loki-mode 9.53.0 → 9.54.0

package/autonomy/run.sh

@@ -9064,6 +9064,10 @@ setup_agent_branch() {
     # Controlled by LOKI_BRANCH_PROTECTION env var (default: true). Set it to
     # "false" to opt out fully and work on the current branch (back-compat).
     local branch_protection="${LOKI_BRANCH_PROTECTION:-true}"
+    # Set to 1 only once THIS run has a current snapshot (mint or resume
+    # union); _loki_record_session_created records nothing otherwise, since a
+    # leftover or stale snapshot would make it claim a user's file.
+    _LOKI_SNAPSHOT_THIS_RUN=0
 
     if [ "$branch_protection" != "true" ]; then
         log_info "Branch protection disabled (LOKI_BRANCH_PROTECTION=${branch_protection})"
@@ -9098,11 +9102,15 @@ setup_agent_branch() {
 
     # Already on a loki branch (session-* or delegate-*): idempotent reuse, do
     # not nest a branch off a loki branch (LOCK A5/A7).
+    # Both reuse paths add what is untracked now to the pre-existing list (a
+    # file the user made between sessions is theirs), except the files an
+    # unfinished previous session created (_loki_resume_snapshot).
     case "$cur" in
         loki/*)
             log_info "Already on loki branch ${cur}"
             mkdir -p .loki/state 2>/dev/null || true
             printf '%s\n' "$cur" > .loki/state/agent-branch.txt 2>/dev/null || true
+            _loki_resume_snapshot
             return 0
             ;;
     esac
@@ -9113,8 +9121,14 @@ setup_agent_branch() {
     if [ -s .loki/state/agent-branch.txt ]; then
         recorded="$(cat .loki/state/agent-branch.txt 2>/dev/null || true)"
         if [ -n "$recorded" ] && git rev-parse --verify "$recorded" >/dev/null 2>&1; then
-            if git checkout "$recorded" >/dev/null 2>&1; then
+            # --no-overwrite-ignore: git's default checkout silently replaces a
+            # gitignored user file at a path the session branch tracks, and the
+            # file is gone when the user switches back. On conflict the resume
+            # is refused and a fresh session branch (with a fresh snapshot) is
+            # minted below.
+            if git checkout --no-overwrite-ignore "$recorded" >/dev/null 2>&1; then
                 log_info "Resuming on recorded agent branch: ${recorded}"
+                _loki_resume_snapshot
                 return 0
             fi
             log_warn "Recorded agent branch ${recorded} could not be checked out - creating a new one"
@@ -9133,19 +9147,13 @@ setup_agent_branch() {
 
     log_info "Branch protection enabled - creating agent branch: $branch_name (base: $cur)"
 
-    # Record the user's own untracked (not ignored) files, repo-wide,
-    # NUL-delimited and relative to the repo top, so commit_session_changes
-    # and the receipt (autonomy/lib/workspace_diff.py) leave them alone. Taken
-    # only when a branch is minted: on resume, untracked files can be the
-    # agent's own uncommitted work. .loki/ is self-ignored above.
-    local top="" snap=".loki/state/preexisting-untracked.z"
-    if top="$(git rev-parse --show-toplevel 2>/dev/null)" \
-       && git -C "$top" ls-files -z --others --exclude-standard > "$snap.tmp" 2>/dev/null \
-       && mv -f "$snap.tmp" "$snap" 2>/dev/null; then
-        :
-    else
-        rm -f "$snap.tmp" "$snap" 2>/dev/null
-        log_warn "Could not record pre-existing untracked files; the session commit may include them"
+    # Record the user's own untracked and gitignored files so
+    # commit_session_changes and the receipt leave them alone.
+    local snap_ok=1 leftover=""
+    if ! _loki_snapshot_or_fail_closed; then
+        snap_ok=0
+        rm -f .loki/state/preexisting-untracked.z .loki/state/preexisting-untracked.sha.z 2>/dev/null
+        log_warn "Could not record pre-existing untracked files; this session will commit nothing (review and commit manually)"
     fi
 
     # Create and checkout the feature branch
@@ -9154,6 +9162,16 @@ setup_agent_branch() {
         return 1
     fi
 
+    # A new session branch starts with an empty session-created record. Files
+    # an unfinished earlier session left (reached here after a refused resume)
+    # were just snapshotted as pre-existing: kept on disk, never committed.
+    leftover="$(_loki_nul_names .loki/state/session-created.z)"
+    if [ -n "$leftover" ]; then
+        log_warn "Left uncommitted from an earlier unfinished session, now treated as your files: $leftover"
+    fi
+    rm -f .loki/state/session-created.z 2>/dev/null
+    if [ "$snap_ok" = 1 ]; then _LOKI_SNAPSHOT_THIS_RUN=1; fi
+
     # Store the branch name for later use (PR creation, cleanup)
     printf '%s\n' "$branch_name" > .loki/state/agent-branch.txt 2>/dev/null
 
@@ -9162,6 +9180,180 @@ setup_agent_branch() {
     echo "$branch_name"
 }
 
+# Snapshot, or fail closed. Any snapshot failure (for example git older than
+# 2.18, whose status lacks --no-renames / --ignored=matching) leaves a marker
+# that makes commit_session_changes commit nothing: a missing snapshot must
+# only ever mean an older session, never "sweep everything".
+_loki_snapshot_or_fail_closed() {
+    if _loki_snapshot_preexisting "$@"; then
+        rm -f .loki/state/preexisting-untracked.failed 2>/dev/null
+        return 0
+    fi
+    mkdir -p .loki/state 2>/dev/null
+    : > .loki/state/preexisting-untracked.failed 2>/dev/null
+    return 1
+}
+
+# _loki_snapshot_preexisting [union]
+# Write .loki/state/preexisting-untracked.z: every path git does not track,
+# untracked and gitignored, repo-wide, NUL-delimited, relative to the repo top.
+# commit_session_changes unstages these and the receipt
+# (autonomy/lib/workspace_diff.py) does not claim them. --ignored=matching lists
+# a directory only when an ignore pattern matches it, so node_modules/ is one
+# "dir/" entry covering its subtree, while logs/ holding only *.log files is
+# listed file by file (a new logs/app.json is still the agent's). "union" keeps
+# the paths already recorded. The sibling .sha.z (content hash per file entry)
+# lets the receipt list a pre-existing file the run changed; it is removed
+# first, so a failed hash step means no detection, never stale hashes. Returns
+# non-zero, leaving any earlier list in place, when git cannot list.
+_loki_snapshot_preexisting() {
+    local snap=".loki/state/preexisting-untracked.z" top="" base="" exclude=""
+    rm -f "${snap%.z}.sha.z" 2>/dev/null
+    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
+    mkdir -p .loki/state 2>/dev/null || return 1
+    # "union" never adds a path listed in session-created.z: those files were
+    # made by a session that did not finish (interrupt, pod loss), so the
+    # session that finishes the work commits them. If the user edits one of
+    # them between sessions it is still the session's file and is committed
+    # with the edit. Recorded entries only block additions; they never remove
+    # a path already in the list.
+    if [ "${1:-}" = union ]; then
+        base="$snap"
+        exclude=".loki/state/session-created.z"
+    fi
+    if ! _loki_untracked_status "$snap.status" \
+       || ! _loki_untracked_merge "$snap.status" "$base" "$exclude" exact "$snap"; then
+        rm -f "$snap.status" "$snap.tmp"
+        return 1
+    fi
+    rm -f "$snap.status"
+    python3 -E "$SCRIPT_DIR/lib/workspace_diff.py" hash-snapshot "$top" "$snap" >/dev/null 2>&1 \
+        || log_warn "Could not hash your pre-existing untracked files; the receipt cannot list the ones this run changes"
+    return 0
+}
+
+# _loki_untracked_status <out>: the one enumeration behind both the snapshot
+# and the session-created record, so the two always agree: raw
+# `git status --porcelain -z` records for the whole repo, .loki excluded.
+# Non-zero, writing nothing, when git cannot list.
+_loki_untracked_status() {
+    local top="" prefix=""
+    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
+    prefix="$(git rev-parse --show-prefix 2>/dev/null)" || return 1
+    git -C "$top" --no-optional-locks status --porcelain -z --no-renames -uall \
+        --ignored=matching --ignore-submodules=all -- ":(exclude,literal)${prefix}.loki" \
+        > "$1" 2>/dev/null && return 0
+    rm -f "$1"
+    return 1
+}
+
+# _loki_untracked_merge <status> <base> <exclude> exact|cover <out>
+# Atomically write <out>: the NUL-delimited paths of <base>, plus every
+# untracked ("??") or ignored ("!!") path in <status> that <exclude> does not
+# hold. With "cover", an <exclude> entry ending in "/" also holds every path
+# below it (workspace_diff._covered). An empty or missing <base> or <exclude>
+# is an empty list; any other read or write failure is non-zero and leaves
+# <out> as it was. Sorted bytewise, like `LC_ALL=C sort -z -u`. One python
+# process: bash 3.2 has no associative arrays, and a bash loop cost 300ms per
+# 6,000 entries on /bin/bash. -E and no cwd on sys.path (D7): the cwd is the
+# agent's repo.
+_loki_untracked_merge() {
+    python3 -E -c 'import sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import os
+status, base, exclude, mode, out = sys.argv[1:6]
+def entries(path, missing_ok=True):
+    try:
+        with open(path, "rb") as fh:
+            return [p for p in fh.read().split(b"\0") if p]
+    except FileNotFoundError:
+        if missing_ok:
+            return []
+        raise
+held = set(entries(exclude)) if exclude else set()
+def covered(path):
+    if path in held:
+        return True
+    cut = path.find(b"/") if mode == "cover" else -1
+    while cut != -1:
+        if path[:cut + 1] in held:
+            return True
+        cut = path.find(b"/", cut + 1)
+    return False
+paths = set(entries(base)) if base else set()
+for rec in entries(status, missing_ok=False):
+    # The session-created record ("cover" mode) never holds a directory entry:
+    # a whole-directory entry (logs/, out/) would stop the resume union from
+    # adopting a file the user later creates inside it, and a .gitignore
+    # rewrite would then sweep that file. Adopting such a directory as
+    # pre-existing fails safe (the agent files inside stay uncommitted).
+    if mode == "cover" and rec.endswith(b"/"):
+        continue
+    if rec[:3] in (b"?? ", b"!! ") and not covered(rec[3:]):
+        paths.add(rec[3:])
+with open(out + ".tmp", "wb") as fh:
+    fh.write(b"".join(p + b"\0" for p in sorted(paths)))
+os.replace(out + ".tmp", out)' "$@" 2>/dev/null
+}
+
+# _loki_record_session_created
+# Union into .loki/state/session-created.z (NUL-delimited, repo-top-relative,
+# atomic) the paths git does not track now that the pre-existing snapshot does
+# not cover: the files this session created. The resume union never adds these
+# to the snapshot, so a session that is interrupted (cleanup) or killed (pod
+# loss: no trap runs, hence the call after every provider turn) still has its
+# own files committed by the session that finishes. commit_session_changes
+# clears the record after a normal commit; a new session branch starts empty.
+# Records nothing unless this run took a current snapshot (a leftover or stale
+# one would make it claim a user's file). On a failure the record is left as it
+# was, never partial, and preexisting-untracked.failed is never touched; the
+# next successful call recomputes everything, so only a failure on the final
+# call before a kill loses paths (those are then treated as the user's: kept on
+# disk, not committed).
+_loki_record_session_created() {
+    local snap=".loki/state/preexisting-untracked.z" out=".loki/state/session-created.z"
+    [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" = 1 ] || return 0
+    if [ -f "$snap" ] && _loki_untracked_status "$out.status" \
+       && _loki_untracked_merge "$out.status" "$out" "$snap" cover "$out"; then
+        rm -f "$out.status"
+        return 0
+    fi
+    rm -f "$out.status" "$out.tmp" 2>/dev/null
+    log_warn "Could not record the files this session created; if the run stops before the next record, they are treated as yours and left uncommitted"
+    return 1
+}
+
+# _loki_resume_snapshot: the resume paths' union, naming the files carried over
+# from an unfinished previous session (this session's commit includes them).
+_loki_resume_snapshot() {
+    local carried=""
+    if ! _loki_snapshot_or_fail_closed union; then
+        log_warn "Could not add your current untracked files to the pre-existing list; this session will commit nothing (review and commit manually)"
+        return 0
+    fi
+    _LOKI_SNAPSHOT_THIS_RUN=1
+    carried="$(_loki_nul_names .loki/state/session-created.z)"
+    if [ -n "$carried" ]; then
+        log_info "Carried over as this session's work, not adopted as your files (created by the unfinished previous session): $carried"
+    fi
+}
+
+# _loki_nul_names <file>: the entries of a NUL-delimited repo-top-relative list
+# that exist now, comma-separated, the first 20 then "(and N more)".
+_loki_nul_names() {
+    local p top="" n=0 out=""
+    [ -s "$1" ] || return 0
+    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 0
+    while IFS= read -r -d '' p; do
+        if [ -e "$top/$p" ] || [ -L "$top/$p" ]; then
+            n=$((n + 1))
+            if [ "$n" -le 20 ]; then out="${out}${out:+, }${p}"; fi
+        fi
+    done < "$1"
+    if [ "$n" -gt 20 ]; then out="${out} (and $((n - 20)) more)"; fi
+    printf '%s' "$out"
+}
+
 # RUN-25 iter 21 (Wave D #2): the two secret matchers now live in one sourceable
 # lib so the commit gate (here) and the completion evidence gate (completion-
 # council.sh) share a single implementation. Sourced with a guard so a re-source
@@ -9226,13 +9418,20 @@ commit_session_changes() {
         ':!*.key' ':!*.pem' ':!*.p12' ':!*.keystore' \
         ':!id_rsa*' ':!*.token' ':!credentials*' 2>/dev/null || true
 
-    # Unstage exactly the files that were untracked when the branch was minted
-    # (setup_agent_branch): they are the user's, not this session's work, and
-    # committing them here would delete them from disk on a later checkout of
-    # the base. Agent-created files stay staged. Skip an empty snapshot: an
+    # Unstage exactly the paths recorded as untracked or gitignored when the
+    # session started (setup_agent_branch; a "dir/" entry covers its subtree):
+    # they are the user's, not this session's work, and committing them here
+    # would delete them from disk on a later checkout of the base (an agent
+    # rewrite of .gitignore can expose ignored files to `git add -A`).
+    # Agent-created files stay staged. Skip an empty snapshot: an
     # empty --pathspec-from-file resets the WHOLE index. No snapshot (older
     # session): behave as before. If the unstage fails (git < 2.25), commit
     # nothing rather than sweep the user's files in.
+    if [ -f "$PWD/.loki/state/preexisting-untracked.failed" ]; then
+        git reset -q >/dev/null 2>&1 || true
+        log_warn "Left uncommitted: could not record your pre-existing untracked files at session start (the snapshot needs git 2.18+, excluding them needs 2.25+). Review and commit manually."
+        return 0
+    fi
     local preexisting="$PWD/.loki/state/preexisting-untracked.z" top=""
     if [ -s "$preexisting" ]; then
         if ! { top="$(git rev-parse --show-toplevel 2>/dev/null)" \
@@ -9244,8 +9443,12 @@ commit_session_changes() {
         fi
     fi
 
-    # Nothing staged = clean no-op, never an error.
+    # Nothing staged = clean no-op, never an error. A session that ends here or
+    # commits below ended normally: its session-created record is spent (what
+    # it listed is committed, or was never committable), so the next session
+    # starts clean.
     if git diff --cached --quiet 2>/dev/null; then
+        rm -f .loki/state/session-created.z 2>/dev/null
         return 0
     fi
 
@@ -9287,7 +9490,9 @@ commit_session_changes() {
         return 0
     fi
 
-    git commit -m "Loki Mode session changes (${ITERATION_COUNT:-0} iterations, result=${result:-0})" 2>/dev/null || true
+    if git commit -m "Loki Mode session changes (${ITERATION_COUNT:-0} iterations, result=${result:-0})" 2>/dev/null; then
+        rm -f .loki/state/session-created.z 2>/dev/null
+    fi
     audit_agent_action "git_commit" "Committed session changes" "iterations=${ITERATION_COUNT:-0},result=${result:-0}" || true
     return 0
 }
@@ -12573,9 +12778,19 @@ os.replace(tmp, out)
     fi
 
     if [ "$test_passed" = "true" ]; then
-        touch "$quality_dir/unit-tests.pass"
         rm -f "$loki_dir/signals/TESTS_FAILED" 2>/dev/null || true
-        log_info "Test suite gate: $test_runner passed"
+        # BACKLOG 55: the #82 zero-test run exited 0 but proved nothing. It is
+        # inconclusive, so it must not leave the pass marker the receipt reads
+        # as "unit_tests passed" (proof-generator.py _collect_quality_gates).
+        # Still non-blocking (return 0 below) and still not a failure (no
+        # TESTS_FAILED), so the council decides it, per the #82 design.
+        if [ "$_tr_zero_tests" = "true" ]; then
+            rm -f "$quality_dir/unit-tests.pass" 2>/dev/null || true
+            log_warn "Test suite gate: $test_runner ran zero tests -- inconclusive (not passed, not failed)"
+        else
+            touch "$quality_dir/unit-tests.pass"
+            log_info "Test suite gate: $test_runner passed"
+        fi
         # Coverage block is distinct from tests-red: tests passed, but enforced
         # coverage is below threshold. Return nonzero to gate WITHOUT writing the
         # TESTS_FAILED signal or removing unit-tests.pass.
@@ -19583,7 +19798,11 @@ load_state() {
         if command -v python3 &> /dev/null; then
             # BUG-ST-006: Validate checkpoint integrity before loading state
             local state_valid
-            state_valid=$(LOKI_STATE_FILE="$state_file" python3 -c "
+            # -E and the sys.path filter (D7): the cwd is the target repo, and a
+            # committed json.py must not decide the loaded iteration count
+            # (a fake non-zero count would skip the iteration-0 evidence drop).
+            state_valid=$(LOKI_STATE_FILE="$state_file" python3 -E -c "
+import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['LOKI_STATE_FILE']) as f:
@@ -19609,15 +19828,20 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
                 ITERATION_COUNT=0
                 # Back up corrupted state file for diagnosis
                 mv "$state_file" "${state_file}.corrupt.$(date +%s)" 2>/dev/null || true
+                # Starts at iteration 0: drop the previous session's test
+                # evidence, as the iteration-0 block at the end does.
+                rm -f "${TARGET_DIR:-.}/.loki/quality/.test-results.iter" \
+                      "${TARGET_DIR:-.}/.loki/quality/unit-tests.pass" \
+                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" 2>/dev/null || true
                 return
             fi
 
             # Load retry count, iteration count, and status from previous session
             local prev_status
-            prev_status=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('status', 'unknown'))" 2>/dev/null || echo "unknown")
-            RETRY_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('retryCount', 0))" 2>/dev/null || echo "0")
+            prev_status=$(LOKI_STATE_FILE="$state_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('status', 'unknown'))" 2>/dev/null || echo "unknown")
+            RETRY_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('retryCount', 0))" 2>/dev/null || echo "0")
             # BUG-RUN-003: Restore ITERATION_COUNT from persisted state
-            ITERATION_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('iterationCount', 0))" 2>/dev/null || echo "0")
+            ITERATION_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('iterationCount', 0))" 2>/dev/null || echo "0")
 
             # Reset retry count + iteration count if previous session ended in a
             # terminal state. A fresh `loki start` after a terminal run is a NEW
@@ -19678,6 +19902,18 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
     else
         RETRY_COUNT=0
     fi
+    # A session that starts at iteration 0 has run nothing yet, so a leftover
+    # freshness marker or unit-tests.pass is a previous session's evidence.
+    # Iterations restart at 0, so keeping them would let an old pass:true read
+    # as this iteration's result.
+    if [ "${ITERATION_COUNT:-0}" = "0" ]; then
+        # Same path the writer (enforce_test_coverage) and the freshness
+        # readers use.
+        local _q="${TARGET_DIR:-.}/.loki/quality"
+        # test-results.json too: with the marker gone the receipt's quality
+        # gates fall back to its status, reporting a previous session's run.
+        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" 2>/dev/null || true
+    fi
 }
 
 # Load tasks from queue files for prompt injection
@@ -23908,6 +24144,12 @@ if __name__ == "__main__":
         # v7.5.12: Provider invocation finished (or was killed by trap).
         LOKI_PROVIDER_ACTIVE=0
 
+        # Record the files this session has created so far. A pod loss is a
+        # SIGKILL (no trap runs), so this per-turn record is what lets the
+        # resumed session commit them. One git status; no-op without a
+        # session snapshot.
+        _loki_record_session_created || true
+
         echo ""
         echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
         echo ""
@@ -26208,6 +26450,10 @@ cleanup() {
         fi
         # v7.5.12: Kill any running provider pipeline first, before slow cleanup.
         kill_provider_child 2>/dev/null || true
+        # This exit makes no session commit: record the files this session
+        # created (after the provider is gone, so none are added later), so a
+        # resume commits them instead of adopting them as the user's.
+        _loki_record_session_created || true
         rm -f "$loki_dir/STOP" "$loki_dir/PAUSE" "$loki_dir/PAUSED.md" 2>/dev/null
         # UT2-13: Clear cli-provider marker on session end.
         rm -f "$loki_dir/state/cli-provider" 2>/dev/null || true
@@ -26282,6 +26528,8 @@ except (json.JSONDecodeError, OSError): pass
         log_warn "Loki Mode interrupted -- shutting down (double Ctrl+C)"
         # v7.5.12: Kill provider pipeline immediately so we don't wait on it.
         kill_provider_child 2>/dev/null || true
+        # No session commit on this exit either (see the branch above).
+        _loki_record_session_created || true
         # Write STOP signal so any peer processes (dashboard, etc.) also stop.
         mkdir -p "$loki_dir" 2>/dev/null && touch "$loki_dir/STOP" 2>/dev/null || true
         if type app_runner_cleanup &>/dev/null; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.53.0"
+__version__ = "9.54.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.53.0
+**Version:** v9.54.0
 
 ---
 

package/docs/v10/BACKLOG.md

@@ -90,6 +90,47 @@ Status values: todo, in progress, shipped (version), parked (reason).
 59. **Agent edits to pre-existing untracked files are omitted from the receipt (new in v9.53.0).** Store a blob hash per snapshot entry; list a path whose hash changed (for example `preexisting_modified`) while still never committing the user's file (cycle-2 council). Not a false pass: no verdict reads the list.
 60. **Bun `runTestCoverage` accepts a stale `test-results.json`** (no freshness check against `.loki/quality/.test-results.iter`), and an inconclusive coverage still lands in `GateOutcome.passed[]` with an "(gate did not run)" log line.
 
+61. **`evidence-block.json` still writes the raw `$test_pass`** (`completion-council.sh` ~2792, block path), so `tests.pass` can read true for an inconclusive test axis when another axis blocks.
+62. **`enforce_test_coverage` monorepo-custom-rejected path** records `pass: true` / `verified` and touches `unit-tests.pass` when `LOKI_MONOREPO_TEST_CMD` is rejected and the gate is skipped.
+63. **`council_augment_from_managed_memory`** (`completion-council.sh` ~228) runs `cd "${PROJECT_DIR:-$(pwd)}"` then `python3 -m memory.managed_memory.retrieve`; with `PROJECT_DIR` unset it can run the agent repo's own `memory/` package into the council prompt.
+64. **A test script like `exit 0` still reads as a pass on both routes** (the zero-test detector acts only on positive evidence of zero tests); `node --test` behind an npm script is not detected. The Bun freshness marker is agent-writable.
+65. **(Fixed for interrupt and kill in cycle 3 via `.loki/state/session-created.z`; see 86 for limits.) Previous-session leftovers become "pre-existing" after a crash** (cycle-3 disclosure): files left uncommitted by a crashed or secret-scan-aborted session are recorded as pre-existing on the next run and stay on disk, uncommitted.
+
+66. **Ignored `dir/` snapshot entries hide agent files under them.** If the agent un-ignores `build/` and creates `build/agent.js`, the literal `build/` reset unstages it and the receipt's coverage check hides it; an agent edit to a user file under that entry is not disclosed (no per-file hash for dir entries). At least report new or changed paths covered only by a dir entry (cycle-3 council).
+67. **Deletions and ignored edits are not disclosed.** An agent `rm` of a pre-existing untracked user file, or an edit to a still-ignored pre-existing file (`.env.local`), leaves the receipt silent; iterate the recorded hash map (missing = deleted, changed = modified), with care for gate-regenerated noise (cycle-3 council).
+68. **The resume union never prunes entries that became tracked**: a file the user committed between sessions is still unstaged by the session commit while the receipt lists it as modified. Drop union entries present in `git ls-files -z --cached`.
+69. **Snapshot hashing cost on large untracked data trees**: every file entry is sha256'd at every session start (30k small files: 1.9s; tens of GB of untracked parquet or weights would stall for minutes). Add a size cap or a size+mtime+inode fingerprint.
+70. **Snapshot and hash files live in agent-writable `.loki/state`**: an agent can add entries (hide or uncommit files) or delete the hash file (suppress `preexisting_modified`). Predates cycle 3; matters for adversarial agents.
+71. **`evidence-gate-details` `tests.ok` stays true for an inconclusive test axis**; `surface_evidence_gate_details` prints `tests_ok=True` next to `tests_inconclusive`.
+
+72. **Refused resume keeps the old `base-branch.txt` and says too little.** Now that `--no-overwrite-ignore` makes the mint fallback a normal path, session 2 keeps session 1's recorded base (wrong PR `--base` advice if it started elsewhere), and the warning does not name the ignored file or where session 1's commits live.
+
+73. **Bash records a test run that exits 0 but reports failures as a pass** (a jest printing "Tests: 1 failed, 2 passed" with exit 0 wrote `pass: true`, `verified`). Parse the runner's own summary for failures (cycle-3 council round 2).
+74. **Agent self-commits bypass the snapshot (data risk).** The snapshot guards only Loki's session commit: an agent that rewrites `.gitignore` and runs `git add -A && git commit` itself puts the user's untracked and ignored files on the session branch, and a base checkout removes them from disk. The RARV prompt tells every provider to checkpoint-commit; only `providers/claude.sh` (and the Bun override) forbids `git add -A`. Intersect `git diff --diff-filter=A <base>..HEAD` with the snapshot in `commit_session_changes`, `git rm --cached` hits, warn, and add the hygiene line to codex/cline/opencode/aider prompts. Also: an agent moving a user file to a new path gets the user's bytes committed under an agent-created name.
+75. **Unregistered suites:** `tests/council/test_managed_completion_flag.sh`, `tests/council/test_managed_review*`, `tests/test-voter-agents-json.sh` and `tests/test-evidence-gate-no-tests.sh` are never run by `tests/run-all-tests.sh` (named only in comments).
+
+76. **`done-recognition.sh` tests_axis (434-479): a zero-test record falls through** to an affirmative branch (predates cycle 3; council round 3).
+77. **Every Bun test-results.json is stale by construction:** only bash `enforce_test_coverage` writes `.test-results.iter`, so the Bun gate always re-runs `npm test` or reports inconclusive, and an unknown zero-test detector result makes every exit-0 npm run inconclusive. Fails safe; decide whether Bun should write its own marker.
+78. **Leading-directory pathspec mismatch:** a pre-existing untracked file `a` also matches `a/b` in the literal reset, but `workspace_diff._covered` only treats `a/` entries as covering children, so the commit omits `a/b` while the receipt lists it (the receipt is the honest side).
+79. **A previous session's `static-analysis.pass` survives iteration 0** and reads as a pass of the exogenous static_analysis gate when the new session never runs static analysis (cannot produce VERIFIED alone). Add it to the iteration-0 drop.
+80. **Refused resume on a paused or interrupted state keeps session 1's `start-sha`** while the new branch is minted from the current base, so base commits made between sessions can appear in the receipt diff (extends 72).
+
+81. **Two more verdict-relevant inline Python sites without D7:** `run.sh` `_declared_test_script` (~11981) and `_ws_script` (~12101) run plain `python3 -c` with the cwd in the agent repo (extends 54).
+82. **`proof-generator._collect_quality_gates` reads `test-results.json` status with no freshness check** against `.test-results.iter` (the iteration-0 drop covers the new-session case; a stale file mid-session is still read).
+83. **An embedded git repo with no commits under an un-ignored directory makes `git add -A` fail as a whole**; `commit_session_changes` then silently commits nothing with no "Left uncommitted" warning (fails safe, predates cycle 3).
+84. **`-E` also drops `PYTHONDONTWRITEBYTECODE`/`PYTHONIOENCODING`/`PYTHONUTF8`** for the guarded helpers; the council-v2 swarm imports may write `__pycache__` into the install dir (cosmetic).
+
+85. **The test gate's pytest writes `__pycache__/*.pyc` into the user's repo**, and the session commit includes them when the repo does not ignore `__pycache__` (seen in a receipt: `__pycache__/helper.cpython-313.pyc`). `P6.no-gate-artifacts-committed` covers only the static-analysis gate; run tests with `PYTHONDONTWRITEBYTECODE=1` or a pycache prefix under `.loki` (cycle-3 interrupt fix).
+86. **Session-created record limits:** the provider turn in flight when the process dies is not recorded (SIGHUP is not trapped, like SIGKILL), so those files are treated as the user's (kept, never committed); a refused resume starts an empty record (warns by name); a path created then deleted by the agent and later re-created by the user is committed as the session's; the snapshot now requires python3 (fails closed without it).
+
+87. **Resume rehash hides earlier edits:** the union deletes and rehashes `.sha.z`, so after a SIGKILL or pod loss (no session-1 receipt) session 1's edit to a pre-existing untracked file never appears as `preexisting_modified`. Keep existing hashes for entries already in the base list; hash only new paths.
+88. **Old git (< 2.18) receipt attribution:** a failed mint snapshot deletes the list, so the receipt names every user untracked file as the run's work (names and counts only; the commit path fails closed). Keep an `ls-files --others --exclude-standard` fallback list for the receipt.
+89. **Bash and Bun read `failed_count` differently:** the bash evidence gate reads `pass: true` as PASS whatever `failed_count` says; Bun now fails it.
+
+90. **Data risk, next in line: `LOKI_BRANCH_PROTECTION=false` on a leftover `loki/session-*` branch** returns before any snapshot (`run.sh` ~9073), and `commit_session_changes` then commits with the earlier session's stale snapshot, so a file the user made since is committed and lost from disk on checkout of the base (also in v9.53.0; breaks the LOCK A1 opt-out promise). One guard: commit nothing unless this run took a snapshot, or skip the session commit when branch protection is off (cycle-3 council round 6).
+91. **Zero-test stage events:** a zero-test run still returns 0 from `enforce_test_coverage`, so the loop emits `stage_complete test_suite pass` (~24590) although the result is inconclusive.
+92. **Receipt path bases mix under a subdirectory `TARGET_DIR`:** tracked entries are repo-top-relative, untracked and `preexisting_modified` entries are cwd-relative.
+
 ## Later milestones
 
 M1 one command, M2 Seal and Wall, M3 assign like a teammate, M4 system map, M5 the line, M6 ship and operate, M7 one screen, M8 legacy lane, M9 enterprise readiness, M10 simplify and ship v10.0.0. Items get broken out here when their milestone comes up.

package/docs/v10/METRICS.md

@@ -42,6 +42,7 @@ produced it. "Not measured" is a real value here: nothing is estimated.
 
 | Property | Status | Command |
 |---|---|---|
-| all 9 | 1 of 9 proven (P6); 48 cases, 25 pass, 23 pending with milestones (2026-09-26, v9.53.0) | `bash tests/moat/run.sh` |
+| all 9 | 1 of 9 proven (P6); 55 cases, 32 pass, 23 pending with milestones (2026-09-26, v9.54.0) | `bash tests/moat/run.sh` |
+| history | v9.53.0: 1 of 9, 48 cases, 25 pass, 23 pending | - |
 | history | v9.52.0: 0 of 9, 45 cases, 21 pass, 24 pending | - |
 | runtime | about 15s locally (9 scripts in parallel), about 1m15s CI job | `time bash tests/moat/run.sh` |

package/docs/v10/PROGRESS.md

@@ -27,6 +27,7 @@
 
 ## Shipped in v10 program
 
+- **v9.54.0** (2026-09-26): resume never sweeps, overwrites or loses user files (between-session files, gitignored files, interrupted sessions, old git); previous-session test evidence never read as this session's; D7 on checklist verification, council helpers and load_state.
 - **v9.53.0** (2026-09-26): P6 in-place brownfield proven (moat 1 of 9); user untracked files never swept into session commits; no bytecode from the syntax gate; Bun gate never passes an inconclusive result; council and runner verdict paths cannot import from the agent repo.
 - **v9.52.0** (2026-09-25): moat suite `tests/moat/` (45 cases, 0 of 9 properties proven, 24 pending with milestones, ratchet baseline set by this release); verifier fixes (Bun `--jwks`, stripped signature, malformed tokens, strict flags and help, `python3 -E` on every verify path, exit contract 64/66); council `pass` readers fail closed; honest `doctor --airgap`; main-red fix.
 
@@ -37,6 +38,22 @@
 - Council: 3 of 3 APPROVE on the first round. Non-blocking data-safety findings recorded as BACKLOG 57-60.
 - Released as v9.53.0.
 
+### Cycle 3 (2026-09-26)
+
+- v9.53.0 verified on all channels (npm latest + gitHead `d7fb8674`, tag, GitHub release, Docker amd64/arm64, Homebrew sha256).
+- Dev fleet (3 worktree slices): resume re-snapshot, gitignored files, receipt discloses edits to user files (BACKLOG 57-59); D7 on checklist verification and council helpers (53, 54 partly); zero-test and stale results never affirmative on either route (55, 56, 60).
+- Moat: still 1 of 9 proven (P6); 54 cases registered (48 in the release-tag union), 23 pending; ratchet against v9.52.0 and v9.53.0. New cases: P6.resume-does-not-sweep, P6.ignored-files-not-swept, P6.preexisting-edit-disclosed, P6.resume-keeps-ignored-user-file, P2.checklist-verify-not-shadowed, P2.zero-test-never-affirmative.
+- Council rounds: r1 CONCERN x2 (resume overwrote ignored user files; stale Bun pass) -> fixed 55ee9747; r2 CONCERN (previous test-results.json still reported) -> fixed d55b13f4; r3 CONCERN (snapshot on git < 2.18 fell back to sweeping everything) -> fixed f71ab6a1; r4 3 of 3 APPROVE but an interrupt regression found -> fixed 5faa666e; r5 CONCERN (session-created record held directory entries) -> fixed 32d3831a; r6 **3 of 3 APPROVE**.
+- Moat at release: 1 of 9 proven; 55 registered, 32 pass, 23 pending.
+- Released as v9.54.0.
+- Open items the slices found: BACKLOG 61-65.
+
+## Next (after cycle 3)
+
+1. BACKLOG 90 (branch-protection-off stale snapshot: data risk), then 74 (agent self-commits bypass the snapshot), 85 (test-gate `__pycache__`), 73 (exit-0 runs with failures).
+2. Honest verdict: 81, 82, 89, 91; council helper D7 remainder (54).
+3. Then P7 (no fabricated data), P9 (Rule of Two), M0 measurement.
+
 ## Next (after cycle 2)
 
 1. Brownfield data safety: BACKLOG 57, 58, 59 (resume re-snapshot, gitignored files, receipt omission).