loki-mode 9.53.0 → 9.54.2

package/autonomy/run.sh

@@ -8765,10 +8765,20 @@ start_resource_monitor() {
     # Initial check
     check_system_resources
 
-    # Background monitoring loop
+    # Background monitoring loop. BACKLOG 22: a bare `sleep N` inside this
+    # subshell survives a TERM to the subshell -- caught traps do not carry
+    # into a foreground child, so the sleep reparents to init and outlives the
+    # run for up to RESOURCE_CHECK_INTERVAL seconds. Backgrounding the sleep
+    # and recording its PID lets a TERM trap kill it directly; `wait` returns
+    # immediately once the trap fires, so shutdown is not delayed either.
     (
+        _loki_rm_sleep_pid=""
+        trap '[ -n "$_loki_rm_sleep_pid" ] && kill "$_loki_rm_sleep_pid" 2>/dev/null; exit 0' TERM
         while true; do
-            sleep "$RESOURCE_CHECK_INTERVAL"
+            sleep "$RESOURCE_CHECK_INTERVAL" &
+            _loki_rm_sleep_pid=$!
+            wait "$_loki_rm_sleep_pid"
+            _loki_rm_sleep_pid=""
             check_system_resources
         done
     ) &
@@ -9064,6 +9074,10 @@ setup_agent_branch() {
     # Controlled by LOKI_BRANCH_PROTECTION env var (default: true). Set it to
     # "false" to opt out fully and work on the current branch (back-compat).
     local branch_protection="${LOKI_BRANCH_PROTECTION:-true}"
+    # Set to 1 only once THIS run has a current snapshot (mint or resume
+    # union); _loki_record_session_created records nothing otherwise, since a
+    # leftover or stale snapshot would make it claim a user's file.
+    _LOKI_SNAPSHOT_THIS_RUN=0
 
     if [ "$branch_protection" != "true" ]; then
         log_info "Branch protection disabled (LOKI_BRANCH_PROTECTION=${branch_protection})"
@@ -9087,8 +9101,10 @@ setup_agent_branch() {
     [ -f .loki/.gitignore ] || printf '*\n' > .loki/.gitignore 2>/dev/null || true
 
     # Capture the ref Loki was run from. Detached HEAD yields the literal "HEAD".
+    # symbolic-ref also names an unborn branch (fresh `git init`), where
+    # rev-parse printed "HEAD" and failed, recording "HEAD" twice as the base.
     local cur=""
-    cur="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+    cur="$(git symbolic-ref --short -q HEAD 2>/dev/null || echo HEAD)"
 
     # Detached HEAD: do NOT branch, do NOT fabricate a base (LOCK A2/A6).
     if [ "$cur" = "HEAD" ]; then
@@ -9098,11 +9114,15 @@ setup_agent_branch() {
 
     # Already on a loki branch (session-* or delegate-*): idempotent reuse, do
     # not nest a branch off a loki branch (LOCK A5/A7).
+    # Both reuse paths add what is untracked now to the pre-existing list (a
+    # file the user made between sessions is theirs), except the files an
+    # unfinished previous session created (_loki_resume_snapshot).
     case "$cur" in
         loki/*)
             log_info "Already on loki branch ${cur}"
             mkdir -p .loki/state 2>/dev/null || true
             printf '%s\n' "$cur" > .loki/state/agent-branch.txt 2>/dev/null || true
+            _loki_resume_snapshot
             return 0
             ;;
     esac
@@ -9113,39 +9133,37 @@ setup_agent_branch() {
     if [ -s .loki/state/agent-branch.txt ]; then
         recorded="$(cat .loki/state/agent-branch.txt 2>/dev/null || true)"
         if [ -n "$recorded" ] && git rev-parse --verify "$recorded" >/dev/null 2>&1; then
-            if git checkout "$recorded" >/dev/null 2>&1; then
+            # --no-overwrite-ignore: git's default checkout silently replaces a
+            # gitignored user file at a path the session branch tracks, and the
+            # file is gone when the user switches back. On conflict the resume
+            # is refused and a fresh session branch (with a fresh snapshot) is
+            # minted below.
+            if git checkout --no-overwrite-ignore "$recorded" >/dev/null 2>&1; then
                 log_info "Resuming on recorded agent branch: ${recorded}"
+                _loki_resume_snapshot
                 return 0
             fi
             log_warn "Recorded agent branch ${recorded} could not be checked out - creating a new one"
         fi
     fi
 
-    # Fresh run: persist the base branch (fresh-run-only) BEFORE branching, then
-    # mint and check out the feature branch (LOCK A2).
+    # Fresh run: mint and check out the feature branch, then persist its base
+    # (fresh-run-only, LOCK A2).
     local timestamp
     timestamp=$(date +%s)
     local branch_name="loki/session-${timestamp}-$$"
 
     mkdir -p .loki/state 2>/dev/null || true
-    # Persist the base only once per run tree; never overwrite an existing base.
-    [ ! -s .loki/state/base-branch.txt ] && printf '%s\n' "$cur" > .loki/state/base-branch.txt 2>/dev/null
 
     log_info "Branch protection enabled - creating agent branch: $branch_name (base: $cur)"
 
-    # Record the user's own untracked (not ignored) files, repo-wide,
-    # NUL-delimited and relative to the repo top, so commit_session_changes
-    # and the receipt (autonomy/lib/workspace_diff.py) leave them alone. Taken
-    # only when a branch is minted: on resume, untracked files can be the
-    # agent's own uncommitted work. .loki/ is self-ignored above.
-    local top="" snap=".loki/state/preexisting-untracked.z"
-    if top="$(git rev-parse --show-toplevel 2>/dev/null)" \
-       && git -C "$top" ls-files -z --others --exclude-standard > "$snap.tmp" 2>/dev/null \
-       && mv -f "$snap.tmp" "$snap" 2>/dev/null; then
-        :
-    else
-        rm -f "$snap.tmp" "$snap" 2>/dev/null
-        log_warn "Could not record pre-existing untracked files; the session commit may include them"
+    # Record the user's own untracked and gitignored files so
+    # commit_session_changes and the receipt leave them alone.
+    local snap_ok=1 leftover=""
+    if ! _loki_snapshot_or_fail_closed; then
+        snap_ok=0
+        rm -f .loki/state/preexisting-untracked.z .loki/state/preexisting-untracked.sha.z 2>/dev/null
+        log_warn "Could not record pre-existing untracked files; this session will commit nothing (review and commit manually)"
     fi
 
     # Create and checkout the feature branch
@@ -9154,6 +9172,25 @@ setup_agent_branch() {
         return 1
     fi
 
+    # A new session branch starts with an empty session-created record. Files
+    # an unfinished earlier session left (reached here after a refused resume)
+    # were just snapshotted as pre-existing: kept on disk, never committed.
+    leftover="$(_loki_nul_names .loki/state/session-created.z)"
+    if [ -n "$leftover" ]; then
+        log_warn "Left uncommitted from an earlier unfinished session, now treated as your files: $leftover"
+    fi
+    rm -f .loki/state/session-created.z 2>/dev/null
+    if [ "$snap_ok" = 1 ]; then _LOKI_SNAPSHOT_THIS_RUN=1; fi
+
+    # Every mint (a refused resume included) records its own base and the
+    # commit it starts at (the empty tree when unborn); the resume paths above
+    # keep both. A base left by an earlier session can name a branch deleted
+    # since, and _loki_untrack_agent_committed_user_files then could not find
+    # the user files the agent commits.
+    printf '%s\n' "$cur" > .loki/state/base-branch.txt 2>/dev/null
+    { git rev-parse --verify -q HEAD || git hash-object -t tree /dev/null; } \
+        > .loki/state/session-start-sha 2>/dev/null
+
     # Store the branch name for later use (PR creation, cleanup)
     printf '%s\n' "$branch_name" > .loki/state/agent-branch.txt 2>/dev/null
 
@@ -9162,6 +9199,180 @@ setup_agent_branch() {
     echo "$branch_name"
 }
 
+# Snapshot, or fail closed. Any snapshot failure (for example git older than
+# 2.18, whose status lacks --no-renames / --ignored=matching) leaves a marker
+# that makes commit_session_changes commit nothing: a missing snapshot must
+# only ever mean an older session, never "sweep everything".
+_loki_snapshot_or_fail_closed() {
+    if _loki_snapshot_preexisting "$@"; then
+        rm -f .loki/state/preexisting-untracked.failed 2>/dev/null
+        return 0
+    fi
+    mkdir -p .loki/state 2>/dev/null
+    : > .loki/state/preexisting-untracked.failed 2>/dev/null
+    return 1
+}
+
+# _loki_snapshot_preexisting [union]
+# Write .loki/state/preexisting-untracked.z: every path git does not track,
+# untracked and gitignored, repo-wide, NUL-delimited, relative to the repo top.
+# commit_session_changes unstages these and the receipt
+# (autonomy/lib/workspace_diff.py) does not claim them. --ignored=matching lists
+# a directory only when an ignore pattern matches it, so node_modules/ is one
+# "dir/" entry covering its subtree, while logs/ holding only *.log files is
+# listed file by file (a new logs/app.json is still the agent's). "union" keeps
+# the paths already recorded. The sibling .sha.z (content hash per file entry)
+# lets the receipt list a pre-existing file the run changed; it is removed
+# first, so a failed hash step means no detection, never stale hashes. Returns
+# non-zero, leaving any earlier list in place, when git cannot list.
+_loki_snapshot_preexisting() {
+    local snap=".loki/state/preexisting-untracked.z" top="" base="" exclude=""
+    rm -f "${snap%.z}.sha.z" 2>/dev/null
+    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
+    mkdir -p .loki/state 2>/dev/null || return 1
+    # "union" never adds a path listed in session-created.z: those files were
+    # made by a session that did not finish (interrupt, pod loss), so the
+    # session that finishes the work commits them. If the user edits one of
+    # them between sessions it is still the session's file and is committed
+    # with the edit. Recorded entries only block additions; they never remove
+    # a path already in the list.
+    if [ "${1:-}" = union ]; then
+        base="$snap"
+        exclude=".loki/state/session-created.z"
+    fi
+    if ! _loki_untracked_status "$snap.status" \
+       || ! _loki_untracked_merge "$snap.status" "$base" "$exclude" exact "$snap"; then
+        rm -f "$snap.status" "$snap.tmp"
+        return 1
+    fi
+    rm -f "$snap.status"
+    python3 -E "$SCRIPT_DIR/lib/workspace_diff.py" hash-snapshot "$top" "$snap" >/dev/null 2>&1 \
+        || log_warn "Could not hash your pre-existing untracked files; the receipt cannot list the ones this run changes"
+    return 0
+}
+
+# _loki_untracked_status <out>: the one enumeration behind both the snapshot
+# and the session-created record, so the two always agree: raw
+# `git status --porcelain -z` records for the whole repo, .loki excluded.
+# Non-zero, writing nothing, when git cannot list.
+_loki_untracked_status() {
+    local top="" prefix=""
+    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 1
+    prefix="$(git rev-parse --show-prefix 2>/dev/null)" || return 1
+    git -C "$top" --no-optional-locks status --porcelain -z --no-renames -uall \
+        --ignored=matching --ignore-submodules=all -- ":(exclude,literal)${prefix}.loki" \
+        > "$1" 2>/dev/null && return 0
+    rm -f "$1"
+    return 1
+}
+
+# _loki_untracked_merge <status> <base> <exclude> exact|cover <out>
+# Atomically write <out>: the NUL-delimited paths of <base>, plus every
+# untracked ("??") or ignored ("!!") path in <status> that <exclude> does not
+# hold. With "cover", an <exclude> entry ending in "/" also holds every path
+# below it (workspace_diff._covered). An empty or missing <base> or <exclude>
+# is an empty list; any other read or write failure is non-zero and leaves
+# <out> as it was. Sorted bytewise, like `LC_ALL=C sort -z -u`. One python
+# process: bash 3.2 has no associative arrays, and a bash loop cost 300ms per
+# 6,000 entries on /bin/bash. -E and no cwd on sys.path (D7): the cwd is the
+# agent's repo.
+_loki_untracked_merge() {
+    python3 -E -c 'import sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import os
+status, base, exclude, mode, out = sys.argv[1:6]
+def entries(path, missing_ok=True):
+    try:
+        with open(path, "rb") as fh:
+            return [p for p in fh.read().split(b"\0") if p]
+    except FileNotFoundError:
+        if missing_ok:
+            return []
+        raise
+held = set(entries(exclude)) if exclude else set()
+def covered(path):
+    if path in held:
+        return True
+    cut = path.find(b"/") if mode == "cover" else -1
+    while cut != -1:
+        if path[:cut + 1] in held:
+            return True
+        cut = path.find(b"/", cut + 1)
+    return False
+paths = set(entries(base)) if base else set()
+for rec in entries(status, missing_ok=False):
+    # The session-created record ("cover" mode) never holds a directory entry:
+    # a whole-directory entry (logs/, out/) would stop the resume union from
+    # adopting a file the user later creates inside it, and a .gitignore
+    # rewrite would then sweep that file. Adopting such a directory as
+    # pre-existing fails safe (the agent files inside stay uncommitted).
+    if mode == "cover" and rec.endswith(b"/"):
+        continue
+    if rec[:3] in (b"?? ", b"!! ") and not covered(rec[3:]):
+        paths.add(rec[3:])
+with open(out + ".tmp", "wb") as fh:
+    fh.write(b"".join(p + b"\0" for p in sorted(paths)))
+os.replace(out + ".tmp", out)' "$@" 2>/dev/null
+}
+
+# _loki_record_session_created
+# Union into .loki/state/session-created.z (NUL-delimited, repo-top-relative,
+# atomic) the paths git does not track now that the pre-existing snapshot does
+# not cover: the files this session created. The resume union never adds these
+# to the snapshot, so a session that is interrupted (cleanup) or killed (pod
+# loss: no trap runs, hence the call after every provider turn) still has its
+# own files committed by the session that finishes. commit_session_changes
+# clears the record after a normal commit; a new session branch starts empty.
+# Records nothing unless this run took a current snapshot (a leftover or stale
+# one would make it claim a user's file). On a failure the record is left as it
+# was, never partial, and preexisting-untracked.failed is never touched; the
+# next successful call recomputes everything, so only a failure on the final
+# call before a kill loses paths (those are then treated as the user's: kept on
+# disk, not committed).
+_loki_record_session_created() {
+    local snap=".loki/state/preexisting-untracked.z" out=".loki/state/session-created.z"
+    [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" = 1 ] || return 0
+    if [ -f "$snap" ] && _loki_untracked_status "$out.status" \
+       && _loki_untracked_merge "$out.status" "$out" "$snap" cover "$out"; then
+        rm -f "$out.status"
+        return 0
+    fi
+    rm -f "$out.status" "$out.tmp" 2>/dev/null
+    log_warn "Could not record the files this session created; if the run stops before the next record, they are treated as yours and left uncommitted"
+    return 1
+}
+
+# _loki_resume_snapshot: the resume paths' union, naming the files carried over
+# from an unfinished previous session (this session's commit includes them).
+_loki_resume_snapshot() {
+    local carried=""
+    if ! _loki_snapshot_or_fail_closed union; then
+        log_warn "Could not add your current untracked files to the pre-existing list; this session will commit nothing (review and commit manually)"
+        return 0
+    fi
+    _LOKI_SNAPSHOT_THIS_RUN=1
+    carried="$(_loki_nul_names .loki/state/session-created.z)"
+    if [ -n "$carried" ]; then
+        log_info "Carried over as this session's work, not adopted as your files (created by the unfinished previous session): $carried"
+    fi
+}
+
+# _loki_nul_names <file>: the entries of a NUL-delimited repo-top-relative list
+# that exist now, comma-separated, the first 20 then "(and N more)".
+_loki_nul_names() {
+    local p top="" n=0 out=""
+    [ -s "$1" ] || return 0
+    top="$(git rev-parse --show-toplevel 2>/dev/null)" || return 0
+    while IFS= read -r -d '' p; do
+        if [ -e "$top/$p" ] || [ -L "$top/$p" ]; then
+            n=$((n + 1))
+            if [ "$n" -le 20 ]; then out="${out}${out:+, }${p}"; fi
+        fi
+    done < "$1"
+    if [ "$n" -gt 20 ]; then out="${out} (and $((n - 20)) more)"; fi
+    printf '%s' "$out"
+}
+
 # RUN-25 iter 21 (Wave D #2): the two secret matchers now live in one sourceable
 # lib so the commit gate (here) and the completion evidence gate (completion-
 # council.sh) share a single implementation. Sourced with a guard so a re-source
@@ -9175,6 +9386,101 @@ fi
 if ! type _commit_scan_secret_file >/dev/null 2>&1; then _commit_scan_secret_file() { return 1; }; fi
 if ! type _commit_path_looks_secret >/dev/null 2>&1; then _commit_path_looks_secret() { return 1; }; fi
 
+# _loki_covered_paths <paths> <snapshot> <top> <out>
+# Atomically write <out>: the NUL-delimited entries of <paths> that <snapshot>
+# covers (the entry itself or a parent "dir/" entry, as workspace_diff._covered)
+# and that still exist under <top>. Non-zero on a read or write failure. -E and
+# no cwd on sys.path (D7): the cwd is the agent's repo.
+_loki_covered_paths() {
+    python3 -E -c 'import sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import os
+paths, snap, top, out = sys.argv[1:5]
+def entries(path):
+    with open(path, "rb") as fh:
+        return [p for p in fh.read().split(b"\0") if p]
+held = set(entries(snap))
+def covered(path):
+    if path in held:
+        return True
+    cut = path.find(b"/")
+    while cut != -1:
+        if path[:cut + 1] in held:
+            return True
+        cut = path.find(b"/", cut + 1)
+    return False
+# A file gone from disk stays tracked: untracking it would leave its bytes
+# only in history.
+top = os.fsencode(top)
+hits = [p for p in entries(paths) if covered(p) and os.path.lexists(os.path.join(top, p))]
+with open(out + ".tmp", "wb") as fh:
+    fh.write(b"".join(p + b"\0" for p in hits))
+os.replace(out + ".tmp", out)' "$@" 2>/dev/null
+}
+
+# _loki_untrack_agent_committed_user_files <branch> (BACKLOG 74)
+# An agent that rewrites .gitignore and runs `git add -A && git commit` itself
+# puts the user's untracked or ignored files on the session branch, and a
+# checkout of the base then deletes them from disk. Files ADDED on the branch
+# since it forked from the recorded base that the pre-existing snapshot covers
+# are removed from the index (they stay on disk) and that removal is committed
+# on its own, before the session commit: it adds no content, and no later exit
+# (a secret abort, a failed unstage) can put the files back on the branch tip.
+# Records this session's removals in .loki/state/agent-committed-user-files.z
+# and warns that the branch history still holds them. The fork is the merge
+# base with the recorded base branch, else the session's recorded start commit
+# (.loki/state/session-start-sha). Non-zero when the removal could not be
+# committed, or when neither fork resolves or the check fails (the tip may hold
+# user files): the caller then makes no session commit, whose `git add -A`
+# would stage the files again.
+_loki_untrack_agent_committed_user_files() {
+    local snap=".loki/state/preexisting-untracked.z" rec=".loki/state/agent-committed-user-files.z"
+    local base="" fork="" start="" top="" names=""
+    local unchecked="Before switching branches, run git rm --cached on each of your files the agent committed and commit, or a checkout of the base deletes them. Left uncommitted: no session commit."
+    [ -s "$snap" ] || return 0
+    # No commit on the branch yet: the agent committed nothing.
+    git rev-parse --verify -q HEAD >/dev/null 2>&1 || return 0
+    [ -s .loki/state/base-branch.txt ] && base="$(cat .loki/state/base-branch.txt 2>/dev/null)"
+    if [ -n "$base" ]; then fork="$(git merge-base HEAD "$base" 2>/dev/null)" || fork=""; fi
+    if [ -z "$fork" ] && [ -s .loki/state/session-start-sha ]; then
+        start="$(cat .loki/state/session-start-sha 2>/dev/null)"
+        # A commit on this branch, or the empty tree of an unborn mint.
+        if git merge-base --is-ancestor "$start" HEAD 2>/dev/null \
+           || [ "$(git cat-file -t "$start" 2>/dev/null)" = tree ]; then
+            fork="$start"
+        fi
+    fi
+    if [ -z "$fork" ]; then
+        log_warn "Could not check whether the agent committed your pre-existing untracked files on $1: base branch '${base:-unknown}' not found and the recorded session start commit is missing or not on this branch. ${unchecked}"
+        return 1
+    fi
+    # --no-renames: a user file swept in beside a deleted tracked file must
+    # read as added, not as a rename of that file.
+    if ! top="$(git rev-parse --show-toplevel 2>/dev/null)" \
+       || ! git -C "$top" diff --name-only -z --no-renames --diff-filter=A "$fork" HEAD > "$rec.added" 2>/dev/null \
+       || ! _loki_covered_paths "$rec.added" "$snap" "$top" "$rec.new"; then
+        rm -f "$rec.added" "$rec.new" "$rec.new.tmp"
+        log_warn "Could not check whether the agent committed your pre-existing untracked files on $1. ${unchecked}"
+        return 1
+    fi
+    rm -f "$rec.added"
+    if [ ! -s "$rec.new" ]; then
+        rm -f "$rec.new"
+        return 0
+    fi
+    mv -f "$rec.new" "$rec"
+    names="$(_loki_nul_names "$rec")"
+    git reset -q >/dev/null 2>&1 || true
+    if ! git -C "$top" update-index -z --force-remove --stdin < "$rec" >/dev/null 2>&1 \
+       || ! git commit -q -m "Loki Mode: untrack pre-existing user files the agent committed" >/dev/null 2>&1; then
+        log_warn "The agent committed your pre-existing files on $1 and Loki could not remove them from the branch: ${names}. They are on disk. Before switching branches, run git rm --cached on each and commit, or a checkout of the base deletes them. Left uncommitted: no session commit."
+        return 1
+    fi
+    log_warn "The agent committed your pre-existing untracked or ignored files on $1: ${names}. Loki removed them from the branch tip; they stay on disk, untracked. The branch history still holds them: do not push $1 as-is. To drop them from its history: git reset --soft ${fork} && git commit"
+    audit_agent_action "git_untrack_user_files" "Removed pre-existing user files the agent committed" "files=${names}" || true
+    return 0
+}
+
 commit_session_changes() {
     # Squash the session's work into one honest session-end commit on the agent
     # branch (LOCK A3/A4/A8). Commit-always (incl. failed runs) so the user is
@@ -9209,6 +9515,25 @@ commit_session_changes() {
             ;;
     esac
 
+    # Commit nothing unless THIS run took a current snapshot (BACKLOG 90). The
+    # LOCK A1 opt-out takes none, so it never commits, even on a leftover
+    # loki/session-* branch whose agent-branch.txt and snapshot belong to an
+    # earlier session: that stale snapshot would sweep in a file the user made
+    # since, and a checkout of the base would delete it. Checked before any
+    # staging, so the opt-out leaves the user's index alone.
+    if [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" != 1 ]; then
+        if [ "${LOKI_BRANCH_PROTECTION:-true}" != "true" ]; then
+            log_info "Branch protection off (LOKI_BRANCH_PROTECTION=${LOKI_BRANCH_PROTECTION}): no session commit; the work stays uncommitted on ${cur}"
+        elif [ -f "$PWD/.loki/state/preexisting-untracked.failed" ]; then
+            log_warn "Left uncommitted: could not record your pre-existing untracked files at session start (the snapshot needs git 2.18+, excluding them needs 2.25+). Review and commit manually."
+        else
+            log_warn "Left uncommitted: this run recorded no snapshot of your pre-existing untracked files, so it makes no session commit. Review and commit manually."
+        fi
+        return 0
+    fi
+
+    _loki_untrack_agent_committed_user_files "$cur" || return 0
+
     # Stage everything except .loki/ runtime state and a secret-path denylist.
     # These excludes are defense-in-depth ONLY for the top-level cases git
     # pathspec handles cleanly. We deliberately do NOT add nested globs like
@@ -9226,13 +9551,16 @@ commit_session_changes() {
         ':!*.key' ':!*.pem' ':!*.p12' ':!*.keystore' \
         ':!id_rsa*' ':!*.token' ':!credentials*' 2>/dev/null || true
 
-    # Unstage exactly the files that were untracked when the branch was minted
-    # (setup_agent_branch): they are the user's, not this session's work, and
-    # committing them here would delete them from disk on a later checkout of
-    # the base. Agent-created files stay staged. Skip an empty snapshot: an
+    # Unstage exactly the paths recorded as untracked or gitignored when the
+    # session started (setup_agent_branch; a "dir/" entry covers its subtree):
+    # they are the user's, not this session's work, and committing them here
+    # would delete them from disk on a later checkout of the base (an agent
+    # rewrite of .gitignore can expose ignored files to `git add -A`).
+    # Agent-created files stay staged. Skip an empty snapshot: an
     # empty --pathspec-from-file resets the WHOLE index. No snapshot (older
     # session): behave as before. If the unstage fails (git < 2.25), commit
-    # nothing rather than sweep the user's files in.
+    # nothing rather than sweep the user's files in. A failed snapshot never
+    # gets here (the snapshot guard above returns first).
     local preexisting="$PWD/.loki/state/preexisting-untracked.z" top=""
     if [ -s "$preexisting" ]; then
         if ! { top="$(git rev-parse --show-toplevel 2>/dev/null)" \
@@ -9244,8 +9572,12 @@ commit_session_changes() {
         fi
     fi
 
-    # Nothing staged = clean no-op, never an error.
+    # Nothing staged = clean no-op, never an error. A session that ends here or
+    # commits below ended normally: its session-created record is spent (what
+    # it listed is committed, or was never committable), so the next session
+    # starts clean.
     if git diff --cached --quiet 2>/dev/null; then
+        rm -f .loki/state/session-created.z 2>/dev/null
         return 0
     fi
 
@@ -9287,7 +9619,9 @@ commit_session_changes() {
         return 0
     fi
 
-    git commit -m "Loki Mode session changes (${ITERATION_COUNT:-0} iterations, result=${result:-0})" 2>/dev/null || true
+    if git commit -m "Loki Mode session changes (${ITERATION_COUNT:-0} iterations, result=${result:-0})" 2>/dev/null; then
+        rm -f .loki/state/session-created.z 2>/dev/null
+    fi
     audit_agent_action "git_commit" "Committed session changes" "iterations=${ITERATION_COUNT:-0},result=${result:-0}" || true
     return 0
 }
@@ -11884,6 +12218,12 @@ ZT_MATCHES_EOF
 }
 
 enforce_test_coverage() {
+    # Every suite this gate launches (pytest, unittest, the coverage pass, a
+    # package script that runs Python) runs inside the user's repo: no
+    # __pycache__/*.pyc there, so none can land in the session commit when the
+    # repo does not ignore them (BACKLOG 85). Bytecode caching only; the same
+    # tests run. Scoped to this call.
+    local -x PYTHONDONTWRITEBYTECODE=1
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local quality_dir="$loki_dir/quality"
     mkdir -p "$quality_dir" "$loki_dir/signals"
@@ -11913,7 +12253,9 @@ enforce_test_coverage() {
         # that is the legitimate case they were written for (a package that ships
         # a runner but no npm script).
         local _declared_test_script=""
-        _declared_test_script=$(_LOKI_PKG="${TARGET_DIR:-.}/package.json" python3 -c "
+        # BACKLOG 81 (D7): -E plus the sys.path filter, so the agent's repo (the
+        # cwd) cannot supply json or sitecustomize to this reader.
+        _declared_test_script=$(_LOKI_PKG="${TARGET_DIR:-.}/package.json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_LOKI_PKG']) as f:
@@ -12033,7 +12375,8 @@ sys.stdout.write(t.strip())
                     # npm test), so the grep only ever picked the LABEL, never
                     # what ran. This corrects the evidence, not the execution.
                     local _ws_script
-                    _ws_script=$(_LOKI_PKG="$pkg_json" python3 -c "
+                    # BACKLOG 81 (D7): same guard as the root reader above.
+                    _ws_script=$(_LOKI_PKG="$pkg_json" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['_LOKI_PKG']) as f:
@@ -12353,6 +12696,9 @@ TREOF
         # run instead of re-running the suite. Single source of truth for "tests
         # ran this iteration", set on every return path that writes results.
         printf '%s\n' "${ITERATION_COUNT:-0}" > "$quality_dir/.test-results.iter" 2>/dev/null || true
+        # BACKLOG 91: non-blocking, but nothing was measured: the loop's
+        # stage_complete event reads this and says not_run, not pass.
+        _LOKI_TEST_SUITE_STATUS=not_run
         return 0
     fi
 
@@ -12364,6 +12710,49 @@ TREOF
     # first, then delete every remaining control char (\000-\037, incl. ESC).
     details=$(echo "$details" | tr '"' "'" | tr '\n' ' ' | tr -d '\000-\037' | head -c 500)
 
+    # BACKLOG 73: a runner that exits 0 while its own summary reports failures
+    # (`jest || true`, a script that swallows the status) failed. The failure
+    # count comes from the runner's summary lines in the FULL output (the details
+    # tail can drop them: the jest branch keeps 3 lines). The highest count
+    # across summaries wins, so output that concatenates several runs (npm test
+    # --workspaces, `jest; vitest`) cannot hide a failed run behind a later
+    # green one. Shapes: jest "Tests: 1 failed, ...", vitest "Tests  1 failed |
+    # ...", pytest "=== 1 failed, 2 passed in 0.1s ===" (or its -q line), node
+    # TAP "# fail 1" and the spec reporter's "<info sign> fail 1", counted only
+    # right after the matching pass line (node TAP echoes a test's own stdout
+    # as "# ..." lines, which must not count), mocha "1 failing", go "--- FAIL:"
+    # lines. A read summary with no failures is a measured 0. With no recognised
+    # summary the old best-effort parse of the tail still applies (null when it
+    # finds nothing). Either way a recorded count above zero is a failure: the
+    # council evidence gate and the Bun gate both read failed_count > 0 as one.
+    # LC_ALL=C: bytes, so any runner output parses; [ \t] not [[:space:]] for
+    # old mawk.
+    local _tr_passed_n _tr_failed_n _tr_summary_red=false
+    _tr_failed_n=$(printf '%s\n' "${output:-}" | LC_ALL=C sed "s/$(printf '\033')\[[0-9;]*[A-Za-z]//g" | LC_ALL=C awk '
+        function upd(n) { if (n > f) f = n; seen = 1 }
+        /^Tests:[ \t]/ || /^[ \t]*Tests[ \t]+[0-9]/ ||
+        /^=+ .*[0-9]+ (passed|failed)/ || /^[0-9]+ (passed|failed).* in [0-9.]+s/ {
+            n = 0; if (match($0, /[0-9]+ failed/)) n = substr($0, RSTART, RLENGTH) + 0; upd(n) }
+        /^[^ A-Za-z0-9]+ fail [0-9]+[ \t]*$/ { if (prev ~ /^[^ A-Za-z0-9]+ pass [0-9]+[ \t]*$/) upd($3 + 0) }
+        /^[ \t]*[0-9]+ passing \(/ { upd(0) }
+        /^[ \t]*[0-9]+ failing[ \t]*$/ { upd($1 + 0) }
+        /^--- FAIL: / { go++ }
+        { prev = $0 }
+        END { if (go > f) { f = go; seen = 1 } if (seen) print f + 0 }')
+    _tr_passed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ passed' | grep -oE '[0-9]+' | head -1)
+    [ -n "$_tr_failed_n" ] || _tr_failed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ failed' | grep -oE '[0-9]+' | head -1)
+    # node --test emits TAP-ish "# pass N" / "# fail N" summary lines, which the
+    # "N passed"/"N failed" pattern above does not match. Fall back to those.
+    [ -n "$_tr_passed_n" ] || _tr_passed_n=$(printf '%s' "$details" | grep -oE '# pass [0-9]+' | grep -oE '[0-9]+' | head -1)
+    [ -n "$_tr_failed_n" ] || _tr_failed_n=$(printf '%s' "$details" | grep -oE '# fail [0-9]+' | grep -oE '[0-9]+' | head -1)
+    [ -n "$_tr_passed_n" ] || _tr_passed_n=null
+    [ -n "$_tr_failed_n" ] || _tr_failed_n=null
+    if [ "$test_passed" = "true" ] && [ "$_tr_failed_n" != "null" ] && [ "$_tr_failed_n" -gt 0 ] 2>/dev/null; then
+        test_passed=false
+        _tr_summary_red=true
+        log_warn "Test suite gate: $test_runner exited 0 but its summary reports $_tr_failed_n failed -- recording a failure"
+    fi
+
     # Evidence Receipt provenance (v7.85.0): record the deterministic FACTS a
     # non-forgeable receipt needs -- the command that ran, its exit code, and a
     # status enum -- alongside the legacy pass/runner/min_coverage keys the
@@ -12381,6 +12770,8 @@ TREOF
         *)           _tr_cmd="$test_runner" ;;
     esac
     if [ "$test_passed" = "true" ]; then _tr_exit=0; _tr_status="verified"; else _tr_exit=1; _tr_status="failed"; fi
+    # BACKLOG 73: the runner itself exited 0; record that fact, not a made-up 1.
+    if [ "$_tr_summary_red" = "true" ]; then _tr_exit=0; fi
 
     # #82 (zero-test-file hardening): a runner that EXITED 0 but executed ZERO
     # real tests is a mini fake-green -- it records "verified" while proving
@@ -12402,17 +12793,6 @@ TREOF
         log_warn "Verification gap: $test_runner exited 0 but ran ZERO tests -- recording inconclusive (no_tests_run), not verified"
     fi
 
-    # Best-effort pass/fail counts from the summary text (null when not found).
-    local _tr_passed_n _tr_failed_n
-    _tr_passed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ passed' | grep -oE '[0-9]+' | head -1)
-    _tr_failed_n=$(printf '%s' "$details" | grep -oE '[0-9]+ failed' | grep -oE '[0-9]+' | head -1)
-    # node --test emits TAP-ish "# pass N" / "# fail N" summary lines, which the
-    # "N passed"/"N failed" pattern above does not match. Fall back to those.
-    [ -n "$_tr_passed_n" ] || _tr_passed_n=$(printf '%s' "$details" | grep -oE '# pass [0-9]+' | grep -oE '[0-9]+' | head -1)
-    [ -n "$_tr_failed_n" ] || _tr_failed_n=$(printf '%s' "$details" | grep -oE '# fail [0-9]+' | grep -oE '[0-9]+' | head -1)
-    [ -n "$_tr_passed_n" ] || _tr_passed_n=null
-    [ -n "$_tr_failed_n" ] || _tr_failed_n=null
-
     # verification_gap is "none" whenever a real runner executed AND ran tests:
     # the suite ran, so there is no docs-without-execution / source-without-tests
     # gap. The #82 zero-test case is the exception -- a runner ran but executed
@@ -12573,9 +12953,21 @@ os.replace(tmp, out)
     fi
 
     if [ "$test_passed" = "true" ]; then
-        touch "$quality_dir/unit-tests.pass"
         rm -f "$loki_dir/signals/TESTS_FAILED" 2>/dev/null || true
-        log_info "Test suite gate: $test_runner passed"
+        # BACKLOG 55: the #82 zero-test run exited 0 but proved nothing. It is
+        # inconclusive, so it must not leave the pass marker the receipt reads
+        # as "unit_tests passed" (proof-generator.py _collect_quality_gates).
+        # Still non-blocking (return 0 below) and still not a failure (no
+        # TESTS_FAILED), so the council decides it, per the #82 design.
+        if [ "$_tr_zero_tests" = "true" ]; then
+            rm -f "$quality_dir/unit-tests.pass" 2>/dev/null || true
+            log_warn "Test suite gate: $test_runner ran zero tests -- inconclusive (not passed, not failed)"
+            _LOKI_TEST_SUITE_STATUS=not_run  # BACKLOG 91, see the no-runner return
+        else
+            touch "$quality_dir/unit-tests.pass"
+            log_info "Test suite gate: $test_runner passed"
+            _LOKI_TEST_SUITE_STATUS=pass
+        fi
         # Coverage block is distinct from tests-red: tests passed, but enforced
         # coverage is below threshold. Return nonzero to gate WITHOUT writing the
         # TESTS_FAILED signal or removing unit-tests.pass.
@@ -19583,7 +19975,11 @@ load_state() {
         if command -v python3 &> /dev/null; then
             # BUG-ST-006: Validate checkpoint integrity before loading state
             local state_valid
-            state_valid=$(LOKI_STATE_FILE="$state_file" python3 -c "
+            # -E and the sys.path filter (D7): the cwd is the target repo, and a
+            # committed json.py must not decide the loaded iteration count
+            # (a fake non-zero count would skip the iteration-0 evidence drop).
+            state_valid=$(LOKI_STATE_FILE="$state_file" python3 -E -c "
+import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import json, os, sys
 try:
     with open(os.environ['LOKI_STATE_FILE']) as f:
@@ -19609,15 +20005,20 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
                 ITERATION_COUNT=0
                 # Back up corrupted state file for diagnosis
                 mv "$state_file" "${state_file}.corrupt.$(date +%s)" 2>/dev/null || true
+                # Starts at iteration 0: drop the previous session's test
+                # evidence, as the iteration-0 block at the end does.
+                rm -f "${TARGET_DIR:-.}/.loki/quality/.test-results.iter" \
+                      "${TARGET_DIR:-.}/.loki/quality/unit-tests.pass" \
+                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" 2>/dev/null || true
                 return
             fi
 
             # Load retry count, iteration count, and status from previous session
             local prev_status
-            prev_status=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('status', 'unknown'))" 2>/dev/null || echo "unknown")
-            RETRY_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('retryCount', 0))" 2>/dev/null || echo "0")
+            prev_status=$(LOKI_STATE_FILE="$state_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('status', 'unknown'))" 2>/dev/null || echo "unknown")
+            RETRY_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('retryCount', 0))" 2>/dev/null || echo "0")
             # BUG-RUN-003: Restore ITERATION_COUNT from persisted state
-            ITERATION_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -c "import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('iterationCount', 0))" 2>/dev/null || echo "0")
+            ITERATION_COUNT=$(LOKI_STATE_FILE="$state_file" python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]; import json, os; print(json.load(open(os.environ['LOKI_STATE_FILE'])).get('iterationCount', 0))" 2>/dev/null || echo "0")
 
             # Reset retry count + iteration count if previous session ended in a
             # terminal state. A fresh `loki start` after a terminal run is a NEW
@@ -19678,6 +20079,18 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
     else
         RETRY_COUNT=0
     fi
+    # A session that starts at iteration 0 has run nothing yet, so a leftover
+    # freshness marker or unit-tests.pass is a previous session's evidence.
+    # Iterations restart at 0, so keeping them would let an old pass:true read
+    # as this iteration's result.
+    if [ "${ITERATION_COUNT:-0}" = "0" ]; then
+        # Same path the writer (enforce_test_coverage) and the freshness
+        # readers use.
+        local _q="${TARGET_DIR:-.}/.loki/quality"
+        # test-results.json too: with the marker gone the receipt's quality
+        # gates fall back to its status, reporting a previous session's run.
+        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" 2>/dev/null || true
+    fi
 }
 
 # Load tasks from queue files for prompt injection
@@ -23908,6 +24321,12 @@ if __name__ == "__main__":
         # v7.5.12: Provider invocation finished (or was killed by trap).
         LOKI_PROVIDER_ACTIVE=0
 
+        # Record the files this session has created so far. A pod loss is a
+        # SIGKILL (no trap runs), so this per-turn record is what lets the
+        # resumed session commit them. One git status; no-op without a
+        # session snapshot.
+        _loki_record_session_created || true
+
         echo ""
         echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
         echo ""
@@ -24345,8 +24764,12 @@ EOF
                 local _stg_t0=$(date +%s 2>/dev/null); local _stg_ok=pass
                 # F49: isolate HOME so the project's suite cannot pollute the
                 # user's real home when it execs the generated app.
+                _LOKI_TEST_SUITE_STATUS=""
                 if _loki_with_app_sandbox enforce_test_coverage; then
                     clear_gate_failure "test_coverage"
+                    # BACKLOG 91: a zero-test or no-runner run returns 0 without
+                    # measuring anything; its stage status is not_run, not pass.
+                    if [ "$_LOKI_TEST_SUITE_STATUS" = "not_run" ]; then _stg_ok=not_run; fi
                 else
                     _stg_ok=fail
                     local tc_count
@@ -25446,11 +25869,33 @@ kill_provider_child() {
         fi
         kill -TERM "$child_pid" 2>/dev/null && killed=1
     done
-    # Also kill provider leaf processes by name in case they were reparented.
-    local proc
-    for proc in claude codex aider cline; do
-        pkill -TERM -f "^${proc}( |$)" 2>/dev/null && killed=1
-    done
+    # Also kill provider leaf processes in case they were reparented (to init,
+    # once their immediate parent -- a shell or the provider CLI itself --
+    # exited). A reparented process changes PARENT, not PROCESS GROUP: unless
+    # a process explicitly calls setpgid/setsid, it keeps the pgid it was
+    # launched into, which for every invoke_* call above is this shell's own
+    # pgid ($$). Scope the sweep to that pgid, matched by process name, rather
+    # than a bare `pkill -f "^claude( |$)"` -- that matched the FULL COMMAND
+    # LINE of every "claude", "codex", "aider" or "cline" process on the whole
+    # machine, with no scoping at all, and killed unrelated Claude Code
+    # sessions in other terminals the moment ANY loki-mode run finished,
+    # double-Ctrl-C'd, or Ctrl-C'd in perpetual mode (build prompt D14 and
+    # `feedback-pkill-f-substring-killed-the-session`). Reproduced: a decoy
+    # `claude` process in a DIFFERENT process group survived; one launched
+    # inside this shell's job (matching how a real reparented leaf would sit)
+    # was still caught.
+    local proc my_pgid
+    my_pgid="$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ')"
+    if [ -n "$my_pgid" ]; then
+        for proc in claude codex aider cline; do
+            local leaf_pid leaf_pgid
+            for leaf_pid in $(pgrep -f "^${proc}( |$)" 2>/dev/null); do
+                leaf_pgid="$(ps -o pgid= -p "$leaf_pid" 2>/dev/null | tr -d ' ')"
+                [ -n "$leaf_pgid" ] && [ "$leaf_pgid" = "$my_pgid" ] || continue
+                kill -TERM "$leaf_pid" 2>/dev/null && killed=1
+            done
+        done
+    fi
 
     # Brief wait for graceful exit (max ~2s).
     local i=0
@@ -26208,6 +26653,10 @@ cleanup() {
         fi
         # v7.5.12: Kill any running provider pipeline first, before slow cleanup.
         kill_provider_child 2>/dev/null || true
+        # This exit makes no session commit: record the files this session
+        # created (after the provider is gone, so none are added later), so a
+        # resume commits them instead of adopting them as the user's.
+        _loki_record_session_created || true
         rm -f "$loki_dir/STOP" "$loki_dir/PAUSE" "$loki_dir/PAUSED.md" 2>/dev/null
         # UT2-13: Clear cli-provider marker on session end.
         rm -f "$loki_dir/state/cli-provider" 2>/dev/null || true
@@ -26282,6 +26731,8 @@ except (json.JSONDecodeError, OSError): pass
         log_warn "Loki Mode interrupted -- shutting down (double Ctrl+C)"
         # v7.5.12: Kill provider pipeline immediately so we don't wait on it.
         kill_provider_child 2>/dev/null || true
+        # No session commit on this exit either (see the branch above).
+        _loki_record_session_created || true
         # Write STOP signal so any peer processes (dashboard, etc.) also stop.
         mkdir -p "$loki_dir" 2>/dev/null && touch "$loki_dir/STOP" 2>/dev/null || true
         if type app_runner_cleanup &>/dev/null; then