amicus 4.9.0 → 4.9.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.0",
+  "version": "4.9.2",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,130 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.2] - 2026-08-27
+
+*The instrument existed; nothing could read it.*
+
+Issue #202 deferred its retry-policy decision to evidence: "v4.9 W13 records per-leg
+time-to-first-token in `runStats`, so the next rev can derive this from observation instead of
+argument." That probe had never reported a value into any artifact CI uploads — `tally.js`'s
+hand-maintained allowlist stripped it one hop before `tally.json`. Reading it changed the
+diagnosis: first tokens on the CI egress are a continuous heavy tail (8.0 s to 384.2 s, no gap),
+not an upstream that accepts and never serves. This release fixes the instrument, then the
+kill switches that were set inside that tail.
+
+### Fixed
+
+- **`ttftMs` survives the runStats re-projection (#202).** `tally.js :: tally` re-projects every
+  row through a hand-maintained allowlist that never named the field, and `verdict.js` copies that
+  array verbatim — so the W13 probe emitted correctly into `tally-input.json` and was destroyed
+  before `tally.json` and `verdict.json`, the only artifacts CI uploads. MEASURED, run
+  33030485388: 11 of 12 rows carried it going in, 0 of 12 coming out. `tally.js` becomes the fifth
+  emit gate and the fourth importer of the shared `isMeasuredTtft` predicate. A drift pin now fails
+  for ANY future `buildRunStatsEntry` key the allowlist is not taught to carry.
+- **A zero-output leg now names its cause (#202).** `getSessionStatus` was called only inside
+  `if (mirror.output.length > 0)` — a gate a leg that produced nothing never satisfies — so the one
+  leg needing diagnosis was the only one that never asked. A bounded, non-throwing read now runs at
+  the two backstop firing sites (a living leg makes no extra call) and appends `busy` /`idle`/
+  `retry` with the upstream message. `busy` means provider-side, `idle` means engine-side, `retry`
+  names the cause; none is suppressed. Untrusted provider text is sanitized.
+- **Dead Stage-2 judge legs are announced (#202).** A dead judge leg still binds to its seat, so it
+  was neither `orphan` nor `unbound` and Stage 2 had no third case: it fell through into
+  `judgeResults` unremarked. Run 32956900910 shipped a four-column adjudication matrix that two of
+  its four judges never voted in, with no degrade recorded. New `stage2-judge` channel.
+- **B53 no longer kills healthy, billing legs.** `TOOL_CALL_STALL_MS` was 180 s, condemned by this
+  repo's own measurement — a real 190.6 s `task` call recorded in `headless.js`, taken on a
+  developer machine. That measurement had corrected its neighbour (the settle deferral) and left
+  its own subject alone. Now 300 s, with CI overriding to 480 s.
+- **The Stage-1 retry backstop no longer ties with the leg timeout.** `min(2 * backstop, legCap)`
+  made the deadlines equal whenever `2 * backstop >= legCap`; the backstop won only by the poll
+  loop's ordering. It now clamps strictly below, so a retry death keeps its named diagnosis
+  instead of degrading to a generic `timeout`.
+
+### Added
+
+- **`verdict.json` publishes `seatsReviewed {reviewed, of}`.** `deriveSeatLoss` returns null when
+  no `--critic` was requested, and CI requests none, so seat loss was structurally absent from
+  every CI verdict while a two-seat bench published a four-model street-cred table. Derived from
+  `runStats`, counting the bench roles `buildSeats` mints (`seat`, `critic`, `lens:<slug>`).
+  Surfaced in the check-run title and the sticky comment footer.
+
+### Changed
+
+- **A dead Stage-2 judge now degrades the run, so it exits 2.** Previously a half-adjudicated
+  verdict could exit 0. This changes CI signal: runs that passed before will now report degraded
+  when a judge dies.
+- **CI council caps.** Per-leg `--timeout` 10 -> 16 min and `timeout-minutes` 45 -> 75, to give the
+  tool-stall detector real reach (120 s -> 480 s of a leg). The job cap covers a worst case of
+  four leg caps; that figure is a floor, since Stage-2 repairs are serial.
+
+## [4.9.1] - 2026-08-27
+
+*A silent provider failure, and the unservable model ids it produced.*
+
+A session on `deepseek` failed with `you passed deepseek-v4-flash-0731`. Tracing that one error
+found a chain: a provider fetch failed silently, the empty namespace it left behind was
+indistinguishable from "never fetched", and that ambiguity licensed the wizard to synthesise and
+persist a direct model id nothing serves.
+
+### Fixed
+
+- **Per-provider catalog fetch failures are reported instead of collapsing to `[]` (#209).**
+  `fetchAllModels()` returned a flat row array, so a provider whose fetch was REJECTED could not be
+  told apart from one that legitimately serves no models — all four failure modes (non-200, timeout,
+  network error, parse error) resolved to a bare `[]`, and the existing reporting fired only when
+  *every* provider returned nothing. A 401ing key silently zeroed that vendor's namespace and every
+  picker then offered gateway-only routes with no indication why. `fetchAllModelsDetailed()` now
+  carries `{rows, failures}`, the cache persists `providerFailures` alongside the rows they
+  describe, and `amicus models --check` prints
+  `PROVIDER FETCH FAILED: <provider> (HTTP 401)` (`--json` carries the array).
+  `fetchAllModels()` keeps its signature as a rows-only wrapper.
+- **A rejected namespace no longer yields a fabricated direct model id (#208).**
+  `classifyModel` returns `'unknown'` for an empty namespace because it could not distinguish
+  "never fetched" from "fetch rejected", and that licensed `directFormIfSafe` to strip the
+  `openrouter/` prefix and produce an id the direct API does not serve. Optimism is now suppressed
+  when *that vendor's* namespace fetch was rejected, and preserved when it was simply never
+  attempted. Threaded through the picker, the shortlist, both Electron wizard entry points and the
+  CLI setup path — the picker rebuilds its own `catalogInfo`, so without threading the guard was
+  live in unit tests and dead in production.
+- **The persistence path requires catalog evidence (#214).**
+  `toStorableRoute` — whose result is written straight into `config.aliases` and used to seed fresh
+  configs — decided direct-vs-gateway with no catalog evidence at all. It now routes through
+  `directFormIfSafe`, and `toLiveSeedAliases` stops discarding evidence it was already handed.
+- **Alias drift is computed against the same evidence the writer uses.**
+  `findDriftedStoredAliases` resolved its "current" value without `providerFailures`, so a rejected
+  namespace produced false drift whose suggested repair would have written back the very id #208
+  removed.
+- **Guards no longer depend on an optional argument.** `directFormIfSafe`/`directFormIfProven`
+  keyed both the `DIVERGENT_VENDORS` and namespace-rejection checks on a caller-supplied `vendor`
+  that the API marks optional, while the catalog check derived its own — so a caller using the
+  documented shape silently lost two of three guards. The vendor is now derived from the id when
+  omitted.
+- **The setup wizard keeps direct-first routing when the catalog is unavailable.** With no catalog,
+  quick picks fell back to raw `openrouter/…` routes, which Amicus treats as an explicit
+  force-OpenRouter literal — an offline setup would have pinned the user to the gateway
+  permanently.
+- **`pre-commit` no longer fails on a clone that has never stashed.** The hook gated its
+  lint-staged workaround on being inside a worktree; the real trigger is a missing `refs/stash`,
+  which is true of any fresh clone whose first commit precedes its first `git stash`.
+
+### Changed
+
+- **`toCanonicalDefault` is renamed `stripGatewayPrefix`** (`src/utils/curated-models.js`). The old
+  name read as the correct answer and three separate callers took it at its word and persisted ids
+  the direct API may not serve. It cannot be made evidence-taking — it *produces* the candidate
+  `classifyModel` checks — so the name now says what it is. Callers deriving an id that will be
+  called or stored must use `directFormIfSafe`/`directFormIfProven`. Internal utility, not a
+  documented API surface, but importers reaching into `src/utils/` will need the new name.
+- **Route canonicalisation for the setup wizard is decided in the main process.** The renderer
+  carried a hand-copy of `toCanonicalDefault` that had neither of the real primitive's guards; it is
+  deleted, and the safe form now ships to the page as data. Routing policy no longer reaches the
+  renderer at all.
+- **`gatewayOf(id)`** replaces three verbatim copies of the gateway-classification one-liner.
+- An ESLint rule now bans hand-rolled `openrouter/` prefix stripping outside an audited allowlist.
+- CI council bench: `qwen` moves from `qwen3.8-max` to `qwen3.8-27b` — same 1M context, ~4.8x
+  cheaper input. Bench-only; the shipped alias table is unchanged.
+
 ## [4.9.0] - 2026-08-26
 
 *The council does new work.*

package/README.md

@@ -455,7 +455,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.0",
+  "version": "4.9.2",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/docs/usage.md

@@ -538,7 +538,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.0",
+  "version": "4.9.2",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/electron/ipc-setup.js

@@ -184,11 +184,13 @@ function registerSetupHandlers(getMainWindow, { ipcMain = require('electron').ip
       let cfg = loadConfig();
       if (!cfg) {
         const { toLiveSeedAliases } = require('../src/utils/quick-picks');
-        let catalog = [];
+        // issue 214: getCatalogInfo, not getCatalog -- toLiveSeedAliases PERSISTS
+        // these routes, so it must see which namespaces were rejected.
+        let catalogInfo = { models: [] };
         try {
-          catalog = await require('../src/utils/model-catalog').getCatalog();
+          catalogInfo = await require('../src/utils/model-catalog').getCatalogInfo();
         } catch (_err) { /* offline: pinned seeds */ }
-        cfg = { aliases: toLiveSeedAliases(catalog) };
+        cfg = { aliases: toLiveSeedAliases(catalogInfo) };
       }
       if (!cfg.aliases) { cfg.aliases = {}; }
       if (defaultModel) { cfg.default = defaultModel; }

package/electron/main.js

@@ -327,12 +327,20 @@ function createAmicusWindow() {
 async function createSetupWindow() {
   // Lazy-load setup UI to avoid loading it for sidecar mode
   const { buildSetupHTML } = require('./setup-ui');
-  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
+  const { resolveQuickPicks, canonicalRoutesFor, toStorableRoute } = require('../src/utils/quick-picks');
   let quickPicks;
   const shortlists = {};
   try {
-    const catalog = await require('../src/utils/model-catalog').getCatalog();
+    // issue 208: getCatalogInfo (not getCatalog) -- the shortlist needs the
+    // per-provider fetch outcomes, or directFormIfSafe's namespace-failure
+    // gate cannot fire and a rejected namespace still yields bare direct ids.
+    const catalogInfo = await require('../src/utils/model-catalog').getCatalogInfo();
+    const catalog = catalogInfo.models;
     quickPicks = resolveQuickPicks(catalog);
+    // issue 214: decide each pick's safe storable form HERE, with the catalog in
+    // hand, and ship it as data. The page cannot require() the canonicalisation
+    // primitives, and its hand-copy of them dropped their guards.
+    for (const p of quickPicks) { p.canonicalRoutes = canonicalRoutesFor(p, catalogInfo); }
 
     // issue 138: one vendor shortlist per family card, resolved server-side from
     // the same catalog the quick picks came from (no extra IPC round-trip).
@@ -341,7 +349,8 @@ async function createSetupWindow() {
       try {
         shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
           catalog,
-          recommendedId: toStorableRoute(p),
+          providerFailures: catalogInfo.providerFailures,
+          recommendedId: toStorableRoute(p, catalogInfo),
         });
       } catch (_e) { /* a shortlist failure must never block the wizard */ }
     }
@@ -520,21 +529,26 @@ function createSettingsChildWindow() {
   // createSetupWindow awaits. A missing or corrupt cache reads back as null
   // and degrades to the same pinned fallback buildSetupHTML already applies
   // when no quickPicks are given.
-  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
+  const { resolveQuickPicks, canonicalRoutesFor, toStorableRoute } = require('../src/utils/quick-picks');
   const { readCache } = require('../src/utils/model-catalog');
   let quickPicks;
   const shortlists = {};
   try {
     const cacheDoc = readCache();
     const catalog = cacheDoc ? cacheDoc.models : [];
+    // issue 208: the cache doc carries the fetch outcomes for THESE rows.
+    const providerFailures = (cacheDoc && cacheDoc.providerFailures) || [];
     quickPicks = resolveQuickPicks(catalog);
+    // issue 214: see the note at the other resolveQuickPicks site.
+    for (const p of quickPicks) { p.canonicalRoutes = canonicalRoutesFor(p, { models: catalog, providerFailures }); }
 
     const { buildModelShortlist } = require('../src/utils/model-shortlist');
     for (const p of quickPicks) {
       try {
         shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
           catalog,
-          recommendedId: toStorableRoute(p),
+          providerFailures,
+          recommendedId: toStorableRoute(p, { models: catalog, providerFailures }),
         });
       } catch (_e) { /* a shortlist failure must never block the wizard */ }
     }

package/electron/setup-ui.js

@@ -11,9 +11,8 @@ const { buildLocalSectionHTML } = require('./setup-ui-local');
 const { buildLocalScript } = require('./setup-ui-local-script');
 const { getDefaultAliases } = require('../src/utils/config');
 const { getBrandName } = require('./toolbar');
-const { resolveQuickPicks } = require('../src/utils/quick-picks');
+const { resolveQuickPicks, canonicalRoutesFor } = require('../src/utils/quick-picks');
 const { PROVIDER_FAMILY_NAMES } = require('../src/utils/model-fetcher');
-const { listDirectProviders } = require('../src/utils/provider-registry');
 
 /**
  * @param {object} [options={}]
@@ -30,17 +29,26 @@ function buildSetupHTML(options = {}) {
     quickPicks = resolveQuickPicks([]),          // pinned fallbacks when not provided
     shortlists = {},
   } = options;
+  // Council A1 (PR 215): a pick reaching the page WITHOUT canonicalRoutes makes
+  // pickRouteFor fall back to the raw openrouter/... route, which this codebase
+  // treats as an EXPLICIT force-OpenRouter literal that never reconsiders
+  // direct-first -- so an offline setup (pinned fallback above, catalog
+  // unavailable) would pin the user to the gateway permanently. Backfill from an
+  // EMPTY catalog: directFormIfSafe is optimistic when nothing disproves the bare
+  // form (restoring direct-first) while still refusing for DIVERGENT_VENDORS,
+  // which the deleted toBareIfDirect did not.
+  const picks = quickPicks.map(p =>
+    (p && p.canonicalRoutes) ? p : { ...p, canonicalRoutes: canonicalRoutesFor(p, { models: [] }) });
   const brandName = getBrandName(client);
   const keysHtml = buildKeysStepHTML(PROVIDERS);
-  const modelHtml = buildModelStepHTML(quickPicks, undefined, undefined, shortlists);
+  const modelHtml = buildModelStepHTML(picks, undefined, undefined, shortlists);
   const aliasHtml = buildAliasEditorHTML(getDefaultAliases());
   const css = buildWizardCSS();
   const providersJson = JSON.stringify(PROVIDERS);
-  const modelChoicesJson = JSON.stringify(quickPicks);
+  const modelChoicesJson = JSON.stringify(picks);
   const providerNamesJson = JSON.stringify(PROVIDER_NAMES);
   const defaultAliasesJson = JSON.stringify(getDefaultAliases());
   const familyNamesJson = JSON.stringify(PROVIDER_FAMILY_NAMES);
-  const directProvidersJson = JSON.stringify(listDirectProviders());
   return `<!DOCTYPE html>
 <html><head><meta charset="utf-8"><title>Amicus Setup</title>
 <style>${css}</style></head><body>
@@ -62,11 +70,11 @@ function buildSetupHTML(options = {}) {
     </div>
   </div>
   <div class="footer"><div class="footer-brand"><svg width="15" height="15" viewBox="0 0 32 32" fill="none"><path d="M4 8H19"/><path d="M4 11H14L19 8"/><path d="M4 14H13L19 8"/><path d="M4 17H12L19 8"/><path d="M4 20H11L19 8"/><path d="M4 23H10L19 8"/><path class="brand-main" d="M19 8H28"/></svg> ${brandName}</div><div class="footer-nav"><button class="nav-btn" id="back-btn" style="display:none">Back</button><button class="nav-btn primary" id="next-btn" disabled>Next</button><button class="nav-btn primary" id="finish-btn" style="display:none">Finish</button></div></div>
-${buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson, directProvidersJson)}
+${buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson)}
 </body></html>`;
 }
 
-function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson, directProvidersJson) {
+function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson) {
   const keysJs = buildKeysScript();
   const aliasJs = buildAliasScript();
   const councilJs = buildCouncilScript();
@@ -83,7 +91,6 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
   var providerNamesData = ${providerNamesJson};
   var defaultAliases = Object.assign(Object.create(null), ${defaultAliasesJson});
   var PROVIDER_FAMILY_NAMES = ${familyNamesJson};
-  var directProviders = ${directProvidersJson};
   var routingChoices = {};
   var explicitRouteChoices = {};
   // issue 138: alias -> a SPECIFIC model id the user drilled down to. Empty
@@ -288,20 +295,6 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
     } else { nextBtn.disabled = false; }
   }
 
-  // #61: an auto-selected (non-explicit) openrouter/<vendor>/<model> route
-  // whose vendor also has a direct integration must be stored bare
-  // (<vendor>/<model>) so the gateway router can policy-route it direct-first;
-  // a stored openrouter/... string is treated as an explicit force-OpenRouter
-  // literal and never reconsiders direct-first. Mirrors
-  // src/utils/curated-models.js's toCanonicalDefault exactly. Gateway-only
-  // vendors (not in directProviders, e.g. qwen/grok/glm/...) pass through
-  // unchanged since OpenRouter is their only route anyway.
-  function toBareIfDirect(route) {
-    if (typeof route !== 'string' || route.indexOf('openrouter/') !== 0) { return route; }
-    var rest = route.slice('openrouter/'.length);
-    var vendor = rest.split('/')[0];
-    return directProviders.indexOf(vendor) !== -1 ? rest : route;
-  }
 
   // Single source of the route choice for a quick-pick row: explicit pill
   // choice if its key still exists, else first provider with a key, else
@@ -311,12 +304,12 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
     // issue 138: an explicit per-model choice overrides the family flagship.
     var picked = modelChoiceIds[mc.alias];
     if (picked) {
-      // Deliberately NEVER toBareIfDirect(picked) here (unlike the auto-pick
-      // canonicalization below): picked/modelOpenrouterIds come straight
-      // from the shortlist's own id/data-or, and for a DIVERGENT_VENDOR
-      // (e.g. anthropic) that id can already BE its only-callable
-      // openrouter/<vendor>/... form -- stripping the prefix would
-      // fabricate a direct id nothing serves.
+      // A drilled-down pick is returned VERBATIM -- never canonicalised (unlike
+      // the auto-pick below): picked/modelOpenrouterIds come straight from the
+      // shortlist's own id/data-or, which the picker already built through
+      // directFormIfSafe. For a DIVERGENT_VENDOR (e.g. anthropic) that id can
+      // already BE its only-callable openrouter/<vendor>/... form, so touching
+      // the prefix here would fabricate a direct id nothing serves.
       if (routingChoices[mc.alias] === 'openrouter' && explicitRouteChoices[mc.alias]) {
         return modelOpenrouterIds[mc.alias] || picked;
       }
@@ -332,9 +325,13 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
       if (!prov) { prov = provs[0]; }
     }
     var route = mc.routes[prov] || null;
-    // Only canonicalize auto-picks; an explicit "via OpenRouter" pill click
-    // is a deliberate choice and is returned unchanged.
-    if (route && !explicitRouteChoices[mc.alias]) { route = toBareIfDirect(route); }
+    // issue 214: the SAFE storable form is decided server-side (quick-picks.js
+    // canonicalRoutesFor) and shipped with the pick. The page must not re-derive
+    // it: its old hand-copy of stripGatewayPrefix dropped both of that
+    // primitive's guards. An explicit "via OpenRouter" pill stays unchanged.
+    if (route && !explicitRouteChoices[mc.alias]) {
+      route = (mc.canonicalRoutes && mc.canonicalRoutes[prov]) || route;
+    }
     return route;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.0",
+  "version": "4.9.2",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/council-verdict.schema.json

@@ -229,6 +229,16 @@
         "criticSeated"
       ]
     },
+    "seatsReviewed": {
+      "type": "object",
+      "description": "#202, optional. How much of the BENCH actually reviewed, derived from runStats: `of` counts every BENCH-role row — `seat`, `critic`, or `lens:<slug>`, exactly the roles seats.js :: buildSeats mints (one per bench seat POST-retry, so a healed seat is counted once and its first attempt is `role:'superseded'`), and `reviewed` counts those whose leg completed. Judges, chair and repair rows are not bench seats and are excluded. EMIT-WHEN-SET: a record with no bench rows carries no key at all, because `0 of 0` would read as a measurement of an empty bench rather than as the absence it is. WHY IT EXISTS: the sibling `seatLoss` above is present only when --critic was requested, and CI runs none — so seat loss was structurally absent from every CI verdict while a two-seat bench published a four-model street-cred table whose dead seats rendered `n/a`, indistinguishable from the legend's neutral (MEASURED, run 4424218c). No `additionalProperties: false` at the top level of this schema means an additive field was always accepted here; this documents the shape rather than changing what is accepted.",
+      "properties": {
+        "reviewed": { "type": "integer", "minimum": 0, "description": "Bench seats whose leg completed." },
+        "of": { "type": "integer", "minimum": 1, "description": "Bench seats benched, post-retry." }
+      },
+      "required": ["reviewed", "of"],
+      "additionalProperties": false
+    },
     "degrades": {
       "description": "v4.6 Plan 2: what this run lost — copied verbatim from the sink at verdict assembly. Additive; absent when the sink recorded nothing. v4.9 widened kind with 'info': an announcement that is neither a loss nor a recovery (e.g. a task run's ledger-skipped note) — carried here without degrading the run.",
       "type": "array",

package/src/council/run-retry-window.js

@@ -0,0 +1,62 @@
+/**
+ * @module council/run-retry-window
+ * The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay
+ * silent before the backstop kills it.
+ *
+ * ⚠️ EXTRACTED, not shaved (release Constraint 6, and the 300-line gate that put
+ * `verdict-seat-loss.js` in its own leaf): #219's correction took run-retry.js to
+ * 314/300. Its own module also makes the property directly testable.
+ *
+ * SL-2 Task 5 (#129): a retry re-runs the SAME model under the SAME conditions,
+ * so a latency failure is structurally unhealable — double the window rather
+ * than repeat it. ⚠️ #135 C0 took the base 240s -> 600s; deliberate, see
+ * CHANGELOG (council A1, PR #182).
+ *
+ * ⚠️ CLAMPED STRICTLY BELOW the leg timeout, not TO it (#219, council gpt
+ * major). `Math.min(2 * backstop, legTimeoutMs)` made the two deadlines EQUAL
+ * whenever `2 * backstop >= legTimeoutMs` — exactly CI today (2 x 480000 ===
+ * 960000 === `--timeout 16`). The backstop still won, but only by epsilon and
+ * only because the poll loop tests its deadline BEFORE sleeping, so the final
+ * poll lands just past the wall. That is an undocumented accident of loop order;
+ * if it ever lost, the leg would die a generic `timeout` and throw away the
+ * named NO_OUTPUT_BACKSTOP diagnosis this clamp exists to preserve.
+ *
+ * A PROPORTIONAL headroom, not a fixed subtraction: a constant large enough to
+ * beat a poll cycle (seconds) would drive a small leg cap to zero or negative,
+ * and `ms <= 0` is the documented DISABLE hatch — silently disabling the backstop
+ * is far worse than the race it fixes. 5% of any realistic leg cap clears the 2 s
+ * poll interval by a wide margin.
+ *
+ * `2 * 0 === 0` still disables, because `Math.min(0, anything positive) === 0`.
+ */
+
+'use strict';
+
+/**
+ * @param {number} baseBackstopMs the first attempt's resolved no-output window
+ * @param {number} legTimeoutMs the per-leg hard cap ((o.timeout || 15) * 60_000)
+ * @returns {number} the retry's window: doubled, clamped strictly below the cap
+ */
+function retryBackstopMs(baseBackstopMs, legTimeoutMs) {
+  // ⚠️ NOT floored at the first attempt's window, and #219 round 2 (glm) asked
+  // for exactly that — correctly observing that when `legTimeoutMs <= 2 * base`
+  // the retry window comes out slightly SHORTER than the attempt it exists to
+  // give room to (480000/480000 -> 456000). The observation is right; the remedy
+  // is worse than what it fixes, MEASURED across all three regimes:
+  //
+  //   regime            first(effective)   unfloored   floored   unfloored gives
+  //   cap = 2x base           480000        912000     912000    NAMED backstop
+  //   cap = base              480000        456000     480000    NAMED backstop
+  //   cap < base (t=3)        180000        171000     180000    NAMED backstop
+  //
+  // Flooring pins the window ONTO the leg cap in both degenerate regimes, which
+  // is the tie the headroom exists to break — so the leg dies a generic
+  // `timeout` and the named diagnosis is lost. That diagnosis is this module's
+  // entire purpose. The unfloored cost is bounded at 5% of the window (24 s at
+  // CI scale, 9 s at `--timeout 3`), and it is paid only where the leg cap
+  // already dominates the backstop. Trading ≤5% of one retry's patience for a
+  // named cause on every retry death is the right side of that trade.
+  return Math.min(2 * baseBackstopMs, Math.floor(legTimeoutMs * 0.95));
+}
+
+module.exports = { retryBackstopMs };

package/src/council/run-retry.js

@@ -17,6 +17,7 @@
 const { materializeReviews, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
 const { resolveNoOutputBackstopMs } = require('../utils/no-output-backstop');
+const { retryBackstopMs } = require('./run-retry-window');
 const { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote }
   = require('./run-retry-notes');
 // briefingFor + bindRetryWave live in ./run-retry-launch (v4.8 T-A2 split); the pad/bind core it wraps is stage1-bind.js :: bindPaddedWave (SI-27).
@@ -54,17 +55,13 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [],
   const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [], twins,
     stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [],
     stillDeadRetryLegs: [], seatOf: new Map(), orphanLegs: [], attemptedSeats: new Set() };
-  // Task 5 (#129): SL-2 retries the SAME model under the SAME conditions, so a
-  // latency failure is structurally unhealable. Double the window, clamped to
-  // the leg timeout so the failure CLASS stays NO_OUTPUT_BACKSTOP rather than
-  // silently becoming an ordinary timeout at a low --timeout. 2*0 === 0 keeps
-  // the disable hatch. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
-  // ⚠️ #135 C0 took this 240s -> 600s; deliberate, see CHANGELOG (council A1, PR #182).
+  // The retry window: doubled and clamped strictly below the leg timeout.
+  // Reasoning (and #219's correction) lives in ./run-retry-window — extracted
+  // for the 300-line gate. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
   const legTimeoutMs = (o.timeout || 15) * 60 * 1000;
-  const escalatedBackstopMs = Math.min(
-    2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs()),
-    legTimeoutMs,
-  );
+  const escalatedBackstopMs = retryBackstopMs(
+    Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs(),
+    legTimeoutMs);
 
   for (const unit of groupStage1Losses(o, deadWaves, deadLegs, seatOf, twins)) {
     // Task-4 review hardening: a unit this pass cannot even ATTEMPT — an

package/src/council/run-stage2.js

@@ -23,6 +23,9 @@ const stage2 = require('./briefings-stage2');
 const { parseJudgeOutput } = require('./parse-stage2');
 const { sanitizeName, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
+// #219 (council, glm minor): `leg.error` is UNTRUSTED provider text. The house
+// sanitizer — one sanitizer, one dialect (utils/text-sanitize.js).
+const { collapseExcerpt } = require('../utils/text-sanitize');
 const { buildRunStatsEntry } = require('./run-assemble');
 // v4.8 PR3 Task 4: seat binding. artifactName is NOT re-exported from
 // run-launch.js (its exports stop at sanitizeName/isAbortExit), so it comes
@@ -169,9 +172,16 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
       fs.writeFileSync(path.join(o.runDir, name), leg.summary, { mode: 0o600 });
     }
     let conformance = 'clean';
-    let parsed = (leg.status === 'complete' && leg.summary)
-      ? parseJudgeOutput(leg.summary, parseCtx)
-      : { ok: false, errors: [{ code: 'DEAD_LEG', detail: leg.error || leg.status }] };
+    // #202: ONE predicate for "this judge never answered at all", shared by the
+    // DEAD_LEG classification below and by the degrade it now raises. Spelling it
+    // twice is how the two would drift into disagreeing about which judges died —
+    // and note it is NOT `leg.status !== 'complete'`: a leg that completes with an
+    // EMPTY summary produced nothing either, and the DEAD_LEG arm has always
+    // treated it that way.
+    const legDied = !(leg.status === 'complete' && leg.summary);
+    let parsed = legDied
+      ? { ok: false, errors: [{ code: 'DEAD_LEG', detail: leg.error || leg.status }] }
+      : parseJudgeOutput(leg.summary, parseCtx);
     let attempts = 0;
     // ⚠️ LC-12: the judging text the repair prompt must carry, tracked exactly like
     // Stage-1's `repairing` so `judging` and `parsed.errors` always describe the SAME
@@ -216,6 +226,40 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
       if (parsed.ok) { conformance = 'repaired'; }
     }
     if (!parsed.ok) {
+      // #202: THE MISSING THIRD CASE. A dead judge leg still comes back as a leg
+      // object, so bindPaddedWave binds it — it is neither `orphan` nor
+      // `unbound`, and stage 2 had no case for it. It fell through into
+      // judgeResults with `ok:false` and vanished: MEASURED on CI run
+      // 32956900910 (wave 9d8029c8-s2), where glm and qwen judges died at +300s
+      // with zero tokens and run.json recorded no degrade at all, while the
+      // verdict shipped a four-column adjudication matrix two of them never
+      // voted in. The one net that might have caught it, `thin-cross-review`,
+      // fires only at `usableJudges < 2`; that run had exactly 2 of 4.
+      //
+      // ⚠️ Emitted with the default kind ('degrade'), so run-degrade.js's sink
+      // sets `degraded.value` and the run exits 2. That is a deliberate
+      // behaviour change (owner's call): before it, a half-adjudicated verdict
+      // could exit 0, and W11 only exited 2 because of an unrelated
+      // cost-accounting degrade. An unparseable-but-ANSWERED judge is a
+      // different fact and is deliberately excluded — it already darkens the
+      // seat's row via `conformance: 'unstructured'`, and it is repairable.
+      if (legDied) {
+        ctx.degrade.note({
+          channel: 'stage2-judge',
+          what: `judge ${judge} did not adjudicate`,
+          // #219: `why` is PROSE — it renders into run.json, the report and the
+          // sticky PR comment — so the provider's text is collapsed to one
+          // bounded line. `data.reason` below stays VERBATIM on purpose: it is
+          // the machine surface, it is JSON (nothing to inject), and truncating
+          // it would cost exactly the fidelity a reader opens run.json for.
+          why: `its Stage-2 leg ended '${leg.status}'`
+            + (leg.error ? `: ${collapseExcerpt(leg.error, 200)}` : ''),
+          effect: `the cross-review was adjudicated by fewer than the ${judges.length} judges the `
+            + 'bench implies; the run continues and will exit degraded (2)',
+          data: { judge, seat: seat ? seat.id : null, waveId: `${o.runId}-s2`,
+            status: leg.status, reason: leg.error || null },
+        });
+      }
       judgeResults.push({ judge, seat, ok: false, order: null, orderSeats: null, adjudications: null,
         conformance: leg.status === 'complete' ? 'unstructured' : 'clean',
         // #83 (v4.6 Plan 2): the judge's ORIGINAL Stage-2 wave leg, mirroring

package/src/council/tally.js

@@ -6,6 +6,11 @@ const { peersOf, unattributedPeerDrops } = require('./peer-split');
 // the seat-keying in it — release Constraint 6 is EXTRACT, never shave).
 // computeStreetCred is re-exported below, so no existing import path moved.
 const { computeStreetCred } = require('./street-cred');
+// #202: the TTFT probe's LAST emit gate — a RE-PROJECTION, so omitting the field
+// here destroyed one already produced rather than failing to produce it. Through
+// v4.9.1 utils/ttft.js's docblock enumerated only the four PRODUCER gates and
+// stopped one short of this one; it now names all five.
+const { isMeasuredTtft } = require('../utils/ttft');
 
 /**
  * Peers-only tier cascade. a/d are agree/dispute counts among PEER judges
@@ -181,6 +186,13 @@ function tally(input) {
       ...(r.seat ? { seat: r.seat } : {}),
       status: r.status || 'unknown',
       durationMs: typeof r.durationMs === 'number' ? r.durationMs : null,
+      // #202: emit-when-VALID, in buildRunStatsEntry's own slot (between
+      // durationMs and usage) so G7b's key-order invariant holds for a row that
+      // carries it. NOT `durationMs`'s null-coercion above: a null here would be
+      // read as a measurement, and absence must keep its one meaning — "no
+      // substantive tick was ever observed". The shared predicate is imported
+      // rather than hand-spelled; this file has no require-free pin.
+      ...(isMeasuredTtft(r.ttftMs) ? { ttftMs: r.ttftMs } : {}),
       usage: r.usage || null,
     })),
     tierCounts: countTiers(outFindings),