amicus 4.8.0 → 4.9.0

package/electron/workspace-ui/workspace-seats.js

@@ -1,18 +1,15 @@
 /**
- * Council Workspace — seats panel painter (v4.4 §5). D8 extraction (Task 1,
- * v4.6.2 PR4): moved verbatim out of workspace-panels.js, which was pressed
- * up against the 300-line size gate — this file is where Task 2 adds
- * dead-seat rows. Loads immediately before workspace-panels.js (index.html),
- * which keeps a thin delegate; reads `window.AmicusApp` at CALL time, same
- * discipline as every sibling renderer file (workspace-app.js boots last and
- * owns `state`).
+ * Council Workspace — seats panel painter (v4.4 §5). D8 extraction (Task 1, v4.6.2 PR4): moved
+ * verbatim out of workspace-panels.js, which was pressed up against the 300-line size gate —
+ * this file is where Task 2 adds dead-seat rows. Loads immediately before workspace-panels.js
+ * (index.html), which keeps a thin delegate; reads `window.AmicusApp` at CALL time, same
+ * discipline as every sibling renderer file (workspace-app.js boots last and owns `state`).
  *
- * Task 2 ("dead-seat rows"): `state.detail.run` and `state.detail.verdict`
- * are the raw run.json/verdict.json docs (src/workspace/run-detail.js —
- * `getRunDetail` returns them wholesale, unfiltered), so `run.degrades` and
- * `verdict.seatLoss` are already on `state.detail` today; no data-layer
- * threading was needed. Only the derivation (window.AmicusLive.deadSeats,
- * live-seats.js) and this file's painting are new.
+ * Task 2 ("dead-seat rows"): `state.detail.run` and `state.detail.verdict` are the raw
+ * run.json/verdict.json docs (src/workspace/run-detail.js — `getRunDetail` returns them
+ * wholesale, unfiltered), so `run.degrades` and `verdict.seatLoss` are already on
+ * `state.detail` today; no data-layer threading was needed. Only the derivation
+ * (window.AmicusLive.deadSeats, live-seats.js) and this file's painting are new.
  *
  * NOTE (scope, matches the plan's file list): renderSeatsPanel() (below) is reached from
  * renderDetail() — called both from openRun() (a fresh run open) and from the blind toggle
@@ -50,41 +47,57 @@
    * seat-keyed and deadSeats still dedup'd on the alias; PR5c seat-keyed the other side too,
    * so both now key on "seat id where the record supplies one, alias otherwise". The
    * kind/channel FILTER still mirrors window.AmicusLive.deadSeats — now at
-   * live-dead-seats.js, which PR5c split out of live-seats.js for the 300-line gate — and
-   * must keep doing so. Two spellings of one rule is PR5a council finding B1.
+   * live-dead-seats.js, where PR5c's size-gate split put it and v4.9 W9 named it `isSeatLoss` —
+   * and must keep doing so; the two moved together in W9's one commit. Two spellings of one rule
+   * is PR5a council finding B1; only the behavioural drift pin in workspace-seats.test.js holds it.
    *
    * ⚠️ The two sides are NOT identical, and the difference is deliberate: deadSeats decides
    * whether a seat is RENDERED, so it fails toward showing a row; this decides whether a
    * badge is PAINTED, so an unidentified record falls back to the alias and marks every seat
    * sharing it. Over-badging is visible and self-correcting; a missing badge is silent.
    *
-   * The kind/channel filter is load-bearing: run.degrades[] also carries
-   * kind:'heal' / channel:'stage1-retry' records with the SAME retryWaveId/firstFailure fields
-   * for seats that RECOVERED, and a field-only scan would tag a recovered seat "retried once".
+   * The kind/channel filter is load-bearing: run.degrades[] also carries kind:'heal' /
+   * channel:'stage1-retry' records with the SAME retryWaveId/firstFailure fields for seats that
+   * RECOVERED, and a field-only scan would tag a recovered seat "retried once".
    *
-   * ⚠️ firstFailure is TRUTHINESS ONLY. Two shapes, both built in
-   * run-retry-group.js :: groupStage1Losses — its deadLegs loop emits {seat, class:'leg',
-   * status, reason}; its deadWaves loop emits {seat, class: lossClass(w), waveId, reason}
-   * at THREE sites (lens/critic/bench), none carrying a status key, where
-   * `const lossClass = w => (w.partial ? 'missing' : 'wave')` — so firstFailure.status is
-   * undefined on every wave-origin seat. ⚠️ T-A8 DROPPED five line numbers here: re-opened
-   * 2026-08-17 they had all rotted a uniform +31 (T-A3 +15, T-A6 +16), and "now 235" is 266.
+   * ⚠️ `firstFailure` is no longer a retried MARKER here — the W9 fix round narrowed the gate to
+   * `retryWaveId` (see below) — and the only thing left read off it is `.seatId`. THREE shapes
+   * carry that key today: `run-retry-group.js :: groupStage1Losses` builds two, its deadLegs
+   * loop's {seat, class:'leg', status, reason} and its deadWaves loop's {seat, class:
+   * lossClass(w), waveId, reason} at three sites (lens/critic/bench), both stamped with `seatId`
+   * by `recordFailure`; `run-retry-notes.js :: skippedWaveNote` builds a third, {seat, class:
+   * 'missing', waveId, reason}, which never passes through recordFailure and so carries NO
+   * seatId — it puts the seat id on `data.seatId` instead, which the key read below falls
+   * through to. ⚠️ T-A8 DROPPED five line numbers here: re-opened 2026-08-17 they had all rotted
+   * a uniform +31 (T-A3 +15, T-A6 +16), and "now 235" is 266.
    */
   function retriedSeats(degrades) {
     var out = Object.create(null);
     (degrades || []).forEach(function (d) {
-      if (!d || d.kind !== 'degrade') { return; }
-      if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave') { return; }
+      // A kind-LESS record IS a degrade (W9 fix round, C4) — this panel falls back to
+      // `verdict.degrades` below, documents that can predate kinds. Mirrors isSeatLoss.
+      if (!d || (d.kind !== undefined && d.kind !== 'degrade')) { return; }
       var data = d.data || {};
-      if (!(data.retryWaveId || data.firstFailure)) { return; }
-      if (d.channel === 'dead-leg') {
-        // ⚠️ Prefer the SEAT ID when the record names one. TWO mechanisms now supply it, not
-        // one: retryLegStillDeadNote and missingLegStillDeadNote via `firstFailure.seatId`
-        // (pinned by tests/council/run-retry.test.js:628 on a twin bench), and — since
-        // v4.8 PR5c — srcLegStillDeadNote via its own `data.seatId`. Reading only the first
-        // meant a srcLeg record keyed by ALIAS and badged the live twin "retried once" while
-        // the seat that was actually retried showed nothing.
-        // `data.seat` remains the last fallback for pre-PR5c records (residual R6).
+      // Hoisted ABOVE the channel test (behaviour-preserving — the two loss channels already
+      // required it) because it is ALSO the `seat-unbound` gate v4.9 W9 admits that shared channel
+      // through: orphan-leg, re-vote and Stage-2 judge notes ride it, are not retried seats, and
+      // none carries a retry-family field. ⚠️ NARROWED to `retryWaveId` alone in the W9 fix round
+      // (mutant SKIPRETRIED): this is a RETRIED set, and `run-retry-notes.js :: skippedWaveNote`
+      // carries a `firstFailure` for a seat the retry never ATTEMPTED, so badging it would be
+      // false. `isSeatLoss` still admits that record as a LOSS — its gate keeps both fields; only
+      // the retried READ differs (the drift pin compares exactly that read). Every RETRIED seat's
+      // builder emits `retryWaveId` — never-attempted skippedWaveNote alone lacks it — so no badge is lost.
+      if (!data.retryWaveId) { return; }
+      if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave'
+        && !(d.channel === 'seat-unbound' && (data.seatId || data.seat))) { return; }
+      if (d.channel !== 'dead-wave') {
+        // ⚠️ Prefer the SEAT ID when the record names one. TWO mechanisms supply it, not one:
+        // retryLegStillDeadNote and missingLegStillDeadNote via `firstFailure.seatId` (pinned by
+        // tests/council/run-retry.test.js:628 on a twin bench), and — since v4.8 PR5c —
+        // srcLegStillDeadNote via its own `data.seatId`, joined on that key by waveStillDeadNote's
+        // partial `seat-unbound` arm in v4.9 W9. Reading only the first meant a srcLeg record
+        // keyed by ALIAS and badged the live twin "retried once" while the seat that was actually
+        // retried showed nothing. `data.seat` is the last fallback, for pre-PR5c records (R6).
         var key = (data.firstFailure && data.firstFailure.seatId) || data.seatId || data.seat;
         if (key) { out[key] = true; }
       } else {
@@ -102,9 +115,8 @@
     return out;
   }
 
-  // Mirrors isReviewing at live-dead-seats.js (moved there by PR5c's size-gate split) —
-  // a chair/judge/rebuttal/revote row must not
-  // carry a reviewer's retry marker.
+  // Mirrors isReviewing at live-dead-seats.js (moved there by PR5c's size-gate split) — a
+  // chair/judge/rebuttal/revote row must not carry a reviewer's retry marker.
   function isReviewingRole(role) {
     return role === 'seat' || role === 'critic' ||
       (typeof role === 'string' && role.indexOf('lens:') === 0);
@@ -117,11 +129,16 @@
     var tbody = A.$('seats-body');
     window.AmicusRender.renderSeats(tbody, seats, A.state.blind, A.labelOf);
     var seatLoss = d.verdict && d.verdict.seatLoss;
-    var runMeta = { critic: (d.run && d.run.critic) || null };
+    // `criticSeat` (v4.9 W9 / R4): run.json's resolved critic SEAT id (run-state.js ::
+    // initCouncilRun seeds it, seats.js :: preflightSeats supplies it) — what lets deadSeats
+    // tag the critic by seat identity. Null with no critic, and on pre-field run.json.
+    var runMeta = { critic: (d.run && d.run.critic) || null,
+      criticSeat: (d.run && d.run.criticSeat) || null };
     // Source-selection (v4.6.3 PR2, spec D4): run-degrade.js swallows checkpoint failures, so
-    // verdict.json can carry degrade records run.json's own checkpoint lost — fall back to it
-    // ONLY when run.degrades is empty/absent. A fallback, never a union: both docs can carry
-    // records for the SAME run, and the persisted run.json copy is authoritative when present.
+    // verdict.json can carry degrade records run.json's own checkpoint lost — fall back to it ONLY
+    // when run.degrades is empty/absent. A fallback, never a union: both docs can carry records for
+    // the SAME run, and the persisted run.json copy is authoritative when present. (This fallback
+    // is why the kind test above must admit a kind-LESS record: verdict.json can predate kinds.)
     var deg = (d.run && d.run.degrades && d.run.degrades.length) ? d.run.degrades
       : ((d.verdict && d.verdict.degrades) || []);
     var retried = retriedSeats(deg);
@@ -130,16 +147,14 @@
     // composed doc's leg order — so tbody.children[i] is not seats[i]. Build the key exactly the
     // way renderSeats does or the lookup silently misses.
     var rowsByKey = Object.create(null);
-    Array.prototype.slice.call(tbody.children).forEach(function (row) {
-      rowsByKey[row.dataset.key] = row;
-    });
+    Array.prototype.slice.call(tbody.children).forEach(function (row) { rowsByKey[row.dataset.key] = row; });
     seats.forEach(function (s) {
       var row = rowsByKey[String(s.id || s.model)];
       if (!row || !row.children[8]) { return; }
-      // Column 8 is the table's unlabeled trailing flag cell (index.html:51's final <th></th>).
-      // It carries '⏳ stalled' on the LIVE path; on this terminal path seatsFromRunStats
-      // hardcodes stalled:false (live-seats.js, seatsFromRunStats), so it is always empty here and free to use.
-      // If that ever changes, this is the collision site.
+      // Column 8 is the table's unlabeled trailing flag cell (index.html:51's final <th></th>). It
+      // carries '⏳ stalled' on the LIVE path; on this terminal path seatsFromRunStats hardcodes
+      // stalled:false, so it is always empty here and free to use — the collision site if that
+      // ever changes.
       // Fix wave (whole-branch review, finding 2): this pass must be SYMMETRIC. renderSeats
       // reuses rows keyed on `model:role` across calls — including across two different
       // terminal runs opened in sequence that happen to share an alias+role — and never resets
@@ -158,34 +173,35 @@
       //
       // ⚠️ NAMING HAZARD (council A1): `seat` means TWO different things three lines apart.
       // `s.seat` is a SEAT ID (`alias#N`, from src/council/run-stats-entry.js :: buildRunStatsEntry
-      // via the cost row). The degrade records keyed into `retried` above use `data.seat`,
-      // which is an ALIAS and stays one
-      // deliberately (run-retry-notes.js:39-45 — verdict.js:72 compares it against `o.critic`).
-      // Reading one as the other is precisely how an earlier revision of this fix paired an
-      // alias-keyed map with a seat-id lookup and dropped every badge. When touching either
-      // side, say which space you are in.
+      // via the cost row). The degrade records keyed into `retried` above use `data.seat`, which is
+      // an ALIAS and stays one deliberately (run-retry-notes.js :: waveStillDeadNote's `data`
+      // comment; `verdict-seat-loss.js :: deriveSeatLoss`'s `criticLeg` compares it to `o.critic` —
+      // both by SYMBOL since W9). Reading one as the other is precisely how an earlier revision of
+      // this fix paired an alias-keyed map with a seat-id lookup and dropped every badge. When
+      // touching either side, say which space you are in.
       //
       // ⚠️ The pre-PR expression was `retried[s.modelInput || s.model]` (council B1). The
       // `modelInput` arm is dropped on purpose: this loop only ever iterates
       // `seatsFromRunStats(...)` output (assigned in workspace-seats.js :: renderSeatsPanel), and
       // that projection emits no `modelInput` at all — live payload seats, which DO carry it,
       // reach `deadSeats` in workspace-seats.js :: appendDeadRows and never reach here. The
-      // invariant is pinned by test (12) in workspace-seats.test.js;
-      // if that test ever fails, restore the `s.modelInput` arm rather than deleting the test.
-      // ⚠️ `s.seat &&` is LOAD-BEARING (council A1). `s.seat` is null on a unique bench, and a
-      // bare `retried[s.seat]` coerces null to the STRING key 'null' — so a seat with no seat id
-      // would match a degrade record whose alias is literally `null`. Measured: with
-      // `m = Object.create(null); m['null'] = true`, `m[null]` is `true`. Contrived, but this
-      // module already guards the same class elsewhere — live-dead-seats.js, deadSeats' Object.create(null) note, records a model
-      // named `toString` crashing the seats repaint, which is why Object.create(null) is used
-      // throughout. The guard costs nothing and closes it.
+      // invariant is pinned by test (12) in workspace-seats.test.js; if that test ever fails,
+      // restore the `s.modelInput` arm rather than deleting the test.
+      // ⚠️ `s.seat &&` is LOAD-BEARING (council A1). `s.seat` is null on a unique bench, and a bare
+      // `retried[s.seat]` coerces null to the STRING key 'null' — so a seat with no seat id would
+      // match a degrade record whose alias is literally `null`. Measured: with
+      // `m = Object.create(null); m['null'] = true`, `m[null]` is `true`. Contrived, but this module
+      // already guards the same class elsewhere — live-dead-seats.js's Object.create(null) note in
+      // deadSeats records a model named `toString` crashing the seats repaint, which is why
+      // Object.create(null) is used throughout. The guard costs nothing and closes it.
       //
-      // ⚠️ KEYSPACE (council B1): `retried` deliberately mixes seat ids (`alias#N`) and bare
-      // aliases as keys, because only one of five emitter arms supplies a seat id. That is a
-      // real collision surface and a KNOWN one — src/council/seats.js:236 already records that
-      // a literal alias containing '#' collides with a minted #N id, and preflightSeats refuses
-      // exactly that shape. This map inherits that guarantee rather than re-deriving it; if
-      // preflightSeats ever stops refusing it, this lookup becomes ambiguous.
+      // ⚠️ KEYSPACE (council B1): `retried` deliberately mixes seat ids (`alias#N`) and bare aliases
+      // as keys — every emitter arm supplies a seat id since v4.9 W9 P1, but a slot the producer
+      // could NOT identify still emits null and falls back to the alias. That is a real collision
+      // surface and a KNOWN one — src/council/seats.js:236 already records that a literal alias
+      // containing '#' collides with a minted #N id, and preflightSeats refuses exactly that shape.
+      // This map inherits that guarantee rather than re-deriving it; if preflightSeats ever stops
+      // refusing it, this lookup becomes ambiguous.
       var isRetried = isReviewingRole(s.role)
         && !!((s.seat && retried[s.seat]) || retried[s.model]);
       if (isRetried) {
@@ -201,13 +217,12 @@
   }
 
   /**
-   * Paints the dead-seat rows appended after live rows. Deliberately NOT
-   * folded into workspace-render.js's renderSeats (293/300 — must not grow)
-   * and NOT run through its keyed diff: dead rows carry no per-tick-changing
-   * field, so a full rebuild every call is correct and cheap, and renderSeats
-   * just above already self-cleans any PRIOR dead row as an unrecognized
-   * `data-key` (its own seen-set only knows about the live `seats` it was
-   * just given), so nothing here needs to track dead rows across calls.
+   * Paints the dead-seat rows appended after live rows. Deliberately NOT folded into
+   * workspace-render.js's renderSeats (293/300 — must not grow) and NOT run through its keyed
+   * diff: dead rows carry no per-tick-changing field, so a full rebuild every call is correct
+   * and cheap, and renderSeats just above already self-cleans any PRIOR dead row as an
+   * unrecognized `data-key` (its own seen-set only knows about the live `seats` it was just
+   * given), so nothing here needs to track dead rows across calls.
    *
    * Cells route through window.AmicusLive.seatCells(...) — the SAME function
    * live rows use — so name masking (and every other column's blank/em-dash
@@ -264,7 +279,8 @@
     var A = window.AmicusApp;
     var d = A.state.detail;
     var seatLoss = d && d.verdict ? d.verdict.seatLoss : null;
-    var runMeta = { critic: (d && d.run && d.run.critic) || null };
+    var runMeta = { critic: (d && d.run && d.run.critic) || null,
+      criticSeat: (d && d.run && d.run.criticSeat) || null };
     // Source-selection (v4.6.3 PR2, spec D4), live-path twin of renderSeatsPanel's fallback
     // above: the tick's own live.degrades wins when non-empty; state.detail.verdict.degrades is
     // usually absent mid-run (verdict.json doesn't exist until the run finishes) — fine, this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.8.0",
+  "version": "4.9.0",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
@@ -63,6 +63,7 @@
     "models:info": "node bin/amicus.js models",
     "models:check": "node bin/amicus.js models --check",
     "models:check:strict": "node bin/amicus.js models --check --strict",
+    "check:ci-alias-pins": "node scripts/check-ci-alias-pins.js",
     "generate-icon": "node scripts/generate-icon.js",
     "generate-docs": "node scripts/generate-docs.js",
     "generate-docs:check": "node scripts/generate-docs.js --check",

package/schemas/council-run.schema.json

@@ -103,13 +103,13 @@
       }
     },
     "degrades": {
-      "description": "v4.6 Plan 1: every degrade/heal the sink announced — additive, written by run-degrade.js.",
+      "description": "v4.6 Plan 1: every degrade/heal the sink announced — additive, written by run-degrade.js. v4.9 widened kind with 'info': an announcement that is neither a loss nor a recovery (e.g. a task run's ledger-skipped note) — recorded here but never flipping the run degraded.",
       "type": "array",
       "items": {
         "type": "object",
         "required": ["kind", "channel", "what", "why", "effect"],
         "properties": {
-          "kind": { "enum": ["degrade", "heal"] },
+          "kind": { "enum": ["degrade", "heal", "info"] },
           "channel": { "type": "string" },
           "what": { "type": "string" },
           "why": { "type": "string" },

package/schemas/council-tally.schema.json

@@ -21,6 +21,10 @@
         "seats": {
           "type": "array",
           "description": "v4.8, optional. The run's seat table, one {id, alias, role, lens, position} entry per BENCH seat in bench order, echoed verbatim from the tally input. The engine emits it only when the bench repeats an alias — the one case where the `alias#N` ids on findings[].raiserSeat, adjudications[].seat and runStats[].seat resolve to nothing else in the document, since meta.models is the ALIAS list. Bench-only: 'claude' is never a seat, so meta.models.length need not equal seats.length and the two must never be joined positionally. ABSENCE DOES NOT MEAN the bench had no repeated alias — hand-assembled and MCP-assembled input reaches tally() with no seat machinery behind it; it means only that no seat table is available. `items` is deliberately unconstrained: consumers must tolerate a table that is not an array of seat objects (the report and Workspace renderers fall back to alias space whole rather than failing), and the MCP input schema accepts the same latitude."
+        },
+        "intent": {
+          "enum": ["review", "task"],
+          "description": "v4.9, optional. The run's intent. The engine emits it only when 'task' — a review run's meta never materializes the key, keeping every review artifact byte-identical — but an explicit 'review' from hand-assembled input is accepted."
         }
       }
     },
@@ -96,7 +100,19 @@
         }
       }
     },
-    "runStats": { "type": "array", "items": { "type": "object" } },
+    "runStats": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "ttftMs": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "v4.9 W13, optional. Time-to-first-token for this row's leg: milliseconds from the leg asking OpenCode for output to the first poll carrying substantive activity (output, reasoning, a tool call, a tool result, or a tool call reaching a terminal status) — the very same predicate the no-output backstop disarms on, read at the one site in src/headless.js's poll loop, so the two can never drift. EMIT-WHEN-SET: absent means no substantive tick was ever OBSERVED, which is NOT the same as `0` (a first token inside the first poll, a real value that must survive) and NOT the same as `null`. KNOWN BIAS, stated so the C2 derivation reads the sample correctly: (a) the stamp is taken at poll time, not token time, so every value is an UPPER BOUND carrying up to one poll interval of slack; (b) absence is still not proof the model produced nothing — the activity block now runs ABOVE all four completion gates (so a leg that first produced output and finished inside one poll IS measured), but a leg ended by an external abort, by a consecutive-poll-failure bail, by --timeout expiry during the final sleep, or by the pre-send backstop ends without any poll observing what it may already have served; (c) PR #207 round 3 adds one more cause of absence — a reading taken across a BACKWARD wall-clock jump is negative (the probe is a Date.now() delta), and every producer DROPS such a reading rather than clamping it to 0, because a clamp would publish 'first token inside the first poll' — the single most consequential value in this distribution — for a leg that measured nothing of the kind. PROBE ONLY at v4.9 W13 (ruling R12, probe first / derive later): nothing in the engine derives a backstop, threshold, or routing decision from it. No `additionalProperties: false` on this row means additive fields were always accepted here — this documents the shape rather than changing what is accepted, exactly as streetCred[].seat above does."
+          }
+        }
+      }
+    },
     "tierCounts": {
       "type": "object",
       "required": ["Confirmed", "Contested", "Singleton", "Disputed"],

package/schemas/council-verdict.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://raw.githubusercontent.com/BourbonDog/amicus/main/schemas/council-verdict.schema.json",
   "title": "amicus council-verdict document",
-  "description": "Verdict record (`council verdict --json`, amicus_verdict, verdict.json). overallVerdict is the chair's parsed VERDICT line — null in every Stage-4 manual path, populated by the headless engine.",
+  "description": "Verdict record (`council verdict --json`, amicus_verdict, verdict.json). overallVerdict is the chair's parsed terminal line — the VERDICT line on a review run, the ANSWER line on a task run (v4.9 W7) — null in every Stage-4 manual path, populated by the headless engine.",
   "type": "object",
   "required": [
     "schemaVersion",
@@ -56,13 +56,21 @@
     "claudeInCouncil": {
       "type": "boolean"
     },
+    "intent": {
+      "enum": ["review", "task"],
+      "description": "v4.9, optional. The run's intent, forwarded from the tally record's meta.intent. The engine emits it only when 'task' — a review verdict never materializes the key, keeping review-run verdict.json byte-identical — but an explicit 'review' from hand-assembled input is accepted."
+    },
     "overallVerdict": {
+      "description": "v4.9 W7: the chair's parsed terminal line on EITHER scale — a review run's VERDICT phrase ('Ship it' | 'Fix these first' | 'Fundamental rethink') or a task run's ANSWER phrase ('Converged' | 'Split' | 'Insufficient'). The two scales are disjoint by construction, so the value alone identifies the intent; `intent` above states it explicitly on task runs.",
       "oneOf": [
         {
           "enum": [
             "Ship it",
             "Fix these first",
-            "Fundamental rethink"
+            "Fundamental rethink",
+            "Converged",
+            "Split",
+            "Insufficient"
           ]
         },
         {
@@ -222,13 +230,13 @@
       ]
     },
     "degrades": {
-      "description": "v4.6 Plan 2: what this run lost — copied verbatim from the sink at verdict assembly. Additive; absent on a clean run.",
+      "description": "v4.6 Plan 2: what this run lost — copied verbatim from the sink at verdict assembly. Additive; absent when the sink recorded nothing. v4.9 widened kind with 'info': an announcement that is neither a loss nor a recovery (e.g. a task run's ledger-skipped note) — carried here without degrading the run.",
       "type": "array",
       "items": {
         "type": "object",
         "required": ["kind", "channel", "what", "why", "effect"],
         "properties": {
-          "kind": { "enum": ["degrade", "heal"] },
+          "kind": { "enum": ["degrade", "heal", "info"] },
           "channel": { "type": "string" },
           "what": { "type": "string" },
           "why": { "type": "string" },

package/schemas/run.schema.json

@@ -23,6 +23,11 @@
     "opencodeSessionId": { "type": ["string", "null"] },
     "usage": { "type": ["object", "null"] },
     "pack": { "type": "object" },
-    "tag": { "type": "string" }
+    "tag": { "type": "string" },
+    "ttftMs": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "v4.9 W13, optional. Time-to-first-token for this leg: milliseconds from the leg asking OpenCode for output to the first poll carrying substantive activity — the same predicate the no-output backstop disarms on. EMIT-WHEN-SET, like `pack` and `tag` above and unlike `opencodeSessionId`/`durationMs`: absent means no substantive tick was OBSERVED, which is neither `0` (a real first-token-inside-the-first-poll measurement) nor `null`. KNOWN BIAS, for whoever derives from this later: the value is stamped at poll time rather than token time, so it is an UPPER BOUND carrying up to one poll interval of slack; and absence is not proof the model served nothing — a leg ended by an external abort, by a consecutive-poll-failure bail, by --timeout expiry during the final sleep, or by the pre-send backstop can have served output no poll ever observed, and (PR #207 round 3) so can a leg whose only reading was taken across a backward wall-clock jump: the probe is a Date.now() delta, so a skewed reading is negative, and every producer DROPS such a reading rather than clamping it to 0 — a clamp would publish 'first token inside the first poll' for a leg that measured nothing of the kind. PROBE ONLY at v4.9 W13 — nothing derives from it yet."
+    }
   }
 }

package/skills/second-opinion/COUNCIL-DESIGN.md

@@ -110,7 +110,7 @@ Run as ordered phases; track as todos. **Three sequential waves of model calls**
 - Chair selection & fallback: §5.3.
 
 ### Stage 4 — Tiered decisions (peer-validated)
-- **Consensus tier** = **Confirmed** findings (≥ 2 peer agreements, agrees dominate) → offer one **bulk accept/deny** (user may name exceptions).
+- **Consensus tier** = **Confirmed** findings (≥ 2 peer agreements with agrees dominating — or a lone corroborating peer with zero disputes) → offer one **bulk accept/deny** (user may name exceptions).
 - **Judgment tier** = **Disputed** (strong peer pushback), **Contested** (live dispute), or **Singleton** (only the raiser) → present **each individually**, showing the adjudication data and which model raised/disputed it.
 - Record every decision (accepted / denied / modified / deferred).
 

package/skills/second-opinion/MANUAL-ORCHESTRATION.md

@@ -228,7 +228,7 @@ Instruct the chair to write a **synthesized verdict** that:
 - Distinguishes findings the bench broadly endorsed from contested or singleton claims
 - Arrives at an overall assessment of the artifact
 
-**Chair verdict scale (optional element, when ON):** append the addendum from `SEAT-BRIEFS.md § Chair verdict-scale addendum` to the chair packet — the chair must close with 3–5 **hard questions** the artifact's author probably hasn't asked themselves, then a final parseable line: `VERDICT: Ship it | Fix these first | Fundamental rethink`. Surface that line verbatim at the top of `report.md` and in the inline chat presentation. When debate mode is also ON, the chair packet is built from the *final* (post-rebuttal) tally and includes the defense/re-vote outcomes.
+**Chair closing scale (standard since v4.9 — not an opt-in element):** append the addendum from `SEAT-BRIEFS.md § Chair closing-scale addendum` to the chair packet — the chair must close with 3–5 **hard questions** the artifact's author probably hasn't asked themselves, then a final parseable line: `VERDICT: Ship it | Fix these first | Fundamental rethink`. (On a task-intent run, use that section's ANSWER twin instead — `ANSWER: Converged | Split | Insufficient` — and never translate one scale into the other.) Surface that line verbatim at the top of `report.md` and in the inline chat presentation. When debate mode is also ON, the chair packet is built from the *final* (post-rebuttal) tally and includes the defense/re-vote outcomes.
 
 Save the chair's output to the run folder as `verdict.md`.
 

package/skills/second-opinion/MODEL-NOTES.md

@@ -4,10 +4,13 @@ This file is the `second-opinion` skill's evolving memory of **how to actually d
 well**. Read it before Stage 0 (council selection and launch); update it, with the user's
 approval, at the end of each run (Stage 6). Keep it tight — merge and prune rather than append.
 
-_Last updated: 2026-08-03 (per-section fold-back, both directions — the haiku "hard-404"
-re-diagnosed as a `/v1`-less `ANTHROPIC_BASE_URL`, pre-degrade-era claims re-grounded in the
-announcement contract (`degrades[]`/`seatLoss`/exit 2/one Stage-1 retry), three model sections and
-the peer-consensus≠evidence rule upstreamed from the field ledger; see changelog)._
+_Last updated: 2026-08-25 (per-section fold-back, both directions — the `NO_OUTPUT_BACKSTOP`
+mechanism, conformance-vs-content plus the credit-exhaustion attribution correction, the
+inlined-source-pack technique, and per-model calibration nuances upstreamed from the field ledger;
+the `runStats` allowlist correction adopted back into the local ledger; see changelog). Prior:
+2026-08-03 (haiku "hard-404" re-diagnosed as a `/v1`-less `ANTHROPIC_BASE_URL`, pre-degrade-era
+claims re-grounded in the announcement contract, three model sections and the peer-consensus≠
+evidence rule upstreamed)._
 
 ## Global operating rules (all models)
 - **Fast path:** `council run` applies `--agent Plan` / `--no-context` / `--summary-length
@@ -34,6 +37,28 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
 - **Read results from the JSON documents** (`--json`): a wave's `legs[].summary` / a run's
   `summary` is the model's output; `status`/`error`/`counts` are ground truth for failures. Never
   scrape stderr logs to judge success.
+- **`conformance` measures FORMAT, not content — read an `unstructured` leg before writing it
+  off.** A leg that fails to emit a parseable findings block scores zero findings in the tally even
+  when its prose review is the bench's strongest — hand-extracted, one such "zero-finding" leg has
+  tied for the best peers-only street-cred on its bench and carried the round's deepest structural
+  finding no other seat found. Open every non-`clean` `review-<seat>.md` and judge it by substance
+  before discarding it. Before blaming a model's format for a run of `unstructured`/zero-finding
+  legs, **check account credit health** — a mid-run credit exhaustion produces the same signature
+  (repair and judge legs failing together) and has been traced to billing, not model behavior. Tell:
+  a cluster of legs failing in seconds with zero tokens, especially if OpenRouter-routed seats die
+  while direct-routed seats on the same run keep working.
+- **`NO_OUTPUT_BACKSTOP` is a fixed no-first-token deadline (120s by default) — it kills slow
+  models, not just dead ones, and the once-only auto-retry cannot save them.** A model-agnostic
+  dead-man's switch arms at leg launch and disarms only on substantive activity (output growth,
+  reasoning-token growth, or a tool call); it is independent of `--timeout`, and the only override
+  is the env var `AMICUS_NO_OUTPUT_BACKSTOP_MS` — there is no CLI flag or per-model setting. The
+  retry reuses the same threshold, so a slow-but-alive model can burn its one retry for nothing and
+  still exit degraded. It fires identically on a genuinely dead route and on a live model that
+  simply thinks past 120s before its first token — **distinguish them with a solo re-run before
+  blaming the model.** Size an override from the *slowest observed leg × 2* with real headroom; a
+  merely-doubled setting has still been killed by the slowest legs seen in practice. It applies to
+  every leg in the process, so raising it loses the genuine dead-endpoint fast-fail for the whole
+  bench while it's set.
 - **Transient provider errors** (502s, connection drops): re-run the affected leg (solo
   `amicus start --json`, same briefing file) or the wave — see per-model notes for
   model-specific signals. Never present a half-finished run as an answer.
@@ -75,6 +100,15 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
   multi-file packet despite the standard preamble. Treat a many-file briefing as a long-read task:
   expect stubs, retry solo once with the identical briefing, then substitute the model — or
   pre-concatenate the packet into one file for weaker readers.
+- **For code/plan review, inline a curated source pack and forbid tools — it eliminates the
+  narrate-then-stub class outright.** Instead of pointing seats at a repo to read live, put the
+  artifact plus a line-numbered extract of exactly the cited source regions directly in the
+  briefing, each headed with its real file path, under an explicit "everything is inline; do NOT
+  use any tools or read any files" preamble. This has produced first-attempt findings from every
+  seat on a bench — including models whose documented failure mode is multi-file agentic reads —
+  and it makes citation-checking possible, since reviewers can verify line numbers against the
+  pack. Trade is a bigger briefing per seat; worth it whenever the question is "are these claims
+  true of this code?"
 - **`--agent Plan` can trigger a literal, hard "planning mode — cannot execute" refusal on some
   models** (terse, near-zero-token responses), not just the intended read-only tool restriction —
   and prompt wording alone has not fixed it; switching that model to `--agent Build` has, immediately.
@@ -106,6 +140,11 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
   own `runStats` rows too — so anything keying `runStats` by model must use an **allowlist**, not a
   judge exclusion; see `docs/council.md`'s `runStats[].role` roster (under `amicus council tally`)
   for the exact set.
+- **Budget Stage 2 at rough parity with Stage 1 on a multi-seat bench, not as a rounding error.**
+  Every judge reads the *whole* anonymized bundle, so judge input scales with `seats ×
+  review-length` while Stage-1 input is just the briefing — on a 4-seat bench the bundle is often
+  larger than the briefing itself. Rule of thumb: estimate Stage 2 ≈ Stage 1, then add the chair.
+  The old habit of treating cross-review as cheap comes from small benches with short reviews.
 - **Expect agreement inflation in Stage-2 adjudication.** The judge contract defines `agree` by
   worked example ("an 'I missed this — it's valid' counts as agree") but gives no example for
   `dispute` and no positive definition of `neutral`, while requiring a verdict on EVERY finding —
@@ -124,6 +163,11 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
     `~/.config/amicus/config.json` take precedence over the shipped routes, so a bench you picked for
     price can resolve to a Pro/preview tier and trip a low `--max-cost` (exit 1) — or quietly cost
     5-10× what you budgeted. Confirm what each seat actually resolves to before a budget bench.
+  - **`amicus models` shows what THIS machine resolves an alias to, not the shipped catalog.** It
+    merges local `config.json` overrides silently, so a CI runner or a teammate's machine — which
+    carries no user config — can seat a materially different model under the identical alias and
+    price. To know what actually ships, read the alias table in `src/utils/curated-models.js`
+    directly rather than trusting a local `amicus models` listing.
 - **The chair cannot also hold a bench seat**, so a bench built from budget aliases cannot chair
   itself with one of them — pick the chair from *outside* the bench list.
 - **Stage-6 approvals:** write the proposed MODEL-NOTES diff to a run-folder file and put that path
@@ -199,6 +243,12 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
 - **Asserts context-dependent facts (dates, "is this future?") without verifying** — and self-confirms them in adjudication. Cross-check any time-dependent claim it raises.
 - A good calibration anchor in cross-review: confirms observational findings, disputes interpretive overreach. A repeatable role: the seat most likely to catch **confidence inflation** in an otherwise-correct argument (theoretical risk asserted as demonstrated mechanism, proxies used as pseudo-diagnostics).
 - **When gpt disputes a specific numeric claim, weight that dispute heavily before a debate round erodes it** — it has been right and then talked out of the objection by a persuasive rebuttal (see the peer-consensus rule).
+- **On long, dense, code-heavy artifacts it returns fast and skims — seat it for calibration, not
+  coverage, there.** Where it returns 25-32 findings on prose/resumes/business docs, on a dense
+  technical/code plan it has come in the fastest leg on the bench by a wide margin with only a
+  couple of findings against peers' 8 — both real, both confirmed, so this is shallow rather than
+  wrong; its lifetime confirm-rate held. Put a slower, deeper model on coverage and let gpt anchor
+  calibration on artifacts like this.
 
 ### Grok  (`--model grok` → via OpenRouter)
 - Very fast legs; credible judge and chair (rejected its own weak findings as chair; honest blind self-rank).
@@ -221,8 +271,15 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
 - Its specificity is also its risk: it reaches for **exhaustive quantitative claims ("every",
   "all", "none") that are directionally right and literally wrong** — and it has successfully
   DEFENDED one in a debate round against a correct dispute. Verify its universal quantifiers
-  against a primary source (see the peer-consensus rule).
-- **Very slow legs (4-8× its peers)** — it gates wave wall-clock; budget timeouts around it.
+  against a primary source (see the peer-consensus rule). It has also been observed doing the
+  opposite well: correctly scoping its own blocker-severity finding as *contingent on an unprobed
+  precondition* rather than asserting it outright — a genuine calibration improvement worth
+  crediting when it shows up.
+- **Its time-to-first-token now sits directly on the `NO_OUTPUT_BACKSTOP` cliff, not comfortably
+  under it** — observed legs have run well past the 120s default, and even a doubled 180-240s
+  override has been killed by the slowest of them. Size the override from the *slowest observed
+  leg × 2* with real headroom (see the Global `NO_OUTPUT_BACKSTOP` rule); it still gates wave
+  wall-clock either way.
 - Stalls on long agentic reads (poller "Incomplete" with only a preamble). Reserve for short-artifact work.
 
 ### Mistral  (`--model mistral` → via OpenRouter)
@@ -271,8 +328,16 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
 - Honest under pressure both ways: it refused to fabricate on repair attempts, and it has
   withdrawn a contested finding cleanly in debate. An honest refusal still costs the seat — watch
   `conformance` per seat, not just the finding count.
-
-### Qwen  (`--model qwen` → qwen3.7-max via OpenRouter; distinct from `qwen-coder`)
+- **Cheap-seat pattern across repeat use: low finding count, high calibration value.** It has
+  repeatedly been the cheapest seat on its bench while contributing fewer findings by volume than
+  peers, but its findings have skewed toward internal-consistency catches (a claim contradicted by
+  an earlier section of the same artifact) rather than raw coverage — read them for that, not for
+  volume, before discounting a low count.
+- **First use as chair was clean and notably good:** recognized when two surviving reviews had
+  split the labor rather than duplicated it and synthesized across that seam instead of flattening
+  it. A viable chair candidate alongside deepseek.
+
+### Qwen  (`--model qwen` → qwen3.8-max via OpenRouter; distinct from `qwen-coder`)
 - Very large context (1M tokens per catalog). As a red-team substitute it has produced a thorough,
   well-organized adversarial review with accurate, specific line citations and genuinely unique
   catches that verified true against the source — weight its specific, cited claims heavily.
@@ -283,8 +348,12 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
   short-artifact work: a book-length single-file read succeeded on retry with the anti-narration
   preamble, but multi-file packets have produced narration stubs twice in one run — with the
   preamble present, under both Plan and Build. It narrates rather than refuses under Plan.
+- **Inlining removes its multi-file-read failure mode entirely.** On a fully inlined briefing (no
+  agentic file reads) it has tied for most findings on the bench and ranked #2 by every judge —
+  the counterpart to the multi-file-read stalls above. Seat qwen for inlined verification-
+  scaffolding review; keep it off agentic multi-file reads.
 
-### minimax  (`--model minimax` → via OpenRouter)
+### minimax  (`--model minimax` → minimax-m2.7 via OpenRouter)
 - Fast (~2 min review legs), cheap, `clean` findings-JSON conformance on debut.
 - Took the **critic seat** brief exceptionally well: unanimously ranked #1 by its bench, full
   coverage on a ground-truth test, zero padded findings under the anti-padding rule. A strong
@@ -410,3 +479,13 @@ This section keeps only per-model **qualitative quirks** and **structural-confor
   gemini-3.1-pro), and gemini/deepseek/gpt/grok/kimi/Claude enrichments. Standing practice: each
   release cherry-picks generalizable lessons per-section (docs/publishing.md release checklist),
   never a bulk copy.
+- **2026-08-25 (fold-back, both directions)** — Folded in from the field ledger: the
+  `NO_OUTPUT_BACKSTOP` no-first-token-deadline mechanism and sizing rule; `conformance` measures
+  format not content, with the credit-exhaustion attribution correction; the `amicus models`
+  local-vs-shipped alias-resolution caveat; the inlined-source-pack technique; the Stage-2
+  cost-parity rule; kimi's backstop-cliff and contingent-precondition calibration nuance; gpt's
+  technical-artifact shallowness and qwen's inlining rehabilitation; glm's calibration-over-volume
+  and chair-debut notes; minimax's pinned route id. Adopted back into the local ledger: the v4.7
+  `runStats` allowlist correction to the spend-tracking rule (the local copy's v4.6
+  judge-exclusion description was superseded). No client/engagement material, run identifiers, or
+  dollar figures carried over.