amicus 4.4.0 → 4.5.0

package/src/headless.js

@@ -11,7 +11,7 @@ const { logger } = require('./utils/logger');
 const { ensureNodeModulesBinInPath } = require('./utils/path-setup');
 const { ensurePortAvailable } = require('./utils/server-setup');
 const { mapAgentToOpenCode } = require('./utils/agent-mapping');
-const { writeProgress } = require('./sidecar/progress');
+const { writeProgress, writeTerminalProgressSafe } = require('./sidecar/progress');
 const { writeFileAtomic } = require('./utils/atomic-write');
 const { createMirrorState, mirrorMessages, logMessage, getPendingToolCalls,
   getLiveToolCalls, mirrorUsageOnly, allAssistantUsagePresent } = require('./sidecar/conversation-mirror');
@@ -122,8 +122,22 @@ const USAGE_SETTLE_CALL_TIMEOUT_MS = envNumber('AMICUS_USAGE_SETTLE_CALL_TIMEOUT
  * ON EXCEEDING IT the leg COMPLETES anyway — never fails — carrying
  * `toolSettleTimedOut` on the result, the terminal progress record and the
  * error log channel. Owner's standing ruling: fail LOUD, not fail CLOSED.
+ *
+ * v4.4.1 LC-2 (owner ruling, 2026-07-26): the leg's completion and its partial
+ * output are unchanged, but its OpenCode session is now ABORTED at the ceiling
+ * (see the finalization block) so it stops billing for work nobody will read.
  */
 const TOOL_SETTLE_GRACE_MS = envNumber('AMICUS_TOOL_SETTLE_GRACE_MS', 300000);
+/**
+ * v4.4.1 LC-2 — how long the ceiling's abort call may take before we stop
+ * waiting on it. A hard constant rather than an env knob (the same disposition
+ * as src/sidecar/child-sessions.js's bounds): it exists to stop a pathological
+ * hang, not to be tuned. The leg is already complete and already paid for when
+ * this runs, so an unbounded wait here would hold a finished answer hostage to a
+ * best-effort cost optimization — exactly the trade A-8 forbids. Injectable via
+ * `options.toolSettleAbortTimeoutMs` so the bound itself is testable.
+ */
+const TOOL_SETTLE_ABORT_TIMEOUT_MS = 5000;
 
 /**
  * Race a promise against a timeout. Returns the promise's result, or rejects with
@@ -258,12 +272,28 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       if (options.mcp) {
         serverOptions.mcp = options.mcp;
       }
-      const result = await startServer(serverOptions);
+      // v4.4.1 fix wave (F5): this is the OTHER server-start site. It calls
+      // startServer directly rather than going through startOpenCodeServer, so
+      // the lock-class retry added for the concurrent-start race never covered
+      // it — a plain `amicus start` that lost the race still died on the first
+      // `database is locked`. "Two separate amicus processes contending" is half
+      // that retry's stated justification, and this is one of the two processes.
+      // Same bounded, narrow policy: 5 attempts (Step 10.5 widened it from 3),
+      // lock-class messages only, final failure rethrown unchanged into the
+      // degrade path below.
+      const { retryOnLockRace } = require('./utils/server-setup');
+      const result = await retryOnLockRace(() => startServer(serverOptions),
+        { retryDelayMs: options.retryDelayMs });
       client = result.client;
       server = result.server;
       logger.debug('Server started', { url: server.url });
     } catch (error) {
       logger.error('Failed to start OpenCode server', { error: error.message });
+      // FR-1: this return predates the outer try — A3's terminal write never ran
+      // for it, leaving 'initializing' on disk while metadata said 'error'.
+      if (!writeTerminalProgressSafe(sessionDir, `Failed to start server: ${error.message}`)) {
+        logger.debug('terminal progress write failed on server-start failure (best-effort)', { taskId });
+      }
       return {
         summary: '',
         completed: false,
@@ -289,6 +319,10 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
 
       if (!serverReady) {
         await server.close();
+        // FR-1: returns out of the outer try — the A3 catch never sees it.
+        if (!writeTerminalProgressSafe(sessionDir, 'OpenCode server failed to start')) {
+          logger.debug('terminal progress write failed on server-not-ready (best-effort)', { taskId });
+        }
         return {
           summary: '',
           completed: false,
@@ -326,6 +360,12 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       } catch (error) {
         if (watchdog) { watchdog.cancel(); }
         if (!externalServer) { await server.close(); }
+        // FR-1: the one path a council leg can hit under T0.5's shared server —
+        // pre-fix, the Workspace showed the seat perpetually live off a
+        // non-terminal 'server_ready' while metadata.json said 'error'.
+        if (!writeTerminalProgressSafe(sessionDir, error.message)) {
+          logger.debug('terminal progress write failed on createSession failure (best-effort)', { taskId });
+        }
         return {
           summary: '',
           completed: false,
@@ -457,6 +497,8 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // `=== undefined` rather than `||`: 0 is meaningful (disable the deferral).
     const toolSettleGraceMs = options.toolSettleGraceMs === undefined
       ? TOOL_SETTLE_GRACE_MS : options.toolSettleGraceMs;
+    const toolSettleAbortTimeoutMs = options.toolSettleAbortTimeoutMs === undefined
+      ? TOOL_SETTLE_ABORT_TIMEOUT_MS : options.toolSettleAbortTimeoutMs;
     let consecutivePollFailures = 0;
     let pollFailureBail = false;
     let lastAssistantMsgId = null;
@@ -478,6 +520,7 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     let toolSettleDeferredSince = null; // ms timestamp of the first deferral, or null
     let toolSettleTimedOut = false;     // the grace ceiling was exceeded
     let unsettledAtCeiling = [];        // what was still live when it was exceeded
+    let toolSettleAborted = false;      // LC-2: the ceiling's abort landed (see finalization)
 
     /**
      * Should this poll's completion signal be DEFERRED because a tool call has
@@ -917,6 +960,54 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       }
     }
 
+    // ---- v4.4.1 LC-2: stop paying for a session nobody will read -------------
+    // OWNER RULING (2026-07-26). The leg is complete and runHeadless is returning,
+    // so nothing will ever read further session output — the outcome was already
+    // discarded by completing. Aborting here does not truncate an answer that
+    // would have been used; it stops paying for work nobody will read. The
+    // original objection ("stops the bleeding at the cost of truncating a
+    // possibly-healthy call") applied to aborting ON the completion route, where
+    // the call might still have mattered. Here it cannot.
+    //
+    // ORDER IS LOAD-BEARING, on BOTH sides:
+    //   AFTER the child-session walk above — aborting first risks losing the
+    //     subtree cost data v4.4.0 exists to capture, trading one silent
+    //     under-report for another.
+    //   BEFORE server.close() below — the abort is an SDK call and needs a live
+    //     server. It is not redundant with close(): on a SHARED server (every
+    //     council run) close() is never called here, and the session would go on
+    //     billing against a server that outlives this leg.
+    //
+    // A-8 APPLIES: "never lose the answer" outranks "never report inaccurate
+    // usage". This is an optimization layered on an already-successful,
+    // already-paid-for leg, so every failure — rejection, hang, or a missing
+    // session id — is logged and dropped. Nothing here may alter `completed`,
+    // `summary`, `usage` or `error`. `toolSettleAborted: false` is the honest
+    // record of "we tried and could not; it may still be billing".
+    if (toolSettleTimedOut && sessionId) {
+      try {
+        const { abortSession } = require('./opencode-client');
+        await withTimeout(
+          abortSession(client, sessionId, ...dirArgs),
+          toolSettleAbortTimeoutMs,
+          'abortSession(tool-settle)',
+        );
+        toolSettleAborted = true;
+        // Task 6 review X2: a LANDED abort is the good outcome of a condition
+        // that is already logged at `error` (the ceiling itself). Logging the
+        // remedy at `warn` reads as a second problem; `info` reads honestly.
+        // The FAILED abort below stays at `warn` — that one really is a problem
+        // ("it may still be billing").
+        logger.info('Aborted the OpenCode session after the tool-settle ceiling', {
+          taskId, sessionId, unsettled: unsettledAtCeiling.length,
+        });
+      } catch (abortErr) {
+        toolSettleAborted = false;
+        logger.warn('Could not abort the session after the tool-settle ceiling — it may '
+          + 'still be billing', { taskId, sessionId, error: abortErr.message });
+      }
+    }
+
     if (!externalServer) { await server.close(); }
     if (mirror.toolCalls.length > 0) {
       logger.info('Tool calls summary', {
@@ -958,8 +1049,13 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // live GUI reads this file (src/observe/live-doc.js). `unsettledToolCalls` is
     // a COUNT here (progress.json is a compact snapshot); the full list is on the
     // returned result for the caller's metadata.
+    //
+    // v4.4.1 LC-2: `toolSettleAborted` rides alongside it — `true` = the session
+    // was told to stop, `false` = it may still be billing. Both are meaningful
+    // ONLY when the ceiling was hit, so neither appears on a clean leg.
     const settleFlags = toolSettleTimedOut
-      ? { toolSettleTimedOut: true, unsettledToolCalls: unsettledAtCeiling.length }
+      ? { toolSettleTimedOut: true, unsettledToolCalls: unsettledAtCeiling.length,
+        toolSettleAborted }
       : {};
     // v4.4 B4 (Task 2) + v4.4.1 CA-1: a leg that made a SUBAGENT call has spend
     // in a CHILD OpenCode session that is billed separately and is NOT rolled
@@ -981,15 +1077,46 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
         : {}),
       ...(subtree.unknown ? { subtreeUnknown: true } : {}) }
       : (subagentToolCalls.length > 0 ? { subtreeUnknown: true } : {});
-    try { writeProgress(sessionDir, 'complete', { usage: { ...usage, ...subtreeProgress }, ...settleFlags }); }
+    // ---- v4.4.1 LC-3: the terminal stage is DERIVED, never hardcoded ---------
+    // This write sits above BOTH returns below, so EVERY terminal path reaches
+    // it — the external-abort break, the --timeout, the poll-failure bail, the
+    // tool-call wedge — and it used to stamp 'complete' on all of them. The live
+    // workspace reads progress.json directly (src/observe/live-doc.js
+    // enrichLegUsage), so an aborted or errored leg rendered with a green check
+    // until metadata.json landed. Fix the WRITER: src/observe/council-legs.js
+    // already prefers metadata.json for a terminal leg and is NOT the problem.
+    //
+    // resolveTerminalState is the codebase's single source of truth for the
+    // (completed, timedOut, aborted, error) → status mapping, and it is what
+    // start.js / continue.js / resume.js / finalizeHeadlessResult will run on
+    // THIS function's return value to stamp metadata.json. Deriving the stage
+    // from it — rather than re-deriving a second, hand-rolled expression here —
+    // is what guarantees progress.json's stage and metadata.json's status cannot
+    // disagree. It also covers the two cases a hand-rolled `aborted ? … :
+    // sessionError ? …` would get wrong: a TIMED-OUT leg (which would still have
+    // read 'complete'), and the F1 case where a session error arrived alongside
+    // usable output and the leg legitimately returns completed (which would have
+    // read a false 'error').
+    //
+    // `failedWithNoUsableOutput` is hoisted out of the `if` below so the stage
+    // and the returned shape are decided by ONE predicate and cannot drift.
+    const failedWithNoUsableOutput = !!(sessionError && (!mirror.output || pollFailureBail || toolStalled));
+    const { resolveTerminalState } = require('./sidecar/session-finalize');
+    const terminalStage = resolveTerminalState({
+      completed,
+      timedOut,
+      aborted,
+      error: failedWithNoUsableOutput ? sessionError : null,
+    }).status;
+    try { writeProgress(sessionDir, terminalStage, { usage: { ...usage, ...subtreeProgress }, ...settleFlags }); }
     catch (progressErr) {
       logger.debug('terminal progress write failed (best-effort)', { taskId, error: progressErr.message });
     }
     const settleResult = toolSettleTimedOut
-      ? { toolSettleTimedOut: true, unsettledToolCalls: unsettledAtCeiling }
+      ? { toolSettleTimedOut: true, unsettledToolCalls: unsettledAtCeiling, toolSettleAborted }
       : {};
 
-    if (sessionError && (!mirror.output || pollFailureBail || toolStalled)) {
+    if (failedWithNoUsableOutput) {
       return {
         summary: mirror.output ? extractSummary(mirror.output, foldNonce) : '',
         completed: false,
@@ -1036,7 +1163,53 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     }
     if (watchdog) { watchdog.cancel(); }
     if (uninstallSignals) { uninstallSignals(); }
-    if (!externalServer) { await server.close(); }
+    // ⚠️ v4.4.1 M2: guarded — this used to be a bare `await server.close()` sitting directly
+    // above A3's terminal-write block, OUTSIDE any try, in the one place a close failure is
+    // least affordable: the error handler. A rejection here would have skipped the terminal
+    // progress write below entirely AND replaced the original `error` (the one A3 exists to
+    // preserve) with this close failure instead. `close()` has already done its job of freeing
+    // the port by the time we get here; a failure to close cleanly is not this handler's
+    // problem to propagate, so it is logged and swallowed, same discipline as every other
+    // best-effort close in this file (see the signal handler above).
+    if (!externalServer) {
+      try { await server.close(); } catch (closeErr) {
+        logger.debug('server.close() failed in the outer exception handler (best-effort)', {
+          taskId, error: closeErr.message,
+        });
+      }
+    }
+    // ⚠️ v4.4.1 A3 — the last hole in LC-3's story. LC-3 made the SUCCESS path's terminal
+    // progress write derive its stage from resolveTerminalState instead of hardcoding 'complete',
+    // so an aborted/errored/timed-out leg stopped rendering with a green check. This path — the
+    // outer exception handler — wrote NO terminal progress record at all, so progress.json kept
+    // whatever non-terminal stage the last flush left on it (usually 'receiving') while the
+    // caller's finalizeHeadlessResult stamped metadata.json 'error' off the return value below.
+    // The live workspace and `amicus watch` read progress.json DIRECTLY (live-doc.js
+    // enrichLegUsage, council-legs.js), so a leg that exploded rendered as still-streaming
+    // forever: exactly the stale-state class LC-3 closed one path over.
+    //
+    // ⚠️ This runs INSIDE an error handler: it must never throw and must never mask the original
+    // error, so the whole thing sits in its own try and its failure is a debug line, exactly like
+    // the success path's write. The stage comes from the same single source of truth that path
+    // uses, so progress.json's stage and metadata.json's status still cannot disagree.
+    //
+    // ⚠️ The prior `usage` is READ BACK and re-attached deliberately. writeProgress REBUILDS
+    // progress.json from `{stage, stageLabel, updatedAt, ...extra}` — it does not merge — so a
+    // bare terminal write would silently delete whatever real spend the last 'receiving' flush had
+    // already recorded, trading a stale-stage bug for a cost-under-report on exactly the legs that
+    // failed. There are no settled totals on this path (that is what the exception cost us), so
+    // carrying the last known usage forward unchanged is the honest maximum.
+    //
+    // v4.4.1 M3 — scope of "the last known ones": `usage` ONLY. That same 'receiving' flush also
+    // wrote `p.extra` (e.g. `messagesReceived`), and that is deliberately left to drop here, not
+    // carried forward too — the same call LC-3's success-path terminal write already made (see
+    // that block's comment above): readProgress() derives `messages` from conversation.jsonl's
+    // assistant entries directly and only falls back to `messagesReceived` when there are none, so
+    // restating a stale count on an exception — where conversation.jsonl is the more truthful,
+    // already-mirrored source — could only disagree with the file it exists to summarize.
+    if (!writeTerminalProgressSafe(sessionDir, error.message)) {
+      logger.debug('terminal progress write failed after exception (best-effort)', { taskId });
+    }
     const { emptyUsageTotals } = require('./utils/pricing');
     return {
       summary: '',

package/src/mcp-council-run.js

@@ -24,6 +24,22 @@ function textResult(text, isError) {
   return result;
 }
 
+/**
+ * v4.5 Task 15 (B7/F5): maps amicus_council_run's MCP input keys to the CLI
+ * arg-key names applyPackToArgs's knob tables use (pack-resolve.js), so
+ * applyPackToMcpInput can reuse those tables unchanged. `template` has no
+ * Zod-declared counterpart on this tool (MCP has no template param of its
+ * own — template/apply.js's own docblock: "MCP has no template params of its
+ * own") — a pack's briefing.template is the ONLY way a template reaches this
+ * handler, carried through as a plain (non-schema) `input.template` property
+ * consumed by the render step below.
+ */
+const COUNCIL_PACK_PARAM_MAP = {
+  models: 'models', council: 'council', chair: 'chair', critic: 'critic', lenses: 'lenses',
+  debate: 'debate', timeoutMinutes: 'timeout', maxCost: 'max-cost', gateway: 'gateway',
+  template: 'template',
+};
+
 /**
  * Resolve the bench: models XOR council preset (amicus_fanout parity).
  * Also returns `presetName` (v4.3 Task 3, spec §7.1): the trimmed council
@@ -45,9 +61,11 @@ function resolveBenchInput(input) {
     const presetName = input.council.trim();
     const expanded = resolveCouncilMembers(presetName, catalog);
     if (expanded.error) { return { error: expanded.error }; }
-    return { bench: expanded.models, presetName };
+    // v4.5 Wave 2: the child never re-resolves (bench is spawned pre-expanded
+    // to --models) — the pre-seed below is the only place this is recorded.
+    return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
   }
-  return { bench: inputModels, presetName: null };
+  return { bench: inputModels, presetName: null, droppedMembers: [] };
 }
 
 /**
@@ -55,7 +73,8 @@ function resolveBenchInput(input) {
  * {runId, runDir} immediately (fenced).
  * @param {object} input tool input
  * @param {string} project resolved project dir
- * @param {{spawnFn: Function, clientName: string}} helpers injected by mcp-server
+ * @param {{spawnFn: Function, clientName: string, autoOpen?: {decide: Function, launch: Function}}} helpers
+ *   injected by mcp-server; `autoOpen` is a v4.5 test seam (real modules used when absent)
  */
 async function handleCouncilRunTool(input, project, helpers) {
   // Task 15 (spec §5.3): validate onComplete FIRST, before any run dir is
@@ -74,10 +93,45 @@ async function handleCouncilRunTool(input, project, helpers) {
   if (briefing.charCodeAt(0) === 0xFEFF) { briefing = briefing.slice(1); }
   if (!briefing.trim()) { return textResult(`briefingFile ${input.briefingFile} is empty.`, true); }
 
+  // v4.5 Task 15 (B7/F5): resolve `pack` IN-PROCESS, before bench/chair/etc
+  // resolution, so a pack-filled input.models/council/chair/critic/lenses/
+  // timeoutMinutes/maxCost/gateway/debate flows through the SAME validation
+  // below a typed value would (single-resolution rule: never spawn --pack —
+  // this is the only place the pack is resolved).
+  let packRecord = null;
+  const notices = [];
+  if (input.pack !== undefined) {
+    const { applyPackToMcpInput } = require('./pack/pack-resolve');
+    const pr = applyPackToMcpInput({
+      packRef: input.pack, expectedKind: 'council', input, paramMap: COUNCIL_PACK_PARAM_MAP,
+    });
+    // v4.5 final-review T15-m1: amicus_start's own pack-error branch
+    // (mcp-server.js) keeps code+hint via buildErrorDoc's JSON envelope; this
+    // handler's error surface is plain text (born-fenced, not JSON), so the
+    // hint (e.g. PACK_NOT_FOUND's 'amicus pack list') is appended to the
+    // message instead of being converted into a JSON envelope, which would
+    // change this tool's established response shape.
+    if (pr.error) { return textResult(pr.error.message + (pr.error.hint ? `\n${pr.error.hint}` : ''), true); }
+    packRecord = pr.packRecord;
+    notices.push(...pr.notices);
+  }
+  // MCP has no template param of its own — a pack's briefing.template (merged
+  // onto input.template above) is the only way one reaches this handler.
+  // {{prompt}} = the briefingFile content; the RENDERED text is what lands in
+  // briefing.md below (mirrors the CLI's single template-application point).
+  if (input.template !== undefined) {
+    const { applyTemplate } = require('./template/apply');
+    const t = applyTemplate({ templateRef: input.template, prompt: briefing, project });
+    if (t.error) { return textResult(t.error.message, true); }
+    briefing = t.prompt;
+    notices.push(...t.notices);
+  }
+
   const benchRes = resolveBenchInput(input);
   if (benchRes.error) { return textResult(benchRes.error, true); }
   const bench = benchRes.bench;
   const presetName = benchRes.presetName;
+  const droppedMembers = benchRes.droppedMembers || [];
   if (bench.length < 2) { return textResult('A council needs at least 2 seats.', true); }
   const chair = (typeof input.chair === 'string' && input.chair.trim()) ? input.chair.trim() : CHAIR_DEFAULT;
   if (bench.includes(chair)) {
@@ -121,6 +175,14 @@ async function handleCouncilRunTool(input, project, helpers) {
         maxCost: (typeof input.maxCost === 'number') ? input.maxCost : null,
         gateway: input.gateway || 'auto', outDir: runDir,
       },
+      // v4.5 Task 15: additive-only — absent (not null) without a pack. The
+      // spawned child's own seed omits `pack` (never passed --pack); initRun's
+      // plain shallow merge (run-state.js) preserves this pre-seeded value —
+      // pinned behavior, Task 12.
+      ...(packRecord ? { pack: packRecord } : {}),
+      // v4.5 Wave 2: additive, same preserved-across-the-child's-own-initRun
+      // precedent as `pack` above — absent (never []) when nothing dropped.
+      ...(droppedMembers.length ? { droppedMembers } : {}),
       usage: null, createdAt: new Date().toISOString(),
     });
     runState.writePointer(project, runId, runDir);
@@ -170,14 +232,56 @@ async function handleCouncilRunTool(input, project, helpers) {
   // the only code that later sees this council run reach terminal state.
   if (oc.mode === 'mcp-notify') { requestMcpNotify(runId); }
 
+  // ★ v4.5 auto-open (spec §6): decide via the pure helper, launch detached,
+  // never await, never fail the run. helpers.autoOpen is a test seam.
+  const ao = helpers.autoOpen || {
+    decide: (ctx) => require('./sidecar/workspace-auto-open').shouldAutoOpenWorkspace(ctx),
+    launch: (opts) => require('./sidecar/workspace-window').launchWorkspaceWindowDetached(opts),
+  };
+  let workspaceOpened = false;
+  let workspaceOpenReason = null;
+  try {
+    const { isElectronUsable } = require('./sidecar/electron-install');
+    const { getWorkspaceAutoOpen } = require('./utils/config');
+    const decision = ao.decide({
+      client: helpers.clientName,
+      electronUsable: isElectronUsable(),
+      platform: process.platform,
+      env: process.env,
+      autoOpenConfig: getWorkspaceAutoOpen(),
+      uiParam: input.ui,
+    });
+    if (decision.open) {
+      const r = ao.launch({ project, runId });
+      if (r && r.launched === false) {
+        workspaceOpenReason = r.reason;
+      } else {
+        workspaceOpened = true;
+      }
+    } else {
+      workspaceOpenReason = decision.reason;
+    }
+  } catch (err) {
+    workspaceOpenReason = `auto-open-failed: ${err.message}`;
+  }
+
   const body = JSON.stringify({
     schemaVersion: 2, type: 'council-run', runId, runDir, status: 'running',
     message: 'Council run started. Preferred: call amicus_wait with the runId — one blocking ' +
       'call replaces polling; re-call it while it returns timedOut: true. Fallback: poll ' +
       'amicus_status with the runId. Artifacts land in runDir (verdict.json, report.html).',
+    workspaceOpened,
+    ...(workspaceOpenReason ? { workspaceOpenReason } : {}),
+    // v4.5 Wave 2: otherwise invisible here short of separately reading run.json.
+    ...(droppedMembers.length ? { droppedMembers } : {}),
   });
   // Born-fenced (spec §8): council MCP tool text is wrapped like amicus_read.
-  return textResult(fenceSidecarOutput(body));
+  const content = [{ type: 'text', text: fenceSidecarOutput(body) }];
+  // v4.5 Task 15: pack/template notices (e.g. a bench-override) are non-fatal —
+  // surfaced as extra unfenced content blocks, same precedent as
+  // mcp-server.js's routeResult.notice (amicus_start).
+  for (const n of notices) { content.push({ type: 'text', text: n }); }
+  return { content };
 }
 
 // The council-awareness helpers live in their own module; re-exported here so