The default `stella run` path and fleet workers assemble engines without token-drift calibration

[macanderson]

Problem

stella-cli assembles a session at seven call sites. Five seed the token-drift CalibrationMap from the store's prior drift samples; two never do.

Seeded:

• run_interactive — crates/stella-cli/src/agent.rs:758
• run_raw_one_shot — crates/stella-cli/src/agent/goal.rs:63
• run_goal_cmd — crates/stella-cli/src/agent/goal.rs:245
• Command Deck sessions — crates/stella-cli/src/command_deck.rs:348
• Deck sub-sessions — crates/stella-cli/src/subsession.rs:625

Never seeded:

• run_pipeline_one_shot (crates/stella-cli/src/agent.rs:232-684) — the default stella run path
• fleet workers (crates/stella-cli/src/fleet_cmd.rs:673-740)

Verify: rg -n 'seed_calibration' crates/stella-cli/src/ — no hit in run_pipeline_one_shot's assembly block (agent.rs:240-459) or anywhere in fleet_cmd.rs. PipelinePorts has no calibration field (rg -n calibration crates/stella-pipeline/src/ports.rs returns nothing; crates/stella-pipeline/src/pipeline.rs:2495 mentions calibration cohorts (#871) only in a comment), so the engines the pipeline drives run with un-seeded estimation.

What to establish first

Whether the pipeline's engine construction can consume a CalibrationMap at all. Two acceptable outcomes:

1. It should: thread the seeded map through the pipeline configuration so stella run and stella fleet get the same drift-informed estimates as the other five paths. Witness: a test that fails on main because the pipeline path's engines see an empty map while the store holds drift samples.
2. It deliberately does not: state the exemption in a comment at both assembly sites and in crates/stella-pipeline/README.md, so the asymmetry is a declared boundary instead of silent drift.

Constraints

• Found while designing Drink our own kool-aid: in-repo surfaces consume the workspace's public embedding APIs like a plugin host would #1557. Its B1 slice collapses the seven assembly sites onto stella-runtime's RuntimeBuilder, whose build() always seeds calibration (crates/stella-runtime/src/session.rs:117) — landing B1 would change this behavior implicitly, which is exactly why it must be decided and witnessed explicitly first (or in the same PR), never absorbed silently.
• crates/stella-cli/src/agent.rs is at its exact file-size ceiling (2270, scripts/file-size-baseline.txt) — a fix must be net-zero there or land in a submodule.

Definition of done

Either both paths seed and consume calibration with a witness test, or the exemption is documented at both sites and in the pipeline README. Refs #1557.

[macanderson]

Triage 2026-08-06: P1 (kept) — the default stella run path and fleet workers run with un-seeded token estimation while five other assembly sites seed it: silent behavioral drift on the most-used path, and a decision that must be made explicitly before #1557's B1 slice absorbs it implicitly. Plan: as specced in the body; next step is establishing whether PipelinePorts can carry a CalibrationMap at all, then either threading the seeded map through with the fails-on-main witness, or documenting the exemption at both assembly sites and in the pipeline README. Mind agent.rs at its exact ceiling — net-zero there or a submodule.

[macanderson]

Answered the question this issue asks first — "establish whether the pipeline's engine construction can consume a CalibrationMap at all".

It can. But the shape is constrained in a way that rules out the obvious implementation, so here is the design, plus one defect I did fix.

The obvious approach does not compile

Putting the map on PipelineConfig is the first thing anyone will try, and it cannot work:

• CalibrationMap derives Debug, Default — not Clone (crates/stella-core/src/estimator.rs:322).
• PipelineConfig derives Debug, Clone, Default (crates/stella-pipeline/src/pipeline.rs:432 for the hand-written Default).

An owned field would strip Clone from PipelineConfig, which many call sites rely on.

And that is not an accident of derives — it is the designed ownership. CalibrationMap's own doc says it:

the engine drives turns through &self — the caller owns the map across turns and hands the engine a shared reference, mirroring how BudgetGuard outlives individual turns.

The shape that fits

A borrowed field on Pipeline, mirroring the existing with_gate:

1. Pipeline gains calibration: Option<&'a CalibrationMap> and a with_calibration(...) builder — same pattern as turn_gate, which already proves the lifetime works.
2. Consumed at the four Engine::with_sleeper sites: pipeline.rs:1659, pipeline/fanout_stage.rs:273, pipeline/witness_stage.rs:292 and :408. Each becomes if let Some(c) = self.calibration { engine = engine.with_calibration(c); }.
3. Callers: agent.rs's run_pipeline_one_shot and fleet_cmd.rs's worker assembly already have a &store in scope, so both are seed_calibration(&store, cfg) plus one .with_calibration(&calibration).

Do all four engine sites, not just the execute turn. The witness author and the fan-out children are engines too, and seeding three of four would reproduce this issue's exact shape one level down.

God-file budget, since the issue flags it: agent.rs and fleet_cmd.rs are both at their ceilings and each needs ~2 lines, so plan for a sibling or a net-zero refactor there. pipeline.rs currently measures well under its recorded ceiling, but it is still on the closed-to-growth list — the field and builder are the kind of thing that belongs in a sibling module if it grows past a few lines.

Option 2 should not be taken

This issue offers "state the exemption" as an acceptable outcome. I do not think it is: there is no principled reason the engines behind the default stella run should estimate worse than the ones behind stella chat. Declaring that deliberate would be filing a bug as a feature, and #1557's B1 slice will silently fix it later anyway — which is precisely the implicit change this issue exists to prevent.

What I did fix — PR #1924

stella-parity's calibration.drift row declared its CLI mechanism as "seed_calibration from the store plus with_calibration on every driver path". That is false, and a capability matrix that is confidently wrong is worse than one marked unwitnessed — it is what a reviewer checks instead of the code.

The row now names which five paths seed and which two do not, and its missing field records that the absent CLI-side witness is exactly what would have caught the gap: the row was unwitnessed and wrong at the same time, and those are the same fact.

UNWITNESSED_BASELINE stays at 3. Promoting the row to Shipped is what closing this issue earns; doing it before the wiring exists would just re-tell the same lie in a stronger tense.

This issue stays open for the wiring itself.