amicus 4.4.0 → 4.4.1

package/src/council/parse-stage2.js

@@ -35,7 +35,15 @@ function parseJudgeOutput(text, { labels, findingIds }) {
   const errors = [];
   const known = new Set(labels);
   const flat = [];
-  if (!Array.isArray(parsed.ranking) || parsed.ranking.length === 0) {
+  // ⚠️ v4.4.1 FINAL-REVIEW C. `JSON.parse('null')` SUCCEEDS — it returns null and
+  // throws nothing — so a body of literal `null` sailed past the catch above and
+  // `parsed.ranking` threw `TypeError: Cannot read properties of null`. parseDebateDefense
+  // (:129) and parseRevote (:167) below already carried this `!parsed` guard; the judge
+  // path and findings.js's validateFindings did not, which made it an asymmetry among
+  // five consumers of one extractor rather than a new rule. Guarded on BOTH derefs so
+  // a `null` body reports exactly what a keyless `{}` body already reported —
+  // BAD_RANKING + BAD_ADJUDICATIONS — and no new error code enters a repair prompt.
+  if (!parsed || !Array.isArray(parsed.ranking) || parsed.ranking.length === 0) {
     errors.push({ code: 'BAD_RANKING', detail: 'ranking must be a non-empty array of review labels' });
   } else {
     for (const slot of parsed.ranking) {
@@ -52,7 +60,7 @@ function parseJudgeOutput(text, { labels, findingIds }) {
   }
 
   const knownIds = new Set(findingIds);
-  if (!Array.isArray(parsed.adjudications)) {
+  if (!parsed || !Array.isArray(parsed.adjudications)) {   // see the `!parsed` note above
     errors.push({ code: 'BAD_ADJUDICATIONS', detail: 'adjudications must be an array' });
   } else {
     for (const a of parsed.adjudications) {

package/src/council/report.js

@@ -114,15 +114,26 @@ function renderMd(m) {
   for (const s of m.streetCred) { out.push(`| ${s.model} | ${fmtNum(s.peersOnly)} | ${fmtNum(s.withSelf)} |`); }
 
   out.push('\n## Findings by tier\n');
-  for (const t of TIER_ORDER) {
-    const group = m.findings.filter(f => f.tier === t);
-    if (!group.length) { continue; }
-    out.push(`### ${t}`);
-    for (const f of group) {
-      const dec = f.decision ? ` — ${f.decision}${f.applied ? ' (applied)' : ''}` : '';
-      out.push(`- **${f.id}** (${f.severity}, raiser ${f.raiser}) — a${f.basis.a}/d${f.basis.d}/n${f.basis.n}${dec}`);
+  // LC-10 fast-follow (review minor M3): m.findings can legitimately be EMPTY
+  // (every seat honestly reported nothing) — TIER_ORDER's four groups are then
+  // all empty too, and the loop below emits nothing, leaving this heading with
+  // no content beneath it before '## Cost'. Same heading-over-nothing class
+  // Task 3 closed in the Stage-2 prompts (buildJudgeBundle/buildChairPacket),
+  // human-facing here rather than model-facing. State the clean bench instead
+  // of leaving the heading to dangle.
+  if (!m.findings.length) {
+    out.push('_No findings were raised on this bench — a clean review is a valid review._\n');
+  } else {
+    for (const t of TIER_ORDER) {
+      const group = m.findings.filter(f => f.tier === t);
+      if (!group.length) { continue; }
+      out.push(`### ${t}`);
+      for (const f of group) {
+        const dec = f.decision ? ` — ${f.decision}${f.applied ? ' (applied)' : ''}` : '';
+        out.push(`- **${f.id}** (${f.severity}, raiser ${f.raiser}) — a${f.basis.a}/d${f.basis.d}/n${f.basis.n}${dec}`);
+      }
+      out.push('');
     }
-    out.push('');
   }
 
   // Defensive: never emit the heading unless at least one grouping has

package/src/council/run-assemble.js

@@ -40,13 +40,26 @@ function worseConformance(a, b) {
  * leg doc yields durationMs/usage null (never invent a value). `model` (the
  * council alias) overrides leg.model (the resolved executable id) so ledger
  * rows join meta.models by exact string (ledger.js:20-24).
+ *
+ * ⚠️ LC-11 / review F1: `findingsUnverified` and `repairRefused` are the same
+ * class of fact as `conformance` and ride the same row. They are the two halves
+ * of the repair contract's outcome: `findingsUnverified` marks a 'repaired' seat
+ * whose contract could NOT be checked (the original block was absent or
+ * unparseable, so there was no finding count to compare), and `repairRefused`
+ * ({code, detail}) marks the stronger case — the contract WAS checked and broken,
+ * which is otherwise indistinguishable from a seat that never emitted JSON at
+ * all. Both are additive and present only when set, so a run without either is
+ * byte-for-byte unchanged.
  */
-function buildRunStatsEntry({ leg, model, role, wasChair, conformance }) {
+function buildRunStatsEntry({ leg, model, role, wasChair, conformance, findingsUnverified,
+  repairRefused }) {
   return {
     model: model !== undefined ? model : (leg ? leg.model : null),
     role,
     wasChair: !!wasChair,
     conformance: conformance || 'clean',
+    ...(findingsUnverified ? { findingsUnverified: true } : {}),
+    ...(repairRefused ? { repairRefused } : {}),
     status: leg ? leg.status : 'error',
     durationMs: leg && typeof leg.durationMs === 'number' ? leg.durationMs : null,
     usage: (leg && leg.usage) || null,
@@ -139,6 +152,7 @@ function buildTallyInput({ runId, date, bench, chair, reviews, judgeResults, cha
   const rankings = okJudges.map(j => ({ judge: j.judge, order: j.order }));
   const runStats = reviews.map(r => buildRunStatsEntry({
     leg: r.leg, model: r.model, role: r.role, wasChair: false, conformance: r.conformance,
+    findingsUnverified: r.findingsUnverified, repairRefused: r.repairRefused,
   }));
   if (claudeReview) {
     meta.models.push(CLAUDE_SEAT);      // last, mirroring its review-N+1 label
@@ -176,7 +190,34 @@ function writeVerdictFiles({ runDir, record, overallVerdict, chairText }) {
   return verdict;
 }
 
+/**
+ * Build the chair packet and persist it as `chair-packet.md`. Lifted verbatim
+ * out of run.js for the 300-line gate (v4.4.1 Task 0.5) — same composition,
+ * same debate addendum, same file write.
+ * @param {{runDir: string, reviews: Array, claudeReview: object|null,
+ *   tallyInput: object, record: object, debateOutcomes: Array|null, date: string}} args
+ *   `tallyInput`/`record` are the DEBATED ones when --debate ran, the
+ *   provisional pair otherwise (run.js keeps that sequencing).
+ * @returns {string} the packet text (run.js hands it straight to runChair)
+ */
+function buildChairPacketFile({ runDir, reviews, claudeReview, tallyInput, record, debateOutcomes, date }) {
+  const { buildChairPacket } = require('./briefings-stage2');
+  const { buildDebateAddendum } = require('./briefings-debate');
+  const packet = buildChairPacket({
+    // §4.4: the chair sees Claude's de-anonymized review like any other; it casts
+    // no rankings/adjudications, so it appears ONLY as one more review block.
+    reviews: reviews.map(r => ({ model: r.model, text: r.text }))
+      .concat(claudeReview ? [{ model: 'claude', text: claudeReview.text }] : []),
+    rankings: tallyInput.rankings,
+    adjudications: tallyInput.adjudications,
+    tierCounts: record.tierCounts, date,
+  }) + (debateOutcomes ? '\n\n' + buildDebateAddendum({ outcomes: debateOutcomes }) : '');
+  fs.writeFileSync(path.join(runDir, 'chair-packet.md'), packet, { mode: 0o600 });
+  return packet;
+}
+
 module.exports = {
   buildRunStatsEntry, worseConformance, buildTallyInput, writeTallyFiles, writeVerdictFiles,
+  buildChairPacketFile,
   preflightClaudeReview, labelClaudeReview, claudeRunStatsRow, CLAUDE_SEAT,
 };

package/src/council/run-budget.js

@@ -24,6 +24,10 @@
  * UNDER-REPORTING, not "continuing in the presence of uncertainty" — and
  * nothing here converts uncertainty into a fabricated number in either
  * direction (no rounding unknown up to a guess, no rounding it down to zero).
+ *
+ * v4.4.1 CA-6 completes that posture at the EXIT CODE (see inexactUnderCeiling
+ * below): a ceiling never blocks, but a run under a ceiling no longer exits 0
+ * while publishing a total it knows is only a floor.
  */
 
 const { sumWaveUsage } = require('../utils/pricing');
@@ -40,7 +44,7 @@ const { sumWaveUsage } = require('../utils/pricing');
  * @returns {{spendState:Function, spent:Function, overBudget:Function,
  *   remainingBudget:Function, noticeUnknownSpend:Function, usageBlock:Function,
  *   addWave:Function, reserveBudget:Function, releaseBudget:Function,
- *   noteBudgetRefusal:Function, budgetRefusals:Function}}
+ *   noteBudgetRefusal:Function, budgetRefusals:Function, inexactUnderCeiling:Function}}
  */
 function createBudget({ allLegs, maxCost, runDir, degraded, write }) {
   const legs = allLegs || [];
@@ -155,10 +159,20 @@ function createBudget({ allLegs, maxCost, runDir, degraded, write }) {
   };
   const budgetRefusals = () => refusals.slice();
 
-  let noticed = false;
+  // ⚠️ v4.4.1 CA-3: a plain `noticed` boolean announced the FIRST unknown leg and
+  // silently swallowed every one created afterwards (Stage 2, repairs, debate,
+  // chair) — run.json kept the correct final count, so the data was right and
+  // only the announcement was wrong, which is exactly the failure mode the
+  // fail-loud posture exists to prevent. Track the count that was last announced
+  // instead, so a GROWING total re-announces while an unchanged one stays quiet:
+  // the notice keeps its "once per new fact" character without going silent on
+  // the later stages. (The alternative — deferring every notice to finalize() —
+  // was rejected: the notice exists to inform a decision still in flight.)
+  let noticedAt = -1;
   /**
-   * One prominent, un-missable notice per run when the total is incomplete — for
-   * EITHER reason, which are different statements and are worded differently:
+   * One prominent, un-missable notice each time the incomplete total GROWS (see
+   * `noticedAt` above; re-calling it with nothing new is silent) — for EITHER
+   * reason, which are different statements and are worded differently:
    *   - `unknownLegs`        — the leg reported no usage at all.
    *   - `subtreeUnknownLegs` — the leg's own cost is known, but it spawned a
    *     subagent whose CHILD session is billed separately and whose spend the
@@ -174,8 +188,9 @@ function createBudget({ allLegs, maxCost, runDir, degraded, write }) {
    */
   const noticeUnknownSpend = () => {
     const s = spendState();
-    if ((s.unknownLegs === 0 && s.subtreeUnknownLegs === 0) || noticed) { return; }
-    noticed = true;
+    const n = s.unknownLegs + s.subtreeUnknownLegs;
+    if (n === 0 || n === noticedAt) { return; }
+    noticedAt = n;
     const ceiling = hasCeiling ? ` or the $${maxCost} --max-cost ceiling` : '';
     const parts = [];
     if (s.unknownLegs > 0) {
@@ -185,10 +200,27 @@ function createBudget({ allLegs, maxCost, runDir, degraded, write }) {
       parts.push(`${s.subtreeUnknownLegs} council leg(s) spawned a subagent whose CHILD session spend `
         + 'is billed separately and could NOT be determined');
     }
-    emit(`Notice: ${parts.join('; and ')} and is NOT included in the $${s.known.toFixed(4)} `
-      + `total${ceiling}. Real spend is HIGHER than reported — this total is at least, not exactly, `
-      + 'what was spent. See run.json usage (unknownLegs / subtreeUnknownLegs), or '
-      + '`amicus spend --json` (sourceMix.unknown).\n');
+    // v4.4.1 A3: the counts are CUMULATIVE, and re-announcing a grown total
+    // ("1 council leg(s)…" then "4 council leg(s)…") reads as two separate
+    // findings that a reader can reasonably add up to five. "so far this run"
+    // says once, for both clauses, that each number is a running total.
+    emit(`Notice: so far this run, ${parts.join('; and ')} and is NOT included in the `
+      + `$${s.known.toFixed(4)} total${ceiling}. Real spend is HIGHER than reported — this total `
+      + 'is at least, not exactly, what was spent. See run.json usage (unknownLegs / '
+      + 'subtreeUnknownLegs), or `amicus spend --json` (sourceMix.unknown).'
+      // v4.4.1 CA-6: with a ceiling set, an inexact total is not a clean run — say
+      // so where the uncertainty is announced, so exit 2 is never a surprise.
+      //
+      // ⚠️ Review F2: hedged to "is on track to" rather than "will". This notice
+      // fires from noticeUnknownSpend(), which run.js calls immediately BEFORE
+      // the overBudget() check — so a run whose KNOWN spend also crosses the
+      // ceiling right here prints this sentence and then exits 1
+      // (COST_EXCEEDED), not 2. A signalled run exits 130/143. "Will" would be a
+      // guarantee this code cannot make; "is on track to" states the tendency
+      // that holds in the common case without promising an outcome decided
+      // later, downstream of this call.
+      + (hasCeiling ? ' Because a ceiling is set and this total is inexact, the run is on track '
+        + 'to exit degraded (2); the ceiling itself still never halts a run.' : '') + '\n');
   };
 
   /**
@@ -217,8 +249,29 @@ function createBudget({ allLegs, maxCost, runDir, degraded, write }) {
     };
   };
 
+  /**
+   * v4.4.1 CA-6 (OWNER RULING, 2026-07-26). Is a `--max-cost` ceiling in force
+   * over a total we already know to be incomplete?
+   *
+   * `--max-cost` bounds KNOWN spend: an unknown leg contributes nothing to it and
+   * never halts a run — see `overBudget` above, which this deliberately does NOT
+   * touch, and which must keep ignoring unknown legs. That policy is right and it
+   * stays. What was wrong was the REPORT. A run could exit 0 — read by every
+   * script and every human as "clean, and inside your ceiling" — while knowingly
+   * publishing a floor: `council-wsgate02` really spent $0.9859 against a $0.75
+   * ceiling (131%) while amicus believed $0.3720, and exited 0.
+   *
+   * So the exit code degrades to 2, through the SAME `degraded` channel
+   * `noteBudgetRefusal` already uses for a shrunken bench: the run finished, its
+   * answer is good, and the cost figure underneath it is not the whole bill.
+   * With NO ceiling there is nothing to be inexact against and the exit code is
+   * untouched — an unpriced leg on an unbounded run is a fact, not a degradation.
+   * @returns {boolean}
+   */
+  const inexactUnderCeiling = () => hasCeiling && !usageBlock().costExact;
+
   return { spendState, spent, overBudget, remainingBudget, noticeUnknownSpend, usageBlock,
-    addWave, reserveBudget, releaseBudget, noteBudgetRefusal, budgetRefusals };
+    addWave, reserveBudget, releaseBudget, noteBudgetRefusal, budgetRefusals, inexactUnderCeiling };
 }
 
 module.exports = { createBudget };

package/src/council/run-chair.js

@@ -129,7 +129,10 @@ async function runChair(ctx, { packet, degraded, statsFn, isSignalled }) {
   if (chairText && !overallVerdict && !overBudget()) {
     runState.appendStageWave(o.runDir, 'chair', `${o.runId}-ch4`);
     const repair = await launchers.launchSolo({
-      model: actualChair, prompt: stage2.buildChairRepairPrompt(),
+      // ⚠️ LC-12: the synthesis rides along. The chair leg SUCCEEDED — only the
+      // VERDICT line is missing — so a fresh repair session that cannot see the
+      // synthesis is picking a verdict on an artifact it has never read.
+      model: actualChair, prompt: stage2.buildChairRepairPrompt({ synthesis: chairText }),
       project: o.runDir, waveId: `${o.runId}-ch4`,
       timeout: o.timeout, gateway: o.gateway, noValidateModel: o.noValidateModel,
       noCostGate: o.noCostGate,

package/src/council/run-debate.js

@@ -95,7 +95,8 @@ async function runDefenseSolo(ctx, raiser, findings, idx) {
     runState.appendStageWave(ctx.o.runDir, 'debate-defense', repairId);
     const res2 = await ctx.launchers.launchSolo({
       ...legOpts(ctx, repairId), model: raiser,
-      prompt: dbrief.buildDefenseRepairPrompt({ errors: parsed.errors }),
+      // ⚠️ LC-12: a repair solo is a fresh session — the defense that failed rides along.
+      prompt: dbrief.buildDefenseRepairPrompt({ errors: parsed.errors, defense: leg.summary }),
     });
     ctx.addWave(res2.wave);
     if (isAbortExit(res2.exitCode)) { return { raiser, aborted: res2.exitCode }; }
@@ -144,7 +145,8 @@ async function runRevoteWave(ctx, judges, bundleFindings) {
       const repairId = `${waveId}-${judge}r`;
       runState.appendStageWave(ctx.o.runDir, 'debate-revote', repairId);
       const r2 = await ctx.launchers.launchSolo({ ...legOpts(ctx, repairId), model: judge,
-        prompt: dbrief.buildRevoteRepairPrompt({ errors: parsed.errors }) });
+        // ⚠️ LC-12: ditto — the re-vote output being repaired rides with its errors.
+        prompt: dbrief.buildRevoteRepairPrompt({ errors: parsed.errors, revote: leg.summary }) });
       ctx.addWave(r2.wave);
       if (isAbortExit(r2.exitCode)) { return { aborted: r2.exitCode }; }
       const leg2 = r2.leg && r2.leg.status === 'complete' ? r2.leg : null;

package/src/council/run-finalize.js

@@ -0,0 +1,102 @@
+// src/council/run-finalize.js
+'use strict';
+
+/**
+ * @module council/run-finalize
+ * The TERMINAL half of run.js's finalize(): the whole exit-code vocabulary
+ * (signal → code, code → status, and the degradation that resolves the run's
+ * FINAL code), the last-chance unknown-spend notice, run.json's terminal
+ * checkpoint, the run-terminal event and the on-complete hook. Extracted from
+ * run.js for the 300-line size gate (v4.4.1 fix wave) — run.js keeps the half
+ * that must stay in the closure (uninstalling signals and releasing the run's
+ * shared server).
+ *
+ * ⚠️ BOOKKEEPING MUST NEVER SINK A RUN THAT ALREADY FINISHED. run.js documents
+ * "Never rejects for run errors: always resolves {exitCode, run}", but every
+ * `return finalize(…)` in it is a bare `return` of a promise — which, by async
+ * semantics, does NOT route through the enclosing catch. So a throw from the
+ * terminal checkpoint (an unwritable run dir, a full disk) escaped runCouncil as
+ * a REJECTION, past its own contract, and past run.js's `catch`. Worse, the
+ * throw landed between the server release and the caller, so the caller had no
+ * result to act on. Everything here is therefore guarded: a failure is announced
+ * on stderr and the run still resolves with a document whose terminal fields are
+ * authoritative.
+ */
+
+const { emitRunTerminal } = require('../observe/events');
+const { fireCouncilOnComplete } = require('../observe/on-complete');
+const runState = require('./run-state');
+
+/** Abort signal → the run's exit code. Lives here with the rest of the exit-code
+ *  vocabulary; re-exported from ./run (its long-standing public home). */
+const SIGNAL_EXIT = { SIGINT: 130, SIGTERM: 143, SIGBREAK: 143 };
+
+/**
+ * run.json status for a council exit code (spec §4 degradation table).
+ * @param {number} code @returns {string}
+ */
+function statusForExit(code) {
+  return (code === 130 || code === 143) ? 'aborted'
+    : code === 0 ? 'complete' : code === 1 ? 'error' : 'partial';
+}
+
+/**
+ * The run's FINAL exit code, and the ONE place a would-be-clean run degrades.
+ *
+ * Precedence, highest first:
+ *   1. a signal — an aborted run reports how it was killed, nothing else;
+ *   2. a non-zero code the driver already decided (1 = error, 2 = degraded) —
+ *      never re-labelled, because a failure is not a degradation;
+ *   3. `degraded.value` — the flag a shrunken bench, a thin cross-review, a dead
+ *      debate leg and (v4.4.1 CA-6) an inexact total under a `--max-cost`
+ *      ceiling all already set. 0 becomes 2.
+ *
+ * ⚠️ CA-6 is wired here rather than at the ceiling itself ON PURPOSE. The
+ * standing owner ruling — "I don't want hitting a ceiling to stop us from
+ * solving real problems" — is absolute: `overBudget()` still trips on KNOWN
+ * spend only and a ceiling still never blocks a run. What changes is only what
+ * the run CLAIMS on the way out. Exit 0 means "clean, and inside your ceiling";
+ * a run that published a total it knows is a floor has not earned that.
+ *
+ * @param {{signalled: number|null, exitCode: number, degraded?: {value: boolean},
+ *   inexactUnderCeiling?: () => boolean}} args
+ * @returns {number}
+ */
+function resolveTerminalExit({ signalled, exitCode, degraded, inexactUnderCeiling }) {
+  if (signalled) { return signalled; }
+  if (degraded && inexactUnderCeiling && inexactUnderCeiling()) { degraded.value = true; }
+  return (exitCode === 0 && degraded && degraded.value) ? 2 : exitCode;
+}
+
+/**
+ * Write the run's terminal record and fire its terminal observers.
+ *
+ * @param {{o: object, code: number, error?: object|null,
+ *   noticeUnknownSpend: Function, usageBlock: Function,
+ *   deps?: {fireOnCompleteFn?: Function, write?: Function}}} args
+ * @returns {Promise<object>} the run document — always usable, even when the
+ *   write failed (the on-disk doc merged under the authoritative terminal fields).
+ */
+async function writeRunTerminal({ o, code, error, noticeUnknownSpend, usageBlock, deps = {} }) {
+  const status = statusForExit(code);
+  const terminal = { status, exitCode: code, error: error || null };
+  try {
+    noticeUnknownSpend(); // v4.4: never finish a run silently short (run-budget.js)
+    const run = runState.checkpoint(o.runDir, {
+      ...terminal, usage: usageBlock(), completedAt: new Date().toISOString(),
+    });
+    emitRunTerminal(o.runDir, o.runId, status, code, o.follow);
+    await (deps.fireOnCompleteFn || fireCouncilOnComplete)(o.onComplete, run,
+      { runId: o.runId, runDir: o.runDir, exitCode: code, project: o.project }, o.onCompleteDeps);
+    return run;
+  } catch (err) {
+    const write = deps.write || ((s) => process.stderr.write(s));
+    write(`Notice: council run bookkeeping failed at finalize: ${err.message}. The run itself `
+      + `finished with exit ${code} (${status}); run.json may be incomplete.\n`);
+    let onDisk = {};
+    try { onDisk = runState.readRun(o.runDir) || {}; } catch { /* unreadable too */ }
+    return { runId: o.runId, ...onDisk, ...terminal };
+  }
+}
+
+module.exports = { statusForExit, resolveTerminalExit, writeRunTerminal, SIGNAL_EXIT };

package/src/council/run-launch.js

@@ -17,6 +17,20 @@
 const fs = require('fs');
 const path = require('path');
 
+/**
+ * Did a launch exit because a SIGNAL killed it (130 = SIGINT, 143 = SIGTERM)
+ * rather than because the work failed? Every stage loop short-circuits on this
+ * instead of treating the wave as a normal failure.
+ *
+ * It lives HERE, with the module that produces those exit codes, because every
+ * stage loop needs it — including run-stage2.js. Defining it in run-stages.js and
+ * importing it back from its own child made the two mutually circular, which is
+ * why runStage2 could not be re-exported from run-stages.js (v4.4.1 review F5).
+ * @param {number} code
+ * @returns {boolean}
+ */
+function isAbortExit(code) { return code === 130 || code === 143; }
+
 /**
  * @param {{fanoutFn?: Function, remainingBudget?: () => number|null,
  *   reserveBudget?: (waveId: string, estimate: number) => boolean,
@@ -32,6 +46,11 @@ const path = require('path');
  *   synchronously, with the estimate it just computed; see run-budget.js.
  *   onBudgetRefusal: notified when the ceiling refuses a wave, so a seat that
  *   never launched can never vanish silently.
+ *   sharedServer (v4.4.1 Task 0.5): a GETTER returning the run's single
+ *   {serverClient, server} pair, or null. A getter (not a value) because run.js
+ *   builds the launchers before it acquires the server — see ./run-server for
+ *   why one server per run, and why `_scratch` isolation survives it. Returning
+ *   null leaves the transport call byte-identical: the wave owns its own server.
  * @returns {{launchWave: Function, launchSolo: Function}}
  */
 function createLaunchers(deps = {}) {
@@ -39,6 +58,7 @@ function createLaunchers(deps = {}) {
   const remainingBudget = deps.remainingBudget || null;
   const reserveBudget = deps.reserveBudget || null;
   const onBudgetRefusal = deps.onBudgetRefusal || null;
+  const sharedServer = deps.sharedServer || null;
 
   /**
    * @param {{models: string[], prompt: string, project: string, waveId: string,
@@ -61,8 +81,14 @@ function createLaunchers(deps = {}) {
     // provider or no ceiling, so the transport call is byte-identical for
     // non-council callers and for `--max-cost`-less runs.
     const remaining = remainingBudget ? remainingBudget() : null;
+    // v4.4.1 Task 0.5: every launch in the run rides the SAME OpenCode server.
+    // NOT `client` — that key is fanout's client TYPE string; the SDK client is
+    // `serverClient` (see the seam comment in fanout.js). Absent → the wave
+    // starts and closes its own server, exactly as before.
+    const shared = sharedServer ? sharedServer() : null;
     const { wave, exitCode, errorDoc } = await fanoutFn({
       ...(typeof remaining === 'number' ? { maxCost: remaining } : {}),
+      ...(shared ? { serverClient: shared.serverClient, server: shared.server } : {}),
       // v4.4 cost-council finding 1: `maxCost` above is a READ taken before the
       // transport resolved routing; a concurrently launching sibling can claim
       // part of that allowance in the meantime. This is the CLAIM that settles
@@ -173,4 +199,6 @@ function materializeDebate(runDir, legs, prefix) {
   return out;
 }
 
-module.exports = { createLaunchers, materializeReviews, materializeDebate, sanitizeName };
+module.exports = {
+  createLaunchers, materializeReviews, materializeDebate, sanitizeName, isAbortExit,
+};