@miller-tech/uap 2.11.0 → 2.16.2

package/tools/agents/scripts/anthropic_proxy.py

@@ -662,6 +662,48 @@ _DOUBLING_FAIL_RE = re.compile(
     re.IGNORECASE,
 )
 
+# ---------------------------------------------------------------------------
+# LOCKSTEP ESCALATION guardrail: the SAME tool call failing with the SAME
+# error, over and over -- the intersection of DOUBLING-DOWN (identical
+# fingerprint) and ERROR-LOOP (identical failure signature). Those two guards
+# used to split this case against itself: DOUBLING-DOWN yielded ("ERROR-LOOP
+# owns the lockstep case") while ERROR-LOOP's remedy assumes a failing FILE to
+# re-read, which is wrong for tool-misuse loops (a remote command that can
+# never succeed). Observed live (2026-09-25): one ssh/docker/python call
+# re-issued 27 times -- ~15 min of full-context prefills at 100% GPU, three
+# ignored re-read nudges -- before the ERROR-LOOP hard stop finally fired.
+#
+# Lockstep owns the case and escalates decisively: a PIVOT directive at
+# PROXY_LOCKSTEP_PIVOT_AT, a final warning one fire later, and a hard stop
+# (400 + loop-incident record) at PROXY_LOCKSTEP_HARD_AT. Both directives are
+# always given before the stop, so with the defaults the stop lands at
+# max(HARD_AT, PIVOT_AT+2) -- never earlier. A fresh human user turn re-arms
+# the guard, mirroring ERROR-LOOP. PROXY_LOCKSTEP_BREAK=off disables the
+# guard; PIVOT_AT=0 disables it too (the ladder has no entry point);
+# HARD_AT=0 disables only the hard stop (advisory tiers still fire).
+#
+# Dependency: the streaks lockstep reads are fed by the ERROR-LOOP and
+# DOUBLING-DOWN trackers, so PROXY_ERROR_LOOP=off or PROXY_DOUBLING_BREAK=off
+# silently disarms lockstep as well. Fail-safe direction, but operator-visible
+# in the docs.
+PROXY_LOCKSTEP_BREAK = os.environ.get("PROXY_LOCKSTEP_BREAK", "on").lower() not in {
+    "0", "off", "false", "no",
+}
+PROXY_LOCKSTEP_PIVOT_AT = int(os.environ.get("PROXY_LOCKSTEP_PIVOT_AT", "2"))
+PROXY_LOCKSTEP_HARD_AT = int(os.environ.get("PROXY_LOCKSTEP_HARD_AT", "4"))
+
+# Loop-incident ledger: every lockstep escalation tier appends one JSONL
+# record so `uap loops` can show what looped, how hard, and hand the incident
+# to `uap ideate` / `uap deliver` for resolution. Best-effort telemetry -- the
+# proxy never fails a request over it. "" disables; the default honors
+# XDG_CONFIG_HOME like the rest of the UAP config layout.
+_LOOP_INCIDENT_DEFAULT = os.path.join(
+    os.environ.get("XDG_CONFIG_HOME") or os.path.expanduser("~/.config"),
+    "uap",
+    "loop-incidents.jsonl",
+)
+UAP_LOOP_INCIDENTS = os.environ.get("UAP_LOOP_INCIDENTS", _LOOP_INCIDENT_DEFAULT)
+
 PROXY_TOOL_STATE_MACHINE = os.environ.get(
     "PROXY_TOOL_STATE_MACHINE", "on"
 ).lower() not in {
@@ -1360,6 +1402,12 @@ PROXY_DISABLE_THINKING_ALWAYS = os.environ.get(
 # switches, the tool-turn breakers, the JSON-verdict grammar, the empty-response
 # retry and every assistant prefill/continuation.
 #
+# SUPERSEDED 2026-09-21: that backend is not what runs. The local engine is
+# buun-llama-cpp with --jinja, which ACCEPTS chat_template_kwargs (verified
+# with a live 200 carrying enable_thinking). The capability probe below is why
+# the engine change needed no code change at all — it adapts instead of
+# assuming. The incident above is kept as the record of why the probe exists.
+#
 # 'auto' (default) probes the upstream once and remembers; 'on'/'off' pin it for
 # an operator who knows their backend and does not want the probe.
 PROXY_CHAT_TEMPLATE_KWARGS = os.environ.get(
@@ -1544,7 +1592,11 @@ async def _reconcile_wire_model(openai_body: dict) -> None:
 
     THE BUG THIS FIXES, measured 2026-08-19. llama.cpp ignores the OpenAI
     `model` field entirely, so for years the proxy could forward whatever the
-    client asked for. ninfer-serve VALIDATES it. With the local-only sentinel
+    client asked for. ninfer-serve VALIDATES it. (SUPERSEDED 2026-09-21: the
+    backend is llama.cpp again, which ignores the field — both `qwen3.8-27b`
+    and the real alias return 200. This reconciliation is now belt-and-braces
+    rather than load-bearing, and stays because the next engine may validate
+    again.) With the local-only sentinel
     (ANTHROPIC_PASSTHROUGH_MODELS=__local_only__ -- the shipped systemd default)
     EVERY advertised id is served locally, including the four `claude-*` ones,
     and every one of them came back:
@@ -2396,6 +2448,13 @@ class SessionMonitor:
     doubling_streak: int = 0  # consecutive FAILED retries of that same call
     doubling_break_fires: int = 0  # monotonic count of injected pivot directives
     last_doubling_obs: str = ""  # msg-count:fingerprint key of the last counted observation
+    lockstep_fires: int = 0  # lockstep escalation directives injected this streak
+    lockstep_blocks: int = 0  # monotonic count of lockstep hard stops (400s) served
+    # Streak depth at which the last lockstep tier fired. A client retry resends
+    # an IDENTICAL trailing transcript (5xx, stream abort), which without this
+    # would re-inject the directive and re-append a ledger record per retry.
+    lockstep_last_fire_streak: int = 0
+    session_id: str = ""  # owning session id (set by get_session_monitor)
     mandate_deliver_fires: int = 0  # monotonic count of forced deliver-routings (mandate)
     mandate_deliver_active: bool = False  # THIS turn is pinned to deliver (beats recon convergence)
     tool_starvation_streak: int = 0  # Consecutive forced turns with no tool_calls produced
@@ -3260,6 +3319,7 @@ def get_session_monitor(session_id: str) -> SessionMonitor:
         monitor = SessionMonitor(context_window=default_context_window)
         session_monitors[session_id] = monitor
 
+    monitor.session_id = session_id
     monitor.touch()
     if monitor.context_window <= 0:
         monitor.context_window = default_context_window
@@ -6234,7 +6294,7 @@ def openai_to_anthropic_request(openai_body: dict) -> dict:
                     elif isinstance(block, str):
                         blocks.append({"type": "text", "text": block})
 
-            for tc in msg.get("tool_calls", []) or []:
+            for tc in msg.get("tool_calls") or []:
                 fn = tc.get("function", {})
                 try:
                     args = json.loads(fn.get("arguments", "{}") or "{}")
@@ -7261,6 +7321,226 @@ def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> N
     logger.warning("STUCK-BREAK: forced terminal turn (%s, fires=%d)", reason, monitor.stuck_break_fires)
 
 
+def _lockstep_streak(monitor: "SessionMonitor") -> int:
+    """Depth of the identical-call-identical-failure lockstep.
+
+    DOUBLING-DOWN tracks consecutive failed retries of one fingerprint;
+    ERROR-LOOP tracks consecutive recurrences of one error signature. When both
+    climb together the loop is provably deterministic -- the same input
+    produces the same failure -- so the lockstep depth is the shallower of the
+    two (either signal resetting breaks the lockstep)."""
+    if not PROXY_LOCKSTEP_BREAK:
+        return 0
+    if not monitor.doubling_fp:
+        return 0
+    return min(monitor.doubling_streak, monitor.error_signature_streak)
+
+
+def _lockstep_active(monitor: "SessionMonitor") -> bool:
+    """True when the lockstep ladder owns this turn. ERROR-LOOP and
+    DOUBLING-DOWN consult this to yield rather than stack a second (and, for
+    ERROR-LOOP's file-centric remedy, actively wrong) directive."""
+    return (
+        PROXY_LOCKSTEP_BREAK
+        and PROXY_LOCKSTEP_PIVOT_AT > 0
+        and _lockstep_streak(monitor) >= PROXY_LOCKSTEP_PIVOT_AT
+    )
+
+
+def _record_loop_incident(monitor: "SessionMonitor", outcome: str, detail: str) -> None:
+    """Append one JSONL record to the loop-incident ledger. Best-effort: the
+    proxy never fails a request over telemetry.
+
+    Deliberately lossy -- the fingerprint is hashed and tool ARGUMENTS are
+    never written. The observed loops run remote shells whose command lines
+    can carry tokens, URLs, and credentials; `uap loops` needs the SHAPE of
+    the loop (tool, error signature, streak), not its payload.
+
+    The ledger grows ~3 records per loop episode (pivot / final / hard stop);
+    there is deliberately no rotation -- a wedged session hard-stops instead
+    of streaming records. The file is created 0600 (normalized error
+    fragments can still name internal hosts/services) and opened O_NOFOLLOW
+    so a symlink at the path is refused race-free."""
+    path = UAP_LOOP_INCIDENTS
+    if not path:
+        return
+    try:
+        if os.path.islink(path):
+            logger.warning(
+                "loop-incident ledger is a symlink -- refusing to append (%s)", path
+            )
+            return
+        parent = os.path.dirname(path)
+        if parent:
+            os.makedirs(parent, mode=0o700, exist_ok=True)
+        fp = monitor.doubling_fp or ""
+        record = {
+            "v": 1,
+            "ts": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            "guard": "lockstep",
+            "outcome": outcome,
+            "session": (monitor.session_id or "")[:64],
+            "tool": "+".join(sorted(_fingerprint_tool_names(fp)))[:80],
+            "fingerprint": hashlib.sha1(fp.encode("utf-8", "replace")).hexdigest()[:12]
+            if fp
+            else "",
+            "error_signature": (monitor.last_error_signature or "")[:200],
+            "streak": _lockstep_streak(monitor),
+            "doubling_streak": monitor.doubling_streak,
+            "error_signature_streak": monitor.error_signature_streak,
+            "fires": monitor.lockstep_fires,
+            "blocks": monitor.lockstep_blocks,
+            "detail": (detail or "")[:200],
+        }
+        fd = os.open(
+            path,
+            os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0),
+            0o600,
+        )
+        with os.fdopen(fd, "a", encoding="utf-8") as fh:
+            fh.write(json.dumps(record, ensure_ascii=False) + "\n")
+    except Exception as exc:
+        logger.warning("loop-incident ledger append failed (non-fatal): %s", exc)
+
+
+def _maybe_lockstep_escalate(openai_body: dict, monitor: "SessionMonitor") -> None:
+    """Decisive escalation for the identical-call-identical-failure loop.
+
+    Owns the lockstep case the older guards split against themselves (see the
+    knob block for the 2026-09-25 incident: 27 identical ssh calls, ~15 min of
+    full-context prefills, three ignored re-read nudges). The ladder:
+    PIVOT_AT  -> inject a pivot directive (name the deterministic failure,
+                 demand genuinely different approaches, take one);
+    one fire later -> a final warning that the next recurrence hard-fails;
+    HARD_AT   -> raise ErrorLoopHardBlock (served as a 400) and record the
+                 incident for `uap loops`. A fresh human user turn re-arms,
+                 mirroring ERROR-LOOP. Advisory tiers do not touch tool_choice:
+    the model should keep acting, just never with THAT call again."""
+    streak = _lockstep_streak(monitor)
+    if streak < PROXY_LOCKSTEP_PIVOT_AT or PROXY_LOCKSTEP_PIVOT_AT <= 0:
+        # The lockstep broke (a different call, a new error, or a clean
+        # result): reset the ladder so the NEXT loop climbs it from the pivot
+        # tier instead of inheriting "directives ignored" from a previous,
+        # resolved loop.
+        monitor.lockstep_fires = 0
+        monitor.lockstep_last_fire_streak = 0
+        return
+    # Recon-convergence may strip tools / force a terminal summary this turn;
+    # a "take a different approach now" directive would contradict it. Mirrors
+    # DOUBLING-DOWN's yield.
+    if monitor.recon_convergence_pending():
+        return
+    # Deliberately NO yield to STUCK-BREAK: its repeat-call signal is
+    # continuously true during exactly the loop this guard owns, so yielding
+    # would suppress the decisive tier in the target incident shape. The
+    # directives are complementary anyway -- both demand abandoning the
+    # identical call -- and lockstep's diagnosis steps are prose-doable on a
+    # tool-stripped turn.
+    tool = (monitor.doubling_fp or "").split("|", 1)[0].split(":", 1)[0] or "tool"
+    if (
+        PROXY_LOCKSTEP_HARD_AT > 0
+        and streak >= PROXY_LOCKSTEP_HARD_AT
+        and monitor.lockstep_fires >= 2
+    ):
+        if _has_fresh_user_turn(openai_body):
+            monitor.lockstep_fires = 0
+            monitor.lockstep_last_fire_streak = 0
+            logger.warning(
+                "LOCKSTEP: human turn after %d hard stop(s) -- guard re-armed",
+                monitor.lockstep_blocks,
+            )
+            return
+        monitor.lockstep_blocks += 1
+        # Refuse EVERY retry (that is the hard stop) but record the incident
+        # once per new depth -- a client retrying the refused request resends
+        # the identical transcript and must not spam the ledger.
+        if streak > monitor.lockstep_last_fire_streak:
+            monitor.lockstep_last_fire_streak = streak
+            _record_loop_incident(monitor, "hard_blocked", f"{tool} x{streak}")
+        raise LockstepHardBlock(
+            "LOOP-ESCALATE hard stop: the identical "
+            + tool
+            + " call has now failed "
+            + str(streak)
+            + " times with the identical error, and both pivot directives were "
+            "ignored. Retrying a deterministic failure cannot work, so the "
+            "proxy refuses to burn another full-context prefill on this loop "
+            "(operator policy PROXY_LOCKSTEP_HARD_AT="
+            + str(PROXY_LOCKSTEP_HARD_AT)
+            + "). The incident was recorded to the loop ledger -- run "
+            "`uap loops` to inspect it and hand it to `uap ideate` / "
+            "`uap deliver`, or send a normal user message to re-arm the guard. "
+            "Failing signature: \""
+            + monitor.last_error_signature[:120]
+            + "\""
+        )
+    # Duplicate observation of an already-addressed depth: the client resent
+    # the same trailing transcript. The directive for this depth is already in
+    # the conversation; injecting again would stack copies per retry.
+    if monitor.lockstep_fires > 0 and streak <= monitor.lockstep_last_fire_streak:
+        return
+    if monitor.lockstep_fires == 0:
+        outcome = "pivot"
+        directive = (
+            "\n\nLOOP-ESCALATE -- the identical "
+            + tool
+            + " call has failed "
+            + str(streak)
+            + " times with the IDENTICAL error: \""
+            + monitor.last_error_signature[:120]
+            + "\". Retrying this exact call CANNOT work -- the failure is "
+            "deterministic, so do not issue it again. Switch strategy now:\n"
+            "1. State in one sentence WHY the call fails (quote the decisive "
+            "line of the error).\n"
+            "2. List 2-3 genuinely different approaches -- a different tool, a "
+            "different target, or a smaller verifiable step.\n"
+            "3. Take the most promising one on your next tool turn -- or, if "
+            "tools are unavailable this turn, state the choice now.\n"
+            "If no alternative exists, stop and report the blocker in one "
+            "sentence instead of retrying."
+        )
+    else:
+        outcome = "final_warning"
+        # Accurate deadline: the stop lands at max(HARD_AT, the turn both
+        # directives have been given), so phrase from the knob rather than
+        # promising "once more" when HARD_AT sits further out.
+        if streak + 1 >= PROXY_LOCKSTEP_HARD_AT:
+            deadline = "If the same call with the same error recurs once more"
+        else:
+            deadline = (
+                "If the same call keeps failing through streak "
+                + str(PROXY_LOCKSTEP_HARD_AT)
+            )
+        directive = (
+            "\n\nFINAL WARNING -- the identical failing "
+            + tool
+            + " call was retried AGAIN after the pivot directive. "
+            + deadline
+            + ", the proxy HARD-FAILS this session (400) and records the loop "
+            "incident for `uap loops`. Choose one of the alternatives you "
+            "listed, or stop and report the blocker."
+        )
+    monitor.lockstep_fires += 1
+    monitor.lockstep_last_fire_streak = streak
+    _record_loop_incident(monitor, outcome, f"{tool} x{streak}")
+    msgs = openai_body.get("messages")
+    if not isinstance(msgs, list):
+        msgs = []
+    if msgs and msgs[0].get("role") == "system":
+        msgs[0]["content"] = (msgs[0].get("content") or "") + directive
+    else:
+        msgs.insert(0, {"role": "system", "content": directive.strip()})
+    openai_body["messages"] = msgs
+    logger.warning(
+        "LOCKSTEP: %s injected (%s x%d, sig=%r, fires=%d)",
+        outcome,
+        tool,
+        streak,
+        monitor.last_error_signature[:80],
+        monitor.lockstep_fires,
+    )
+
+
 class ErrorLoopHardBlock(Exception):
     """A session kept re-hitting the SAME tool_result error after
     PROXY_ERROR_LOOP_HARD_LIMIT injected re-read nudges. The /v1/messages
@@ -7268,6 +7548,12 @@ class ErrorLoopHardBlock(Exception):
     prefills instead of being nudged yet again."""
 
 
+class LockstepHardBlock(ErrorLoopHardBlock):
+    """The LOCKSTEP ladder's terminal tier. Subclasses ErrorLoopHardBlock so
+    the single existing 400 handler serves it unchanged; the distinct type
+    lets that handler attribute the stop to the right guard."""
+
+
 def _has_fresh_user_turn(openai_body: dict) -> bool:
     """True when the request's LAST message is a human user turn (text), not a
     tool_result chain. In an unattended tool loop the tail is always a tool
@@ -7304,6 +7590,11 @@ def _maybe_inject_error_loop_break(openai_body: dict, monitor: "SessionMonitor")
     the guard."""
     if not PROXY_ERROR_LOOP:
         return
+    # LOCKSTEP owns the identical-call-identical-error case: its ladder is
+    # faster and its directive correct (pivot to a different approach, not
+    # re-read a file that may not exist). Yield rather than stack directives.
+    if _lockstep_active(monitor):
+        return
     if monitor.error_signature_streak < PROXY_ERROR_LOOP_THRESHOLD:
         return
     if (
@@ -7435,6 +7726,10 @@ def _maybe_inject_doubling_break(openai_body: dict, monitor: "SessionMonitor") -
     should, reason = monitor.should_force_doubling_break()
     if not should:
         return
+    # LOCKSTEP owns the identical-call-identical-error case (faster ladder,
+    # harder stop); only the varied-error doubling shape remains here.
+    if _lockstep_active(monitor):
+        return
     # STUCK-BREAK (a self-aware loop wanting a prose exit) is more urgent.
     stuck, _ = monitor.should_force_stuck_break()
     if stuck:
@@ -8619,6 +8914,12 @@ def build_openai_request(
 
     _maybe_inject_stuck_break(openai_body, monitor)
 
+    # LOCKSTEP ESCALATION: the identical call failing with the identical error.
+    # Runs before ERROR-LOOP/DOUBLING-DOWN, which yield to it -- its ladder
+    # (pivot -> final warning -> hard stop + loop-incident record) is decisive
+    # where their nudges drifted for 27 turns on 2026-09-25.
+    _maybe_lockstep_escalate(openai_body, monitor)
+
     # ERROR-LOOP: same tool_result failure recurring despite varied edits.
     _maybe_inject_error_loop_break(openai_body, monitor)
 
@@ -11441,7 +11742,7 @@ def _build_safe_text_openai_response(
                 },
             }
         ],
-        "usage": openai_resp.get("usage", {}),
+        "usage": openai_resp.get("usage") or {},
     }
 
 
@@ -11463,7 +11764,7 @@ def _build_clean_guardrail_openai_response(
                 },
             }
         ],
-        "usage": openai_resp.get("usage", {}),
+        "usage": openai_resp.get("usage") or {},
     }
 
 
@@ -11656,7 +11957,7 @@ async def _apply_malformed_tool_guardrail(
     # Option 2: Log garbled argument content for diagnostics
     arg_excerpt = ""
     if issue.kind == "invalid_tool_args":
-        for tc in (working_resp.get("choices", [{}])[0].get("message", {}).get("tool_calls", [])):
+        for tc in (working_resp.get("choices", [{}])[0].get("message", {}).get("tool_calls") or []):
             raw_args = tc.get("function", {}).get("arguments", "")
             if raw_args and _is_garbled_tool_arguments(raw_args):
                 arg_excerpt = raw_args[:200].replace("\n", " ")
@@ -11683,7 +11984,7 @@ async def _apply_malformed_tool_guardrail(
     # Track failing tool names for tool narrowing on retry
     failing_tools: set[str] = set()
     if issue.kind == "invalid_tool_args":
-        for tc in (working_resp.get("choices", [{}])[0].get("message", {}).get("tool_calls", [])):
+        for tc in (working_resp.get("choices", [{}])[0].get("message", {}).get("tool_calls") or []):
             fn_name = tc.get("function", {}).get("name", "")
             raw_args = tc.get("function", {}).get("arguments", "")
             if fn_name and raw_args and _is_garbled_tool_arguments(raw_args):
@@ -11794,7 +12095,7 @@ async def _apply_malformed_tool_guardrail(
             monitor.invalid_tool_call_streak += 1
             monitor.arg_preflight_rejections += 1
             # Track failing tools from retries for progressive narrowing
-            for tc in (retry_working.get("choices", [{}])[0].get("message", {}).get("tool_calls", [])):
+            for tc in (retry_working.get("choices", [{}])[0].get("message", {}).get("tool_calls") or []):
                 fn_name = tc.get("function", {}).get("name", "")
                 raw_args = tc.get("function", {}).get("arguments", "")
                 if fn_name and raw_args and _is_garbled_tool_arguments(raw_args):
@@ -12668,7 +12969,7 @@ def openai_to_anthropic_response(
         content.append({"type": "text", "text": sanitized_text})
 
     # Convert tool calls
-    for tc in message.get("tool_calls", []):
+    for tc in message.get("tool_calls") or []:
         fn = tc.get("function", {})
         try:
             args = json.loads(fn.get("arguments", "{}"))
@@ -12735,7 +13036,7 @@ def openai_to_anthropic_response(
         "function_call": "tool_use",
     }
 
-    usage = openai_resp.get("usage", {})
+    usage = openai_resp.get("usage") or {}
 
     _log_non_stream_resp(content, finish, usage)
 
@@ -13754,7 +14055,24 @@ async def count_tokens(request: Request):
             media_type="application/json",
         )
     est = estimate_total_tokens(body)
-    scale = _count_tokens_scale()
+    # This endpoint has no session contextvar, but the client sends the same
+    # profile header here as on /v1/messages — so the session's real window is
+    # recoverable from the request itself. Without this the scale is computed
+    # from the shared pool and a profile-capped client is told to compact at a
+    # point it can never reach.
+    _profile_window = 0
+    # getattr: this endpoint is also driven directly by tests with a minimal
+    # request stub, and a missing header map must degrade to "no profile",
+    # never raise.
+    _prof = _resolve_profile_name(getattr(request, "headers", {}) or {}, body)
+    if _prof:
+        _cfg = _load_profile_config(_prof)
+        if _cfg and _cfg.get("context_window"):
+            try:
+                _profile_window = int(_cfg["context_window"])
+            except (TypeError, ValueError):
+                _profile_window = 0
+    scale = _count_tokens_scale(_profile_window)
     if scale > 1.0:
         scaled = int(est * scale)
         # Once per scale value, explain the discrepancy an operator would
@@ -13768,7 +14086,7 @@ async def count_tokens(request: Request):
                 "fires at ~%d real tokens, before the pruner",
                 scale,
                 PROXY_CLIENT_ASSUMED_WINDOW,
-                _effective_context_window(),
+                _profile_window or _effective_context_window(),
                 int(PROXY_CLIENT_ASSUMED_WINDOW * 0.925 / scale),
             )
         return {"input_tokens": scaled}
@@ -13778,12 +14096,50 @@ async def count_tokens(request: Request):
 _count_scale_logged: float = 0.0
 
 
-def _count_tokens_scale() -> float:
+def _scale_window() -> int:
+    """The window compaction forcing should be computed against.
+
+    The per-SESSION window when one is in force, else the process default.
+
+    This used to be `_effective_context_window()` unconditionally, which is the
+    process-wide value detected from /slots. That silently broke the moment a
+    session carried a profile that capped it BELOW the detected rail, because
+    the two numbers then disagree and only one of them bounds the session:
+
+        detected rail  229376   (shared pool, -np 2 + --kv-unified)
+        profile cap    114688   (what the session may actually use)
+        compact fires  123060   computed from the RAIL -> ABOVE the cap
+        prune fires     80282   computed from the CAP
+
+    Compaction became unreachable and the pruner — designed as a backstop —
+    became the only context manager. That is a real loss, not a wash: the
+    client's compaction writes an LLM summary, while a prune drops the messages
+    and leaves a short breadcrumb list. Resolving the session window first
+    restores the intended ordering (compact ~61.5k, then prune at 80.2k).
+    """
+    try:
+        sid = _current_request_session.get()
+    except LookupError:
+        sid = None
+    if sid:
+        mon = session_monitors.get(sid)
+        win = getattr(mon, "context_window", 0) if mon else 0
+        if win and win > 0:
+            return int(win)
+    return _effective_context_window()
+
+
+def _count_tokens_scale(window_override: int = 0) -> float:
     """Resolve the count_tokens compaction-forcing scale (>= 1.0; 1.0 = off).
 
     "auto" derives it from the LIVE rail each call so a rail resize (server
     restart with a different --ctx-size) re-tunes the client's compact point
     without a proxy restart.
+
+    `window_override` lets a caller that knows the session's window — the
+    count_tokens endpoint, which resolves it from the request's own profile
+    header — supply it directly, since that endpoint runs outside the
+    request-session contextvar that `_scale_window` reads.
     """
     raw = PROXY_COUNT_TOKENS_SCALE.strip().lower()
     if raw in ("", "off", "none", "0", "1", "1.0"):
@@ -13793,7 +14149,7 @@ def _count_tokens_scale() -> float:
             return max(1.0, float(raw))
         except ValueError:
             return 1.0
-    window = _effective_context_window()
+    window = window_override if window_override > 0 else _scale_window()
     if window <= 0:
         return 1.0
     frac = (
@@ -14117,9 +14473,11 @@ async def messages(request: Request):
             profile_grammar=profile_grammar,
         )
     except ErrorLoopHardBlock as exc:
+        lockstep = isinstance(exc, LockstepHardBlock)
         logger.error(
-            "ERROR-LOOP hard stop served (blocks=%d): %s",
-            monitor.error_loop_blocks,
+            "%s hard stop served (blocks=%d): %s",
+            "LOOP-ESCALATE" if lockstep else "ERROR-LOOP",
+            monitor.lockstep_blocks if lockstep else monitor.error_loop_blocks,
             str(exc)[:160],
         )
         return Response(
@@ -14984,7 +15342,7 @@ async def chat_completions(request: Request):
             yield f"data: {json.dumps(content_chunk)}\n\n".encode()
 
         # Tool call chunks
-        for idx, tc in enumerate(message.get("tool_calls", []) or []):
+        for idx, tc in enumerate(message.get("tool_calls") or []):
             tc_chunk = {
                 "id": resp_id,
                 "object": "chat.completion.chunk",

package/tools/agents/scripts/confidence_escalation.py

@@ -50,7 +50,7 @@ class Settings:
     allow_self_judge: bool = False
     #: Backend width: how many generations the upstream serves CONCURRENTLY.
     #: None = UNKNOWN, which must change nothing (not every backend can be
-    #: probed -- ninfer serves no /slots endpoint -- so silence is not evidence).
+    #: probed -- some engines serve no /slots endpoint, and a probe can fail -- so silence is not evidence).
     #: A FIELD rather than a process-env read at decision time: select_recipe is
     #: called per request and an ambient UAP_MODEL_SLOTS=1 (which is exactly what
     #: writeProxyEnv now puts in proxy.env, and what _load_proxy_env_file
@@ -336,7 +336,9 @@ def select_recipe(anthropic_body: dict, settings: Settings, has_tools: bool) ->
     # N=3 costs 3x the wall clock of a single call for the same answer, and the
     # deliver run paying it has a fixed wall-clock budget to finish in.
     #
-    # Measured live (2026-08-20, ninfer --max-concurrency 1, qwen3.8-27b): tool
+    # Measured live on a ONE-RAIL backend (2026-08-20, --max-concurrency 1;
+    # that engine has since been replaced by llama.cpp with -np 2, so the
+    # downgrade now fires only when the probed width really is 1): tool
     # -carrying turns already bypass recipes via `has_tools` above, but mission
     # PLANNING carries no tools -- so it ran under fusion N=3 and took ~20 minutes,
     # 17% of a 120-minute run budget, before turn 1 existed.

package/tools/agents/scripts/project_telemetry.py

@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 """Per-project routing/cost telemetry for the shared UAP anthropic proxy.
 
 The proxy is a shared singleton that serves *every* project, so per-project

package/tools/agents/scripts/tool_risk.py

@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 """AutoMode pre-execution risk classification — advisory heuristic scorer.
 
 Uplift 1.3. Classifies each tool call BEFORE dispatch into one of five risk

package/tools/agents/scripts/tool_risk_calibrate.py

@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 """Calibration harness for the AutoMode advisory risk scorer (uplift 1.3).
 
 Loads the labeled corpus (tools/agents/tests/fixtures/tool_risk_cases.json),

package/tools/agents/scripts/toolcall_path_normalizer.py

@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 """Self-Harness middleware (proxy side) — conversation-aware tool-call path normalizer.
 
 The mechanical fix for the `toolcall.path.garbled` failure: a small quant

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -5335,7 +5335,10 @@ class TestModelsEndpoint(unittest.TestCase):
 
         # Local model — what the inference server actually serves. Tracks the
         # active model: qwen3.8-27b as of 2026-08-19, served by ninfer-serve
-        # (NOT llama.cpp). Requests for this ID route locally even with the
+        # then; as of 2026-09-21 the backend is buun-llama-cpp serving the alias
+        # qwen38-gsq-rco-27b. The id here still routes locally either way —
+        # llama.cpp ignores the OpenAI `model` field — which is the property
+        # under test. Requests for this ID route locally even with the
         # __local_only__ passthrough sentinel set.
         #
         # This assertion is about AGREEMENT with the backend, not about naming.
@@ -6186,5 +6189,53 @@ class TestSendStreamWithRetry(unittest.TestCase):
         self.assertEqual(client.requests[0]["url"], "http://x/v1/chat/completions")
 
 
+class TestNullToolCallsAndUsage(unittest.TestCase):
+    """tabbyAPI/exllamav3 serializes explicit nulls where llama.cpp omits the
+    keys entirely: "tool_calls": null and "usage": null. dict.get(key, default)
+    returns None for present-but-null keys, so every consumer must coerce with
+    `or []` / `or {}`. Regression coverage for the 2026-09-23 EXL3 cutover
+    500s (TypeError: 'NoneType' object is not iterable)."""
+
+    def test_null_tool_calls_treated_as_absent(self):
+        openai_resp = {
+            "choices": [{
+                "finish_reason": "stop",
+                "message": {"role": "assistant", "content": "hello", "tool_calls": None},
+            }],
+            "usage": {"prompt_tokens": 5, "completion_tokens": 3},
+        }
+        out = proxy.openai_to_anthropic_response(openai_resp, "qwen3.8")
+        self.assertEqual(out["stop_reason"], "end_turn")
+        self.assertEqual(out["content"], [{"type": "text", "text": "hello"}])
+
+    def test_null_usage_defaults_to_zero_counts(self):
+        openai_resp = {
+            "choices": [{
+                "finish_reason": "stop",
+                "message": {"role": "assistant", "content": "hi"},
+            }],
+            "usage": None,
+        }
+        out = proxy.openai_to_anthropic_response(openai_resp, "qwen3.8")
+        self.assertEqual(out["usage"]["input_tokens"], 0)
+        self.assertEqual(out["usage"]["output_tokens"], 0)
+
+    def test_null_tool_calls_and_null_usage_together(self):
+        # exact response shape observed from tabbyAPI non-streaming completions
+        openai_resp = {
+            "id": "chatcmpl-x",
+            "object": "chat.completion",
+            "choices": [{
+                "index": 0,
+                "finish_reason": "stop",
+                "message": {"role": "assistant", "content": "PROXYOK", "tool_calls": None},
+            }],
+            "usage": None,
+        }
+        out = proxy.openai_to_anthropic_response(openai_resp, "qwen3.8")
+        self.assertEqual(out["content"][0]["text"], "PROXYOK")
+        self.assertEqual(out["usage"]["output_tokens"], 0)
+
+
 if __name__ == "__main__":
     unittest.main()