amicus 4.5.4 → 4.6.1

package/src/council/run.js

@@ -26,7 +26,7 @@ const runState = require('./run-state');
 const { createLaunchers } = require('./run-launch');
 const { runStage1, runStage2 } = require('./run-stages');   // stage 2 lives in ./run-stage2 (300-line gate), re-exported there
 const { runChair, pickFallbackChair } = require('./run-chair');
-const runDebateMod = require('./run-debate');
+const { runDebateStage } = require('./run-debate-stage');   // debate orchestration lives there (300-line gate), extracted from here (v4.6 Plan 1 Task 1)
 const { decorateRecord } = require('./debate');
 const asm = require('./run-assemble');
 const { createBudget } = require('./run-budget');
@@ -62,8 +62,9 @@ async function runCouncil(options, deps = {}) {
   // across Stage-1's CONCURRENT launches, why addWave must release-and-account atomically, and
   // why a refused wave sets `degraded` (a shrunken bench never exits 0) rather than aborting.
   const degraded = { value: false };
+  const degrade = require('./run-degrade').createDegradeSink({ runDir: o.runDir, degraded });
   const { addWave, overBudget, remainingBudget, noticeUnknownSpend, usageBlock, reserveBudget,
-    noteBudgetRefusal, inexactUnderCeiling } = createBudget({ maxCost: o.maxCost, runDir: o.runDir, degraded });
+    noteBudgetRefusal, inexactUnderCeiling } = createBudget({ maxCost: o.maxCost, runDir: o.runDir, degrade });
   // v4.4.1 Task 0.5: ONE OpenCode server for the whole run — ./run-server carries
   // the why and the evidence that `_scratch` judge isolation survives it. Acquired
   // below (a getter, because the launchers are built first); null = as before.
@@ -72,6 +73,20 @@ async function runCouncil(options, deps = {}) {
     || createLaunchers({ remainingBudget, reserveBudget, onBudgetRefusal: noteBudgetRefusal, sharedServer: () => sharedServer });
 
   runState.initCouncilRun(o); // run.json seed + sessions-dir pointer (run-state.js)
+
+  // dropped-members (spec §5, Plan 4): a seat the user's preset requested that
+  // never resolved is a lost seat — announced like every other loss. Fires
+  // once per member, before any launch (zero spend), for BOTH transports.
+  for (const dm of o.droppedMembers || []) {
+    degrade.note({
+      channel: 'dropped-members',
+      what: `seat ${dm.member} was not seated`,
+      why: dm.reason,
+      effect: 'the bench is smaller than the preset requested; the run will exit degraded (2)',
+      data: { member: dm.member, reason: dm.reason },
+    });
+  }
+
   emitRunStarted(o.runDir, o.runId, { bench: o.models, chair: o.chair }, o.follow);
 
   let signalled = null;
@@ -93,15 +108,15 @@ async function runCouncil(options, deps = {}) {
     const claimed = sharedServer;
     sharedServer = null;
     await require('./run-server').releaseRunServer(claimed);
-    const code = resolveTerminalExit({ signalled, exitCode, degraded, inexactUnderCeiling });
+    const code = resolveTerminalExit({ signalled, exitCode, degraded, degrade, inexactUnderCeiling });
     const run = await writeRunTerminal({ o, code, error, noticeUnknownSpend, usageBlock });
     return { exitCode: code, run };
   };
 
   // Injected launchers bring their own transport. Never throws — degrades to null.
-  if (!deps.launchers) { sharedServer = await require('./run-server').acquireRunServer(o, deps); }
+  if (!deps.launchers) { sharedServer = await require('./run-server').acquireRunServer({ ...o, degrade }, deps); }
 
-  const ctx = { o, launchers, addWave, overBudget, scratchDir: path.join(o.runDir, '_scratch') };
+  const ctx = { o, launchers, addWave, overBudget, degrade, scratchDir: path.join(o.runDir, '_scratch') };
 
   try {
     // v4.1 §4.4: Claude-in-council is a FILE input — validated after initRun (so the
@@ -139,7 +154,6 @@ async function runCouncil(options, deps = {}) {
     });
     emitStageTerminal(o.runDir, o.runId, 'stage1', s1Status, o.lenses ? null : `${o.runId}-s1`, o.follow);
     if (signalled || s1.aborted) { return finalize(s1.aborted || signalled); }
-    if (s1.degraded) { degraded.value = true; } // bench shrank → never a "full run"
     if (s1.reviews.length < 2) {
       return finalize(1, {
         code: 'COUNCIL_QUORUM',
@@ -175,7 +189,15 @@ async function runCouncil(options, deps = {}) {
     runState.updateStage(o.runDir, 'stage2', { status: 'complete', completedAt: now() });
     emitStageTerminal(o.runDir, o.runId, 'stage2', 'complete', `${o.runId}-s2`, o.follow);
     if (signalled || s2.aborted) { return finalize(s2.aborted || signalled); }
-    if (s2.judgeResults.filter(j => j.ok).length < 2) { degraded.value = true; } // thin cross-review
+    const usableJudges = s2.judgeResults.filter(j => j.ok).length;
+    if (usableJudges < 2) {
+      degrade.note({
+        channel: 'thin-cross-review',
+        what: `only ${usableJudges} of ${s2.judgeResults.length} judges returned a usable cross-review`,
+        why: 'the other judges produced no parseable Stage-2 block',
+        effect: 'findings were tiered on a thinner cross-review than the bench size implies; will exit degraded (2)',
+      });
+    }
 
     // Merge Stage-2 judging conformance into each seat's row (worst wins).
     const byJudge = new Map(s2.judgeResults.map(j => [j.judge, j]));
@@ -193,64 +215,12 @@ async function runCouncil(options, deps = {}) {
     const provisional = tally(provisionalInput);
 
     // ---- Stage 2.5: debate (optional, spec §5.1) ----
-    let debatedInput = provisionalInput, debatedRecord = provisional;
-    let debateOutcomes = null, debateFindings = null;
-    let debateSummary = o.debate ? { enabled: true, outcome: 'nothing-to-debate',
-      contested: 0, disputed: 0, defended: 0, amended: 0, withdrawn: 0, noResponse: 0,
-      revoteJudges: 0, revoteApplied: 0, verdictChanges: 0 } : null;
-    if (o.debate) {
-      // spec §5.1: the provisional tally is ALSO an audit artifact, not just a stage
-      // checkpoint — no ledger append, written before any debate leg launches.
-      fs.writeFileSync(path.join(o.runDir, 'tally-provisional.json'), JSON.stringify(provisional, null, 2), { mode: 0o600 });
-      runState.updateStage(o.runDir, 'tally-provisional', { status: 'complete', startedAt: now(), completedAt: now() });
-      emitStageStarted(o.runDir, o.runId, 'tally-provisional', null, o.follow);
-      emitStageTerminal(o.runDir, o.runId, 'tally-provisional', 'complete', null, o.follow);
-      const worthDebating = !runDebateMod.nothingToDebate(provisional);
-      if (worthDebating && !overBudget()) {
-        runState.updateStage(o.runDir, 'debate-defense', { status: 'running', startedAt: now(), project: ctx.scratchDir });
-        emitStageStarted(o.runDir, o.runId, 'debate-defense', null, o.follow);
-        const dbg = await runDebateMod.runDebate(ctx, { provisionalRecord: provisional, tallyInput: provisionalInput });
-        // A signal mid-debate aborts finalization: no tally-final, no ledger (spec §5.7). Close
-        // the summary FIRST — the writer contract requires a valid `outcome` whenever the key exists.
-        if (dbg.aborted) {
-          runState.checkpoint(o.runDir, { debate: { ...debateSummary, outcome: 'ran',
-            contested: dbg.contested, disputed: dbg.disputed } });
-          return finalize(dbg.aborted);
-        }
-        runState.updateStage(o.runDir, 'debate-defense', { status: 'complete', completedAt: now() });
-        emitStageTerminal(o.runDir, o.runId, 'debate-defense', 'complete', null, o.follow);
-        // run-debate owns debate-revote's running/waveId/waveIds checkpoint — only it
-        // knows whether the wave launched. Never advertise a `-rv` id here: a skipped
-        // re-vote would leave the abort cascade chasing the v4.0 lens `-s1` phantom.
-        // Mirror run-chair.js's 'skipped' convention (no startedAt) when nothing was
-        // defended/amended or the cost ceiling skipped it — 'complete' would report
-        // work that never happened.
-        runState.updateStage(o.runDir, 'debate-revote', dbg.revoteLaunched
-          ? { status: 'complete', completedAt: now() } : { status: 'skipped', completedAt: now() });
-        // debate-revote-TERMINAL only — run-debate.js owns the START (spec §4.2 /
-        // v4.3 Task 7 B3 note): only it knows the `-rv` waveId when launched.
-        emitStageTerminal(o.runDir, o.runId, 'debate-revote',
-          dbg.revoteLaunched ? 'complete' : 'skipped', dbg.revoteLaunched ? `${o.runId}-rv` : null, o.follow);
-        ({ debatedInput, debateFindings, debateSummary } = dbg);
-        debatedRecord = tally(debatedInput);
-        // Defensive truthiness guard: `[]` is truthy in JS, so an empty outcomes
-        // list must be normalized to null here — otherwise the packet-assembly
-        // ternary below still calls buildDebateAddendum({outcomes: []}), which
-        // emits a bare "--- Debate round outcomes ---" heading with nothing
-        // under it (same defect class ee447b6 fixed on the report renderer).
-        debateOutcomes = (dbg.addendumOutcomes && dbg.addendumOutcomes.length > 0)
-          ? dbg.addendumOutcomes : null;
-        // Dead/unstructured defense, partial/fully-dead re-vote or a cost-ceiling re-vote skip
-        // each degrade the run → exit 2 (spec §5.7), same channel as a dead Stage-1 leg.
-        if (dbg.degraded) { degraded.value = true; }
-      } else if (worthDebating) {
-        // Budget gone before the defense wave launched, but there WAS something to debate — the
-        // other cost-ceiling branch (spec §5.7). Over budget AND nothing to debate stays the latter.
-        debateSummary.outcome = 'skipped-cost-ceiling';
-        degraded.value = true;
-      }
-      runState.checkpoint(o.runDir, { debate: debateSummary });
-    }
+    const { debatedInput, debatedRecord, debateOutcomes, debateFindings, aborted: debateAborted } =
+      await runDebateStage(ctx, { provisional, provisionalInput, overBudget });
+    // Mirrors the `if (signalled || s1.aborted)` / `if (signalled || s2.aborted)` guards
+    // above: run-debate-stage.js can't reach this closure's `finalize`, so it hands the
+    // signal back here instead (see its docblock) and we finalize on its behalf.
+    if (debateAborted) { return finalize(debateAborted); }
 
     const packet = asm.buildChairPacketFile({
       runDir: o.runDir, reviews: s1.reviews, claudeReview, date: o.date,
@@ -258,7 +228,7 @@ async function runCouncil(options, deps = {}) {
     });
 
     const chairRes = await runChair(ctx, {
-      packet, degraded, statsFn, isSignalled: () => signalled,
+      packet, degrade, statsFn, isSignalled: () => signalled,
     });
     if (chairRes.aborted !== null) { return finalize(chairRes.aborted); }
     const { chairLeg, actualChair, chairText, chairConformance, overallVerdict } = chairRes;
@@ -284,8 +254,10 @@ async function runCouncil(options, deps = {}) {
     runState.updateStage(o.runDir, tallyStage, { status: 'complete', completedAt: now() });
     emitStageStarted(o.runDir, o.runId, tallyStage, null, o.follow);
     emitStageTerminal(o.runDir, o.runId, tallyStage, 'complete', null, o.follow);
+    // Verdict assembly is the degrade cut-off: anything noted after this line
+    // reaches stderr + run.json but not verdict.json (spec §6 rule 1).
     asm.writeVerdictFiles({ runDir: o.runDir, record, overallVerdict, chairText,
-      critic: o.critic, deadWaves });
+      critic: o.critic, deadWaves, degrades: degrade.all() });
     runState.updateStage(o.runDir, 'verdict', { status: 'complete', completedAt: now() });
     emitStageStarted(o.runDir, o.runId, 'verdict', null, o.follow);
     emitStageTerminal(o.runDir, o.runId, 'verdict', 'complete', null, o.follow);

package/src/council/verdict.js

@@ -9,13 +9,6 @@ const { parseChairVerdict } = require('./parse-stage2');
 // engine in Plan B via opts.overallVerdict, null in every Stage-4 manual path).
 const VERDICT_SCHEMA_VERSION = 2;
 
-/**
- * Merge a tally record with Claude's Stage-4 decisions into the verdict record.
- * @param {object} record  tally() output
- * @param {Array<{id,decision,applied,duplicateOf,tierOverride}>} decisions
- * @param {{overallVerdict?: (string|null)}} [opts] engine hook (Plan B): the
- *   parsed chair `VERDICT:` line; omitted/undefined → null.
- */
 /**
  * Describe which requested seats actually reviewed, for the verdict's own face.
  *
@@ -54,6 +47,57 @@ function summarizeSeatLoss({ runId, critic, deadWaves = [] } = {}) {
   };
 }
 
+/**
+ * seatLoss, derived from the sink's records (v4.6 Plan 2, spec D3 — closes #84).
+ *
+ * WHY A DERIVATION: two fields reporting lost seats can disagree; deriving one
+ * from the other makes contradiction inexpressible. `summarizeSeatLoss` stays
+ * exactly as v4.5.2 shipped it (its tests pass unedited — that is the proof the
+ * shape survived); this function rebuilds its wave input from `dead-wave`
+ * records and then adds the losses waves can never show: `dead-leg` records —
+ * a solo critic wave that STARTED but whose one leg died is invisible to
+ * deadWaves, which is #84's second half.
+ *
+ * Reads ONLY record.data (Task 1's machine surface) — never the prose fields.
+ * @param {{runId: string, critic: ?string, degrades: Array<object>}} o
+ * @returns {?object} the summarizeSeatLoss shape, or null when no critic was requested
+ */
+function deriveSeatLoss({ runId, critic, degrades = [] } = {}) {
+  if (!critic) { return null; }
+  const real = degrades.filter(d => d.kind !== 'heal' && d.data);
+  const waves = real.filter(d => d.channel === 'dead-wave')
+    .map(d => ({ waveId: d.data.waveId, models: d.data.models || [], reason: d.data.reason }));
+  const base = summarizeSeatLoss({ runId, critic, deadWaves: waves });
+  const legs = real.filter(d => d.channel === 'dead-leg');
+  const criticLeg = legs.find(l => l.data.seat === critic) || null;
+  return {
+    ...base,
+    criticSeated: base.criticSeated && !criticLeg,
+    // SL-2 handoff: a reconciliation note (run-retry-notes.js's
+    // missingLegStillDeadNote) carries data.status: null when the retry
+    // produced no leg for the seat at all — there is no status to name, so
+    // the old `ended '${status}'` template rendered the literal string
+    // "ended 'null'". A status-carrying record keeps the original text.
+    reason: base.reason || (criticLeg
+      ? (criticLeg.data.reason || (criticLeg.data.status
+        ? `the critic leg ended '${criticLeg.data.status}' with no usable output`
+        : 'the critic leg produced no usable output'))
+      : null),
+    deadBenchSeats: [...base.deadBenchSeats,
+      ...legs.filter(l => l.data.seat !== critic).map(l => l.data.seat)],
+  };
+}
+
+/**
+ * Merge a tally record with Claude's Stage-4 decisions into the verdict record.
+ * @param {object} record  tally() output
+ * @param {Array<{id,decision,applied,duplicateOf,tierOverride}>} decisions
+ * @param {{overallVerdict?: (string|null), seatLoss?: object, degrades?: Array<object>}} [opts]
+ *   `overallVerdict` is the engine hook (Plan B): the parsed chair `VERDICT:`
+ *   line; omitted/undefined → null. `seatLoss` (v4.5.2) and `degrades` (v4.6
+ *   Plan 2) are additive and OPTIONAL — each lands on the verdict only when
+ *   truthy/non-empty, absent otherwise (never fabricated).
+ */
 function buildVerdict(record, decisions = [], opts = {}) {
   const byId = new Map(decisions.map(d => [d.id, d]));
   return {
@@ -87,6 +131,11 @@ function buildVerdict(record, decisions = [], opts = {}) {
     // Additive and OPTIONAL (schemaVersion stays 2): present only when a critic
     // was requested, so its absence never has to be interpreted.
     ...(opts.seatLoss ? { seatLoss: opts.seatLoss } : {}),
+    // v4.6 Plan 2 (spec §4): the canonical what-was-lost surface. Additive and
+    // OPTIONAL — present only when the run actually degraded, so a clean run's
+    // verdict is byte-for-byte unchanged. schemaVersion stays 2 (the v4.5.2
+    // seatLoss precedent).
+    ...(opts.degrades && opts.degrades.length ? { degrades: opts.degrades } : {}),
   };
 }
 
@@ -127,6 +176,29 @@ function readOverallVerdict(runDir, runId) {
   return null;
 }
 
+/**
+ * Recover the additive loss surfaces for a Stage-5 rebuild (#87, v4.6 Plan 4).
+ * Same contract as readOverallVerdict directly above: the run folder's own
+ * verdict.json is the only source, a foreign runId never leaks, and absence
+ * yields nulls — the rebuild preserves, never invents. tally.json carries
+ * neither field, which is why the pre-#87 rebuild silently destroyed both.
+ * @param {string} runDir
+ * @param {string} [runId]
+ * @returns {{seatLoss: (object|null), degrades: (Array<object>|null)}}
+ */
+function readPriorVerdictSurfaces(runDir, runId) {
+  try {
+    const prior = JSON.parse(fs.readFileSync(path.join(runDir, 'verdict.json'), 'utf-8'));
+    if (!runId || prior.runId === runId) {
+      return {
+        seatLoss: (prior.seatLoss && typeof prior.seatLoss === 'object') ? prior.seatLoss : null,
+        degrades: Array.isArray(prior.degrades) && prior.degrades.length ? prior.degrades : null,
+      };
+    }
+  } catch { /* no prior verdict.json, or unreadable — nothing to preserve */ }
+  return { seatLoss: null, degrades: null };
+}
+
 /** Atomic write: tmp + rename (matches the repo's wave.json convention). */
 function writeVerdictAtomic(filePath, verdict) {
   const tmp = `${filePath}.tmp-${process.pid}`;
@@ -135,5 +207,6 @@ function writeVerdictAtomic(filePath, verdict) {
 }
 
 module.exports = {
-  buildVerdict, summarizeSeatLoss, readOverallVerdict, writeVerdictAtomic, VERDICT_SCHEMA_VERSION,
+  buildVerdict, summarizeSeatLoss, deriveSeatLoss, readOverallVerdict, readPriorVerdictSurfaces,
+  writeVerdictAtomic, VERDICT_SCHEMA_VERSION,
 };

package/src/mcp-council-bench.js

@@ -0,0 +1,45 @@
+// src/mcp-council-bench.js
+'use strict';
+
+/**
+ * @module mcp-council-bench
+ * Bench resolution for `amicus_council_run` (models XOR council preset). Split
+ * out of mcp-council-run.js (v4.6 Plan 4 Task 4b): that file sat at 298/300
+ * lines and the --dropped-members producer (the MCP→child transport-parity
+ * fix) needed the room. `resolveBenchInput` is self-contained — no dependency
+ * on the handler's validation/spawn-argv logic — so it moves verbatim to its
+ * own leaf; the old home (mcp-council-run.js) requires it back, so its one
+ * call site keeps working unchanged. Never part of mcp-council-run.js's
+ * module.exports (an internal helper, not a re-exported API), so no re-export
+ * shim is needed there.
+ */
+
+/**
+ * Resolve the bench: models XOR council preset (amicus_fanout parity).
+ * Also returns `presetName` (v4.3 Task 3, spec §7.1): the trimmed council
+ * preset name when that branch was taken, else null — this handler always
+ * spawns the CLI child with an already-expanded `--models` list (never
+ * `--council`), so the preset name would otherwise be lost; the caller
+ * forwards it via the internal `--council-name` passthrough instead.
+ */
+function resolveBenchInput(input) {
+  const inputModels = Array.isArray(input.models) ? input.models : [];
+  const hasModels = inputModels.length > 0;
+  const hasCouncil = typeof input.council === 'string' && input.council.trim();
+  if (hasModels && hasCouncil) { return { error: "Pass exactly one of 'models' / 'council', not both." }; }
+  if (!hasModels && !hasCouncil) { return { error: "Provide 'models' or 'council'." }; }
+  if (hasCouncil) {
+    const { resolveCouncilMembers } = require('./utils/config');
+    const { readCache } = require('./utils/model-catalog');
+    const catalog = (readCache() || {}).models || [];
+    const presetName = input.council.trim();
+    const expanded = resolveCouncilMembers(presetName, catalog);
+    if (expanded.error) { return { error: expanded.error }; }
+    // v4.5 Wave 2: the child never re-resolves (bench is spawned pre-expanded
+    // to --models) — the pre-seed below is the only place this is recorded.
+    return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
+  }
+  return { bench: inputModels, presetName: null, droppedMembers: [] };
+}
+
+module.exports = { resolveBenchInput };

package/src/mcp-council-run.js

@@ -17,6 +17,9 @@ const runState = require('./council/run-state');
 const { fenceSidecarOutput } = require('./utils/untrusted-fence');
 const { isPathInside } = require('./project-root-allowlist');
 const { validateOnComplete, requestMcpNotify } = require('./mcp-notify');
+// v4.6 Plan 4 Task 4b: resolveBenchInput moved to its own leaf (size gate) —
+// see mcp-council-bench.js's module docblock for why.
+const { resolveBenchInput } = require('./mcp-council-bench');
 
 function textResult(text, isError) {
   const result = { content: [{ type: 'text', text }] };
@@ -40,34 +43,6 @@ const COUNCIL_PACK_PARAM_MAP = {
   template: 'template',
 };
 
-/**
- * Resolve the bench: models XOR council preset (amicus_fanout parity).
- * Also returns `presetName` (v4.3 Task 3, spec §7.1): the trimmed council
- * preset name when that branch was taken, else null — this handler always
- * spawns the CLI child with an already-expanded `--models` list (never
- * `--council`), so the preset name would otherwise be lost; the caller
- * forwards it via the internal `--council-name` passthrough instead.
- */
-function resolveBenchInput(input) {
-  const inputModels = Array.isArray(input.models) ? input.models : [];
-  const hasModels = inputModels.length > 0;
-  const hasCouncil = typeof input.council === 'string' && input.council.trim();
-  if (hasModels && hasCouncil) { return { error: "Pass exactly one of 'models' / 'council', not both." }; }
-  if (!hasModels && !hasCouncil) { return { error: "Provide 'models' or 'council'." }; }
-  if (hasCouncil) {
-    const { resolveCouncilMembers } = require('./utils/config');
-    const { readCache } = require('./utils/model-catalog');
-    const catalog = (readCache() || {}).models || [];
-    const presetName = input.council.trim();
-    const expanded = resolveCouncilMembers(presetName, catalog);
-    if (expanded.error) { return { error: expanded.error }; }
-    // v4.5 Wave 2: the child never re-resolves (bench is spawned pre-expanded
-    // to --models) — the pre-seed below is the only place this is recorded.
-    return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
-  }
-  return { bench: inputModels, presetName: null, droppedMembers: [] };
-}
-
 /**
  * amicus_council_run: validate → prep run dir → spawn CLI child → return
  * {runId, runDir} immediately (fenced).
@@ -205,6 +180,14 @@ async function handleCouncilRunTool(input, project, helpers) {
   // itself is never spawned (it would collide with `--models`) — this internal,
   // undocumented flag carries the preset NAME through for attribution only.
   if (presetName) { args.push('--council-name', presetName); }
+  // v4.6 Plan 4 Task 4b: same precedent as --council-name above — an internal,
+  // undocumented passthrough. The child's own resolveBench has no literal
+  // --council to re-resolve from, so without this it always resolves
+  // droppedMembers: [] and the sink's dropped-members channel (Task 4) never
+  // fires — a CLI `--council <preset>` run exits 2 on a dropped member while
+  // an identical MCP run exits 0. Omitted when nothing dropped (and always
+  // for bare `models` input) — argv stays byte-identical to today otherwise.
+  if (droppedMembers.length) { args.push('--dropped-members', JSON.stringify(droppedMembers)); }
   // v4.1 §4.5b/§4.5d. claudeReviewFile is resolved against `project` for the same
   // reason outDir is — an MCP client may send a relative path, and the child's cwd
   // is the run dir. Validation of the file itself stays in the spawned engine's

package/src/mcp-server.js

@@ -1388,8 +1388,12 @@ const handlers = {
       // must be carried through or it is destroyed. Unlike the CLI there is no
       // run-folder path to anchor on (`record` arrives inline), so it is an
       // explicit input; omitted → null, never fabricated.
+      // #87: seatLoss/degrades get the same additive-passthrough treatment —
+      // present only when the caller supplies them, never fabricated here.
       const verdict = buildVerdict(input.record, input.decisions || [],
-        { overallVerdict: input.overallVerdict });
+        { overallVerdict: input.overallVerdict,
+          ...(input.seatLoss ? { seatLoss: input.seatLoss } : {}),
+          ...(Array.isArray(input.degrades) && input.degrades.length ? { degrades: input.degrades } : {}) });
       if (!input.render) {
         return textResult(fenceSidecarOutput(JSON.stringify(verdict)));
       }
@@ -1455,6 +1459,21 @@ async function startMcpServer() {
     { capabilities: { roots: {} } }
   );
 
+  // MCP update notice (spec 2026-08-03): the MCP server replaces the CLI's
+  // deliberately-skipped pre-command update check. Fire-and-forget — startup
+  // is never delayed; when the async init resolves with an update known, one
+  // stderr line lands in the client's MCP log. The per-result notice itself
+  // is appended by maybeAppendUpdateNotice in the registration wrapper below.
+  const { initUpdateCheck, getUpdateInfo } = require('./utils/updater');
+  const { maybeAppendUpdateNotice } = require('./utils/update-notice');
+  initUpdateCheck().then(() => {
+    const updateInfo = getUpdateInfo();
+    if (updateInfo && updateInfo.hasUpdate) {
+      process.stderr.write(
+        `[amicus] update available: v${updateInfo.current} -> v${updateInfo.latest}\n`);
+    }
+  }).catch(() => { /* advisory only */ });
+
   for (const tool of getTools()) {
     const register = (name) => server.registerTool(
       name,
@@ -1462,11 +1481,11 @@ async function startMcpServer() {
       async (input) => {
         try {
           const project = await resolveProjectDir(input.project, server);
-          return await handlers[tool.name](input, project, server);
+          return maybeAppendUpdateNotice(await handlers[tool.name](input, project, server));
         }
         catch (err) {
           logger.error(`MCP tool error: ${name}`, { error: err.message });
-          return textResult(`Error: ${err.message}`, true);
+          return maybeAppendUpdateNotice(textResult(`Error: ${err.message}`, true));
         }
       }
     );

package/src/mcp-tools.js

@@ -433,6 +433,14 @@ function getTools() {
         '(or the closing VERDICT: line of chair-output.md). Pass it through whenever you ' +
         'overwrite verdict.json — it is the only copy, tally.json has none. Omit when the ' +
         'chair was skipped; never author one yourself.'),
+      seatLoss: z.record(z.any()).nullable().optional().describe(
+        'The engine-written <runDir>/verdict.json seatLoss block (v4.5.2 — critic seating). ' +
+        'Additive passthrough — preserved onto the rebuilt verdict; omitted → absent, never ' +
+        'fabricated (#87).'),
+      degrades: z.array(z.record(z.any())).nullable().optional().describe(
+        'The engine-written <runDir>/verdict.json degrades[] (v4.6 Plan 2 — what was lost). ' +
+        'Additive passthrough — preserved onto the rebuilt verdict; omitted → absent, never ' +
+        'fabricated (#87).'),
       render: z.boolean().optional().describe('Also return the markdown rendering of the decided verdict (and refresh report.html when outDir is given).'),
       outDir: z.string().optional().describe('Dir to write report.html into when render:true — resolved against the project dir and rejected if it escapes it. Omit to write nothing.'),
       project: z.string().optional().describe('Optional project directory path.'),
@@ -566,9 +574,13 @@ function getGuideText() {
     .map(([name, model]) => `| ${name} | ${model} |`)
     .join('\n');
   // #33: surface the running version (and a call-time staleness warning) so a
-  // post-upgrade agent session can tell it's running old code.
+  // post-upgrade agent session can tell it's running old code. Spec 2026-08-03
+  // adds the registry-side sibling: a newer release exists (not latched here —
+  // the guide is the on-demand surface).
   const warn = versionWarning();
+  const updateLine = require('./utils/update-notice').guideUpdateLine();
   const versionLine = `**Running amicus version:** ${RUNNING_VERSION}`
+    + (updateLine ? `\n\n> ${updateLine}` : '')
     + (warn ? `\n\n> ⚠️ ${warn}` : '');
 
   return `# Amicus Usage Guide

package/src/utils/degrade.js

@@ -0,0 +1,69 @@
+'use strict';
+
+/**
+ * @module utils/degrade
+ * The degrade/heal record: one shape, one vocabulary, shared by the council
+ * runtime and `doctor`. Pure — no I/O, no council knowledge.
+ *
+ * WHY validation lives here and THROWS: it is what makes the announcement
+ * contract real. A degrade that does not say what was lost, why, and what it
+ * cost cannot be constructed. Callers never see the throw — run-degrade.js's
+ * sink catches it and converts it into an `internal` degrade (spec §7).
+ */
+
+const DEGRADE_CHANNELS = Object.freeze(new Set([
+  // council runtime channels
+  'dead-leg', 'dead-wave', 'budget-refusal', 'shared-server-unavailable',
+  'dropped-members', 'chair-skipped-cost-ceiling', 'chair-failed',
+  'thin-cross-review', 'debate-degraded', 'inexact-under-ceiling',
+  'stage1-retry',
+  'internal',
+  // doctor channels
+  'doctor-check-failed', 'doctor-fix',
+]));
+
+const KINDS = Object.freeze(new Set(['degrade', 'heal']));
+const REQUIRED = ['what', 'why', 'effect'];
+
+function makeDegrade(input = {}) {
+  const kind = input.kind === undefined ? 'degrade' : input.kind;
+  if (!KINDS.has(kind)) {
+    throw new Error(`degrade: unknown kind '${kind}' (expected 'degrade' or 'heal')`);
+  }
+  if (!DEGRADE_CHANNELS.has(input.channel)) {
+    throw new Error(`degrade: unknown channel '${input.channel}'`);
+  }
+  for (const f of REQUIRED) {
+    if (typeof input[f] !== 'string' || !input[f].trim()) {
+      throw new Error(`degrade: '${f}' is required and must be a non-blank string`);
+    }
+  }
+  const record = {
+    kind, channel: input.channel,
+    what: input.what.trim(), why: input.why.trim(), effect: input.effect.trim(),
+  };
+  if (typeof input.remedy === 'string' && input.remedy.trim()) {
+    record.remedy = input.remedy.trim();
+  }
+  if (input.data !== undefined) {
+    if (typeof input.data !== 'object' || input.data === null || Array.isArray(input.data)) {
+      throw new Error("degrade: 'data' must be a plain object when provided");
+    }
+    record.data = Object.freeze({ ...input.data });
+  }
+  return Object.freeze(record);
+}
+
+/**
+ * The ONE voice for every channel. Kept here rather than at call sites so ten
+ * channels cannot drift into ten dialects.
+ * @param {object} record from makeDegrade
+ * @returns {string} one line, newline-terminated
+ */
+function formatDegrade(record) {
+  const lead = record.kind === 'heal' ? 'Recovered' : 'Notice';
+  const remedy = record.remedy ? ` Try: ${record.remedy}.` : '';
+  return `${lead}: ${record.what} — ${record.why}. ${record.effect}.${remedy}\n`;
+}
+
+module.exports = { makeDegrade, formatDegrade, DEGRADE_CHANNELS };

package/src/utils/doctor-degrade.js

@@ -0,0 +1,51 @@
+'use strict';
+
+/**
+ * @module utils/doctor-degrade
+ * The doctor-side collector (spec §4): maps doctor's check rows onto the shared
+ * degrade/heal vocabulary. Pure — reads row STATUS and the structured `fixed`
+ * flag only, never message prose (the Plan 2 rule: prose is the human surface).
+ *
+ * Mapping (spec §6, with the recorded interpretation):
+ *   status 'error'      → kind 'degrade', channel 'doctor-check-failed'
+ *   row.fixed === true  → kind 'heal',    channel 'doctor-fix'
+ *   'ok'/'warn' rows    → no record — doctor's exit code ignores warns, and the
+ *                         §6 equivalence (exit derives from any degrade) must
+ *                         hold without changing exit behavior.
+ * A row can produce both (a partial self-heal that still fails).
+ * Never throws: a malformed row degrades honestly, mirroring the council sink.
+ */
+const { makeDegrade } = require('./degrade');
+
+function collectDoctorDegrades(checks) {
+  const records = [];
+  for (const c of Array.isArray(checks) ? checks : []) {
+    if (!c) { continue; }
+    const name = c.name || c.id || 'unnamed';
+    if (c.status === 'error') {
+      records.push(makeDegrade({
+        channel: 'doctor-check-failed',
+        what: `the '${name}' check failed`,
+        why: (typeof c.message === 'string' && c.message.trim()) ? c.message : 'the check produced no message',
+        effect: 'amicus may not work correctly until this is fixed; doctor exits 1',
+        ...(typeof c.hint === 'string' && c.hint.trim() ? { remedy: c.hint } : {}),
+        data: { checkId: c.id || null },
+      }));
+    }
+    if (c.fixed === true) {
+      records.push(makeDegrade({
+        kind: 'heal',
+        channel: 'doctor-fix',
+        what: `the '${name}' check was repaired in place`,
+        why: (typeof c.fixDetail === 'string' && c.fixDetail.trim())
+          ? `doctor --fix ${c.fixDetail}`
+          : "doctor --fix applied the check's self-heal",
+        effect: 'no further action needed; the repair already ran',
+        data: { checkId: c.id || null },
+      }));
+    }
+  }
+  return records;
+}
+
+module.exports = { collectDoctorDegrades };