amicus 4.8.0 → 4.9.0

package/src/utils/provider-default-picker.js

@@ -17,8 +17,11 @@
 const { resolveTier } = require('./model-tiers');
 const { getCostTier, loadConfig, saveConfig } = require('./config');
 const { pairAcrossGateways } = require('./gateway-route-catalog');
-const { toCanonicalDefault, DIVERGENT_VENDORS } = require('./curated-models');
 const { isLocalProvider } = require('./local-providers');
+// directFormIfSafe (list-building) / directFormIfProven (persistence): see
+// model-canonicalization.js's module docstring for why these are two
+// separately-named functions rather than one with an optional mode.
+const { directFormIfSafe, directFormIfProven } = require('./model-canonicalization');
 
 /**
  * @param {{pricing?: {prompt?: string|number|null}|null}|null|undefined} orRow
@@ -49,8 +52,10 @@ function vendorRowsIn(catalog, vendor) {
 }
 
 /**
- * Choose the verbatim catalog id a single catalog `row` should surface as in
- * the picker -- NEVER fabricates an id.
+ * Choose the id a single catalog `row` should surface as in the picker.
+ * Prefers a real, verbatim catalog id; only SYNTHESISES one (delegating to
+ * `directFormIfSafe`, model-canonicalization.js -- see its module docstring
+ * for the guard) for a non-divergent vendor with no direct twin at all.
  *
  * A direct-namespace row always keeps its own (real, direct-callable) id,
  * regardless of what `pairAcrossGateways` could resolve for it -- this is
@@ -60,35 +65,55 @@ function vendorRowsIn(catalog, vendor) {
  * and must not be dropped or silently merged.
  *
  * An OpenRouter-namespace row is collapsed onto a direct id only when
- * `pairAcrossGateways` found exactly one (unambiguous) direct twin -- that's
- * a real catalog id, safe to reuse for dedup. Otherwise: for
+ * `pairAcrossGateways` found exactly one (unambiguous) direct twin. For
  * `DIVERGENT_VENDORS` (direct ids don't share a string form with
- * OpenRouter's -- e.g. anthropic's dash-vs-dot versioning), the row keeps
- * its OpenRouter-prefixed id as-is; stripping the prefix would fabricate a
- * non-direct-callable dot-form id no row actually carries. Non-divergent
- * vendors keep the pre-existing strip via `toCanonicalDefault`, which is
- * safe because their direct and OpenRouter ids are identical once the
- * `openrouter/<vendor>/` prefix is removed (mirrors curated-models.js's
- * `directFormFor` policy).
+ * OpenRouter's, e.g. anthropic's dash-vs-dot versioning), the row keeps its
+ * OpenRouter-prefixed id as-is -- `directFormIfSafe` gates that set FIRST
+ * and internally (model-canonicalization.js), so stripping is never even
+ * attempted on their ids, which is not a string-safe operation.
  * @param {string} vendor
  * @param {boolean} isDirect whether `row.id` is itself a direct-namespace id
  * @param {{id:string}} row
  * @param {{direct?:string, openrouter?:string}} paired
+ * @param {{models: Array<{id:string, authoritative?: boolean}>}} catalogInfo
  * @returns {string|null}
  */
-function chooseRowId(vendor, isDirect, row, paired) {
+function chooseRowId(vendor, isDirect, row, paired, catalogInfo) {
   if (isDirect) { return row.id; }
   if (paired.direct) { return paired.direct; }
   if (!paired.openrouter) { return null; }
-  return DIVERGENT_VENDORS.has(vendor) ? paired.openrouter : toCanonicalDefault(paired.openrouter);
+  return directFormIfSafe(vendor, paired.openrouter, catalogInfo);
 }
 
 /**
  * Dedupe `vendor`'s catalog rows across gateways into one row per logical
  * model, reusing `pairAcrossGateways` (never re-deriving the pairing logic).
- * Every row id is verbatim from the catalog (see `chooseRowId`) -- never
- * fabricated, and a direct row is never dropped even when its OpenRouter
- * twin is ambiguous.
+ * A direct row is never dropped even when its OpenRouter twin is ambiguous.
+ *
+ * Row ids are verbatim catalog ids whenever a real row carries them: a
+ * direct row keeps its own id, and an OpenRouter row collapses onto a
+ * direct twin only when `pairAcrossGateways` found exactly one. For a
+ * NON-divergent vendor with no direct twin at all, `chooseRowId` derives
+ * the bare form via `directFormIfSafe` -- SYNTHESISED, not verbatim, only
+ * when the vendor's namespace can't prove it invalid (issue 195). Measured
+ * 2026-08-24 against a real 601-row catalog: all 14 `deepseek` rows derive
+ * this way (empty namespace); `google` (19/69) and `openai` (51/175) rows
+ * used to derive the same unconditional way despite a populated,
+ * authoritative namespace omitting that specific id, and now stay
+ * OpenRouter-prefixed instead. Once a bare id IS synthesized (the deepseek
+ * case), it is safe for routing, but not for the reason an earlier version
+ * of this comment claimed: a bare id is NOT failure-routed direct-first-
+ * with-OpenRouter-fallback. gateway-router.js's auto-mode step 7 is
+ * `if (rq.keys[vendor] && hasForm(rq, 'direct'))`, and `hasForm` is
+ * `!req.gatewayIds || req.gatewayIds[gateway] !== undefined` -- a bare id
+ * carries no `gatewayIds` at all, so `hasForm(rq, 'direct')` is VACUOUSLY
+ * true on this path; the only real gate is `rq.keys[vendor]`. The fallback
+ * to OpenRouter is therefore KEY-ABSENCE-driven (no key for `vendor`), not
+ * a check that the direct form actually resolves -- that check only fires
+ * on the ALIAS path, where `gatewayIds` IS attached and `hasForm` can
+ * genuinely be false. It is not a catalog-confirmed direct id either way,
+ * and callers that need that distinction should consult
+ * `curated-models.js`'s `directFormProvenance()`.
  * @param {Array<{id:string,name:string,contextLength:(number|null)}>} catalog
  * @param {string} vendor
  * @returns {Array<{id:string,name:string,contextLength:(number|null),pricePerMInput:(number|null),isPreselected:boolean}>}
@@ -109,7 +134,7 @@ function buildRows(catalog, vendor) {
     const isDirect = row.id.startsWith(directPrefix);
     const token = isDirect ? row.id.slice(directPrefix.length) : row.id.slice(orPrefix.length);
     const paired = pairAcrossGateways(vendor, token, catalogInfo);
-    const chosenId = chooseRowId(vendor, isDirect, row, paired);
+    const chosenId = chooseRowId(vendor, isDirect, row, paired, catalogInfo);
     if (!chosenId || seenIds.has(chosenId)) { continue; }
     seenIds.add(chosenId);
 
@@ -124,7 +149,7 @@ function buildRows(catalog, vendor) {
     // pricing (`sourceRow`, which for a local/direct row IS the catalog row
     // itself) instead. Gated on `isLocal`, NOT on "no OpenRouter twin", so a
     // direct (non-local) row with no twin still renders `pricePerMInput:
-    // null` (tests/provider-default-picker.test.js:59, pinned).
+    // null` (tests/provider-default-picker.test.js:60, pinned).
     const localPrice = isLocal ? pricePerMInputFrom(sourceRow) : null;
 
     rows.push({
@@ -140,22 +165,22 @@ function buildRows(catalog, vendor) {
 
 /**
  * Canonicalize `resolveTier`'s verbatim catalog-id output the same way row
- * ids are built (`chooseRowId`), so it can be matched against `rows`
- * exactly. `resolveTier` already prefers a real direct id when one matches
- * the tier pattern (`model-tiers.js`'s `pickForTier` tries the direct
- * namespace first), so this only has an effect when it fell back to an
- * OpenRouter id (no matching direct-namespace row at all). For
- * `DIVERGENT_VENDORS`, that OpenRouter id must stay OpenRouter-prefixed --
- * stripping it would fabricate a non-direct-callable dot-form id that no row
- * carries. Non-divergent vendors keep the pre-existing strip, safe because
- * their direct and OpenRouter ids are identical once the prefix is removed.
+ * ids are built (`chooseRowId`/`directFormIfSafe`), so it matches `rows`
+ * exactly. Only matters when `resolveTier` fell back to an OpenRouter id (no
+ * matching direct-namespace row for the tier). `directFormIfSafe` gates
+ * `DIVERGENT_VENDORS` itself and keeps that id OpenRouter-prefixed;
+ * non-divergent vendors go through the same `classifyModel`-guarded strip
+ * `chooseRowId` uses (issue 195) -- an unconditional strip here would
+ * produce a canonical id `rows` no longer carries whenever `directFormIfSafe`
+ * kept the row itself OpenRouter-prefixed, defeating the match below.
  * @param {string} vendor
  * @param {string|null} resolved verbatim catalog id from `resolveTier`, or null
+ * @param {{models: Array<{id:string, authoritative?: boolean}>}} catalogInfo
  * @returns {string|null}
  */
-function canonicalizeResolved(vendor, resolved) {
+function canonicalizeResolved(vendor, resolved, catalogInfo) {
   if (!resolved) { return null; }
-  return DIVERGENT_VENDORS.has(vendor) ? resolved : toCanonicalDefault(resolved);
+  return directFormIfSafe(vendor, resolved, catalogInfo);
 }
 
 /**
@@ -173,7 +198,9 @@ function canonicalizeResolved(vendor, resolved) {
 function computePreselectedId(vendor, tier, catalog, rows) {
   const effectiveTier = tier || getCostTier();
   const resolved = resolveTier(vendor, effectiveTier, catalog);
-  const canonical = canonicalizeResolved(vendor, resolved);
+  // F2 (B5): guard the same way applyProviderDefault does, so classifyModel
+  // never sees a non-array `models` regardless of what a caller passes.
+  const canonical = canonicalizeResolved(vendor, resolved, { models: Array.isArray(catalog) ? catalog : [] });
   if (canonical && rows.some(r => r.id === canonical)) { return canonical; }
 
   const priced = rows.filter(r => r.pricePerMInput !== null);
@@ -217,22 +244,35 @@ function buildProviderDefaultChoices(vendor, options = {}) {
  * `config.default` on first use. Read-modify-write, NO-CLOBBER -- preserves
  * an already-set `config.default` and every other existing alias/key.
  *
- * `chosenId` is a verbatim catalog id straight from `buildProviderDefaultChoices`
- * (via `chooseRowId`/`computePreselectedId`): a real direct id, or -- for a
- * `DIVERGENT_VENDORS` vendor with no direct twin -- an `openrouter/`-prefixed
- * id. **Never** run `toCanonicalDefault` on a divergent vendor's id: that
- * would strip the `openrouter/` prefix and fabricate a non-direct-callable
- * dot-form id no row actually carries (the exact bug just fixed in Task 4's
- * `chooseRowId`/`canonicalizeResolved`). Non-divergent vendors' direct and
- * OpenRouter ids are identical once the prefix is stripped, so
- * `toCanonicalDefault` is safe there.
+ * `chosenId` comes straight from `buildProviderDefaultChoices`: a real
+ * direct id; an `openrouter/`-prefixed id (`DIVERGENT_VENDORS`, or -- since
+ * issue 195 -- a non-divergent vendor whose bare form would classify
+ * `invalid`); or a bare id already SYNTHESISED via `directFormIfSafe`. By
+ * the time this function runs, `chosenId`'s prefix (or lack of one) IS the
+ * decision -- PERSISTENCE therefore uses `directFormIfProven`, not
+ * `directFormIfSafe`: it strips the `openrouter/` prefix only on POSITIVE
+ * evidence (`classifyModel` returns `valid` -- the bare id is an actual
+ * catalog row), never merely because the catalog couldn't disprove it.
+ *
+ * This matters because `directFormIfSafe`'s optimistic default is correct
+ * for LIST-BUILDING (an empty/absent catalog can't assert absence, so a
+ * bare guess is reasonable to offer) but wrong here: a catalog fetch that
+ * failed or came back empty (`catalog` omitted, or `[]`) must never be read
+ * as license to fabricate a direct id `chooseRowId` never actually offered
+ * -- that reintroduces the exact bug issue 195 fixed, silently, on every
+ * degraded fetch. `directFormIfProven` preserves `chosenId` verbatim
+ * whenever the catalog can't prove the bare form valid, so an empty/absent
+ * `catalog` option is inert (no canonicalization at all), not a fallback to
+ * the old unconditional strip.
  * @param {string} vendor e.g. 'anthropic'
- * @param {string} chosenId verbatim catalog id from the picker
- * @param {{seedDefaultIfAbsent?: boolean}} [options]
+ * @param {string} chosenId id from the picker (see above -- not always
+ *   catalog-verbatim)
+ * @param {{seedDefaultIfAbsent?: boolean, catalog?: Array<{id:string}>}} [options]
  * @returns {{alias: string, setAsDefault: boolean}}
  */
-function applyProviderDefault(vendor, chosenId, { seedDefaultIfAbsent = true } = {}) {
-  const storedId = DIVERGENT_VENDORS.has(vendor) ? chosenId : toCanonicalDefault(chosenId);
+function applyProviderDefault(vendor, chosenId, { seedDefaultIfAbsent = true, catalog } = {}) {
+  const catalogInfo = { models: Array.isArray(catalog) ? catalog : [] };
+  const storedId = directFormIfProven(vendor, chosenId, catalogInfo);
 
   const config = loadConfig() || {};
   if (!config.aliases || typeof config.aliases !== 'object') { config.aliases = {}; }
@@ -246,4 +286,12 @@ function applyProviderDefault(vendor, chosenId, { seedDefaultIfAbsent = true } =
   return { alias: vendor, setAsDefault };
 }
 
-module.exports = { buildProviderDefaultChoices, applyProviderDefault, pricePerMInputFrom };
+// directFormIfSafe/directFormIfProven are re-exported (not just used
+// internally) so a caller that wants the canonicalization primitives
+// directly doesn't need to know they now live in model-canonicalization.js
+// -- see tests/model-canonicalization.test.js for the identity pin proving
+// this is a re-export, not a second, divergeable copy.
+module.exports = {
+  buildProviderDefaultChoices, applyProviderDefault, pricePerMInputFrom,
+  directFormIfSafe, directFormIfProven,
+};

package/src/utils/provider-default-prompt.js

@@ -111,7 +111,7 @@ async function runProviderDefaultFlow(provider, options = {}) {
     chosenId = await promptForChoice(ask, print, choices);
   }
 
-  const { setAsDefault } = applyProviderDefault(provider, chosenId, { seedDefaultIfAbsent: true });
+  const { setAsDefault } = applyProviderDefault(provider, chosenId, { seedDefaultIfAbsent: true, catalog });
   const summaryLine = `\`amicus start --model ${provider}\` → ${chosenId}` +
     (setAsDefault ? ', set as your default model' : '');
 

package/src/utils/quick-picks.js

@@ -79,8 +79,8 @@ function resolveQuickPicks(catalog) {
  * Stripping the prefix there fabricates an id the direct API rejects, which
  * `amicus doctor` then reports as a stale alias. The row's own direct route is
  * used verbatim, falling back to the intact `openrouter/` form when the
- * catalog offered no direct pick. Mirrors the guard already used at
- * `provider-default-picker.js:82,143,220`.
+ * catalog offered no direct pick. Mirrors the DIVERGENT_VENDORS-first guard
+ * `model-canonicalization.js :: directFormIfSafe` uses internally.
  * @param {{vendorPath?:string, routes?:Object<string,string>}} pick
  * @returns {string|undefined}
  */

package/src/utils/remediation-hints.js

@@ -143,6 +143,30 @@ const REMEDIATION_HINTS = Object.freeze({
    */
   pruneSessionIndex:
     'amicus doctor --fix  (removes sessions-index.json entries whose project no longer exists on disk — liveness-based, never by age)',
+
+  /**
+   * Fabricated bare alias (B3, council review of PR 198 / issue 195): v4.8.0
+   * could persist a `<vendor>/<model>` id no catalog row carries. `doctor
+   * --fix` rewrites ONLY the narrow, mechanically-unambiguous class -- an
+   * alias that classifies `invalid` on the `direct` gateway AND has an
+   * unambiguous OpenRouter twin (`pairAcrossGateways`, alias-audit.js's
+   * `findFabricatedAliasRepairs`) -- to that twin. Every other stale/drifted
+   * alias (typo, retired model, user-invented id) is left for `amicus
+   * models --check` instead, never guessed at.
+   */
+  repairFabricatedAlias:
+    'amicus doctor --fix  (rewrites a fabricated bare alias to its catalog-confirmed OpenRouter id — safe only for the narrow class doctor can prove; use `amicus models --check` for anything else)',
+
+  /**
+   * A3 (council review of PR 198): same repairable class as
+   * `repairFabricatedAlias` above, but the cached catalog `evaluateAliasesCheck`
+   * would repair FROM is itself stale (older than doctor's own `catalog`
+   * check's freshness window) -- a stale catalog can be missing rows that
+   * would make a "fabricated" id look repairable when it is merely unfetched,
+   * so the repair declines rather than write on unverified evidence.
+   */
+  repairFabricatedAliasStaleCatalog:
+    'amicus models --refresh, then amicus doctor --fix  (the alias looks fabricated but the cached catalog is stale — refresh it first so the repair rests on current data, not a possibly-incomplete snapshot)',
 });
 
 module.exports = REMEDIATION_HINTS;

package/src/utils/result-schema.js

@@ -8,6 +8,8 @@
  * split out so ./abort-result.js can depend on it without a circular require).
  */
 const { SCHEMA_VERSION } = require('./result-schema-version');
+// v4.9 W13 Task A (PR #207 round 3, B3): the shared ttftMs honesty predicate.
+const { isMeasuredTtft } = require('./ttft');
 
 /** Leg/run statuses that count as terminal for wave aggregation. */
 const TERMINAL_STATUSES = ['complete', 'error', 'timeout', 'aborted', 'crashed', 'idle-timeout'];
@@ -70,6 +72,14 @@ function buildRunResult({ taskId, metadata = {}, result = null, summary = null,
     durationMs,
     sessionDir,
     opencodeSessionId: metadata.opencodeSessionId || null,
+    // v4.9 W13 Task A (probe only, R12): time-to-first-token, sourced straight
+    // off `metadata` like `opencodeSessionId` above. ADDITIVE and emit-when-set
+    // (the pack/tag spread form below, not the `|| null` coercion above): an
+    // absent ttft means "no substantive tick was observed", which is neither
+    // zero nor null, so it must not be coerced into either. PR #207 round 3
+    // (B3): emit-when-VALID via the shared predicate — `metadata` is read off
+    // disk, so NaN/±Infinity/negatives/fractions all reach here. See ./ttft.js.
+    ...(isMeasuredTtft(metadata.ttftMs) ? { ttftMs: metadata.ttftMs } : {}),
     usage: usage !== null ? usage : (metadata.usage || null),
     ...(metadata.pack ? { pack: metadata.pack } : {}),
     ...(metadata.tag ? { tag: metadata.tag } : {}),

package/src/utils/text-sanitize.js

@@ -0,0 +1,81 @@
+/**
+ * @module utils/text-sanitize
+ * One third-party string, safe to render: no escapes, no bidi, one short line.
+ *
+ * EXTRACTED from src/utils/engine-log-parse.js (v4.9 W10 round 3). It was built
+ * there for the engine-log excerpt (round-2 review B2), but reviews B1+C2 put a
+ * SECOND caller on it — `utils/engine-skew.js` runs server-reported version
+ * strings through the same pass before they reach the stderr notice and the
+ * death-report clause. Leaving it in the parse module meant the skew detector
+ * had to depend on the log parser to sanitize a version number, which is a
+ * dependency edge that says nothing true about either module. Here, neither
+ * caller owns it and both just use it.
+ *
+ * `engine-log-parse.js` RE-EXPORTS both names, so every existing import path
+ * stays valid and the extraction pins can assert these are the SAME function
+ * objects rather than a second copy — the same shape as the round-2 splits.
+ *
+ * THE RULE, in one line: this is the ONLY sanitizer. A second implementation
+ * would be a second set of holes, and the holes are the point — every finding
+ * that has landed here (ANSI in round 2, bidi in round 3) was a class the
+ * previous pass could not see.
+ *
+ * PURE: no I/O, no throwing paths, no state.
+ */
+
+'use strict';
+
+/** One short line: long enough for a real engine error, short enough to ride
+ *  inside an error string that already carries the backstop's own sentence. */
+const MAX_EXCERPT_CHARS = 200;
+
+/** An ANSI escape sequence: CSI (`ESC [ … final`), OSC (`ESC ] … BEL/ST`), or a
+ *  bare two-character escape. */
+// eslint-disable-next-line no-control-regex
+const ANSI_SEQUENCE = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)?|[@-_])/g;
+/** C0 and C1 control characters, DEL included. */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHAR = /[\u0000-\u001f\u007f-\u009f]/g;
+/**
+ * Unicode BIDI controls: the embedding/override set, the isolates, the marks.
+ *
+ * Round-3 review A2. PRINTABLE-range code points, so the C0/C1 sweep above never
+ * saw them — and each reorders the characters that follow, letting a third
+ * party's error string rewrite the sentence it is quoted into (a RIGHT-TO-LEFT
+ * OVERRIDE renders the rest of the line backwards). Formatting, so DROPPED.
+ */
+const BIDI_CONTROL = /[\u202a-\u202e\u2066-\u2069\u200e\u200f\u061c]/g;
+
+/**
+ * One line, no control characters, no bidi controls, at most `maxChars`.
+ *
+ * SANITIZED, not just collapsed (round-2 review B2). This is quoted verbatim
+ * from a third party's text into output that reaches terminals and MCP
+ * surfaces; engine lines can embed provider output, colour codes and all.
+ * Escape sequences and bidi controls are DROPPED (formatting: removing them
+ * keeps `<esc>[31mred<esc>[0m` as `red`, not as spaced-out text); every
+ * remaining control byte becomes a space, which the collapse below tidies.
+ *
+ * THE CAP IS A PARAMETER because this is the house sanitizer for any
+ * third-party string we render, not only log excerpts: `utils/engine-skew.js`
+ * runs SERVER-SUPPLIED version strings through it at a shorter cap before they
+ * enter the stderr notice and the death-report clause (round-3 reviews B1+C2).
+ * One sanitizer, one dialect — a second implementation is a second set of holes.
+ * @param {*} text
+ * @param {number} [maxChars]
+ * @returns {string}
+ */
+function collapseExcerpt(text, maxChars = MAX_EXCERPT_CHARS) {
+  const oneLine = String(text === undefined || text === null ? '' : text)
+    .replace(ANSI_SEQUENCE, '')
+    .replace(BIDI_CONTROL, '')
+    .replace(CONTROL_CHAR, ' ')
+    .replace(/\s+/g, ' ').trim();
+  if (oneLine.length <= maxChars) { return oneLine; }
+  return `${oneLine.slice(0, maxChars - 1)}…`;
+}
+
+module.exports = {
+  collapseExcerpt,
+  MAX_EXCERPT_CHARS,
+};

package/src/utils/ttft.js

@@ -0,0 +1,57 @@
+/**
+ * @module utils/ttft
+ * The one honesty predicate for the time-to-first-token probe (v4.9 W13).
+ *
+ * ⚠️ The JSDoc leads this file, ahead of `'use strict'`, matching
+ * `utils/text-sanitize.js` / `utils/engine-skew.js` / `utils/alias-shadow.js`:
+ * `scripts/generate-docs.js` only reads a block comment that starts at byte
+ * zero, so a `// path` line above it would leave this module's CLAUDE.md row
+ * blank the way `utils/result-schema.js`'s already is.
+ *
+ * `ttftMs` is produced once — in `src/headless.js`'s poll loop, as a
+ * `Date.now()` delta — and then passes four EMIT GATES on its way to a
+ * document: `headless.js`'s three returns, `sidecar/fanout-leg.js`'s leg patch,
+ * `utils/result-schema.js :: buildRunResult`, and
+ * `council/run-stats-entry.js :: buildRunStatsEntry`. Every gate used to spell
+ * its own `typeof x === 'number'` test, which is four chances to disagree and
+ * four ways to publish a value both schemas forbid.
+ *
+ * ⚠️ `typeof` is not the schema's contract. `schemas/run.schema.json` and
+ * `schemas/council-tally.schema.json` both declare this field
+ * `integer, minimum 0`, and `typeof` admits four families that violate it:
+ *   · NaN — `JSON.stringify` writes it as `null`, so the artifact breaks its own
+ *     schema while LOOKING like the honest absence the emit-when-set rule means.
+ *   · ±Infinity — not hypothetical from an artifact: `JSON.parse('1e999')` is
+ *     `Infinity` (MEASURED), and it also serializes to `null`.
+ *   · Negative — the probe is a wall-clock delta, so a backward jump (NTP
+ *     correction, a VM resuming from suspend, a manual clock set) between the
+ *     clock origin and the first substantive poll measures below zero.
+ *   · Fractional — a hand-edited leg document.
+ *
+ * ⚠️ DROP, DO NOT CLAMP. A skewed −5 s reading clamped to `0` would publish
+ * "first token inside the first poll" — the most consequential value in the
+ * distribution the C2 derivation will read — for a leg that measured nothing of
+ * the kind. Emit-when-VALID is the same discipline as emit-when-set: absence
+ * already means "no honest measurement was made", and a dishonest number is
+ * exactly that. `0` itself stays a real, emittable measurement.
+ *
+ * ⚠️ Three of the four gates import this. The fourth,
+ * `council/run-stats-entry.js`, is pinned REQUIRE-FREE (P3,
+ * tests/council/run-stats-entry.test.js — the pin fires on the character
+ * sequence anywhere in that file, comments included) so require-free consumers
+ * can import it, so it spells the same expression by hand. The structural pins
+ * that keep the hand-spelled copy in step live in that same test file.
+ */
+
+'use strict';
+
+/**
+ * Is this a real time-to-first-token measurement, fit to ride a document?
+ * @param {*} value
+ * @returns {boolean} true only for a non-negative integer millisecond count.
+ */
+function isMeasuredTtft(value) {
+  return Number.isInteger(value) && value >= 0;
+}
+
+module.exports = { isMeasuredTtft };

package/src/utils/untrusted-fence.js

@@ -17,6 +17,16 @@
  * stays intact inside the fence. It must NOT be applied to CLI --json stdout
  * (the byte-parseable programmatic channel) or amicus_read mode=metadata —
  * structured data a caller parses, where wrapping would break the contract.
+ *
+ * This module ALSO hosts the OUTBOUND family's tag neutralizer
+ * (`defangOutboundFenceTags`, PR #200 tails B2/C2; close tags only until PR
+ * #206 round 3 B3b took it to open tags too). It lives here rather than
+ * beside either outbound builder because there are two of them — the council
+ * briefing tail (src/council/briefings-stage2-task.js :: fenceBriefing) and the
+ * parent-conversation section (src/prompt-builder.js :: buildContextSection) —
+ * in two directories that do not import each other, and this is the one module
+ * in the tree whose subject is fences and which both can reach without either
+ * depending on the other.
  */
 'use strict';
 
@@ -36,4 +46,104 @@ ${body}
 </untrusted_sidecar_output>`;
 }
 
-module.exports = { fenceSidecarOutput };
+/**
+ * Every OUTBOUND house fence's tag name. ONE list, deliberately: both surfaces
+ * run the neutralizer over their whole vocabulary, not just their own tag, so a
+ * fence added to the family is covered everywhere by editing this array — and a
+ * body that carries the SIBLING surface's tags (either end, since round 3)
+ * cannot smuggle them through the surface that does not happen to emit them.
+ * @see src/council/briefings-stage2-task.js :: BRIEFING_FENCE_CLOSE
+ * @see src/prompt-builder.js :: buildContextSection
+ */
+const OUTBOUND_FENCE_TAGS = ['council_briefing', 'previous_conversation'];
+
+/**
+ * `</council_briefing>` / `</previous_conversation>`, case-insensitively and
+ * tolerating whitespace ANYWHERE inside the angle brackets — including between
+ * the `<` and the `/` (round 3, C1: the round-2 pattern required those two to
+ * be adjacent, so `< /council_briefing>` rode through untouched, and a reading
+ * model honours that spelling exactly as readily as the tight one). The slash
+ * and its surrounding space are INSIDE the captured group, so the author's own
+ * spelling survives into the defanged form and nothing is hidden.
+ * ⚠️ Module-level and `g`-flagged: safe ONLY because its sole use is
+ * `String#replace`, which resets `lastIndex` around the call. A `.test()` on
+ * this object would carry `lastIndex` between calls and skip matches — build a
+ * fresh regex if one is ever needed. Same warning for the OPEN pattern below.
+ */
+const OUTBOUND_FENCE_CLOSE_RE =
+  new RegExp(`<(\\s*\\/\\s*(?:${OUTBOUND_FENCE_TAGS.join('|')})\\s*)>`, 'gi');
+
+/**
+ * The same families' OPEN tags, attributes and all (round 3, B3b).
+ *
+ * `\\b` after the name is what keeps this off tags that merely START with a
+ * house name — `<council_briefingx>` is somebody else's markup — and
+ * `[^<>]*` carries whatever attributes the author wrote through into the
+ * escaped form. It cannot match a CLOSE tag: `\\s*` does not consume the `/`.
+ */
+const OUTBOUND_FENCE_OPEN_RE =
+  new RegExp(`<(\\s*(?:${OUTBOUND_FENCE_TAGS.join('|')})\\b[^<>]*)>`, 'gi');
+
+/**
+ * Neutralize any outbound house fence tag inside a body about to be embedded in
+ * one (PR #200 tails B2/C2; round 3 B3b/C1 widened it from closes to both ends).
+ *
+ * Without this, untrusted text that contains the close tag ends the fence early
+ * in the reading model's eyes and everything after it reads as the engine
+ * speaking — the fence's entire purpose, undone by a string the author types.
+ * The replacement is an entity escape (`&lt;/council_briefing&gt;`), so the
+ * text stays legible as what the author wrote while no longer being a tag:
+ * nothing is deleted and nothing is silently swallowed.
+ *
+ * OPEN TAGS TOO, and round 2's reason for skipping them was wrong (B3b). That
+ * reason — "an open tag inside a fence cannot escape it" — holds for a STRICT
+ * parser and fails for the reader this fence is actually addressed to. A model
+ * that balances tags reads the attacker's `<council_briefing …>` and the
+ * engine's REAL `</council_briefing>` as one pair: the attacker's tag gets the
+ * close, and the engine's fence is left unterminated. Everything after the
+ * attacker's open reads as fenced material, and everything the ENGINE writes
+ * after the real close reads as still inside a fence. That is the same escape
+ * one tag along. MEASURED before widening (W12, re-verified round 3): nothing
+ * in the tree PARSES these tags — the only occurrences outside test assertions
+ * are the two producers' own literals — so escaping opens breaks no consumer.
+ *
+ * ⚠️ THE BOUNDARY IS SOFT, and this is a disclosure, not a caveat. An entity
+ * escape is a convention about how a READING MODEL should interpret bytes, not
+ * a parser guarantee: some models decode `&lt;/council_briefing&gt;` back to
+ * the tag while reading, and a model that does is not fenced by this. What this
+ * buys is defense in depth — it removes the LITERAL tag, so the escape stops
+ * being free and starts depending on a decoding step the attacker does not
+ * control. The load-bearing protection is still the preamble both fences carry
+ * (the enclosed text is reference material, not instructions); this hardens it,
+ * and does not replace it. Deleting the tag outright would be a stronger
+ * boundary and a worse product — the reader would silently lose text the author
+ * wrote, which is the failure the whole fence exists to avoid.
+ *
+ * Total over non-strings (returns its argument unchanged): callers hand it
+ * whatever they were given, and a missing body must never be a throw inside a
+ * prompt builder.
+ * @param {string} text the untrusted body about to be fenced
+ * @returns {string} the same bytes when it carries no house tag
+ */
+function defangOutboundFenceTags(text) {
+  if (typeof text !== 'string') { return text; }
+  // Closes first: once a close is escaped its `<` is gone, so the OPEN pattern
+  // cannot see it. (It could not match one anyway — see the pattern's note —
+  // but the order makes that independent of the pattern staying that way.)
+  return text
+    .replace(OUTBOUND_FENCE_CLOSE_RE, '&lt;$1&gt;')
+    .replace(OUTBOUND_FENCE_OPEN_RE, '&lt;$1&gt;');
+}
+
+// FUNCTIONS FIRST, constant last — the PR 201 round-2 workaround for
+// `scripts/generate-docs-helpers.js :: extractExports`, which renders EVERY
+// export as `name()` and keeps only the first five. Ordering conceals a
+// constant behind that cap; MEASURED here, it cannot, because this module
+// exports three names and the cap never fires. So CLAUDE.md's Key Exports cell
+// reads `OUTBOUND_FENCE_TAGS()` for what is an array — a known-defect instance
+// of the generator bug, not a claim this module makes, and the second one below
+// the workaround's floor after `utils/text-sanitize.js`. It goes away with the
+// generator ruling filed in BACKLOG.md; padding the export list to five to hide
+// it would not be a fix, and the list itself must stay exported —
+// tests/utils/outbound-fence-defang.test.js reads it as the LIVE vocabulary.
+module.exports = { fenceSidecarOutput, defangOutboundFenceTags, OUTBOUND_FENCE_TAGS };

package/src/workspace/fold-format.js

@@ -5,10 +5,11 @@
  * (src/headless.js `formatFoldOutput`, exported from src/headless.js and
  * re-exported from src/index.js) — byte-for-byte the same **7-line** head:
  * marker, Model, Session, Client, CWD, Mode, `---`. ⚠️ v4.4.1 DOC-5: this said
- * "8-line" for two releases. Line 8 (`VERDICT:`) is council's OWN addition and
+ * "8-line" for two releases. Line 8 (the terminal line — `VERDICT:` on a review
+ * run, `ANSWER:` on a task one since v4.9 W8) is council's OWN addition and
  * has no counterpart in formatFoldOutput, whose 8th element is the summary
  * body. Only the first 7 lines are the shared contract; anyone changing the
- * shared format must sync those and leave `VERDICT:` alone.
+ * shared format must sync those and leave the terminal line alone.
  * src/headless.js is the SOURCE OF TRUTH; keep the head in sync with it.
  * (Line numbers deliberately omitted — the previous `:775-789`/`:797` citation
  * had drifted by ~500 lines.) The duplication is deliberate:
@@ -24,7 +25,7 @@
  * The chair body is UNTRUSTED model text: it passes through stripFoldMarkers
  * before embedding, so chair prose containing a marker can never truncate or
  * spoof the fold (the exact hazard the nonce closure exists for).
- * Degradation mirrors the engine's ladder: no chair → VERDICT: none + tally
+ * Degradation mirrors the engine's ladder: no chair → `<terminal>: none` + tally
  * summary; pre-tally → stage/status summary. Never blocked, always labeled.
  */
 'use strict';
@@ -63,14 +64,34 @@ function buildFoldText(o) {
   // amicus_verdict MCP path types overallVerdict as a bare z.string().nullable()
   // — mcp-tools.js :: amicus_verdict), so a multi-line or marker-bearing value
   // must never reach the head verbatim: an embedded '\n' would shift every line below
-  // VERDICT: (a raw string containing '\n' becomes several elements once the
+  // the terminal line (a raw string containing '\n' becomes several elements once the
   // head array is '\n'-joined), and an embedded marker could spoof the fold.
-  // Safe on the shipped engine path (parseChairVerdict returns a canonical
-  // CHAIR_VERDICTS phrase) — this is defense-in-depth, not a fix for a real
+  // Safe on the shipped engine path (`run-chair.js :: runChair` parses the chair's
+  // terminal line with `parse-stage2.js :: parseChairTerminal`, which returns a
+  // canonical phrase of the run's OWN scale — CHAIR_VERDICTS on a review run,
+  // CHAIR_ANSWERS on a task one) — this is defense-in-depth, not a fix for a real
   // producer.
+  // ⚠️ DE-ROT (v4.9 W8): this said "parseChairVerdict returns a canonical
+  // CHAIR_VERDICTS phrase", true only until W7 added the second scale — after
+  // which it named the wrong parser for every task run.
   const overall = verdict && verdict.overallVerdict
     ? stripFoldMarkers(String(verdict.overallVerdict)).replace(/[\r\n]+/g, ' ').trim()
     : null;
+  // v4.9 W8: the terminal line names the SCALE its phrase belongs to. The two
+  // scales are disjoint by pinned construction (tests/council/chair-scale-drift.test.js),
+  // so labelling a CHAIR_ANSWERS phrase `VERDICT:` asserts a scale it is not on.
+  // `intent` is emit-when-'task' (verdict.js :: buildVerdict, the W5 ruling), so
+  // absence — and an explicit 'review' — keep the review fold byte-identical.
+  // ⚠️ v4.9 fix round 2 (council B2): `run.intent` is the SECOND carrier, and it
+  // is what covers the DEGRADED fold — the one a user reaches for precisely when
+  // a task run went wrong. With no verdict.json (or a parse-failed one) there is
+  // no verdict.intent, and the fold headed `VERDICT: none` on a run that was
+  // never on that scale. `o.run` is the parsed run.json, which checkpoints
+  // `intent: 'task'` at start (src/council/run.js :: runCouncil):
+  // electron/ipc-workspace.js passes `run: detail.run` and run-detail.js ::
+  // getRunDetail reads it straight from `<runDir>/run.json`.
+  // PR #200 round-5 B3: parens on the whole disjunction — behaviour-identical.
+  const terminalLabel = ((verdict && verdict.intent === 'task') || run.intent === 'task') ? 'ANSWER' : 'VERDICT';
   const tierCounts = (verdict && verdict.tierCounts) || (tally && tally.tierCounts) || null;
   const cost = run.usage && run.usage.cost ? run.usage.cost : null;
 
@@ -82,7 +103,7 @@ function buildFoldText(o) {
     `CWD: ${o.project}`,
     'Mode: council',
     '---',
-    `VERDICT: ${overall || 'none'}`,
+    `${terminalLabel}: ${overall || 'none'}`,
   ];
   if (tierCounts) {
     head.push(tierLine(tierCounts));