@miller-tech/uap 2.39.0 → 2.44.1

package/docs/benchmarks/PROMPT_UPLIFT_BLENDER.md

@@ -0,0 +1,161 @@
+# Prompt Uplift Field Study: a 2-bit Model Passes a Pixel Gate (2026-11)
+
+**Date:** 2026-11-12 · **Subject:** `abliterated-iq2_xs` on a frozen Blender build
+contract, driven by bespoke harness tooling (the repo's UAP install is 2.39.1; UAP
+supplies the memory store and worktree workflow here, not the harness — there is no
+uplift subsystem to attribute a result to)
+**Scope:** one measured prompt-uplift run against a frozen multi-gate acceptance
+contract, and the four transferable lessons it produced. This is a dated study, not
+a feature doc: the harness lives in the experiment repo, not here. It is an
+*uncontrolled field run* in the sense defined by
+[benchmarks/README.md](README.md) — one model, no control arm, prompt changed at every
+step — so it shows magnitude and mechanism, not causation; quote the paired harness for
+causal claims. For the evergreen mechanism the study informs, see
+[guides/DELIVER.md](../guides/DELIVER.md) (iterate against real completion gates) and
+[guides/LOCAL_MODELS.md](../guides/LOCAL_MODELS.md).
+
+## The experiment
+
+Task: write a Blender Python script that builds a rigged, animated, game-ready
+robot. Acceptance is two independent gates, and the model is asked to produce exactly
+one artifact, its build script:
+
+- **Structural gate** — 12 checks: exactly 19 bones, 4 clips, under 12k tris, feet
+  on the floor, weapon grip at the palm, every mesh bound to the rig, FBX
+  round-trip, and so on. Hash-pinned in `.uap/gate-lock.json` (`a519af41c595…`),
+  along with the human-readable contract `gates.md`.
+- **Visual gate** — 8 pixel-level checks over 36 rendered PNGs (4 clips × 3 keyframe
+  positions × 3 ortho cameras). Pixels are classified by HSV hue, so the gate reads
+  the render the way a reviewer would: is the weapon at the hand, are the feet on the
+  floor line, is any part floating off in space. Added after the lock file was
+  written, so it is pinned by recorded hash (`7672fece1d0e…`) rather than by
+  `gate-lock.json` — see the caveat under lesson 1.
+
+Model: `abliterated-iq2_xs` (a ~2-bit quantized small model), temp 0, **first attempt
+only, no repair turns**. Each stage is one prompt revision, scored by `prompt_sha`, so
+a score is attributable to an exact prompt.
+
+`n` counts scored attempts — every row in `.uap/uplift/results.jsonl` except the three
+`--dry-prompt` rows, which print the prompt and record no score. A build that crashes is
+scored 0, not excluded. `12/12` is the structural gate; `both gates` means 12/12 *and*
+8/8 on the same first attempt.
+
+| stage | prompt change | n | 12/12 | both gates | `sys` crashes |
+|-------|---------------|---|-------|------------|---------------|
+| bare | raw prompt | 5 | 0 | n/a (no visual gate) | 0 |
+| A-acceptance | 12-check contract + API crib sheet | 38 | 23 | n/a (no visual gate) | 0 |
+| B-visual | + render/visual gate | 3 | 3 | 0 (visual 3/8–4/8) | 0 |
+| B-visual-v2 | visual rules rewritten | 3 | 0 (all three builds crashed) | 0 | 0 |
+| B-visual-v3 | tightened geometry rules | 3 | 2 | **0** (visual 6/8 twice) | 0 |
+| B-visual-v4 | vertical limb chains, blade inside hand | 9 | 1 | **1** | 4 |
+| B-visual-v5 | verbatim import header + copied fix loop | 6 | **6** | **4 (67%)** | 0 |
+
+First-attempt rate at *both* gates went 0/3 → 1/9 → 4/6 across three prompt
+revisions, with no change to the model, the gates, or the temperature. v4's nine runs
+split four ways: 4 `sys` crashes, 3 reasoning truncations, 1 built-but-incomplete
+(11/12, 6/8), 1 clean pass.
+
+## Four lessons
+
+### 1. A gate the model can edit is not a gate
+
+The lock file states the rule in its own header: the model "may NOT edit these files.
+A hash mismatch fails the run." The runner copies the validator, the visual gate, the
+render script and `gates.md` fresh into each attempt workspace before the build runs,
+then executes the model's script there. That keeps the frozen originals in `tooling/`
+out of the way, but nothing enforces the header's sentence at runtime: the model's
+script runs as ordinary Blender Python with write access to its workspace, and the
+workspace sits inside the same repo as the originals. Integrity was therefore
+established *after* the fact: pinned hash matches live, and every workspace carried
+byte-identical gate copies (one distinct hash across all 63 validator and 24
+visual-gate copies).
+
+Be precise about the strength of that. The runner copies the gates but does not
+re-verify the hashes *inside* the run, and the workspace copy is writable, so the
+guarantee here is audit-after-the-fact rather than runtime enforcement. That is enough
+to make the pass rate falsifiable — a tampered gate would show up as a hash mismatch
+when checked — but it is not the same as a read-only mount or a pre-flight assertion.
+Closing that gap is cheap: recompute the workspace gate hashes after the model's
+script has written and before the gates execute, and score the attempt 0 on mismatch.
+Four `hashlib` calls in the runner turn "no tampering was found afterwards" into
+"tampering could not have helped". The transferable part stands either way: without a
+pinned verifier, a 67% pass rate is unfalsifiable, because the cheapest path to 12/12
+is editing the checker. This is the
+same `enforce, don't suggest` stance as everywhere else in UAP, applied to the verifier
+rather than the producer.
+
+### 2. Score the prompt, not the vibe
+
+Every run records `prompt_sha` alongside its score, and prompt files compose with
+`#extends <stage>` so a revision is a delta, not a rewrite. That is what made v4
+diagnosable: the geometry rules demonstrably worked (attempt 5 hit both gates,
+matching the offline geometry test that had been run before the stage shipped) while
+the stage as a whole regressed. Without per-revision attribution, "v4 is worse than
+v3" would have buried a working fix under an unrelated crash.
+
+### 3. A regression can be a missing word, not a wrong idea
+
+4 of 9 v4 runs died identically:
+
+```
+NameError: name 'sys' is not defined. Did you forget to import 'sys'?
+  argv = sys.argv
+```
+
+The composed prompt asks for an `argv` guard (`argv` appears 7 times) and never
+contains the words `import sys` — 0 occurrences in 43,382 characters. So the import is
+purely the model's own guess. Reading the generated headers confirms it: v3's three
+runs each happened to write `import bpy, sys, os`, while v4's four crashing runs wrote
+`import bpy` / `import math` / `from mathutils import …` and omitted `sys` — same
+instruction, different coin flip. v5 states the header as four lines to copy verbatim,
+`import sys` included, and the crash count went to 0/6 with the validator at 6/6.
+
+The transferable part: when a prompt asks for a construct, state the import or
+declaration that construct needs, as text to copy rather than prose to understand.
+Small models rewrite headers; they do not reliably infer them.
+
+### 4. Reasoning budget is a hard constraint, not a tuning knob
+
+Three v4 runs left reasoning on: the model spent 17k–27k reasoning characters before
+writing any code and hit `finish_reason=length` mid-table, at both 8k and 12k max
+tokens, producing an unterminated tuple and a `SyntaxError`. All three scored 0.
+
+The pattern holds across the whole log, not just v4. Of 67 scored runs, 15 had
+reasoning on and 52 had it off. Every one of the 52 reasoning-off runs finished with
+`finish=stop` — none truncated. All 8 truncated runs in the log had reasoning on, and
+all 8 scored 0. Reasoning on did not become safe at a bigger budget either: the 7
+reasoning-on runs that were given 32k–64k tokens did finish, and their best score was
+11/12 — no reasoning-on run in the log ever cleared the structural gate. Meanwhile v5,
+run with `--reasoning-effort none --max-tokens 12000`, scored 12/12 six times out of
+six. A truncated run is a budget misconfiguration, not a model failure, and the budget
+must be pinned in the invocation for scores to stay comparable across stages.
+
+## Where the last two failures sit
+
+Both remaining failures are single-rung and both are animation amplitude, not
+geometry. A walk cycle lifted the feet 17 px where the limit is 12; an attack pose
+rotated the blade edge-on so its pixels left the camera plane entirely (gap 999 means
+"no weapon pixels found in that frame", not "drifted a little").
+
+The structural gate measures the rest pose, so both builds pass 12/12 and fail the
+pixel gate. Its `feet-on-floor` rung reads the lowest world-Z of any `Foot*` vertex at
+`|z| <= 0.005` m — a static measurement — while the visual gate measures the lift in
+every rendered frame. That gap, a structural check that never exercises the animated
+state, is the argument for the visual gate existing at all.
+
+For scale, re-rendering the offline reference build (the hand-written geometry proof
+that shipped the v4/v5 rules) through the same pixel gate puts its peak foot lift at
+7 px and its island ratio at 0.088 of the bbox diagonal (limit 0.30); the four passing
+v5 runs land at 3–9 px. The failing walk cycle at 17 px is not marginally off — it is
+over twice the reference and 5 px past the limit, on the one rung it misses.
+
+## Reproduce
+
+Harness, prompts, findings, and per-attempt workspaces live in the experiment repo
+(`blender-test-1`): `tooling/uplift_runner.py`, `.uap/uplift/prompts/`,
+`.uap/uplift/FINDINGS-B-visual-v{4,5}.md`, `.uap/uplift/runs/`.
+
+```
+python3 tooling/uplift_runner.py --stage B-visual-v5 --attempt N \
+    --reasoning-effort none --max-tokens 12000
+```

package/docs/benchmarks/README.md

@@ -61,6 +61,7 @@ authoritative.
 | [Token Optimization](TOKEN_OPTIMIZATION.md) | Where the token savings come from |
 | [Accuracy Analysis](ACCURACY_ANALYSIS.md) | Success-rate and error analysis |
 | [Comprehensive Benchmarks](COMPREHENSIVE_BENCHMARKS.md) | Extended measurements |
+| [Prompt Uplift Field Study](PROMPT_UPLIFT_BLENDER.md) | Uncontrolled field run: prompt revisions only, one 2-bit model, frozen structural + pixel gates (0/3 → 4/6). Descriptive, no control arm |
 
 ## Task suites and raw runs
 

package/docs/guides/LOCAL_MODELS.md

@@ -171,6 +171,48 @@ For the full picture — the `uap proxy` lifecycle, the reliability guardrails
 that keep a small model from wedging, security, and serving recipes — see the
 **[Inference Proxy guide](PROXY.md)**.
 
+## Droid (Factory) custom models — auto-populated from the live arm
+
+Droid reads its model list from `customModels` in `~/.factory/settings.json`
+(user) and `<project>/.factory/settings.json` (project). Those entries are
+static per file — Droid does not discover local servers — so a backend swap
+would otherwise leave every Droid instance pinning a retired model id.
+
+[`scripts/sync-local-agent-configs.sh`](../../scripts/sync-local-agent-configs.sh)
+closes that gap, and never transcribes the alias: it reads the model id and
+geometry from `config/model-profiles/qwen38.json` (the same single source of
+truth the rails suite drift-checks against the live `/props` on :8080), then:
+
+- migrates every retired local id (the registry's `retired_local_aliases`
+  list — the single source, never transcribed into the script) onto the
+  alias the current arm serves — proxy entries to `:4000`, direct-Responses
+  entries stay on `:8080`;
+- **adds** the entry when a settings file has no local qwen model at all, so
+  every Droid instance (user-level settings cover all projects) can call it;
+- sizes entries to the profile's per-session cap (114688 via the proxy, the
+  131072 pool on the direct path) and the proxy tool-turn cap (32768);
+- pins `baseModelId` on Anthropic-protocol entries (default
+  `claude-sonnet-4-6`, override `DROID_ANTHROPIC_BASE_MODEL`) so the entry
+  inherits model-specific prompts, tools, and Script-mode eligibility instead
+  of the "custom model does not map to a built-in" fallback behavior.
+
+For "at any given time" freshness, run it with `MODELS_ONLY=1`: that mode
+converges **only** the `.factory` custom-model lists, takes the alias from the
+LIVE backend (`/props` on :8080, profile fallback when unreachable), and
+touches nothing else. The wiring is machine-local, not shipped:
+`.factory/` is gitignored, so the repo cannot carry the hook — wire it once
+per machine (project or user `.factory/settings.json`) as a `SessionStart`
+hook running exactly that, per [ADR
+0015](../architecture/adr/0015-session-hook-model-convergence-as-standing-consent.md),
+and every Droid session starts with the qwen list pointed at whatever arm is
+actually serving. `DRY_RUN=1` shows the plan; a run backs up only what it
+changes.
+
+```bash
+bash scripts/sync-local-agent-configs.sh          # full operator sync
+MODELS_ONLY=1 bash scripts/sync-local-agent-configs.sh   # droid lists only
+```
+
 ## Related
 
 - [Deploy Batching](./DEPLOY_BATCHING.md) — what `uap deliver --deploy` queues.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "2.39.0",
+  "version": "2.44.1",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lib/droid-sync-contracts.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+#
+# droid-sync-contracts.sh — SHARED CONTRACT for Droid (Factory) model sync.
+# -----------------------------------------------------------------------------
+# Every Droid/Factory instance — the user-level ~/.factory/config.json and
+# ~/.factory/settings.json AND the repo-level .factory/settings.json — must
+# auto-converge its customModels onto the LIVE local qwen3.8 backend instead
+# of drifting onto retired ids and stale hosts.
+#
+# This file is the single place the installer and the sandbox test agree on:
+# the variable names and their defaults. It is SOURCED (never executed) by
+# scripts/sync-local-agent-configs.sh and by scripts/test-sync-sandbox.sh, so
+# the installer and the assertions read ONE contract instead of two
+# transcriptions of it — a number or path transcribed in both places is
+# exactly the failure class that left the sandbox suite red through the
+# 1-rail era. The FUNCTION bodies live in sync-local-agent-configs.sh
+# (sync_droid_models / droid_sync_lock); the sandbox asserts them textually
+# against that file, so this contract stays free of dead stub code.
+#
+# CONTRACT RULES (this file is frozen once accepted):
+#   * Sourcing is SIDE-EFFECT FREE: no I/O, no mkdir, no network, no writes.
+#     Every value is a `: "${VAR:=default}"` assignment, so a caller may
+#     pre-set any of them (the sandbox does, to point at a throwaway $HOME)
+#     and the caller's value always wins.
+#   * Nothing here depends on bash features beyond 4.2.
+#
+# shellcheck shell=bash
+#
+
+# Double-source guard: the installer and the sandbox may both source this.
+if [ -n "${_UAP_DROID_SYNC_CONTRACTS_LOADED:-}" ]; then
+  return 0 2>/dev/null || true
+fi
+_UAP_DROID_SYNC_CONTRACTS_LOADED=1
+
+# ===========================================================================
+# SHARED VARIABLES — all overridable from the environment.
+# ===========================================================================
+
+# MODELS_ONLY — when "1", the sync touches ONLY the customModels/custom_models
+# arrays of the Droid config files. No service operations (systemctl/curl),
+# no proxy env requirement, no other agent configs. This is the mode the
+# auto-convergence session hook runs in: it must be safe to fire on every
+# session start, on any machine state.
+#   "0" (default) = full sync      "1" = customModels only
+: "${MODELS_ONLY:=0}"
+
+# REPO_ROOT — absolute path of the checkout the sync is running against.
+# Derived from this file's own location (scripts/lib/ -> repo root), never
+# from $PWD, so a hook fired from a subdirectory still resolves the repo
+# .factory/settings.json correctly. A caller (the installer, the sandbox)
+# may pre-set it to redirect the whole sync at a throwaway tree.
+: "${REPO_ROOT:=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+
+# PROJECT_FACTORY_SET — the repo-level Droid settings file whose customModels
+# must converge alongside the user-level ones. camelCase spelling
+# ("customModels"), same shape as ~/.factory/settings.json.
+: "${PROJECT_FACTORY_SET:=$REPO_ROOT/.factory/settings.json}"
+
+# DROID_ANTHROPIC_BASE_MODEL — the Factory BUILT-IN catalog id written into
+# `baseModelId` of anthropic-provider entries. A custom Anthropic-provider
+# model inherits that built-in's prompt/tool-call behavior; without it Droid
+# warns the entry "does not map to a built-in model". claude-sonnet-4-6 is the
+# choice because it accepts reasoning-effort "off" (the proxy sends none) and
+# speaks the Anthropic Messages class the :4000 proxy serves. This is NOT a
+# local model id — it must never carry a qwen id.
+: "${DROID_ANTHROPIC_BASE_MODEL:=claude-sonnet-4-6}"
+
+# DROID_SYNC_LOCK — lock file serialising concurrent Droid config writes
+# (session-start hook + manual installer run + a second Droid window).
+# Without it two writers read-modify-write the same JSON and one set of
+# customModels silently loses the other's update. Defaults under
+# $XDG_RUNTIME_DIR so it is per-user and per-boot; /tmp is the fallback for
+# environments without XDG_RUNTIME_DIR (containers, CI sandboxes).
+# $XDG_RUNTIME_DIR is per-user (0700 tmpfs); the /tmp fallback is
+# world-writable, so key it per-uid there or any local user could hold the
+# lock forever and silently disable convergence.
+if [ -n "${XDG_RUNTIME_DIR:-}" ]; then
+  : "${DROID_SYNC_LOCK:=$XDG_RUNTIME_DIR/uap-droid-sync.lock}"
+else
+  : "${DROID_SYNC_LOCK:=/tmp/uap-droid-sync-$UID.lock}"
+fi
+
+# ===========================================================================
+# FUNCTION CONTRACT (bodies live in sync-local-agent-configs.sh)
+# ===========================================================================
+# droid_sync_lock — acquire fd 9 on $DROID_SYNC_LOCK with `flock -n`.
+#   returns 0 = lock held for this script; 1 = another sync holds it.
+#
+# sync_droid_models <FILE> <CREATE> — converge ONE Droid config file.
+#   FILE   : a Droid settings.json (camelCase customModels) or legacy
+#            config.json (snake_case custom_models).
+#   CREATE : "1" = create the file (with the canonical entry) when absent —
+#            only settings targets use this; the legacy file is patched
+#            in place or left alone. "0" = patch only when present.
+#   Reads from the caller's scope: MODEL_ALIAS, PROXY_URL, DIRECT_URL,
+#   CTX_SESSION, CTX_POOL, MAX_OUTPUT, DROID_ANTHROPIC_BASE_MODEL,
+#   PROXY_TOKEN (via UAP_SYNC_TOKEN env), DRY_RUN.
+#   Migration rules (idempotent; no change => file left byte-identical):
+#     * entries whose model is a RETIRED local id — or already the live
+#       alias, or model-less but pointed at :4000/:8080 — converge onto
+#       MODEL_ALIAS;
+#     * route by existing shape: baseUrl with :8080 -> direct strata route
+#       (pool-sized); :4000 WITHOUT /v1 -> Anthropic Messages root (proxy
+#       root + baseModelId + apiKey only if absent, session-sized); anything
+#       else local -> proxy chat route ($PROXY_URL/v1 + token);
+#     * cloud models (anything else, including the :8317 router entries) are
+#       deliberate user choices and are never repointed;
+#     * a settings.json with NO local entry after migration gains the
+#       canonical proxy entry (add-if-missing);
+#     * the 192.168.1.165:8317 split-brain host is fixed everywhere;
+#     * writes are atomic (tmp file in the same directory + os.replace),
+#       under the flock, with backups taken by the caller's backup().
+#   returns 0 always (a per-file failure is a printed WARN, not an abort).

package/src/policies/enforcers/delivery_enforcement.py

@@ -193,16 +193,32 @@ def _trivial_edit_chars() -> int:
 
 def _changed_chars(args: dict) -> int | None:
     """Total changed characters for an Edit/MultiEdit, or None when it can't be
-    measured (e.g. a whole-file Write) — None means 'not trivially small'."""
+    measured (e.g. a whole-file Write) — None means 'not trivially small'.
+
+    Harnesses spell the anchor fields three ways: Claude Code sends
+    old_string/new_string, some SDKs oldString/newString, and Droid (Factory)
+    old_str/new_str. An unrecognized spelling measured as None — read as a
+    whole-file rewrite — which force-escalated every Droid Edit as complex
+    regardless of size (observed live 2026-11-12: a 4-line comment insert was
+    refused as 'a whole-file rewrite that replaces most of a substantial
+    file'). grab() recognizes all three spellings at both call sites."""
+    def grab(d: dict) -> tuple[object, object]:
+        old = d.get("old_string") or d.get("oldString") or d.get("old_str")
+        new = d.get("new_string") or d.get("newString") or d.get("new_str")
+        return old, new
     def pair(o: object, n: object) -> int:
         return len(str(o or "")) + len(str(n or ""))
     if "edits" in args and isinstance(args["edits"], list):
-        return sum(
-            pair(e.get("old_string") or e.get("oldString"), e.get("new_string") or e.get("newString"))
-            for e in args["edits"] if isinstance(e, dict)
-        )
-    old = args.get("old_string") or args.get("oldString")
-    new = args.get("new_string") or args.get("newString")
+        total, measured = 0, False
+        for e in args["edits"]:
+            if not isinstance(e, dict):
+                continue
+            old, new = grab(e)
+            if old is not None or new is not None:
+                measured = True
+                total += pair(old, new)
+        return total if measured else None
+    old, new = grab(args)
     if old is not None or new is not None:
         return pair(old, new)
     return None  # Write (full content) — not a trivial edit
@@ -232,7 +248,7 @@ def _write_cost(args: dict, root: Path) -> int | None:
     """
     content = args.get("content")
     if content is None:
-        content = args.get("new_string") or args.get("newString")
+        content = args.get("new_string") or args.get("newString") or args.get("new_str")
     if content is None:
         return None
     new_len = len(str(content))
@@ -460,8 +476,11 @@ def _escalation_block(rel: str, kind: str, detail: str, args: dict) -> None:
         intent = {
             k: v
             for k, v in (
-                ("old_string", args.get("old_string", args.get("oldString"))),
-                ("new_string", args.get("new_string", args.get("newString"))),
+                # Same three spellings as _changed_chars/_write_cost — an
+                # escalated Droid edit (old_str/new_str) must be recorded as a
+                # replayable intent, not silently dropped to None.
+                ("old_string", args.get("old_string") or args.get("oldString") or args.get("old_str")),
+                ("new_string", args.get("new_string") or args.get("newString") or args.get("new_str")),
                 ("content", args.get("content")),
             )
             if isinstance(v, str)
@@ -868,8 +887,11 @@ def main() -> None:
         intent_payload = {
             k: v
             for k, v in (
-                ("old_string", args.get("old_string", args.get("oldString"))),
-                ("new_string", args.get("new_string", args.get("newString"))),
+                # Same three spellings as _changed_chars/_write_cost — an
+                # escalated Droid edit (old_str/new_str) must be recorded as a
+                # replayable intent, not silently dropped to None.
+                ("old_string", args.get("old_string") or args.get("oldString") or args.get("old_str")),
+                ("new_string", args.get("new_string") or args.get("newString") or args.get("new_str")),
                 ("content", args.get("content")),
             )
             if isinstance(v, str)

package/templates/hooks/pre-tool-use-bash.sh

@@ -14,8 +14,18 @@ fi
 # Read tool input from stdin (JSON)
 INPUT=$(cat)
 
-# Extract command from tool_input
-CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
+# Extract command from tool_input, with bounded retries. Under a full
+# parallel suite (or a busy box) a jq spawn can fail transiently, and a
+# fail-open on that would silently allow exactly the edits this guard
+# exists to block — measured as the recurring jq '.version = "9.9.9"'
+# semver-suite flake (3 strikes on 2026-11-12: two CI runs, one local).
+# Fail-open stays the LAST resort for genuinely unparseable input.
+CMD=""
+for _attempt in 1 2 3 4 5; do
+  CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
+  [ -n "$CMD" ] && break
+  sleep 0.05
+done
 
 # If we can't determine the command, fail open
 if [ -z "$CMD" ]; then
@@ -178,7 +188,28 @@ fi
 # That is a READ. Splitting on ; && || | and newline keeps every real edit
 # (each has sed/awk/jq and package.json inside one statement) and drops the
 # cross-statement coincidence. Verified against both corpora before and after.
-if printf '%s' "$CMD" | tr ';|&\n' '\n\n\n\n' | grep -qE "(sed|awk).*package\.json.*(version|\"version\")|((sed|awk).*version.*package\.json)|(jq.*\.version.*package\.json)"; then
+#
+# Evaluated with BUILT-INS ONLY: parameter expansion for the statement split,
+# [[ =~ ]] for the match. An earlier `printf | tr | grep -qE` pipeline looked
+# equivalent but had a load-shaped hole: in an `if` condition a grep that fails
+# to spawn (exit 2/126/127 under fork pressure) is indistinguishable from a
+# no-match (exit 1), so the rule silently failed OPEN under the full parallel
+# suite — the canary still refused, so it looked like a genuine allow. That was
+# the recurring semver-suite flake (3 strikes on 2026-11-12: two CI runs, one
+# local version-bump gate). Zero forks here means no spawn can hiccup, and no
+# pipeline stage can mask a match.
+_semv_split="${CMD//[;|&]/$'\n'}"
+_semv_a='(sed|awk).*package\.json.*version'
+_semv_b='(sed|awk).*version.*package\.json'
+_semv_c='jq.*\.version.*package\.json'
+_semv_hit=""
+while IFS= read -r _semv_stmt; do
+  if [[ "$_semv_stmt" =~ $_semv_a || "$_semv_stmt" =~ $_semv_b || "$_semv_stmt" =~ $_semv_c ]]; then
+    _semv_hit="yes"
+    break
+  fi
+done <<< "$_semv_split"
+if [ -n "$_semv_hit" ]; then
   echo "BLOCKED [semver-versioning]: Manual package.json version edits are prohibited. Use: npm run version:patch, version:minor, or version:major. See policies/semver-versioning.md" >&2
   exit 2
 fi

package/templates/hooks/stop.sh

@@ -233,10 +233,49 @@ if [ "$CODE_CHANGED" = "true" ] && [ "${UAP_VERIFY_ON_STOP:-1}" != "0" ] && comm
     fi
   fi
   set -e
+  # A green verify (or a gate that never ran) resets the consecutive-block
+  # counter below — a fresh red streak starts from zero.
+  if [ "$VERIFY_RC" = "0" ]; then
+    rm -f "${PROJECT_DIR}/.uap/stop-gate/blocks" 2>/dev/null || true
+  fi
   # RC 1 = a REAL gate failure (code is broken) → block. Everything else fails
   # OPEN: RC 3 = infra (gate timed out / couldn't spawn), 124 = outer timeout,
   # 127 = missing, any other = internal — none should ever wedge a session.
   if [ "$VERIFY_RC" = "1" ]; then
+    # Bounded consecutive-block relief. The re-entrancy guard at the top
+    # relents only when the harness sends stop_hook_active:true (the Claude
+    # Code contract). Harnesses that send no Stop payload (observed: Factory
+    # Droid on pay2u, 2026-10-18) never trip that guard, so a persistently-red
+    # gate — e.g. max-fidelity interaction fail-closed on a repo with entry
+    # pages but no manifest — became an unbounded Stop→continue→Stop loop:
+    # exactly the wedge this hook's fail-open design promises cannot happen.
+    # Count consecutive RC-1 blocks per project; relent (allow the stop, with
+    # the red verdict still on record) after UAP_STOP_BLOCK_LIMIT (default 3).
+    # A block older than an hour starts a fresh count: the counter tracks a
+    # LOOP, not history — a new session gets a fresh budget.
+    mkdir -p "${PROJECT_DIR}/.uap/stop-gate" 2>/dev/null || true
+    BLOCK_FILE="${PROJECT_DIR}/.uap/stop-gate/blocks"
+    BLOCK_COUNT=0
+    BLOCK_TS=0
+    if [ -f "$BLOCK_FILE" ]; then
+      BLOCK_COUNT="$(head -1 "$BLOCK_FILE" 2>/dev/null || echo 0)"
+      BLOCK_TS="$(tail -1 "$BLOCK_FILE" 2>/dev/null || echo 0)"
+    fi
+    case "$BLOCK_COUNT" in ''|*[!0-9]*) BLOCK_COUNT=0 ;; esac
+    case "$BLOCK_TS" in ''|*[!0-9]*) BLOCK_TS=0 ;; esac
+    NOW="$(date +%s 2>/dev/null || echo 0)"
+    case "$NOW" in ''|*[!0-9]*) NOW=0 ;; esac
+    if [ "$NOW" -gt 0 ] && [ "$((NOW - BLOCK_TS))" -gt 3600 ]; then
+      BLOCK_COUNT=0
+    fi
+    BLOCK_LIMIT="${UAP_STOP_BLOCK_LIMIT:-3}"
+    case "$BLOCK_LIMIT" in ''|*[!0-9]*) BLOCK_LIMIT=3 ;; esac
+    if [ "$BLOCK_COUNT" -ge "$BLOCK_LIMIT" ]; then
+      echo ""
+      echo "## RUNTIME/USER-PATH GATE still red after $BLOCK_COUNT consecutive blocks — allowing stop so the session cannot wedge. The verdict above stays on record; fix the failure in a follow-up session. (Bound: UAP_STOP_BLOCK_LIMIT=$BLOCK_LIMIT; full bypass: UAP_VERIFY_ON_STOP=0.)"
+      exit 0
+    fi
+    printf '%s\n%s\n' "$((BLOCK_COUNT + 1))" "$NOW" > "$BLOCK_FILE" 2>/dev/null || true
     echo ""
     echo "## RUNTIME/USER-PATH GATE FAILED — the code does not run or does not work for a real user"
     echo "$VERIFY_OUT"

package/tools/agents/scripts/anthropic_proxy.py

@@ -1621,11 +1621,23 @@ PROXY_EMPTY_TOOL_LOOP_BREAK = int(
 # ever-growing transcript (observed: ctx 936%, model emits tool_calls 18/min
 # despite tool_choice=auto). After this many consecutive turns at/above the
 # ratio, strip tools entirely so the only possible response is a terminal text
-# summary (end_turn), which ends the client's agentic loop. Ratio is set high
-# enough that only a true runaway trips it — a merely-full session tops out near
-# 100-130%, never 300%. 0 disables.
+# summary (end_turn), which ends the client's agentic loop.
+#
+# Ratio sits above the merely-full band but inside the runaway band. A
+# merely-full session tops out near 100-141%: a client that honestly believes
+# a ~200k window (PROXY_CLIENT_ASSUMED_WINDOW) and compacts at 92.5% sends at
+# most ~185k against a 131,072 rail. A window-blind runaway plateaus wherever
+# its own belief caps it, and that plateau can sit far below 300%: live
+# 2026-11-06 (droid + flash-next, cognition-engine), a client with no
+# maxContextLimit (assumed 250k) ramped 132% -> 198% in 4 minutes and then sat
+# at 190-198% for 4+ HOURS — every turn CRITICAL-PRUNEd blind to ~6 messages
+# (~24-40k actually sent upstream), findings evaporating, the model re-reading
+# the same files — because the 3.0 gate was written for 936% runaways and this
+# one never crossed 200%. 1.6 clears the merely-full band (141% plus one
+# ~19k-token turn of headroom) while ending that class of treadmill within
+# STREAK turns. 0 disables.
 PROXY_RAW_CTX_FINALIZE_RATIO = float(
-    os.environ.get("PROXY_RAW_CTX_FINALIZE_RATIO", "3.0")
+    os.environ.get("PROXY_RAW_CTX_FINALIZE_RATIO", "1.6")
 )
 PROXY_RAW_CTX_FINALIZE_STREAK = int(
     os.environ.get("PROXY_RAW_CTX_FINALIZE_STREAK", "2")

package/tools/agents/tests/test_delivery_enforcement_write_complexity.py

@@ -94,6 +94,32 @@ class WriteComplexityTest(unittest.TestCase):
         self.assertEqual(small[0], 0, small[1])
         self.assertEqual(big[0], 2, big[1])
 
+    def test_droid_edit_spelling_is_measured_the_same(self):
+        # Droid (Factory) sends old_str/new_str. Before 2026-11-12 those
+        # spellings measured as None — "whole-file rewrite" — so EVERY Droid
+        # Edit escalated as complex regardless of size. Same sizes as the
+        # Claude-spelling case must get the same verdicts.
+        root = project()
+        target = os.path.join(root, "src", "thing.ts")
+        small = run(root, {"file_path": target, "old_str": "a" * 20, "new_str": "b" * 20}, op="Edit")
+        big = run(root, {"file_path": target, "old_str": "a" * 300, "new_str": "b" * 300}, op="Edit")
+        self.assertEqual(small[0], 0, small[1])
+        self.assertEqual(big[0], 2, big[1])
+
+    def test_multiedit_droid_spelling_sums_across_edits(self):
+        root = project()
+        target = os.path.join(root, "src", "multi.ts")
+        code_ok, out_ok = run(root, {"file_path": target, "edits": [
+            {"old_str": "a" * 20, "new_str": "b" * 20},
+            {"old_str": "c" * 20, "new_str": "d" * 20},
+        ]}, op="MultiEdit")
+        code_big, _ = run(root, {"file_path": target, "edits": [
+            {"old_str": "a" * 200, "new_str": "b" * 200},
+            {"old_str": "c" * 200, "new_str": "d" * 200},
+        ]}, op="MultiEdit")
+        self.assertEqual(code_ok, 0, out_ok)
+        self.assertEqual(code_big, 2)
+
     def test_nature_exemptions_are_unchanged(self):
         root = project()
         docs = run(root, {"file_path": os.path.join(root, "docs", "n.md"), "content": "x" * 9000})