amicus 4.5.4 → 4.6.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.5.4",
+  "version": "4.6.0",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,77 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [Unreleased]
+
+## [4.6.0] - 2026-08-02
+
+### Added (v4.6 milestone — the degrade announcement invariant, plans 1-4)
+
+- **The ten-channel degrade announcement contract.** A council run can no longer degrade its
+  exit code without announcing what was lost: every loss routes through one sink
+  (`src/council/run-degrade.js`, the only code allowed to flip `degraded.value` — enforced by a
+  source-scan invariant test) and lands with mandatory *what/why/effect* on stderr,
+  `run.json.degrades[]`, `verdict.json.degrades[]`, and the report's new **"What was lost"**
+  section, all rendered in one voice.
+- **`verdict.seatLoss` is now derived from the degrade records** (closes #84) — a dead critic
+  *leg* finally flips `criticSeated`, and `seatLoss` can no longer disagree with `degrades[]`.
+  The v4.5.2 seatLoss shape is unchanged (its tests passed byte-unedited).
+- **Stage-2 judge legs get `runStats` rows** (closes #83) — per-leg cost attribution for ~38%
+  of a run's spend that had none, judge-tagged in the report's cost table.
+- **`doctor` speaks the same language**: `doctor --json` gains additive `degrades[]`;
+  `doctor --fix` prints `Recovered:` lines for every repair; the engine hints state causes as
+  **unverified** instead of asserting an antivirus guess.
+- **The Workspace is discoverable from the CLI**: `watch` usage names `--ui` (closes #80), and
+  a CLI council run with Electron present prints how to open the live Workspace (closes #81 —
+  the silence half; auto-open parity remains a product decision).
+
+### Changed (v4.6 — deliberate behavior changes)
+
+- **A dropped preset member now degrades the run to exit 2 on every transport** (was: exit 0
+  with a `--json`-blind stderr notice). The loss is announced per-member with its reason.
+- **A shared-server acquisition failure now exits degraded (2)** (was: stderr + run.json only,
+  exit 0) — the per-wave fallback is the racy configuration and the run says so.
+- **Reported cost totals rise** for identical runs versus v4.5.x: judge legs now appear in
+  `runStats`. Consumers keying `runStats` by model must exclude `role: 'judge'` (as the
+  ledger's reliability join now does).
+- In-run degrade notices hedge the exit-code claim truthfully ("will exit degraded (2)");
+  `engineMissing`/`reinstallEngineAv` hint prose changed to the unverified voice (commands
+  byte-identical).
+
+### Fixed (v4.6)
+
+- **A dead Stage-1 leg was announced on no surface at all** (closes #85) — the only trace was
+  its absence from the stage entry's `taskIds`. Now named everywhere, with a regression pin.
+- **The Stage-5 verdict rebuild silently destroyed `seatLoss`/`degrades[]`** (closes #87) —
+  `tally.json` carries neither, so the decisions flow dropped both; now preserved from the run
+  folder's verdict the same way the chair's synthesis already was, on both CLI and MCP.
+- **`watch --ui` against an `--out-dir` run failed with a symptom, not a cause** (closes #82) —
+  the error now names the launch-directory pointer and the working invocation.
+
+### Fixed
+
+- **`/amicus:council` lost all of its frontmatter at load time.** `commands/council.md`'s
+  `argument-hint` value began with `[material, path, or URL] [...]`, which YAML reads as a flow
+  sequence followed by a second, unexpected `[` — the whole block failed to parse, so the command
+  loaded with empty metadata: no description, no argument hint, and `disable-model-invocation:
+  true` silently dropped (the command was model-invocable, the opposite of the intent). The value
+  is now single-quoted. Present since `3900429` (Phase 9a, 2026-07-02); `claude plugin validate
+  .claude-plugin/plugin.json` failed on it, non-strict, that entire time.
+- **The preflight that should have caught it was validating the wrong file.** With `.claude-plugin/`
+  holding both manifests, `claude plugin validate .` resolves the *marketplace* manifest and
+  reports `✔ Validation passed` without ever inspecting the plugin. `docs/DISTRIBUTION.md` §2 now
+  documents the path trap, prescribes `claude plugin validate .claude-plugin/plugin.json`, and
+  records why `--strict` is expected to fail here (the deliberately retained root-`CLAUDE.md`
+  warning).
+
+### Changed
+
+- **`tests/plugin-commands.test.js` now YAML-parses frontmatter** for `commands/council.md` and
+  both skills, asserting `description`, `argument-hint` (as a *string*), and
+  `disable-model-invocation: true` survive parsing. The previous
+  `expect(md).toContain('argument-hint:')` substring checks passed happily against a file that
+  could not parse. `yaml` added as a devDependency for this.
+
 ## [4.5.4] - 2026-08-01
 
 ### Fixed

package/README.md

@@ -441,7 +441,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.5.4",
+  "version": "4.6.0",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/commands/council.md

@@ -1,6 +1,6 @@
 ---
 description: Run a structured multi-model LLM council review of the given material — wraps the second-opinion skill (independent reviews → anonymous cross-review → non-Claude chair verdict → accept/deny decisions).
-argument-hint: [material, path, or URL] [analysis request + criteria] [optional elements — e.g. "with a critic seat", "debate mode", "expert lenses", "chair verdict scale"]
+argument-hint: '[material, path, or URL] [analysis request + criteria] [optional elements — e.g. "with a critic seat", "debate mode", "expert lenses", "chair verdict scale"]'
 disable-model-invocation: true
 ---
 

package/docs/DISTRIBUTION.md

@@ -50,17 +50,36 @@ users only see a version bump when we bump it, not on every commit. Treat
 ### Preflight (run before every submission or major post-listing update)
 
 ```bash
-claude plugin validate . --strict
+claude plugin validate .claude-plugin/plugin.json    # the PLUGIN check — see the path trap below
+claude plugin validate .                             # the marketplace manifest (separate check)
 claude --plugin-dir .   # smoke: /amicus:council, /amicus:sidecar, /amicus:second-opinion, MCP tools
 npm test
 ```
 
-- `claude plugin validate . --strict` is the same structural check the
-  review pipeline runs; `--strict` promotes unrecognized-field warnings to
-  errors so nothing slips through that CI would later flag. It needs the
-  Claude Code CLI installed locally — it is **not** wired into this repo's
-  CI (runners have no `claude` auth), so `tests/plugin-manifest.test.js` is
-  the CI-side proxy for manifest completeness.
+- **Path trap — `claude plugin validate .` does NOT validate the plugin.**
+  This repo's `.claude-plugin/` holds *both* `marketplace.json` and
+  `plugin.json`; given `.`, the CLI resolves the marketplace manifest, prints
+  `Validating marketplace manifest:` / `✔ Validation passed`, and never looks
+  at the plugin, its commands, or its skills. Always pass
+  `.claude-plugin/plugin.json` explicitly for the plugin check — that is the
+  surface the review pipeline evaluates. (This masked a real defect for a
+  month: `commands/council.md` shipped an unparseable `argument-hint` from
+  2026-07-02 until 2026-08-01 while `.` reported clean. Read the first line
+  of the output — it names which manifest was actually checked.)
+- `claude plugin validate` is the same structural check the review pipeline
+  runs. It needs the Claude Code CLI installed locally — it is **not** wired
+  into this repo's CI (runners have no `claude` auth), so
+  `tests/plugin-manifest.test.js` and `tests/plugin-commands.test.js` are the
+  CI-side proxies. The latter now YAML-parses the command and skill
+  frontmatter (`yaml` is a devDependency for exactly this); substring
+  assertions like `toContain('argument-hint:')` cannot see a parse failure,
+  which is how the `council.md` defect passed CI.
+- **`--strict` is expected to FAIL here, by design.** It promotes the
+  root-`CLAUDE.md` warning ("not loaded as project context") to an error. The
+  plugin root is the repo root, and `CLAUDE.md` is this repo's development
+  context — we keep it deliberately. Use the non-strict run as the gate and
+  read the warning list by eye; a *new* warning is the signal, not the
+  `CLAUDE.md` one.
 - `claude --plugin-dir .` loads the plugin from the working tree so you can
   manually confirm `/amicus:council`, `/amicus:sidecar`, and
   `/amicus:second-opinion` all appear in the command picker exactly once,
@@ -68,10 +87,18 @@ npm test
 - `npm test` must be green, specifically `tests/plugin-manifest.test.js`
   and `tests/plugin-commands.test.js`.
 
-**Known current-tree preflight result (checked 2026-07-02, `p9/distribution`
-at a1bea3c):** `claude plugin validate . --strict` passes clean, exit 0.
-(History: `--strict` previously flagged an unknown `plugin.json → bugs`
-field; that field was removed in commit `4207485`, so the warning is gone.)
+**Known current-tree preflight result (checked 2026-08-01, on
+`fix/plugin-frontmatter-validation`):**
+`claude plugin validate .claude-plugin/plugin.json` → exit 0,
+`✔ Validation passed with warnings` (the one retained root-`CLAUDE.md`
+warning). With `--strict` → exit 1 on that same warning, as documented above.
+`claude plugin validate .` → exit 0 on the marketplace manifest.
+
+History of this line: it previously read "`claude plugin validate . --strict`
+passes clean, exit 0" as of 2026-07-02 — measured against the *marketplace*
+manifest via the path trap above, while the plugin itself had a hard
+frontmatter error in `commands/council.md`. Older still: `--strict` flagged an
+unknown `plugin.json → bugs` field, removed in commit `4207485`.
 
 ### Submit
 

package/docs/usage.md

@@ -443,7 +443,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.5.4",
+  "version": "4.6.0",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.5.4",
+  "version": "4.6.0",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
@@ -95,7 +95,8 @@
     "lint-staged": "^16.3.2",
     "puppeteer": "^24.36.0",
     "sharp": "^0.35.3",
-    "ws": "^8.19.0"
+    "ws": "^8.19.0",
+    "yaml": "^2.9.0"
   },
   "engines": {
     "node": ">=22.12.0"

package/schemas/council-run.schema.json

@@ -82,6 +82,26 @@
         "at": { "type": "string" }
       }
     },
+    "degrades": {
+      "description": "v4.6 Plan 1: every degrade/heal the sink announced — additive, written by run-degrade.js.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["kind", "channel", "what", "why", "effect"],
+        "properties": {
+          "kind": { "enum": ["degrade", "heal"] },
+          "channel": { "type": "string" },
+          "what": { "type": "string" },
+          "why": { "type": "string" },
+          "effect": { "type": "string" },
+          "remedy": { "type": "string" },
+          "data": {
+            "type": "object",
+            "description": "v4.6 Plan 2: optional structured facts for derivations (e.g. dead-leg {seat,status,reason}, dead-wave {waveId,models,reason}). Prose fields stay the human surface."
+          }
+        }
+      }
+    },
     "debate": {
       "type": "object",
       "properties": {

package/schemas/council-verdict.schema.json

@@ -205,6 +205,26 @@
         "criticRequested",
         "criticSeated"
       ]
+    },
+    "degrades": {
+      "description": "v4.6 Plan 2: what this run lost — copied verbatim from the sink at verdict assembly. Additive; absent on a clean run.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["kind", "channel", "what", "why", "effect"],
+        "properties": {
+          "kind": { "enum": ["degrade", "heal"] },
+          "channel": { "type": "string" },
+          "what": { "type": "string" },
+          "why": { "type": "string" },
+          "effect": { "type": "string" },
+          "remedy": { "type": "string" },
+          "data": {
+            "type": "object",
+            "description": "v4.6 Plan 2: optional structured facts for derivations (e.g. dead-leg {seat,status,reason}, dead-wave {waveId,models,reason}). Prose fields stay the human surface."
+          }
+        }
+      }
     }
   }
 }

package/schemas/doctor.schema.json

@@ -21,7 +21,29 @@
           "name": { "type": "string" },
           "status": { "type": "string" },
           "message": { "type": ["string", "null"] },
-          "hint": { "type": ["string", "null"] }
+          "hint": { "type": ["string", "null"] },
+          "fixed": { "type": "boolean" },
+          "fixDetail": { "type": "string" }
+        }
+      }
+    },
+    "degrades": {
+      "description": "v4.6 Plan 3: failed checks and --fix repairs in the shared degrade/heal vocabulary — additive, absent when clean.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["kind", "channel", "what", "why", "effect"],
+        "properties": {
+          "kind": { "enum": ["degrade", "heal"] },
+          "channel": { "type": "string" },
+          "what": { "type": "string" },
+          "why": { "type": "string" },
+          "effect": { "type": "string" },
+          "remedy": { "type": "string" },
+          "data": {
+            "type": "object",
+            "description": "v4.6 Plan 3: optional structured facts for derivations (doctor: {checkId}). Prose fields stay the human surface."
+          }
         }
       }
     }

package/src/cli-council-run-render.js

@@ -0,0 +1,51 @@
+// src/cli-council-run-render.js
+'use strict';
+
+/**
+ * @module cli-council-run-render
+ * Human-readable render of a finished `amicus council run` (the non-`--json`
+ * output path, v4.0 spec §4). Split out of cli-handlers-council-run.js (v4.6
+ * Plan 4 Task 2): that file sat at 298/300 lines and Plan 4 Task 3 adds the
+ * #81 Workspace notice, which needed the room. `renderRunHuman` is
+ * self-contained — no dependency on the handler's flag-parsing or engine
+ * dispatch — so it moves verbatim to its own leaf; the old home
+ * (cli-handlers-council-run.js) requires it back and re-exports it, so every
+ * existing import path keeps working unchanged.
+ */
+
+function renderRunHuman(run) {
+  const lines = [
+    `Council run ${run.runId}: ${run.status} (exit ${run.exitCode})`,
+    `  bench: ${(run.bench || []).join(', ')}  chair: ${run.chair}`,
+    `  dir:   ${run.options && run.options.outDir}`,
+  ];
+  // v4.4: a cost line that omits unpriced legs reads as the whole bill. The
+  // diagnosis measured council-wsgate02 printing $0.3720 for a run that really
+  // spent $0.9859. Say what we know, then say what we cannot know — and print
+  // the line even when NOTHING resolved (the old `typeof amount === 'number'`
+  // guard silently dropped it, so a fully unpriced run looked free).
+  const u = run.usage || null;
+  const unknownLegs = u && typeof u.unknownLegs === 'number'
+    ? u.unknownLegs
+    : (u && u.cost && u.cost.unpricedLegs) || 0;
+  // v4.4 Task 2: a fully-priced run can still be short. `council-wsgate01`
+  // printed an unqualified $0.2821 for a run that really spent $0.3036 — every
+  // leg `reported`, and 100% of the gap one unattributed `explore` child session.
+  const subtreeLegs = u && typeof u.subtreeUnknownLegs === 'number'
+    ? u.subtreeUnknownLegs
+    : (u && u.cost && u.cost.subtreeUnknownLegs) || 0;
+  if (u && u.cost && (typeof u.cost.amount === 'number' || unknownLegs > 0 || subtreeLegs > 0)) {
+    const known = typeof u.cost.amount === 'number' ? `$${u.cost.amount.toFixed(4)}` : '$0.0000';
+    const gaps = [];
+    if (unknownLegs > 0) { gaps.push(`${unknownLegs} leg(s) unknown`); }
+    if (subtreeLegs > 0) { gaps.push(`${subtreeLegs} leg(s) with unattributed subagent child-session spend`); }
+    const tail = gaps.length > 0
+      ? ` + ${gaps.join(' + ')} — real spend is at least this much`
+      : '';
+    lines.push(`  cost:  ${known} (${u.cost.source})${tail}`);
+  }
+  if (run.error) { lines.push(`  error: ${run.error.code}: ${run.error.message}`); }
+  return lines.join('\n') + '\n';
+}
+
+module.exports = { renderRunHuman };

package/src/cli-handlers-council-run.js

@@ -13,6 +13,10 @@ const path = require('path');
 const { failJson, buildErrorDoc, ERROR_CODES } = require('./utils/error-doc');
 const { validateTaskId } = require('./utils/validators');
 const { GATEWAY_MODES } = require('./utils/model-descriptor');
+// v4.6 Plan 4 Task 2: renderRunHuman moved to its own leaf (size gate); this
+// file re-exports it below so every existing require() of this path still
+// resolves it unchanged.
+const { renderRunHuman } = require('./cli-council-run-render');
 
 const CHAIR_DEFAULT = 'deepseek';
 
@@ -40,9 +44,9 @@ function sanitizeCouncilName(name) {
 
 /**
  * Resolve bench models from --models XOR --council (mirrors handleFanout).
- * Also returns `presetName` (v4.3 Task 3, spec §7.1): the trimmed --council
- * name when that branch was taken, else null — threaded into runCouncil's
- * `councilName` option so council ledger rows can be attributed to a preset.
+ * Also returns `presetName` (v4.3 Task 3, spec §7.1: trimmed --council name,
+ * else null) and `droppedMembers`: a preset's own drops, or — bare --models —
+ * the parsed `--dropped-members` MCP→child passthrough (v4.6 Plan 4 Task 4b).
  */
 function resolveBench(args, useJson) {
   const hasModels = typeof args.models === 'string' && args.models.trim();
@@ -68,54 +72,40 @@ function resolveBench(args, useJson) {
     if (expanded.error) {
       return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: ${expanded.error}` }) };
     }
-    if (expanded.dropped && expanded.dropped.length && !useJson) {
-      process.stderr.write(`Notice: dropped unavailable council member(s): ${expanded.dropped.join(', ')}\n`);
-    }
-    // v4.5 Wave 2: threaded into runCouncil's options — the ONLY prior signal
-    // was the stderr-only Notice above, which --json mode never even prints.
+    // v4.5 Wave 2 → Plan 4 Task 4: threaded into runCouncil's options — the
+    // sink now announces each dropped member, with reason, on every transport and surface.
     return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
   }
-  return { bench: parseList(args.models), presetName: null, droppedMembers: [] };
+  if (args['dropped-members'] === undefined) {
+    return { bench: parseList(args.models), presetName: null, droppedMembers: [] };
+  }
+  let dm; try { dm = JSON.parse(args['dropped-members']); } catch { dm = null; }
+  if (!Array.isArray(dm) || !dm.every(d => d && typeof d.member === 'string' && typeof d.reason === 'string')) {
+    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
+      message: 'Error: --dropped-members must be a JSON array of {member, reason} entries' }) };
+  }
+  return { bench: parseList(args.models), presetName: null, droppedMembers: dm };
 }
 
-function renderRunHuman(run) {
-  const lines = [
-    `Council run ${run.runId}: ${run.status} (exit ${run.exitCode})`,
-    `  bench: ${(run.bench || []).join(', ')}  chair: ${run.chair}`,
-    `  dir:   ${run.options && run.options.outDir}`,
-  ];
-  // v4.4: a cost line that omits unpriced legs reads as the whole bill. The
-  // diagnosis measured council-wsgate02 printing $0.3720 for a run that really
-  // spent $0.9859. Say what we know, then say what we cannot know — and print
-  // the line even when NOTHING resolved (the old `typeof amount === 'number'`
-  // guard silently dropped it, so a fully unpriced run looked free).
-  const u = run.usage || null;
-  const unknownLegs = u && typeof u.unknownLegs === 'number'
-    ? u.unknownLegs
-    : (u && u.cost && u.cost.unpricedLegs) || 0;
-  // v4.4 Task 2: a fully-priced run can still be short. `council-wsgate01`
-  // printed an unqualified $0.2821 for a run that really spent $0.3036 — every
-  // leg `reported`, and 100% of the gap one unattributed `explore` child session.
-  const subtreeLegs = u && typeof u.subtreeUnknownLegs === 'number'
-    ? u.subtreeUnknownLegs
-    : (u && u.cost && u.cost.subtreeUnknownLegs) || 0;
-  if (u && u.cost && (typeof u.cost.amount === 'number' || unknownLegs > 0 || subtreeLegs > 0)) {
-    const known = typeof u.cost.amount === 'number' ? `$${u.cost.amount.toFixed(4)}` : '$0.0000';
-    const gaps = [];
-    if (unknownLegs > 0) { gaps.push(`${unknownLegs} leg(s) unknown`); }
-    if (subtreeLegs > 0) { gaps.push(`${subtreeLegs} leg(s) with unattributed subagent child-session spend`); }
-    const tail = gaps.length > 0
-      ? ` + ${gaps.join(' + ')} — real spend is at least this much`
-      : '';
-    lines.push(`  cost:  ${known} (${u.cost.source})${tail}`);
-  }
-  if (run.error) { lines.push(`  error: ${run.error.code}: ${run.error.message}`); }
-  return lines.join('\n') + '\n';
+/**
+ * Default real helpers; tests override via depsOverride (mirrors
+ * cli-handlers-spend.js's realDeps()/depsOverride convention).
+ */
+function realDeps() {
+  return {
+    // #81 (spec §2): same pure presence probe doctor's electron checks use (src/cli-handlers-doctor.js).
+    getElectronPath: () => require('./sidecar/interactive-process').getElectronPath(),
+  };
 }
 
-/** @param {object} args parsed CLI args @returns {Promise<number>} exit code */
-async function handleCouncilRun(args) {
+/**
+ * @param {object} args parsed CLI args
+ * @param {object} [depsOverride] test seam (getElectronPath)
+ * @returns {Promise<number>} exit code
+ */
+async function handleCouncilRun(args, depsOverride = {}) {
   const useJson = !!args.json;
+  const deps = { ...realDeps(), ...depsOverride };
 
   // v4.5 Task 12 (B7/F5): resolve --pack FIRST, above the Task-5 template
   // block, so a pack-filled args.template renders through that single
@@ -243,6 +233,17 @@ async function handleCouncilRun(args) {
   const { readCache } = require('./utils/model-catalog');
   const { runCouncil } = require('./council/run');
   const cfg = loadConfig() || {};
+
+  // #81 (spec §2): the GUI's existence was announced on NO surface from the
+  // CLI path — MCP launches auto-open, the CLI stayed silent. Auto-open
+  // parity is a product decision (deliberately not taken here); the SILENCE
+  // is the spec's to fix. Presence probe only — never launches. Placed here
+  // (runId/runDir already resolved, still before the engine await) so the
+  // notice is useful WHILE the run is live, not just after it finishes.
+  if (!useJson && deps.getElectronPath()) {
+    process.stderr.write(`Notice: the Council Workspace can render this run live — open it with: amicus watch ${runId} --ui\n`);
+  }
+
   const { exitCode, run } = await runCouncil({
     briefing: promptRes.prompt, models: bench, chair, critic, lenses,
     project, runId, runDir,

package/src/cli-handlers-council.js

@@ -8,7 +8,7 @@ const { sumWaveUsage, formatCost } = require('./utils/pricing');
 const { failJson, ERROR_CODES } = require('./utils/error-doc');
 const { buildReport } = require('./council/report');
 const { validateFindings, buildValidateDoc } = require('./council/findings');
-const { buildVerdict, readOverallVerdict, writeVerdictAtomic } = require('./council/verdict');
+const { buildVerdict, readOverallVerdict, readPriorVerdictSurfaces, writeVerdictAtomic } = require('./council/verdict');
 const {
   runSave: runCouncilSave,
   runList: runCouncilList,
@@ -169,8 +169,14 @@ function runVerdict(args, useJson) {
     // one of only two homes of the chair's synthesis (the other is
     // chair-output.md); tally.json carries no copy. Recover it from the RUN
     // folder — the tally's own directory, not `-o` — before rebuilding.
-    const overallVerdict = readOverallVerdict(path.dirname(path.resolve(tallyPath)), record.meta.runId);
-    verdict = buildVerdict(record, decisions, { overallVerdict });
+    const runDir = path.dirname(path.resolve(tallyPath));
+    const overallVerdict = readOverallVerdict(runDir, record.meta.runId);
+    // #87: tally.json carries neither seatLoss nor degrades — recover both from
+    // the run folder's verdict the same way the chair line is recovered.
+    const prior = readPriorVerdictSurfaces(runDir, record.meta.runId);
+    verdict = buildVerdict(record, decisions, { overallVerdict,
+      ...(prior.seatLoss ? { seatLoss: prior.seatLoss } : {}),
+      ...(prior.degrades ? { degrades: prior.degrades } : {}) });
   }
   catch (e) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `cannot build verdict: ${e.message}`,

package/src/cli-handlers-doctor.js

@@ -171,40 +171,8 @@ async function runDoctorChecks(depsOverride = {}) {
   checks.push(await guardAsync('electron-mcp', 'Electron (MCP launch path)',
     () => electronMcpCheck.evaluateElectronMcp({ ...d, fixTimeoutMs: FIX_TIMEOUT_MS })));
 
-  checks.push(await guardAsync('electron', 'Electron (interactive GUI)', async () => {
-    if (d.getElectronPath()) {
-      return { id: 'electron', name: 'Electron (interactive GUI)', status: 'ok', message: 'installed', hint: null };
-    }
-    // Broken (missing / quarantined). With --fix, self-heal in place (#56):
-    // repairElectron provisions the binary; {deferred} (no cache, no network)
-    // maps to WARN — a deferred download is not a failure. Without --fix, just
-    // point the user at `amicus doctor --fix`.
-    if (d.fix) {
-      let res;
-      try {
-        res = await d.repairElectron({ timeoutMs: FIX_TIMEOUT_MS });
-      } catch (e) {
-        return { id: 'electron', name: 'Electron (interactive GUI)', status: 'warn', message: `repair failed: ${e.message} — headless still works`, hint: HINTS.doctorFix };
-      }
-      res = res || {};
-      if (res.repaired) {
-        return { id: 'electron', name: 'Electron (interactive GUI)', status: 'ok', message: 'installed (self-healed)', hint: null };
-      }
-      const why = res.reason ? ` — ${res.reason}` : '';
-      // Quarantine (AV deleted electron.exe post-extract) is NOT a deferral and
-      // must NEVER be silently retried: surface the allow-list instruction as a
-      // WARN and STOP. No re-run of repairElectron here (no loop).
-      const detail = res.quarantined
-        ? `antivirus quarantine${why}`
-        : res.deferred
-          ? `deferred${why}`
-          : res.contended
-            ? `repair already in progress${why}`
-            : `not provisioned${why}`;
-      return { id: 'electron', name: 'Electron (interactive GUI)', status: 'warn', message: `${detail} — headless still works`, hint: HINTS.doctorFix };
-    }
-    return { id: 'electron', name: 'Electron (interactive GUI)', status: 'warn', message: 'not installed — headless still works', hint: HINTS.doctorFix };
-  }));
+  checks.push(await guardAsync('electron', 'Electron (interactive GUI)',
+    () => electronMcpCheck.evaluateElectronInteractive(d, { fixTimeoutMs: FIX_TIMEOUT_MS })));
 
   checks.push(guard('skills', 'Skills installed', () => (
     d.skillInstalled()
@@ -256,7 +224,7 @@ async function runDoctorChecks(depsOverride = {}) {
 
 const MARK = { ok: '✓', warn: '⚠', error: '✗' }; // ✓ ⚠ ✗
 
-function renderHuman(checks) {
+function renderHuman(checks, degrades = []) {
   let out = 'amicus doctor\n\n';
   for (const c of checks) {
     out += `${MARK[c.status] || '?'} ${c.name}: ${c.message}\n`;
@@ -265,6 +233,13 @@ function renderHuman(checks) {
   const errors = checks.filter(c => c.status === 'error').length;
   const warns = checks.filter(c => c.status === 'warn').length;
   out += `\n${errors} error(s), ${warns} warning(s).\n`;
+  // D7: every --fix repair announces what it did, in the one voice. Failures
+  // are NOT repeated here — the ✗ rows above already carry them; degrade
+  // records are the --json/artifact surface.
+  const { formatDegrade } = require('./utils/degrade');
+  for (const r of degrades.filter(x => x.kind === 'heal')) {
+    out += formatDegrade(r);
+  }
   return out;
 }
 
@@ -281,14 +256,18 @@ async function handleDoctor(args, runChecks = runDoctorChecks) {
   // self-heal in place. Omitted (not false) when absent so the injected
   // test-double sees a clean "no fix" call.
   const checks = await runChecks(args.fix ? { fix: true } : undefined);
+  // v4.6 Plan 3: collect once, both paths consume — the shared degrade/heal
+  // vocabulary (spec §4/§6). Never affects the exit-code logic below.
+  const { collectDoctorDegrades } = require('./utils/doctor-degrade');
+  const degrades = collectDoctorDegrades(checks);
   if (useJson) {
     const { buildDoctorDoc } = require('./utils/result-schema');
     const VERSION = require('../package.json').version;
-    const doc = buildDoctorDoc({ version: VERSION, timestamp: new Date().toISOString(), checks });
+    const doc = buildDoctorDoc({ version: VERSION, timestamp: new Date().toISOString(), checks, degrades });
     process.stdout.write(JSON.stringify(doc, null, 2) + '\n');
     return doc.ok ? 0 : 1;
   }
-  process.stdout.write(renderHuman(checks));
+  process.stdout.write(renderHuman(checks, degrades));
   return checks.some(c => c.status === 'error') ? 1 : 0;
 }
 

package/src/cli-handlers-watch.js

@@ -104,7 +104,7 @@ async function handleWatch(args) {
   const { failJson, ERROR_CODES } = require('./utils/error-doc');
   const id = args._[1];
   if (!id || id === true) {
-    process.stderr.write('Error: id is required for watch\nUsage: amicus watch <id> [--json] [--plain] [--interval <sec>]\n');
+    process.stderr.write('Error: id is required for watch\nUsage: amicus watch <id> [--json] [--plain] [--interval <sec>] [--ui]\n');
     return 1;
   }
   const check = validateTaskId(String(id));

package/src/cli.js

@@ -397,7 +397,7 @@ Commands:
   council verdict <tally.json> [--decisions <d.json>] [-o <out.json>]   Build + write verdict.json
   doctor      Check your setup: keys, catalog, binary, skills, MCP (--json)
   spend [--since 7d] [--json]           Cross-run cost rollup from the spend ledger
-  watch <id> [--json] [--plain] [--interval <sec>]   Live-render a run from any terminal
+  watch <id> [--json] [--plain] [--interval <sec>] [--ui]   Live-render a run from any terminal
   abort       Abort a running session (or --all)
   setup       Configure default model and aliases
     --api-keys               Open API key setup window

package/src/council/ledger.js

@@ -18,7 +18,11 @@ function countSeverity(findings) {
 function buildLedgerRows(record) {
   const { meta, findings, streetCred, runStats, judged } = record;
   const sc = new Map(streetCred.map(s => [s.model, s]));
-  const rs = new Map(runStats.filter(r => !DEBATE_ROLES.has(r.role)).map(r => [r.model, r]));
+  // Judge rows (#83, v4.6 Plan 2) are Stage-2 cost attribution, not seats: the
+  // join below is keyed by MODEL, and judges ARE bench models — without this
+  // exclusion the judge row would silently overwrite the seat row.
+  const rs = new Map(runStats.filter(r => !DEBATE_ROLES.has(r.role) && r.role !== 'judge')
+    .map(r => [r.model, r]));
   return meta.models.map(model => {
     const raised = findings.filter(f => f.raiser === model);
     const s = sc.get(model) || {};