amicus 4.6.1 → 4.6.2

package/electron/workspace-ui/workspace-seats.js

@@ -0,0 +1,117 @@
+/**
+ * Council Workspace — seats panel painter (v4.4 §5). D8 extraction (Task 1,
+ * v4.6.2 PR4): moved verbatim out of workspace-panels.js, which was pressed
+ * up against the 300-line size gate — this file is where Task 2 adds
+ * dead-seat rows. Loads immediately before workspace-panels.js (index.html),
+ * which keeps a thin delegate; reads `window.AmicusApp` at CALL time, same
+ * discipline as every sibling renderer file (workspace-app.js boots last and
+ * owns `state`).
+ *
+ * Task 2 ("dead-seat rows"): `state.detail.run` and `state.detail.verdict`
+ * are the raw run.json/verdict.json docs (src/workspace/run-detail.js —
+ * `getRunDetail` returns them wholesale, unfiltered), so `run.degrades` and
+ * `verdict.seatLoss` are already on `state.detail` today; no data-layer
+ * threading was needed. Only the derivation (window.AmicusLive.deadSeats,
+ * live-model.js) and this file's painting are new.
+ *
+ * NOTE (scope, matches the plan's file list): renderSeatsPanel() (below) is reached from
+ * renderDetail() — called both from openRun() (a fresh run open) and from the blind toggle
+ * (workspace-app.js:197-227), which must repaint dead rows too so the mask flip reaches
+ * them. A dead-leg/dead-wave degrade is checkpointed to run.json as soon as Stage 1's
+ * once-only retry pass resolves for that seat — which can be well before the rest of the run
+ * reaches a terminal status, so a seat CAN be "announced dead" in the data while the run is
+ * still live-polling.
+ *
+ * HISTORY: dead rows first shipped gated on terminal status (Task 2's fix wave, task
+ * review, controller ruling) — appended ONLY when window.AmicusLive.TERMINAL_STATUSES
+ * matched d.run.status, the same predicate startLiveLoop() uses at workspace-verbs.js:69 to
+ * decide whether a run is even worth polling. Reason at the time: renderDetail()'s
+ * unconditional V.startLiveLoop() call (workspace-app.js:151) schedules a
+ * setTimeout(tick, 0) on any still-running run; that tick's first resolution repainted
+ * #seats-body via applyLive's direct renderSeats() call (workspace-verbs.js:130), whose own
+ * leaver-removal (workspace-render.js:220-222) immediately deleted the `dead:`-keyed row
+ * renderSeatsPanel had just appended — a one-frame flash-then-vanish that read as a glitch,
+ * not a feature — so gating on terminal simply hid dead rows until no further tick could
+ * un-paint them. PR4b (Christian's mid-poll ruling on PR 102) replaced that gate with tick
+ * re-append: applyLive() now calls appendDeadRows() (below) immediately after every
+ * renderSeats() repaint (workspace-verbs.js:130-131), restoring the row the SAME tick that
+ * just wiped it instead of leaving it hidden. renderSeatsPanel() below no longer checks
+ * TERMINAL_STATUSES at all — dead rows paint unconditionally, on a live run or a done one.
+ */
+(function () {
+  'use strict';
+
+  function renderSeatsPanel() {
+    var A = window.AmicusApp;
+    var d = A.state.detail;
+    var seats = window.AmicusLive.seatsFromRunStats(d.derived.cost.rows);
+    var tbody = A.$('seats-body');
+    window.AmicusRender.renderSeats(tbody, seats, A.state.blind, A.labelOf);
+    var seatLoss = d.verdict && d.verdict.seatLoss;
+    var dead = window.AmicusLive.deadSeats(d.run.degrades, seatLoss, seats);
+    renderDeadSeatRows(tbody, dead, A.state.blind, A.labelOf);
+  }
+
+  /**
+   * Paints the dead-seat rows appended after live rows. Deliberately NOT
+   * folded into workspace-render.js's renderSeats (287/300 — must not grow)
+   * and NOT run through its keyed diff: dead rows carry no per-tick-changing
+   * field, so a full rebuild every call is correct and cheap, and renderSeats
+   * just above already self-cleans any PRIOR dead row as an unrecognized
+   * `data-key` (its own seen-set only knows about the live `seats` it was
+   * just given), so nothing here needs to track dead rows across calls.
+   *
+   * Cells route through window.AmicusLive.seatCells(...) — the SAME function
+   * live rows use — so name masking (and every other column's blank/em-dash
+   * convention) matches exactly, not a reimplementation. Two overrides after
+   * the call: index 0 (name, blind-ON-and-unlabeled dead seats only — see the
+   * comment at that line) and index 6 (cost). seatCells would dash() a
+   * missing costDisplay to '—', indistinguishable from a seat that ran but
+   * whose cost is merely unmeasured (see cost-unknown-display.test.js) — a
+   * dead seat has no cost concept at all, so that cell renders empty instead
+   * (D6: "no cost cell").
+   */
+  function renderDeadSeatRows(tbody, dead, blindOn, labelOf) {
+    (dead || []).forEach(function (seat) {
+      var cells = window.AmicusLive.seatCells(
+        { model: seat.model, status: seat.statusText, stalled: false }, blindOn, labelOf);
+      // Fix wave 2 (smoke-caught, GUI smoke on real degraded run 12c96b6b): dead seats never
+      // produce a review, so state.labelByModel (built from the run's names derivation — models
+      // that DID review) never carries them; seatCells' own `blindOn && label ? label : alias`
+      // fallback is LOAD-BEARING for LIVE rows (RN-9/F36, live-model.js) and stays untouched, but
+      // for a dead seat that fallback leaks the raw model name under blind — precisely the seat
+      // blind mode most needs to hide. Placeholder ONLY when blind is on AND no label resolved;
+      // a label that DOES resolve (possible in principle) still wins via seatCells' own cell.
+      if (blindOn && !(labelOf && labelOf(seat.model))) { cells[0] = '(masked)'; }
+      cells[6] = '';
+      var row = window.AmicusRender.el('tr',
+        { className: 'seat-dead', dataset: { key: 'dead:' + seat.model } },
+        cells.map(function (c, i) {
+          return window.AmicusRender.el('td',
+            { className: i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : '') }, [c]);
+        }));
+      tbody.appendChild(row);
+    });
+  }
+
+  /**
+   * Live-tick twin of renderSeatsPanel's dead block (PR4b, Christian's mid-poll
+   * ruling on PR 102): applyLive's renderSeats repaint wipes dead:-keyed rows
+   * (leaver-removal), so every tick re-appends from the tick's own payload.
+   * seatLoss comes from state.detail (absent mid-run — the critic's own
+   * dead-leg degrade covers it live; the terminal refresh unions the rest).
+   */
+  function appendDeadRows(live) {
+    var A = window.AmicusApp;
+    var d = A.state.detail;
+    var seatLoss = d && d.verdict ? d.verdict.seatLoss : null;
+    var dead = window.AmicusLive.deadSeats(live.degrades, seatLoss, live.seats || []);
+    renderDeadSeatRows(A.$('seats-body'), dead, A.state.blind, A.labelOf);
+  }
+
+  window.AmicusSeats = {
+    renderSeatsPanel: renderSeatsPanel,
+    renderDeadSeatRows: renderDeadSeatRows,
+    appendDeadRows: appendDeadRows,
+  };
+})();

package/electron/workspace-ui/workspace-verbs.js

@@ -128,6 +128,7 @@
     // `live.ok` is true, so this is simply "always paint," empty roster included.
     if (live.seats) {
       R.renderSeats(A.$('seats-body'), live.seats, A.state.blind, A.labelOf);
+      window.AmicusSeats.appendDeadRows(live);
     }
     // F42: state.detail can be swapped/absent under a tick — never deref .derived unguarded.
     var derived = A.state.detail && A.state.detail.derived ? A.state.detail.derived : null;

package/electron/workspace-ui/workspace.css

@@ -112,6 +112,12 @@ mark { background: var(--gold-soft); color: var(--gold-400); border-radius: var(
 .table td { border-bottom: var(--bd); padding: var(--space-3) var(--space-4); }
 .table td.num, .table th.num { text-align: right; font-family: var(--font-mono); }
 .stalled-flag { color: var(--warn); }
+/* Task 2 (v4.6.2 PR4, "dead-seat rows"): an announced-dead seat's row —
+   muted like every other "nothing to see here" surface (.empty-note,
+   .chip.aborted, .stage.skipped, .rail-project all key off --text-3), never
+   the warn/danger colors those two-line notes use — a dead seat is a fact
+   already fully explained in the banner/verdict, not a NEW alarm here. */
+tr.seat-dead td { color: var(--text-3); }
 
 /* ---- matrix tier rows (report-html light-ground pairs, as token vars) -- */
 .matrix-wrap { overflow-x: auto; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.6.1",
+  "version": "4.6.2",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/alias-audit.schema.json

@@ -12,6 +12,11 @@
     "staleCount": { "type": "number" },
     "stale": { "type": "array", "items": { "type": "object" } },
     "gatewayFindingsCount": { "type": "number" },
-    "gatewayFindings": { "type": "array", "items": { "type": "object" } }
+    "gatewayFindings": { "type": "array", "items": { "type": "object" } },
+    "driftedCount": { "type": "number" },
+    "drifted": { "type": "array", "items": { "type": "object" } },
+    "probeCount": { "type": "number" },
+    "probe": { "type": "array", "items": { "type": "object" } },
+    "probeSkipped": { "type": ["string", "null"] }
   }
 }

package/schemas/council-run.schema.json

@@ -102,6 +102,20 @@
         }
       }
     },
+    "chairAttempts": {
+      "description": "v4.6.2 PR5 (LC-5): one entry per resolved chair fallback-walk attempt (ch1/ch2/ch3 — the ch4 VERDICT-line repair is not an attempt, see classifyChairAttempt), checkpointed incrementally so a mid-walk kill preserves the attempts already resolved. Additive; absent on chairless (cost-skipped) runs and on every pre-PR5 run.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["waveId", "model", "outcome"],
+        "properties": {
+          "waveId": { "type": "string" },
+          "model": { "type": "string" },
+          "outcome": { "enum": ["completed", "error", "timeout", "no-output"] },
+          "reason": { "type": ["string", "null"] }
+        }
+      }
+    },
     "debate": {
       "type": "object",
       "properties": {

package/src/cli-handlers-doctor.js

@@ -12,6 +12,8 @@ const electronMcpCheck = require('./utils/doctor-electron-mcp-check');
 // local-providers check body (v4.2 §4.7 C8) — split out to keep this file
 // under the gate (mirrors the engineCheck/mcpChecks split above).
 const localProvidersCheck = require('./utils/doctor-local-providers-check');
+// v4.6.2 PR1 (spec §4) — the 'anthropic-base-url' check body.
+const baseUrlCheck = require('./utils/doctor-base-url-check');
 
 const MAX_CATALOG_AGE_MS = 24 * 60 * 60 * 1000; // 24h (mirrors model-catalog DEFAULT_MAX_AGE_MS)
 
@@ -38,6 +40,7 @@ function realDeps() {
     readCache: () => require('./utils/model-catalog').readCache(),
     collectAliasSources: () => require('./utils/alias-audit').collectAliasSources(),
     findStaleAliases: (s, c) => require('./utils/alias-audit').findStaleAliases(s, c),
+    findDriftedStoredAliases: (s, c) => require('./utils/alias-audit').findDriftedStoredAliases(s, c),
     hasOpencodeBinary: () => {
       // Single source of truth shared with the runtime server-start guard.
       const { ensureNodeModulesBinInPath, hasOpencodeBinary } = require('./utils/path-setup');
@@ -148,12 +151,21 @@ async function runDoctorChecks(depsOverride = {}) {
   checks.push(guard('aliases', 'Model aliases', () => {
     const cache = d.readCache();
     const catalog = (cache && cache.models) || [];
-    const stale = d.findStaleAliases(d.collectAliasSources(), catalog);
-    return stale.length === 0
-      ? { id: 'aliases', name: 'Model aliases', status: 'ok', message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null }
-      : { id: 'aliases', name: 'Model aliases', status: 'warn', message: `${stale.length} stale: ${stale.map(s => s.alias).join(', ')}`, hint: 'amicus models --check' };
+    const sources = d.collectAliasSources();
+    const stale = d.findStaleAliases(sources, catalog);
+    const drifted = d.findDriftedStoredAliases(sources, catalog);
+    if (stale.length === 0 && drifted.length === 0) {
+      return { id: 'aliases', name: 'Model aliases', status: 'ok', message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null };
+    }
+    const parts = [];
+    if (stale.length) { parts.push(`${stale.length} stale: ${stale.map(s => s.alias).join(', ')}`); }
+    if (drifted.length) { parts.push(`${drifted.length} drifted: ${drifted.map(s => s.alias).join(', ')}`); }
+    return { id: 'aliases', name: 'Model aliases', status: 'warn', message: parts.join('; '), hint: 'amicus models --check' };
   }));
 
+  checks.push(guard('anthropic-base-url', 'ANTHROPIC_BASE_URL',
+    () => baseUrlCheck.evaluateAnthropicBaseUrl(d)));
+
   checks.push(guard('opencode-bin', 'OpenCode binary', () => (
     d.hasOpencodeBinary()
       ? { id: 'opencode-bin', name: 'OpenCode binary', status: 'ok', message: 'found', hint: null }

package/src/cli.js

@@ -149,6 +149,7 @@ const BOOLEAN_FLAGS = [
      'md',                   // council report: emit Markdown (default)
      'fix',                  // doctor: self-heal fixable checks in place (#56)
      'strict',               // models --check: exit non-zero on curated per-gateway drift (#gwid Task 6)
+     'live',                 // models --check: opt-in probe of stored aliases with real engine legs (v4.6.2 PR3, spec §6)
      'render',               // council verdict: also refresh report.html next to the decided verdict
      'claude',               // init: register for Claude Code only (Task 15)
      'desktop',              // init: register for Claude Desktop only (Task 15)
@@ -501,6 +502,9 @@ Options for 'models':
   --strict                     With --check: also exit non-zero on curated
                                per-gateway drift (stale/divergent direct or
                                openrouter forms). Informational without it.
+  --live                       With --check: probe every stored alias with one real
+                               engine leg (spends) — served / accepted-but-silent /
+                               error. Requires --check.
   --json                       Machine-readable output
 `,
   list: `

package/src/council/run-chair.js

@@ -42,6 +42,32 @@ function pickFallbackChair(statsRows, bench, failedChair) {
   return candidates.length ? candidates[0].model : null;
 }
 
+/**
+ * Outcome taxonomy for one fallback-walk attempt (spec §8, LC-5). The ch4
+ * VERDICT repair is deliberately NOT an attempt: its chair leg already
+ * completed — only the verdict line is being re-prompted — and the outcome
+ * enum has no honest value for it.
+ * @param {object|null} rawLeg the UNFILTERED leg (attemptChair nulls `leg` on
+ *   failure; this is the one before that narrowing, so a failed leg document
+ *   is still visible here)
+ * @param {object|null} [errorDoc] set when the launch never produced a wave
+ *   at all (pre-flight refusal) — the only source of a reason in that case
+ * @returns {{outcome: 'completed'|'error'|'timeout'|'no-output', reason: string|null}}
+ */
+function classifyChairAttempt(rawLeg, errorDoc) {
+  if (!rawLeg) {
+    const reason = (errorDoc && (errorDoc.message || errorDoc.reason)) || 'no leg document';
+    return { outcome: 'error', reason };
+  }
+  if (rawLeg.status === 'timeout') { return { outcome: 'timeout', reason: rawLeg.reason || null }; }
+  if (rawLeg.status === 'complete') {
+    const hasOutput = rawLeg.summary && String(rawLeg.summary).trim();
+    return hasOutput ? { outcome: 'completed', reason: null }
+      : { outcome: 'no-output', reason: rawLeg.reason || null };
+  }
+  return { outcome: 'error', reason: rawLeg.reason || rawLeg.error || String(rawLeg.status) };
+}
+
 /**
  * Chair chain (attempt → retry → ledger-promoted fallback → give up) plus the
  * single VERDICT-line repair re-prompt.
@@ -76,12 +102,28 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
     addWave(solo.wave);
     const ok = solo.leg && solo.leg.status === 'complete'
       && solo.leg.summary && solo.leg.summary.trim();
-    return { leg: ok ? solo.leg : null, exitCode: solo.exitCode };
+    // rawLeg is the UN-nulled leg — the classifier needs to see a failed leg
+    // document, not just the ok/null collapse the rest of the walk consumes.
+    return { leg: ok ? solo.leg : null, exitCode: solo.exitCode, errorDoc: solo.errorDoc, rawLeg: solo.leg };
   };
 
   let chairLeg = null;
   let actualChair = null;
   let skippedForCost = false;
+  // Additive on run.json (LC-5): one entry per resolved attempt (ch1/ch2/ch3;
+  // ch4 is a repair, not an attempt — see classifyChairAttempt). Declared here
+  // (not inside the else branch below) so it stays in scope for the
+  // chair-failed why enrichment after the branch closes, and so a
+  // cost-skipped chair (the `if` branch) simply never calls recordAttempt —
+  // chairAttempts is never checkpointed and the key stays absent on run.json.
+  const chairAttempts = [];
+  const recordAttempt = (attempt, waveId, model) => {
+    const cls = classifyChairAttempt(attempt.rawLeg, attempt.errorDoc);
+    chairAttempts.push({ waveId, model, outcome: cls.outcome, reason: cls.reason });
+    // Checkpointed HERE, before the caller's own isAbortExit bail — a mid-walk
+    // kill must not lose the attempts already resolved (spec §8 kill-mid-walk).
+    runState.checkpoint(o.runDir, { chairAttempts });
+  };
   if (overBudget()) {
     // Ceiling hit after the tally is computable: skip the chair, write the
     // verdict with overallVerdict null, exit 2 (spec §4 degradation table).
@@ -102,9 +144,11 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
     // Fallback chain (spec §4): retry same chair once → promote best
     // non-bench model from the ledger → give up (no Claude fallback headless).
     let attempt = await attemptChair(o.chair, `${o.runId}-ch1`);
+    recordAttempt(attempt, `${o.runId}-ch1`, o.chair);
     if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
     if (!attempt.leg && !overBudget()) {
       attempt = await attemptChair(o.chair, `${o.runId}-ch2`);
+      recordAttempt(attempt, `${o.runId}-ch2`, o.chair);
       if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
     }
     if (attempt.leg) { actualChair = o.chair; }
@@ -114,6 +158,7 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
       const fallback = pickFallbackChair(statsRows, o.models, o.chair);
       if (fallback) {
         attempt = await attemptChair(fallback, `${o.runId}-ch3`);
+        recordAttempt(attempt, `${o.runId}-ch3`, fallback);
         if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
         if (attempt.leg) { actualChair = fallback; }
       }
@@ -160,7 +205,8 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
       what: 'the council has no chair synthesis',
       why: chairLeg
         ? 'the chair ran but its output carried no parseable VERDICT: line'
-        : 'no chair leg completed, including after the fallback chain',
+        : `no chair leg completed after the fallback walk — ${chairAttempts.map(a =>
+          `${a.waveId.split('-').pop()} ${a.model}: ${a.reason || a.outcome}`).join(' · ')}`,
       effect: 'the verdict is written with overallVerdict null; will exit degraded (2)',
     });
   }
@@ -170,4 +216,4 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
   };
 }
 
-module.exports = { runChair, pickFallbackChair };
+module.exports = { runChair, pickFallbackChair, classifyChairAttempt };

package/src/headless.js

@@ -454,19 +454,72 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       promptOptions.reasoning = reasoning;
     }
 
-    // Send prompt asynchronously (returns immediately, we poll for results)
+    // v4.6.2 PR2 amendment (controller live smoke, field evidence): arm BEFORE
+    // the prompt send, not after. OpenCode's prompt-send handler can itself
+    // block on the upstream provider call before ever returning — a silently-
+    // accepting endpoint (the v4.6.1 gemini class) hung the very next line's
+    // await for 6+ minutes with the backstop never even created yet, upstream
+    // of every mechanism that was supposed to catch it. `startedAt` here means
+    // "time since the leg asked for output". Disarmed permanently by the first
+    // SUBSTANTIVE-activity tick in the poll loop below (output/tool/result/
+    // reasoning/settle — NOT the placeholder-compatible message/assistant-id
+    // signals; see substantiveActivity); 0 (or negative) disables — the
+    // send itself is unbounded in that case too (see withTimeout below).
+    const { resolveNoOutputBackstopMs, createNoOutputBackstop } = require('./utils/no-output-backstop');
+    // v4.6.2 PR3 Task 1: Number.isFinite, not `!== undefined` — a non-number
+    // (e.g. a string arriving from a CLI/JSON boundary) must fall through to
+    // env resolution instead of reaching the deadline arithmetic below.
+    // `startedAt + ms` string-concatenates when ms is a string, producing a
+    // deadline `nowMs >= deadline` can never satisfy — the backstop would
+    // silently never fire. Finite zero (the documented explicit-disable
+    // value) still takes the direct branch: Number.isFinite(0) === true.
+    const noOutputBackstopMs = Number.isFinite(options.noOutputBackstopMs)
+      ? options.noOutputBackstopMs : resolveNoOutputBackstopMs(options._env);
+    const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: Date.now() });
+    let backstopFired = false;
+    // Single source for the reason string so the pre-send firing site below and
+    // the per-poll firing site further down (still ticking the SAME instance)
+    // can never drift apart.
+    const noOutputBackstopReason = () => 'NO_OUTPUT_BACKSTOP: model produced no '
+      + `output, reasoning, or tool calls in ${Math.round(noOutputBackstopMs / 1000)}s `
+      + '— likely a listed-but-not-serving model or a dead endpoint';
+
+    // Send prompt asynchronously (returns immediately, we poll for results) —
+    // bounded by the backstop: an endpoint that accepts but never answers must
+    // not hang this await the way it hung the field-observed leg.
     logger.info('Sending prompt to OpenCode', {
       sessionId,
       model,
       agent: promptOptions.agent,
       userMessageLength: userMessage.length
     });
-    const promptResult = await sendPromptAsync(client, sessionId, promptOptions);
-    writeProgress(sessionDir, 'prompt_sent');
-    logger.info('Prompt sent successfully, entering polling loop', {
-      sessionId,
-      timeoutMs
-    });
+    const sendPromptLabel = 'sendPromptAsync';
+    const sendPromptPromise = sendPromptAsync(client, sessionId, promptOptions);
+    let promptResult = null;
+    try {
+      promptResult = await withTimeout(sendPromptPromise, noOutputBackstopMs, sendPromptLabel);
+      writeProgress(sessionDir, 'prompt_sent');
+      logger.info('Prompt sent successfully, entering polling loop', {
+        sessionId,
+        timeoutMs
+      });
+    } catch (sendErr) {
+      const isBackstopTimeout = noOutputBackstopMs > 0
+        && sendErr.message === `${sendPromptLabel} timed out after ${noOutputBackstopMs}ms`;
+      if (!isBackstopTimeout) { throw sendErr; } // a genuine sendPromptAsync failure — unchanged behavior
+      // The backstop deadline won the race — OpenCode never returned from the
+      // prompt-send call at all; the "accepts, never responds" shape dies
+      // upstream of the poll loop entirely. Swallow the orphaned promise so it
+      // can never surface as an unhandled rejection whenever/if it eventually
+      // settles on its own (Promise.race already subscribes each racer
+      // internally, so this is defensive belt-and-suspenders, not load-bearing
+      // — verified empirically before relying on it).
+      sendPromptPromise.catch(() => {});
+      backstopFired = true;
+      logger.warn('No-output backstop fired before the prompt send resolved', {
+        taskId, sessionId, backstopMs: noOutputBackstopMs,
+      });
+    }
 
     const mirror = createMirrorState();
     let completed = false;
@@ -474,6 +527,14 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     let aborted = false;
     let sessionError = null; // Captures model/SDK errors from assistant messages
 
+    // Seed sessionError exactly like the #37 boundary-provider-error case right
+    // below does, so the run ends with a usable reason (the poll loop is
+    // skipped entirely on this path — see the while-condition and the
+    // backstop-abort block further down).
+    if (backstopFired) {
+      sessionError = noOutputBackstopReason();
+    }
+
     // Hard provider failure detected at the client boundary (#37): a non-2xx /
     // 402 from promptAsync surfaces here even when the server never emits an
     // assistant message carrying info.error. Seed sessionError so the loop's
@@ -573,7 +634,14 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       return false;
     };
 
-    while (!completed && (Date.now() - startTime) < timeoutMs) {
+    // `!backstopFired`: a no-op for the pre-existing mid-loop firing path (that
+    // branch already `break`s the instant it sets backstopFired, so this outer
+    // condition is never re-checked with it true from there) — it only matters
+    // for the NEW pre-send-timeout path above, where backstopFired can already
+    // be true before the loop ever starts. Skips the loop entirely rather than
+    // burning one wasted pollIntervalMs sleep before falling through to the
+    // post-loop abort block below.
+    while (!completed && !backstopFired && (Date.now() - startTime) < timeoutMs) {
       watchdog.touch();
       await new Promise(resolve => setTimeout(resolve, pollIntervalMs));
 
@@ -729,6 +797,26 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
           || newAssistant || reasoningActivity || settleActivity;
         if (progressed) { lastProgressAt = Date.now(); }
 
+        // v4.6.2 PR2 amendment 2 (controller live smoke + debug trace): the
+        // backstop disarms only on SUBSTANTIVE activity — output, reasoning,
+        // or tool motion (the spec's "first token/reasoning/tool_use").
+        // messageActivity/newAssistant are excluded: OpenCode creates an empty
+        // assistant placeholder on prompt ACCEPTANCE, which is precisely the
+        // accepted-but-not-serving bookkeeping the backstop must not trust.
+        // `progressed` itself (and every stall/idle consumer of it above) is
+        // deliberately untouched — this is a narrower, backstop-only signal.
+        const substantiveActivity = outputGrew || toolActivity || resultActivity
+          || reasoningActivity || settleActivity;
+
+        // No-output backstop: one tick per poll. Fired is terminal — break the
+        // loop; the post-loop block below mirrors the timeout path.
+        if (noOutputBackstop.tick(substantiveActivity, Date.now()) === 'fired') {
+          backstopFired = true;
+          sessionError = noOutputBackstopReason();
+          logger.warn('No-output backstop fired', { taskId, backstopMs: noOutputBackstopMs });
+          break;
+        }
+
         // B53: a wedged tool call (tool_use emitted, result never arrives) otherwise
         // burns the full --timeout with zero output — the stable-poll idle gate above
         // requires mirror.output.length > 0, which a pre-text wedge never satisfies.
@@ -832,7 +920,15 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     });
 
     // Handle timeout
-    if (!completed && !aborted && (Date.now() - startTime) >= timeoutMs) {
+    // v4.6.2 PR2 fix wave: `!backstopFired` — the backstop's own break can
+    // land after the post-break poll tail (getMessages + mirror processing
+    // already inside that iteration) has ALSO crossed timeoutMs when the two
+    // thresholds are configured close together, so this block must yield
+    // once the backstop already ended the leg. Exactly one terminal-timing
+    // signal per leg: statusFromResult() (src/utils/result-schema.js) checks
+    // timedOut BEFORE error, so a leg carrying both would misreport as an
+    // ordinary 'timeout' instead of the distinctly-named backstop reason.
+    if (!completed && !aborted && !backstopFired && (Date.now() - startTime) >= timeoutMs) {
       timedOut = true;
       logger.warn('Task timed out', { taskId, elapsed: Date.now() - startTime });
 
@@ -846,6 +942,20 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       }
     }
 
+    // Backstop fired: abort the OpenCode session exactly like the timeout path
+    // (the agent keeps running otherwise). The leg's error already carries the
+    // NO_OUTPUT_BACKSTOP reason; no separate degrade machinery — the ordinary
+    // dead-leg path (SL-2 retry, sink announcement, exit codes) inherits it.
+    if (backstopFired && !completed && !aborted) {
+      try {
+        const { abortSession } = require('./opencode-client');
+        await abortSession(client, sessionId, ...dirArgs);
+        logger.info('Session aborted after no-output backstop', { taskId, sessionId });
+      } catch (abortErr) {
+        logger.warn('Failed to abort session after backstop', { error: abortErr.message });
+      }
+    }
+
     watchdog.cancel();
     if (uninstallSignals) { uninstallSignals(); }
 

package/src/mcp-council-awareness.js

@@ -185,6 +185,7 @@ function buildCouncilStatusPayload(project, taskId) {
     legsTotal, legsComplete, elapsed: elapsedOf(run),
     exitCode: run.exitCode !== undefined ? run.exitCode : null,
     version: RUNNING_VERSION,
+    degrades: run.degrades || [],
   };
   if (usageLegs.length) { payload.usage = rollupWaveUsage(usageLegs); }
   if (allLegIds.length) {

package/src/opencode-client.js

@@ -557,6 +557,27 @@ function buildServerOptions(options = {}) {
     : (options.model ? [options.model] : []);
   config.provider = buildProviderModels(resolvedForProvider);
 
+  // v4.6.2 PR1 (spec §4, D1/D2): a host-form ANTHROPIC_BASE_URL is correct
+  // for Anthropic SDKs (they append /v1) and fatal for OpenCode's
+  // direct-anthropic provider (it appends /messages -> 404). Carry the
+  // normalized full-prefix form as a provider-config override — config-level,
+  // no process env is written anywhere. AMICUS_BASE_URL_NORMALIZE=0 disables.
+  // Merge order keeps any existing options.baseURL authoritative (M-5 lesson:
+  // never clobber a user-authored value with a derived one).
+  const { resolveBaseUrlOverride, announceBaseUrlNormalizationOnce } = require('./utils/base-url-classify');
+  const baseUrlEnv = options._env || process.env;
+  const anthropicBaseUrl = resolveBaseUrlOverride(baseUrlEnv);
+  if (anthropicBaseUrl) {
+    if (!Object.prototype.hasOwnProperty.call(config.provider, 'anthropic')) {
+      config.provider.anthropic = { models: {} };
+    }
+    config.provider.anthropic.options = {
+      baseURL: anthropicBaseUrl,
+      ...(config.provider.anthropic.options || {}),
+    };
+    announceBaseUrlNormalizationOnce(baseUrlEnv.ANTHROPIC_BASE_URL, anthropicBaseUrl, options._noticeDeps);
+  }
+
   // Register custom 'chat' agent: reads auto-approved, writes/bash require permission
   const chatAgent = {
     description: 'Conversational agent — reads are auto-approved, writes and commands require permission',

package/src/sidecar/fanout-leg.js

@@ -74,7 +74,7 @@ function buildRoutingFailureLeg({ leg, legId, waveId, quiet }) {
  * Adds `.reason` (alias of buildRunResult's `.error`) and `.legId` so the
  * fallback loop reads a stable shape without re-deriving them.
  */
-async function runSingleAttempt({ leg, legId, waveId, project, directory, follow, systemPrompt, userMessage, timeoutMs, agent, client, server, summaryLength, reasoning, quiet, foldNonce }) {
+async function runSingleAttempt({ leg, legId, waveId, project, directory, follow, systemPrompt, userMessage, timeoutMs, agent, client, server, summaryLength, reasoning, quiet, foldNonce, noOutputBackstopMs }) {
   const { IdleWatchdog } = require('../utils/idle-watchdog');
   const { markAborted } = require('../utils/session-abort');
   const { runHeadless } = require('../headless');
@@ -121,7 +121,7 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     result = await runHeadless(
       leg.model, systemPrompt, userMessage, legId, project,
       timeoutMs, agent || 'build',
-      { client, server, watchdog, summaryLength, reasoning, nonce: foldNonce, directory }
+      { client, server, watchdog, summaryLength, reasoning, nonce: foldNonce, directory, noOutputBackstopMs }
     );
   } catch (err) {
     result = { summary: '', completed: false, timedOut: false, aborted: false, error: err.message, taskId: legId };

package/src/sidecar/fanout.js

@@ -267,7 +267,7 @@ async function runFanout(options) {
         timeoutMs, agent: options.agent, client, server,
         summaryLength: options.summaryLength, reasoning, quiet: options.quiet,
         foldNonce, directory: options.directory, follow,
-        fallback: options.fallback, catalog: options.catalog,
+        fallback: options.fallback, catalog: options.catalog, noOutputBackstopMs: options.noOutputBackstopMs,
       });
     }));
   } finally {