@miller-tech/uap 1.179.4 → 1.179.6

package/docs/guides/PROXY.md

@@ -179,6 +179,8 @@ set is below.
 | Env (default) | Behavior |
 |---|---|
 | `PROXY_MAX_CONNECTIONS` (20) | httpx pool size; a large pool + 529 backoff absorbs connection churn gracefully |
+| `PROXY_UPSTREAM_RETRY_MAX` (3) / `PROXY_UPSTREAM_RETRY_DELAY_SECS` (5) | Transient-failure retry budget for upstream calls, on both the buffered and the streaming path. Values below 1 are clamped to 1 |
+| **503 "Loading model"** (no toggle) | llama-server answers 503 while a GGUF is still being mapped. Both paths treat it as transient: wait for `/health` (up to 60s), then retry. A wait that times out surfaces the 503 rather than stacking another — so a cold start costs at most ~60s of extra latency per attempt, not `RETRY_MAX × 60s` of dead air |
 | **529 backpressure** (no toggle) | A pool timeout returns HTTP **529 `overloaded_error`** with `retry-after` — pure graceful degradation, not a hard failure |
 | `PROXY_CLOSEWAIT_REAP_INTERVAL` (0 = **off**) | Opt-in CLOSE-WAIT reaper (pool self-heal); off by default because pool-swap churn can harm a saturated upstream |
 | `PROXY_TOOL_NARROWING` (**off**) | Opt-in: drop cycling/banned tools from the set on loops — always keeps the Bash/WebFetch/Agent escape hatch + write tools (a floor invariant that never strands the agent) |

package/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.179.4",
-  "version": "1.179.4",
+  "version": "1.179.6",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project",
+    "test:enforcers": "python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_delivery_enforcement_worktree",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/tools/agents/scripts/anthropic_proxy.py

@@ -3560,6 +3560,92 @@ class DisconnectAwareClient(httpx.AsyncClient):
                 task.cancel()
 
 
+async def _send_stream_with_retry(
+    client: httpx.AsyncClient,
+    url: str,
+    payload: dict,
+) -> httpx.Response:
+    """POST a streaming completion, retrying transient failures and 503 "Loading model".
+
+    The streaming sibling of `_post_with_retry_inner`. Both retry the
+    `_UPSTREAM_RETRY_EXCEPTIONS` set — which is wider than connect errors; a
+    ReadTimeout/ReadError mid-setup is retried too — so a llama-server restart
+    doesn't fail the turn. Both also treat a 503 "Loading model" as transient:
+    llama-server answers that while a GGUF is still being mapped, so the right
+    move is to wait for /health and retry rather than surface a fatal error.
+
+    Raises the last transient exception when every attempt failed. Otherwise
+    returns the response, which may itself be a non-200 the caller must handle —
+    including a loading 503 that outlived the retry budget, or one whose health
+    wait timed out.
+    """
+    # Clamp: a configured 0 would skip the loop entirely and fall through to the
+    # terminal raise with last_exc unset, escaping the caller's narrow except as
+    # an unhandled 500. One attempt is the floor.
+    retry_max = max(1, PROXY_UPSTREAM_RETRY_MAX)
+    last_exc: Exception | None = None
+    for attempt in range(retry_max):
+        try:
+            resp = await client.send(
+                client.build_request(
+                    "POST",
+                    url,
+                    json=payload,
+                    headers={"Content-Type": "application/json"},
+                ),
+                stream=True,
+            )
+            setattr(resp, "_uap_client", client)
+            if resp.status_code == 503:
+                # _is_loading_model_503 reads .text, which raises ResponseNotRead
+                # on an unread streaming body — and its bare `except` turns that
+                # into a silent False, so without this read every loading 503
+                # would look permanent and the retry would never fire. httpx
+                # caches the body, so the caller's non-200 handler re-reads free.
+                try:
+                    await resp.aread()
+                except BaseException:
+                    # Never leave the connection checked out: a ReadError here is
+                    # retryable and would otherwise loop with resp unreferenced
+                    # and unclosed, accruing CLOSE-WAIT until the pool saturates.
+                    _detach_aclose(resp)
+                    raise
+                if _is_loading_model_503(resp) and attempt < retry_max - 1:
+                    logger.warning(
+                        "Upstream 503 Loading model (stream attempt %d/%d) – waiting for health",
+                        attempt + 1,
+                        retry_max,
+                    )
+                    healthy = await _wait_for_upstream_health(client, max_wait=60.0)
+                    if not healthy:
+                        # Matches _post_with_retry_inner: once a health wait has
+                        # timed out, stacking another one just buys the client
+                        # minutes of dead air before the same failure. Surface it.
+                        return resp
+                    _detach_aclose(resp)
+                    continue
+            return resp
+        except _UPSTREAM_RETRY_EXCEPTIONS as exc:
+            last_exc = exc
+            if attempt < retry_max - 1:
+                logger.warning(
+                    "Upstream transient error (stream attempt %d/%d): %s – retrying in %.0fs",
+                    attempt + 1,
+                    retry_max,
+                    type(exc).__name__,
+                    PROXY_UPSTREAM_RETRY_DELAY_SECS,
+                )
+                await asyncio.sleep(PROXY_UPSTREAM_RETRY_DELAY_SECS)
+            else:
+                logger.error(
+                    "Upstream stream failed after %d attempts: %s: %s",
+                    retry_max,
+                    type(exc).__name__,
+                    exc,
+                )
+    raise last_exc if last_exc else RuntimeError("upstream stream retry failed")
+
+
 async def _post_with_retry_inner(
     client: httpx.AsyncClient,
     url: str,
@@ -11676,43 +11762,17 @@ async def messages(request: Request):
         # Retry upstream connection with backoff to handle
         # llama-server restarts gracefully instead of 500-ing to the client.
         MAX_UPSTREAM_RETRIES = PROXY_UPSTREAM_RETRY_MAX
-        RETRY_DELAY_SECS = PROXY_UPSTREAM_RETRY_DELAY_SECS
         last_exc: Exception | None = None
         resp: httpx.Response | None = None
 
-        for attempt in range(MAX_UPSTREAM_RETRIES):
-            try:
-                resp = await client.send(
-                    client.build_request(
-                        "POST",
-                        f"{LLAMA_CPP_BASE}/chat/completions",
-                        json=openai_body,
-                        headers={"Content-Type": "application/json"},
-                    ),
-                    stream=True,
-                )
-                setattr(resp, "_uap_client", client)
-                # Connection succeeded – break out of retry loop
-                last_exc = None
-                break
-            except _UPSTREAM_RETRY_EXCEPTIONS as exc:
-                last_exc = exc
-                if attempt < MAX_UPSTREAM_RETRIES - 1:
-                    logger.warning(
-                        "Upstream connect failed (attempt %d/%d): %s – retrying in %.0fs",
-                        attempt + 1,
-                        MAX_UPSTREAM_RETRIES,
-                        type(exc).__name__,
-                        RETRY_DELAY_SECS,
-                    )
-                    await asyncio.sleep(RETRY_DELAY_SECS)
-                else:
-                    logger.error(
-                        "Upstream connect failed after %d attempts: %s: %s",
-                        MAX_UPSTREAM_RETRIES,
-                        type(exc).__name__,
-                        exc,
-                    )
+        try:
+            resp = await _send_stream_with_retry(
+                client,
+                f"{LLAMA_CPP_BASE}/chat/completions",
+                openai_body,
+            )
+        except _UPSTREAM_RETRY_EXCEPTIONS as exc:
+            last_exc = exc
 
         if last_exc is not None:
             return Response(

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -3,6 +3,7 @@
 import asyncio
 import importlib.util
 import json
+import os
 import unittest
 import unittest.mock
 from pathlib import Path
@@ -91,36 +92,44 @@ class TestProxyConfigTuning(unittest.TestCase):
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
 
-    def test_build_request_bypasses_floor_for_tool_turns_when_thinking_disabled(self):
-        old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
-        old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
-        try:
-            setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", 4096)
-            setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", True)
-
-            body = {
-                "model": "test",
-                "max_tokens": 512,
-                "messages": [{"role": "user", "content": "run pwd"}],
-                "tools": [
+    def test_thinking_disabled_flag_no_longer_changes_the_tool_turn_budget(self):
+        # This test used to assert 512 while toggling
+        # PROXY_DISABLE_THINKING_ON_TOOL_TURNS. That gating was deliberately
+        # removed — it skipped the floor on every tool turn once thinking was
+        # off, which re-introduced truncated tool calls on long edits — and the
+        # flag now only feeds a log line. Asserting the post-removal number
+        # alone would just duplicate test_max_tokens_floor_bypassed_for_small_
+        # preflight, so pin the removal itself: the flag must not move the
+        # budget in either position. 512 lands on THINKING_MIN_FOR_TOOLS (2048)
+        # because Qwen emits <think> regardless of the flag, and on a tool turn
+        # those blocks alone eat ~400-1000 tokens, leaving nothing for the
+        # tool_call (observed live as ~5 required_tool_miss retries per turn).
+        def budget(disable_thinking):
+            with unittest.mock.patch.object(proxy, "PROXY_MAX_TOKENS_FLOOR", 4096), \
+                    unittest.mock.patch.object(
+                        proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", disable_thinking):
+                return proxy.build_openai_request(
                     {
-                        "name": "Bash",
-                        "description": "run command",
-                        "input_schema": {"type": "object"},
-                    }
-                ],
-            }
+                        "model": "test",
+                        "max_tokens": 512,
+                        "messages": [{"role": "user", "content": "run pwd"}],
+                        "tools": [
+                            {
+                                "name": "Bash",
+                                "description": "run command",
+                                "input_schema": {"type": "object"},
+                            }
+                        ],
+                    },
+                    proxy.SessionMonitor(context_window=0),
+                ).get("max_tokens")
 
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            self.assertEqual(openai.get("max_tokens"), 512)
-        finally:
-            setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
-            setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
+        self.assertEqual(budget(True), budget(False), "flag must no longer gate the floor")
+        self.assertEqual(budget(True), 2048)
 
-    def test_build_request_skips_floor_for_non_tool_turns(self):
-        """Non-tool requests should NOT have the max_tokens floor applied."""
+    def test_non_tool_turn_takes_thinking_floor_not_the_big_floor(self):
+        """Non-tool requests skip PROXY_MAX_TOKENS_FLOOR and land on
+        THINKING_MIN_NO_TOOLS instead — a different, larger mechanism."""
         old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
         old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
         try:
@@ -133,11 +142,20 @@ class TestProxyConfigTuning(unittest.TestCase):
                 "messages": [{"role": "user", "content": "say ok"}],
             }
 
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            # Floor should NOT inflate max_tokens for non-tool requests
-            self.assertEqual(openai.get("max_tokens"), 512)
+            with unittest.mock.patch.dict(
+                os.environ, {"PROXY_THINKING_MIN_NO_TOOLS": "8192"}
+            ):
+                openai = proxy.build_openai_request(
+                    body, proxy.SessionMonitor(context_window=0)
+                )
+            # The big PROXY_MAX_TOKENS_FLOOR (4096) is still skipped for
+            # non-tool turns — that is what this test guards. What the request
+            # lands on instead is THINKING_MIN_NO_TOOLS: Qwen spends small
+            # no-tool budgets entirely inside <think>, the EMPTY-OUTPUT GUARD
+            # then promotes truncated reasoning as the body, and evaluator
+            # callers get an unparseable verdict. Distinct mechanism, distinct
+            # value — assert it explicitly rather than the raw 512.
+            self.assertEqual(openai.get("max_tokens"), 8192)
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
@@ -170,30 +188,56 @@ class TestProfileSelection(unittest.TestCase):
         )
         self.assertIn(suffix, openai_body["messages"][0]["content"])
 
+    @staticmethod
+    def _grammar_body():
+        return {
+            "model": "default",
+            "max_tokens": 128,
+            "messages": [{"role": "user", "content": "run pwd"}],
+            "tools": [
+                {
+                    "name": "Bash",
+                    "description": "run command",
+                    "input_schema": {"type": "object"},
+                }
+            ],
+        }
+
     def test_build_request_uses_profile_grammar_override(self):
-        old_flag = getattr(proxy, "PROXY_TOOL_CALL_GRAMMAR")
-        setattr(proxy, "PROXY_TOOL_CALL_GRAMMAR", True)
-        try:
-            body = {
-                "model": "default",
-                "max_tokens": 128,
-                "messages": [{"role": "user", "content": "run pwd"}],
-                "tools": [
-                    {
-                        "name": "Bash",
-                        "description": "run command",
-                        "input_schema": {"type": "object"},
-                    }
-                ],
-            }
+        # PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY defaults to True and gates the
+        # whole grammar path on tool_choice == "required". It postdates this
+        # test, which is why the override looked broken: _apply_tool_call_grammar
+        # returned before ever consulting it. Relax the gate so this test covers
+        # what its name says — the override winning over the default GBNF — and
+        # let the test below cover the gate itself.
+        with unittest.mock.patch.object(proxy, "PROXY_TOOL_CALL_GRAMMAR", True), \
+                unittest.mock.patch.object(
+                    proxy, "PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY", False):
             openai_body = proxy.build_openai_request(
-                body,
+                self._grammar_body(),
                 proxy.SessionMonitor(context_window=0),
                 profile_grammar="grammar-test",
             )
-            self.assertEqual(openai_body.get("grammar"), "grammar-test")
-        finally:
-            setattr(proxy, "PROXY_TOOL_CALL_GRAMMAR", old_flag)
+        self.assertEqual(openai_body.get("grammar"), "grammar-test")
+
+    def test_required_only_gate_is_what_decides_whether_grammar_attaches(self):
+        # The gate that broke the test above is real behaviour and was untested.
+        # Assert it on the DISCRIMINATING axis — tool_choice — rather than only
+        # the negative case: a bare assertIsNone would also pass if the grammar
+        # flag were off, if tools were stripped, or if the _apply_tool_call_grammar
+        # call site were deleted outright, so it would prove nothing.
+        def grammar_for(tool_choice):
+            body = {"tools": [{"type": "function"}], "tool_choice": tool_choice}
+            with unittest.mock.patch.object(proxy, "PROXY_TOOL_CALL_GRAMMAR", True), \
+                    unittest.mock.patch.object(
+                        proxy, "PROXY_TOOL_CALL_GRAMMAR_REQUIRED_ONLY", True):
+                proxy._apply_tool_call_grammar(
+                    body, tool_choice=tool_choice, grammar_override="grammar-test"
+                )
+            return body.get("grammar")
+
+        self.assertEqual(grammar_for("required"), "grammar-test")
+        self.assertIsNone(grammar_for("auto"))
 
     def test_prune_target_fraction_uses_config_or_default(self):
         old_target = getattr(proxy, "PROXY_CONTEXT_PRUNE_TARGET_FRACTION")
@@ -408,7 +452,18 @@ class TestStreamGuardedPathSelection(unittest.TestCase):
 
 
 class TestMalformedToolGuardrail(unittest.TestCase):
-    def test_detects_malformed_tool_payload(self):
+    def test_tolerates_orphan_parameter_closer_after_a_valid_answer(self):
+        # Reversed deliberately on 2026-05-12 (_strip_orphan_tool_xml): an orphan
+        # closer with no opener is no longer treated as a malformed tool call,
+        # because Qwen3.6 leaks bare </parameter> training residue after a valid
+        # answer when forced into tool_choice='required' with nothing to call, and
+        # rejecting those cost ~11 false rejections in 40 min on a related branch.
+        #
+        # Be honest about the trade-off this pins: THIS payload is the model
+        # regurgitating its own tool schema twice, which is a plausible genuine
+        # failure. It survives only because the separator is '= {' rather than
+        # '=\n{' — one whitespace character flips the verdict. We accept that
+        # false negative to kill a much larger false-positive class.
         openai_resp = {
             "choices": [
                 {
@@ -427,9 +482,43 @@ class TestMalformedToolGuardrail(unittest.TestCase):
             "tools": [{"name": "Read", "input_schema": {"type": "object"}}],
             "messages": [{"role": "user", "content": "fix this"}],
         }
-        self.assertTrue(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
+        self.assertFalse(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
 
-    def test_detects_closing_function_tag_payload(self):
+    def test_still_detects_a_payload_that_retains_its_opener(self):
+        # The other half of the contract the strip promises: tolerating orphan
+        # closers must not blind the guardrail to a genuine malformed attempt,
+        # which keeps its opener. Without this, the test above alone would be
+        # satisfied by deleting the detector outright.
+        anthropic_body = {
+            "tools": [{"name": "Read", "input_schema": {"type": "object"}}],
+            "messages": [{"role": "user", "content": "fix this"}],
+        }
+        for payload in (
+            # The load-bearing case: an orphan closer AND a real opener in the
+            # same text. Only this one proves the strip removes the residue
+            # without also swallowing the genuine attempt beside it — the other
+            # payloads return early before _strip_orphan_tool_xml ever runs.
+            '</function> then <function=Bash><parameter name="c">ls</parameter></function>',
+            '<parameter name="cmd">ls</parameter>',
+            '<tool_call>{"name":"Read"}',
+            '<function=Bash>{"cmd":"ls"}',
+        ):
+            with self.subTest(payload=payload):
+                openai_resp = {
+                    "choices": [
+                        {
+                            "finish_reason": "stop",
+                            "message": {"content": payload, "tool_calls": []},
+                        }
+                    ]
+                }
+                self.assertTrue(
+                    proxy._is_malformed_tool_response(openai_resp, anthropic_body)
+                )
+
+    def test_tolerates_orphan_function_closer_after_a_valid_answer(self):
+        # Same 2026-05-12 reversal as the </parameter> case above: a trailing
+        # </function> with no opener is training residue, not a tool call.
         openai_resp = {
             "choices": [
                 {
@@ -449,7 +538,7 @@ class TestMalformedToolGuardrail(unittest.TestCase):
             "tools": [{"name": "Bash", "input_schema": {"type": "object"}}],
             "messages": [{"role": "user", "content": "list root docs/json files"}],
         }
-        self.assertTrue(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
+        self.assertFalse(proxy._is_malformed_tool_response(openai_resp, anthropic_body))
 
     def test_detects_think_tag_with_repeated_policy_phrase(self):
         openai_resp = {
@@ -1840,7 +1929,14 @@ class TestTurnCountFinalizeBreaker(unittest.TestCase):
                 self._body(45), proxy.SessionMonitor(context_window=262144)
             )
             self.assertFalse(out.get("tools"))  # tools stripped
-            self.assertIn("STOP now", out["messages"][-1]["content"])
+            # The breaker's wording moved from a hard "STOP now" to a periodic
+            # progress checkpoint that explicitly resumes next turn. Assert the
+            # contract that survives rewording rather than the prose: the turn
+            # count is cited, and the model is told not to emit a tool call —
+            # which is the half that must agree with the stripped toolset.
+            nudge = out["messages"][-1]["content"]
+            self.assertIn("45", nudge)
+            self.assertRegex(nudge, r"(?i)do NOT emit any tool call|no tools are available")
         finally:
             setattr(proxy, "PROXY_HARD_FINALIZE_TURNS", old)
 
@@ -3643,8 +3739,9 @@ class TestDegenerateRepetitionDetection(unittest.TestCase):
         self.assertFalse(truncated)
         self.assertEqual(result["choices"][0]["message"]["content"], text)
 
-    def test_max_tokens_floor_skipped_for_non_tool_requests(self):
-        """max_tokens floor should not inflate non-tool requests."""
+    def test_non_tool_request_lands_below_the_big_floor(self):
+        """The 16384 floor is skipped for non-tool turns; the much smaller
+        THINKING_MIN_NO_TOOLS applies instead."""
         old_floor = getattr(proxy, "PROXY_MAX_TOKENS_FLOOR")
         old_disable = getattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS")
         try:
@@ -3656,11 +3753,17 @@ class TestDegenerateRepetitionDetection(unittest.TestCase):
                 "max_tokens": 100,
                 "messages": [{"role": "user", "content": "generate a title"}],
             }
-            openai = proxy.build_openai_request(
-                body, proxy.SessionMonitor(context_window=0)
-            )
-            # No tools = no floor inflation
-            self.assertEqual(openai.get("max_tokens"), 100)
+            with unittest.mock.patch.dict(
+                os.environ, {"PROXY_THINKING_MIN_NO_TOOLS": "8192"}
+            ):
+                openai = proxy.build_openai_request(
+                    body, proxy.SessionMonitor(context_window=0)
+                )
+            # No tools = the 16384 floor is skipped. The result is the much
+            # smaller THINKING_MIN_NO_TOOLS, not the raw 100: a 100-token
+            # no-tool budget is consumed entirely by Qwen's mandatory <think>,
+            # leaving nothing for the answer. Still well under the floor.
+            self.assertEqual(openai.get("max_tokens"), 8192)
         finally:
             setattr(proxy, "PROXY_MAX_TOKENS_FLOOR", old_floor)
             setattr(proxy, "PROXY_DISABLE_THINKING_ON_TOOL_TURNS", old_disable)
@@ -3826,8 +3929,10 @@ class EmptyOutputGuardTest(unittest.TestCase):
         self.assertFalse(any(b.get("type") == "text" for b in out["content"]))
 
 
-if __name__ == "__main__":
-    unittest.main()
+# NB: the `unittest.main()` entrypoint is at the END of this file. It used to
+# sit here, above ~2200 further lines of TestCase classes, so running the file
+# directly exited after this point and silently skipped roughly 40% of the
+# module — including TestSendStreamWithRetry — while still printing OK.
 
 
 class TestCompletionContractGuardrails(unittest.TestCase):
@@ -5834,3 +5939,228 @@ class TestPassthroughTimeout(unittest.IsolatedAsyncioTestCase):
 
         self.assertIsNotNone(captured.get("timeout"))
         self.assertEqual(captured["timeout"].read, proxy.PROXY_PASSTHROUGH_TIMEOUT)
+
+
+class _FakeStreamResponse:
+    """Stand-in for a streamed httpx.Response, faithful to two contracts.
+
+    Both are load-bearing for _send_stream_with_retry, and a fake that models
+    neither lets the fix be deleted with the suite still green:
+
+    1. `.text` raises ResponseNotRead until the body has been read. That is why
+       the production code calls aread() before _is_loading_model_503 — whose
+       bare `except` would otherwise swallow the raise into a silent False and
+       silently disable the retry.
+    2. aread() caches. The caller re-reads the same response in its non-200
+       handler, which only works because httpx serves the second read from
+       cache rather than raising StreamConsumed.
+    """
+
+    def __init__(self, status_code, text=""):
+        self.status_code = status_code
+        self._body = text
+        self._read = False
+        self.read_count = 0
+        self.closed = False
+
+    @property
+    def text(self):
+        if not self._read:
+            raise httpx.ResponseNotRead()
+        return self._body
+
+    async def aread(self):
+        if self._read:
+            return self._body.encode()  # cached: no second stream consumption
+        self._read = True
+        self.read_count += 1
+        return self._body.encode()
+
+    async def aclose(self):
+        self.closed = True
+
+
+class _FakeStreamClient:
+    """Replays a queued script of responses/exceptions for client.send()."""
+
+    def __init__(self, scripted):
+        self._scripted = list(scripted)
+        self.sends = 0
+        self.requests = []
+        self.stream_flags = []
+
+    def build_request(self, method, url, **kwargs):
+        return {"method": method, "url": url, **kwargs}
+
+    async def send(self, request, stream=False):
+        self.sends += 1
+        self.requests.append(request)
+        self.stream_flags.append(stream)
+        if not self._scripted:
+            raise AssertionError("no scripted response left")
+        nxt = self._scripted.pop(0)
+        if isinstance(nxt, Exception):
+            raise nxt
+        return nxt
+
+
+class TestSendStreamWithRetry(unittest.TestCase):
+    """The streaming path must treat 503 'Loading model' as transient.
+
+    Regression guard: this path used to break out of its retry loop on any HTTP
+    response, so a streamed turn that began while llama-server was still mapping
+    a GGUF surfaced 'AI_APICallError: Loading model' to the client as a fatal
+    error. The non-streaming sibling (_post_with_retry_inner) retried it —
+    health-gated and bounded by PROXY_UPSTREAM_RETRY_MAX — while the streaming
+    path, the one every opencode turn actually uses, did not retry it at all.
+    """
+
+    def _run(self, client, health_ok=True, retry_max=3):
+        waited = []
+
+        async def _fake_health(_client, max_wait=60.0, poll_interval=5.0):
+            waited.append(max_wait)
+            return health_ok
+
+        async def _no_sleep(_secs):
+            return None
+
+        def _sync_close(closeable):
+            # Production schedules the close on a detached task; inside a test
+            # the loop closes before it runs. Close eagerly so `.closed` is a
+            # deterministic assertion rather than a race.
+            closeable.closed = True
+
+        with unittest.mock.patch.object(proxy, "_wait_for_upstream_health", _fake_health), \
+                unittest.mock.patch.object(proxy, "_detach_aclose", _sync_close), \
+                unittest.mock.patch.object(proxy, "PROXY_UPSTREAM_RETRY_MAX", retry_max), \
+                unittest.mock.patch.object(asyncio, "sleep", _no_sleep):
+            resp = asyncio.run(
+                proxy._send_stream_with_retry(client, "http://x/v1/chat/completions", {})
+            )
+        return resp, waited
+
+    def test_retries_loading_model_503_then_returns_success(self):
+        loading = _FakeStreamResponse(503, "Loading model")
+        ok = _FakeStreamResponse(200, "")
+        client = _FakeStreamClient([loading, ok])
+
+        resp, waited = self._run(client)
+
+        self.assertIs(resp, ok)
+        self.assertEqual(client.sends, 2, "should have retried after the 503")
+        self.assertEqual(len(waited), 1, "should have waited for upstream health")
+        self.assertTrue(loading.closed, "the discarded 503 must be closed")
+
+    def test_does_not_retry_a_non_loading_503(self):
+        # A 503 that is not a model load is a real upstream failure; passing it
+        # straight through preserves the existing error contract.
+        overloaded = _FakeStreamResponse(503, "server is overloaded")
+        client = _FakeStreamClient([overloaded, _FakeStreamResponse(200, "")])
+
+        resp, waited = self._run(client)
+
+        self.assertIs(resp, overloaded)
+        self.assertEqual(client.sends, 1)
+        self.assertEqual(waited, [])
+
+    def test_returns_503_after_exhausting_retry_budget(self):
+        responses = [_FakeStreamResponse(503, "Loading model") for _ in range(3)]
+        client = _FakeStreamClient(list(responses))
+
+        resp, waited = self._run(client, retry_max=3)
+
+        self.assertEqual(client.sends, 3)
+        self.assertEqual(resp.status_code, 503)
+        self.assertIs(resp, responses[-1], "last 503 is surfaced to the caller")
+        self.assertEqual(len(waited), 2, "waits between attempts, not after the last")
+
+    def test_surfaces_the_503_when_the_health_wait_times_out(self):
+        # Mirrors _post_with_retry_inner: once upstream is still unhealthy after
+        # a full wait, stacking more waits only buys the client dead air. Without
+        # this gate a dead upstream costs retry_max x 60s before the same failure.
+        loading = _FakeStreamResponse(503, "Loading model")
+        client = _FakeStreamClient([loading, _FakeStreamResponse(200, "")])
+
+        resp, waited = self._run(client, health_ok=False)
+
+        self.assertIs(resp, loading, "unhealthy upstream surfaces the 503 now")
+        self.assertEqual(client.sends, 1, "must not retry a still-unhealthy upstream")
+        self.assertEqual(len(waited), 1)
+
+    def test_reads_the_body_before_classifying_a_503(self):
+        # The fix hinges on aread() preceding _is_loading_model_503, whose bare
+        # `except` would turn httpx's ResponseNotRead into a silent False and
+        # disable the retry entirely. Deleting that aread() must fail here.
+        loading = _FakeStreamResponse(503, "Loading model")
+        ok = _FakeStreamResponse(200, "")
+        client = _FakeStreamClient([loading, ok])
+
+        resp, _ = self._run(client)
+
+        self.assertIs(resp, ok)
+        self.assertEqual(loading.read_count, 1, "body read exactly once, before .text")
+
+    def test_closes_the_response_when_the_body_read_fails(self):
+        # A ReadError while reading the 503 body is retryable; if the discarded
+        # response is not closed the connection accrues as CLOSE-WAIT until the
+        # pool saturates, with the client seeing nothing wrong.
+        class _ExplodingResponse(_FakeStreamResponse):
+            async def aread(self):
+                raise httpx.ReadError("reset mid-body")
+
+        boom = _ExplodingResponse(503, "Loading model")
+        ok = _FakeStreamResponse(200, "")
+        client = _FakeStreamClient([boom, ok])
+
+        resp, _ = self._run(client)
+
+        self.assertIs(resp, ok, "the read failure is retried")
+        self.assertTrue(boom.closed, "the abandoned response must be closed")
+
+    def test_still_retries_connect_errors(self):
+        # Regression guard for the pre-existing behaviour the extraction replaced.
+        ok = _FakeStreamResponse(200, "")
+        client = _FakeStreamClient([httpx.ConnectError("boom"), ok])
+
+        resp, _ = self._run(client)
+
+        self.assertIs(resp, ok)
+        self.assertEqual(client.sends, 2)
+
+    def test_raises_when_every_connect_attempt_fails(self):
+        client = _FakeStreamClient([httpx.ConnectError("boom") for _ in range(3)])
+
+        with self.assertRaises(httpx.ConnectError):
+            self._run(client, retry_max=3)
+
+        self.assertEqual(client.sends, 3)
+
+    def test_retry_max_of_zero_still_makes_one_attempt(self):
+        # An unclamped 0 skipped the loop and raised a bare RuntimeError, which
+        # the call site's narrow `except` misses — an unhandled 500 where the
+        # old code returned a clean 529.
+        ok = _FakeStreamResponse(200, "")
+        client = _FakeStreamClient([ok])
+
+        resp, _ = self._run(client, retry_max=0)
+
+        self.assertIs(resp, ok)
+        self.assertEqual(client.sends, 1)
+
+    def test_preserves_the_streaming_contract_the_caller_depends_on(self):
+        # stream=True keeps the turn incremental (buffering it would silently
+        # reintroduce full-generation latency), and _uap_client drives the
+        # inflight accounting that the pool-retire logic waits on.
+        ok = _FakeStreamResponse(200, "")
+        client = _FakeStreamClient([ok])
+
+        resp, _ = self._run(client)
+
+        self.assertEqual(client.stream_flags, [True])
+        self.assertIs(getattr(resp, "_uap_client"), client)
+        self.assertEqual(client.requests[0]["url"], "http://x/v1/chat/completions")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_delivery_enforcement_all_langs.py

@@ -45,7 +45,13 @@ NOT_GATED = ["package.json", "config.yaml", "data.xml", "README.md", "notes.txt"
 
 def run(path, content="x" * 2000):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     p = subprocess.run(
         [sys.executable, str(ENF), "--operation", "Write", "--args", json.dumps({"file_path": path, "content": content})],

package/tools/agents/tests/test_delivery_enforcement_exemptions.py

@@ -21,7 +21,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(path):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     p = subprocess.run(
         [sys.executable, str(ENF), "--operation", "Write",

package/tools/agents/tests/test_delivery_enforcement_filepath.py

@@ -9,7 +9,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(args, env=None):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     if env:
         e.update(env)

package/tools/agents/tests/test_delivery_enforcement_web_and_bash.py

@@ -17,7 +17,13 @@ ENF = Path(__file__).resolve().parents[3] / "src" / "policies" / "enforcers" / "
 
 def run(op, args, env=None):
     e = {**os.environ, "UAP_ENFORCE_DELIVERY": "block", "UAP_INFERENCE_ENDPOINT": "http://172.17.0.1:8080/v1"}
-    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY"):
+    # ANTHROPIC_BASE_URL / OPENAI_BASE_URL must be stripped too: the enforcer
+    # downgrades block -> advisory for a local-model session, so a developer
+    # with a loopback base URL exported (the normal shape of a local session)
+    # sees every block-expecting test here allow instead. CI has them unset, so
+    # this is green in CI and red on the developer's machine.
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS", "UAP_DELIVER_LOCAL_MODE",
+              "UAP_DELIVER_LOCAL_ADVISORY", "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
         e.pop(k, None)
     if env:
         e.update(env)

package/tools/agents/tests/test_delivery_enforcement_worktree.py

@@ -24,8 +24,17 @@ def run(path, root, env_extra=None):
     env = dict(os.environ)
     env["UAP_REPO_ROOT"] = str(root)
     env["UAP_ENFORCE_DELIVERY"] = "block"
-    env.pop("UAP_DELIVER_ACTIVE", None)
-    env.pop("UAP_DELIVER_BYPASS", None)
+    # Every ambient input that can turn "block" into "allow" must be cleared,
+    # or these tests assert the developer's shell rather than the enforcer.
+    # ANTHROPIC_BASE_URL is the subtle one: delivery_enforcement downgrades
+    # block -> advisory for a local-model session, so with a loopback base URL
+    # exported (the normal shape of a local session here) the three
+    # block-expecting tests below flip to allowed. CI has it unset, so this
+    # fails only for developers — presenting as "behaviour drifted".
+    for k in ("UAP_DELIVER_ACTIVE", "UAP_DELIVER_BYPASS",
+              "UAP_DELIVER_LOCAL_MODE", "UAP_DELIVER_LOCAL_ADVISORY",
+              "ANTHROPIC_BASE_URL", "OPENAI_BASE_URL"):
+        env.pop(k, None)
     if env_extra:
         env.update(env_extra)
     p = subprocess.run(
@@ -82,8 +91,12 @@ class TestDeliveryEnforcementWorktree(unittest.TestCase):
         )
 
 
-if __name__ == "__main__":
-    unittest.main()
+# NB: the `unittest.main()` entrypoint lives at the END of this file, not here.
+# It used to sit at this point, above the two classes below, so running the file
+# directly (`python3 tools/agents/tests/test_delivery_enforcement_worktree.py`)
+# ran 7 tests and printed OK while `python -m unittest` ran 14 — the 7 it
+# skipped being exactly LocalAdvisoryTest + LocalModeTest. Anyone verifying a
+# change to those got a false green.
 
 
 import os as _os, subprocess as _sp, sys as _sys, json as _json, tempfile as _tf
@@ -96,7 +109,21 @@ class LocalAdvisoryTest(unittest.TestCase):
             root = _Path(td); (root/".git").mkdir()
             f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
             e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
-            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            # This test asserts the DEFAULT for a local session, so every input
+            # that overrides that default has to be cleared:
+            #  - UAP_DELIVER_BYPASS: run() already strips it. An agent shell
+            #    commonly exports it, the enforcer then allows every write, and
+            #    the block-expecting tests fail rc 0 != 2 — which reads as
+            #    "behaviour drifted" rather than "your env leaked".
+            #  - UAP_DELIVER_LOCAL_MODE: LocalModeTest._run already strips it;
+            #    omitting it here was an inconsistency. Importing the proxy
+            #    module (any test that does _load_proxy_module()) runs
+            #    _load_proxy_env_file(), which loads .uap/proxy.env into the
+            #    real os.environ — and that file sets UAP_DELIVER_LOCAL_MODE.
+            #    So this test's result depended on whether a proxy-importing
+            #    module ran before it in the same process.
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_ACTIVE",
+                      "UAP_DELIVER_BYPASS","UAP_DELIVER_LOCAL_MODE"): e.pop(k, None)
             e.update(extra_env)
             p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
             return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
@@ -120,7 +147,8 @@ class LocalModeTest(unittest.TestCase):
             root = _Path(td); (root/".git").mkdir()
             f = root/"src"/"a.ts"; f.parent.mkdir(parents=True); f.write_text("x")
             e = dict(_os.environ); e["UAP_REPO_ROOT"]=str(root)
-            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_LOCAL_MODE","UAP_DELIVER_ACTIVE"): e.pop(k, None)
+            # See the note in LocalAdvisoryTest._run — same ambient-bypass leak.
+            for k in ("ANTHROPIC_BASE_URL","UAP_DELIVER_LOCAL_ADVISORY","UAP_DELIVER_LOCAL_MODE","UAP_DELIVER_ACTIVE","UAP_DELIVER_BYPASS"): e.pop(k, None)
             e.update(env)
             p = _sp.run([_sys.executable, str(_ENF), "--operation","Write","--args",_json.dumps({"file_path":str(f)})], capture_output=True, text=True, env=e)
             return p.returncode, _json.loads(p.stdout) if p.stdout.strip() else {}
@@ -141,3 +169,7 @@ class LocalModeTest(unittest.TestCase):
     def test_default_is_advisory(self):
         rc, out = self._run({"ANTHROPIC_BASE_URL":"http://127.0.0.1:4000"})
         self.assertEqual(rc, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_enforcer_suite_coverage.py

@@ -28,8 +28,19 @@ TESTS = Path(__file__).resolve().parent
 # Verified failing for their own pre-existing reasons, not by omission. Each
 # entry is a debt with a stated cause — not a place to park a newly broken test.
 KNOWN_EXCLUDED = {
-    "test_anthropic_proxy_streaming": "behaviour drifted from the assertions",
-    "test_delivery_enforcement_worktree": "behaviour drifted from the assertions",
+    # test_anthropic_proxy_streaming and test_delivery_enforcement_worktree
+    # were both listed here as "behaviour drifted from the assertions" and are
+    # now listed in test:enforcers instead:
+    #   - proxy_streaming had 7 genuinely stale assertions (max_tokens floors
+    #     superseded by the thinking-floor, a grammar guard that postdated the
+    #     test, the turn-count breaker's rewording, and two malformed-payload
+    #     cases deliberately reversed by _strip_orphan_tool_xml). All rewritten
+    #     against current intent. This is the module that covers the streaming
+    #     503 retry, so it was the gap that let that bug ship.
+    #   - delivery_enforcement_worktree never drifted at all: two of its env
+    #     helpers failed to strip an ambient UAP_DELIVER_BYPASS, so the
+    #     enforcer allowed every write and four block-expecting tests read 0
+    #     instead of 2. It passes clean; the helpers are now hermetic.
     "test_uap_compliance": "needs a populated DB; environment-bound",
 }
 
@@ -87,5 +98,50 @@ class TestEveryListedModuleActuallyCollects(unittest.TestCase):
         assert ghosts == set(), f"test:enforcers names modules that do not exist: {sorted(ghosts)}"
 
 
+class TestTheGateCollectsWhatItClaims(unittest.TestCase):
+    """Every check above is structural — none pins how many tests actually run.
+
+    A listed module can define a TestCase and still contribute almost nothing.
+    Two real instances: a mid-file `unittest.main()` in
+    test_anthropic_proxy_streaming and test_delivery_enforcement_worktree cut
+    direct runs off partway through the file (273 -> 168 and 14 -> 7) while
+    still printing OK; and a mass deletion inside any listed module is invisible
+    to the listing checks. A floor on the collected count catches both.
+    """
+
+    # Deliberately below the current count so ordinary churn doesn't trip it.
+    # Raise it when the suite grows substantially; never lower it to make a
+    # failing gate pass — that is the deletion this test exists to catch.
+    MINIMUM_COLLECTED = 750
+
+    def test_listed_modules_collect_at_least_the_expected_test_count(self):
+        loader = unittest.TestLoader()
+        suite = loader.loadTestsFromNames(
+            [f"tools.agents.tests.{m}" for m in sorted(_listed_modules())]
+        )
+        # loadTestsFromNames turns an import failure into a _FailedTest that
+        # still counts, so surface those rather than let them pad the total.
+        broken = [
+            str(t) for t in _flatten(suite)
+            if type(t).__name__ == "_FailedTest"
+        ]
+        assert broken == [], f"listed modules that fail to even import: {broken}"
+
+        count = suite.countTestCases()
+        assert count >= self.MINIMUM_COLLECTED, (
+            f"the gate collects {count} tests, below the {self.MINIMUM_COLLECTED} floor. "
+            "Tests were deleted, a module stopped collecting, or an entrypoint "
+            "truncates the file. Investigate before adjusting this number."
+        )
+
+
+def _flatten(suite):
+    for item in suite:
+        if isinstance(item, unittest.TestSuite):
+            yield from _flatten(item)
+        else:
+            yield item
+
+
 if __name__ == "__main__":
     unittest.main()