amicus 4.8.1 → 4.9.1

package/src/utils/model-fetcher.js

@@ -136,48 +136,85 @@ function fetchModelsFromProvider(provider, key) {
 }
 
 /**
- * Perform the HTTPS fetch + normalize for a single configured provider.
- * Resolves to `[]` on any non-200 response, network error, timeout, or parse error.
+ * Perform the HTTPS fetch + normalize for a single configured provider,
+ * REPORTING why it failed (issue #209). The four failure modes used to
+ * collapse to a bare `[]`, which made a rejected fetch indistinguishable from
+ * a provider that legitimately serves no models -- and that ambiguity is what
+ * lets `classifyModel` return 'unknown' for a namespace whose fetch was
+ * actually refused (see #208).
  * @param {string} provider - Key into PROVIDER_FETCH_CONFIG
  * @param {string} key - API key
- * @returns {Promise<Array>} Normalized model rows, or [] on any failure
+ * @returns {Promise<{rows: Array, failure: {reason: string, status?: number, detail?: string}|null}>}
  */
-function fetchViaConfig(provider, key) {
+function fetchViaConfigDetailed(provider, key) {
   const config = PROVIDER_FETCH_CONFIG[provider];
   const url = config.buildUrl ? config.buildUrl(key) : config.url;
   const headers = config.authHeader(key);
 
   return new Promise((resolve) => {
     let chunks = '';
+    const ok = (rows) => resolve({ rows, failure: null });
+    const fail = (failure) => resolve({ rows: [], failure });
+
     const timer = setTimeout(() => {
       req.destroy();
-      resolve([]);
+      fail({ reason: 'timeout', detail: `no response within ${FETCH_TIMEOUT_MS}ms` });
     }, FETCH_TIMEOUT_MS);
 
     const req = https.get(url, { headers }, (res) => {
       if (res.statusCode !== 200) {
         clearTimeout(timer);
         res.on('data', () => {});
-        res.on('end', () => resolve([]));
+        res.on('end', () => fail({ reason: 'http-status', status: res.statusCode }));
         return;
       }
       res.on('data', (chunk) => { chunks += chunk; });
       res.on('end', () => {
         clearTimeout(timer);
         try {
-          resolve(config.normalize(chunks));
-        } catch (_err) {
-          resolve([]);
+          ok(config.normalize(chunks));
+        } catch (err) {
+          fail({ reason: 'parse-error', detail: err.message });
         }
       });
     });
-    req.on('error', () => {
+    req.on('error', (err) => {
       clearTimeout(timer);
-      resolve([]);
+      fail({ reason: 'network-error', detail: err.message });
     });
   });
 }
 
+/**
+ * Rows-only view of `fetchViaConfigDetailed`, preserving the historical
+ * contract (`[]` on any failure) for existing callers.
+ * @param {string} provider @param {string} key @returns {Promise<Array>}
+ */
+function fetchViaConfig(provider, key) {
+  return fetchViaConfigDetailed(provider, key).then(r => r.rows);
+}
+
+/**
+ * Per-provider fetch WITH failure reporting. Mirrors
+ * `fetchModelsFromProvider`'s special cases exactly:
+ *  - anthropic without a key: the hardcoded floor, no network, NOT a failure.
+ *  - anthropic with a key that yields nothing: floor rows, failure reported.
+ *  - unknown provider: no rows, not a failure (nothing was attempted).
+ * @param {string} provider @param {string} key
+ * @returns {Promise<{rows: Array, failure: object|null}>}
+ */
+function fetchModelsFromProviderDetailed(provider, key) {
+  const floor = () => ANTHROPIC_MODELS.map(r => ({ ...r, authoritative: false }));
+  if (provider === 'anthropic') {
+    if (!key) { return Promise.resolve({ rows: floor(), failure: null }); }
+    return fetchViaConfigDetailed('anthropic', key).then(({ rows, failure }) =>
+      (rows.length > 0 ? { rows, failure: null } : { rows: floor(), failure }));
+  }
+  const config = PROVIDER_FETCH_CONFIG[provider];
+  if (!config) { return Promise.resolve({ rows: [], failure: null }); }
+  return fetchViaConfigDetailed(provider, key);
+}
+
 /** Providers to fetch: every keyed provider + openrouter (keyless-capable) + anthropic. */
 function providersToFetch(keys) {
   const set = new Set(Object.keys(keys).filter(p => keys[p]));
@@ -190,12 +227,16 @@ function providersToFetch(keys) {
  * Fetch models from all providers that have keys configured; openrouter is
  * always included (keyless public endpoint) as is anthropic (hardcoded list).
  * @param {Object<string, string>} keys - Map of provider → API key string
- * @returns {Promise<Array<{id: string, name: string, contextLength: number|null, pricing: object|null}>>} Combined model list
+ * @returns {Promise<{rows: Array, failures: Array<{provider: string, reason: string, status?: number, detail?: string}>}>}
  */
-async function fetchAllModels(keys) {
+async function fetchAllModelsDetailed(keys) {
   const providers = providersToFetch(keys);
-  const results = await Promise.all(providers.map(p => fetchModelsFromProvider(p, keys[p] || '')));
-  const rows = results.flat();
+  const results = await Promise.all(providers.map(p =>
+    fetchModelsFromProviderDetailed(p, keys[p] || '').then(r => ({ provider: p, ...r }))));
+  const rows = results.flatMap(r => r.rows);
+  const failures = results
+    .filter(r => r.failure)
+    .map(r => ({ provider: r.provider, ...r.failure }));
   // v4.2 §4.4: append local-provider rows via the scheme-aware probe (5s, [] on failure).
   try {
     const { getLocalProviders } = require('./local-providers');
@@ -205,7 +246,17 @@ async function fetchAllModels(keys) {
       listLocalModels(e, { timeoutMs: 5000, bearer: e.apiKeyEnv ? process.env[e.apiKeyEnv] : undefined })));
     for (const r of localResults) { rows.push(...r); }
   } catch (_err) { /* local rows are best-effort — never break the cloud catalog */ }
-  return rows;
+  return { rows, failures };
+}
+
+/**
+ * Rows-only view of `fetchAllModelsDetailed` — the historical signature, kept
+ * so existing callers and their tests are unaffected.
+ * @param {Object<string, string>} keys
+ * @returns {Promise<Array>} Combined model list
+ */
+async function fetchAllModels(keys) {
+  return (await fetchAllModelsDetailed(keys)).rows;
 }
 
 /**
@@ -236,6 +287,8 @@ function groupModelsByFamily(models) {
 module.exports = {
   fetchModelsFromProvider,
   fetchAllModels,
+  fetchAllModelsDetailed,
+  fetchModelsFromProviderDetailed,
   providersToFetch,
   groupModelsByFamily,
   ANTHROPIC_MODELS,

package/src/utils/model-shortlist.js

@@ -60,7 +60,8 @@ function compareShortlistRows(a, b) {
 
 /**
  * @param {string} vendor e.g. 'deepseek'
- * @param {{catalog?: Array<object>, recommendedId?: string, limit?: number}} [options]
+ * @param {{catalog?: Array<object>, recommendedId?: string, limit?: number,
+ *   providerFailures?: Array<{provider:string}>}} [options]
  * @returns {{recommendedId: (string|null), suggested: Array<object>,
  *   rest: Array<object>, total: number}}
  */
@@ -69,7 +70,9 @@ function buildModelShortlist(vendor, options = {}) {
   const limit = Number.isInteger(options.limit) && options.limit > 0
     ? options.limit : SHORTLIST_LIMIT;
 
-  const { preselectedId, rows } = buildProviderDefaultChoices(vendor, { catalog });
+  const { preselectedId, rows } = buildProviderDefaultChoices(vendor, {
+    catalog, providerFailures: options.providerFailures,
+  });
   if (!rows || rows.length === 0) {
     return { recommendedId: null, suggested: [], rest: [], total: 0 };
   }

package/src/utils/provider-default-picker.js

@@ -118,9 +118,11 @@ function chooseRowId(vendor, isDirect, row, paired, catalogInfo) {
  * @param {string} vendor
  * @returns {Array<{id:string,name:string,contextLength:(number|null),pricePerMInput:(number|null),isPreselected:boolean}>}
  */
-function buildRows(catalog, vendor) {
+function buildRows(catalog, vendor, providerFailures) {
   const byId = new Map(catalog.filter(r => r && typeof r.id === 'string').map(r => [r.id, r]));
-  const catalogInfo = { models: catalog };
+  // issue 208: providerFailures MUST ride along -- this rebuilds catalogInfo from a bare
+  // array, so dropping it leaves directFormIfSafe's namespace gate dead in production.
+  const catalogInfo = { models: catalog, providerFailures: providerFailures || [] };
   const directPrefix = `${vendor}/`;
   const orPrefix = `openrouter/${vendor}/`;
   // Hoisted: `vendor` is fixed for the whole call, so this is decided once
@@ -229,7 +231,7 @@ function buildProviderDefaultChoices(vendor, options = {}) {
   if (typeof vendor !== 'string' || !vendor) { return { preselectedId: null, rows: [] }; }
 
   const catalog = Array.isArray(options.catalog) ? options.catalog : [];
-  const rows = buildRows(catalog, vendor);
+  const rows = buildRows(catalog, vendor, options.providerFailures);
   if (rows.length === 0) { return { preselectedId: null, rows: [] }; }
 
   const preselectedId = computePreselectedId(vendor, options.tier, catalog, rows);
@@ -271,6 +273,7 @@ function buildProviderDefaultChoices(vendor, options = {}) {
  * @returns {{alias: string, setAsDefault: boolean}}
  */
 function applyProviderDefault(vendor, chosenId, { seedDefaultIfAbsent = true, catalog } = {}) {
+  // Council C4 (PR 215): NO providerFailures -- directFormIfProven strips only on POSITIVE evidence, so a failed/empty namespace ('unknown') already returns chosenId untouched.
   const catalogInfo = { models: Array.isArray(catalog) ? catalog : [] };
   const storedId = directFormIfProven(vendor, chosenId, catalogInfo);
 

package/src/utils/quick-picks.js

@@ -10,7 +10,8 @@
 
 'use strict';
 
-const { getFamilies, toDefaultAliases, toCanonicalDefault, DIVERGENT_VENDORS } = require('./curated-models');
+const { getFamilies, toDefaultAliases, DIVERGENT_VENDORS } = require('./curated-models');
+const { directFormIfSafe } = require('./model-canonicalization');
 
 const MARKER_RE = /(-preview|-exp|-beta|-latest|:free)+$/;
 
@@ -84,12 +85,20 @@ function resolveQuickPicks(catalog) {
  * @param {{vendorPath?:string, routes?:Object<string,string>}} pick
  * @returns {string|undefined}
  */
-function toStorableRoute(pick) {
+function toStorableRoute(pick, catalogInfo) {
   const routes = (pick && pick.routes) || {};
   if (pick && DIVERGENT_VENDORS.has(pick.vendorPath)) {
     return routes[pick.vendorPath] || routes.openrouter;
   }
-  return toCanonicalDefault(routes.openrouter || Object.values(routes)[0]);
+  const route = routes.openrouter || Object.values(routes)[0];
+  if (!route) { return undefined; }
+  // issue 214 remedy 1: this value is PERSISTED (sidecar/setup.js writes it into
+  // config.aliases; toLiveSeedAliases seeds a fresh config with it), so it must
+  // not be a blind prefix strip. directFormIfSafe keeps the optimism for a
+  // namespace that was never fetched while refusing for one the catalog
+  // disproves OR whose fetch was rejected -- the gap #208 closed on the picker
+  // path and left open here.
+  return directFormIfSafe(pick.vendorPath, route, catalogInfo || { models: [] });
 }
 
 /**
@@ -98,15 +107,44 @@ function toStorableRoute(pick) {
  * overlaid value is not a raw prefix strip.
  * @returns {Object<string,string>}
  */
-function toLiveSeedAliases(catalog) {
+function toLiveSeedAliases(catalogOrInfo) {
+  // Accepts the bare models array (historical callers) or a full catalogInfo.
+  // issue 214: the evidence was always handed in and then discarded.
+  const info = Array.isArray(catalogOrInfo)
+    ? { models: catalogOrInfo }
+    : (catalogOrInfo || { models: [] });
   const seeds = toDefaultAliases();
-  for (const r of resolveQuickPicks(catalog || [])) {
+  for (const r of resolveQuickPicks(info.models || [])) {
     if (r.source === 'live' && r.routes.openrouter) {
-      const stored = toStorableRoute(r);
+      const stored = toStorableRoute(r, info);
       if (stored) { seeds[r.alias] = stored; }
     }
   }
   return seeds;
 }
 
-module.exports = { compareIdsDesc, pickCurrent, resolveQuickPicks, toLiveSeedAliases, toStorableRoute };
+
+/**
+ * Per-provider SAFE storable form for a resolved quick pick (issue 214).
+ *
+ * The wizard renderer used to derive this itself, via a hand-copy of
+ * `stripGatewayPrefix` (`toBareIfDirect`) that dropped both of the real
+ * primitive's guards: it stripped `openrouter/` for DIVERGENT_VENDORS
+ * (fabricating anthropic's dot id, which the direct API rejects) and stripped
+ * for a namespace whose fetch had failed. The renderer cannot `require()`, so
+ * the decision is made here -- once, with the catalog in hand -- and shipped
+ * to the page as data.
+ * @param {{vendorPath: string, routes: Object<string,string>}} pick
+ * @param {{models: Array<{id:string}>, providerFailures?: Array<{provider:string}>}} catalogInfo
+ * @returns {Object<string,string>} provider -> safe storable id
+ */
+function canonicalRoutesFor(pick, catalogInfo) {
+  const out = {};
+  const routes = (pick && pick.routes) || {};
+  for (const [provider, route] of Object.entries(routes)) {
+    out[provider] = directFormIfSafe(pick.vendorPath, route, catalogInfo || { models: [] });
+  }
+  return out;
+}
+
+module.exports = { compareIdsDesc, canonicalRoutesFor, pickCurrent, resolveQuickPicks, toLiveSeedAliases, toStorableRoute };

package/src/utils/result-schema.js

@@ -8,6 +8,8 @@
  * split out so ./abort-result.js can depend on it without a circular require).
  */
 const { SCHEMA_VERSION } = require('./result-schema-version');
+// v4.9 W13 Task A (PR #207 round 3, B3): the shared ttftMs honesty predicate.
+const { isMeasuredTtft } = require('./ttft');
 
 /** Leg/run statuses that count as terminal for wave aggregation. */
 const TERMINAL_STATUSES = ['complete', 'error', 'timeout', 'aborted', 'crashed', 'idle-timeout'];
@@ -70,6 +72,14 @@ function buildRunResult({ taskId, metadata = {}, result = null, summary = null,
     durationMs,
     sessionDir,
     opencodeSessionId: metadata.opencodeSessionId || null,
+    // v4.9 W13 Task A (probe only, R12): time-to-first-token, sourced straight
+    // off `metadata` like `opencodeSessionId` above. ADDITIVE and emit-when-set
+    // (the pack/tag spread form below, not the `|| null` coercion above): an
+    // absent ttft means "no substantive tick was observed", which is neither
+    // zero nor null, so it must not be coerced into either. PR #207 round 3
+    // (B3): emit-when-VALID via the shared predicate — `metadata` is read off
+    // disk, so NaN/±Infinity/negatives/fractions all reach here. See ./ttft.js.
+    ...(isMeasuredTtft(metadata.ttftMs) ? { ttftMs: metadata.ttftMs } : {}),
     usage: usage !== null ? usage : (metadata.usage || null),
     ...(metadata.pack ? { pack: metadata.pack } : {}),
     ...(metadata.tag ? { tag: metadata.tag } : {}),
@@ -221,7 +231,8 @@ function buildCatalogDoc({ models, fetchedAt, refreshed = false, search = null,
  *   probeSkipped?: string|null}} opts
  */
 function buildAuditDoc({
-  stale, catalogAvailable, gatewayFindings = [], drifted = [], probe = [], probeSkipped = null
+  stale, catalogAvailable, gatewayFindings = [], drifted = [], probe = [], probeSkipped = null,
+  providerFailures = []
 }) {
   return {
     schemaVersion: SCHEMA_VERSION,
@@ -236,6 +247,11 @@ function buildAuditDoc({
     probeCount: probe.length,
     probe,
     probeSkipped,
+    // issue 209: providers ATTEMPTED and REJECTED for the catalog in hand. An
+    // empty namespace is otherwise indistinguishable from a provider that
+    // genuinely serves nothing.
+    providerFailuresCount: providerFailures.length,
+    providerFailures,
   };
 }
 

package/src/utils/text-sanitize.js

@@ -0,0 +1,81 @@
+/**
+ * @module utils/text-sanitize
+ * One third-party string, safe to render: no escapes, no bidi, one short line.
+ *
+ * EXTRACTED from src/utils/engine-log-parse.js (v4.9 W10 round 3). It was built
+ * there for the engine-log excerpt (round-2 review B2), but reviews B1+C2 put a
+ * SECOND caller on it — `utils/engine-skew.js` runs server-reported version
+ * strings through the same pass before they reach the stderr notice and the
+ * death-report clause. Leaving it in the parse module meant the skew detector
+ * had to depend on the log parser to sanitize a version number, which is a
+ * dependency edge that says nothing true about either module. Here, neither
+ * caller owns it and both just use it.
+ *
+ * `engine-log-parse.js` RE-EXPORTS both names, so every existing import path
+ * stays valid and the extraction pins can assert these are the SAME function
+ * objects rather than a second copy — the same shape as the round-2 splits.
+ *
+ * THE RULE, in one line: this is the ONLY sanitizer. A second implementation
+ * would be a second set of holes, and the holes are the point — every finding
+ * that has landed here (ANSI in round 2, bidi in round 3) was a class the
+ * previous pass could not see.
+ *
+ * PURE: no I/O, no throwing paths, no state.
+ */
+
+'use strict';
+
+/** One short line: long enough for a real engine error, short enough to ride
+ *  inside an error string that already carries the backstop's own sentence. */
+const MAX_EXCERPT_CHARS = 200;
+
+/** An ANSI escape sequence: CSI (`ESC [ … final`), OSC (`ESC ] … BEL/ST`), or a
+ *  bare two-character escape. */
+// eslint-disable-next-line no-control-regex
+const ANSI_SEQUENCE = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)?|[@-_])/g;
+/** C0 and C1 control characters, DEL included. */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHAR = /[\u0000-\u001f\u007f-\u009f]/g;
+/**
+ * Unicode BIDI controls: the embedding/override set, the isolates, the marks.
+ *
+ * Round-3 review A2. PRINTABLE-range code points, so the C0/C1 sweep above never
+ * saw them — and each reorders the characters that follow, letting a third
+ * party's error string rewrite the sentence it is quoted into (a RIGHT-TO-LEFT
+ * OVERRIDE renders the rest of the line backwards). Formatting, so DROPPED.
+ */
+const BIDI_CONTROL = /[\u202a-\u202e\u2066-\u2069\u200e\u200f\u061c]/g;
+
+/**
+ * One line, no control characters, no bidi controls, at most `maxChars`.
+ *
+ * SANITIZED, not just collapsed (round-2 review B2). This is quoted verbatim
+ * from a third party's text into output that reaches terminals and MCP
+ * surfaces; engine lines can embed provider output, colour codes and all.
+ * Escape sequences and bidi controls are DROPPED (formatting: removing them
+ * keeps `<esc>[31mred<esc>[0m` as `red`, not as spaced-out text); every
+ * remaining control byte becomes a space, which the collapse below tidies.
+ *
+ * THE CAP IS A PARAMETER because this is the house sanitizer for any
+ * third-party string we render, not only log excerpts: `utils/engine-skew.js`
+ * runs SERVER-SUPPLIED version strings through it at a shorter cap before they
+ * enter the stderr notice and the death-report clause (round-3 reviews B1+C2).
+ * One sanitizer, one dialect — a second implementation is a second set of holes.
+ * @param {*} text
+ * @param {number} [maxChars]
+ * @returns {string}
+ */
+function collapseExcerpt(text, maxChars = MAX_EXCERPT_CHARS) {
+  const oneLine = String(text === undefined || text === null ? '' : text)
+    .replace(ANSI_SEQUENCE, '')
+    .replace(BIDI_CONTROL, '')
+    .replace(CONTROL_CHAR, ' ')
+    .replace(/\s+/g, ' ').trim();
+  if (oneLine.length <= maxChars) { return oneLine; }
+  return `${oneLine.slice(0, maxChars - 1)}…`;
+}
+
+module.exports = {
+  collapseExcerpt,
+  MAX_EXCERPT_CHARS,
+};

package/src/utils/ttft.js

@@ -0,0 +1,57 @@
+/**
+ * @module utils/ttft
+ * The one honesty predicate for the time-to-first-token probe (v4.9 W13).
+ *
+ * ⚠️ The JSDoc leads this file, ahead of `'use strict'`, matching
+ * `utils/text-sanitize.js` / `utils/engine-skew.js` / `utils/alias-shadow.js`:
+ * `scripts/generate-docs.js` only reads a block comment that starts at byte
+ * zero, so a `// path` line above it would leave this module's CLAUDE.md row
+ * blank the way `utils/result-schema.js`'s already is.
+ *
+ * `ttftMs` is produced once — in `src/headless.js`'s poll loop, as a
+ * `Date.now()` delta — and then passes four EMIT GATES on its way to a
+ * document: `headless.js`'s three returns, `sidecar/fanout-leg.js`'s leg patch,
+ * `utils/result-schema.js :: buildRunResult`, and
+ * `council/run-stats-entry.js :: buildRunStatsEntry`. Every gate used to spell
+ * its own `typeof x === 'number'` test, which is four chances to disagree and
+ * four ways to publish a value both schemas forbid.
+ *
+ * ⚠️ `typeof` is not the schema's contract. `schemas/run.schema.json` and
+ * `schemas/council-tally.schema.json` both declare this field
+ * `integer, minimum 0`, and `typeof` admits four families that violate it:
+ *   · NaN — `JSON.stringify` writes it as `null`, so the artifact breaks its own
+ *     schema while LOOKING like the honest absence the emit-when-set rule means.
+ *   · ±Infinity — not hypothetical from an artifact: `JSON.parse('1e999')` is
+ *     `Infinity` (MEASURED), and it also serializes to `null`.
+ *   · Negative — the probe is a wall-clock delta, so a backward jump (NTP
+ *     correction, a VM resuming from suspend, a manual clock set) between the
+ *     clock origin and the first substantive poll measures below zero.
+ *   · Fractional — a hand-edited leg document.
+ *
+ * ⚠️ DROP, DO NOT CLAMP. A skewed −5 s reading clamped to `0` would publish
+ * "first token inside the first poll" — the most consequential value in the
+ * distribution the C2 derivation will read — for a leg that measured nothing of
+ * the kind. Emit-when-VALID is the same discipline as emit-when-set: absence
+ * already means "no honest measurement was made", and a dishonest number is
+ * exactly that. `0` itself stays a real, emittable measurement.
+ *
+ * ⚠️ Three of the four gates import this. The fourth,
+ * `council/run-stats-entry.js`, is pinned REQUIRE-FREE (P3,
+ * tests/council/run-stats-entry.test.js — the pin fires on the character
+ * sequence anywhere in that file, comments included) so require-free consumers
+ * can import it, so it spells the same expression by hand. The structural pins
+ * that keep the hand-spelled copy in step live in that same test file.
+ */
+
+'use strict';
+
+/**
+ * Is this a real time-to-first-token measurement, fit to ride a document?
+ * @param {*} value
+ * @returns {boolean} true only for a non-negative integer millisecond count.
+ */
+function isMeasuredTtft(value) {
+  return Number.isInteger(value) && value >= 0;
+}
+
+module.exports = { isMeasuredTtft };

package/src/utils/untrusted-fence.js

@@ -17,6 +17,16 @@
  * stays intact inside the fence. It must NOT be applied to CLI --json stdout
  * (the byte-parseable programmatic channel) or amicus_read mode=metadata —
  * structured data a caller parses, where wrapping would break the contract.
+ *
+ * This module ALSO hosts the OUTBOUND family's tag neutralizer
+ * (`defangOutboundFenceTags`, PR #200 tails B2/C2; close tags only until PR
+ * #206 round 3 B3b took it to open tags too). It lives here rather than
+ * beside either outbound builder because there are two of them — the council
+ * briefing tail (src/council/briefings-stage2-task.js :: fenceBriefing) and the
+ * parent-conversation section (src/prompt-builder.js :: buildContextSection) —
+ * in two directories that do not import each other, and this is the one module
+ * in the tree whose subject is fences and which both can reach without either
+ * depending on the other.
  */
 'use strict';
 
@@ -36,4 +46,104 @@ ${body}
 </untrusted_sidecar_output>`;
 }
 
-module.exports = { fenceSidecarOutput };
+/**
+ * Every OUTBOUND house fence's tag name. ONE list, deliberately: both surfaces
+ * run the neutralizer over their whole vocabulary, not just their own tag, so a
+ * fence added to the family is covered everywhere by editing this array — and a
+ * body that carries the SIBLING surface's tags (either end, since round 3)
+ * cannot smuggle them through the surface that does not happen to emit them.
+ * @see src/council/briefings-stage2-task.js :: BRIEFING_FENCE_CLOSE
+ * @see src/prompt-builder.js :: buildContextSection
+ */
+const OUTBOUND_FENCE_TAGS = ['council_briefing', 'previous_conversation'];
+
+/**
+ * `</council_briefing>` / `</previous_conversation>`, case-insensitively and
+ * tolerating whitespace ANYWHERE inside the angle brackets — including between
+ * the `<` and the `/` (round 3, C1: the round-2 pattern required those two to
+ * be adjacent, so `< /council_briefing>` rode through untouched, and a reading
+ * model honours that spelling exactly as readily as the tight one). The slash
+ * and its surrounding space are INSIDE the captured group, so the author's own
+ * spelling survives into the defanged form and nothing is hidden.
+ * ⚠️ Module-level and `g`-flagged: safe ONLY because its sole use is
+ * `String#replace`, which resets `lastIndex` around the call. A `.test()` on
+ * this object would carry `lastIndex` between calls and skip matches — build a
+ * fresh regex if one is ever needed. Same warning for the OPEN pattern below.
+ */
+const OUTBOUND_FENCE_CLOSE_RE =
+  new RegExp(`<(\\s*\\/\\s*(?:${OUTBOUND_FENCE_TAGS.join('|')})\\s*)>`, 'gi');
+
+/**
+ * The same families' OPEN tags, attributes and all (round 3, B3b).
+ *
+ * `\\b` after the name is what keeps this off tags that merely START with a
+ * house name — `<council_briefingx>` is somebody else's markup — and
+ * `[^<>]*` carries whatever attributes the author wrote through into the
+ * escaped form. It cannot match a CLOSE tag: `\\s*` does not consume the `/`.
+ */
+const OUTBOUND_FENCE_OPEN_RE =
+  new RegExp(`<(\\s*(?:${OUTBOUND_FENCE_TAGS.join('|')})\\b[^<>]*)>`, 'gi');
+
+/**
+ * Neutralize any outbound house fence tag inside a body about to be embedded in
+ * one (PR #200 tails B2/C2; round 3 B3b/C1 widened it from closes to both ends).
+ *
+ * Without this, untrusted text that contains the close tag ends the fence early
+ * in the reading model's eyes and everything after it reads as the engine
+ * speaking — the fence's entire purpose, undone by a string the author types.
+ * The replacement is an entity escape (`&lt;/council_briefing&gt;`), so the
+ * text stays legible as what the author wrote while no longer being a tag:
+ * nothing is deleted and nothing is silently swallowed.
+ *
+ * OPEN TAGS TOO, and round 2's reason for skipping them was wrong (B3b). That
+ * reason — "an open tag inside a fence cannot escape it" — holds for a STRICT
+ * parser and fails for the reader this fence is actually addressed to. A model
+ * that balances tags reads the attacker's `<council_briefing …>` and the
+ * engine's REAL `</council_briefing>` as one pair: the attacker's tag gets the
+ * close, and the engine's fence is left unterminated. Everything after the
+ * attacker's open reads as fenced material, and everything the ENGINE writes
+ * after the real close reads as still inside a fence. That is the same escape
+ * one tag along. MEASURED before widening (W12, re-verified round 3): nothing
+ * in the tree PARSES these tags — the only occurrences outside test assertions
+ * are the two producers' own literals — so escaping opens breaks no consumer.
+ *
+ * ⚠️ THE BOUNDARY IS SOFT, and this is a disclosure, not a caveat. An entity
+ * escape is a convention about how a READING MODEL should interpret bytes, not
+ * a parser guarantee: some models decode `&lt;/council_briefing&gt;` back to
+ * the tag while reading, and a model that does is not fenced by this. What this
+ * buys is defense in depth — it removes the LITERAL tag, so the escape stops
+ * being free and starts depending on a decoding step the attacker does not
+ * control. The load-bearing protection is still the preamble both fences carry
+ * (the enclosed text is reference material, not instructions); this hardens it,
+ * and does not replace it. Deleting the tag outright would be a stronger
+ * boundary and a worse product — the reader would silently lose text the author
+ * wrote, which is the failure the whole fence exists to avoid.
+ *
+ * Total over non-strings (returns its argument unchanged): callers hand it
+ * whatever they were given, and a missing body must never be a throw inside a
+ * prompt builder.
+ * @param {string} text the untrusted body about to be fenced
+ * @returns {string} the same bytes when it carries no house tag
+ */
+function defangOutboundFenceTags(text) {
+  if (typeof text !== 'string') { return text; }
+  // Closes first: once a close is escaped its `<` is gone, so the OPEN pattern
+  // cannot see it. (It could not match one anyway — see the pattern's note —
+  // but the order makes that independent of the pattern staying that way.)
+  return text
+    .replace(OUTBOUND_FENCE_CLOSE_RE, '&lt;$1&gt;')
+    .replace(OUTBOUND_FENCE_OPEN_RE, '&lt;$1&gt;');
+}
+
+// FUNCTIONS FIRST, constant last — the PR 201 round-2 workaround for
+// `scripts/generate-docs-helpers.js :: extractExports`, which renders EVERY
+// export as `name()` and keeps only the first five. Ordering conceals a
+// constant behind that cap; MEASURED here, it cannot, because this module
+// exports three names and the cap never fires. So CLAUDE.md's Key Exports cell
+// reads `OUTBOUND_FENCE_TAGS()` for what is an array — a known-defect instance
+// of the generator bug, not a claim this module makes, and the second one below
+// the workaround's floor after `utils/text-sanitize.js`. It goes away with the
+// generator ruling filed in BACKLOG.md; padding the export list to five to hide
+// it would not be a fix, and the list itself must stay exported —
+// tests/utils/outbound-fence-defang.test.js reads it as the LIVE vocabulary.
+module.exports = { fenceSidecarOutput, defangOutboundFenceTags, OUTBOUND_FENCE_TAGS };

package/src/workspace/fold-format.js

@@ -5,10 +5,11 @@
  * (src/headless.js `formatFoldOutput`, exported from src/headless.js and
  * re-exported from src/index.js) — byte-for-byte the same **7-line** head:
  * marker, Model, Session, Client, CWD, Mode, `---`. ⚠️ v4.4.1 DOC-5: this said
- * "8-line" for two releases. Line 8 (`VERDICT:`) is council's OWN addition and
+ * "8-line" for two releases. Line 8 (the terminal line — `VERDICT:` on a review
+ * run, `ANSWER:` on a task one since v4.9 W8) is council's OWN addition and
  * has no counterpart in formatFoldOutput, whose 8th element is the summary
  * body. Only the first 7 lines are the shared contract; anyone changing the
- * shared format must sync those and leave `VERDICT:` alone.
+ * shared format must sync those and leave the terminal line alone.
  * src/headless.js is the SOURCE OF TRUTH; keep the head in sync with it.
  * (Line numbers deliberately omitted — the previous `:775-789`/`:797` citation
  * had drifted by ~500 lines.) The duplication is deliberate:
@@ -24,7 +25,7 @@
  * The chair body is UNTRUSTED model text: it passes through stripFoldMarkers
  * before embedding, so chair prose containing a marker can never truncate or
  * spoof the fold (the exact hazard the nonce closure exists for).
- * Degradation mirrors the engine's ladder: no chair → VERDICT: none + tally
+ * Degradation mirrors the engine's ladder: no chair → `<terminal>: none` + tally
  * summary; pre-tally → stage/status summary. Never blocked, always labeled.
  */
 'use strict';
@@ -63,14 +64,34 @@ function buildFoldText(o) {
   // amicus_verdict MCP path types overallVerdict as a bare z.string().nullable()
   // — mcp-tools.js :: amicus_verdict), so a multi-line or marker-bearing value
   // must never reach the head verbatim: an embedded '\n' would shift every line below
-  // VERDICT: (a raw string containing '\n' becomes several elements once the
+  // the terminal line (a raw string containing '\n' becomes several elements once the
   // head array is '\n'-joined), and an embedded marker could spoof the fold.
-  // Safe on the shipped engine path (parseChairVerdict returns a canonical
-  // CHAIR_VERDICTS phrase) — this is defense-in-depth, not a fix for a real
+  // Safe on the shipped engine path (`run-chair.js :: runChair` parses the chair's
+  // terminal line with `parse-stage2.js :: parseChairTerminal`, which returns a
+  // canonical phrase of the run's OWN scale — CHAIR_VERDICTS on a review run,
+  // CHAIR_ANSWERS on a task one) — this is defense-in-depth, not a fix for a real
   // producer.
+  // ⚠️ DE-ROT (v4.9 W8): this said "parseChairVerdict returns a canonical
+  // CHAIR_VERDICTS phrase", true only until W7 added the second scale — after
+  // which it named the wrong parser for every task run.
   const overall = verdict && verdict.overallVerdict
     ? stripFoldMarkers(String(verdict.overallVerdict)).replace(/[\r\n]+/g, ' ').trim()
     : null;
+  // v4.9 W8: the terminal line names the SCALE its phrase belongs to. The two
+  // scales are disjoint by pinned construction (tests/council/chair-scale-drift.test.js),
+  // so labelling a CHAIR_ANSWERS phrase `VERDICT:` asserts a scale it is not on.
+  // `intent` is emit-when-'task' (verdict.js :: buildVerdict, the W5 ruling), so
+  // absence — and an explicit 'review' — keep the review fold byte-identical.
+  // ⚠️ v4.9 fix round 2 (council B2): `run.intent` is the SECOND carrier, and it
+  // is what covers the DEGRADED fold — the one a user reaches for precisely when
+  // a task run went wrong. With no verdict.json (or a parse-failed one) there is
+  // no verdict.intent, and the fold headed `VERDICT: none` on a run that was
+  // never on that scale. `o.run` is the parsed run.json, which checkpoints
+  // `intent: 'task'` at start (src/council/run.js :: runCouncil):
+  // electron/ipc-workspace.js passes `run: detail.run` and run-detail.js ::
+  // getRunDetail reads it straight from `<runDir>/run.json`.
+  // PR #200 round-5 B3: parens on the whole disjunction — behaviour-identical.
+  const terminalLabel = ((verdict && verdict.intent === 'task') || run.intent === 'task') ? 'ANSWER' : 'VERDICT';
   const tierCounts = (verdict && verdict.tierCounts) || (tally && tally.tierCounts) || null;
   const cost = run.usage && run.usage.cost ? run.usage.cost : null;
 
@@ -82,7 +103,7 @@ function buildFoldText(o) {
     `CWD: ${o.project}`,
     'Mode: council',
     '---',
-    `VERDICT: ${overall || 'none'}`,
+    `${terminalLabel}: ${overall || 'none'}`,
   ];
   if (tierCounts) {
     head.push(tierLine(tierCounts));