@miller-tech/uap 1.213.0 → 1.215.0

package/dist/cli/deliver.js

@@ -27,6 +27,7 @@ import { authorAcceptanceGate } from '../delivery/self-gate.js';
 import { applyPendingIntents } from '../delivery/pending-intents.js';
 import { runAcceptanceGate } from '../delivery/acceptance-judge.js';
 import { buildMissionAcceptanceGate, resolveAcceptanceVerdict } from '../delivery/mission-acceptance.js';
+import { compareCapability, invalidateCapabilityBaseline, readCapabilityBaseline, readCapabilityCurrent, writeCapabilityBaseline, fpsOf, drawsPerFrame, } from '../delivery/capability-profile.js';
 import { createSpecRegistry } from '../delivery/spec-registry.js';
 import { guardAgainstOwnerExit, resolveOwnerPid } from '../delivery/orphan-guard.js';
 import { findRepoRoot, formatScopeNotice, unreachablePaths } from '../delivery/scope-notice.js';
@@ -187,7 +188,7 @@ export function bestKeepFastScore(gateResults, fastRungIds) {
 export { resolveAcceptanceVerdict } from '../delivery/mission-acceptance.js';
 import { createAgenticExecutor, noopApplier, selectExecutorMode, lockContractFiles } from '../delivery/agentic-executor.js';
 import { createRepairEscalation } from '../delivery/repair-escalation.js';
-import { clearProjectStop, clearStop, finalRunStatus, isRunBudgetExpired, isStopRequested, makeStopLatch, requestStop, runBudgetMinutes, loadRunState, newRunId, saveRunState, isEpicResume, MAX_PERSISTED_PHASES } from '../delivery/run-state.js';
+import { clearProjectStop, clearStop, finalRunStatus, isRunBudgetExpired, isRunBudgetExplicit, isStopRequested, makeStopLatch, phaseAwareRunBudgetMinutes, requestStop, runBudgetMinutes, loadRunState, newRunId, saveRunState, isEpicResume, MAX_PERSISTED_PHASES } from '../delivery/run-state.js';
 import { planDeliveryPhases, shouldDecompose } from '../delivery/decompose.js';
 import { initLedger, markItem } from '../delivery/completion-ledger.js';
 import { loadUapConfigRaw } from '../utils/config-loader.js';
@@ -272,7 +273,7 @@ import { createHaloDeliveryTracer } from '../delivery/halo-trace.js';
 import { haloTracePath, isHaloTracingEnabled } from '../observability/halo-exporter.js';
 import { createRunCoordinator } from '../delivery/run-coordinator.js';
 import { readCuratedIdeas } from './ideate.js';
-import { createEscalationController, defaultEscalationLadder } from '../delivery/escalation.js';
+import { createEscalationController, defaultEscalationLadder, DEFAULT_STAGNATION_TURNS } from '../delivery/escalation.js';
 import { FilePracticeStore, defaultPracticePath, extractKeywords, retrievePracticesSemantic, } from '../delivery/practice.js';
 import { detectRungs, mergeRedetectedRungs, runLadder, runTieredLadder, tierOf, TIER_ORDER, demoteBaselineFailures, baselineRegressions } from '../delivery/verifier-ladder.js';
 import { runDeployDevLadder } from '../delivery/deploy-dev-gate.js';
@@ -1126,6 +1127,91 @@ export async function deliverCommand(instruction, options) {
         throw err;
     }
 }
+/**
+ * Consecutive flat turns after which an epic attempt yields to a fresh one.
+ *
+ * TWO, from the measurement rather than from taste. In every flat attempt
+ * observed (rust-pg-ext, qwen3.8-27b, 2026-08-20) the score was already pinned
+ * by turn 2 and never moved again through turn 5 — and `↑ turn 3: enable
+ * critic` fired in all four of them without changing anything. Turn 1 can never
+ * trip it: the first score is by definition an improvement on "no score yet".
+ *
+ * Only ever applied when a retry remains, so the cost of being wrong is one
+ * fresh attempt on the same epic — the thing that actually rescued the measured
+ * case (a flat 5-turn attempt, then a pass in 2).
+ */
+/**
+ * Consecutive flat turns after which an epic attempt yields to a fresh one.
+ *
+ * THREE, and the number is measured rather than chosen. Replaying this rail's
+ * exact streak logic over 157 deliver logs — 51 attempts where it would arm —
+ * gives, per threshold: fires / turns cut / in-attempt breakthroughs destroyed
+ *
+ *     K=2   35   101   5      <- the first draft. Destroys five real wins.
+ *     K=3   32    67   3
+ *     K=4   30    35   2
+ *
+ * Moving 2 -> 3 gives up 34 turns of saving and spares two attempts that went
+ * on to PASS from a flat run — `migration-register-rel-record` [75,75,75,PASS]
+ * and `contracts` [100,100,100,PASS]. The first draft's comment asserted that a
+ * turn-4 breakthrough was something "this sample never showed"; the corpus
+ * contains one, and it passed. That claim was wrong and this is the correction.
+ *
+ * The count is a FLOOR, scaled up with the turn budget by the loop (see
+ * `abortOnFlatTurns`): every breakthrough still lost at K=3 is a 6-8 turn
+ * attempt from a maxTurns=20 run, where three flat turns is a far weaker signal
+ * than it is out of five.
+ *
+ * Caveat kept in view: the replay reads gate percentages from logs, so it
+ * cannot see acceptance movement or inconclusive turns — both of which reset
+ * the streak. Every "destroyed" count above is therefore an upper bound.
+ */
+export const EPIC_FLAT_TURN_YIELD = 3;
+/**
+ * The threshold, with an operator override: `UAP_EPIC_FLAT_TURN_YIELD`.
+ * `0` or any non-positive value disables the rail entirely.
+ *
+ * Blank is treated as UNSET, not as zero: an exported-but-empty variable is a
+ * common accident, and `Number('')` is 0, which would silently switch the rail
+ * off — the exact inversion of the "a typo must not disable it" intent.
+ */
+export function epicFlatTurnYield() {
+    const raw = process.env.UAP_EPIC_FLAT_TURN_YIELD;
+    if (raw !== undefined && raw.trim() !== '') {
+        const n = Number(raw);
+        if (Number.isFinite(n))
+            return n >= 1 ? Math.floor(n) : undefined;
+    }
+    return EPIC_FLAT_TURN_YIELD;
+}
+/**
+ * The loop option that yields a FLAT epic attempt to a fresh one — or nothing.
+ *
+ * Extracted so the WIRING is testable, not just the threshold. It carries the
+ * whole safety argument: ending an attempt early is defensible only while a
+ * fresh attempt remains, so on the last attempt (`retriesRemaining` 0 or
+ * absent) this returns `{}` and the attempt plays out exactly as today.
+ *
+ * WHAT THIS DOES AND DOES NOT BUY, stated precisely because the first draft
+ * overclaimed it: no turn budget is transferred. Each attempt gets its own
+ * `maxTurns` either way, so a fresh attempt is not made longer by an earlier
+ * one ending sooner — the epic's TOTAL exploration shrinks. What is saved is
+ * wall clock, on turns whose gate score is provably not moving.
+ */
+export function epicFlatTurnOption(retriesRemaining, escalationLadderReach = 0) {
+    if (!((retriesRemaining ?? 0) > 0))
+        return {};
+    const limit = epicFlatTurnYield();
+    if (limit === undefined)
+        return {};
+    // NEVER yield while this attempt still has an unplayed escalation tier — the
+    // ladder is precisely "what this attempt has left to try", and cutting it is
+    // not reclaiming waste, it is skipping the rescue. Raising the threshold to
+    // the ladder's reach is self-correcting: when the ladder needs the whole turn
+    // budget (a stronger model on a 5-turn attempt), the resulting limit exceeds
+    // the budget and the rail simply never fires.
+    return { abortOnFlatTurns: Math.max(limit, escalationLadderReach) };
+}
 async function runDeliver(instruction, options) {
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
     // P1 (plan D1): --pending replays gate-recorded edit intents exactly, then
@@ -2052,6 +2138,32 @@ async function runDeliver(instruction, options) {
             onEscalate: (tier, turn) => console.log(chalk.magenta(`  ↑ turn ${turn}: ${tier.label}`)),
         })
         : undefined;
+    /**
+     * The turn on which the LAST escalation tier issues its directive.
+     *
+     * An epic attempt may end early on a plateau, and that must never cut the
+     * ladder short: a tier decided on turn N is consumed by turn N+1, so yielding
+     * at or before the last tier's turn means the tier never runs. Measured
+     * against the real ladder — with a stronger model configured, an attempt that
+     * delivers on turn 6 was abandoned on turn 4 and the stronger model was never
+     * called once.
+     *
+     * 0 when no ladder is active, which is the configuration the plateau
+     * measurement was taken in (those logs show `enable critic` and nothing
+     * above it — no stronger model was configured).
+     */
+    const escalationLadderReach = (() => {
+        if (!options.escalate)
+            return 0;
+        const tiers = defaultEscalationLadder({
+            includeExploration: !agentic,
+            candidates,
+            maxTurns: maxTurns ?? 5,
+            escalateExecutor,
+            escalateModelName,
+        }).length;
+        return tiers > 0 ? DEFAULT_STAGNATION_TURNS * tiers + 1 : 0;
+    })();
     // Phase 4: learned best-practice cards for similar tasks. Retrieval is
     // semantic (embeddings) by default — better recall than keyword overlap —
     // and falls back to keyword matching automatically when no embedding
@@ -2282,6 +2394,24 @@ async function runDeliver(instruction, options) {
         const fastScore = bestKeepFastScore(record.gateResults, bestFastRungIds);
         if (fastScore === null || fastScore <= baselineGateScore)
             return; // not a new best
+        // VETO on capability. This is the whole reason the capability profile exists,
+        // and without this hook it would not have closed the incident it cites: on
+        // the recorded regression the gate score went 0% -> 100% WHILE the app lost
+        // most of its function. Acceptance now blocks that turn — but acceptance is
+        // not a rung, so its verdict never reaches `record.gateResults`, and this
+        // hook would happily snapshot the gutted tree as the run's new "best" and
+        // DISPOSE the good one. The end-of-run rollback then restores the damage.
+        //
+        // Reads the same two files acceptance does, so the two cannot disagree.
+        const capCmp = compareCapability(readCapabilityBaseline(projectRoot), readCapabilityCurrent(projectRoot));
+        if (capCmp.regressed) {
+            if (!options.dryRun) {
+                console.log(chalk.yellow(`  no-regress: turn scored ${fastScore.toFixed(2)} but LOST capability — refusing to adopt it as best`));
+                for (const f of capCmp.findings)
+                    console.log(chalk.dim(`    ${f}`));
+            }
+            return;
+        }
         const snap = snapshotTree(projectRoot);
         if (!snap.ok)
             return; // size-cap / failure: keep the previous best
@@ -2682,7 +2812,26 @@ async function runDeliver(instruction, options) {
     // 2026-08-13 — 651 minutes, still phase 0 of 6, 20% of gates on every turn).
     // Riding the stop latch means expiry behaves exactly like an operator's stop
     // request: the turn finishes, the work is checkpointed, the lock is released.
-    const budgetMinutes = runBudgetMinutes(projectRoot);
+    // The budget is captured BEFORE decomposition, so it starts at the calibrated
+    // single-mission default and is re-derived once the plan's size is known (see
+    // applyPhaseBudget). `let`, because a 7-epic plan needs a different clock than
+    // the one-mission runs the 120-minute default was measured on.
+    const budgetExplicit = isRunBudgetExplicit(projectRoot);
+    let budgetMinutes = runBudgetMinutes(projectRoot);
+    const baseBudgetMinutes = budgetMinutes;
+    /**
+     * Grant the run time proportional to the plan, once the plan exists.
+     * No-op when the operator set the budget themselves, and never shrinks it.
+     */
+    const applyPhaseBudget = (phaseCount) => {
+        if (budgetExplicit)
+            return;
+        const next = phaseAwareRunBudgetMinutes(baseBudgetMinutes, phaseCount);
+        if (next > budgetMinutes) {
+            budgetMinutes = next;
+            console.log(chalk.dim(`  ⏱ run budget ${baseBudgetMinutes} → ${budgetMinutes} min for ${phaseCount} planned phases`));
+        }
+    };
     const runStartedAtMs = Date.now();
     let stoppedForBudget = false;
     // Captured at OBSERVATION time: isStopRequested consumes the project-level
@@ -3021,6 +3170,14 @@ async function runDeliver(instruction, options) {
             persistPlan: (plan) => {
                 runState.phases = plan;
                 saveRunState(runState);
+                // THE epic budget hook. On a fresh epic run — the DEFAULT for every
+                // mission — the outer `phases` is undefined (it is only ever
+                // resumeState.phases; the decompose block is explicitly skipped when
+                // epics are on), so the call site before dispatch never fires and the
+                // whole scaler was dead on the path that motivated it. The plan first
+                // exists HERE. Re-granting on a later re-plan is safe: the grant only
+                // ever raises (see phaseAwareRunBudgetMinutes).
+                applyPhaseBudget(plan.length);
             },
             persistCompleted: ({ summaries, completed }) => {
                 runState.phaseSummaries = [...summaries];
@@ -3040,8 +3197,14 @@ async function runDeliver(instruction, options) {
                 saveRunState(runState);
             },
             runOrchestrated: (missionText, plan, parentTaskId) => runOrchestratedMissionCore(buildOrchestratedDeps(missionText, plan, epicParallelTasks, parentTaskId)),
-            runEpicLoop: async (scoped) => {
-                const loop = new ConvergenceLoop({ ...loopConfig, baselineCheck: false, resumeFrom: undefined, onIteration: makeIterationHook() }, executor, seams);
+            runEpicLoop: async (scoped, opts) => {
+                const loop = new ConvergenceLoop({
+                    ...loopConfig,
+                    baselineCheck: false,
+                    resumeFrom: undefined,
+                    onIteration: makeIterationHook(),
+                    ...epicFlatTurnOption(opts?.retriesRemaining, escalationLadderReach),
+                }, executor, seams);
                 return loop.deliver(scoped);
             },
             setEpicSpec: (spec) => specs.setShared(spec), // fresh epic — breaker needs fresh diff evidence
@@ -3199,6 +3362,32 @@ async function runDeliver(instruction, options) {
     const keepBest = resolveKeepBest(options.keepBest) && fastRungs.length > 0 && !needsSelfGate;
     let regressSnapshot = null;
     let baselineGateScore = 0;
+    // Capability baseline: what the deliverable DOES before this run touches it.
+    //
+    // PROMOTED, not measured. The pre-run ladder immediately below already runs
+    // the execution gate, and that gate writes `.uap/capability/current.json` as a
+    // byproduct of the browser session it opens anyway — so pinning a baseline is
+    // a file copy, not a second headless launch. That is the point of having moved
+    // the measurement into the gate.
+    //
+    // Reported when it is ABSENT, too. An unmeasured baseline silently disables
+    // the whole check, and this repo has shipped inert rungs that looked exactly
+    // like healthy ones from the outside.
+    const pinCapabilityBaseline = () => {
+        if (options.dryRun)
+            return;
+        const pre = readCapabilityCurrent(projectRoot);
+        if (!pre?.measured) {
+            // Nothing measurable this run, so any baseline still on disk describes a
+            // DIFFERENT tree. Drop it rather than measure against it.
+            invalidateCapabilityBaseline(projectRoot);
+            console.log(chalk.dim(`  capability: no baseline (${pre?.reason ?? 'not measured'}) — regression check inactive`));
+            return;
+        }
+        writeCapabilityBaseline(projectRoot, pre);
+        console.log(chalk.dim(`  capability baseline: ${fpsOf(pre).toFixed(1)} fps, ${drawsPerFrame(pre).toFixed(2)} draws/frame, ` +
+            `${pre.programsUsed} programs, ${pre.listenerTypes} event types`));
+    };
     if (keepBest) {
         baselineGateScore = runLadder(fastRungs, projectRoot).score;
         const snapResult = snapshotTree(projectRoot);
@@ -3216,6 +3405,18 @@ async function runDeliver(instruction, options) {
             console.log(chalk.yellow(`  no-regress: ${label} — ${snapResult.detail}; rollback disabled for this run`));
         }
     }
+    // Pin the capability baseline for EVERY run, not only under --keep-best.
+    //
+    // It used to sit inside that branch, which meant --no-keep-best (or
+    // UAP_DELIVER_KEEP_BEST=0, or a self-gated project) left the PREVIOUS run's
+    // baseline on disk. A later, unrelated run then measured against a days-old
+    // reading of a different app and blocked every turn — with the only documented
+    // escape being a flag that did nothing. A baseline nobody pinned this run is
+    // worse than no baseline.
+    //
+    // When --keep-best did not run a ladder there may be no reading yet; the
+    // helper says so and leaves the check inactive rather than guessing.
+    pinCapabilityBaseline();
     // Mark this run (and the gate subprocesses it spawns) as deliver-driven so
     // the delivery-enforcement policy exempts the sanctioned path. Scoped to the
     // loop and RESTORED afterward so a programmatic/long-lived caller doesn't
@@ -3261,6 +3462,14 @@ async function runDeliver(instruction, options) {
                 console.log(chalk.dim('  lazy attempt did not pass — engaging the full convergence stack'));
             }
         }
+        // Grant the clock the sequence the plan implies, before any runner starts
+        // consuming it. Epics run as N missions back to back, so the single-mission
+        // default expires mid-sequence (measured: 7 epics, ~16 min each, against a
+        // 120-minute cap). This covers the paths where the plan is ALREADY known —
+        // --no-epics decomposed runs, and epic RESUMES (resumeState.phases). A
+        // fresh epic run has no plan yet and is granted in persistPlan instead.
+        if (phases && phases.length >= 2)
+            applyPhaseBudget(phases.length);
         // Resume routing: an epic-kind resume re-enters the epic path (fidelity —
         // completed epics carry forward as prior summaries). Everything else takes
         // a cursor-honoring sequential path — phased when a phase plan was
@@ -3437,13 +3646,24 @@ async function runDeliver(instruction, options) {
         const endLadder = runLadder(fastRungs, projectRoot);
         const endScore = endLadder.score;
         const endRegressions = baselineRegressions(fastRungs, endLadder.results);
-        if (endScore < baselineGateScore || endRegressions.length > 0) {
+        // A capability regression is a THIRD reason to restore, and without it the veto
+        // above is only half a fix. The incident this feature cites is precisely
+        // "gate score went UP while capability collapsed": the veto correctly refuses
+        // to adopt the gutted turn as best, the run then ENDS on that turn, and this
+        // predicate sees endScore >= baseline with no gate regressions and keeps it —
+        // shipping the damage and disposing the good snapshot. The end-of-run ladder
+        // just re-ran the execution rung, so the reading here is fresh.
+        const endCap = compareCapability(readCapabilityBaseline(projectRoot), readCapabilityCurrent(projectRoot));
+        const endCapabilityLost = endCap.regressed;
+        if (endScore < baselineGateScore || endRegressions.length > 0 || endCapabilityLost) {
             try {
                 restoreTree(projectRoot, regressSnapshot);
                 console.log(chalk.yellow(endRegressions.length > 0
                     ? `  ↩ no-regress: reverted to best — tests that passed at baseline are failing now: ` +
                         `${endRegressions.flatMap((r) => r.tests).slice(0, 5).join(', ')}`
-                    : `  ↩ no-regress: reverted to best (end gate score ${endScore.toFixed(2)} < best ${baselineGateScore.toFixed(2)})`));
+                    : endCapabilityLost
+                        ? `  ↩ no-regress: reverted to best — the run ended having LOST capability: ${endCap.findings.join('; ')}`
+                        : `  ↩ no-regress: reverted to best (end gate score ${endScore.toFixed(2)} < best ${baselineGateScore.toFixed(2)})`));
                 disposeSnapshot(regressSnapshot);
             }
             catch (restoreErr) {