amicus 4.8.1 → 4.9.1

package/src/headless.js

@@ -21,6 +21,13 @@ const { buildFoldMarker, trailingFoldMarkerRegex, generateFoldNonce } = require(
 // that uses this helper. See src/utils/env-num.js for why the older `||` knobs are
 // deliberately left alone.
 const { envNumber } = require('./utils/env-num');
+// v4.9 W10 (#133 piece 2): the engine's own error line for a dead session.
+const { engineErrorForSession } = require('./utils/engine-log');
+// v4.9 W10 (#133 piece 3): the standing engine version-skew record, if any.
+const { currentEngineSkew, formatSkewSuffix } = require('./utils/engine-skew');
+// v4.9 W13 Task A (PR #207 round 3, B3): the one honesty predicate every ttftMs
+// emit gate shares — see src/utils/ttft.js for why `typeof` was not it.
+const { isMeasuredTtft } = require('./utils/ttft');
 
 /**
  * Fold marker that the agent outputs when done.
@@ -158,14 +165,26 @@ function withTimeout(promise, ms, label) {
  * Task 6 (#129, #133): build the NO_OUTPUT_BACKSTOP reason string. Report
  * ONLY what the mechanism observed — a deadline passed with no substantive
  * activity (output/reasoning/tool calls) — never a cause. At the pre-send
- * firing site (runHeadless, ~:506-518) the backstop can win the race against
+ * firing site (runHeadless, where the backstop is armed just before
+ * `sendPromptAsync`) the backstop can win the race against
  * sendPromptAsync before the send ever resolves, so "the endpoint accepted
  * the request" is not even something that site observed. The previous text
  * asserted "likely a listed-but-not-serving model or a dead endpoint" — a
  * canned guess with no evidence gate — which sent 30 minutes of #133's
  * debugging at model ids and API keys while the real cause (an opencode
- * engine version skew) sat in ~/.local/share/opencode/log/opencode.log the
- * whole time.
+ * engine version skew) sat in the engine's own log the whole time.
+ *
+ * v4.9 W10 (#133 piece 2): that log is now READ. When
+ * src/utils/engine-log.js finds an ERROR line for this leg's session,
+ * `engineLogExcerpt` carries it and ` — engine log: <excerpt>` is appended
+ * AFTER the whole sentence below — so the `NO_OUTPUT_BACKSTOP:` prefix that
+ * src/sidecar/models-probe.js classifies on stays byte-stable, and on every
+ * miss path (no dir, no file, no session match, no ERROR line) the excerpt
+ * clause is absent — a standing skew still appends its own clause, see below. NOTE the path this comment used to
+ * name (a single `opencode/log/opencode.log`) was already stale when it was
+ * written: the engine now writes one timestamped file per process, and both
+ * schemes are live on real machines — engine-log.js's header records the
+ * measurement and reads both.
  *
  * `fromEnv` distinguishes two ways `ms` was decided, NOT whether
  * AMICUS_NO_OUTPUT_BACKSTOP_MS is relevant — it is relevant on both branches:
@@ -190,20 +209,54 @@ function withTimeout(promise, ms, label) {
  *     it governs (false on the probe) or omitting it (false/unhelpful on the
  *     retry) — true on both, and still points a user at the remedy.
  *
+ * v4.9 W10 (#133 piece 3): `engineSkew` adds a SECOND, independent clause —
+ * the two engine versions, when src/utils/engine-skew.js has a skew standing
+ * for THIS leg's own server (the caller reads the record by client; see the
+ * firing-site comment in runHeadless). It is
+ * deliberately NOT gated on `engineLogExcerpt`: gating it would make the
+ * reliable signal (two version strings both sides already publish) depend on
+ * the unreliable one (a log file that may be absent or rotated), and in #133
+ * the skew WAS the answer. Both clauses are append-only, so with neither the
+ * string is byte-for-byte what it was before either piece existed.
+ *
  * Kept module-scope and pure (not a closure over runHeadless locals) so it
  * can be asserted on directly in tests without driving the poll loop; the
  * `noOutputBackstopReason` closure inside runHeadless just forwards to this
- * with the per-run `noOutputBackstopMs`/`backstopFromEnv` values, so the two
- * firing sites there stay identical to what's tested here.
- * @param {{ms: number, fromEnv: boolean}} args
+ * with the per-run `noOutputBackstopMs`/`backstopFromEnv`/engine-log/skew
+ * values, so the two firing sites there stay identical to what's tested here.
+ * @param {{ms: number, fromEnv: boolean, engineLogExcerpt?: string|null,
+ *          engineSkew?: {server: string, installed: string}|null}} args
  * @returns {string}
  */
-function formatNoOutputBackstopReason({ ms, fromEnv }) {
-  return 'NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in '
+function formatNoOutputBackstopReason({ ms, fromEnv, engineLogExcerpt, engineSkew }) {
+  const observed = 'NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in '
     + `${Math.round(ms / 1000)}s — `
     + (fromEnv
       ? 'the AMICUS_NO_OUTPUT_BACKSTOP_MS window (0 disables)'
       : 'a caller-set window overriding the AMICUS_NO_OUTPUT_BACKSTOP_MS default');
+  // Append-only: absent/empty excerpt ⇒ the string above, unchanged byte for byte.
+  const quoted = engineLogExcerpt ? `${observed} — engine log: ${engineLogExcerpt}` : observed;
+  // Append-only for the same reason: no skew ⇒ formatSkewSuffix returns ''.
+  return `${quoted}${formatSkewSuffix(engineSkew)}`;
+}
+
+/**
+ * v4.9 W10 (#133 piece 2): the engine-log lookup, wrapped so it can never
+ * become the failure it reports on. The resolver is already best-effort
+ * internally; this second belt is at the CALL site because the caller is a
+ * leg's death report — the one place where an extra exception would replace a
+ * usable failure reason with a stack trace. Missing sessionId ⇒ skip entirely.
+ * @param {string|undefined} sessionId
+ * @param {object|undefined} engineLogOptions - test seam (options._engineLog)
+ * @returns {string|null}
+ */
+function engineErrorExcerptSafe(sessionId, engineLogOptions) {
+  if (!sessionId) { return null; }
+  try {
+    return engineErrorForSession(sessionId, engineLogOptions || {});
+  } catch (_e) {
+    return null;
+  }
 }
 
 /**
@@ -366,6 +419,29 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
   const { IdleWatchdog } = require('./utils/idle-watchdog');
   let watchdog;
   let uninstallSignals;
+  // v4.9 W13 Task A — THE TTFT PROBE's storage. Milliseconds from the leg
+  // asking for output (`outputClockStartedAt` below — the backstop's OWN clock
+  // origin) to the first poll where `substantiveActivity` is true. `null` until
+  // then, and EMIT-WHEN-SET from there: a leg that never produced anything
+  // carries no ttftMs key on the result, on disk, or in any downstream
+  // document. `0` is a real measurement (first substantive tick inside the
+  // first poll), which is why the absence is a missing key rather than a falsy
+  // value.
+  //
+  // ⚠️ Declared HERE, beside `sessionId`/`watchdog`, and NOT inside the try
+  // below (PR #203 council round 1, finding A2). It used to live in the poll
+  // loop's scope, so it was not even in scope at the catch-all return: a leg
+  // that streamed real output and then threw discarded its own measurement.
+  // Same shape as `sessionId`, for the same reason — the outer handler is a
+  // return path like any other and must be able to report what was measured.
+  //
+  // ⚠️ PROBE ONLY — nothing derives from this number. No backstop change, no
+  // threshold, no per-model window. W13 ruling R12 is explicitly "probe first,
+  // derive later": the C2 derivation (per-model backstops from evidence) waits
+  // for real field observations, which cannot exist until this ships. Do not
+  // wire it into a decision without that evidence — and read the RESIDUAL
+  // CENSORING note on the stamp site in the poll loop before you do.
+  let ttftMs = null;
 
   try {
     if (!externalServer) {
@@ -535,15 +611,41 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     const backstopFromEnv = !Number.isFinite(options.noOutputBackstopMs);
     const noOutputBackstopMs = backstopFromEnv
       ? resolveNoOutputBackstopMs(options._env) : options.noOutputBackstopMs;
-    const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: Date.now() });
+    // v4.9 W13 Task A: ONE clock origin, captured once and shared with the
+    // backstop instead of a second `Date.now()`. `startedAt` here already means
+    // "time since the leg asked for output" (see the block comment above), so
+    // the TTFT probe below measures from exactly the instant the backstop
+    // starts counting — the two can never disagree about when the wait began.
+    const outputClockStartedAt = Date.now();
+    const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: outputClockStartedAt });
     let backstopFired = false;
     // Single source for the reason string so the pre-send firing site below and
     // the per-poll firing site further down (still ticking the SAME instance)
     // can never drift apart. Forwards to the module-scope, pure
     // formatNoOutputBackstopReason (below/exported) so tests can assert on the
     // string shape directly without driving the whole poll loop.
+    //
+    // v4.9 W10 (#133 piece 2): the engine-log excerpt is resolved HERE, in the
+    // one shared closure, rather than separately at each firing site — the
+    // enrichment then reaches BOTH sites by construction, which is the same
+    // no-drift argument that put the reason string here in the first place.
+    // Resolved at CALL time (not once when this closure is defined) so the
+    // engine has already written the line by the time we read it, and so the
+    // read never happens on a leg that lives.
+    //
+    // v4.9 W10 (#133 piece 3): the skew record is read at call time for the
+    // same reason — `createSession` above is what puts it there, and on the
+    // shared-server path a sibling leg on THIS server may have been the one to
+    // see it. Asked for by `client`, so what comes back is THIS leg's own
+    // server's standing record and never a stranger's (W10 round-1 review A3):
+    // the record is per server and refreshed on every create, so a skew that
+    // was fixed mid-run, or one that belongs to another server this process
+    // also talks to, cannot ride out on this death report. The read is a Map
+    // lookup and does no I/O, so unlike the log read it needs no guard.
     const noOutputBackstopReason = () => formatNoOutputBackstopReason({
       ms: noOutputBackstopMs, fromEnv: backstopFromEnv,
+      engineLogExcerpt: engineErrorExcerptSafe(sessionId, options._engineLog),
+      engineSkew: currentEngineSkew(client),
     });
 
     // Send prompt asynchronously (returns immediately, we poll for results) —
@@ -638,6 +740,8 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     let lastMessageCount = 0;
     let lastReasoningLength = 0; // B53: track reasoning-output growth to detect thinking
     let lastProgressAt = Date.now(); // B53: last poll where `progressed` was true
+    // v4.9 W13 Task A: `ttftMs` itself is declared at function scope (see the
+    // block comment beside `sessionId`) so the catch-all return can carry it.
     let toolStalled = false; // B53: distinct from completed/timedOut/aborted — see resolveTerminalState
     let lastSettledToolCount = 0; // B4: tool calls observed reaching a terminal status
 
@@ -774,6 +878,133 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
           elapsed: Date.now() - startTime
         });
 
+        // ---- per-poll activity, read ONCE, ABOVE every completion gate --------
+        // Activity-aware idle detection: ANY of text growth, a new tool call, a new
+        // tool result, a new message, a new assistant message id, or reasoning-output
+        // growth counts as progress. Only count toward completion when NOTHING changed
+        // (genuine idle).
+        //
+        // ⚠️ POSITION IS LOAD-BEARING (v4.9 W13, PR #203 council round 1, findings
+        // A1+B1). This block used to sit BELOW the four completion gates that
+        // follow — fold-marker, boundary-provider-error, error-with-no-output and
+        // sdk-idle — every one of which `break`s. A leg whose first substantive
+        // output and whose completion landed in the SAME poll therefore never
+        // reached the TTFT stamp, and those are exactly the FAST legs, so the
+        // censoring truncated the left tail rather than sampling at random.
+        // Hoisting is value-preserving, and the AUDIT that says so is below rather
+        // than an appeal to construction (PR #207 round 4, B2 — the earlier wording
+        // here claimed "every `last*` tracker is written only here" and "nothing
+        // reads them after the loop", and BOTH are false as written, because
+        // `lastAssistantMsgId` is a `last*` tracker this block never writes).
+        // MEASURED, every reader in this file:
+        //   · `mirror` changes only at the `mirrorMessages` call above, so every
+        //     delta below reads the same numbers it read at the old site.
+        //   · This block WRITES exactly seven trackers — output length, tool-call
+        //     count, tool-result count, message count, reasoning length, settled-
+        //     tool count and `lastProgressAt`. Outside this block those seven have
+        //     exactly ONE reader in the whole file: `lastProgressAt`, in the B53
+        //     tool-stall gate further down. That gate sat below the block's OLD
+        //     position too, so their order is unchanged. None of the seven is read
+        //     after the loop.
+        //   · `lastAssistantMsgId` is READ here (`newAssistant`) and written where
+        //     it always was, at the BOTTOM of the loop below every gate — so the
+        //     comparison still runs against the previous poll's id, and the one
+        //     post-loop `last*` reader (`hasAssistantMsg` on the timeout result)
+        //     reads a tracker this block does not touch.
+        // The only behaviour change is that a poll which BREAKS now advances those
+        // seven first, and nothing observes them afterwards.
+        // Hoisting the whole block (rather than adding a second stamp beside each
+        // gate) is what keeps ONE definition of the predicate and ONE stamp site.
+        const outputGrew = mirror.output.length > lastOutputLength;
+        lastOutputLength = mirror.output.length;
+        const toolActivity = mirror.toolCalls.length > lastToolCallCount;
+        lastToolCallCount = mirror.toolCalls.length;
+        const resultActivity = mirror.seenToolResultIds.size > lastToolResultCount;
+        lastToolResultCount = mirror.seenToolResultIds.size;
+        const messageActivity = messageCount > lastMessageCount;
+        lastMessageCount = messageCount;
+        const newAssistant = currentAssistantMsgId !== lastAssistantMsgId;
+        // B53: an interleaved-thinking model with a pending tool call can stream ONLY
+        // reasoning deltas for minutes with no text/tool/result/message growth — mirror
+        // the F6d treatment in conversation-mirror.js (reasoning growth = activity) so
+        // the stall clock resets instead of falsely firing "Tool call stalled".
+        const reasoningActivity = mirror.reasoningOutput.length > lastReasoningLength;
+        lastReasoningLength = mirror.reasoningOutput.length;
+        // v4.4 B4: a tool call REACHING a terminal status is real activity. Before
+        // the shape fix this could never be observed (pending never cleared), so a
+        // multi-tool leg's stall clock only reset on text growth.
+        const settleActivity = mirror.settledToolCallIds.size > lastSettledToolCount;
+        lastSettledToolCount = mirror.settledToolCallIds.size;
+
+        const progressed = outputGrew || toolActivity || resultActivity || messageActivity
+          || newAssistant || reasoningActivity || settleActivity;
+        if (progressed) { lastProgressAt = Date.now(); }
+
+        // v4.6.2 PR2 amendment 2 (controller live smoke + debug trace): the
+        // backstop disarms only on SUBSTANTIVE activity — output, reasoning,
+        // or tool motion (the spec's "first token/reasoning/tool_use").
+        // messageActivity/newAssistant are excluded: OpenCode creates an empty
+        // assistant placeholder on prompt ACCEPTANCE, which is precisely the
+        // accepted-but-not-serving bookkeeping the backstop must not trust.
+        // `progressed` itself (and every stall/idle consumer of it above) is
+        // deliberately untouched — this is the narrower signal.
+        //
+        // v4.9 W13 Task A: it now has TWO readers — the TTFT probe on the next
+        // line and the backstop tick further down — which is why it stopped
+        // being described as "backstop-only". They read the SAME const on
+        // purpose: "the time to first token" and "the moment the backstop
+        // disarms" are the same instant BY CONSTRUCTION, and a second definition
+        // of the predicate is exactly how those two would silently drift apart.
+        const substantiveActivity = outputGrew || toolActivity || resultActivity
+          || reasoningActivity || settleActivity;
+
+        // v4.9 W13 Task A — THE TTFT STAMP. One shot, never re-armed, reading
+        // the same `substantiveActivity` const the backstop is ticked with
+        // below. Keyed on `progressed` it would report a first-token time for
+        // OpenCode's empty acceptance placeholder — the exact lie the
+        // amendment-2 narrowing of `substantiveActivity` removed from the backstop.
+        //
+        // ⚠️ RESIDUAL CENSORING — READ THIS BEFORE DERIVING ANYTHING (the C2
+        // derivation must know the bias; PR #203 round 1, B1). With the hoist
+        // above, every leg whose activity is OBSERVED by a poll is measured.
+        // What is still unmeasurable, and therefore what an ABSENT ttftMs can
+        // mean besides "served nothing":
+        //   1. Externally aborted legs. The metadata `status: 'aborted'` check
+        //      runs at the TOP of the poll body, before `getMessages`, and
+        //      breaks — so anything served since the previous poll is never
+        //      mirrored.
+        //   2. Poll-failure bail. `getMessages` failing
+        //      `maxConsecutivePollFailures` times in a row ends the leg with
+        //      whatever the last SUCCESSFUL poll saw.
+        //   3. `--timeout` expiry between polls: the while-condition ends the
+        //      loop, so output that arrived during the final sleep is unseen.
+        //   4. The pre-send backstop path, which skips the poll loop entirely —
+        //      a model that began streaming while `sendPromptAsync` hung is
+        //      never polled at all.
+        //   5. A backward wall-clock jump before the first substantive poll
+        //      (PR #207 round 3, B3). The reading is taken but is not a
+        //      measurement, so the emit gates drop it — see the ruling below.
+        // And the value itself is QUANTIZED UPWARD: it is stamped at poll time,
+        // not at token time, so every measurement is an upper bound carrying up
+        // to one `pollIntervalMs` (plus the getMessages round-trip) of slack.
+        // Nothing extra is recorded for the censored cases on purpose — there is
+        // no honest number to record, and a sentinel would be read as data.
+        //
+        // ⚠️ CLOCK-SKEW RULING (PR #207 round 3, B3). This is a wall-clock
+        // delta, not a monotonic one, so a backward jump between
+        // `outputClockStartedAt` and this poll — NTP correction, a VM resuming
+        // from suspend, a manual clock set — measures NEGATIVE. Such a reading
+        // is DROPPED at the emit gates (`isMeasuredTtft`), never clamped:
+        // clamping to `0` would publish "first token inside the first poll",
+        // the most consequential value in the distribution the C2 derivation
+        // will read, for a leg that measured nothing of the kind.
+        //
+        // The stamp stays one-shot and unguarded ON PURPOSE. Re-arming after a
+        // skewed reading would let a LATER poll stamp a delta against the same
+        // displaced origin: a bigger number, equally wrong, and no longer even
+        // the first token. One decision point (the gate) beats two.
+        if (ttftMs === null && substantiveActivity) { ttftMs = Date.now() - outputClockStartedAt; }
+
         // Check for the completion marker as the FINAL non-empty line, carrying
         // THIS run's nonce (#BL-7 + 15b.3). Models may emit a bare or wrong-nonce
         // marker on its own line mid-output (echoing a prior sidecar, these
@@ -830,46 +1061,6 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
           }
         }
 
-        // Activity-aware idle detection: ANY of text growth, a new tool call, a new
-        // tool result, a new message, a new assistant message id, or reasoning-output
-        // growth counts as progress. Only count toward completion when NOTHING changed
-        // (genuine idle).
-        const outputGrew = mirror.output.length > lastOutputLength;
-        lastOutputLength = mirror.output.length;
-        const toolActivity = mirror.toolCalls.length > lastToolCallCount;
-        lastToolCallCount = mirror.toolCalls.length;
-        const resultActivity = mirror.seenToolResultIds.size > lastToolResultCount;
-        lastToolResultCount = mirror.seenToolResultIds.size;
-        const messageActivity = messageCount > lastMessageCount;
-        lastMessageCount = messageCount;
-        const newAssistant = currentAssistantMsgId !== lastAssistantMsgId;
-        // B53: an interleaved-thinking model with a pending tool call can stream ONLY
-        // reasoning deltas for minutes with no text/tool/result/message growth — mirror
-        // the F6d treatment in conversation-mirror.js (reasoning growth = activity) so
-        // the stall clock resets instead of falsely firing "Tool call stalled".
-        const reasoningActivity = mirror.reasoningOutput.length > lastReasoningLength;
-        lastReasoningLength = mirror.reasoningOutput.length;
-        // v4.4 B4: a tool call REACHING a terminal status is real activity. Before
-        // the shape fix this could never be observed (pending never cleared), so a
-        // multi-tool leg's stall clock only reset on text growth.
-        const settleActivity = mirror.settledToolCallIds.size > lastSettledToolCount;
-        lastSettledToolCount = mirror.settledToolCallIds.size;
-
-        const progressed = outputGrew || toolActivity || resultActivity || messageActivity
-          || newAssistant || reasoningActivity || settleActivity;
-        if (progressed) { lastProgressAt = Date.now(); }
-
-        // v4.6.2 PR2 amendment 2 (controller live smoke + debug trace): the
-        // backstop disarms only on SUBSTANTIVE activity — output, reasoning,
-        // or tool motion (the spec's "first token/reasoning/tool_use").
-        // messageActivity/newAssistant are excluded: OpenCode creates an empty
-        // assistant placeholder on prompt ACCEPTANCE, which is precisely the
-        // accepted-but-not-serving bookkeeping the backstop must not trust.
-        // `progressed` itself (and every stall/idle consumer of it above) is
-        // deliberately untouched — this is a narrower, backstop-only signal.
-        const substantiveActivity = outputGrew || toolActivity || resultActivity
-          || reasoningActivity || settleActivity;
-
         // No-output backstop: one tick per poll. Fired is terminal — break the
         // loop; the post-loop block below mirrors the timeout path.
         if (noOutputBackstop.tick(substantiveActivity, Date.now()) === 'fired') {
@@ -1309,6 +1500,12 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
         // #133 P1: sessionId was assigned at :413/:417, well before this
         // return — guaranteed set here, same as `taskId` above.
         opencodeSessionId: sessionId,
+        // v4.9 W13 Task A: emit-when-set. This return is reached by legs that
+        // failed with no USABLE output, which is not the same as no output at
+        // all — a leg that streamed reasoning and then errored has a real ttft
+        // and must keep it. (PR #207 round 3, B3: emit-when-VALID too — see the
+        // clock-skew ruling at the stamp site above.)
+        ...(isMeasuredTtft(ttftMs) ? { ttftMs } : {}),
         error: sessionError
       };
     }
@@ -1326,6 +1523,8 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       ...subtreeResult,
       // #133 P1: see the comment on the sibling return above — guaranteed set.
       opencodeSessionId: sessionId,
+      // v4.9 W13 Task A: emit-when-set — see the sibling return above.
+      ...(isMeasuredTtft(ttftMs) ? { ttftMs } : {}),
       exitCode: 0
     };
 
@@ -1410,6 +1609,14 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       // outcomes explicit and already schema-shaped (run.schema.json:23
       // wants string|null, never undefined).
       opencodeSessionId: sessionId || null,
+      // v4.9 W13 Task A (PR #203 round 1, A2): emit-when-set, the SAME rule as
+      // the two returns in the try body. An exception is not evidence that
+      // nothing was served — a leg can stream a first token and explode in the
+      // post-loop finalization (`server.close()` is the one unguarded await on
+      // that path), and throwing away a measurement it already made would be a
+      // second, silent loss on top of the first. Nothing is invented: a leg
+      // that exploded before any poll observed activity still carries no key.
+      ...(isMeasuredTtft(ttftMs) ? { ttftMs } : {}),
       error: error.message
     };
   }

package/src/mcp-council-bench.js

@@ -3,8 +3,10 @@
 
 /**
  * @module mcp-council-bench
- * Bench resolution for `amicus_council_run` (models XOR council preset). Split
- * out of mcp-council-run.js (v4.6 Plan 4 Task 4b): that file sat at 298/300
+ * Bench resolution for `amicus_council_run` (models XOR council preset), plus
+ * the MCP transport's alias-shadow notice site (`auditBenchAliases`, PR #207
+ * round 2 A1 — the mirror of what cli-council-run-bench.js owns for the CLI).
+ * Split out of mcp-council-run.js (v4.6 Plan 4 Task 4b): that file sat at 298/300
  * lines and the --dropped-members producer (the MCP→child transport-parity
  * fix) needed the room. `resolveBenchInput` is self-contained — no dependency
  * on the handler's validation/spawn-argv logic — so it moves verbatim to its
@@ -46,4 +48,63 @@ function resolveBenchInput(input) {
   return { bench: inputModels, presetName: null, droppedMembers: [] };
 }
 
-module.exports = { resolveBenchInput };
+/**
+ * THE MCP-SIDE alias-shadow notice site (PR #207 council round 2, finding A1).
+ *
+ * The CLI's twin lives in `cli-council-run-bench.js :: resolveBench`; each
+ * transport's bench module owns its own audit site, and both call the shared
+ * `auditAliasShadows` entry point and nothing else.
+ *
+ * ⚠️ WHY A SECOND SITE AT ALL. Round 1 (finding A4) measured that the CLI seam
+ * EXECUTES on the MCP path — `mcp-council-run.js` always spawns the child with
+ * an expanded `--models` — but SURFACES nothing there: `spawnSidecarProcess`
+ * gives the child `stdio: ['ignore','ignore',<fd>]` on `<runDir>/debug.log`, so
+ * its stderr is a file the client never reads. This site writes into the tool
+ * result instead, so the MCP caller actually sees it. The two copies live on
+ * different surfaces (a tool-result block here; `debug.log` there), so neither
+ * surface ever double-prints.
+ *
+ * Called from the HANDLER rather than from `resolveBenchInput` above, because
+ * only the handler has the chair and the critic — and because the handler runs
+ * on every council_run call while a wiring inside `resolveBenchInput` would sit
+ * on both of its branches but still miss nothing else. Diagnosis only: this
+ * changes no id, no exit code and no artifact.
+ *
+ * ⚠️ WHERE IN THE HANDLER, and why it moved (PR #207 round 5, A1). The call used
+ * to sit beside the bench validation, ABOVE the critic+lenses mutual exclusion,
+ * the lens-count mismatch and every later rejection. `notices` is only ever read
+ * at the very end, when the tool result is assembled, so each of those
+ * rejections computed an audit — reading the user's `config.json` off disk,
+ * comparing two alias tables, formatting lines — and then discarded every line
+ * with the rest of the result. Dead work, and it contradicted the CLI's "a
+ * rejected bench is silent by construction" as well as the suite's own
+ * rejected-run control (which passed only because it exercised the ONE rejection
+ * that returns before the audit).
+ *
+ * So the site is now immediately after the spawn succeeds — the first point from
+ * which the handler is guaranteed to return the success content. Everything left
+ * below it is best-effort (the pid write, the notify request, auto-open), and
+ * none of it can return early. "Never computed on a rejected call" is therefore
+ * structural rather than a property of which rejections happen to sit above it,
+ * which is what the previous placement got wrong.
+ *
+ * ⚠️ AND THE LINE IS RE-SHAPED FOR THIS SURFACE (PR #207 round 5, D3).
+ * `formatAliasShadow` terminates every notice with `\n`, because both of its
+ * stream writers need it to make the text a line. An MCP content block is not a
+ * stream: its sibling notices (`pack-resolve.js`) carry no trailing newline, so
+ * an un-trimmed alias-shadow block rendered with a stray blank line after it.
+ * The trim lives HERE, at the one writer whose sink is not a stream, rather than
+ * in `formatAliasShadow` — the newline is correct for the CLI and `models
+ * --check`, and the round-4 sanitizing pins assert `endsWith('\n')` on that side.
+ * @param {string[]} bench resolved bench seats (already expanded)
+ * @param {string} chair explicit or default chair alias
+ * @param {string|null} critic critic alias, when one was named
+ * @param {string[]} notices the handler's per-call notice array (tool-result blocks)
+ */
+function auditBenchAliases(bench, chair, critic, notices) {
+  require('./utils/alias-shadow').auditAliasShadows(
+    [...bench, chair, ...(critic ? [critic] : [])],
+    (line) => notices.push(String(line).trimEnd()));
+}
+
+module.exports = { resolveBenchInput, auditBenchAliases };

package/src/mcp-council-run.js

@@ -19,7 +19,7 @@ const { isPathInside } = require('./project-root-allowlist');
 const { validateOnComplete, requestMcpNotify } = require('./mcp-notify');
 // v4.6 Plan 4 Task 4b: resolveBenchInput moved to its own leaf (size gate) —
 // see mcp-council-bench.js's module docblock for why.
-const { resolveBenchInput } = require('./mcp-council-bench');
+const { resolveBenchInput, auditBenchAliases } = require('./mcp-council-bench');
 
 function textResult(text, isError) {
   const result = { content: [{ type: 'text', text }] };
@@ -58,7 +58,7 @@ async function handleCouncilRunTool(input, project, helpers) {
   // for any caller that bypasses schema validation).
   const oc = validateOnComplete(input.onComplete);
   if (!oc.ok) { return textResult(oc.error, true); }
-  const CHAIR_DEFAULT = 'deepseek';
+  const { CHAIR_DEFAULT } = require('./cli-council-run-bench'); // v4.9 W13 (PR #203 A6): one owner, not a second copy
   if (typeof input.briefingFile !== 'string' || !input.briefingFile.trim()) {
     return textResult("amicus_council_run requires 'briefingFile' (a path to the briefing).", true);
   }
@@ -204,6 +204,9 @@ async function handleCouncilRunTool(input, project, helpers) {
   // v4.7 F8 (D13): the spawned CLI child's own cli-handlers-council-run.js
   // stores the tag on the run.json seed (Task 3) — this handler only forwards.
   if (input.tag) { args.push('--tag', input.tag); }
+  // v4.9 W5.2: emit-when-'task' — 'review' (the zod-declared default spelled
+  // out) never reaches the child's argv; review-run argv stays byte-identical.
+  if (input.intent === 'task') { args.push('--intent', 'task'); }
 
   let child;
   try { child = helpers.spawnFn(args, runDir); } catch (err) {
@@ -219,6 +222,9 @@ async function handleCouncilRunTool(input, project, helpers) {
   // read-merge-write has no lock (see run-state.writeSpawnPid).
   try { if (typeof child?.pid === 'number') { runState.writeSpawnPid(runDir, child.pid); } }
   catch { /* best-effort */ }
+  // PR #207 round 2 (A1) + round 5 (A1): the alias-shadow notice's MCP surface,
+  // sited past every return that discards `notices` — rationale on its own def.
+  auditBenchAliases(bench, chair, critic, notices);
   // Task 15 (spec §5.3): the run is now known-launched under runId — mark it
   // for a best-effort terminal notify. runWait's poll loop (mcp-wait.js) is
   // the only code that later sees this council run reach terminal state.
@@ -273,7 +279,8 @@ async function handleCouncilRunTool(input, project, helpers) {
   const content = [{ type: 'text', text: fenceSidecarOutput(body) }];
   // v4.5 Task 15: pack/template notices (e.g. a bench-override) are non-fatal —
   // surfaced as extra unfenced content blocks, same precedent as
-  // mcp-server.js's routeResult.notice (amicus_start).
+  // mcp-server.js's routeResult.notice (amicus_start). PR #207 round 2 (A1)
+  // added a third producer: the alias-shadow lines from auditBenchAliases.
   for (const n of notices) { content.push({ type: 'text', text: n }); }
   return { content };
 }

package/src/mcp-server.js

@@ -390,8 +390,34 @@ const handlers = {
     // The file itself is written just before the spawn fallback below (the
     // shared-server path passes the prompt in-process and never reads args).
     const briefingPath = path.join(sessionDir, 'briefing.md');
+    // ⚠️ W1-M4 (v4.9 W12), the amicus_start half of the divergence Task 7 closed
+    // for src/mcp-server.js :: amicus_fanout — same shape, same reason.
+    // `briefing.md` and the initial `metadata.briefing` below both used to be
+    // written from the RAW `input.prompt` while the shared-server branch's own
+    // metadata write recorded the rendered text, and for a `start` row
+    // `metadata.briefing` IS the `--search` corpus
+    // (src/sidecar/list-search.js :: rowMatchesSearch falls through to
+    // `row.briefing` for anything that is not a wave or a council run). A child that dies before
+    // its own createSessionMetadata therefore left the session permanently
+    // unfindable by the text the user actually sees. So: the RENDERED text goes
+    // on disk, and the child is handed the RAW input through a sibling
+    // `briefing-input.md`, keeping its own later render byte-identical and still
+    // the provenance source for `promptMeta.template`.
+    //
+    // ⚠️ Both defaults are LOAD-BEARING: with no pack-forwarded template nothing
+    // renders, so the rendered text IS the raw prompt and childPromptPath must
+    // fall back to briefingPath — otherwise every ordinary start would spawn
+    // with `--prompt-file undefined`.
+    //
+    // Hoisted here (it was local to the shared-server branch) so ONE expression
+    // serves both paths: two copies of "rendered, else raw" is the drift that
+    // produced this defect in the first place.
+    const renderedPrompt = fwd.renderedPrompt !== undefined ? fwd.renderedPrompt : input.prompt;
+    const childPromptPath = fwd.renderedPrompt !== undefined
+      ? path.join(sessionDir, 'briefing-input.md')
+      : briefingPath;
     const detectedClient = detectClient(mcpServer);
-    const args = ['start', '--prompt-file', briefingPath, '--task-id', taskId, '--client', detectedClient];
+    const args = ['start', '--prompt-file', childPromptPath, '--task-id', taskId, '--client', detectedClient];
     // resolvedModel is always defined here — a routing failure already
     // returned above — and is the router's executableId, not the raw alias.
     args.push('--model', resolvedModel);
@@ -434,11 +460,12 @@ const handlers = {
       let sessionId;
       try {
         // v4.5 decision 1 + Wave-1 fix (I1/I2): the template was already
-        // rendered by the shared prepareForward call above — reuse its text
-        // instead of rendering again. Notices stay LOCAL (not packNotices):
-        // a fall-through to the spawn-fallback catch must never leak one.
+        // rendered by the shared prepareForward call above — this path reuses
+        // its text (`renderedPrompt`, hoisted above with the spawn fallback in
+        // W12) instead of rendering again. Notices stay LOCAL (not
+        // packNotices): a fall-through to the spawn-fallback catch must never
+        // leak one.
         const inProcessNotices = [...fwd.notices];
-        const renderedPrompt = fwd.renderedPrompt !== undefined ? fwd.renderedPrompt : input.prompt;
         // v4.7 PR6: the gate used to hang off `packForward.maxCost !== undefined`,
         // so a no-pack MCP start skipped it while the CLI (cli-handlers-run.js:90)
         // gated unconditionally with a cfg.maxCost fallback. Same guard, both doors.
@@ -660,13 +687,18 @@ const handlers = {
     }
 
     // Feature flag disabled (or shared server failed): fall back to per-process spawn.
-    // BL-1: create the session dir and write the prompt to briefing.md BEFORE the
-    // spawn so --prompt-file (built above) resolves to a real file, keeping the
-    // full prompt off the ~32KB-capped Windows command line.
+    // BL-1: create the session dir and write the prompt files BEFORE the spawn so
+    // --prompt-file (built above) resolves to a real file, keeping the full
+    // prompt off the ~32KB-capped Windows command line. W1-M4: briefing.md is
+    // the RENDERED text; the sibling briefing-input.md exists only when a pack
+    // template actually rendered something (see childPromptPath above).
     let child;
     try {
       fs.mkdirSync(sessionDir, { recursive: true, mode: 0o700 });
-      fs.writeFileSync(briefingPath, input.prompt, { mode: 0o600 });
+      fs.writeFileSync(briefingPath, renderedPrompt, { mode: 0o600 });
+      if (childPromptPath !== briefingPath) {
+        fs.writeFileSync(childPromptPath, input.prompt, { mode: 0o600 });
+      }
       child = spawnSidecarProcess(args, sessionDir);
     } catch (err) {
       return textResult(`Failed to start Amicus: ${err.message}`, true);
@@ -681,8 +713,11 @@ const handlers = {
           headless: !!input.noUi,
           // Seed briefing/mode so list/status are informative even before the
           // CLI child's createSessionMetadata overwrite (or if it crashes first).
+          // W1-M4 (see the briefing.md block above): the RENDERED text, twin of
+          // the shared-server branch's own write — this field is a start row's
+          // `--search` corpus.
           mode: input.noUi ? 'headless' : 'interactive',
-          briefing: input.prompt,
+          briefing: renderedPrompt,
           // v4.5 Task 15: additive-only — absent (not null) without a pack.
           ...(packRecord ? { pack: packRecord } : {}),
         }, null, 2), { mode: 0o600 });
@@ -1316,7 +1351,8 @@ const handlers = {
       // ⚠️ W1-M4: briefing.md is the SEARCH CORPUS — src/sidecar/list-search.js reads it verbatim
       // — and a child that aborts before fanout.js:145 never re-renders it, leaving the wave
       // permanently unfindable by the text the user actually sees. Write the RENDERED text here
-      // (parity with the amicus_start path at :441/:506) and hand the child the raw input in a
+      // (parity with src/mcp-server.js :: amicus_start, whose own `renderedPrompt` was hoisted
+      // above both of its branches in v4.9 W12 — see its W1-M4 block) and hand the child the raw input in a
       // sibling file, so its own later re-render still produces byte-identical output and
       // promptMeta.template provenance survives.
       const briefingText = fwd.renderedPrompt !== undefined ? fwd.renderedPrompt : input.prompt;
@@ -1424,7 +1460,11 @@ const handlers = {
       const record = tally(input);
       // Auto-append to the reliability ledger (parity with `amicus council
       // tally`). Best-effort: a ledger write failure must not fail the tally.
-      try { require('./council/ledger').appendRun(record); } catch { /* best-effort */ }
+      // v4.9 W5.4 gate 3: task-run records never feed it — gated on the
+      // RECORD's meta.intent (tally copies meta verbatim from the input).
+      if (!(record.meta && record.meta.intent === 'task')) {
+        try { require('./council/ledger').appendRun(record); } catch { /* best-effort */ }
+      }
       // v4.0 §8 (H9): fence the JSON — council output summarizes untrusted
       // model prose entering the orchestrating agent's context. JSON intact
       // inside the fence; CLI --json stays unfenced (the programmatic channel).