amicus 4.6.1 → 4.6.3

package/src/council/run-chair.js

@@ -42,6 +42,32 @@ function pickFallbackChair(statsRows, bench, failedChair) {
   return candidates.length ? candidates[0].model : null;
 }
 
+/**
+ * Outcome taxonomy for one fallback-walk attempt (spec §8, LC-5). The ch4
+ * VERDICT repair is deliberately NOT an attempt: its chair leg already
+ * completed — only the verdict line is being re-prompted — and the outcome
+ * enum has no honest value for it.
+ * @param {object|null} rawLeg the UNFILTERED leg (attemptChair nulls `leg` on
+ *   failure; this is the one before that narrowing, so a failed leg document
+ *   is still visible here)
+ * @param {object|null} [errorDoc] set when the launch never produced a wave
+ *   at all (pre-flight refusal) — the only source of a reason in that case
+ * @returns {{outcome: 'completed'|'error'|'timeout'|'no-output', reason: string|null}}
+ */
+function classifyChairAttempt(rawLeg, errorDoc) {
+  if (!rawLeg) {
+    const reason = (errorDoc && (errorDoc.message || errorDoc.reason)) || 'no leg document';
+    return { outcome: 'error', reason };
+  }
+  if (rawLeg.status === 'timeout') { return { outcome: 'timeout', reason: rawLeg.reason || null }; }
+  if (rawLeg.status === 'complete') {
+    const hasOutput = rawLeg.summary && String(rawLeg.summary).trim();
+    return hasOutput ? { outcome: 'completed', reason: null }
+      : { outcome: 'no-output', reason: rawLeg.reason || null };
+  }
+  return { outcome: 'error', reason: rawLeg.reason || rawLeg.error || String(rawLeg.status) };
+}
+
 /**
  * Chair chain (attempt → retry → ledger-promoted fallback → give up) plus the
  * single VERDICT-line repair re-prompt.
@@ -76,12 +102,28 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
     addWave(solo.wave);
     const ok = solo.leg && solo.leg.status === 'complete'
       && solo.leg.summary && solo.leg.summary.trim();
-    return { leg: ok ? solo.leg : null, exitCode: solo.exitCode };
+    // rawLeg is the UN-nulled leg — the classifier needs to see a failed leg
+    // document, not just the ok/null collapse the rest of the walk consumes.
+    return { leg: ok ? solo.leg : null, exitCode: solo.exitCode, errorDoc: solo.errorDoc, rawLeg: solo.leg };
   };
 
   let chairLeg = null;
   let actualChair = null;
   let skippedForCost = false;
+  // Additive on run.json (LC-5): one entry per resolved attempt (ch1/ch2/ch3;
+  // ch4 is a repair, not an attempt — see classifyChairAttempt). Declared here
+  // (not inside the else branch below) so it stays in scope for the
+  // chair-failed why enrichment after the branch closes, and so a
+  // cost-skipped chair (the `if` branch) simply never calls recordAttempt —
+  // chairAttempts is never checkpointed and the key stays absent on run.json.
+  const chairAttempts = [];
+  const recordAttempt = (attempt, waveId, model) => {
+    const cls = classifyChairAttempt(attempt.rawLeg, attempt.errorDoc);
+    chairAttempts.push({ waveId, model, outcome: cls.outcome, reason: cls.reason });
+    // Checkpointed HERE, before the caller's own isAbortExit bail — a mid-walk
+    // kill must not lose the attempts already resolved (spec §8 kill-mid-walk).
+    runState.checkpoint(o.runDir, { chairAttempts });
+  };
   if (overBudget()) {
     // Ceiling hit after the tally is computable: skip the chair, write the
     // verdict with overallVerdict null, exit 2 (spec §4 degradation table).
@@ -101,10 +143,14 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
     emitStageStarted(o.runDir, o.runId, 'chair', null, o.follow);
     // Fallback chain (spec §4): retry same chair once → promote best
     // non-bench model from the ledger → give up (no Claude fallback headless).
-    let attempt = await attemptChair(o.chair, `${o.runId}-ch1`);
+    const waveId1 = `${o.runId}-ch1`;
+    let attempt = await attemptChair(o.chair, waveId1);
+    recordAttempt(attempt, waveId1, o.chair);
     if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
     if (!attempt.leg && !overBudget()) {
-      attempt = await attemptChair(o.chair, `${o.runId}-ch2`);
+      const waveId2 = `${o.runId}-ch2`;
+      attempt = await attemptChair(o.chair, waveId2);
+      recordAttempt(attempt, waveId2, o.chair);
       if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
     }
     if (attempt.leg) { actualChair = o.chair; }
@@ -113,7 +159,9 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
       try { statsRows = statsFn(); } catch { /* no ledger yet */ }
       const fallback = pickFallbackChair(statsRows, o.models, o.chair);
       if (fallback) {
-        attempt = await attemptChair(fallback, `${o.runId}-ch3`);
+        const waveId3 = `${o.runId}-ch3`;
+        attempt = await attemptChair(fallback, waveId3);
+        recordAttempt(attempt, waveId3, fallback);
         if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
         if (attempt.leg) { actualChair = fallback; }
       }
@@ -160,7 +208,8 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
       what: 'the council has no chair synthesis',
       why: chairLeg
         ? 'the chair ran but its output carried no parseable VERDICT: line'
-        : 'no chair leg completed, including after the fallback chain',
+        : `no chair leg completed after the fallback walk — ${chairAttempts.map(a =>
+          `${a.waveId.split('-').pop()} ${a.model}: ${a.reason || a.outcome}`).join(' · ')}`,
       effect: 'the verdict is written with overallVerdict null; will exit degraded (2)',
     });
   }
@@ -170,4 +219,4 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
   };
 }
 
-module.exports = { runChair, pickFallbackChair };
+module.exports = { runChair, pickFallbackChair, classifyChairAttempt };

package/src/headless.js

@@ -454,19 +454,72 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       promptOptions.reasoning = reasoning;
     }
 
-    // Send prompt asynchronously (returns immediately, we poll for results)
+    // v4.6.2 PR2 amendment (controller live smoke, field evidence): arm BEFORE
+    // the prompt send, not after. OpenCode's prompt-send handler can itself
+    // block on the upstream provider call before ever returning — a silently-
+    // accepting endpoint (the v4.6.1 gemini class) hung the very next line's
+    // await for 6+ minutes with the backstop never even created yet, upstream
+    // of every mechanism that was supposed to catch it. `startedAt` here means
+    // "time since the leg asked for output". Disarmed permanently by the first
+    // SUBSTANTIVE-activity tick in the poll loop below (output/tool/result/
+    // reasoning/settle — NOT the placeholder-compatible message/assistant-id
+    // signals; see substantiveActivity); 0 (or negative) disables — the
+    // send itself is unbounded in that case too (see withTimeout below).
+    const { resolveNoOutputBackstopMs, createNoOutputBackstop } = require('./utils/no-output-backstop');
+    // v4.6.2 PR3 Task 1: Number.isFinite, not `!== undefined` — a non-number
+    // (e.g. a string arriving from a CLI/JSON boundary) must fall through to
+    // env resolution instead of reaching the deadline arithmetic below.
+    // `startedAt + ms` string-concatenates when ms is a string, producing a
+    // deadline `nowMs >= deadline` can never satisfy — the backstop would
+    // silently never fire. Finite zero (the documented explicit-disable
+    // value) still takes the direct branch: Number.isFinite(0) === true.
+    const noOutputBackstopMs = Number.isFinite(options.noOutputBackstopMs)
+      ? options.noOutputBackstopMs : resolveNoOutputBackstopMs(options._env);
+    const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: Date.now() });
+    let backstopFired = false;
+    // Single source for the reason string so the pre-send firing site below and
+    // the per-poll firing site further down (still ticking the SAME instance)
+    // can never drift apart.
+    const noOutputBackstopReason = () => 'NO_OUTPUT_BACKSTOP: model produced no '
+      + `output, reasoning, or tool calls in ${Math.round(noOutputBackstopMs / 1000)}s `
+      + '— likely a listed-but-not-serving model or a dead endpoint';
+
+    // Send prompt asynchronously (returns immediately, we poll for results) —
+    // bounded by the backstop: an endpoint that accepts but never answers must
+    // not hang this await the way it hung the field-observed leg.
     logger.info('Sending prompt to OpenCode', {
       sessionId,
       model,
       agent: promptOptions.agent,
       userMessageLength: userMessage.length
     });
-    const promptResult = await sendPromptAsync(client, sessionId, promptOptions);
-    writeProgress(sessionDir, 'prompt_sent');
-    logger.info('Prompt sent successfully, entering polling loop', {
-      sessionId,
-      timeoutMs
-    });
+    const sendPromptLabel = 'sendPromptAsync';
+    const sendPromptPromise = sendPromptAsync(client, sessionId, promptOptions);
+    let promptResult = null;
+    try {
+      promptResult = await withTimeout(sendPromptPromise, noOutputBackstopMs, sendPromptLabel);
+      writeProgress(sessionDir, 'prompt_sent');
+      logger.info('Prompt sent successfully, entering polling loop', {
+        sessionId,
+        timeoutMs
+      });
+    } catch (sendErr) {
+      const isBackstopTimeout = noOutputBackstopMs > 0
+        && sendErr.message === `${sendPromptLabel} timed out after ${noOutputBackstopMs}ms`;
+      if (!isBackstopTimeout) { throw sendErr; } // a genuine sendPromptAsync failure — unchanged behavior
+      // The backstop deadline won the race — OpenCode never returned from the
+      // prompt-send call at all; the "accepts, never responds" shape dies
+      // upstream of the poll loop entirely. Swallow the orphaned promise so it
+      // can never surface as an unhandled rejection whenever/if it eventually
+      // settles on its own (Promise.race already subscribes each racer
+      // internally, so this is defensive belt-and-suspenders, not load-bearing
+      // — verified empirically before relying on it).
+      sendPromptPromise.catch(() => {});
+      backstopFired = true;
+      logger.warn('No-output backstop fired before the prompt send resolved', {
+        taskId, sessionId, backstopMs: noOutputBackstopMs,
+      });
+    }
 
     const mirror = createMirrorState();
     let completed = false;
@@ -474,6 +527,14 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     let aborted = false;
     let sessionError = null; // Captures model/SDK errors from assistant messages
 
+    // Seed sessionError exactly like the #37 boundary-provider-error case right
+    // below does, so the run ends with a usable reason (the poll loop is
+    // skipped entirely on this path — see the while-condition and the
+    // backstop-abort block further down).
+    if (backstopFired) {
+      sessionError = noOutputBackstopReason();
+    }
+
     // Hard provider failure detected at the client boundary (#37): a non-2xx /
     // 402 from promptAsync surfaces here even when the server never emits an
     // assistant message carrying info.error. Seed sessionError so the loop's
@@ -573,7 +634,14 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       return false;
     };
 
-    while (!completed && (Date.now() - startTime) < timeoutMs) {
+    // `!backstopFired`: a no-op for the pre-existing mid-loop firing path (that
+    // branch already `break`s the instant it sets backstopFired, so this outer
+    // condition is never re-checked with it true from there) — it only matters
+    // for the NEW pre-send-timeout path above, where backstopFired can already
+    // be true before the loop ever starts. Skips the loop entirely rather than
+    // burning one wasted pollIntervalMs sleep before falling through to the
+    // post-loop abort block below.
+    while (!completed && !backstopFired && (Date.now() - startTime) < timeoutMs) {
       watchdog.touch();
       await new Promise(resolve => setTimeout(resolve, pollIntervalMs));
 
@@ -729,6 +797,26 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
           || newAssistant || reasoningActivity || settleActivity;
         if (progressed) { lastProgressAt = Date.now(); }
 
+        // v4.6.2 PR2 amendment 2 (controller live smoke + debug trace): the
+        // backstop disarms only on SUBSTANTIVE activity — output, reasoning,
+        // or tool motion (the spec's "first token/reasoning/tool_use").
+        // messageActivity/newAssistant are excluded: OpenCode creates an empty
+        // assistant placeholder on prompt ACCEPTANCE, which is precisely the
+        // accepted-but-not-serving bookkeeping the backstop must not trust.
+        // `progressed` itself (and every stall/idle consumer of it above) is
+        // deliberately untouched — this is a narrower, backstop-only signal.
+        const substantiveActivity = outputGrew || toolActivity || resultActivity
+          || reasoningActivity || settleActivity;
+
+        // No-output backstop: one tick per poll. Fired is terminal — break the
+        // loop; the post-loop block below mirrors the timeout path.
+        if (noOutputBackstop.tick(substantiveActivity, Date.now()) === 'fired') {
+          backstopFired = true;
+          sessionError = noOutputBackstopReason();
+          logger.warn('No-output backstop fired', { taskId, backstopMs: noOutputBackstopMs });
+          break;
+        }
+
         // B53: a wedged tool call (tool_use emitted, result never arrives) otherwise
         // burns the full --timeout with zero output — the stable-poll idle gate above
         // requires mirror.output.length > 0, which a pre-text wedge never satisfies.
@@ -832,7 +920,15 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     });
 
     // Handle timeout
-    if (!completed && !aborted && (Date.now() - startTime) >= timeoutMs) {
+    // v4.6.2 PR2 fix wave: `!backstopFired` — the backstop's own break can
+    // land after the post-break poll tail (getMessages + mirror processing
+    // already inside that iteration) has ALSO crossed timeoutMs when the two
+    // thresholds are configured close together, so this block must yield
+    // once the backstop already ended the leg. Exactly one terminal-timing
+    // signal per leg: statusFromResult() (src/utils/result-schema.js) checks
+    // timedOut BEFORE error, so a leg carrying both would misreport as an
+    // ordinary 'timeout' instead of the distinctly-named backstop reason.
+    if (!completed && !aborted && !backstopFired && (Date.now() - startTime) >= timeoutMs) {
       timedOut = true;
       logger.warn('Task timed out', { taskId, elapsed: Date.now() - startTime });
 
@@ -846,6 +942,20 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       }
     }
 
+    // Backstop fired: abort the OpenCode session exactly like the timeout path
+    // (the agent keeps running otherwise). The leg's error already carries the
+    // NO_OUTPUT_BACKSTOP reason; no separate degrade machinery — the ordinary
+    // dead-leg path (SL-2 retry, sink announcement, exit codes) inherits it.
+    if (backstopFired && !completed && !aborted) {
+      try {
+        const { abortSession } = require('./opencode-client');
+        await abortSession(client, sessionId, ...dirArgs);
+        logger.info('Session aborted after no-output backstop', { taskId, sessionId });
+      } catch (abortErr) {
+        logger.warn('Failed to abort session after backstop', { error: abortErr.message });
+      }
+    }
+
     watchdog.cancel();
     if (uninstallSignals) { uninstallSignals(); }
 

package/src/mcp-council-awareness.js

@@ -185,6 +185,7 @@ function buildCouncilStatusPayload(project, taskId) {
     legsTotal, legsComplete, elapsed: elapsedOf(run),
     exitCode: run.exitCode !== undefined ? run.exitCode : null,
     version: RUNNING_VERSION,
+    degrades: run.degrades || [],
   };
   if (usageLegs.length) { payload.usage = rollupWaveUsage(usageLegs); }
   if (allLegIds.length) {

package/src/opencode-client.js

@@ -557,6 +557,27 @@ function buildServerOptions(options = {}) {
     : (options.model ? [options.model] : []);
   config.provider = buildProviderModels(resolvedForProvider);
 
+  // v4.6.2 PR1 (spec §4, D1/D2): a host-form ANTHROPIC_BASE_URL is correct
+  // for Anthropic SDKs (they append /v1) and fatal for OpenCode's
+  // direct-anthropic provider (it appends /messages -> 404). Carry the
+  // normalized full-prefix form as a provider-config override — config-level,
+  // no process env is written anywhere. AMICUS_BASE_URL_NORMALIZE=0 disables.
+  // Merge order keeps any existing options.baseURL authoritative (M-5 lesson:
+  // never clobber a user-authored value with a derived one).
+  const { resolveBaseUrlOverride, announceBaseUrlNormalizationOnce } = require('./utils/base-url-classify');
+  const baseUrlEnv = options._env || process.env;
+  const anthropicBaseUrl = resolveBaseUrlOverride(baseUrlEnv);
+  if (anthropicBaseUrl) {
+    if (!Object.prototype.hasOwnProperty.call(config.provider, 'anthropic')) {
+      config.provider.anthropic = { models: {} };
+    }
+    config.provider.anthropic.options = {
+      baseURL: anthropicBaseUrl,
+      ...(config.provider.anthropic.options || {}),
+    };
+    announceBaseUrlNormalizationOnce(baseUrlEnv.ANTHROPIC_BASE_URL, anthropicBaseUrl, options._noticeDeps);
+  }
+
   // Register custom 'chat' agent: reads auto-approved, writes/bash require permission
   const chatAgent = {
     description: 'Conversational agent — reads are auto-approved, writes and commands require permission',

package/src/session-manager.js

@@ -22,6 +22,9 @@ const SESSION_STATUS = {
 /** Canonical session dir name — new sessions are written here. */
 const SESSIONS_DIR = 'amicus_sessions';
 
+/** Subagent sessions nest one level under their parent taskId dir. */
+const SUBAGENTS_DIR = 'subagents';
+
 /**
  * Get the canonical session directory path for a task (used for WRITES).
  * Spec Reference: §8.1 Session directory structure
@@ -256,7 +259,7 @@ function saveSummary(projectDir, taskId, summary) {
  * // Returns: '/path/to/project/.claude/amicus_sessions/abc123/subagents/subagent-xyz'
  */
 function getSubagentDir(projectDir, parentTaskId, subagentId) {
-  return path.join(getSessionDir(projectDir, parentTaskId), 'subagents', subagentId);
+  return path.join(getSessionDir(projectDir, parentTaskId), SUBAGENTS_DIR, subagentId);
 }
 
 /**
@@ -355,7 +358,7 @@ function getSubagentSession(projectDir, parentTaskId, subagentId) {
  * @returns {object[]} Array of sub-agent metadata
  */
 function listSubagents(projectDir, parentTaskId, filter = {}) {
-  const subagentsDir = path.join(getSessionDir(projectDir, parentTaskId), 'subagents');
+  const subagentsDir = path.join(getSessionDir(projectDir, parentTaskId), SUBAGENTS_DIR);
 
   if (!fs.existsSync(subagentsDir)) {
     return [];
@@ -412,6 +415,7 @@ module.exports = {
   getSessionDir,
   resolveExistingSessionDir,
   SESSIONS_DIR,
+  SUBAGENTS_DIR,
   SESSION_STATUS,
   // Sub-agent functions
   getSubagentDir,

package/src/sidecar/fanout-leg.js

@@ -74,7 +74,7 @@ function buildRoutingFailureLeg({ leg, legId, waveId, quiet }) {
  * Adds `.reason` (alias of buildRunResult's `.error`) and `.legId` so the
  * fallback loop reads a stable shape without re-deriving them.
  */
-async function runSingleAttempt({ leg, legId, waveId, project, directory, follow, systemPrompt, userMessage, timeoutMs, agent, client, server, summaryLength, reasoning, quiet, foldNonce }) {
+async function runSingleAttempt({ leg, legId, waveId, project, directory, follow, systemPrompt, userMessage, timeoutMs, agent, client, server, summaryLength, reasoning, quiet, foldNonce, noOutputBackstopMs }) {
   const { IdleWatchdog } = require('../utils/idle-watchdog');
   const { markAborted } = require('../utils/session-abort');
   const { runHeadless } = require('../headless');
@@ -121,7 +121,7 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     result = await runHeadless(
       leg.model, systemPrompt, userMessage, legId, project,
       timeoutMs, agent || 'build',
-      { client, server, watchdog, summaryLength, reasoning, nonce: foldNonce, directory }
+      { client, server, watchdog, summaryLength, reasoning, nonce: foldNonce, directory, noOutputBackstopMs }
     );
   } catch (err) {
     result = { summary: '', completed: false, timedOut: false, aborted: false, error: err.message, taskId: legId };

package/src/sidecar/fanout.js

@@ -267,7 +267,7 @@ async function runFanout(options) {
         timeoutMs, agent: options.agent, client, server,
         summaryLength: options.summaryLength, reasoning, quiet: options.quiet,
         foldNonce, directory: options.directory, follow,
-        fallback: options.fallback, catalog: options.catalog,
+        fallback: options.fallback, catalog: options.catalog, noOutputBackstopMs: options.noOutputBackstopMs,
       });
     }));
   } finally {

package/src/sidecar/models-probe.js

@@ -0,0 +1,119 @@
+// src/sidecar/models-probe.js
+'use strict';
+
+/**
+ * @module models-probe
+ * v4.6.2 PR3 (spec §6, D5): `models --check --live` probe tier. Presence in
+ * the catalog is not proof of service — a stored alias can point at a model
+ * id the catalog still lists but the provider no longer actually serves (the
+ * v4.6.1 `gemini` incident: stored `google/gemini-3.1-flash-lite-preview`,
+ * catalog-live, silently dead). This module is the check that would have
+ * caught it: probe every STORED alias with one ordinary engine leg — real
+ * session dir, real spend-ledger row (D5) — on a single quiet fanout wave,
+ * and classify each leg served / accepted-but-silent / error.
+ *
+ * Never called without `--live`; the spend gate lives in the CLI layer
+ * (src/sidecar/models.js), not here — this module always spends when called.
+ */
+
+/** Probe backstop override (spec D5) — a fixed constant, NOT env-configurable;
+ * the env knob (AMICUS_NO_OUTPUT_BACKSTOP_MS) stays the ordinary 120s leg default. */
+const PROBE_WINDOW_MS = 30000;
+
+/** Fixed tiny prompt — a probe leg only needs to prove the model answers at all. */
+const PROBE_PROMPT = 'Reply with exactly: OK';
+
+/**
+ * Classify one leg run-document (buildRunResult shape, src/utils/result-
+ * schema.js) per the plan's Global Constraints classification contract.
+ * Precedence matters: 'complete' wins outright; otherwise a NO_OUTPUT_
+ * BACKSTOP error (PR2's silent-leg detector, armed here at PROBE_WINDOW_MS
+ * instead of its 120s default) is the one specific error shape that means
+ * "the model accepted the request and never produced a token" rather than an
+ * ordinary routing/auth/timeout failure.
+ * @param {{status?:string, error?:string|null}} leg
+ * @returns {'served'|'accepted-but-silent'|'error'}
+ */
+function classifyLeg(leg) {
+  if (leg.status === 'complete') { return 'served'; }
+  if (typeof leg.error === 'string' && /^NO_OUTPUT_BACKSTOP:/.test(leg.error)) { return 'accepted-but-silent'; }
+  return 'error';
+}
+
+/**
+ * Stored (user-config) aliases only — the `--live` probe's scope (spec §6):
+ * defaults/curated-route rows follow the catalog by construction and have no
+ * "was it actually served" question for a live probe to answer. Exported so
+ * the CLI's cap pre-check (models.js) and this module share one predicate.
+ * @param {Array<{source:string}>} sources collectAliasSources() output
+ * @returns {Array<{alias:string,model:string,source:string}>}
+ */
+function selectStoredAliases(sources) {
+  return sources.filter(s => s.source === 'user-config');
+}
+
+/**
+ * Probe every STORED alias with one ordinary engine leg (real session dirs,
+ * real spend rows — D5) on one quiet fanout wave. Returns per-alias outcomes;
+ * never called without --live (the spend gate lives in the CLI layer).
+ * @param {{project?:string}} opts
+ * @param {{runFanout?:Function, collectAliasSources?:Function}} [deps]
+ * @returns {Promise<{results:Array<{alias:string,target:string,outcome:'served'|'accepted-but-silent'|'error',detail:string|null,cost:number|null}>, waveId:string|null}>}
+ */
+async function probeStoredAliases(opts = {}, deps = {}) {
+  const collectAliasSources = deps.collectAliasSources || require('../utils/alias-audit').collectAliasSources;
+  const runFanout = deps.runFanout || require('./fanout').runFanout;
+
+  const stored = selectStoredAliases(collectAliasSources());
+  if (stored.length === 0) { return { results: [], waveId: null }; }
+
+  // runFanout's `models` is the same comma-separated STRING the CLI --models
+  // flag takes (validateFanoutModels -> parseModelsList splits it back apart)
+  // — NOT an array; see council/run-launch.js's launchWave for the identical
+  // `.join(',')` seam. An array here would parse to [] and fail the whole
+  // wave with BAD_ARGS.
+  const { wave, errorDoc } = await runFanout({
+    models: stored.map(s => s.model).join(','),
+    prompt: PROBE_PROMPT,
+    quiet: true,
+    noOutputBackstopMs: PROBE_WINDOW_MS,
+    timeout: 2, // minutes — the overall ceiling behind the backstop
+    project: opts.project,
+  });
+
+  // Final-review blocker 1: two classes of wave never reach leg-creation at
+  // all — the budget preflight refusing before any session exists (failPre ->
+  // {wave: null, errorDoc}) or the shared server failing to start (errorWave ->
+  // {legs: [], error: message}) — so EVERY stored alias would otherwise hit
+  // the `legs[i] || {}` fallback and fabricate a generic `detail: null` row,
+  // which the CLI's `${head} — ${r.detail}` template renders as the literal
+  // string "null", masking the real reason (worse with `quiet: true`, which
+  // suppresses every other print this failure would normally surface on).
+  // Both failure classes carry a real message; thread it onto every row that
+  // has no leg of its own to explain itself.
+  const waveFailure = errorDoc ? errorDoc.message : ((wave && wave.error) || null);
+
+  // Positional zip, not a model-id lookup: deriveLegIds (fanout.js) assigns
+  // legs 1:1 in --models order, and two stored aliases may legitimately share
+  // one target model, so a leg's own identity can't disambiguate which alias
+  // it answers for — only its index can.
+  const legs = (wave && wave.legs) || [];
+  const results = stored.map((s, i) => {
+    const leg = legs[i] || {};
+    const outcome = classifyLeg(leg);
+    const cost = (leg.usage && leg.usage.cost && typeof leg.usage.cost.amount === 'number')
+      ? leg.usage.cost.amount
+      : null;
+    return {
+      alias: s.alias,
+      target: s.model,
+      outcome,
+      detail: leg.error || waveFailure || null,
+      cost,
+    };
+  });
+
+  return { results, waveId: (wave && wave.waveId) || null };
+}
+
+module.exports = { probeStoredAliases, selectStoredAliases, PROBE_WINDOW_MS, PROBE_PROMPT };