@miller-tech/uap 1.179.0 → 1.179.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.179.0",
+  "version": "1.179.3",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate",
+    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",
@@ -31,7 +31,7 @@
     "install:web": "bash scripts/setup/install-web.sh",
     "install:desktop": "bash scripts/setup/install-desktop.sh",
     "install:cloakbrowser": "tsx scripts/setup/install-cloakbrowser.ts",
-    "postinstall": "echo '\n\u2728 Run: npx @miller-tech/uap init --interactive'",
+    "postinstall": "echo '\n✨ Run: npx @miller-tech/uap init --interactive'",
     "version:patch": "bash scripts/version-bump.sh patch",
     "version:minor": "bash scripts/version-bump.sh minor",
     "version:major": "bash scripts/version-bump.sh major",

package/src/policies/enforcers/delivery_enforcement.py

@@ -211,6 +211,31 @@ def _local_mode() -> str:
 
 BASH_OPS = {"Bash", "bash", "run_bash", "shell"}
 
+# The delivery gate's own state. The pending log is the replay queue for
+# `uap deliver --pending`; the lock and heartbeat are how an in-flight run is
+# found, followed, and reclaimed when wedged.
+#
+# Guarding only `rm <literal path>` would repeat the mistake this whole change
+# exists to fix. `: > .uap/pending-deliver.jsonl` is SHORTER than the command it
+# blocks and just as destructive, and `rm -rf .uap` takes all three at once. So
+# match any destructive verb (or a truncating redirect) against any path under
+# `.uap/` that names deliver state — including the directory itself and globs.
+_DELIVER_STATE_PATH = (
+    r"(?:pending-deliver\.jsonl|deliver\.lock|deliver\.heartbeat"
+    r"|pending-[^\s'\"|;&]*|deliver\.[^\s'\"|;&]*|\*[^\s'\"|;&]*)"
+)
+_DELIVER_STATE_RM_RE = re.compile(
+    r"(?:\b(?:rm|unlink|shred|truncate|mv)\b"
+    r"|\bfind\b[^|;&\n]*-(?:delete|exec\s+rm)"
+    r"|\bgit\s+clean\b"
+    r"|(?<![0-9<>])>(?!>))"
+    r"[^|;&\n]*?"
+    # The inner path is optional INSIDE the slash group so a bare `.uap/`
+    # (trailing slash, nothing after) still matches — `rm -rf .uap/` destroys
+    # exactly as much as `rm -rf .uap`.
+    r"((?:[^\s'\"|;&]*/)?\.uap(?:/(?:" + _DELIVER_STATE_PATH + r")?)?)(?:\s|$|['\"])"
+)
+
 # A bash command that WRITES a source file: `> f.ts`, `>> f.ts`, `tee f.ts`,
 # `sed -i ... f.ts`. Without this, Edit/Write gating is trivially bypassable —
 # `cat > app.js <<EOF` writes source with no deliver run and no validation.
@@ -375,6 +400,44 @@ def _handle_bash(args: dict) -> None:
     if os.environ.get("UAP_DELIVER_BYPASS") == "1":
         emit(True, "bash: UAP_DELIVER_BYPASS override set")
         return
+    # Destroying the gate's own state is not a way out of the gate. Observed
+    # live 7x on 2026-07-31 (octopus_invaders_v3), interleaved with kill -9 of
+    # the running deliver: the queued edit intents were discarded to escape a
+    # block rather than completing the work.
+    #
+    # deliver's own housekeeping is unaffected twice over: it rewrites the
+    # pending log in-process (delivery/pending-intents.ts) rather than shelling
+    # out, and its subprocesses carry UAP_DELIVER_ACTIVE=1, which returned
+    # above. UAP_DELIVER_BYPASS=1 also returned above — operator-set only, since
+    # enforcement_self_protect refuses the inline form.
+    #
+    # This block is deliberately NOT relaxed by UAP_ENFORCE_DELIVERY=advisory:
+    # advisory trades verification for speed on an EDIT, but destroying recorded
+    # state is not an edit and has no verified-later equivalent.
+    sm = _DELIVER_STATE_RM_RE.search(cmd)
+    if sm:
+        target = sm.group(1)
+        if "pending-" in target:
+            what = (
+                "that is the queue of edit intents deliver replays; removing it "
+                "discards recorded work rather than completing it. To apply what "
+                "is already queued, run `uap deliver --pending`"
+            )
+        else:
+            what = (
+                "that is the single-flight lock/heartbeat; deleting it starts a "
+                "SECOND concurrent run on the same tree. A stale lock is "
+                "reclaimed automatically by heartbeat age, so it never needs "
+                "deleting"
+            )
+        emit(
+            False,
+            f"BLOCKED: do not destroy the delivery gate's own state ('{target}') — "
+            f"{what}. If a deliver run is in flight, wait for it (deliver tool "
+            "with follow:true, or `uap deliver --await-run`).",
+        )
+        return
+
     m = _BASH_WRITE_RE.search(cmd)
     if m:
         target = m.group(1)

package/src/policies/enforcers/enforcement_infra_protect.py

@@ -26,13 +26,34 @@ Scope (Bash/bash/run_bash commands only):
   - broad `-f`/`--full` kill whose pattern is a substring of the stack's argv
     (uap/llama/qwen/mmproj/nomic/anthropic) or a glob over the python
     interpreter that runs the proxy.
+  - a kill held APART from its target — by a pipe (`ps aux | grep llama-server
+    | xargs kill -9`), by an infra-port lookup feeding it (`lsof -t -i:4000 |
+    xargs kill -9`), by a variable (`X=$(pgrep -f llama-server); kill -9 $X`),
+    or by a `-f` pattern that is an infra port (`pkill -f 8080`) — rule 8.
+    Matching is on TEXT, so a token counts wherever it appears; quoted data and
+    heredoc bodies are stripped first so prose about a kill is not a kill.
+  - a kill whose bare PID resolves to a deliver run or the inference stack
+    (`kill -9 3936358`, `kill -9 -3936358`) — rule 9. Resolved from
+    .uap/deliver.lock and /proc argv, not from the command text, and only for
+    the numbers the command actually names.
   - systemctl stop/restart/kill/disable of the inference services.
   - Starting a server that BINDS an infra port (http.server 8080 etc.) —
     this is how the port got stolen even with kills blocked (the model
     bound the port inside llama-server's crash/restart window).
 
 Killing a SPECIFIC process pattern (e.g. `pkill -f "python3 -m http.server
-8765"`) and serving on non-infra ports stay allowed.
+8765"`) and serving on non-infra ports stay allowed — unless the pattern itself
+carries a stack token, so `pkill -f 'uap deliver'` is refused; wait for the run
+instead.
+
+KNOWN LIMITS, so nobody reads this as airtight. It is a TEXT gate on a language
+with unbounded ways to say the same thing:
+  - obfuscated patterns (`grep '[l]lama-server'`, `pkill -f 'llam[a]-server'`)
+    match the real process but not these rules;
+  - anything routed through `eval`/base64 defeats every text rule by design;
+  - the script-body scan is depth-1 and shell-only (`.sh/.bash/.zsh`).
+Rule 9 is the part that cannot be spelled around, because it resolves PIDs
+rather than reading them. Treat 1-8 as raising the cost, not as a boundary.
 """
 import os
 import re
@@ -40,7 +61,7 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from _common import emit, parse_cli  # noqa: E402
+from _common import emit, parse_cli, repo_root, scannable_command  # noqa: E402
 
 BASH_OPS = {"Bash", "bash", "run_bash", "shell", "execute_command"}
 
@@ -90,6 +111,233 @@ RULES = (
     ),
 )
 
+# --------------------------------------------------------------------------
+# 8) LAUNDERED kills — the verb and its target pulled apart.
+#
+# Rules 1-7 each scan a single shell SEGMENT (`[^|;&\n]*`), so moving the PID
+# list one hop away splits the kill verb from the thing being killed and the
+# whole rule set goes blind. Every one of these reached the stack:
+#     ps aux | grep llama-server | awk '{print $2}' | xargs kill -9   (pipe)
+#     lsof -t -i:4000 | xargs kill -9                                 (pipe)
+#     PIDS=$(pgrep -f llama-server); kill -9 $PIDS                    (variable)
+#     for p in $(pgrep -f llama-server); do kill -9 $p; done          (loop)
+#
+# Observed live (2026-07-31, octopus_invaders_v3, qwen on opencode): the model's
+# `pkill -f "uap deliver"` was refused at 11:13:46Z and EIGHT SECONDS LATER it
+# ran the xargs form and reported "cleaned"; it repeated that at 11:41:53Z. The
+# evasion is found without being sought, so closing only the observed spelling
+# is not closing anything — the `;` twin is the same thought one keystroke away.
+#
+# Three passes, all on ONE logical command:
+#   a) statement-local: a kill verb plus a stack token / infra-port lookup.
+#   b) cross-statement taint: a LOOKUP that names the stack (pgrep/ps/lsof/...)
+#      anywhere, plus a kill verb anywhere. This is what catches the `;` and
+#      loop forms, where neither half is damning alone.
+#   c) a `-f` kill whose pattern IS an infra port (`pkill -f 8080`), which names
+#      no token yet matches llama-server's argv.
+# Statements split on `;`, `&&`, `||`, newline — never on `|`, since a pipeline
+# is one command.
+#
+# Quoted DATA is stripped first via scannable_command(), which removes heredoc
+# bodies and multi-word quoted blobs but keeps single-word quoted arguments, and
+# strips nothing when the command hands text to a shell (`bash <<EOF`, `sh -c`,
+# `eval`, `xargs`). That kills the false-positive class — a commit message or an
+# `echo` describing a kill — WITHOUT opening a heredoc as an evasion. Rules 1-7
+# still read the raw text, so `pkill -f "uap deliver"` stays caught by rule 6.
+_STATEMENT_SPLIT_RE = re.compile(r";|&&|\|\||\n")
+# A kill in COMMAND POSITION, not the word "kill" inside prose or a grep pattern.
+# The `xargs` branch is what keeps the pipe form matching.
+_KILL_VERB_RE = re.compile(
+    r"(?:^|[|;&(`]|\|\||&&|\bxargs\b[^|;&\n]*|\bsudo\b\s+|\bexec\b\s+"
+    r"|\bthen\b\s+|\bdo\b\s+|\$\()"
+    r"\s*(?:\w+=\S*\s+)*(?:[\w./~-]*/)?(?:p?kill(?:all)?[0-9]*|skill)\b"
+)
+_LOOKUP_VERB_RE = re.compile(r"\b(?:pgrep|pidof|ps|lsof|fuser|ss|netstat)\b")
+_INFRA_TOKEN_RE = re.compile(
+    r"\b(uap|llama|llama-server|anthropic|anthropic_proxy|nomic|mmproj"
+    r"|qwen[0-9.]*|llama-slots|slots?[_-]?save|deliver)\b",
+    re.IGNORECASE,
+)
+_PORT_LOOKUP_RE = re.compile(
+    r"\b(lsof|fuser|ss|netstat)\b[^\n]*?[:\s=]" + INFRA_PORTS + r"\b"
+)
+# `pkill -f 8080` — the pattern is the port itself; no token, still fatal.
+_KILL_PATTERN_PORT_RE = re.compile(
+    r"\b(?:p?kill(?:all)?|skill)\b[^|;&\n]*"
+    r"(?:\s-(?:-full|[A-Za-z0-9]*f)\b)[^|;&\n]*\b" + INFRA_PORTS + r"\b"
+)
+# Simple `VAR=value` / `VAR="value"` bindings, substituted before splitting so
+# `X=llama-server; pkill -f "$X"` collapses to the form rule 6 already refuses.
+# Heuristic by design: no scoping, no command-substitution values. It can only
+# ADD matches, never remove one, so it cannot introduce a miss.
+_ASSIGN_RE = re.compile(
+    r"\b([A-Za-z_]\w*)=(?:\"([^\"]*)\"|'([^']*)'|([^\s;&|]+))"
+)
+
+
+def _expand_assignments(cmd: str) -> str:
+    bindings = {
+        m.group(1): (m.group(2) or m.group(3) or m.group(4) or "")
+        for m in _ASSIGN_RE.finditer(cmd)
+    }
+    for name, value in bindings.items():
+        if value:
+            cmd = re.sub(r"\$\{?" + re.escape(name) + r"\}?", value, cmd)
+    return cmd
+
+
+def _laundered_infra_kill(cmd: str) -> bool:
+    """True when a command kills the stack with the verb held apart from it.
+
+    The two halves are read from DIFFERENT views of the same command, because
+    they fail in opposite directions:
+
+      * the kill VERB is read from scannable_command() — quoted data removed —
+        so `-m "…laundered kill of llama-server"` is not mistaken for a kill;
+      * the stack TOKEN is read from the RAW text, because the token routinely
+        lives inside the quotes that identify the victim
+        (`pgrep -f "uap deliver" | while read p; do kill -9 $p; done`). Reading
+        tokens from the blanked view lost exactly that form.
+
+    Statement counts are compared before pairing the two views; if blanking
+    changed the shape (a heredoc removed lines), fall back to the raw text for
+    both, which is the conservative direction.
+    """
+    raw = _expand_assignments(cmd)
+    scannable = _expand_assignments(scannable_command(cmd))
+    raw_stmts = _STATEMENT_SPLIT_RE.split(raw)
+    kill_stmts = _STATEMENT_SPLIT_RE.split(scannable)
+    if len(kill_stmts) != len(raw_stmts):
+        kill_stmts = raw_stmts
+
+    kills = [bool(_KILL_VERB_RE.search(s)) for s in kill_stmts]
+    for is_kill, stmt in zip(kills, raw_stmts):
+        if is_kill and (_INFRA_TOKEN_RE.search(stmt) or _PORT_LOOKUP_RE.search(stmt)):
+            return True
+    if _KILL_PATTERN_PORT_RE.search(raw):
+        return True
+    # Cross-statement: a lookup that NAMES the stack, and a kill anywhere.
+    if any(kills) and any(
+        _LOOKUP_VERB_RE.search(s)
+        and (_INFRA_TOKEN_RE.search(s) or _PORT_LOOKUP_RE.search(s))
+        for s in raw_stmts
+    ):
+        return True
+    return False
+
+
+# --------------------------------------------------------------------------
+# 9) Kill by BARE PID.
+#
+# `kill -9 3936358` names nothing, so no text rule can see what it hits. The
+# model killed its own in-flight deliver this way six times in one hour on
+# 2026-07-31, discarding each run's completed work — the direct cause of ~50
+# minutes spent in a ps/sleep/kill loop making no progress.
+#
+# Resolution is SEMANTIC, not textual, so it cannot be spelled around: the
+# numbers the command names are looked up in /proc and compared against the
+# deliver lock and the stack's argv. Only the PIDs the command actually names
+# are resolved (never a full /proc walk), which is both cheaper and narrower.
+#
+# A dead PID is never protected, and a lock PID must ALSO still look like a
+# deliver run: a crashed run leaves a stale lock, and without the identity check
+# whatever process later recycles that number becomes unkillable while the
+# refusal says "wait for the deliver run" — recreating the exact stall this rule
+# exists to prevent. delivery_enforcement._deliver_lock_holder() has taken the
+# same precaution since the PID-reuse incident; this must not diverge from it.
+_PID_TOKEN_RE = re.compile(r"(?<![\w.])(-?\d{1,10})(?![\w.-])")
+_STACK_ARGV_RE = re.compile(
+    r"(llama-server|anthropic_proxy|nomic-embed"
+    r"|\buap\s+deliver\b|(?:cli\.js|uap)\s+(?:\S+\s+)*deliver\b)",
+    re.IGNORECASE,
+)
+# A pathological command full of integers must not become a syscall storm.
+_MAX_PID_CANDIDATES = 32
+
+
+def _lock_holder_pids() -> dict[str, str]:
+    """PIDs claimed by a deliver lock, from the main root AND any worktree.
+
+    deliver writes its lock under the root it was LAUNCHED from, which under
+    this repo's mandated worktree workflow is often `.worktrees/NNN-*/`, while
+    the gate resolves repo_root() to the main checkout. Reading only the main
+    root would leave rule 9's headline case unprotected in the normal workflow.
+    """
+    holders: dict[str, str] = {}
+    roots = [repo_root()]
+    try:
+        roots.extend(sorted((repo_root() / ".worktrees").glob("*")))
+    except Exception:  # noqa: BLE001 - no worktrees dir: main root only
+        pass
+    for root in roots:
+        try:
+            text = (root / ".uap" / "deliver.lock").read_text(errors="replace")
+        except OSError:
+            continue
+        m = re.match(r"\s*(\d+)", text)
+        if m:
+            holders[str(int(m.group(1)))] = "the deliver run in progress"
+    return holders
+
+
+def _identify_pid(pid: str, holders: dict[str, str]) -> str | None:
+    """What `pid` actually IS right now, or None if it is nothing to protect."""
+    try:
+        argv = (
+            Path(f"/proc/{pid}/cmdline")
+            .read_bytes()
+            .replace(b"\0", b" ")
+            .decode(errors="replace")
+        )
+    except OSError:
+        return None  # dead: a stale lock protects nothing
+    m = _STACK_ARGV_RE.search(argv)
+    if pid in holders:
+        # Confirm identity too — a recycled PID must not inherit the claim.
+        return holders[pid] if m else None
+    return m.group(1).lower() if m else None
+
+
+def _protected_pid_hit(text: str) -> tuple[str, str] | None:
+    if not (_KILL_VERB_RE.search(text) and _PID_TOKEN_RE.search(text)):
+        return None
+    holders = _lock_holder_pids()
+    seen: set[str] = set()
+    for m in _PID_TOKEN_RE.finditer(text):
+        # `kill -9 -3936358` kills the process GROUP — strictly more
+        # destructive, and invisible if the sign is treated as part of the token.
+        pid = str(abs(int(m.group(1))))
+        if pid in seen:
+            continue
+        seen.add(pid)
+        if len(seen) > _MAX_PID_CANDIDATES:
+            break
+        what = _identify_pid(pid, holders)
+        if what:
+            return pid, what
+    return None
+
+
+DELIVER_PID_REASON = (
+    "infra-protect: this command kills the deliver run in progress (pid {pid}). "
+    "A deliver run that is still working is NOT stuck — killing it discards the "
+    "work it has already done and starts the cycle over. Wait for it instead: "
+    "call the deliver tool with follow:true, which answers within about a "
+    "minute; a 'STILL RUNNING' answer is normal and means keep polling, not "
+    "fail. From a shell, `uap deliver --await-run` blocks until the run ends. "
+    "Operator override: set UAP_INFRA_PROTECT_OFF=1 in the launch environment "
+    "(not inline on the command)."
+)
+
+STACK_PID_REASON = (
+    "infra-protect: this command kills {what} (pid {pid}) — the inference stack "
+    "answering this session's own requests (llama-server :8080 / UAP proxy "
+    ":4000 / embeddings :8081). Killing it ends your own session; it is not a "
+    "way to fix a slow response. If the stack genuinely needs restarting, ask "
+    "the operator. Operator override: set UAP_INFRA_PROTECT_OFF=1 in the launch "
+    "environment (not inline on the command)."
+)
+
 REASON = (
     "infra-protect: this command would kill or displace the inference stack this "
     "session runs on (llama-server :8080 / UAP proxy :4000 / embeddings :8081). "
@@ -175,11 +423,24 @@ def main() -> None:
     for rule in RULES:
         if rule.search(cmd):
             emit(False, REASON)
-    # Same rules, applied to the body of any script the command would run.
-    for path, body in _referenced_script_bodies(cmd):
-        for rule in RULES:
-            if rule.search(body):
-                emit(False, f"{REASON} (matched inside the invoked script {path})")
+    # Rules 8 and 9 apply to the command AND to any script it would run — the
+    # script-body pass exists because moving a stack-restart one level down into
+    # a file slipped past every text rule once already, and a rule that skips
+    # that pass reopens exactly that hole.
+    for label, text in [("", cmd), *((f" (matched inside the invoked script {p})", b)
+                                     for p, b in _referenced_script_bodies(cmd))]:
+        if text is not cmd:
+            for rule in RULES:
+                if rule.search(text):
+                    emit(False, f"{REASON}{label}")
+        if _laundered_infra_kill(text):
+            emit(False, f"{REASON}{label}")
+        hit = _protected_pid_hit(text)
+        if hit:
+            pid, what = hit
+            if what == "the deliver run in progress":
+                emit(False, DELIVER_PID_REASON.format(pid=pid) + label)
+            emit(False, STACK_PID_REASON.format(what=what, pid=pid) + label)
     emit(True, "no infra-destructive pattern")
 
 

package/src/policies/enforcers/validate_plan_on_change.py

@@ -119,6 +119,49 @@ def _is_plan_file(target: str) -> bool:
     return bool(PLAN_STEM_RE.search(name[:-3]))
 
 
+def _inside_project(target: str) -> bool:
+    """True when `target` resolves to the project root or below it.
+
+    `uap plan validate` refuses any file outside the project directory, so
+    recording one creates a pending entry NOTHING can clear: every build in the
+    repo blocks, and the remedy the refusal names declines the file. Observed
+    live with a memory note under ~/.claude/, matched only because its filename
+    contained "plan".
+
+    Fails CLOSED on error (treat as inside, i.e. record it). Failing open here
+    would let a transient getcwd() error silently un-gate a plan write.
+    """
+    try:
+        root = os.path.realpath(os.getcwd())
+        abs_target = os.path.realpath(os.path.join(root, target))
+        return abs_target == root or abs_target.startswith(root + os.sep)
+    except Exception:  # noqa: BLE001
+        return True
+
+
+def _prune_unvalidatable(pending: dict) -> tuple[dict, list]:
+    """Split pending into (kept, dropped) — OUTSIDE-PROJECT entries only.
+
+    Those can never be cleared: `uap plan validate` refuses them by design, so
+    they block every build with a remedy that declines the file. This only
+    matters for state recorded before the tracking fix above.
+
+    A MISSING file is deliberately NOT pruned here. `mv PLAN.md PLAN2.md` is not
+    an edit op, so no new entry is recorded; auto-forgiving the old key on the
+    build path would make a rename a silent, unattended gate bypass with the
+    plan content fully intact. A deleted plan is dropped only by an operator
+    running `uap plan clear`, which records what it dropped and why.
+    """
+    kept: dict = {}
+    dropped: list = []
+    for key, seen in pending.items():
+        if not _inside_project(key):
+            dropped.append(key)
+        else:
+            kept[key] = seen
+    return kept, dropped
+
+
 def _key(target: str) -> str:
     """Repo-relative, forward-slashed — the shape `uap plan validate` records."""
     posix = target.replace(os.sep, "/")
@@ -148,6 +191,8 @@ def _refuse(paths: list[str], why: str) -> None:
         "risks, and whether it still matches the request.\n"
         f"  2. Record it: `uap plan validate {sorted(paths)[0]}`.\n"
         "  3. Retry this command.\n"
+        "(If validation refuses the file — outside the project, or deleted — it can "
+        "never clear: `uap plan status` names it and `uap plan clear` drops it.)\n"
         "(Escape hatch, justify in the plan/PR: UAP_PLAN_VALIDATE_OFF=1.)",
         inject_prompt="validate the plan",
     )
@@ -164,6 +209,9 @@ def main() -> None:
         target = _target(args)
         if not _is_plan_file(target):
             emit(True, "not a plan artifact")
+        # Only track what `uap plan validate` can actually validate.
+        if not _inside_project(target):
+            emit(True, "plan artifact outside the project — not tracked")
         state = _load_state()
         pending = state.get("pending") or {}
         pending[_key(target)] = int(time.time())
@@ -181,7 +229,20 @@ def main() -> None:
         emit(True, "not a build/execute/deploy command")
 
     state = _load_state()
-    pending = list((state.get("pending") or {}).keys())
+    # Drop legacy entries `uap plan validate` can never clear, recording what was
+    # dropped so a shrinking blocking set is auditable.
+    pending_map = state.get("pending") or {}
+    kept, dropped = _prune_unvalidatable(pending_map)
+    if dropped:
+        state["pending"] = kept
+        cleared = list(state.get("cleared") or [])
+        cleared.extend(
+            {"key": k, "reason": "outside the project directory", "at": int(time.time())}
+            for k in dropped
+        )
+        state["cleared"] = cleared[-50:]
+        _save_state(state)
+    pending = list(kept.keys())
     if pending:
         _refuse(pending, "these plans were created or modified and never validated")
 

package/src/policies/schemas/policies/delivery-enforcement.md

@@ -12,7 +12,9 @@ which drives a model to verified completion against the project's real gates
 (build, type-check, tests) rather than ad-hoc hand edits.
 
 The enforcer fires on `Edit` / `Write` / `MultiEdit` operations targeting
-source-code files. It is satisfied when any of the following holds:
+source-code files, and on `Bash` commands that write source through the shell
+(a redirect, heredoc, `tee` or `sed -i`), launch a GUI browser, or destroy the
+gate's own state (see below). It is satisfied when any of the following holds:
 
 - the edit runs inside a deliver-driven context (`UAP_DELIVER_ACTIVE=1`),
 - an explicit operator override is set (`UAP_DELIVER_BYPASS=1`),
@@ -43,3 +45,19 @@ of blocking.
 Exempt by construction: non-source files; `docs/`, `scripts/`, `policies/`,
 `src/policies/`, test files (deliver protects those itself); and tooling
 dot-dirs (`.claude/`, `.uap/`, `.worktrees/`, …).
+
+**One carve-out from that dot-dir exemption: the gate's own state.** Destroying
+`.uap/pending-deliver.jsonl`, `.uap/deliver.lock` or `.uap/deliver.heartbeat` —
+by `rm`, `unlink`, `shred`, `truncate`, `mv`, `find -delete`, `git clean`, a
+truncating `>` redirect, or removing `.uap/` itself — is blocked. The pending log
+is the replay queue for `uap deliver --pending`, so deleting it discards recorded
+work rather than completing it; the lock and heartbeat are how an in-flight run
+is found, followed, and reclaimed when wedged, so deleting them starts a second
+concurrent run on the same tree. Observed live 7x on 2026-07-31
+(octopus_invaders_v3), interleaved with `kill -9` of the running deliver.
+
+Unlike an edit, this block is **not** relaxed by `UAP_ENFORCE_DELIVERY=advisory`:
+advisory trades verification for speed on a change, but destroying recorded state
+has no verified-later equivalent. deliver's own housekeeping is unaffected — it
+rewrites the pending log in-process, and its subprocesses carry
+`UAP_DELIVER_ACTIVE=1`.

package/src/policies/schemas/policies/enforcement-infra-protect.md

@@ -23,9 +23,38 @@ the session runs on** is blocked:
   `vite --port 4000`, …) — this is how the port gets stolen even when kills are
   blocked, during the service's crash/restart window.
 
+- A broad `-f`/`--full` kill whose pattern is a substring of the stack's own
+  argv (`uap`, `llama`, `qwen`, `mmproj`, `nomic`, `anthropic`), or a glob over
+  the python interpreter that runs the proxy (`pkill -f "python.*"`).
+- A kill held **apart** from its target, however the two are separated: by a
+  pipe (`ps aux | grep llama-server | xargs kill -9`), by an infra-port lookup
+  feeding it (`lsof -t -i:4000 | xargs kill -9`), by a variable
+  (`P=$(pgrep -f llama-server); kill -9 $P`), by a loop
+  (`for p in $(pgrep -f llama-server); do kill -9 $p; done`), or by a `-f`
+  pattern that is itself an infra port (`pkill -f 8080`).
+- A kill whose **bare PID** resolves to a deliver run or the inference stack
+  (`kill -9 3936358`, and `kill -9 -3936358`, which kills the whole group).
+  This is resolved from `.uap/deliver.lock` and `/proc` rather than from the
+  command text, so it cannot be spelled around; a dead or recycled PID is never
+  protected.
+- The same rules applied to the body of a shell script the command would run —
+  moving a stack-restart one level down into a file once slipped past every
+  text rule.
+
 **Allowed**: killing a SPECIFIC process by pattern
 (`pkill -f "python3 -m http.server 8765"`) and serving your app on any non-infra
-port (e.g. `8765`).
+port (e.g. `8765`) — **unless the pattern itself carries a stack token**, so
+`pkill -f "uap deliver"` is refused. If a deliver run is in flight, wait for it
+(deliver tool with `follow:true`, or `uap deliver --await-run`) instead of
+killing it: a run that is still working is not stuck, and killing it discards
+the work it has already done.
+
+**Known limits.** This is a text gate over a language with unbounded ways to say
+the same thing. Obfuscated patterns (`grep '[l]lama-server'`) match the real
+process but not these rules; anything routed through `eval` or base64 defeats
+every text rule by construction; the script-body scan is depth-1 and shell-only.
+The bare-PID rule is the part that resolves rather than reads. Treat the rest as
+raising the cost, not as a boundary.
 
 ## Why
 
@@ -36,9 +65,24 @@ proxy), `kill $(lsof -t -i:8080)` (killed `llama-server`), then
 into a systemd bind-failure crash loop and `529`-ing its own session. The model
 cannot serve requests once it has killed the stack that answers them.
 
+Observed again (2026-07-31, octopus_invaders_v3): the model spent ~50 minutes in
+a `ps`/`sleep`/`kill` loop, destroying six of its own in-flight `uap deliver`
+runs and restarting them — each kill discarding work the run had already
+completed. When its `pkill -f "uap deliver"` was refused at 11:13:46Z it ran the
+`xargs kill -9` form **eight seconds later** and reported "cleaned". That is why
+the rules above cover the whole family rather than the observed spelling: the
+evasion gets found without being sought, and `SIGKILL` runs no exit handler, so
+none of it appears in `.uap/deliver-exits.log`.
+
 ## Enforcement
 
 Python enforcer `enforcement_infra_protect.py` (Bash/run_bash ops only). Emits a
 specific remediation: kill your own processes by exact pattern and serve on a
-port other than `8080`/`4000`/`8081`. Always active — this protects the runtime,
-not a per-project opt-in.
+port other than `8080`/`4000`/`8081`, or — for a live deliver run — wait for it
+rather than killing it.
+
+Active by default in every project; this protects the runtime, not a per-project
+opt-in. The only override is `UAP_INFRA_PROTECT_OFF=1` set in the launch
+**environment** by the operator. An inline `UAP_INFRA_PROTECT_OFF=1 <cmd>` is
+deliberately NOT honoured and is separately refused by `enforcement-self-protect`
+— an agent that can grant itself the exemption has no control at all.

package/src/policies/schemas/policies/validate-plan-on-change.md

@@ -59,10 +59,14 @@ State in `.uap/plan_state.json` (honours `UAP_STATE_DIR`), shared with
 ```json
 {
   "pending":   { "<repo-relative path>": "<epoch seen>" },
-  "validated": { "<repo-relative path>": "<sha256 of the reviewed bytes>" }
+  "validated": { "<repo-relative path>": "<sha256 of the reviewed bytes>" },
+  "cleared":   [ { "key": "<path>", "reason": "<why unreachable>", "at": "<epoch>" } ]
 }
 ```
 
+`cleared` is the audit trail of pending entries dropped as UNREACHABLE. The
+blocking set only shrinks through validation or through a recorded drop.
+
 Gated commands: `uap deliver`, `npm run build`, `npm start`, `yarn`/`pnpm build`,
 `make`, `cargo build|run`, `go build|run`, `mvn package|install`,
 `gradle build`, `docker build`, `docker compose up`, `terraform apply`,
@@ -75,4 +79,12 @@ Everything not listed is allowed; there is no second allowlist to keep in sync.
 Escape hatch, justify in the plan/PR: `UAP_PLAN_VALIDATE_OFF=1`.
 
 `uap plan status` reports exactly what the gate is waiting on (pending plans and
-plans that have drifted since validation).
+plans that have drifted since validation), listing separately any entry that is
+UNREACHABLE — one validation can never clear, because the file is outside the
+project, deleted, or unreadable.
+
+`uap plan clear` drops those unreachable entries and records them under
+`cleared`. It REFUSES a plan that is present and reviewable, pointing back at
+`uap plan validate`: it is a recovery hatch for a wedged gate, not a way to skip
+review. Without it the only exit from a wedge was editing the state file by
+hand.

package/tools/agents/scripts/anthropic_proxy.py

@@ -393,12 +393,55 @@ def _error_signature(text: str) -> str:
         return ""
     if _NEGATED_FAILURE_RE.search(line):
         return ""
+    return _normalize_error_line(line)
+
+
+def _normalize_error_line(line: str) -> str:
+    """Edit-invariant form of one error line: paths, hex and digits collapsed."""
     line = re.sub(r"(/[^\s:]+)+", "<path>", line)          # unix paths
     line = re.sub(r"\b[0-9a-fA-F]{6,}\b", "<hex>", line)    # hashes/addresses
     line = re.sub(r"\d+", "#", line)                        # line numbers, counts
     line = re.sub(r"\s+", " ", line).strip().lower()
     return line[:200]
 
+
+def _error_signature_for_result(text: str, result_error: bool | None = None) -> str:
+    """Signature for a tool_result, honouring the protocol's own `is_error`.
+
+    Keyword sniffing cannot tell a program REPORTING a failure from a file that
+    merely CONTAINS the word. Observed live (2026-07-31): the model read a Python
+    source file, `_ERROR_LINE_RE` matched the line
+
+        except Exception:  # noqa: BLE001 - unreadable state must not break ...
+
+    and three reads of the same file produced three identical "failures" — so
+    ERROR-LOOP fired and told the model to re-read the file it had just read.
+    Reading a file is the single most common thing an agent does; any file whose
+    text contains `Exception`, `error`, or `not found` could manufacture a streak.
+
+    The transcript already carries the answer. A tool_result has an `is_error`
+    flag, and the DOUBLING-DOWN guard has always preferred it over the keyword
+    heuristics; ERROR-LOOP computed its signature from the text and threw the
+    flag away. Now:
+
+      is_error False -> a clean result. No signature, whatever the bytes say.
+      is_error True  -> a real failure. Signature from the text, and if none of
+                        the keywords match, from its first meaningful line, so
+                        an unfamiliar error shape still forms a streak.
+      absent         -> fall back to the keyword heuristics as before.
+    """
+    if result_error is False:
+        return ""
+    sig = _error_signature(text)
+    if sig or result_error is not True:
+        return sig
+    # Declared an error, but shaped like nothing we recognise. Anchor the streak
+    # on the first meaningful line rather than losing the failure entirely.
+    for raw in (text or "").splitlines():
+        if raw.strip():
+            return _normalize_error_line(raw)
+    return ""
+
 # ---------------------------------------------------------------------------
 # DEFERRAL-BREAK guardrail (Fix A): a model can end a turn with plain prose that
 # DEFERS the work instead of doing it -- "I need more exploration cycles to
@@ -1786,15 +1829,23 @@ class SessionMonitor:
                     by_tool = self.tool_target_history.setdefault(name, {})
                     by_tool[target] = by_tool.get(target, 0) + 1
 
-    def note_tool_result_error(self, latest_result_text: str) -> None:
+    def note_tool_result_error(
+        self, latest_result_text: str, result_error: bool | None = None
+    ) -> None:
         """Track a repeated tool_result error signature (ERROR-LOOP guardrail).
 
         Same normalized error as last turn -> increment the streak; a new error
         or a clean (error-free) result -> reset. Only a SUSTAINED same-failure
-        streak (despite the model's varied edits) trips the nudge."""
+        streak (despite the model's varied edits) trips the nudge.
+
+        result_error is the tool_result `is_error` flag when the client sent one.
+        It beats the keyword heuristics in both directions — see
+        _error_signature_for_result. The caller has always computed this flag;
+        it just was not passed here, so reading a file containing the word
+        `Exception` three times looked exactly like failing three times."""
         if not PROXY_ERROR_LOOP:
             return
-        sig = _error_signature(latest_result_text or "")
+        sig = _error_signature_for_result(latest_result_text or "", result_error)
         if sig and sig == self.last_error_signature:
             self.error_signature_streak += 1
         elif sig:
@@ -6773,7 +6824,7 @@ def _record_last_assistant_tool_calls(
                 if _flags:
                     _latest_err = any(_flags)
                 break
-    monitor.note_tool_result_error(_latest_tr)
+    monitor.note_tool_result_error(_latest_tr, _latest_err)
     tool_fingerprints = []
     tool_targets: dict[str, str] = {}
     assistant_had_text = False  # Fix B: did the last assistant turn emit prose?

package/tools/agents/tests/test_error_loop_ignores_correctives.py

@@ -52,10 +52,12 @@ def _load_signature():
     start = src.index("_ERROR_LINE_RE = re.compile(")
     end = src.index("\n# ---", src.index("def _error_signature"))
     exec(src[start:end], ns)  # noqa: S102 - reading our own source, not input
-    return ns["_error_signature"]
+    return ns
 
 
-_error_signature = _load_signature()
+_NS = _load_signature()
+_error_signature = _NS["_error_signature"]
+_error_signature_for_result = _NS["_error_signature_for_result"]
 
 
 class TestHarnessCorrectivesAreNotFailures(unittest.TestCase):
@@ -164,3 +166,90 @@ class TestDeniedFailuresInPlainProse(unittest.TestCase):
             "2 tests failed",
         ):
             assert _error_signature(line) != "", line
+
+
+# The source file the model was reading when ERROR-LOOP fired on 2026-07-31.
+# Nothing failed; this is a file's CONTENTS, delivered as a successful Read.
+SOURCE_FILE_READ = '''def _load_state() -> dict:
+    try:
+        data = json.loads(_state_path().read_text())
+        return data if isinstance(data, dict) else {}
+    except Exception:  # noqa: BLE001 - unreadable state must not break the tool call
+        return {}
+'''
+
+
+class TestIsErrorFlagBeatsKeywords(unittest.TestCase):
+    """A file that CONTAINS "Exception" is not a failure.
+
+    Keyword sniffing cannot tell a program reporting a failure from a file that
+    merely mentions one. Reading a file is the most common thing an agent does,
+    so any source containing `Exception`, `error` or `not found` could
+    manufacture a streak — and did: three reads of one file produced three
+    identical signatures, and ERROR-LOOP told the model to re-read the file it
+    had just read.
+    """
+
+    def test_a_successful_read_never_produces_a_signature(self):
+        self.assertEqual(_error_signature_for_result(SOURCE_FILE_READ, False), "")
+
+    def test_three_successful_reads_cannot_arm_the_guard(self):
+        # Three was the threshold, and re-reading a file is not a failure streak.
+        sigs = {_error_signature_for_result(SOURCE_FILE_READ, False) for _ in range(3)}
+        self.assertEqual(sigs, {""})
+
+    def test_is_error_false_wins_over_a_real_looking_traceback(self):
+        # `cat` of a log file full of tracebacks is still a successful read.
+        text = "Traceback (most recent call last):\nTypeError: x is not a function"
+        self.assertEqual(_error_signature_for_result(text, False), "")
+
+    def test_is_error_true_still_produces_a_signature(self):
+        text = "ERROR: TypeError: x is not a function at /a/b.js:12"
+        self.assertNotEqual(_error_signature_for_result(text, True), "")
+
+    def test_is_error_true_with_an_unfamiliar_shape_still_forms_a_streak(self):
+        # The client declared a failure; losing it because no keyword matched
+        # would be the opposite mistake — a real repeated failure going untracked.
+        text = "the frobnicator declined\nmore detail here"
+        sig = _error_signature_for_result(text, True)
+        self.assertNotEqual(sig, "")
+        self.assertEqual(sig, _error_signature_for_result(text, True))  # stable
+
+    def test_without_the_flag_the_old_heuristics_still_apply(self):
+        # Clients that never send is_error must keep working exactly as before.
+        self.assertNotEqual(_error_signature_for_result("ERROR: SyntaxError: bad", None), "")
+        self.assertEqual(_error_signature_for_result("all tests passed", None), "")
+        self.assertEqual(
+            _error_signature_for_result(SOURCE_FILE_READ, None), _error_signature(SOURCE_FILE_READ)
+        )
+
+    def test_an_empty_declared_error_does_not_crash(self):
+        self.assertEqual(_error_signature_for_result("", True), "")
+        self.assertEqual(_error_signature_for_result("   \n\n ", True), "")
+
+
+class TestTheFlagIsActuallyWiredThrough(unittest.TestCase):
+    """The logic above is worthless if the caller never passes the flag.
+
+    That was the whole bug: the request handler computed `_latest_err` from the
+    tool_result blocks and then called `note_tool_result_error(_latest_tr)`,
+    dropping it. Every unit test passed. Reverting the call site to the one-arg
+    form — i.e. restoring the live bug exactly — still passes the entire suite,
+    which is why this asserts on the source.
+    """
+
+    def test_the_request_handler_passes_the_is_error_flag(self):
+        src = PROXY.read_text()
+        assert "_latest_err" in src, "the handler no longer computes the is_error flag"
+        assert re.search(r"note_tool_result_error\(\s*_latest_tr\s*,\s*_latest_err\s*\)", src), (
+            "note_tool_result_error is called without the is_error flag — reading a file that "
+            "contains the word 'Exception' will manufacture a failure streak again"
+        )
+
+    def test_the_signature_helper_is_the_one_being_used(self):
+        # A refactor that quietly points the monitor back at _error_signature
+        # would reinstate the keyword-only behaviour.
+        src = PROXY.read_text()
+        assert re.search(
+            r"sig = _error_signature_for_result\(latest_result_text or \"\", result_error\)", src
+        ), "note_tool_result_error no longer routes through _error_signature_for_result"

package/tools/agents/tests/test_validate_plan_inside_project.py

@@ -0,0 +1,106 @@
+"""validate-plan-on-change: only track what `uap plan validate` can validate.
+
+The enforcer recorded ANY plan-named file it saw written, including paths
+outside the project. `uap plan validate` refuses those ("explicit plan file must
+live under the project directory"), so the entry could never be cleared: every
+build in the repo blocked, and the remedy the refusal named declined the file.
+Observed live with a memory note at
+~/.claude/projects/<slug>/memory/plan_gate_before_build.md — not a plan at all,
+matched only because its filename contains "plan".
+
+The rename case is the one to guard hardest. `mv PLAN.md PLAN2.md` is not an
+edit op, so no new pending entry is recorded; auto-forgiving the old key on the
+build path would make a rename a silent, unattended gate bypass with the plan
+content fully intact. An earlier draft of this change did exactly that.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ENFORCER = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "validate_plan_on_change.py"
+
+
+def run(cwd: str, op: str, args: dict) -> str:
+    proc = subprocess.run(
+        [sys.executable, str(ENFORCER), "--operation", op, "--args", json.dumps(args)],
+        capture_output=True,
+        text=True,
+        cwd=cwd,
+    )
+    return proc.stdout + proc.stderr
+
+
+def state(cwd: str) -> dict:
+    path = Path(cwd) / ".uap" / "plan_state.json"
+    return json.loads(path.read_text()) if path.exists() else {}
+
+
+class TestPlanGateTracksOnlyProjectFiles(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.cwd = self._tmp.name
+        os.makedirs(os.path.join(self.cwd, "docs", "plans"), exist_ok=True)
+
+    def tearDown(self) -> None:
+        self._tmp.cleanup()
+
+    def test_outside_project_plan_is_not_tracked(self) -> None:
+        out = run(self.cwd, "Write", {"file_path": "/tmp/elsewhere/stray-plan.md"})
+        self.assertIn("outside the project", out)
+        self.assertEqual(state(self.cwd).get("pending", {}), {})
+
+    def test_in_project_plan_is_still_tracked(self) -> None:
+        Path(self.cwd, "docs", "plans", "real-plan.md").write_text("# real")
+        run(self.cwd, "Write", {"file_path": "docs/plans/real-plan.md"})
+        self.assertIn("docs/plans/real-plan.md", state(self.cwd).get("pending", {}))
+
+    def test_build_is_blocked_and_names_the_recovery_command(self) -> None:
+        Path(self.cwd, "docs", "plans", "real-plan.md").write_text("# real")
+        run(self.cwd, "Write", {"file_path": "docs/plans/real-plan.md"})
+        out = run(self.cwd, "Bash", {"command": "npm run build"})
+        self.assertIn("never validated", out)
+        # A wedged agent must not be sent to the one command that declines the file.
+        self.assertIn("uap plan clear", out)
+
+    def test_renaming_a_pending_plan_does_not_forgive_it(self) -> None:
+        plan = Path(self.cwd, "docs", "plans", "real-plan.md")
+        plan.write_text("# real")
+        run(self.cwd, "Write", {"file_path": "docs/plans/real-plan.md"})
+        plan.rename(Path(self.cwd, "docs", "plans", "real-plan-v2.md"))
+
+        out = run(self.cwd, "Bash", {"command": "npm run build"})
+        self.assertIn("never validated", out)
+        self.assertIn("docs/plans/real-plan.md", state(self.cwd).get("pending", {}))
+
+    def test_legacy_outside_entry_is_pruned_and_audited(self) -> None:
+        Path(self.cwd, "docs", "plans", "real-plan.md").write_text("# real")
+        run(self.cwd, "Write", {"file_path": "docs/plans/real-plan.md"})
+        st = state(self.cwd)
+        st.setdefault("pending", {})["/home/somewhere/legacy-plan.md"] = 1
+        Path(self.cwd, ".uap", "plan_state.json").write_text(json.dumps(st))
+
+        run(self.cwd, "Bash", {"command": "npm run build"})
+        st = state(self.cwd)
+        self.assertNotIn("/home/somewhere/legacy-plan.md", st.get("pending", {}))
+        # The in-project plan still gates the build.
+        self.assertIn("docs/plans/real-plan.md", st.get("pending", {}))
+        # A shrinking blocking set must leave a trail.
+        cleared = st.get("cleared", [])
+        self.assertEqual(len(cleared), 1)
+        self.assertEqual(cleared[0]["key"], "/home/somewhere/legacy-plan.md")
+        self.assertIn("outside the project", cleared[0]["reason"])
+
+    def test_non_plan_writes_are_untouched(self) -> None:
+        out = run(self.cwd, "Write", {"file_path": "src/index.ts"})
+        self.assertIn("not a plan artifact", out)
+        self.assertEqual(state(self.cwd).get("pending", {}), {})
+
+
+if __name__ == "__main__":
+    unittest.main()

package/docs/patches/validate-plan-on-change-inside-project.patch

@@ -1,154 +0,0 @@
-# validate-plan-on-change: stop the gate wedging on paths it cannot validate
-#
-# The enforcer records ANY plan-named file it sees written, including paths
-# OUTSIDE the project. `uap plan validate` refuses those ('explicit plan file
-# must live under the project directory'), so such an entry can never be
-# cleared: every build in the repo blocks, and the remedy the refusal names
-# declines the file. Observed live: a memory note at
-# ~/.claude/projects/<slug>/memory/plan_gate_before_build.md — not a plan at
-# all, matched only because its filename contains 'plan' — blocked the repo
-# until .uap/plan_state.json was edited by hand.
-#
-# This patch:
-#   1. stop TRACKING plan files outside the project (the root cause);
-#   2. prune legacy outside-project entries, with an audit record;
-#   3. point the refusal at `uap plan clear` when validation cannot help.
-#
-# It deliberately does NOT auto-prune entries whose file is merely MISSING.
-# `mv PLAN.md PLAN2.md` is not an edit op, so no new entry is recorded — and
-# forgiving the old key on the build path would turn a rename into a silent,
-# unattended gate bypass with the plan content fully intact. A deleted plan is
-# dropped only by an operator running `uap plan clear`, which records it.
-#
-# `src/policies/enforcers/**` is protected by Enforcement Self-Protect, so an
-# agent cannot apply this. Operator, from the repo root:
-#
-#     git apply docs/patches/validate-plan-on-change-inside-project.patch
-#
-# `uap plan clear` (shipped in this PR) recovers an ALREADY-wedged gate without
-# this patch; the patch is what stops the wedge recurring.
-
---- a/src/policies/enforcers/validate_plan_on_change.py
-+++ b/src/policies/enforcers/validate_plan_on_change.py
-@@ -119,6 +119,49 @@
-     return bool(PLAN_STEM_RE.search(name[:-3]))
- 
- 
-+def _inside_project(target: str) -> bool:
-+    """True when `target` resolves to the project root or below it.
-+
-+    `uap plan validate` refuses any file outside the project directory, so
-+    recording one creates a pending entry NOTHING can clear: every build in the
-+    repo blocks, and the remedy the refusal names declines the file. Observed
-+    live with a memory note under ~/.claude/, matched only because its filename
-+    contained "plan".
-+
-+    Fails CLOSED on error (treat as inside, i.e. record it). Failing open here
-+    would let a transient getcwd() error silently un-gate a plan write.
-+    """
-+    try:
-+        root = os.path.realpath(os.getcwd())
-+        abs_target = os.path.realpath(os.path.join(root, target))
-+        return abs_target == root or abs_target.startswith(root + os.sep)
-+    except Exception:  # noqa: BLE001
-+        return True
-+
-+
-+def _prune_unvalidatable(pending: dict) -> tuple[dict, list]:
-+    """Split pending into (kept, dropped) — OUTSIDE-PROJECT entries only.
-+
-+    Those can never be cleared: `uap plan validate` refuses them by design, so
-+    they block every build with a remedy that declines the file. This only
-+    matters for state recorded before the tracking fix above.
-+
-+    A MISSING file is deliberately NOT pruned here. `mv PLAN.md PLAN2.md` is not
-+    an edit op, so no new entry is recorded; auto-forgiving the old key on the
-+    build path would make a rename a silent, unattended gate bypass with the
-+    plan content fully intact. A deleted plan is dropped only by an operator
-+    running `uap plan clear`, which records what it dropped and why.
-+    """
-+    kept: dict = {}
-+    dropped: list = []
-+    for key, seen in pending.items():
-+        if not _inside_project(key):
-+            dropped.append(key)
-+        else:
-+            kept[key] = seen
-+    return kept, dropped
-+
-+
- def _key(target: str) -> str:
-     """Repo-relative, forward-slashed — the shape `uap plan validate` records."""
-     posix = target.replace(os.sep, "/")
-@@ -148,6 +191,8 @@
-         "risks, and whether it still matches the request.\n"
-         f"  2. Record it: `uap plan validate {sorted(paths)[0]}`.\n"
-         "  3. Retry this command.\n"
-+        "(If validation refuses the file — outside the project, or deleted — it can "
-+        "never clear: `uap plan status` names it and `uap plan clear` drops it.)\n"
-         "(Escape hatch, justify in the plan/PR: UAP_PLAN_VALIDATE_OFF=1.)",
-         inject_prompt="validate the plan",
-     )
-@@ -164,6 +209,9 @@
-         target = _target(args)
-         if not _is_plan_file(target):
-             emit(True, "not a plan artifact")
-+        # Only track what `uap plan validate` can actually validate.
-+        if not _inside_project(target):
-+            emit(True, "plan artifact outside the project — not tracked")
-         state = _load_state()
-         pending = state.get("pending") or {}
-         pending[_key(target)] = int(time.time())
-@@ -181,7 +229,20 @@
-         emit(True, "not a build/execute/deploy command")
- 
-     state = _load_state()
--    pending = list((state.get("pending") or {}).keys())
-+    # Drop legacy entries `uap plan validate` can never clear, recording what was
-+    # dropped so a shrinking blocking set is auditable.
-+    pending_map = state.get("pending") or {}
-+    kept, dropped = _prune_unvalidatable(pending_map)
-+    if dropped:
-+        state["pending"] = kept
-+        cleared = list(state.get("cleared") or [])
-+        cleared.extend(
-+            {"key": k, "reason": "outside the project directory", "at": int(time.time())}
-+            for k in dropped
-+        )
-+        state["cleared"] = cleared[-50:]
-+        _save_state(state)
-+    pending = list(kept.keys())
-     if pending:
-         _refuse(pending, "these plans were created or modified and never validated")
- 
---- a/src/policies/schemas/policies/validate-plan-on-change.md
-+++ b/src/policies/schemas/policies/validate-plan-on-change.md
-@@ -59,9 +59,13 @@
- ```json
- {
-   "pending":   { "<repo-relative path>": "<epoch seen>" },
--  "validated": { "<repo-relative path>": "<sha256 of the reviewed bytes>" }
-+  "validated": { "<repo-relative path>": "<sha256 of the reviewed bytes>" },
-+  "cleared":   [ { "key": "<path>", "reason": "<why unreachable>", "at": "<epoch>" } ]
- }
- ```
-+
-+`cleared` is the audit trail of pending entries dropped as UNREACHABLE. The
-+blocking set only shrinks through validation or through a recorded drop.
- 
- Gated commands: `uap deliver`, `npm run build`, `npm start`, `yarn`/`pnpm build`,
- `make`, `cargo build|run`, `go build|run`, `mvn package|install`,
-@@ -75,4 +79,12 @@
- Escape hatch, justify in the plan/PR: `UAP_PLAN_VALIDATE_OFF=1`.
- 
- `uap plan status` reports exactly what the gate is waiting on (pending plans and
--plans that have drifted since validation).
-+plans that have drifted since validation), listing separately any entry that is
-+UNREACHABLE — one validation can never clear, because the file is outside the
-+project, deleted, or unreadable.
-+
-+`uap plan clear` drops those unreachable entries and records them under
-+`cleared`. It REFUSES a plan that is present and reviewable, pointing back at
-+`uap plan validate`: it is a recovery hatch for a wedged gate, not a way to skip
-+review. Without it the only exit from a wedge was editing the state file by
-+hand.