amicus 4.6.1 → 4.6.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.6.1",
+  "version": "4.6.3",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -5,6 +5,158 @@ All notable changes to Amicus are documented here. Format follows
 
 ## [Unreleased]
 
+## [4.6.3] - 2026-08-05
+
+### Added
+
+- **`fable` now carries an authored direct-Anthropic route** (`anthropic/claude-fable-5`,
+  verified live: Anthropic's `/v1/models` lists it and a direct leg serves). With an
+  Anthropic key present, `fable` routes direct-first like the other Anthropic aliases;
+  the `ANTHROPIC_MODELS` floor gains a matching row so keyless installs validate it.
+- **`doctor` gains a `session-metadata-tmp` check; `--fix` sweeps the orphans.** A kill
+  between an atomic write's tmp-file and rename leaves `.metadata.json.*.tmp` orphans in
+  per-session directories (the B09 class — ~30 write sites). Plain `doctor` reports them;
+  `--fix` removes orphans older than 60 s from the current project's sessions root and
+  announces the heal in the one voice (`Recovered: …`).
+- **`council save` announces when it shadows a built-in bench.** Saving a council named
+  `free`/`budget`/`frontier` previously printed no notice at all (the overwrite marker only
+  tracked user-config names); the save now reports `shadowsBuiltin` (`--json`) and prints
+  the shadow notice.
+
+### Fixed
+
+- **`models --check` no longer false-flags deliberate gateway-only routes.** A curated
+  alias whose direct form is derived (not authored) from its OpenRouter route is no
+  longer reported STALE — flat row, `GATEWAY STALE` row, candidates, and the
+  `fix: --add-alias` retarget suggestion all suppressed together — when the OpenRouter
+  route still serves. Deliberately gateway-only entries (`gpt-pro`) are annotated in
+  the curated data and never audited for a direct sibling. Kills the v4.6.2
+  release-gate false positive whose suggested "fix" was a silent tier downgrade.
+- **The Workspace seats panel's dead-seat rows are now role-aware and old-run
+  resilient.** A model that died as critic but succeeded as chair no longer has
+  its dead row hidden by the chair's cost row (only a live reviewing leg —
+  seat/critic/lens — suppresses, and a dead critic only by a live critic leg);
+  the dead critic's row names its role. Pre-v4.6 runs render their losses too:
+  `verdict.seatLoss.deadBenchSeats` feeds rows, and `verdict.json`'s
+  `degrades[]` backstops a `run.json` that lost its checkpoint. A stale
+  `get-run` reply from a run you navigated away from can no longer repaint the
+  run now open.
+- **A valueless `-o`/`--out` on `council verdict` now errors** (`BAD_ARGS`, flag named,
+  exit 1) instead of crashing mid-write (renameSync `TypeError`) and orphaning a
+  `true.tmp-<pid>` temp file. Behavior change, per the v4.6.3 R1 ruling.
+- **README corrections from the v4.6.3 accuracy review**: the Node.js floor is
+  22.12 (required since v3.0 — the README, install scripts, landing page, and
+  `amicus doctor`'s node check still said 18), and the optional-council-elements
+  list now matches the shipped skill (four opt-ins; the chair's verdict scale
+  has been standard, not opt-in). The doctor's `node` row now errors below
+  22.12 (it previously passed anything ≥ 18).
+
+### CI
+
+- **The MCP-Registry skip-check now verifies the version it trusts.** The
+  release workflow's idempotency pre-check previously skipped registry publish
+  on a bare HTTP 200; it now also requires the response body to both name the
+  exact version and report it as `active`, so preview-API schema churn — or a
+  stale/deprecated registry entry — can no longer produce a false skip. Every
+  new failure mode still routes toward publishing.
+
+## [4.6.2] - 2026-08-05
+
+### Added
+
+- **Headless legs now fail fast when a model produces nothing.** A leg that produces zero
+  output, reasoning, or tool calls for `AMICUS_NO_OUTPUT_BACKSTOP_MS` (120 s default,
+  env-tunable) is failed with `NO_OUTPUT_BACKSTOP: …` instead of burning the full `--timeout`
+  to learn nothing — the "accepted but not serving" class. Disarms permanently on the first
+  sign of activity, so slow cold-prefill local models are unaffected; `0` (or negative)
+  disables it.
+- **`doctor` gains a new `anthropic-base-url` row.** Prints the exact `ANTHROPIC_BASE_URL` the
+  process sees and how it will be treated — the host-form value can live only in a parent
+  process's environment, so the seen value is the only diagnostic there is.
+- **Host-form `ANTHROPIC_BASE_URL` is now carried into the engine as `<value>/v1` by default**
+  (a provider-config override — zero env vars written; announced once per process).
+  Host-form is the Anthropic-SDK convention (the SDK appends `/v1` itself), but OpenCode's
+  provider layer treats the value as the full prefix, so unnormalized host-form previously
+  404'd every direct-Anthropic leg. `AMICUS_BASE_URL_NORMALIZE=0` disables normalization
+  entirely.
+- **`models --check` and the `doctor` aliases row now flag stored-alias drift**: a stored alias
+  that's still catalog-listed but no longer matches any route its family currently resolves to
+  (the v4.6.1 `gemini` release-gate class), with the exact `setup --add-alias` refresh command.
+- **`models --check` gains an opt-in `--live` probe.** `--check --live` sends one real, tiny
+  request to every *stored* alias (curated defaults are out of scope) on a single quiet fan-out
+  wave and reports `SERVED` / `SILENT` (`accepted-but-silent`) / `ERROR` per alias — the
+  on-demand version of the check that would have caught the v4.6.1 `gemini` incident (a
+  catalog-listed model no longer actually served). Spends real money: one tiny leg per stored
+  alias. Non-served outcomes fold into the existing exit code; a stored-alias count above the
+  fan-out leg cap (`AMICUS_FANOUT_MAX_LEGS`) fails fast before anything is probed. When the
+  probe can't run (catalog unavailable, or `--refresh` also passed), Amicus announces the skip
+  instead of silently dropping the flag.
+- **The Council Workspace seats panel now shows seats a run announced dead.** The **Seats**
+  table appends a row for every seat with zero usable legs — derived from `run.json`'s
+  `degrades[]` (dead-leg/dead-wave records) and the critic's `verdict.seatLoss` — with a
+  blind-maskable model name (a dead seat has no anonymity label, so blind mode renders
+  `(masked)` rather than leak the raw id), `did not review — retried once` (the degrade
+  recorded a `retryWaveId`) or plain `did not review`, no cost cell, and muted seat-dead
+  styling. Dead rows appear live, mid-poll: as soon as the run checkpoints the loss — always
+  post-retry, so a row never lands before the seat's one shot at recovery is spent — it paints
+  and stays through every tick after (immediately for a dead-wave seat; at that stage's
+  boundary for a dead-leg seat, since the panel keeps suppressing the row while the seat's own
+  errored-leg entry is still listed live); the run's terminal refresh then additionally unions
+  the critic's `seatLoss` on top, for any loss the live payload alone didn't carry.
+- **The chair fallback walk now records every attempt on `run.json`.** Each leg it tries — `ch1`
+  (the requested chair), `ch2` (a same-chair retry), `ch3` (the ledger-promoted fallback) —
+  appends an entry to an additive `chairAttempts[]` array (`{waveId, model, outcome, reason}`,
+  `outcome ∈ completed|error|timeout|no-output`), checkpointed after every attempt so a mid-walk
+  kill never loses what already ran. When no chair leg completes at all, the `chair-failed`
+  degrade's "What was lost" `why` now names each attempt's cause instead of one flat sentence —
+  `ch1 <model>: <reason> · ch2 <model>: <reason> · ...` — while a chair that ran but produced no
+  parseable VERDICT line keeps its original flat why (the walk didn't fail). The `ch4`
+  VERDICT-line repair re-prompt is deliberately not counted as an attempt — its chair leg already
+  completed; only the verdict line gets re-prompted.
+
+### Fixed
+
+- **The `gpt` quick-pick family stopped resolving once OpenAI split 5.6 into
+  tiers.** `idPattern` only matched bare numeric ids (`gpt-5.5`), so it missed
+  5.6 entirely — `gpt-5.6-sol` (premium), `gpt-5.6-terra` (mid), `gpt-5.6-luna`
+  (economy), and their `-pro` siblings all fell outside it, leaving the family
+  pinned to the older `gpt-5.5` and the owner's stored `gpt` alias reported as
+  DRIFTED. Per owner ruling, `gpt` now tracks the TERRA (mid) tier: the
+  pattern additionally matches `-terra` while still excluding `-terra-pro`,
+  `-sol*`, `-luna*`, and the unrelated `-codex` family; the pinned fallback
+  moves to `openrouter/openai/gpt-5.6-terra`. Bare numeric ids stay matched as
+  a within-family fallback.
+- **The curated `opus` pin fell behind the live catalog.** Both routes move from Claude
+  Opus 4.8 to Claude Opus 5: `openrouter/anthropic/claude-opus-5` plus the authored
+  direct `anthropic/claude-opus-5` (verified against the live catalog and Anthropic docs
+  2026-08-04 — authored, never derived; anthropic stays in `DIVERGENT_VENDORS`). Same
+  live price, so the `frontier` bench's pricing evidence is unchanged. The offline
+  `ANTHROPIC_MODELS` floor gains a matching `anthropic/claude-opus-5` row so keyless and
+  offline installs never report the shipped default stale. Opus 5's two gateway forms
+  coincide (no dotted version segment), so the dot-vs-dash regression guards now ride
+  `haiku`, the surviving divergent-form alias.
+
+### Removed
+
+- **The `devstral` alias** (owner ruling 2026-08-04). OpenRouter delisted the entire
+  devstral family — zero matches across the live catalog, any vendor — and the alias had
+  no other route. No served model is a devstral successor, so the alias was dropped
+  rather than retargeted ("no pinned guess is better than a wrong one"); `mistral`
+  remains the vendor's alias, and a stored `devstral` alias in user config is flagged
+  with replacement suggestions by `models --check` / `doctor`. This was the pin that made
+  `models --check` exit 1 — the v4.6.2 release-gate risk.
+
+### CI
+
+- **The macOS/node-24 unit leg now runs jest with `--workerIdleMemoryLimit=1GB`.** That leg —
+  and only that leg — intermittently lost a worker to a native SIGSEGV ("A jest worker process
+  was terminated by another process"), which fails whichever suite occupied the worker with
+  zero assertion failures and a green rerun. Three confirmed hits (2026-07-31
+  run-cost-unknown, 2026-08-04 PR #100 update-notice, 2026-08-05 PR #105 — 6466 passed, the
+  dead worker alone failed 1 suite) tripped the standing third-occurrence rule. The limit
+  makes jest recycle an idle worker before the leak reaches segfault territory; the flag is
+  injected via a matrix `include`, so the other five legs still run a bare `npm test`.
+
 ## [4.6.1] - 2026-08-03
 
 ### Added

package/README.md

@@ -12,7 +12,7 @@ Hand Claude a plan, a design, a diff, an architecture decision, a manuscript —
 
 [![npm version](https://img.shields.io/npm/v/amicus?color=D97757&labelColor=1A1C29)](https://www.npmjs.com/package/amicus)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue?labelColor=1A1C29)](./LICENSE)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D18-brightgreen?labelColor=1A1C29)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D22.12-brightgreen?labelColor=1A1C29)](https://nodejs.org)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?labelColor=1A1C29)](./CONTRIBUTING.md)
 
 **[Quick start ↓](#quick-start)** · [Commands](#commands) · [Documentation](#documentation) · [Troubleshooting](#troubleshooting)
@@ -99,12 +99,11 @@ flowchart LR
   findings-by-tier, cost — no chair prose). This is the default artifact handed to the user.
 - For an **editable source**, the accepted edits land in `<stem>-reviewed.<ext>` next to the original.
 
-**Optional council elements** (v2.2.0, all default off): five opt-in behaviors, offered once as a menu at launch — nothing turns on unless you name it, and the confirmation lists exactly what's on.
+**Optional council elements** (v2.2.0, all default off): four opt-in behaviors, offered once as a menu at launch — nothing turns on unless you name it, and the confirmation lists exactly what's on. **Chair verdict scale** *(standard since v2.2.0's follow-ups — no longer opt-in)*: the chair always closes with 3–5 hard questions and one parseable `VERDICT: Ship it | Fix these first | Fundamental rethink` line.
 
 - **Critic seat** — one reviewer swaps to a four-pass adversarial brief (adversarial pass, edge-case hunt, consistency check, executability test). Its findings enter the same anonymized bundle as everyone else's, so the bench disciplines the critic: manufactured negativity lands Disputed and dies in the tally.
 - **Expert lenses** — each reviewer takes a distinct expert perspective; you pick the panel domain (business, technical, customer, financial, or custom). Lens runs never feed the reliability ledger, and the report discloses the weakened cross-review anonymity.
 - **Debate mode** — after cross-review, every Contested or Disputed finding goes back to its raiser to **defend, amend, or withdraw**, and the disputing judges re-vote. Exactly one rebuttal round, then the final tally.
-- **Chair verdict scale** — the chair closes with 3–5 hard questions and one parseable line: `VERDICT: Ship it | Fix these first | Fundamental rethink`.
 - **Claude in the council** — Claude adds its own fresh review to the bundle so the bench ranks and adjudicates it. Claude is *judged* but never votes or chairs, so the verdict stays independent.
 
 The critic and lens methodologies are adapted from the `/critic` and `/debate` agents in [John Renaldi's product-kit](https://github.com/jrenaldi79/plugin-marketplace) (MIT); the briefing boilerplate lives in [`skills/second-opinion/SEAT-BRIEFS.md`](./skills/second-opinion/SEAT-BRIEFS.md).
@@ -192,7 +191,7 @@ Every path delivers the MCP server and both skills. They differ in what else you
 
 #### With npm — recommended
 
-The canonical path, and the one that gets you the full interactive experience (needs [Node.js](https://nodejs.org) ≥ 18):
+The canonical path, and the one that gets you the full interactive experience (needs [Node.js](https://nodejs.org) ≥ 22.12):
 
 ```bash
 npm install -g amicus
@@ -202,7 +201,7 @@ This is the path to pick unless you specifically want the plugin's slash command
 
 #### With the install script
 
-Same result as npm, one command — macOS, Linux, or Windows (needs [Node.js](https://nodejs.org) ≥ 18):
+Same result as npm, one command — macOS, Linux, or Windows (needs [Node.js](https://nodejs.org) ≥ 22.12):
 
 ```bash
 # macOS / Linux
@@ -333,7 +332,7 @@ Everything you need before your first run, and what's optional.
 
 **Runtime**
 
-- **Node.js ≥ 18** — `node --version` to check. This is the only hard runtime prerequisite.
+- **Node.js ≥ 22.12** — `node --version` to check. This is the only hard runtime prerequisite.
 - **An active Claude Code or Cowork session** — Amicus is orchestrated by Claude; it is not a standalone chatbot.
 
 **Install path & the git toolchain**
@@ -441,7 +440,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.6.1",
+  "version": "4.6.3",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
@@ -552,7 +551,7 @@ Run `amicus doctor` first — it checks keys, catalog, OpenCode binary, Electron
 | Install fails partway, or `amicus doctor` reports the OpenCode binary "not found" | A **transient** error during the OpenCode engine's own postinstall (a spawn `ENOENT`, or an antivirus file-lock while it lays down its 11 per-platform binaries) can roll back the whole atomic install — retrying usually succeeds | Just re-run `npm install -g amicus`. If it still fails, clear the cache first: `npm cache clean --force && npm install -g amicus`. |
 | `401` / auth error | No usable key for the model's vendor — bare `provider/model` ids fall back to `OPENROUTER_API_KEY` automatically, so this means neither the direct key nor an OpenRouter key is configured (or `--gateway direct`/`openrouter` forced a gateway whose key is missing) | Run `amicus setup`, or `amicus key <provider> <key>` to add the missing key; see [Routing](#routing). |
 | `402` / "Payment Required" on first council review / `start` / `fanout` call | Your OpenRouter key is real but has no credit. Key save (`amicus key openrouter <key>` or the setup wizard's key step) only checks that the key **authenticates** — it doesn't check balance, so a zero-credit key saves cleanly and only fails later, on the first real model call. (The `amicus council` subcommand itself is deterministic math and never calls a model.) | Add credit at [openrouter.ai/credits](https://openrouter.ai/credits), **or** switch to a zero-cost council: `amicus setup` → option 2 (Free OpenRouter council) builds one from live `:free`-suffixed models and saves it as `councils.free` — then run `amicus fanout --council free …`. See [Free council (zero-cost)](#free-council-zero-cost) above. |
-| Every direct `anthropic/…` model (`haiku`, `sonnet`, `opus`, `claude`) errors `Not Found` in ~2 s at zero tokens, but the same model works via `openrouter/anthropic/…` | An inherited `ANTHROPIC_BASE_URL` missing its `/v1` path segment. The engine appends only `/messages`, so requests hit `https://api.anthropic.com/messages` → HTTP 404 with an empty body → the bare status text. A shell spawned by Claude Code sets the `/v1`-less form for you. The model id, alias, and key are all fine. | `export ANTHROPIC_BASE_URL=https://api.anthropic.com/v1`, or unset it entirely, or pass `--gateway openrouter`. In a council a dead seat **degrades the run instead of failing it** — smoke-test each seat with one throwaway `amicus start` before paying for a council. See [docs/troubleshooting.md](./docs/troubleshooting.md#every-direct-anthropic-model-fails-with-not-found). |
+| Every direct `anthropic/…` model (`haiku`, `sonnet`, `opus`, `claude`) errors `Not Found` in ~2 s at zero tokens, but the same model works via `openrouter/anthropic/…` | An inherited host-form `ANTHROPIC_BASE_URL` (missing `/v1`) — the Anthropic-SDK convention, not OpenCode's; a shell spawned by Claude Code sets it for you. **Since v4.6.2 amicus normalizes this to `<value>/v1` automatically** (a provider-config override, announced once on stderr) — the model id, alias, and key were never the problem, and now neither is the URL, unless `AMICUS_BASE_URL_NORMALIZE=0` is set or the path is nonstandard. | Should now self-heal — confirm with `amicus doctor`'s `anthropic-base-url` row (shows the value seen + its treatment). Still failing: unset `AMICUS_BASE_URL_NORMALIZE` if you set it, or `export ANTHROPIC_BASE_URL=https://api.anthropic.com/v1` / unset the var entirely / pass `--gateway openrouter`. In a council a dead seat **degrades the run instead of failing it** — smoke-test each seat with one throwaway `amicus start` before paying for a council. See [docs/troubleshooting.md](./docs/troubleshooting.md#every-direct-anthropic-model-fails-with-not-found). |
 | `Model 'X' is unverified against the direct catalog; attempting anyway` for a model that plainly exists | Not a claim the model is wrong — amicus **couldn't check**. That vendor's direct catalog fetch failed (usually a stale or truncated stored key), leaving its namespace empty, and an empty namespace never blocks a launch. The engine may still run the model from its own credential store, so a working model warns forever. | `amicus models --refresh` and watch for a provider that stays empty; re-save the good key with `amicus key <provider> <apikey>`. See [docs/troubleshooting.md](./docs/troubleshooting.md#model-x-is-unverified-against-the-direct-catalog-attempting-anyway). |
 | Session not found | No session matches the given ID | Run `amicus list`, or omit `--session-id` to use the most recent. |
 | No conversation history found | Project-path encoding | Check `~/.claude/projects/`; `/` and `_` in the project path are encoded as `-` in the directory name. |

package/docs/ROADMAP.md

@@ -7,10 +7,10 @@ major jump, gated on funding/cofounder. The observability arc is split so the **
 first (v4.3)** and the **Electron "Council Workspace" (v4.4)** rides on top of it. `--dry-run` cost
 preview dropped to the backlog.
 
-Amicus is at **v4.6.0** (tagged 2026-08-02). Each 4.x rev below leads with the benefit, not the
+Amicus is at **v4.6.2** (tagged 2026-08-05). Each 4.x rev below leads with the benefit, not the
 plumbing.
 
-**Status:** v4.0 through **v4.6.0** have **shipped** — everything down to the v4.7 heading is a
+**Status:** v4.0 through **v4.6.2** have **shipped** — everything down to the v4.7 heading is a
 record of what landed, not a plan. **v4.7 (composition + tagging + GUI ergonomics) is the next
 planned rev** — that scope carried the number v4.6 here until the degrade-announcement-invariant
 milestone took the v4.6.0 release (2026-08-02); renumbered, not descoped. v5.0 remains
@@ -135,6 +135,40 @@ as hard as a crash.
 > the user which one. That silent-degrade class was ruled a north-star violation and took the rev
 > number; the composition scope below moved to v4.7.
 
+**v4.6.1 (shipped 2026-08-03):** the follow-on point release — **SL-2** ("a lost seat gets one
+more chance": the once-only Stage-1 retry with `Recovered:` heals, ruled heal-first off SL-3),
+the **MCP update notice**, the `rebuildElectron` hint deletion, and the **fold-back-corrected
+MODEL-NOTES seed** (PR #93). Ninth consecutive first-attempt publish.
+
+### v4.6.1 / v4.6.2 — the field-report five *(patch train)* — ✅ SHIPPED v4.6.2, 2026-08-05
+Field-report-driven hardening in five sequential PRs plus one ruling follow-up: the
+`ANTHROPIC_BASE_URL` diagnosis pair (doctor row + host-form normalization) and stored-alias
+drift warning (#95); doctor-suite hermeticity (#96); the no-output backstop —
+`AMICUS_NO_OUTPUT_BACKSTOP_MS`, legs that produce nothing fail fast with a real reason (#99);
+`models --check --live` — one quiet paid wave proves stored aliases actually SERVE (#100);
+Workspace dead-seat rows — an announced-dead seat renders on the seats panel, live mid-poll
+after the owner's ruling, blind-masked (#102, #103); chair-attempt records — the fallback walk
+is diagnosable from `run.json` (`chairAttempts[]`, #105). The v4.6 announcement invariant now
+reaches the surface users watch and the artifact they keep.
+
+### v4.6.3 — the post-train sweep *(patch)* — ✅ SHIPPED v4.6.3, 2026-08-05
+A four-PR correction patch: the models audit stops crying wolf, the seats panel stops being
+fooled, and a handful of proven small defects land with tests.
+- **Audit routing-choice + fable direct route** — `models --check` stops flagging deliberate
+  gateway-only routes like `gpt-pro` STALE (no more harmful downgrade suggestion); fable gains an
+  authored `anthropic/claude-fable-5` route and routes direct-first with an Anthropic key — #107
+- **Role-aware, old-run-resilient dead-seat rows + openRun guard** — a model dead as critic but
+  alive as chair now renders its dead row; pre-v4.6 runs render dead rows from
+  `verdict.degrades`/`seatLoss.deadBenchSeats`; the third F09-class stale-reply hole
+  (`openRun`'s `get-run` reply) closes — #108
+- **Valueless `-o` + save-shadow notice + metadata tmp sweep** — a trailing bare `-o`/`--out`
+  now errors instead of orphaning a tmp file; `council save` announces when it shadows a
+  built-in bench; `doctor --fix` sweeps orphaned `metadata.json` tmp files — #109
+- **Registry body assert + Node-floor truth sweep + `makeBaseDeps()`** — the MCP-Registry
+  skip-check verifies the version *and* status it trusts, fail-toward-publish on every other
+  path; the README/install scripts/doctor all agree on the real Node ≥22.12 floor; eleven
+  duplicated doctor test fixtures consolidate into one factory — #110
+
 ## v4.7 — "Compose your councils" *(renumbered from v4.6, 2026-08-02 — spec + fresh plan at kickoff per the anti-rot rule)*
 **Benefit:** councils chain — generate → critique → refine with no manual copy-paste — and history
 becomes navigable.
@@ -143,8 +177,8 @@ becomes navigable.
 - **Session/wave tagging + `--search` + grouped history** (F8) *(S–M)*
 - **GUI power ergonomics** (F10: focus-follows fold hotkey, distinguishable window titles, tiling
   presets) *(S each)*
-- Deferred-item candidates per the v4.5 design doc's §8: RN-2, TST-1/TST-2, REL-2, CA-4, LC-5,
-  remainder of TST-7
+- Deferred-item candidates per the v4.5 design doc's §8: RN-2, TST-1/TST-2, REL-2, CA-4
+  (repair-solos half — the failed-chair half shipped v4.6.2), remainder of TST-7
 - **README + docs update** *(S)*
 > The 2026-07-19 combined spec (`2026-07-19-v4.5-policy-packs-composition-design.md`) holds the
 > approved chaining/tagging/F10 design detail and is the primary input to the v4.7 brainstorm; it

package/docs/configuration.md

@@ -36,14 +36,16 @@ Per vendor, the bare form's direct key is: `google/...` → `GOOGLE_GENERATIVE_A
 `DEEPSEEK_API_KEY`.
 
 **Inherited provider base URLs.** Amicus does not define or read `*_BASE_URL` variables for the
-hosted vendors above, but it does pass the whole environment through to the OpenCode engine, which
-hands them to the underlying provider SDK. `ANTHROPIC_BASE_URL` is the one that bites: the SDK
-appends only `/messages` to it, so it must include the `/v1` path segment. A value of
-`https://api.anthropic.com` (**no** `/v1`) makes every direct `anthropic/…` model fail with a bare
-`Not Found` at zero tokens, while the same models still work through OpenRouter. Some hosts set
-this for you — a shell spawned by Claude Code inherits the `/v1`-less form. Either export
-`https://api.anthropic.com/v1` or unset the variable. See
-[troubleshooting § Every Direct Anthropic Model Fails with `"Not Found"`](./troubleshooting.md#every-direct-anthropic-model-fails-with-not-found).
+hosted vendors above, and it still passes the whole environment through to the OpenCode engine,
+which hands them to the underlying provider SDK. `ANTHROPIC_BASE_URL` gets one extra treatment:
+the SDK appends only `/messages` to it, so it must include the `/v1` path segment, and some hosts
+set the `/v1`-less host-form for you — a shell spawned by Claude Code inherits it. **Since v4.6.2,
+amicus detects that host-form value and carries a normalized `<value>/v1` into the engine as a
+provider-config override by default** (no env var is rewritten) — see `AMICUS_BASE_URL_NORMALIZE`
+above to disable it, and `amicus doctor`'s `anthropic-base-url` row to see how your current value
+is being treated. Any other path (including an already-correct `/v1`) passes through unchanged.
+See [troubleshooting § Every Direct Anthropic Model Fails with `"Not Found"`](./troubleshooting.md#every-direct-anthropic-model-fails-with-not-found)
+for the pre-normalization failure mode and the manual fix if you've disabled the knob.
 
 ---
 
@@ -88,6 +90,7 @@ through OpenRouter as before.
 | `AMICUS_FANOUT_MAX_LEGS` | Cap the number of concurrent legs in a single fanout wave. Protects against accidental runaway costs when `--models` is a long list. Non-positive or non-integer values fall back to the default. | `10` |
 | `AMICUS_MCP_CLIENT` | Force the MCP server's `--client` value (`code-local`, `code-web`, or `cowork`) instead of auto-detecting it from the caller's MCP `initialize` handshake (`clientInfo.name`). Invalid values are ignored (with a warning) and detection proceeds normally. Note: `code-web` requires an explicit `--session-dir` and is not usable for MCP-spawned sessions. | auto-detected |
 | `AMICUS_MAX_SESSIONS` | Maximum number of concurrent sessions the shared OpenCode server (`src/utils/shared-server.js`) will track before rejecting new ones. Renamed from `SIDECAR_MAX_SESSIONS` in v2.0.0. | `20` |
+| `AMICUS_BASE_URL_NORMALIZE` | Set `0` to stop amicus from carrying a host-form `ANTHROPIC_BASE_URL` into the engine as `<value>/v1`. Host-form is the Anthropic-SDK convention (the SDK appends `/v1`); OpenCode treats the value as a full prefix, so unnormalized host-form 404s every direct-Anthropic leg. | `1` |
 
 ---
 
@@ -95,7 +98,7 @@ through OpenRouter as before.
 
 These variables control the polling loop that drives headless sessions. The defaults are conservative and work for almost all workloads. You only need them if you are running against unusually slow or fast model endpoints, or if you are building tooling on top of Amicus and need tighter completion detection.
 
-**Which of these accept `0`, and which ignore it.** The four `SETTLE` knobs in this table (`AMICUS_USAGE_SETTLE_POLLS`, `AMICUS_USAGE_SETTLE_INTERVAL_MS`, `AMICUS_USAGE_SETTLE_CALL_TIMEOUT_MS`, `AMICUS_TOOL_SETTLE_GRACE_MS`) read through `envNumber()` (`src/utils/env-num.js`), which honours an explicit, finite `0` — for those, `0` is a documented escape hatch and each row below says what it switches off. **Every other variable in this table reads through `Number(env) || default`, so `0` is falsy and silently falls back to the default** — there is no way to set them to zero, and that is deliberate: a `0` poll interval would busy-loop and a `0` stall threshold would kill every leg on its first poll. In both families a blank, missing or non-finite value falls back to the default.
+**Which of these accept `0`, and which ignore it.** Five knobs in this table — the four `SETTLE` knobs (`AMICUS_USAGE_SETTLE_POLLS`, `AMICUS_USAGE_SETTLE_INTERVAL_MS`, `AMICUS_USAGE_SETTLE_CALL_TIMEOUT_MS`, `AMICUS_TOOL_SETTLE_GRACE_MS`) plus `AMICUS_NO_OUTPUT_BACKSTOP_MS` — read through `envNumber()` (`src/utils/env-num.js`), which honours an explicit, finite `0` — for those, `0` is a documented escape hatch and each row below says what it switches off (`AMICUS_NO_OUTPUT_BACKSTOP_MS` treats any negative value the same as `0`). **Every other variable in this table reads through `Number(env) || default`, so `0` is falsy and silently falls back to the default** — there is no way to set them to zero, and that is deliberate: a `0` poll interval would busy-loop and a `0` stall threshold would kill every leg on its first poll. In both families a blank, missing or non-finite value falls back to the default.
 
 | Variable | Purpose | Default |
 |----------|---------|---------|
@@ -105,6 +108,7 @@ These variables control the polling loop that drives headless sessions. The defa
 | `AMICUS_STABLE_IDLE_POLLS` | Number of consecutive idle polls required when no explicit completion signal is received (approximately 60 s at the 2 s default). This is the fallback heuristic for models or SDK versions that don't emit a clean completion event. | `30` |
 | `AMICUS_MAX_CONSECUTIVE_POLL_FAILURES` | Consecutive poll failures before the headless runner bails. At the 2 s interval this is approximately 30 s. Prevents a dead server from burning the full session timeout on futile polls. | `15` |
 | `AMICUS_TOOL_CALL_STALL_MS` | How long a tool call may sit pending with **no** result and no output growth before the leg is failed with `Tool call stalled: <tool>` and its OpenCode session aborted. This is the wedge guard: it targets a leg producing nothing at all, and it is skipped while a tool-settle deferral is active (`AMICUS_TOOL_SETTLE_GRACE_MS` owns that decision instead, and ends in a completion rather than a failure). **`0` is ignored** — it falls back to the default rather than disabling the guard, because a `0` threshold would kill every leg on its first poll. There is no way to switch this off; raise it if you legitimately run very long single tool calls. | `180000` |
+| `AMICUS_NO_OUTPUT_BACKSTOP_MS` | Fail a headless leg fast when the model has produced no output, reasoning, or tool calls for this long — the "accepted but not serving" class. Disarms permanently on the first sign of activity, so slow cold-prefill local models are unaffected. **Set `0` (or negative) to disable the backstop entirely** — silent legs then run to the ordinary timeout. | `120000` |
 | `AMICUS_USAGE_SETTLE_POLLS` | How many extra `getMessages` reads run **after** a leg has already finished, to catch provider usage/cost that lands milliseconds after the completion signal (measured: real paid legs losing their cost by 29 ms and 155 ms). The loop breaks early as soon as every assistant message carries usage, so the common case is one extra read. **Set to `0` to disable the reconciliation entirely** — legs then report whatever usage was present at completion, which can be `$0` on a leg that really did cost money. | `3` |
 | `AMICUS_USAGE_SETTLE_INTERVAL_MS` | Delay between those settle reads. **`0` is honoured and means no delay** — the reads run back to back. It does **not** disable the reconciliation (that is `AMICUS_USAGE_SETTLE_POLLS=0`); it only removes the gap between attempts. | `400` |
 | `AMICUS_USAGE_SETTLE_CALL_TIMEOUT_MS` | Per-call deadline for a settle read and for the child-session (subagent) spend walk. Deliberately much tighter than `AMICUS_POLL_CALL_TIMEOUT_MS`: the leg is already finished, so a hung read must not add 30 s × 3 to a run's wall time. The effective value is the **smaller** of this and `AMICUS_POLL_CALL_TIMEOUT_MS`, so raising it above that has no effect. **`0` is honoured and means no timer is armed at all** — a hung settle read or subtree walk would then wait indefinitely. | `5000` |
@@ -243,9 +247,11 @@ Everything lives under `~/.config/amicus/` (`getConfigDir()` in `src/utils/confi
 metadata) use an atomic write: a temp file named `.<target>.<pid>.<random>.tmp` is written
 alongside the target, then renamed into place. A process killed between the write and the rename
 leaves an orphaned `.tmp` file behind forever — harmless, but it accumulates. `amicus doctor --fix`
-sweeps orphaned `sessions-index.json.*.tmp` files (only ones older than 60 seconds, so a live
-writer's in-flight tmp file is never touched); `amicus doctor` (without `--fix`) just reports the
-count.
+sweeps orphaned `sessions-index.json.*.tmp` files and, per-session, orphaned `.metadata.json.*.tmp`
+files (the B09 class, ~30 write sites — both `<taskId>/` and `<taskId>/subagents/<id>/` levels
+under the current project's `.claude/amicus_sessions/`); both sweeps only remove files older than
+60 seconds, so a live writer's in-flight tmp file is never touched. `amicus doctor` (without
+`--fix`) just reports the counts.
 
 ### Session storage
 

package/docs/council.md

@@ -176,7 +176,9 @@ Key semantics:
   same per-member reason) as a preview, before you spend anything.
 - Chair failure recovery: one retry of the same chair → promote the highest peers-only
   street-cred model (from `amicus council stats`) that is not a bench seat → give up and write
-  the verdict with `overallVerdict: null`.
+  the verdict with `overallVerdict: null`. Each attempt in that walk is additionally recorded on
+  `run.json` as `chairAttempts[]` (`{waveId, model, outcome, reason}`), checkpointed after every
+  attempt so a mid-walk kill preserves what already happened.
 - SIGINT/SIGTERM abort the active wave/solo, finalize `run.json` as `aborted`, exit 130/143.
   `amicus abort <councilRunId>` (and the MCP tools via the sessions-dir pointer file
   `council-<runId>.json`) work on council runs; `status`/`list` resolve them the same way.
@@ -329,7 +331,10 @@ launch:
   the Stage-2 contract carries no structured reason field, so rationale lives in prose; on a
   `--debate` run, a re-voted cell instead opens `revote-<model>.md` and also surfaces the
   structured `reason` `debate.json` records for that re-vote), chair verdict + street-cred +
-  Stage-4 decisions, and a cost-by-seat table with a `--max-cost` ceiling gauge.
+  Stage-4 decisions, and a cost-by-seat table with a `--max-cost` ceiling gauge. The Seats table
+  also lists any seat the run announced dead as a muted, no-cost row, live — as soon as the run
+  checkpoints the loss, no terminal wait required (a seat whose errored legs still occupy the
+  active stage's roster paints once that stage completes).
 
 **Historical runs** render entirely from the run directory — open any old `council-<runId>` at any
 time; nothing here requires the run to still be live.

package/docs/troubleshooting.md

@@ -5,7 +5,7 @@
 
 ## First: run `amicus doctor`
 
-Before working through any symptom below, run `amicus doctor` (plugin-only installs: `npx -y amicus@latest doctor`). It checks, in order: Node version, config directory, API keys, default model, catalog freshness, alias staleness, the OpenCode binary, the OpenCode engine's MCP launch path, Electron, installed skills, MCP registration, the legacy sidecar MCP entry, session index tmp files, OpenRouter credit, local providers, and the project root — and prints a targeted fix hint for every failing check. `amicus doctor --fix` self-heals what it can (e.g. re-installs a broken Electron in place); `--json` gives machine-readable output.
+Before working through any symptom below, run `amicus doctor` (plugin-only installs: `npx -y amicus@latest doctor`). It checks, in order: Node version, config directory, API keys, default model, catalog freshness, alias staleness and drift, the ANTHROPIC_BASE_URL form, the OpenCode binary, the OpenCode engine's MCP launch path, Electron, installed skills, MCP registration, the legacy sidecar MCP entry, session index tmp files, OpenRouter credit, local providers, and the project root — and prints a targeted fix hint for every failing check. `amicus doctor --fix` self-heals what it can (e.g. re-installs a broken Electron in place); `--json` gives machine-readable output.
 
 ---
 
@@ -56,33 +56,50 @@ one.** The council degrades around the missing model — the chair silently fall
 collapses from 3 seats to 2, and every finding comes back `confidence: "thin"` because it only ever
 had one peer corroborator. Nothing in `verdict.json` records that the roster changed.
 
-**Cause:** an `ANTHROPIC_BASE_URL` environment variable that is missing the `/v1` path segment.
-The OpenCode engine passes it straight through to `@ai-sdk/anthropic` as the SDK `baseURL`, and the
-SDK appends only `/messages` to it. With `ANTHROPIC_BASE_URL=https://api.anthropic.com` the engine
-therefore posts to `https://api.anthropic.com/messages` instead of
+**Cause:** an `ANTHROPIC_BASE_URL` environment variable in **host-form** — missing the `/v1` path
+segment. That's the Anthropic-SDK convention (the SDK appends `/v1` itself), not OpenCode's — its
+provider layer treats the value as the already-complete prefix and appends only `/messages`, so
+`https://api.anthropic.com` (no `/v1`) posts to `https://api.anthropic.com/messages` instead of
 `https://api.anthropic.com/v1/messages`. That URL returns HTTP **404 with an empty body**, so the AI
-SDK has no error payload to report and surfaces the bare HTTP status text — `Not Found`. The model
-id, the alias, and the API key are all fine; only the URL is wrong.
-
-Some hosts set this variable for you. Notably, running `amicus` from a shell spawned by Claude Code
-inherits `ANTHROPIC_BASE_URL=https://api.anthropic.com` (no `/v1`) from the host process, so amicus
-can fail this way on a machine where nothing in the amicus config is wrong.
-
-**Confirm it in one command** (no key needed for the first line):
+SDK has no error payload to report and surfaces the bare HTTP status text — `Not Found`. Some hosts
+set this variable for you: notably, a shell spawned by Claude Code inherits
+`ANTHROPIC_BASE_URL=https://api.anthropic.com` (no `/v1`) from the host process. The model id, the
+alias, and the API key are never the problem; only the URL is wrong.
+
+**Since v4.6.2, this self-heals by default.** Amicus classifies `ANTHROPIC_BASE_URL` on every
+engine start; when it's host-form, it carries a normalized `<value>/v1` into the engine as a
+provider-config override (no env var is rewritten) and prints one
+`Notice: ANTHROPIC_BASE_URL is host-form (…); passing …/v1 to the engine …` line to stderr, once per
+process. `amicus doctor` also gained an `anthropic-base-url` row that always prints the exact value
+it sees and how it's being treated. So on a current install, this failure should be rare — if
+you're seeing it anyway, it's one of:
+- **`AMICUS_BASE_URL_NORMALIZE=0` is set**, the deliberate escape hatch — it disables the fix
+  entirely. Easy to hit by accident if you set it while chasing something unrelated.
+- **`ANTHROPIC_BASE_URL` carries a nonstandard path** — anything other than blank/`/` (host-form)
+  or an already-correct `/v1` — which amicus passes through untouched rather than guessing (an
+  exotic proxy serving `/messages` at a custom root stays possible).
+- You're running a **pre-v4.6.2** amicus, where none of the above exists yet.
+
+**Confirm it in one command** (no key needed for the first three lines):
 
 ```bash
-echo "$ANTHROPIC_BASE_URL"          # if this prints a URL with no /v1 suffix, that's the cause
-amicus start --model openrouter/anthropic/claude-haiku-4.5 --prompt hi --no-ui   # works
-amicus start --model haiku --prompt hi --no-ui                                    # "Not Found"
+amicus doctor                        # anthropic-base-url row: the value seen + how it's treated
+echo "$ANTHROPIC_BASE_URL"           # host-form (no /v1 suffix) is the underlying condition
+echo "$AMICUS_BASE_URL_NORMALIZE"    # "0" here is what disables the automatic fix
+amicus start --model haiku --prompt hi --no-ui   # should complete; stderr shows the Notice line
+                                                  # the first time normalization actually fires
 ```
 
 **Fix** — pick one:
-- Add the missing segment: `export ANTHROPIC_BASE_URL=https://api.anthropic.com/v1`
-- Or unset it entirely and let the SDK use its own default:
-  `unset ANTHROPIC_BASE_URL` (PowerShell: `Remove-Item Env:\ANTHROPIC_BASE_URL`)
+- Unset `AMICUS_BASE_URL_NORMALIZE` (or set it to anything other than `0`) to restore the default
+  self-heal.
+- Still failing with normalization on? Add the missing segment yourself:
+  `export ANTHROPIC_BASE_URL=https://api.anthropic.com/v1` (PowerShell:
+  `$env:ANTHROPIC_BASE_URL = 'https://api.anthropic.com/v1'`), or unset the variable entirely:
+  `unset ANTHROPIC_BASE_URL` (PowerShell: `Remove-Item Env:\ANTHROPIC_BASE_URL`).
 - Or route Anthropic models through OpenRouter for the run: `--gateway openrouter`.
 
-Either of the first two makes `amicus start --model haiku …` complete normally. **Before spending
+Any of these gets `amicus start --model haiku …` completing normally again. **Before spending
 money on a council, run one throwaway `amicus start` against each configured seat** — a
 `Not Found` there costs nothing, whereas discovering it mid-council costs a degraded verdict.
 
@@ -188,6 +205,18 @@ For full headless configuration, see [docs/configuration.md](./configuration.md)
 
 ---
 
+## Headless Leg Fails with `NO_OUTPUT_BACKSTOP`
+
+**Symptom:** A headless leg (`amicus start --no-ui`, or one leg of a `fanout`/council run) fails with an error starting `NO_OUTPUT_BACKSTOP: model produced no output, reasoning, or tool calls in Ns`.
+
+**Cause:** The model endpoint accepted the request but produced nothing — no output, reasoning, or tool calls — for the entire backstop window (120 s by default). This is the "accepted but not serving" class: usually a dead or misconfigured endpoint, or a catalog-listed model that's no longer actually being served upstream.
+
+**Confirm:** `amicus models --check` — audits your configured aliases against the live catalog and flags drift/staleness. A model that still resolves locally but has quietly been retired upstream is exactly this failure mode, but a static audit only compares against the catalog's *listing* — it can't tell you whether a still-listed model actually answers. For that, run `amicus models --check --live` on demand: it sends one tiny real request to every stored alias and reports `SERVED` / `SILENT` / `ERROR` per alias, where `SILENT` (`accepted-but-silent`) is this exact `NO_OUTPUT_BACKSTOP` failure, caught deliberately instead of by accident. It spends real money (one tiny leg per stored alias) — see [docs/usage.md § `amicus models`](./usage.md#amicus-models--the-model-catalog) for cost, scope, and exit-code details.
+
+**Fix:** Check the alias's target (`amicus models --search <term>` to find the current id, then re-point the alias) — this is the common case. Raise `AMICUS_NO_OUTPUT_BACKSTOP_MS` only if a model legitimately needs more than 120 s to produce its first token; see [docs/configuration.md § Headless Poller Tuning](./configuration.md#headless-poller-tuning).
+
+---
+
 ## Multiple Active Sessions / Wrong Session Picked Up
 
 **Symptom:** Amicus resumes or reads from the wrong session.

package/docs/usage.md

@@ -376,10 +376,35 @@ amicus models                 # List the catalog
 amicus models --search gemini # Filter by substring over id and name
 amicus models --refresh       # Force-refresh from provider APIs
 amicus models --check         # Audit your aliases against the catalog
+amicus models --check --live  # + probe every stored alias with a real leg (spends)
 ```
 
 `amicus models --check` exits with the **number of stale aliases** (capped at 100) and prints same-vendor replacement suggestions for each, so it drops cleanly into CI.
 
+**Gateway-only routes.** A curated alias whose direct form is *derived* from its OpenRouter route (rather than
+authored) is not reported STALE when that direct form is missing from the vendor's
+direct namespace while the OpenRouter route still serves — a gateway-only route with
+no direct sibling is a routing choice, not staleness. Deliberately gateway-only
+entries (e.g. `gpt-pro`) are annotated as such and are never offered a retarget.
+
+**Drifted aliases.** `--check` (and the `doctor` aliases row) also flags **`DRIFTED:`** stored aliases — a stored alias whose target is still catalog-listed but no longer matches any route its family currently resolves to (the v4.6.1 `gemini` release-gate class, where `doctor` stayed green while the model behind it had moved on). Each drift line prints the exact `amicus setup --add-alias <alias>=<current>` refresh command. Drift is informational only — unlike stale aliases, it never changes the exit code.
+
+**Live probe (`--check --live`).** Presence in the catalog is not proof of service — a stored alias can point at a model id the catalog still lists but the provider has quietly stopped serving (the v4.6.1 `gemini` incident). `--check` alone can't see that; `--live` can, by actually asking. Scope is **stored aliases only** (`amicus setup --add-alias`) — curated defaults follow the catalog by construction and have no "was it actually served" question for a live probe to answer. **This spends real money — one tiny leg per stored alias** — every probed alias gets one ordinary engine leg on a single quiet fan-out wave, with a real session dir and a real spend-ledger row, exactly as if you'd run it yourself.
+
+Each stored alias resolves to one of three outcomes:
+
+| Outcome | Example line | Meaning |
+|---------|--------------|---------|
+| `SERVED` | `SERVED: gemini -> openrouter/google/gemini-3.6-flash ($0.0004)` | The model answered; cost shown in parens. |
+| `SILENT` (`accepted-but-silent`) | `SILENT: probetest -> anthropic/claude-opus-4-8 — NO_OUTPUT_BACKSTOP: … (accepted but not serving)` | The endpoint accepted the request but produced nothing for the probe's 30 s backstop window (shorter than the ordinary 120 s default, and not tunable) — the exact "listed but not actually serving" failure this check exists to catch. |
+| `ERROR` | `ERROR:  gpt -> openai/gpt-5.6-terra — 402 Payment Required` | Routing, auth, or provider failure; the raw error is printed. |
+
+**Exit code.** The probe's non-served count folds into the same exit code as the static audit — `max(existing exit, min(nonServedCount, 100))` — so a single `SILENT` or `ERROR` fails the check even when every alias is otherwise catalog-fresh. No stored aliases prints `Live probe: no stored aliases to probe` and never affects the exit code. `--json` adds `probe` (the per-alias array) and `probeCount` (its length) to the `alias-audit` document — both additive, `[]`/`0` when `--live` wasn't passed.
+
+**Cap.** The probe is one fan-out leg per stored alias, so it's bound by the same fan-out leg cap as everything else — 10 by default, raise it with `AMICUS_FANOUT_MAX_LEGS`. More stored aliases than the cap fails fast with a one-line error and probes nothing, so a doomed wave never spends a token.
+
+**When it doesn't run.** `--live` requires `--check` (a bare `--live` errors immediately). If the catalog itself is unavailable, or `--refresh` is also on the command line (which returns before `--check` ever runs), the probe is skipped — Amicus says so instead of silently dropping the flag: `--live skipped: <reason> — nothing was probed`. The `--json` signal differs by path: for catalog-unavailable, the `alias-audit` document carries an additive `probeSkipped` field (a reason slug, e.g. `"catalog-unavailable"`; `null` once the probe actually ran or wasn't requested); for the `--refresh` case, `--json`'s stdout document is a `model-catalog` doc instead, which never carries `probeSkipped` — the announcement goes to stderr there so stdout stays valid JSON.
+
 **Validation on launch.** `start` and `fanout` validate the model against the catalog before launching. For an explicit `--model` on `continue`/`resume` this is **blocking** (a typo'd model fails fast with suggestions); for a model *inherited* from a prior session it's **advisory**. Skip it any time with `--no-validate-model`, or fix the catalog with `amicus models --refresh`.
 
 **Aliases are a curated seed, not a fixed list.** `amicus setup` seeds a curated set of short aliases (e.g. `gemini`, `gpt`, `opus`, `deepseek`), and you add or override them with `amicus setup --add-alias name=provider/model`. To see exactly what resolves on *your* machine, run `amicus models` — that is the source of truth.
@@ -443,7 +468,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.6.1",
+  "version": "4.6.3",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
@@ -495,12 +520,13 @@ Runs every check below, in order, and prints a ✓/⚠/✗ line for each plus a
 
 | Check | What it verifies | Can fail as |
 |---|---|---|
-| `node` | Node.js ≥ 18 | error |
+| `node` | Node.js ≥ 22.12 | error |
 | `config-dir` | The resolved config directory | *(always ok)* |
 | `keys` | At least one cloud-vendor key configured | error |
 | `default-model` | Your default model alias resolves | error |
 | `catalog` | Model-catalog cache present and within the 24h TTL | warn |
 | `aliases` | Your configured aliases still resolve against the catalog | warn |
+| `anthropic-base-url` | `ANTHROPIC_BASE_URL` isn't host-form (host-form 404s every direct-Anthropic leg unless normalized) | warn |
 | `opencode-bin` | The OpenCode engine binary is on `PATH` | error |
 | `engine-mcp` | The engine copy `npx -y amicus@latest mcp` would actually launch (catches a broken npx-cache copy a healthy local install would hide) | warn (error only if there's exactly one npx-cache copy and it's broken) |
 | `electron` | Electron (the interactive GUI) is installed | warn — headless still works |
@@ -508,13 +534,14 @@ Runs every check below, in order, and prints a ✓/⚠/✗ line for each plus a
 | `mcp` | Amicus is registered as an MCP server in Claude Code | warn |
 | `mcp-legacy` | No duplicate legacy `sidecar` MCP entry survives alongside `amicus` | warn |
 | `sessions-index-tmp` | No orphaned `sessions-index.json.*.tmp` files | warn |
+| `session-metadata-tmp` | No orphaned per-session `.metadata.json.*.tmp` files (the B09 class) | warn |
 | `openrouter-credit` | Remaining OpenRouter credit (skipped — reports `ok` — when no OpenRouter key is set) | warn |
 | `local-providers` **(v4.2)** | Every provider in `config.providers` is reachable | warn |
 | `project-root` | Your cwd looks like a real project, not an app/install dir | warn |
 
 **`local-providers`** probes every configured local provider (2s timeout each) the same way `amicus provider test` does, and reports per-id reachability in one line, e.g. `ollama: 3 models @ http://127.0.0.1:11434/v1; my-vllm: unreachable @ http://127.0.0.1:8000/v1`. No providers configured at all is a plain `ok` ("none configured") — this check can never fail your doctor run outright, only warn: a napping `ollama serve` isn't treated as broken setup.
 
-`--fix` self-heals four of the checks above in place: reprovisions Electron, copies the OpenCode engine into a broken npx-cache install, removes a duplicate legacy MCP entry, and sweeps orphaned session-index tmp files (only ones older than 60s). It does **not** start a local server for you — `local-providers` stays a warning until you start the server yourself.
+`--fix` self-heals five of the checks above in place: reprovisions Electron, copies the OpenCode engine into a broken npx-cache install, removes a duplicate legacy MCP entry, sweeps orphaned session-index tmp files, and sweeps orphaned per-session metadata tmp files (both tmp sweeps only ones older than 60s). It does **not** start a local server for you — `local-providers` stays a warning until you start the server yourself.
 
 Exit code is `1` if anything is `error`, else `0` (same rule drives `--json`'s `ok` field).
 

package/electron/setup-ui-aliases.js

@@ -5,14 +5,14 @@
  * delete, and add functionality for the setup wizard Step 3.
  */
 
-/** Grouping metadata for the 20 default aliases */
+/** Grouping metadata for the 19 default aliases */
 const ALIAS_GROUPS = [
   { name: 'Gemini', keys: ['gemini', 'gemini-pro'] },
   { name: 'GPT', keys: ['gpt', 'gpt-pro', 'codex'] },
   { name: 'Claude', keys: ['claude', 'sonnet', 'opus', 'haiku', 'fable'] },
   { name: 'DeepSeek', keys: ['deepseek'] },
   { name: 'Qwen', keys: ['qwen', 'qwen-coder', 'qwen-flash'] },
-  { name: 'Mistral', keys: ['mistral', 'devstral'] },
+  { name: 'Mistral', keys: ['mistral'] },
   { name: 'Other', keys: ['glm', 'minimax', 'grok', 'kimi', 'seed'] },
 ];