml, when npm has no gitHead, falls back to the commit of tag v${VERSION} only if the tag is annotated (release.yml creates it with `git tag -a`), that commit has a successful Tests run on main, and the published tarball's loki-ts/dist/loki.js embeds the version; the source used is logged as GITHEAD_SOURCE. The 40-hex, ancestor-of-origin/main and never-move-latest-backwards checks apply to both paths unchanged.
+- Fixture: tests/test-promote-head-stamp.sh (static check of both workflow definitions plus 8 negative mutations, one per required piece). Red on a0d599d0c (11 requirement failures), green after.
+
+## FC-53 A host-dependent or pipe-dependent assertion reddens the nightly on one OS (NIGHTLY-FLAKE)
+- User saw: Nightly 37790534786 (a0d599d0c) red, blocking releases under D90. Raw: Bun macOS (both bun versions) `(fail) gate-failures cap head/tail parity (W4 L1) > doctor per-provider install hint goes to STDERR` "Expected: <= 1, Received: 2" at gate-failures-cap-parity.test.ts:81; and Full suite Shell shard 1/8 `TEST 1: basic onboard on loki-mode repo ... FAIL` after `echo: write error: Broken pipe`.
+- Law: evidence or it did not happen; an assertion must test the property it names, not a host side effect; never retry, lengthen a sleep or skip to turn a gate green.
+- Cause (measured): (1) The doctor test counted any stdout line containing "Install:". On macOS the system python3 is 3.9, so doctor prints a Python 3.12 warning ending "Install: brew install python@3.12", a second match. It failed on the same SHA in the dispatched run 37780519439 too (job 113322165616, same line), so it was never flaky: deterministic on macOS, hidden because that run's overall verdict was success. (2) `loki onboard` ran `find ... | wc -l` under `set -euo pipefail` (autonomy/loki cmd_onboard); when find exits non-zero on an unreadable or concurrently vanishing entry (other suites create and delete temp files in the repo root during shard runs) the whole command died silently, rc 1 and 0 bytes. Reproduced locally under 14-way parallel load, trace ends at the find|wc line; the same suite passed in run 37780519439 (job 113322165426). In the log the test also saw `echo: write error: Broken pipe` because test-onboard-command.sh used `echo "$output" | grep -q` under pipefail on a 37KB report.
+- Siblings swept: all 11 `echo "$output" | grep -q` sites in test-onboard-command.sh converted. Other suites use the same idiom (grep over tests/*.sh finds it in ~100 files) but only misfire when the producer output exceeds the pipe buffer; none of those showed a nightly failure, so they are tracked by the flake tracker rather than bulk-edited. Bun tests: the only bare "Install:" counter in loki-ts/tests was the doctor test.
+- Mechanism: (1) the doctor test counts only lines carrying a provider install command and requires the sole allowed one to be the claude fallback. (2) Product fix: the two find/grep count pipelines in cmd_onboard tolerate a non-zero producer (`|| true`, the count still comes from wc). Test fix: grep reads the variable through a here-string, which has no upstream writer in the pipeline status. Shared guard: scripts/nightly-flake-tracker.sh compares saved job logs per SHA and emits FLIP (pass in one run, fail in another on one SHA, with a BOARD-ready line) or STABLE-FAIL (red in every run, a real defect).
+- Fixture: test-onboard-command.sh TEST 11 (unreadable directory makes find exit 1; red on the unguarded line with rc 1, green after) and tests/test-nightly-flake-tracker.sh (fixtures in tests/fixtures/nightly-flake). Replay of the real logs: `nightly-flake-tracker.sh SHA:a:<job 113356420172 log> SHA:b:<job 113322165616 log>` reports the doctor test as STABLE-FAIL.
+## FC-54 A path guard selected every file under tests/ and ran helpers as suites (MAIN-RED 6ecedaefe)
+- Seen: Tests run 37792537759 on main went red on 4 fast-gate shards for a diff that only touched release.yml, promote.yml and tests/run-all-tests.sh. Raw: rows such as `py_test tests/lib/scan-workflow-rc.py` (rc=5, pytest collected nothing), `shell_test tests/shard-durations.tsv`, and `shell_test tests/run-all-tests.sh` (rc=124, the whole suite run bare).
+- Law broken: a gate runs only what it can run; a selection row is a runnable test or it is not a row.
+- Cause (measured): scripts/ci/fast-gate.sh guards_for wrote `grep -rlF -- PATTERN tests --include=...`. After `--` the --include flags are file operands, so the filter was silently dropped and any file under tests/ mentioning the workflow name was planned (py_test or shell_test by extension). Separately scripts/select-tests.sh match_kind accepted run-*.sh, which admitted the aggregate tests/run-all-tests.sh. Latent since D90; exposed when workflow files first changed together with run-all-tests.sh.
+- Siblings swept: no other `grep ... -- ... --include` in scripts/, autonomy/ or tests/*.sh. tests/cli/test-alias-forwarding.sh is a legitimate selection with its own red, fixed by ALIAS-FWD 164eb7da2 on the train.
+- Mechanism: options before `--` in the three guards_for greps; match_kind returns no kind for run-all-tests.sh.
+- Fixture: tests/test-fast-gate.sh FC-54 case (release.yml + run-all-tests.sh + a registering test plans only test-*.sh, test_*.py, run[-_]*.sh). Red before, green after.
+
+
+## FC-60 Parallel slices each pass a repo-wide cap or allowlist alone, and the merged train is over it (TRAIN-GREEN)
+- User saw: the 11.3.2 train (832fa4b57) was red before push on four repo-wide guards that each merged slice passed on its own base: loki-ts/tests/engine10/l0_guard.test.ts ("src/commands/verify_pr.ts npm test" and "package.json" unlisted), budget.test.ts (core engine10 5462 lines against the 5,000 cap; features 3158 against 3,000), and tests/cli/test-alias-forwarding.sh ("help: front-page entry count in [12,27] -- got 28").
+- Law: evidence or it did not happen; D33 (core cap never raised), D66 (features cap), L0 (guard allowlist may only shrink without a stated reason).
+- Cause (measured): at 6ecedaefe core is 4734 and features 2977 lines. Each slice (COST, RECEIPT-TRUTH, SARIF, AI-BOM, UNDO-2, VPR-2 and others) was reviewed against a base with room, and no merge step re-ran the repo-wide guards on the union. UNDO-2 added the 28th front-page command after ALIAS-FWD pinned the bound at 27. The VPR-2 package-manifest read in verify_pr.ts predates the guard being selected for it (FC-48).
+- Siblings swept: budget.test.ts, l0_guard.test.ts, the alias-forwarding bound and tests/test-structural-checks.sh are the only cumulative caps in the fast tier. Core and features caps are NOT fixed here: D33 forbids raising the core cap, so the overage is handled by moving code out (EXT-CORE-2-r2 for core, EXT-FEAT-r2 for features), never by raising a cap.
+- Mechanism: (1) l0_guard.allowlist gains two exact file-and-token rows for verify_pr.ts with a stated sunset (the PR own manifest test script is read as data); any other file or token is still red. (2) The alias bound moves 27 to 28 with the added command named in the comment. (3) Train rule: the merge of the last slice must run the guards named in this row on the union before push.
+- Fixture: l0_guard.test.ts red then green; test-alias-forwarding.sh help bound red (got 28) then green.
+
+## FC-61 A test asserted on the first FAIL line, so one earlier real failure masked every later planted-defect check (TRAIN-GREEN)
+- User saw: tests/test-structural-checks.sh "6 passed, 5 failed" with T6, T7 and T9 reporting "committed en dash not caught", "added line starting with + not scanned", "task NOTES.md dash not caught", although the emoji/dash check was working.
+- Law: an assertion must test the property it names, not whichever line prints first.
+- Cause (measured): line_of "$out" "FAIL" | head -1 returns the first failing check. The real line-budget failure (core 5421 >= 5000) prints before "emoji/dash on changes", so the grep for emoji/dash never saw its own FAIL line. T9 asserted rc 0 for the exempt case, which also failed for the unrelated budget reason. T2, T3 and T5 passed only because their checks print before line budgets.
+- Siblings swept: all seven line_of call sites in the file now name their check label through failed_check; T1 stays the one assertion that the whole tree is clean.
+- Mechanism: failed_check matches `^FAIL ... <label>` anywhere in the output.
+- Fixture: with the budget red (as on the train), T6, T7, T9 are red before and green after; T1 remains red until the budget ruling.
+
+## FC-62 A test built an expected path from a raw $TMPDIR and macOS leaves a trailing slash (NIGHTLY-REDS)
+- User saw: tests/test-caveman-flags.sh `bootstrap cwd custody` FAIL on macOS (exit=0, cwd=/var/folders/.../T/loki-caveman-XXXX/bootstrap-tmp/loki-caveman-bootstrap.YYYY).
+- Law: an assertion must test the property it names, not a host path spelling.
+- Cause (measured): macOS $TMPDIR ends in a slash, so `${TMPDIR:-/tmp}/loki-caveman-XXXXXX` became `T//loki-caveman-...`; the product records the canonical single-slash cwd, so the `case "$bootstrap_cwd" in "$BOOT_TMP"/...` pattern never matched although the bootstrap behaved correctly. Reproduced locally: 44 passed, 1 failed before; 45 passed, 0 failed after.
+- Siblings swept: other suites use the same mktemp spelling but only this one compares the result against a recorded cwd string.
+- Mechanism: the test strips one trailing slash from TMPDIR before mktemp.
+- Fixture: tests/test-caveman-flags.sh section 5c is the regression (red on macOS before the strip).
+- Note: the other two Nightly 37790534786 reds (doctor hint, onboard) were already fixed by FC-53 (0c0069df3, in this train); re-verified green here (bun test gate-failures-cap-parity 3 pass; test-onboard-command.sh 11/11).

package/docs/v10/FOUNDER-QUEUE.md

@@ -25,3 +25,4 @@ this file; each item says what the loop does meanwhile.
 | 18 | 2026-10-03 | Screenshot veto for the 10.8.0 Control Plane rebuild (D83): the ground colour #F1F2F6 from the legacy dashboard, and keeping the legacy mascot in the sidebar brand. Also: light-theme status text uses AA-safe companion ink tokens (darker than the legacy hex) because the legacy success, warning, info and muted text fail WCAG AA on #F1F2F6. | Brand and visual design. | Builds with the legacy ground and mascot plus the AA ink tokens (D83 point 6); screenshots go in PROGRESS when CPE-02 lands. | open |
 | 19 | 2026-10-03 | FC-21b and FC-22 (docs/v10/FC21B-FC22-PLAN.md): (a) after an implement time limit, VERIFIED also requires a Wall or task-named test to pass with n>0; (b) dependency install runs by default, only when a selected check fails with a harness-owned load error, opt-out LOKI_E10_INSTALL=0 or loki.yaml verify.install_deps false; (c) exit code 3 (BUDGET_STOP) is dropped whenever a receipt is sealed, outcome and exit follow receipt.verdict. | Behavior and exit-code changes users see. | Decided by the CoS under the standing mandate: (a) yes, (b) yes as stated, (c) yes with a CHANGELOG Changed entry. Founder may reverse. | open |
 | 20 | 2026-10-04 | CP-ASK (docs/v10/CP-ASK-PLAN.md): (a) with LOKI_CP_ASK on, the home box is Ask only, with a "Start a build" link to Compose; (b) defaults $1.00 per ask and 600s, configurable, Ask spend shown on the Cost page apart from run budgets; (c) CP-level runs, receipts and events across all repos always available, per-repo memory and code tools scoped to one repo chip per ask. | Product shape and spend defaults. | Decided by the CoS under the standing mandate as stated. Founder may reverse. | open |
+| 21 | 2026-10-07 | Enable GitHub private vulnerability reporting in the repo settings (Settings, Code security, Private vulnerability reporting). SECURITY.md already tells reporters to use Security tab, "Report a vulnerability". | Public repo settings; agents never change them. | SECURITY.md ships as written; until enabled the "Report a vulnerability" button is absent. | open |

package/docs/v10/GUARDS.md

@@ -837,3 +837,34 @@ previously mismarked two merged guards (S-16, S-74) as PENDING.
   `tests/test-cp-redesign-images.sh` builds a fixture with an unlisted image,
   a ui-refs image and a banned name and asserts each fails.
   Run: `bash tests/test-cp-redesign-images.sh`.
+
+## D91 finding guards (review BLOCK classes become tests)
+
+- **Incident:** the same six review BLOCK classes recurred across trains and were caught only by human or agent reviewers.
+- **Guards** (all in `loki-ts/tests/util/`, each under 2s, picked up by `bun test tests/util`; allowlists in `loki-ts/tests/util/guard-allowlists/`, one `path | reason` per line (full-env-spawn and model-output-regex use `path@N` per-site counts, so a new site in a listed file fails), stale entries and missing reasons fail):
+  1. `raw_gh_spawn_guard.test.ts` (FC-25, FC-40): raw `gh` spawn in loki-ts/src, and raw `git push` / `gh pr create` in autonomy bash, outside the allowlist. Raw `git` in TS stays with `fc25_raw_spawn_guard.test.ts`. Known follow-up: autonomy/loki auto-PR paths push raw.
+  2. `start_flag_parity_guard.test.ts` (FC-37, FC-38): the `loki start` flag sets of bash `cmd_start` and Bun `start.ts` against the declared table `start-flags.txt`. Three real divergences are recorded (`--budget-limit`, `--no-pr`, `--session-model` are Bun-only).
+  3. `registration_list_guard.test.ts` (FC-32, FC-39): every module under src/commands and src/engine10/stages is imported somewhere, and every literal package.json files[] entry exists. Test-runner and shard lists stay with `scripts/structural-checks.sh` and `tests/test-shard-coverage.sh`. Known orphan: commands/status.ts.
+  4. `swarm_internal_read_guard.test.ts`: product code (loki-ts/src, autonomy/) naming docs/v10/BOARD.md, scripts/v10-* or .loki/v10-leader. Zero exceptions today.
+  5. `full_env_spawn_guard.test.ts` (FC-40): a spawn call site with no env or a bare process.env copy, unless the file is baselined. The baseline groups WORKER, UTILITY and SWEEP; SWEEP entries are the conversion backlog. Limit: an env variable built earlier than 14 lines above the call is not seen.
+  6. `model_output_regex_guard.test.ts` (L0, FC-36 family): regex exec/match on model-output variables under engine10. Baselined: xreview VERDICT and session sentinel parsing (follow-up to schema-checked JSON).
+- **The test that proves it fires:** each file plants a violation in the working tree during review (mutation run recorded in the slice report); `full_env_spawn_guard` and `model_output_regex_guard` also carry in-file detector self-tests.
+  Run: `cd loki-ts && bun test tests/util`.
+
+## 22. Repo-wide guards skipped by the diff-selected gate (GATE-GUARDS, FC-48)
+
+- **Incident:** the CI-FAST planner selects tests by diff, so a slice touching
+  only `loki-ts/src/runner/attempts.ts` never ran `fc25_raw_spawn_guard`, and a
+  raw git spawn passed 3 reviews.
+- **Root cause:** every guard was selected only when something it names
+  changed; repo-wide guards name nothing in a given diff.
+- **Guard:** `scripts/global-guards.tsv` is the single declared list of
+  repo-wide guards (loki-ts/tests/util, spawn_env_guard, never_below_raw,
+  l0_guard, structural checks, no-hardcoded-paths, moat P9).
+  `scripts/select-tests.sh` emits it as rule R8 on every non-empty diff,
+  docs-only included, and via `--guards-only`; `scripts/ci/fast-gate.sh plan`
+  and `scripts/impacted-gate.sh` consume it. Add a guard by editing that file
+  only.
+- **The test that proves it fires:** `tests/test-select-tests.sh` (R8 cases):
+  an attempts.ts-only diff and a docs-only diff each select every declared
+  guard. Run: `bash tests/test-select-tests.sh`.

package/docs/v10/GUIDE.md

@@ -17,9 +17,10 @@ longer read; any value is ignored.
 
 `loki start owner/repo#N`, `loki start <issue URL>` and `loki start "<multi-word
 task>"` run Loki 10, the same as `loki owner/repo#N` and `loki "<task>"`. A PRD
-file, a flag-first call (`loki start --simple prd.md`) and a one-word start stay
-on the legacy engine. The legacy engine is being removed (planned work
-resumes 2026-10-07, see docs/v10/LEGACY-REMOVAL.md).
+file, a flag-first call (`loki start --simple prd.md`) and a one-word start still
+run on the previous bash loop (autonomy/run.sh), and so does the opencode
+provider, until FC38-SWEEP ports them. `loki legacy` and LOKI_ENGINE remain
+removed. The previous loop is being removed (see docs/v10/LEGACY-REMOVAL.md).
 
 Some pieces named in this guide are still being built. Each one below says
 so plainly instead of describing a finished feature.
@@ -322,7 +323,8 @@ runs on the B9 corpus, and it can emit shape defaults from those runs
 
 D48 made v10 the default for `loki "<task>"`, `loki owner/repo#N` and
 `loki quick "<task>"`. 11.0.0 removed the engine switch: `loki legacy` exits
-2 with a removal message and LOKI_ENGINE is ignored. Remaining legacy paths
-(`loki start ./prd.md` and the no-bun fallback) are tracked in
+2 with a removal message and LOKI_ENGINE is ignored. PRD-file starts
+(`loki start ./prd.md`), the opencode provider, and the no-bun
+fallback still run on the previous bash loop until FC38-SWEEP ports them; they are tracked in
 docs/v10/LEGACY-REMOVAL.md. The marked line near the top of this file and of
 README.md's Loki 10 section records the current state.

package/docs/v10/LEGACY-REMOVAL.md

@@ -40,13 +40,12 @@ One-word bash commands (autonomy/loki main(), line 21621) and their fate:
 ## 2. Docs and help surface (existing Wave 1, no new work)
 
 `grep -rlE "run.sh|LOKI_ENGINE|loki legacy|legacy engine"` counts (files / mentions):
-- Root: README.md 19, SKILL.md 10, ARCHITECTURE.md 9, COMPONENTS.md 4, AGENTS.md 2, CONTRIBUTING.md 2, TESTING.md 2, CLAUDE.md 1, SETUP.md 1, Dockerfile 1.
+- Root: README.md 19, SKILL.md 10, AGENTS.md 2, CONTRIBUTING.md 2, CLAUDE.md 1, Dockerfile 1. ARCHITECTURE.md (9), COMPONENTS.md (4) and TESTING.md (2) live under docs/; there is no root SETUP.md.
 - docs/: 109 files, 1200 mentions. Shipped (package.json `docs/**/*.md`). Heaviest: v10/BOARD.md 72, BUG-AUDIT-v6.61.0.md 61, ONE-RUN-AUDIT.md 44, BRANCH-LIFECYCLE-PLAN.md 44, CONFIG-FILE-PLAN.md 41, architecture/STATE-MACHINES.md 33, test-scenarios/edge-cases.md 32, v10/ENGINE.md 30, V8-AGENT-SDK-PLAN.md 28, dev/project-structure.md 14. Most are legacy plans: delete, not edit. Keep docs/v10/ (internal records; exclude from `files`).
 - wiki/: 6 files, 13 mentions (Quality-Gates, Enterprise-Features, Enterprise, Contributing, Checkpoints, API-Reference). Quality-Gates and Checkpoints are legacy features: delete pages.
-- skills/ 9 files 33, references/ 7 files 16, vscode-extension/ 3 files 4, integrations/ 2 files 3, templates/ 1 file 2, agent-skills/ 1, packages/loki-seal 4 files 4 (wording only; loki-seal stays).
+- skills/ 9 files 33, references/ 7 files 16, vscode-extension/ 3 files 4, integrations/ 2 files 3, templates/ 1 file 2, examples/agent-skills/ 1, packages/loki-seal 4 files 4 (wording only; loki-seal stays).
 - CLI help: autonomy/loki help (goes with the file), loki-ts/src/cli.ts HELP, engine10/cli.ts USAGE, bin/loki error strings (lines 81, 92, 382, 388).
 - completions/_loki, completions/loki.bash: 0 pattern hits but list every bash command; regenerate from the v10 command list.
-- website/: 0 hits.
 
 ## 3. Directory classification
 
@@ -194,16 +193,15 @@ Row count: 6 rows, decisions: 4 DELETE, 1 KEEP, 1 MOVE.
 |---|---|---|---|
 | README.md version/legacy refs | README.md:3 (3 mentions of v8, v9, legacy), lines mentioning LOKI_ENGINE and `loki legacy` | public docs, npm landing page | DELETE LOKI_ENGINE=legacy hint; rewrite "legacy engine" sections to v10 info or migration note (MOVE history to docs/history/v9-engine.md) |
 | SKILL.md version refs | SKILL.md:28 (old command list, legacy engine description) | Claude Code CLI skill | REPLACE with v10 command list generated from registry (see J below); DELETE legacy engine section |
-| ARCHITECTURE.md | ARCHITECTURE.md:9 mentions | internal docs | audit and DELETE legacy references; KEEP v10 architecture |
+| docs/ARCHITECTURE.md | docs/ARCHITECTURE.md:9 mentions | internal docs | audit and DELETE legacy references; KEEP v10 architecture |
 | CLAUDE.md | CLAUDE.md:1 (v10 references) | developer instructions | KEEP; no cleanup needed |
 | docs/alternative-installations.md | mentions LOKI_ENGINE, legacy engine | shipped docs | DELETE or MOVE to history; rewrite for v10 only |
 | docs/exit-codes.md | mentions legacy command behavior | public API docs | REPLACE with v10 exit codes |
 | docs/ plan files (BUG-AUDIT, ONE-RUN-AUDIT, BRANCH-LIFECYCLE-PLAN, etc., 44 mentions) | grep -l "legacy\|LOKI_ENGINE\|run.sh" docs/ | team reference | MOVE to docs/history/ with dated header (use `git log -1 --format=%cs <file>`) |
 | wiki/ (6 files, 13 mentions) | wiki/Quality-Gates.md, wiki/Checkpoints.md | team docs | DELETE Quality-Gates, Checkpoints (legacy features); audit others |
 | version strings in CLI help | autonomy/loki help output (v8, v9, v10 mentions) | users | DELETE or hand-write to match package.json VERSION |
-| site/docs (if shipped) | website/ (0 legacy hits) | web presence | KEEP; audit for stale info |
 
-Row count: 11 rows, decisions: 3 KEEP, 5 DELETE, 3 MOVE to history, 1 REPLACE (SKILL.md).
+Row count: 10 rows, decisions: 2 KEEP, 5 DELETE, 3 MOVE to history, 1 REPLACE (SKILL.md).
 
 ## 12. I. Tests of legacy surfaces
 

package/docs/v10/METRICS.md

@@ -262,7 +262,7 @@ Misses: pub-click-3059 (hidden tests failed: wrong metavar bracketing), pub-huma
 
 pub-more-itertools-1192 through the E-14 glue entry, real claude, --no-pr: 30s wall (intake 0s, plan 16s, implement 12s, verify 3s, commit and seal under 1s), hidden test passes, $0.4486 over 2 sessions (plan $0.2264, implement $0.2223), verdict PARTIAL only because ruff is not installed. Raw claude on the same task: 15s, $0.1290. The planner session costs as much as the implement session.
 
-## Loki 10 gate report, small tier (2026-09-28, D30; v10.0.0 decision)
+## Loki 10 report on the gates, small tier (2026-09-28, D30; v10.0.0 decision)
 
 All arms on claude-opus-5-5, 29 small tasks with hidden tests, fresh clone per run, provider-sourced cost only. D30 targets vs raw: completion 96.5% or higher, cost per completed task $0.118 or lower, time to a correct result at most raw.
 
@@ -279,7 +279,7 @@ All arms on claude-opus-5-5, 29 small tasks with hidden tests, fresh clone per r
 - Lean-session evidence, 5 tasks (EV-8 D/E, not the full arm): opus lean 4/5 at $0.1571 per completed, p50 28s; sonnet lean 4/5 at $0.1519, p50 27.5s; raw opus on the same 5: 5/5, $0.2161, p50 41s (~/loki-ci-logs/ev8r-{D,E}/results.jsonl). The lean small path is not the default yet (E-64 in rework).
 - Medium and large tiers: not built (EV-11 3 of 15 verified, EV-12 in rework). No "2-5x" claim.
 
-## Loki 10 gate report, medium tier (upstream tests, deletion-mutant audited, not shortcut audited) (2026-09-28, D38; EV-14)
+## Loki 10 report on the gates, medium tier (upstream tests, deletion-mutant audited, not shortcut audited) (2026-09-28, D38; EV-14)
 
 Evidence note (Chief of Staff, 18:00Z): the per-run result files (eval/loki10/results/ev14-medium-{raw,v10}-r{1,2}/results.jsonl, gitignored) were lost when the EV-14 worktree was force-removed in the 17:36Z pruning incident (PROGRESS.md, E-96). The table below is the run agent's report from those files before removal (commit 0afef9e4); it cannot be re-audited. EV-15 re-runs the tier with results kept outside any worktree.
 
@@ -595,3 +595,15 @@ Cost per completed task for sonnet arms measured before this date used the old 3
 | 10.9.1 | BLOCKED | $0.75 | brief handicap, FC-19 class |
 | 10.10.3 | PARTIAL | $2.27 | 12m; full migration (83 files); backend 5855/5858 green; implement stopped at a 900s run cap and verify was skipped (FC-21); run e10-20261003T220847Z-78fa, main be0799f, reported by steering 22:08Z |
 | 10.10.5 | PARTIAL (CLI and receipt match) | $1.73 | run e10-20261003T233414Z-30ca, defaults, cap_s 2700, 12m05s, 2.42M tokens; implement 6m36s finished with no limit; verify, fix, verify ran; 77 files +4325/-2006; independent check: backend 5914 pass 0 fail 29 skip, tsc 0 errors; PARTIAL only from FC-22 (4 frontend tests over-selected, deps absent, honestly NOT PROVEN) and FC-23 (a Wall file failed the package tsc, TS1470); integration request-approval-race NOT PROVEN (needs DB). Zero false claims. |
+
+## B9 raw vs loki (D91 COST-HALF and 10x metric owner)
+
+`bash scripts/b9-scoreboard.sh --ab [--n 3] [--model M] --version V --json-out F --metrics-out docs/v10/METRICS.md`
+runs `claude -p` (raw) and `loki start` (loki) on the same task text. cost_ratio = (loki usd per VERIFIED and hidden-check passing task) /
+(raw usd per task solved), failed-run cost included; correctness_ratio = loki solve rate / raw solve rate, both judged by
+the same hidden checks; wall_ratio = mean loki wall / mean raw wall; 95% percentile bootstrap over runs within each
+(arm, fixture) cell. Raw cost and time come only from the claude SDK result line (`total_cost_usd`, `duration_ms`, cache read/creation tokens); loki cost and time only from the receipt (`cost.usd`, `time.total_s`, `cost.cache_read_tokens`, `cost.cache_creation_tokens`). The old `time.wall_s` and `cost.input_tokens` are never read as totals. A missing field, or `total_s` differing from the sum of `time.stages` by more than 1%, reads NOT RECORDED.
+
+| Date | Run | Fixtures | Result |
+|---|---|---|---|
+| 2026-10-08T04:58Z | b9-ab n1-plumbing (SUPERSEDED) | trivial-sum | SUPERSEDED, do not cite. Used our own clock for wall and the old receipt fields: its loki wall (43s) was not the receipt `time.wall_s`/`total_s` and `time.wall_s` is invalid as a total (it is a stage sum that excludes boot and seal). Rerun on SDK `duration_ms` and receipt `time.total_s` once RECEIPT-TRUTH ships. Former text: cost_ratio=0.92 wall_ratio=3.07 n=1/1, not significant. |

package/docs/v10/MODERNIZE.md

@@ -236,7 +236,7 @@ The report never states more than the equivalence data proves. It is sealed and
 **COBOL to Java**
 - It needs a GnuCOBOL or mainframe runtime and file or copybook I/O capture. It also has no in-process boundary, and Legacy-Bench scores run 16.9-42.5% (V10-RESEARCH section 7).
 - The research gives a method (witness search, symbolic execution plus delta debugging) but no tooling we have.
-- It starts after the first two targets meet the section 12 gates.
+- It starts after the first two targets meet the gates in section 12.
 
 **AngularJS to React** follows COBOL. It needs browser-level capture (Playwright traces) as the oracle.
 

package/docs/v10/OPERATING-MODEL.md

@@ -18,6 +18,7 @@ The CEO is Lokesh Mure (Loki), the founder. Everyone else is an agent. The compa
 - Non-leader sessions act as extra engineers or reviewers on BOARD.md slices, or answer Loki. They never push, bump VERSION, release or rewrite BOARD.md.
 
 ## Nobody sits idle
+- Ready queue >= 30 specced slices (features, enhancements, fixes evenly; D91). Seat cap 14 while weekly usage < 50%.
 - The Chief of Staff keeps 8-16 engineers busy whenever ready slices exist. When anyone finishes, the next slice is assigned in the same turn.
 - The ready queue never drops below 2x the number of engineers; PMs and POs refill it.
 - Idle seats while work exists, or an empty ready queue, is a P0 violation.
@@ -30,9 +31,9 @@ The CEO is Lokesh Mure (Loki), the founder. Everyone else is an agent. The compa
 ## Release pipeline
 - Tier A fast gate on every change (target 60-120s): syntax checks, changed-file shellcheck, diff-selected tests, moat suite split per property. It is feedback, not release authority.
 - Tier B: every main commit has a full Tier B verdict on its exact tree, run on main or on the train that produced it (D55); never cancelled on main.
-- Release = a lookup: publish a commit whose tree already has a Tier B pass. A VERSION-only bump reuses its parent's verdict. Target: 2 min from verified to npm.
-- Trains: the Release Manager batches merged slices; one push per train; releases when verified; the next train opens immediately. Never hold a train for one HIGH slice.
-- If Tier B fails on main: stop releases, open a P0 fix-forward slice. Never unpublish; npm deprecate is allowed.
+- Every approved slice is a release (D96): merge-gate merges to main, and main publishes a PATCH to npm `next` within 15 min. No trains, no batching. Target 3-10 releases per hour.
+- `latest` is promotion only: the newest `next` whose SHA has a green hourly full-suite backstop and green Post-Release Smoke. A red backstop blocks promotion, not publishing.
+- If the backstop fails on main: promotion stops, and a P0 fix-forward slice opens within the hour. Never unpublish; npm deprecate is allowed.
 
 ## Large tasks (for example "rebuild the dashboard")
 - The Architect splits the task into 10-40 slices behind a feature flag.

package/docs/v10/PROGRESS.md

@@ -2268,3 +2268,38 @@ The swarm is stopped: .loki/V10-STOP exists, the loop has no wake-ups, and the c
 - Tests run 37173985482 on 22a5701e1: the cap held but FC-19 read 1799.999 on the first session; 559d3e604 asserts 1799 < limit <= 1800. Tests run 37174422458 on 559d3e604: success (all jobs).
 - 11.0.1 = the bump commit on top of 559d3e604 (release.sh patch --bump-only rc=0). Check `gh run list --workflow release.yml --limit 1` and `npm view loki-mode dist-tags` on resume.
 - Branch and worktree cleanup (founder ask, one agent): 177 merged worktrees removed (187 kept: 150 unmerged, 25 dirty, 8 locked, live, protected), 1015 merged local branches deleted (338 kept), 119 merged remote branches deleted. Unmerged remote branches left for the founder: auto/model-catalog-probe (1 ahead), dep-wave1 (5), slice-A-121b (1), train/66 (1).
+
+## 2026-10-08T05:35Z (CoS) 11.3.1 held on SEC-FSMON; local main 743d7ee2f unpushed
+- origin/main = bee8ac363 = v11.3.0 (npm latest). 11.3.1 is held ONLY on SEC-FSMON: since bee8ac363, the cost preview runs in the supervisor and spawns raw git (project_model/gather.ts listShallow/isGitTracked) with the token, so the P9 fsmonitor plant ran holding GH_TOKEN. v11.3.0 is not affected (P9 PASS on bee8ac363).
+- SEC-FSMON fix 464c6d4a6 (41 git spawn sites routed through util/safe_git.ts, zero-allowlist fc25 guard, canary fixture, red then green). It conflicts with main in safe_git.ts and xreview.ts; the engineer is rebasing onto the main tip. HIGH review (high-sec-fsmon, opus) is in flight. Open ruling: worker git now runs with hooks off and gpgSign off, including the seal commit.
+- Merged locally since bee8ac363 (unpushed): FC38-SCOPE2, COST-HALF rev 3 docs (D93), COMPACT-ONLY-HAIKU, CH-02, FINDING-GUARDS (reverted at fbcde1dcf for start-flag parity, re-landed rebased with start-flags.txt fixed; tests/util 99/0), MCP-A (node protocol tests rc=0, test-mcp-server rc=0).
+- Hermeticity defect: attempts-dispatch "no bun on PATH" fails only in the main checkout; git-archive of the same SHA passes 14/0. Queued as TEST-HERMETIC.
+- In review or rework: MASS-1 250940c67 (only the SDK route runs triage; HIGH re-review), RECEIPT-TRUTH (HIGH BLOCK B1-B5 plus modelUsage scope; uncommitted), JUDGE-DEFAULTS 5d7ab2b9d (rebase plus tsc gaps, then TL re-review), WC-01a 8c528d66b (TL), EVAL-LOSSES (aiq-52 dirty-tree class, humanize-174; CTO accuracy directive).
+- Ship steps after SEC-FSMON approves: merge, rebuild dist in the main checkout, run moat P5/P9/full on the final SHA, push (fetch plus ancestry check, no active release), Tests green, release.sh patch --bump-only plus the CHANGELOG from scratchpad changelog-1131.md (add the SEC-FSMON and FINDING-GUARDS/MCP-A lines).
+
+## 2026-10-08T07:10Z (CoS) 11.3.1 train: FULL-DRIFT merged; PRICE-TRUTH-2 and PLAN-TIMEOUT pending
+- origin/main = 7e6692a8b. Tests on it was cancelled: the D90 plan job hit its 5-min cap before `|| true`, and the full fallback was red on six drift suites plus 7 budget tests.
+- FULL-DRIFT merged locally as cdbec7679 at the approved SHA 0382cad94 (TL APPROVE 9d5c0350e plus delta APPROVE 0382cad94; tree equal to 0382cad94; tests/util 110/0). An earlier merge by branch name picked up the unreviewed 0382cad94 and was undone with `git reset --keep` before any push; lesson saved: merge the approved SHA.
+- PRICE-TRUTH-2 884d22be1 (claude-haiku-4-5 at $1/$5 on every exact-id table; bash check_budget_limit also priced claude-haiku-5-5 as sonnet; parity test runs the real function; FC-45): TL review with tl-fix1131, selector output required (CTO rule).
+- PLAN-TIMEOUT (sec-fsmonitor): building under the CTO conditions (fail-safe full=true, never cancelled, under 30s for 100 commits, cheap drift checks always-run under 60s). FC-47 reserved.
+- RECEIPT-TRUTH 66931a217 (11.3.2): HIGH round 5 with high-receipt-truth; branch frozen.
+- Next: merge PRICE-TRUTH-2 and PLAN-TIMEOUT by SHA, dist rebuild if needed, moat on the final SHA, push, Tests green on that SHA, then release.sh patch --bump-only with scratchpad changelog-1131.md.
+
+## 2026-10-08 07:43Z CoS
+- PRICE-TRUTH-2 merged by SHA 884d22be1 as 82eb1ad31 (FC-45/FC-46 rows conflict resolved, both kept); post-merge util+budget 175/0, test-pricing-parity rc 0; git diff 884d22be1 HEAD^2 empty.
+- 11.3.1 now blocked only on PLAN-TIMEOUT: high-cifast parity byte-identical (236s->2s, 455s->4s), 169-commit plan 15s; P1 timeout-minutes 8, P2 timing test, P3 always-run set, P4 rebase onto 82eb1ad31 sent to sec-fsmonitor.
+- 11.3.2 approved queue (hold until 11.3.1 cut, merge by SHA): 132-E2 057b332e9, 132-B4 36284ebb5, 132-F1 82837ec9f. In review: 132-E3, 132-F3, 133-E2, GOV-FORMULA 76afb31a8. 132-E4 31b5c304b built, target missed (4x 23.7s vs 12s at load 20-26), TL deferred until load drops.
+- Found: tests/cli/test-alias-forwarding.sh fails 3 cases on cdbec7679 (help count 27 vs [12,23], local-ci parity rule missing, report export json kpis exit parity); check in the FULL tier run before the cut.
+
+## 2026-10-08 08:17Z CoS
+- RECEIPT-TRUTH round 6 APPROVED by HIGH at 1b5bbaef5 (R5-1/2/4 mutations red, moat rc 0 with P9 PROVEN, CP 519/0); queued for 11.3.2.
+- FC-47 (CTO ruling): select-tests --run is a no-op on R0 and docs diffs (early exits before DO_RUN). Interim rule: TLs on R0 diffs name and run suites explicitly and report the number of suites executed. Fix slice SEL-RUN-FC47 goes after PLAN-TIMEOUT, then a one-shot audit of the R0 merges since v11.3.0.
+- PLAN-TIMEOUT engineer had no edits from 07:40Z to 08:14Z; re-pinged with a commit-now instruction.
+
+- 2026-10-08T10:27Z CoS: PLAN-TIMEOUT-1 merged by SHA b43536756 (TL APPROVE: fast-gate 10, train-verdict-reuse 40, select-tests 42, rc 0; git diff approved..HEAD^2 empty). Full local tier on 82eb1ad31 hit the 45-min cap (rc 124); reds classified env-only (receipt_attest needs cryptography; indexer + typecheck worktree-path only, green in main). bun 2004/0, util 175/0, moat rc 0 5/9. Lost ~1h: TL verdict sat in an idle teammate; next time read the subagent transcript after 10 min instead of waiting. Pushing the 11.3.1 train now.
+
+## 2026-10-08 12:21Z CoS
+- 11.3.1 (604145bbc, pushed) release run 37774482965 failed at required-ci NIGHTLY-BLOCK (D90): nightly 37686475225 red since 10-04 on one test, macOS bun cockpit "renders a real inline image ... via the bundled wasm" timed out after 5000ms (cold wasm+font load). npm 11.3.1 NOT published.
+- Fix-forward NIGHTLY-COCKPIT (row FC-50, beforeAll warm-up + 30s render timeout, assertions unchanged): built f7f48a120, cockpit 26/0; TL round 1 BLOCK only on FC-47 id collision, r2 is the rename, in review. Then: merge, push, dispatch nightly, FULL rerun of 37774482965.
+- 11.3.2 train on local main (unpushed), now e18e4ca11: 12 earlier slices plus 133-B4..ER-01-r2, 133-E3-r2, SIGS-DOC (run-all-tests.sh registration union by hand), VPR-1-r2. UNDO-2-r2 merge reverted locally (tripped raw-gh and full-env spawn guards), r3 in HIGH review.
+- Product-code conflicts sent to engineers: XV-1 (seal.ts), MARK-1 (pr.ts), MASS-2 (queue.ts/pr.ts). BLOCKs back to engineers: MCP-D (unauthenticated HTTP task creation), VPR-2-r2 (gh authorAssociation field does not exist), T5-ATTEMPTS-PR-r2 (stale help line, r3 in review).