amicus 4.8.0 → 4.9.0

package/docs/ROADMAP.md

@@ -13,10 +13,10 @@ lives under **Backlog (tracked, not scheduled)** with everything else that is re
 Nothing about the content changed and no judgment about its value is implied; only its status. When
 an org buyer and the org to support them exist, it earns a number then.
 
-Amicus is at **v4.7.0** (tagged 2026-08-08). Each 4.x rev below leads with the benefit, not the
+Amicus is at **v4.9.0** (2026-08-26). Each 4.x rev below leads with the benefit, not the
 plumbing.
 
-**Status:** v4.0 through **v4.7.0** have **shipped** — everything on this page is a record of what
+**Status:** v4.0 through **v4.9.0** have **shipped** — everything on this page is a record of what
 landed, not a plan. Composition — the scope that
 carried the number v4.6 here until the degrade-announcement-invariant milestone took the v4.6.0
 release (2026-08-02) — is now an unscheduled candidate for the next rev, tabled in its own section
@@ -206,7 +206,8 @@ list. Two findings drove it:
    An earlier draft of this note said *"all three had already rotted"*; that universal is false and
    is corrected here. The other two HAD already rotted before T2.4 began (`report.js:79` and
    `ledger.js:24` are comments at `ed5c0c02`), so their drift is pre-existing, not this release's.
-   The report fallback is now at `src/council/report.js :: toModel`'s `total`; all three claims
+   The report fallback is now at `src/council/report-cost.js :: buildCostModel`'s `total` (it was
+   `report.js :: toModel`'s until v4.9 W8 extracted the cost table); all three claims
    themselves still hold. So CA-4's omissions are not a schema nicety — they under-report spend on the
    surface the owner relies on, which collides with the cost-truth principle (*reported > estimated
    > unknown; never fabricate $0*). An omitted leg is not "unknown" — it renders as money never
@@ -222,9 +223,9 @@ list. Two findings drove it:
   (`run-assemble.js:180-184`) and one `repair` row per `-q<N>` solo, failed ones included
   (`run-stage2.js:122`).
   ⚠️ **Scope correction:** the failed-chair third of the original CA-4 is **closed** — v4.6.2's
-  `chairAttempts[]` records every attempt on `run.json` (`run-chair.js:133` cites LC-5 by name), and
+  `chairAttempts[]` records every attempt on `run.json` (`run-chair.js:71` cites LC-5 by name), and
   failed-chair cost already reaches `runStats` too: a failed ch1–ch3 attempt gets its own
-  `chair-attempt` row there carrying that leg's real `usage` (`run-chair.js:154-156`), so no third
+  `chair-attempt` row there carrying that leg's real `usage` (`run-chair.js:91-95`), so no third
   row class was needed.
 - **GOA-7 prerequisite — segment the ledger by RESOLVED model, not alias** *(S–M)*: **shipped.**
   `ledger.js:124` now keys on `row.resolvedModel || row.model` and `LEDGER_SCHEMA_VERSION` is 2.
@@ -256,7 +257,9 @@ list. Two findings drove it:
 > *Next-rev hard gates*: the tight-file extraction pass (`cli-handlers-council-run.js` is at
 > **299/300 exactly**, `run-debate.js` at 299, two files **at 300**), and KNOWN_VARIABLES
 > single-sourcing **only if** `{{input}}` is ever scoped — it is not in this rev, so that gate
-> travels with composition rather than blocking here.
+> travels with composition rather than blocking here. *(Update 2026-08-25: the KNOWN_VARIABLES
+> gate is now satisfied — landed in v4.9 W1 ahead of any composition work. The tight-file
+> numbers in this note are a dated snapshot; re-measure with `npm run check:sizes`.)*
 
 ### Deferred out of v4.4.1 into v4.5 (2026-07-27)
 
@@ -276,7 +279,7 @@ a proposed disposition — v4.5 ride-along / v4.6 / backlog — tabled for rulin
 | **CA-4** | `tally.json`'s `runStats` omits Stage-2 judges, repair solos and failed chair attempts (5 rows for 11 real legs in `wsgate04`) | `M` — a schema question, not a fix |
 | **CA-5** | `isSubagentToolCall` is still a `name === 'task'` string proxy | `M`, and **reduced** by v4.4.0: it is now only the fallback when the real subtree walk finds nothing |
 | **LC-1** | B53's stall kill is skipped while a tool-settle deferral is active | `S–M` — shipped deliberately; the author wants a second opinion, which needs data from real runs |
-| ~~**LC-5**~~ | ~~A chair fallback leaves no trace in `run.json`~~ — ✅ **CLOSED by v4.6.2**: `chairAttempts[]` records every attempt (`{waveId, model, outcome, reason}`), checkpointed after each; `run-chair.js:113` cites LC-5 by name. **Do not re-file.** | — |
+| ~~**LC-5**~~ | ~~A chair fallback leaves no trace in `run.json`~~ — ✅ **CLOSED by v4.6.2**: `chairAttempts[]` records every attempt (`{waveId, model, outcome, reason}`), checkpointed after each; `run-chair.js@v4.6.2:113` cites LC-5 by name. **Do not re-file.** | — |
 | **RN-1** | `sanitizeName` collisions surface as a banner rather than a refusal | `S` + a product decision that was already argued once |
 | **RN-2** | `renderRunList` blind masking is best-effort — only the open run resolves labels | `M` |
 | **RN-5** | A blind-mode flip closes every open prose panel and repaints twice | `S–M` |
@@ -354,6 +357,93 @@ behaviour changes.
   CI off 1.2.20. First release whose suite ran against the engine users actually get
 - Plus a `sidecar/reopen-spend.js` extraction, a dead-code deletion, and three documentation gates
 
+## v4.8 — "Every seat counts as itself" *(seat identity)* — ✅ SHIPPED v4.8.0, 2026-08-23
+**Benefit:** seat a model twice and the council finally treats the two seats as two reviewers —
+each with its own vote, its own row, its own file and its own dead-seat badge. Before this rev a
+repeated alias was a bench that quietly disagreed with itself about how many reviewers were in the
+room.
+
+**Scope note.** The design spec behind this number
+(`docs/superpowers/specs/2026-08-10-v4.8-ask-anything-count-everyone-design.md`) carried two halves,
+*ask anything* and *count everyone*. v4.8.0 shipped **count everyone** — the seat-identity spine —
+across the `v48-*` PR train; **ask anything** (task mode, #134/#130, with #146 folded in) was sized
+and moved whole to v4.9 rather than carried half-done. That is the ruling, not a slip.
+
+- **Seats are first-class.** A seat id *is* its alias on every bench with no repeated `--models`
+  entry; where an alias occupies more than one position the seats are `<alias>#1`, `<alias>#2`, and
+  the artifacts follow (`review-<alias>-1.md`, and the same rule for `judge-`/`rebuttal-`/`revote-`).
+  `meta.seats` rides the tally/verdict documents index-parallel with `meta.models` *(L)*
+- **⚠️ The peers-only filter excludes the raiser by SEAT, and findings on a repeated-alias bench
+  change tier in BOTH directions** — a genuine twin's corroboration is no longer discarded, and a
+  twin's *dispute* now demotes. Deliberate, measured case-by-case, and disclosed with its permanent
+  cost: `Disputed` feeds the append-only ledger's `factErrorRate`, which is never migrated.
+  Distinct-alias benches are byte-for-byte unaffected *(M)*
+- **Two new honesty marks on `tally.json`/`verdict.json`** — `findings[].sameModelCorroboration`
+  (corroboration that came from another seat of the same model, so it is not independent) and
+  `findings[].unattributedPeerDrops` (a count of votes excluded from `basis` that the engine could
+  not attribute to anyone). Both emit-when-set; both shipped with their own wrong-in-two-directions
+  disclosures rather than as clean wins *(M)*
+- **Prototype pollution closed across the alias tables** — a member literally named `toString`,
+  `constructor`, `valueOf` or `hasOwnProperty` is no longer a valid alias at any of five gates, and
+  `resolveModel('toString')` throws instead of returning the function itself. One table was not
+  enough: a spread into a plain `{}` re-creates the inherited prototype, so all three builders are
+  seeded *(M)*
+- **A finding with no named raiser stops corroborating itself**, on one principle applied in order —
+  *attribute when you can, mark only when you cannot* — with seat ids deciding first *(M)*
+- **The Workspace stops collapsing dead seats**, and a live seat no longer erases its dead twin;
+  dead rows, retry badges and DOM keys are keyed on the seat, with the producer emitting `null`
+  rather than the alias for a seat it could not identify. Residuals pinned by tests asserting the
+  known-wrong behaviour so they cannot rot silently *(M)*
+- **`streetCred[]` stops dropping or inventing rows** when a hand-assembled `meta.seats` disagrees
+  with `meta.models`, and a mixed reliability-ledger pair group stops reading narrower than one with
+  no seat information at all *(S–M)*
+> Why here: seat identity is a prerequisite, not a feature. Every surface that says *which model
+> said what* — the peer split, street-cred, the ledger join, the Workspace panels, the artifact
+> filenames — was keyed on the alias, so all of them told the same lie on the same bench shape.
+> Fixing them one at a time would have been six half-fixes; the spine makes all six the same fix.
+>
+> **Lineage.** v4.6 made a loss announce itself, v4.7 made the accounting match reality, v4.8 makes
+> the *attribution* match reality. Same invariant family, applied to identity.
+
+**v4.8.1 (shipped 2026-08-25):** the fast-follow patch — setup Step 2 offered one card per curated
+model *family* with no way to choose within it, and the route pill it wrote stored a **provider** id
+rather than a model id, so nothing downstream could tell two models of one family apart either
+(#138). Both wizard surfaces now offer a vendor-scoped drill-down on a new pure `model-shortlist.js`.
+
+## v4.9 — "The council does new work" *(task mode)* — ✅ SHIPPED v4.9.0, 2026-08-26
+**Benefit:** the council stops being able only to critique. Point it at open-ended work with
+`--intent task` and every seat *produces* the deliverable, the judges rank which response best does
+the work, and the chair synthesizes an **answer** — `Converged | Split | Insufficient` — instead of
+a verdict about a review that never happened.
+
+- **★ Task mode** — the *ask anything* half deferred out of v4.8, shipped whole: intent plumbing,
+  Stage-1 task frames at every dispatch site, task judging and the task chair, honest renderers on
+  every surface, and zero reliability rows written by a task run. **Closes #134, #130 and #146** —
+  `--intent task` on the CLI, `intent: 'task'` over MCP, and a review run that is byte-identical
+  everywhere *(L)*
+- **The engine speaks for itself** — a `NO_OUTPUT_BACKSTOP` death report now quotes the engine's own
+  newest ERROR line for that session, and names a server-vs-install engine skew when there is one,
+  with a remedy that says why `doctor` cannot see this class. **Closes #133** *(M)*
+- **Bench signals** — the `ttftMs` probe (measured off the backstop's own substantive-activity
+  predicate, never derived), and a one-per-run warning when a local alias shadows a curated one with
+  a different id, surfaced on the CLI, over MCP and in `models --check` *(M)*
+- **The dead-seat surface finishes the v4.8 job** — an unbound seat stops being invisible in the
+  Workspace, and the critic path keys on seat identity, closing the dead-bench-twin-beside-live-critic
+  erasure v4.8 disclosed as a residual *(M)*
+- **`amicus list` shows council runs on the CLI**, as `amicus_list` has over MCP since v4.0, with
+  the current-project-only scope stated out loud rather than left silent *(S–M)*
+- **Docs update** — task mode in `README.md`, `docs/council.md` and `docs/usage.md`; the `runStats`
+  builder unification, the SI-16 splits and the `seatKey` consolidation carry the internal half *(S)*
+> Why here: #130 and #134 are the same problem from two directions — #130 is the bug report of what
+> happens when a generative brief meets a review-shaped pipeline, #134 is the request to support
+> generative briefs properly — and both trace to one hard-coded frame telling every seat it was a
+> reviewer. One declaration serves both, which is why they were designed together and shipped
+> together rather than as a detector and a feature.
+>
+> **Lineage.** v4.6 through v4.8 each made the council *more honest about a run it already knew how
+> to do* — announcing losses, counting money, attributing seats. v4.9 changes what a council can be
+> asked for in the first place, which is a different kind of rev and is scoped as one.
+
 ## Backlog (tracked, not scheduled)
 
 ### Enterprise-readiness *(unscheduled — gated on funding / cofounder)*
@@ -388,9 +478,10 @@ consumer today (the Council Review GitHub Action) runs a single review per PR, n
 agent driving it, or the `critique`/`refine` built-ins are wanted on their own — those are a much
 smaller slice than the chaining machinery and could ship independently of F6.
 
-⚠️ **Carries its own hard gate:** KNOWN_VARIABLES single-sourcing (`src/template/render.js:45` keeps
-two hand-maintained copies of the known-variable set) must land **before** `{{input}}` does. See
-`BACKLOG.md` *Next-rev hard gates* — that gate travels with this item, not with v4.7.
+⚠️ **Its hard gate is already satisfied:** KNOWN_VARIABLES single-sourcing landed in v4.9 W1
+(2026-08-25) — `src/template/render.js` now derives both validation and rendering from
+`KNOWN_VARIABLES`, drift-tested, so `{{input}}` no longer waits on it. See `BACKLOG.md`
+*Next-rev hard gates* (ticked).
 
 ### GUI power ergonomics (F10) *(unscheduled — dropped from v4.7, 2026-08-05)*
 Focus-follows-fold hotkey, distinguishable window titles, tiling presets *(S each)*.

package/docs/configuration.md

@@ -1,6 +1,6 @@
 # Configuration Reference
 
-`amicus setup` is the recommended way to configure Amicus. It opens a graphical wizard that validates your API keys live, lets you pick a default model from the live catalog, and saves everything to `~/.config/amicus/.env` (permissions `0600`). The environment variables below are for overrides and advanced tuning — most users only need the API keys section.
+`amicus setup` is the recommended way to configure Amicus. It opens a graphical wizard that validates your API keys live, lets you pick a default model from the live catalog — down to a specific model per provider, not just the family default — and saves everything to `~/.config/amicus/.env` (permissions `0600`). The environment variables below are for overrides and advanced tuning — most users only need the API keys section.
 
 ---
 
@@ -78,6 +78,52 @@ not on every launch, and not when you explicitly chose the gateway with `--gatew
 `routing.prefer: "openrouter"` (or pass `--gateway openrouter` per call) to keep routing everything
 through OpenRouter as before.
 
+### Cost tier
+
+`routing.tier` is your standing answer to "when a vendor offers several models, which end of its
+range do you want by default?" It lives under `routing` for filing reasons only — **it does not
+change how a call is routed**, and it is not a gateway knob. Its one and only effect is which row
+the **cost-aware default picker** preselects (`src/utils/provider-default-picker.js`).
+
+| Tier | Means | Example (Anthropic) |
+|---|---|---|
+| `"frontier"` | the most capable / most expensive of the vendor's line | `claude-opus-*` |
+| `"balanced"` | the middle of the range — **the default** | `claude-sonnet-*` |
+| `"economy"` | the cheapest of the line | `claude-haiku-*` |
+
+Absent, misspelled or set to anything outside those three, the tier **coerces silently to
+`"balanced"`** — a junk value never errors and never blocks a launch. Per-vendor tier resolution
+lives in `src/utils/model-tiers.js`; when a vendor's catalog has no model matching the tier, the
+picker falls back to the cheapest priced row, then the first row.
+
+**`routing.tier` is hand-edited only.** No wizard step, CLI command or GUI control writes it — set
+it yourself in `~/.config/amicus/config.json` (the same rule as [`maxCostPerMtok`](#cost-gate)
+below):
+
+```jsonc
+{ "routing": { "prefer": "direct", "tier": "economy" } }
+```
+
+**Where the picker actually runs.** It offers you that vendor's models, priced, with the tier's pick
+flagged as recommended, and writes your choice to `aliases.<vendor>` (seeding `config.default` when
+that is still unset). Three surfaces reach it:
+
+- `amicus key <provider> <key>` — after a successful **cloud**-vendor key save (local-provider
+  bearer saves skip it).
+- `amicus setup` — the readline wizard runs it once per keyed provider, in detection order.
+- The **Electron setup window** — the same picker, with a family → model drill-down.
+
+Non-interactively (`--json`, `--quiet`, or no TTY) the picker takes the recommended pick silently and
+prints a one-line summary instead of prompting. It is also a graceful no-op for `openrouter`, which
+is a gateway rather than a model vendor.
+
+**`routing.tier_onboarded`** is bookkeeping, not a setting: a boolean written automatically the
+first time `amicus start` prints the one-time tip pointing existing users at the picker
+(`src/utils/start-helpers.js`). The tip only fires on an interactive run that already has a direct
+provider key and has not used the picker yet, and the flag is set only when the line actually
+printed — so a `--json` run never burns it. Don't hand-edit it; delete it if you want the tip once
+more.
+
 ---
 
 ## Behavior
@@ -343,12 +389,16 @@ level includes everything above it.
   },
 
   // Gateway routing policy (see Routing above). `prefer` defaults to "direct"
-  // when this key is absent entirely. `migration_notified` is written
-  // automatically the first time the one-time direct-migration notice fires
-  // for a vendor — don't hand-edit it.
+  // when this key is absent entirely. `tier` is the cost-tier preference the
+  // model picker preselects on ("frontier" | "balanced" | "economy"; anything
+  // else coerces to "balanced") — hand-edited only, see Cost tier above.
+  // `migration_notified` and `tier_onboarded` are both written automatically
+  // when their one-time notices fire — don't hand-edit either.
   "routing": {
     "prefer": "direct",
-    "migration_notified": { "openai": true }
+    "tier": "balanced",
+    "migration_notified": { "openai": true },
+    "tier_onboarded": true
   },
 
   // User-defined local / OpenAI-compatible providers (v4.2) — written by

package/docs/council.md

@@ -21,6 +21,7 @@ orchestration recipe. This page is the reference for the artifacts that recipe p
 
 - [The pipeline, end to end](#the-pipeline-end-to-end)
 - [`amicus council run`](#amicus-council-run)
+  - [Task mode (`--intent task`)](#task-mode---intent-task)
   - [Debate mode](#debate-mode)
 - [Council Workspace (GUI)](#council-workspace-gui)
   - [Auto-open on `amicus_council_run` (v4.5)](#auto-open-on-amicus_council_run-v45)
@@ -112,6 +113,7 @@ amicus council run --prompt-file <briefing.md>
     [--gateway auto|direct|openrouter] [--no-validate-model]
     [--template <name|path>] [--artifact <file>] [--var k=v]  # v4.5, see docs/usage.md#briefing-templates
     [--pack <name|path>]                                       # v4.5, see docs/usage.md#policy-packs
+    [--intent review|task]                                     # v4.9, see Task mode below
 ```
 
 **The headless engine (v4.0).** Everything the `second-opinion` skill orchestrates by hand in
@@ -258,7 +260,10 @@ cross-process lock.
 `verdict.json` here is the **undecided** verdict — same schema as [`amicus council
 verdict`](#amicus-council-verdict)'s output (council family v2) plus **`overallVerdict`**
 (`"Ship it" | "Fix these first" | "Fundamental rethink" | null`), parsed from the chair's final
-`VERDICT:` line. Example excerpt:
+`VERDICT:` line — or, on a task run (`--intent task`, v4.9), `"Converged" | "Split" |
+"Insufficient" | null` parsed from its final `ANSWER:` line instead (both scales, and why they
+are disjoint, are in the `overallVerdict` key note under [`amicus council
+verdict`](#amicus-council-verdict)). Example excerpt:
 
 ```json
 {
@@ -282,6 +287,82 @@ Consumers gate on **tiers + the chair verdict line** (`overallVerdict`), per the
 report-only Stage-4 policy. Headless runs pin `meta.claudeInCouncil: false`,
 `meta.runType: "headless"`, and the chair is excluded from the street-cred universe.
 
+### Task mode (`--intent task`)
+
+By default a council **reviews** the material it is given. `--intent task` (over MCP: the `intent`
+parameter on `amicus_council_run`, spelled `'task'`) points the same pipeline at **open-ended work**
+instead: the bench *produces* what the briefing asks for, and the chair synthesizes an **answer**
+rather than a verdict about a review that never happened.
+
+`review` is the default, and it is never stored: `--intent review` is accepted and normalized away
+at every door, so nothing writes `intent: "review"` onto `run.json`, `tally.json` or `verdict.json`.
+Only `"task"` is ever recorded — the same emit-when-set idiom as `--tag`. Any other value is a
+pre-flight `BAD_ARGS` failure before any spend.
+
+**What changes, stage by stage:**
+
+| Stage | Review intent (default) | Task intent |
+|---|---|---|
+| Stage 1 | *"You are one reviewer… Review the material"* — each seat critiques the briefing | *"you are not reviewing the briefing, you are executing it"* — each seat produces the deliverable, then declares the load-bearing claims it rests on |
+| Stage 2 rank | Order the reviews by how **accurate** each critique was | Order the responses from the one that **best does the work the briefing asked for** to the one that does it least well |
+| Stage 2 adjudicate | For every finding id, `agree`/`dispute`/`neutral` on the **critique** | For every claim id, `agree`/`dispute`/`neutral` on whether **the claim holds** |
+| Chair | `VERDICT: Ship it \| Fix these first \| Fundamental rethink` | `ANSWER: Converged \| Split \| Insufficient` |
+| Reliability ledger | One row per (run × model) appended | **Nothing appended** |
+
+**The two scales are disjoint on purpose.** They share no value and no keyword, which is what lets
+each parser stay blind to the other's line: a task run can never report `"Ship it"`, and a review run
+can never report `"Converged"`. The run's intent is what selects the parser — including on a Stage-5
+`amicus council verdict` rebuild long after the run is over, where a carried `overallVerdict` from
+the *wrong* scale is refused and the chair's prose is re-parsed instead. Full field semantics are in
+the `overallVerdict` and `intent` key notes under
+[`amicus council verdict`](#amicus-council-verdict).
+
+**What does *not* change.** The Stage-1 output contract is identical — the same trailing fenced JSON
+skeleton, the same `blocker | major | minor | nit` severity enum, the same required-non-empty
+`location`, validated by the same validator and repaired by the same bounded repair loop. Only the
+frame and the field *glosses* fork. In task mode `location` is the grounding discipline: it names
+what the claim rests on — a source, a computation, or the literal word `assumption`. An empty
+`findings[]` under a real `overall` is a valid task response, exactly as it is a valid review, and
+the bench is told so rather than left to invent claims to fill the array.
+
+Two things a task bundle carries that a review bundle never does: the Stage-2 judge packet ends with
+a `--- THE BRIEFING (what every response was asked to do) ---` section — judges cannot rank *how well
+the work was done* without the ask — and that section is fenced as reference material, because it is
+the first time briefing text reaches a judge in band.
+
+**Task runs write no reliability rows, and say so.** Two gates enforce it (the engine's own append
+and `amicus council tally`'s), and `council tally` refuses a `meta.intent` that is neither spelling
+rather than letting a near-miss slide into the ledger. Where the skip is **load-bearing** it is
+**announced, and the announcement does not degrade the run** — a `Note:` record on the
+`ledger-skipped` channel with `kind: "info"`, which the degrade sink cannot use to flip a run's
+`degraded` state. ⚠️ It is emitted at one site, not on every task run: the chair-fallback promotion
+arm, reached only after the chair's own attempts have all failed and the run still has budget,
+because that arm is the one step that draws on ledger history a task run never fed. A task run whose
+chair answers has no `ledger-skipped` note, and needs none. `info` records are announcements, not losses: the report gives
+them their own **Notes:** list and keeps them out of `## What was lost`. Relatedly,
+[`amicus council stats`](#amicus-council-stats) on an empty ledger now names where rows come from
+instead of implying that no council ever ran.
+
+**Read the tiers correctly.** A task run's report carries the line *"Tiers report peer concurrence,
+never verification."* directly under the tier counts, and the chair's own packet carries the same
+caveat beside the adjudications it is weighing. Peer agreement on a generative bench is correlation
+between models trained on overlapping priors — a tier says *how many peers concurred*, never *that
+the claim was checked*.
+
+**Review runs are byte-identical.** Not "unchanged as far as we know": the review path composes
+through the same dispatcher, and the shared packet — section headers, `Review by <model>` labels,
+empty-section wordings — is used verbatim in both intents. One vocabulary, two instructions.
+
+**Limitations, as of v4.9:**
+
+- **One intent per run.** There is no mixed bench; the whole run is a task run or a review run.
+- **Intent is not pack-settable.** A [policy pack](./usage.md#policy-packs) cannot carry it — pass
+  the flag (or the MCP parameter) explicitly.
+- **`--claude-review` is refused with `--intent task`.** Entering a file as review N+1 is review
+  machinery and has no task-mode meaning.
+- **Task runs build no reliability history**, so they never contribute to — and never benefit from —
+  `amicus council stats`, including the ledger-driven chair-fallback promotion.
+
 ### Debate mode
 
 `--debate` adds a **Stage-2.5 rebuttal round** between cross-review and the final tally
@@ -757,7 +838,8 @@ named here. That is why the v4.8 keys below each needed their own line.
 **Key notes:**
 - `schemaVersion` — verdict-document schema version (currently `2`).
 - `type` — document-type discriminator; always `"council-verdict"` (council family v2 envelope).
-- `overallVerdict` — the chair's verdict-scale outcome: one of `"Ship it"`, `"Fix these first"`, `"Fundamental rethink"`, or `null` when no chair verdict was produced (populated by the headless engine during Stage 3; `null` for a plain `council verdict` merge without engine integration).
+- `overallVerdict` — the chair's terminal-line outcome, on **one of two disjoint scales, chosen by the run's intent**. A review run (no `intent` key) carries a verdict-scale value — `"Ship it"`, `"Fix these first"`, `"Fundamental rethink"` — parsed from the chair's `VERDICT:` line. A **task run** (`intent: "task"`, v4.9) carries an answer-scale value — `"Converged"`, `"Split"`, `"Insufficient"` — parsed from the chair's `ANSWER:` line. The two scales share no value and no keyword, which is what lets each parser be blind to the other's line; a task run therefore never reports `"Ship it"`, and a review run never reports `"Converged"`. `null` on either scale when no chair terminal line was produced (populated by the headless engine during Stage 3; `null` for a plain `council verdict` merge without engine integration).
+- `intent` — **v4.9**, optional, `"task"` only. Present exactly when the run was launched with `--intent task`; absent means review — the engine never writes `"review"` (emit-when-task, the same idiom as `tag`). It is the key every renderer forks on: the report's concurrence qualifier and header word, the fold's and the Workspace chip's `ANSWER:`/`VERDICT:` label, and the chair's own packet/parser upstream of this document.
 - `seats` — **v4.8**, optional. The tally record's `meta.seats` (same `{id, alias, role, lens, position}` shape), promoted to the top level next to `seatLoss`. Present only when the tally record carried one, i.e. only when the bench repeated an alias. It is what makes the `alias#N` ids on `findings[].raiserSeat`, `adjudications[].seat` and `runStats[].seat` resolvable from the verdict **alone** — before v4.8 the verdict named seats it could not resolve. `council report` reads it to give each seat its own adjudication-matrix column; when it is absent, or is not an array of objects each carrying a string `id`, the **adjudication matrix** falls back to alias space whole and renders exactly as it did before v4.8. ⚠️ **That fallback is the matrix's alone — it is not a whole-document guarantee.** The street-cred table beside it labels each row from `streetCred[].seat` whenever the row carries one, a predicate independent of this key, so a verdict with seated `streetCred[]` rows and no usable `seats` renders seat ids in the street-cred table and aliases in the matrix (measured on an absent `seats`, a non-array `seats`, and an array-of-strings `seats`). In-process both fields come from the same twin bench and travel together; the split is reachable on a hand-assembled or externally-supplied record, which `buildVerdict`'s own docblock names. A verdict written before v4.8 carries no `streetCred[].seat` at all and is unaffected.
 - `findings[].raiserSeat` — **v4.8**, optional. The raising seat's id, carried through from the tally record; absent unless the bench repeated an alias. `findings[].raiser` stays the alias.
 - `findings[].sameModelCorroboration` — **v4.8**, optional, `true` only. Carried through from the tally record; see the tally-record notes above for the stamp's meaning **and for the two directions in which it is wrong** (it misses one model behind two aliases, and it fires falsely on one alias behind two executables).
@@ -802,7 +884,12 @@ wrapper over `buildReport()` (`src/council/report.js`, which builds the neutral
 dispatches to `report-md.js` / `report-html.js` — the two renderers that own the string formats).
 
 **What it renders**, in this order: a header (run type, id, date, chair, council members), a
-verdict-summary tier-count table, the **adjudication matrix** (finding × judge, `✓`/`✗`/`–` with
+tier-count summary table — headed **Verdict summary** on a review run and **Answer summary** on a
+task run, since a task run produces an answer, not a verdict, and on a task run followed by the
+one-line concurrence qualifier (*tiers report peer concurrence, never verification*) — a
+**What was lost** section
+when the run degraded (plus a **Notes** list for informational records, e.g. a task run's
+ledger-skipped announcement), the **adjudication matrix** (finding × judge, `✓`/`✗`/`–` with
 `*` marking the raiser's own vote), the **peers-only street-cred table**, **findings grouped by
 tier** (Disputed first), and a **cost table** (per-model status/duration/cost + wave total,
 sourced from `runStats[].usage`).
@@ -873,17 +960,18 @@ matrix does not carry — `` `†` `` marks a finding corroborated only by anoth
 same model — so from v4.8.0 the two legends are no longer interchangeable. That line, and the `†`
 itself, appear only on a run that actually raised such a finding, which is a twin bench only.
 
-⚠️ **v4.8 — a SECOND report/Workspace divergence, in the street-cred table, filed not fixed.** The
-sentence above is scoped to the **matrix**, and stays true. The street-cred table is a different
-story: both renderers (`report-md.js`, `report-html.js`) label each row `seat || model`, so a twin
-bench reads `gemini#1` / `gemini#2`, while the Workspace's street-cred table still labels from the
-model alias
-and reads `gemini` twice with different numbers under one identical name. **On a bench that repeats
-an alias the two street-cred tables now disagree**; on any bench with no repeated alias they are
-identical, because every seat id there *is* its alias. The report side is the corrected one. The
-Workspace side is not a one-liner — its blind mode resolves the label through `opts.labelOf(...)`,
-which would have to accept a seat id first — and is filed in `BACKLOG.md` for v4.9 with that
-signature change as its gate.
+⚠️ **v4.8 filed a SECOND report/Workspace divergence, in the street-cred table — CLOSED in v4.9.**
+The sentence above is scoped to the **matrix**, and stays true. All three street-cred renderers now
+label each row `seat || model`: `report-md.js` and `report-html.js` (v4.8), and the Workspace's own
+(`electron/workspace-ui/workspace-matrix.js :: renderVerdict`, v4.9). A twin bench reads
+`gemini#1` / `gemini#2` in every one of them, instead of the Workspace reading `gemini` twice with
+different numbers under one identical name; on any bench with no repeated alias all three are
+unchanged, because every seat id there *is* its alias. ⚠️ **Blind mode is the deliberate exception
+and is unchanged**: the Workspace still shows the anonymised label, falls back to the model alias
+when no label resolves, and renders a seat id in neither case — a seat id contains its alias, so
+printing one would defeat blind mode (the same rule the matrix follows two paragraphs above).
+`BACKLOG.md` filed this behind the gate *"`opts.labelOf` must accept a seat id"*, which the fix did
+not need: `labelOf` stays alias-keyed, because the value blind mode has to show was never the seat.
 
 This is the same renderer the `second-opinion` skill calls in Stage 5 to produce `report.html`.
 **`report.md` and this renderer's output are two different files** — `report.md` is Claude-authored

package/docs/troubleshooting.md

@@ -237,11 +237,18 @@ For full headless configuration, see [docs/configuration.md](./configuration.md)
 
 **Cause:** The mechanism only knows that the deadline passed with no substantive activity — no output, reasoning, or tool calls — for the backstop window (300 s by default for an ordinary leg). It does **not** know *why*. Do not read this as "the endpoint is dead" or "the model isn't being served" — the message deliberately stops short of that claim, because at one of its two firing sites the backstop can win the race before the prompt send even resolves, so acceptance itself was never observed. Treat `NO_OUTPUT_BACKSTOP` as "silence past the deadline," not a diagnosis.
 
-**Lesson from #133:** an earlier version of this message *did* guess a cause ("likely a listed-but-not-serving model or a dead endpoint"), and that guess sent 30 minutes of debugging at model ids and API keys on a real incident. The actual cause was an OpenCode engine version skew between the npx-cached copy and the global install — sitting the whole time in `~/.local/share/opencode/log/opencode.log`. **Before chasing model/endpoint theories, check that log for the session's real error.**
+Two trailing clauses are the exceptions, and neither is the mechanism's inference:
+
+- ` — engine log: <excerpt>` (since v4.9) is the OpenCode engine's own ERROR line for this exact session, quoted verbatim from the engine's log. That clause is the engine speaking. "For this exact session" is strict: the line must name your session in one of the engine's own session fields (`session.id=`, `id=`, …), so a neighbouring session's failure is never quoted at you — and when nothing on disk meets that bar, the clause is simply absent rather than approximate.
+- ` (engine skew: server <a> ≠ installed <b>)` (since v4.9) means the engine serving **this** run reported a different version than the `opencode-ai` sitting in the install that launched it — two facts, both published by the software itself, neither guessed. It names the server this leg actually talked to, as of this leg's most recent session: a skew seen on some other server in the same process, or one that was fixed part-way through, never rides along on a report it does not belong to. This is #133's own shape; see the Lesson below.
+
+The two clauses are independent: either can appear without the other, and the skew clause is **not** conditional on the log read succeeding. With neither, the message is exactly what it was before v4.9. Everything before them is still only "silence past the deadline".
+
+**Lesson from #133:** an earlier version of this message *did* guess a cause ("likely a listed-but-not-serving model or a dead endpoint"), and that guess sent 30 minutes of debugging at model ids and API keys on a real incident. The actual cause was an OpenCode engine version skew between the npx-cached copy and the global install — sitting in the engine's own log the whole time, at the exact timestamp of every dead session. **Both halves are now surfaced for you** (v4.9): the log line becomes the ` — engine log:` clause, and the skew itself is detected at session-create time — announced on stderr as `[amicus] engine version skew: …` (once per standing skew per server, not once per session) and repeated in the ` (engine skew: …)` clause above. The remedy is to make the two copies the same version — update whichever is behind (`npm i -g amicus`, or re-run the installer for the surface that failed). `amicus doctor` will **not** confirm this one: its engine check compares npx-cached copies against the global install and is structurally blind to the copy the running server loaded, so it can report clean while this notice is firing. One related line can also appear, once per process: `[amicus] server identity unavailable — skew attribution is process-wide; SDK shape may have changed`. It means amicus could not read which server a client is talking to, so skew records stop being kept per server and share one bucket — the skew detection still works, but a clause could in principle be attributed to the wrong server when a run talks to more than one. It is a report about amicus itself, not about your models; if you see it, the OpenCode SDK has probably changed shape and amicus needs an update. If neither clause is present, read the log yourself before chasing model/endpoint theories — see the fix below for where it lives.
 
 **Confirm:** `amicus models --check` — audits your configured aliases against the live catalog and flags drift/staleness. A model that still resolves locally but has quietly been retired upstream is one possible explanation, but a static audit only compares against the catalog's *listing* — it can't tell you whether a still-listed model actually answers. For that, run `amicus models --check --live` on demand: it sends one tiny real request to every stored alias and reports `SERVED` / `SILENT` / `ERROR` per alias, where `SILENT` (`accepted-but-silent`) is this exact `NO_OUTPUT_BACKSTOP` failure, caught deliberately instead of by accident. It spends real money (one tiny leg per stored alias) — see [docs/usage.md § `amicus models`](./usage.md#amicus-models--the-model-catalog) for cost, scope, and exit-code details.
 
-**Fix:** Check the `~/.local/share/opencode/log/opencode.log` for the session's real error first (see #133 above). Then check the alias's target (`amicus models --search <term>` to find the current id, then re-point the alias) — a stale alias is a common case, but not the only one. If the failing leg was a Stage-1 retry (the window read `600s`, or generally double your configured/default value), `AMICUS_NO_OUTPUT_BACKSTOP_MS` **is** the lever — raising it raises both the first attempt's window and the retry's doubled one, unless your `--timeout` is low enough that the doubled window is clamped to the leg timeout. On an ordinary (non-retry) leg, raise it only if a model legitimately needs more than 300 s to produce its first token. The live probe's fixed 30 s window is the one case the env var genuinely cannot touch. See [docs/configuration.md § Headless Poller Tuning](./configuration.md#headless-poller-tuning).
+**Fix:** Read the ` — engine log: …` clause on the failure message first, if it has one — that is the engine's own account of this session (see #133 above). If it has none, look yourself: OpenCode writes its logs to `$XDG_DATA_HOME/opencode/log` when that variable is set, otherwise `~/.local/share/opencode/log` (that path holds on Windows too) — check **both** when `XDG_DATA_HOME` is set, since a leftover value can point at a directory the running engine never writes to (amicus searches all of them, newest file first, and answers from the most recently written line that both is an ERROR and names your session). Current engine builds write **one timestamped file per process** there, e.g. `2026-08-25T185532.log`; older ones append to a single `opencode.log` in the same directory, and both layouts turn up on real machines — so check the newest files by modification time, not one fixed filename. The session's `ses_…` id is the correlation key. Then check the alias's target (`amicus models --search <term>` to find the current id, then re-point the alias) — a stale alias is a common case, but not the only one. If the failing leg was a Stage-1 retry (the window read `600s`, or generally double your configured/default value), `AMICUS_NO_OUTPUT_BACKSTOP_MS` **is** the lever — raising it raises both the first attempt's window and the retry's doubled one, unless your `--timeout` is low enough that the doubled window is clamped to the leg timeout. On an ordinary (non-retry) leg, raise it only if a model legitimately needs more than 300 s to produce its first token. The live probe's fixed 30 s window is the one case the env var genuinely cannot touch. See [docs/configuration.md § Headless Poller Tuning](./configuration.md#headless-poller-tuning).
 
 ---