@miller-tech/uap 1.217.0 → 1.219.0

package/docs/guides/QWEN36_LLAMACPP.md

@@ -172,43 +172,102 @@ overriding `enable_thinking=true`.
 Do **not** switch a Qwen profile to `embedded` — the model's own baked-in template
 still carries the `'System message must be at the beginning.'` raise.
 
-## Speculative decoding: what is running, and DFlash2
-
-Running today: `--spec-type draft-mtp`, reading the MTP head baked into `--model`
-(no drafter file). At `--spec-draft-n-max 2` a verification step accepts at most 3
-tokens; measured draft acceptance is 60-91%.
-
-**DFlash2 exists, fits this card at the current context tier, and is not
-installed.** Measured 2026-08-20 on the RTX 3090, holding `--parallel 2` and
-131072 ctx/slot fixed:
-
-| | |
-|---|---|
-| Engine | [llama.cpp#27342](https://github.com/ggml-org/llama.cpp/pull/27342), **open, not merged**. One commit (`5ecbe1ac1`, ~676 LOC). Cherry-picks onto our build commit `f466cfa38` with **zero conflicts** — our tree is 29 commits ahead of the PR base — and builds clean for `sm_86`. |
-| Drafter | [z-lab/Qwen3.8-27B-DFlash2-GGUF](https://huggingface.co/z-lab/Qwen3.8-27B-DFlash2-GGUF), built for this exact target. Q4_K_M 1.1 GB / Q8_0 2.0 GB. Published acceptance length 5.39 / 5.13. |
-| Why v1 can't be used instead | The merged `draft-dflash` v1 engine cannot load a v2 checkpoint. Both declare `general.architecture = "dflash"`, so auto-detect selects `draft-dflash` and then fails: the v2 GGUF carries 23 conv/selector tensors and `dflash.conv_*` / `dflash.selector_*` metadata keys v1 has no loader for. A rebuild is mandatory; there is no config-only path. |
-
-VRAM, the constraint that decides it. The drafter is 5 layers with its **own 2048
-sliding window**, so its KV cache is ~80 MiB at f16 regardless of the target's
-131072 — the cost is essentially just weights:
-
-| | measured / computed |
-|---|---|
-| Free VRAM at 131072/slot, `--parallel 2` | ~1.9 GiB (`nvidia-smi`: 22607 / 24576 MiB) |
-| Q4_K_M drafter (weights + KV + buffers) | ~1.25 GiB → **fits**, ~0.7 GiB margin |
-| Q8_0 drafter | ~2.1 GiB → does not fit at this tier |
-
-So it does not require dropping context or slot count. The open question is
-throughput, not memory: the PR's own reviewers report degradation at `-np >= 2`
-— the setting this box runs — and the headline 5.x acceptance figures are
-single-stream on Blackwell / Apple M5, not `sm_86`. The honest test is a paired
-A/B at fixed `-np 2` and 131072/slot against `draft-mtp` as configured today.
-Until that measurement exists, `draft-mtp` stays.
-
-> Note: the VRAM table under *Measured: Qwen3.8-27B* below was recorded from
-> llama.cpp's own buffer accounting (~0.95 GiB free); the ~1.9 GiB here is
-> `nvidia-smi` free memory on the whole card. They measure different things —
-> use the smaller one for headroom decisions.
+## Speculative decoding: DFlash2 is the default
+
+`config/llama-profiles/qwen38-27b-dflash2.env` is the default profile as of
+2026-08-20. `qwen38-27b-mtp.env` is kept as the fallback — same model, same
+context, same slot count; only the speculative-decoding config differs.
+
+Measured on this card (RTX 3090, sm_86, temp 0, 4 prompts, 1032 tokens per arm,
+**same binary across arms** so the spec config is the only variable):
+
+| arm | aggregate tok/s | accept rate | tokens/verify step | |
+|---|---|---|---|---|
+| no speculation, `-np 1` | 41.3 | — | 1.00 | baseline |
+| `draft-mtp` n-max 2, `-np 1` | 59.3 | 93.6% | 2.68 | |
+| **DFlash2 n-max 4, `-np 1`** | **68.7** | 67.4% | 3.68 | **1.16×** |
+| `draft-mtp` n-max 2, `-np 2` | 66.0 | 92.5% | 2.67 | |
+| **DFlash2 n-max 4, `-np 2`** | **89.8** | 66.5% | 3.66 | **1.36×** |
+
+The `-np 2` rows are two *genuinely concurrent* requests — the production shape.
+Re-verified end-to-end through `run-llama-server-continuity.sh` with the shipped
+profile: **92.6 tok/s**, tool calls parsing, peak 23459 MiB.
+
+**Read `1.36×` as a blend, not a constant.** That run pushed 4 prompts through a
+2-slot pool, so the last prompt always finishes alone and the wall covers two
+different regimes. Decomposing it from the server's own `launch_slot_`/`release`
+timeline:
+
+| regime | `draft-mtp` | DFlash2 n-max 4 | ratio |
+|---|---|---|---|
+| both slots decoding | 76.4 tok/s | 130.3 tok/s | **1.71×** |
+| one request in flight on the 2-slot server | 57.9 tok/s | 60.4 tok/s | **1.04×** |
+| the measured 4-prompt burst (what `1.36×` reports) | 66.0 | 89.8 | 1.36× |
+
+So the gain is real but duty-cycle dependent: it is ~1.7× while both slots are
+busy and close to nothing when only one request is in flight. Add prompts to the
+burst and the headline drifts up toward 1.71×; remove them and it drifts down.
+The `-np 1` row above is a `--parallel 1` server, which this service never runs —
+for the single-request case on the real 2-slot server use the 1.04–1.2× range,
+not 1.16×.
+
+Two caveats on the numbers, both unclosed:
+
+* **Every measurement was taken at `temperature 0.0`**, while this profile serves
+  at `LLAMA_TEMP=0.7 / TOP_P=0.8 / TOP_K=20`. Greedy is the most favourable
+  setting for speculative decoding, and it flatters a 4-token block more than a
+  2-token one, so `1.36×` is an upper bound for the sampling that actually runs.
+* **Acceptance is strongly prompt-dependent for DFlash2 and flat for MTP.**
+  Across the six prompts ever run, DFlash2 ranged 0.40–0.95 and `draft-mtp` sat
+  in a 0.91–0.97 band. The two lowest-acceptance prompts (prose explanation) were
+  never run against `draft-mtp`, so the regime where DFlash2 could lose is
+  untested. `n-max 7 < n-max 4` is direct evidence that drafting cost dominates
+  once acceptance falls.
+
+Two results here are worth keeping, because both contradict what the upstream
+material predicts:
+
+* **DFlash2 does not degrade under concurrency on this card — it improves.** The
+  PR thread reports throughput collapsing at `-np >= 2`; here the advantage grows
+  from 1.16× to 1.36× going from one slot to two. Do not carry that assumption to
+  other hardware in either direction; measure it.
+* **`n-max 4` beats `n-max 7`** (76.7 vs 69.8 tok/s), even though n-max 7 accepts
+  a longer block (4.86 vs 3.87 tokens/step). Acceptance falls from 72% to 55% as
+  the block lengthens, so the extra drafting outruns what it buys. The drafter
+  card's published acceptance length of 5.39 is real but is not the throughput
+  optimum.
+
+### The cost, and when to roll back
+
+Peak VRAM in the production shape is **23459 / 24576 MiB — about 1.1 GiB free**.
+There is **no paired measurement of `draft-mtp` taken the same way**, so treat the
+drafter's marginal cost as un-measured rather than as the ~0.8 GiB the weights
+imply: the table above reports ~0.95 GiB free for `draft-mtp` at this same tier,
+which cannot both be true and leave DFlash2 roomier. Re-measure both profiles
+with one harness before relying on either figure. Note also that 23459 was
+sampled with `nvidia-smi` on a 1 s loop over a ~10 s run whose longest prefill
+was 540 tokens — it never exercised a long-context prefill on two slots, which is
+the real peak event at 131072/slot. The drafter's weights (Q4_K_M,
+1.1 GB) are essentially the whole difference: its KV cache stays around 80 MiB
+because it carries its own 2048-token sliding window rather than scaling with the
+target's 131072/slot. That is what lets this fit without cutting context or slots
+— and it is why `LLAMA_DRAFT_CTX_SIZE` must stay unset.
+
+This card has a history of *global* kernel OOM events selecting this service for
+its RSS. The GPU side is now thinner too. **If the server starts failing to load
+or dying, switch `~/.config/uap/llama-server.env` back to `qwen38-27b-mtp.env`
+before changing anything else** — that is what the fallback profile is for.
+
+### The engine is an unmerged PR
+
+[llama.cpp#27342](https://github.com/ggml-org/llama.cpp/pull/27342) is **open**.
+The build is a cherry-pick of `5ecbe1ac1` onto `f466cfa38` (zero conflicts),
+vendored as `config/llama-patches/dflash2-pr27342.patch` so it is reproducible if
+the build worktree is lost. The merged `draft-dflash` **v1** engine cannot
+substitute: a v2 checkpoint declares the same `general.architecture = "dflash"`,
+so auto-detect selects `draft-dflash` and then fails on the 23 conv/selector
+tensors and `dflash.conv_*` / `dflash.selector_*` metadata keys v1 has no loader
+for. Return to plain upstream master once the PR lands.
 
 ## Point UAP at it
 

package/docs/reference/CONFIGURATION_REFERENCE.md

@@ -42,24 +42,60 @@ uap config wizard               # interactive expert configurator (also: uap set
 | | |
 |---|---|
 | **Where** | `.uap.json` |
-| **Type** | enum (block \| advisory \| off) |
+| **Type** | enum (block \| advisory \| off \| escalate) |
 | **Default** | `block` |
 
-How the delivery gate treats a direct source edit outside `uap deliver`. `block` refuses it (exit 2), `advisory` warns but allows, `off` disables the gate. (The `UAP_ENFORCE_DELIVERY` env var overrides this at runtime.)
+How the delivery gate treats a direct source edit outside `uap deliver`. `block` refuses it (exit 2) and routes it to deliver; `escalate` lets direct edits land and routes to deliver only as an ESCALATION — after `delivery.escalateAfterFailures` consecutive gate failures, `delivery.escalateAfterEdits` edits to one file with no green gate, or a single change above `delivery.complexEditChars`; `advisory` warns but allows; `off` disables the gate. (The `UAP_ENFORCE_DELIVERY` env var overrides this at runtime.)
 
-**Recommendation:** `block` for hands-free/local-model work so every change is gated and verified; `advisory` when a capable human/Opus is driving and you want warnings without friction.
+**Recommendation:** `escalate` for everyday agent work: small and medium edits go straight to disk and are judged by the project's own build/test + the verify hooks, while deliver is reserved for complex multi-file work and for when direct editing is demonstrably not working. `block` only when EVERY change must pass the convergence loop (unattended hands-free runs); `advisory` when a capable human is driving.
 
 ### `delivery.localMode`
 
 | | |
 |---|---|
 | **Where** | `.uap.json` |
-| **Type** | enum (advisory \| deliver \| block) |
+| **Type** | enum (advisory \| deliver \| block \| escalate) |
 | **Default** | `advisory` |
 
-How local-model sessions are routed through delivery. `deliver` runs builds through the convergence loop; `block` forbids raw edits; `advisory` warns.
+How a local-model session resolves a `block` posture. `escalate` lets direct edits land and escalates to deliver on evidence (failed gates, churn, size); `deliver` routes every substantive edit through the convergence loop; `block` forbids raw edits; `advisory` warns.
 
-**Recommendation:** `deliver` when a local model does the writing (routes it through the verified loop); `advisory` for exploratory work.
+**Recommendation:** `escalate` when a local model does the writing — deliver becomes the escalation point instead of a tax on every small task; `deliver` only for unattended runs where each change must be converged; `advisory` for exploratory work.
+
+### `delivery.escalateAfterFailures`
+
+| | |
+|---|---|
+| **Where** | `.uap.json` |
+| **Type** | number |
+| **Default** | `2` |
+
+Escalate mode: after this many CONSECUTIVE verification failures (uap verify, the stop hook, or a build/test command observed by the hooks) since the last green gate, the next non-trivial direct source edit is refused and routed to `uap deliver` with the failure attached. 0 disables this trigger.
+
+**Recommendation:** Leave at 2: one failure is normal iteration; two in a row with no green in between is the signal that direct editing is not converging.
+
+### `delivery.escalateAfterEdits`
+
+| | |
+|---|---|
+| **Where** | `.uap.json` |
+| **Type** | number |
+| **Default** | `10` |
+
+Escalate mode: when one source file has been edited this many times with no green gate in between, the next edit to it escalates to `uap deliver` (thrashing guard). Any passing verification resets the count. 0 disables this trigger.
+
+**Recommendation:** Leave at 10 — generous enough for honest iteration, low enough to stop a model that is patching the same file line by line.
+
+### `delivery.complexEditChars`
+
+| | |
+|---|---|
+| **Where** | `.uap.json` |
+| **Type** | number |
+| **Default** | `6000` |
+
+Escalate mode: a single edit or whole-file write above this many characters (or a write that guts a substantial file) is treated as complex work and routed through `uap deliver` so it is verified rather than trusted blind. 0 disables this trigger.
+
+**Recommendation:** 6000 characters is roughly a whole module; anything that size deserves the convergence loop. Raise it for generated/vendored code, lower it for a weak executor.
 
 ### `deliver.escalateModel`
 
@@ -78,7 +114,7 @@ Stronger model id for deliver escalation ladders: repair passes, the phase-5 esc
 | | |
 |---|---|
 | **Where** | shell env |
-| **Type** | enum (block \| advisory \| off) |
+| **Type** | enum (block \| advisory \| off \| escalate) |
 | **Default** | `block` |
 
 Runtime override of the delivery gate read by the hooks/enforcers from the shell env. Takes precedence over `delivery.enforcement`.
@@ -217,7 +253,7 @@ Base URL of an OpenAI-compatible, image_url-capable endpoint used for aesthetic
 | **Type** | string |
 | **Default** | `` |
 
-Model id sent to the vision endpoint for aesthetic review (e.g. qwen36-35b-a3b-iq4xs).
+Model id sent to the vision endpoint for aesthetic review (e.g. qwen3.8-27b).
 
 **Recommendation:** Set by `uap setup` to your local vision model. Required for blocking vision review under `max` fidelity.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.217.0",
+  "version": "1.219.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -17,6 +17,24 @@ Escape hatches (always honored, even in block mode):
   - UAP_DELIVER_ACTIVE=1   set by the deliver loop for its own subprocesses
   - UAP_DELIVER_BYPASS=1   explicit operator override for a sanctioned manual edit
 
+ESCALATE mode (`delivery.enforcement: escalate`, or `delivery.localMode:
+escalate` for a local-model session under block): deliver is an ESCALATION
+POINT, not the path every edit is forced through. Ordinary source edits go
+straight to disk (the project's own build/test + the verify hooks judge them)
+and the gate routes to `uap deliver` only when the evidence says direct editing
+is not working or the change is too big to land unverified:
+
+  - failures : >= delivery.escalateAfterFailures (default 2) consecutive
+               verification failures since the last green gate
+  - churn    : one file edited >= delivery.escalateAfterEdits (default 10)
+               times with no green gate in between (thrashing)
+  - complex  : a single edit/write above delivery.complexEditChars (default
+               6000) or a whole-file rewrite that guts a substantial file
+
+The evidence lives in .uap/escalation-state.json, written by the
+escalation_tracker.py hook (uap verify / stop hook / build+test shell results)
+and cleared by any green verification or a landed deliver run.
+
 Exempt by construction: non-source files, docs/configs/scripts/policies, test
 files (deliver protects those itself), and tooling dot-dirs.
 """
@@ -277,12 +295,195 @@ def _is_local_model_session() -> bool:
 # Back-compat: UAP_DELIVER_LOCAL_ADVISORY=0 maps to "block".
 def _local_mode() -> str:
     m = os.environ.get("UAP_DELIVER_LOCAL_MODE", "").lower()
-    if m in {"advisory", "deliver", "block"}:
+    if m in {"advisory", "deliver", "block", "escalate"}:
         return m
     adv = os.environ.get("UAP_DELIVER_LOCAL_ADVISORY", "on").lower()
     return "advisory" if adv not in {"0", "off", "false", "no", ""} else "block"
 
 
+def _effective_mode() -> str:
+    """The gate posture for THIS operation: block | advisory | off | escalate.
+
+    `UAP_ENFORCE_DELIVERY` (config-authoritative via the policy gate) wins. A
+    local-model session under `block` is then resolved through
+    `UAP_DELIVER_LOCAL_MODE`: advisory -> advisory, escalate -> escalate,
+    deliver/block -> block (keep the route-through-deliver block).
+    """
+    mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
+    if mode == "block" and _is_local_model_session():
+        lm = _local_mode()
+        if lm in {"advisory", "escalate"}:
+            return lm
+    return mode
+
+
+# ── ESCALATE mode: evidence-driven routing ───────────────────────────────────
+ESCALATION_STATE_FILE = ".uap/escalation-state.json"
+
+
+def _delivery_cfg_int(root: Path, key: str, env: str, default: int) -> int:
+    """An integer budget from the environment, else `.uap.json` delivery.<key>."""
+    raw = os.environ.get(env)
+    if raw is not None:
+        try:
+            return max(0, int(raw))
+        except ValueError:
+            pass
+    try:
+        import json as _json
+        cfg_root = Path(os.environ.get("UAP_MAIN_ROOT") or root)
+        cfg = _json.loads((cfg_root / ".uap.json").read_text(encoding="utf-8"))
+        value = (cfg.get("delivery") or {}).get(key)
+        if isinstance(value, bool):
+            return default
+        if isinstance(value, (int, float)):
+            return max(0, int(value))
+    except Exception:
+        pass
+    return default
+
+
+def _escalation_state(root: Path) -> dict:
+    """The tracker's evidence, or an empty record. Evidence older than
+    UAP_DELIVER_ESCALATION_TTL_SEC (default 6h) is ignored: yesterday's red
+    build must not gate today's first edit."""
+    import json as _json
+    import time as _time
+    empty = {"failures": 0, "edits_since_green": {}, "last_failure": None}
+    try:
+        st = _json.loads((root / ESCALATION_STATE_FILE).read_text(encoding="utf-8"))
+        if not isinstance(st, dict):
+            return empty
+    except Exception:
+        return empty
+    try:
+        ttl = int(os.environ.get("UAP_DELIVER_ESCALATION_TTL_SEC", "21600"))
+    except ValueError:
+        ttl = 21600
+    # Age the FAILURE evidence by when it was recorded, not by the last edit:
+    # `updated` moves on every direct edit, which would keep a two-day-old red
+    # gate alive for as long as the agent keeps typing.
+    lf = st.get("last_failure") if isinstance(st.get("last_failure"), dict) else None
+    anchor = int((lf or {}).get("ts") or st.get("updated") or 0)
+    if ttl > 0 and int(_time.time()) - anchor > ttl:
+        return empty
+    st.setdefault("failures", 0)
+    st.setdefault("edits_since_green", {})
+    return st
+
+
+def _record_escalation_edit(root: Path, rel: str) -> None:
+    """Count a direct edit against the file's churn budget (best-effort)."""
+    import json as _json
+    import time as _time
+    path = root / ESCALATION_STATE_FILE
+    try:
+        st = _json.loads(path.read_text(encoding="utf-8")) if path.exists() else {}
+        if not isinstance(st, dict):
+            st = {}
+    except Exception:
+        st = {}
+    edits = st.get("edits_since_green") if isinstance(st.get("edits_since_green"), dict) else {}
+    edits[rel] = int(edits.get(rel, 0)) + 1
+    st["edits_since_green"] = edits
+    st.setdefault("failures", 0)
+    st["updated"] = int(_time.time())
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = path.with_suffix(".tmp")
+        tmp.write_text(_json.dumps(st, indent=1), encoding="utf-8")
+        os.replace(tmp, path)
+    except Exception:
+        pass
+
+
+def _escalation_trigger(root: Path, rel: str, changed: "int | None", *, size_known: bool = True):
+    """(kind, human detail) when this edit must escalate to deliver, else None.
+
+    Order matters: a failing build is the strongest evidence, then thrashing on
+    one file, then sheer size. `changed is None` with size_known means a
+    whole-file rewrite the cost model refused (gutting) -> complex."""
+    st = _escalation_state(root)
+    n_fail = int(st.get("failures") or 0)
+    fail_budget = _delivery_cfg_int(root, "escalateAfterFailures", "UAP_DELIVER_ESCALATE_FAILURES", 2)
+    if fail_budget > 0 and n_fail >= fail_budget:
+        lf = st.get("last_failure") or {}
+        detail = str(lf.get("detail") or "").strip().replace("\n", " | ")[:400]
+        src = str(lf.get("source") or "gate")
+        return ("failures", f"{n_fail} consecutive verification failure(s) since the last green gate (last: {src}: {detail or 'no detail'})")
+    edits = st.get("edits_since_green") or {}
+    n_edits = int(edits.get(rel, 0)) if isinstance(edits, dict) else 0
+    churn_budget = _delivery_cfg_int(root, "escalateAfterEdits", "UAP_DELIVER_ESCALATE_EDITS", 10)
+    if churn_budget > 0 and n_edits >= churn_budget:
+        return ("churn", f"'{rel}' has been edited {n_edits} times with no green gate in between")
+    if size_known:
+        big = _delivery_cfg_int(root, "complexEditChars", "UAP_DELIVER_COMPLEX_EDIT_CHARS", 6000)
+        if changed is None:
+            return ("complex", "a whole-file rewrite that replaces most of a substantial file")
+        if big > 0 and changed > big:
+            return ("complex", f"a {changed}-character change (budget {big}) — a whole module's worth")
+    return None
+
+
+def _escalation_block(rel: str, kind: str, detail: str, args: dict) -> None:
+    """Refuse the direct edit and hand the agent the deliver escalation, with
+    the evidence that triggered it. Terse and imperative on purpose (weak local
+    models retry or hallucinate completion on passive prose)."""
+    if kind == "failures":
+        msg = (
+            f"ESCALATE: {detail}. Direct edits are paused: editing '{rel}' again would repeat "
+            "what is not working. Call the `deliver` tool NOW with a one-line task that names the "
+            "failing gate and the fix (or run: uap deliver \"fix: <the failure>\"). Deliver "
+            "converges the change against the real gates; direct edits resume once it lands or "
+            "the gates go green. Do NOT retry this edit."
+        )
+        hint = f"fix the failing verification and make the gates green: {detail[:240]}"
+        intent = None
+    elif kind == "churn":
+        msg = (
+            f"ESCALATE: {detail} — you are thrashing. Stop patching it line by line. Call the "
+            "`deliver` tool with a one-line description of the INTENDED END STATE of this file "
+            "(what it must do, which tests must pass). Direct edits to it resume after a green "
+            "gate. Do NOT retry this edit."
+        )
+        hint = f"bring {rel} to a working state that passes the project gates"
+        intent = None
+    else:
+        msg = (
+            f"ESCALATE: this is {detail}. A change this size must land through the `deliver` "
+            "tool (or: uap deliver \"<one-line description>\") so it is verified against the "
+            "gates, not trusted blind. Your content is recorded as a replayable intent. Do NOT "
+            "retry this edit directly."
+        )
+        hint = f"implement the intended change to {rel}"
+        intent = {
+            k: v
+            for k, v in (
+                ("old_string", args.get("old_string", args.get("oldString"))),
+                ("new_string", args.get("new_string", args.get("newString"))),
+                ("content", args.get("content")),
+            )
+            if isinstance(v, str)
+        } or None
+    emit(False, msg, route="deliver", deliverHint=hint, editIntent=intent, escalation=kind)
+
+
+def _handle_escalate_edit(args: dict, rel: str, root: Path, changed: "int | None") -> None:
+    trig = _escalation_trigger(root, rel, changed)
+    if trig is not None:
+        _escalation_block(rel, trig[0], trig[1], args)
+        return
+    _record_escalation_edit(root, rel)
+    print(
+        f"[delivery-enforcement] escalate mode: direct edit to '{rel}' allowed "
+        f"({'whole-file' if changed is None else changed} chars). Verify with the project's "
+        "build/test; deliver is the escalation point after repeated gate failures or for "
+        "large multi-file work.",
+        file=sys.stderr,
+    )
+    emit(True, "escalate mode: direct edit allowed; deliver is the escalation point")
+
+
 BASH_OPS = {"Bash", "bash", "run_bash", "shell"}
 
 # The delivery gate's own state. The pending log is the replay queue for
@@ -295,7 +496,7 @@ BASH_OPS = {"Bash", "bash", "run_bash", "shell"}
 # match any destructive verb (or a truncating redirect) against any path under
 # `.uap/` that names deliver state — including the directory itself and globs.
 _DELIVER_STATE_PATH = (
-    r"(?:pending-deliver\.jsonl|deliver\.lock|deliver\.heartbeat"
+    r"(?:pending-deliver\.jsonl|deliver\.lock|deliver\.heartbeat|escalation-state\.json"
     r"|pending-[^\s'\"|;&]*|deliver\.[^\s'\"|;&]*|\*[^\s'\"|;&]*)"
 )
 _DELIVER_STATE_RM_RE = re.compile(
@@ -515,9 +716,17 @@ def _handle_bash(args: dict) -> None:
     m = _BASH_WRITE_RE.search(cmd)
     if m:
         target = m.group(1)
-        mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
-        if mode == "block" and _is_local_model_session() and _local_mode() == "advisory":
-            mode = "advisory"
+        mode = _effective_mode()
+        if mode == "escalate":
+            # Size is unknowable for a shell write; failures/churn still decide.
+            root = repo_root()
+            trig = _escalation_trigger(root, target, None, size_known=False)
+            if trig is not None:
+                _escalation_block(target, trig[0], trig[1], {})
+                return
+            _record_escalation_edit(root, target)
+            emit(True, "escalate mode: shell source write allowed; deliver is the escalation point")
+            return
         msg = (
             f"BLOCKED: do not write source via the shell ('{target}'). Writing files with "
             "a redirect/heredoc/sed/tee bypasses the delivery gate. To create or change "
@@ -604,7 +813,7 @@ def main() -> None:
     # testing the same code underneath it — tell it to WAIT. route:wait so the
     # autoroute stands down instead of enqueuing a duplicate.
     holder = _deliver_lock_holder(root)
-    if holder is not None and os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower() == "block":
+    if holder is not None and os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower() in {"block", "escalate"}:
         emit(
             False,
             f"WAIT: a `uap deliver` run (pid {holder}) is ALREADY in progress for this project and is "
@@ -618,6 +827,15 @@ def main() -> None:
         )
         return
 
+    # ESCALATE: direct edits land unless the evidence (failed gates, churn,
+    # size) says this change needs the convergence loop.
+    if _effective_mode() == "escalate":
+        changed = _changed_chars(args)
+        if changed is None:
+            changed = _write_cost(args, root)
+        _handle_escalate_edit(args, rel_posix, root, changed)
+        return
+
     # #3-F: terse, imperative, model-parseable. Weak local models otherwise
     # retry the blocked edit or hallucinate completion ("the files exist") when
     # the message is a passive explanation. State the exact next action.
@@ -649,8 +867,8 @@ def main() -> None:
         intent_payload = {
             k: v
             for k, v in (
-                ("old_string", args.get("old_string")),
-                ("new_string", args.get("new_string")),
+                ("old_string", args.get("old_string", args.get("oldString"))),
+                ("new_string", args.get("new_string", args.get("newString"))),
                 ("content", args.get("content")),
             )
             if isinstance(v, str)

package/templates/hooks/deliver_autoroute.py

@@ -120,8 +120,8 @@ def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set
     edit_intent = out.get("editIntent") or {
         k: v
         for k, v in (
-            ("old_string", args.get("old_string")),
-            ("new_string", args.get("new_string")),
+            ("old_string", args.get("old_string", args.get("oldString"))),
+            ("new_string", args.get("new_string", args.get("newString"))),
             ("content", args.get("content")),
         )
         if isinstance(v, str)