amicus 4.9.0 → 4.9.2

package/src/council/verdict-seats-reviewed.js

@@ -0,0 +1,60 @@
+/**
+ * @module council/verdict-seats-reviewed
+ * #202: the bench-seat census for verdict.json, as a spreadable fragment.
+ *
+ * ⚠️ EXTRACTED, not shaved — release Constraint 6, and the same 300-line gate
+ * that put `verdict-seat-loss.js` in its own leaf: adding this to verdict.js
+ * took that file to 313/300. It could not join verdict-seat-loss.js either —
+ * that module is pinned to export EXACTLY its two functions.
+ *
+ * This is the ONE place that decides what "a bench seat" means, so the
+ * emit-when-set rule and the role filter cannot drift apart. `of` is every
+ * `role:'seat'` row — one per bench seat POST-retry, so a healed seat counts
+ * once while its first attempt is `role:'superseded'`; judges, chair and
+ * repairs are not bench seats. `reviewed` is those whose leg completed: a
+ * `timeout` is not a review any more than an `error` is.
+ *
+ * A LEAF: it requires nothing, matching its seat-loss sibling.
+ */
+
+'use strict';
+
+/**
+ * @param {Array<object>|undefined} runStats
+ * @returns {{seatsReviewed?: {reviewed: number, of: number}}}
+ */
+/**
+ * Is this runStats row a BENCH seat — something that was asked to review?
+ *
+ * ⚠️ These are exactly the three roles `seats.js :: buildSeats` mints, and that
+ * is the point: it is the producer, so this mirrors it rather than guessing.
+ * `role === 'seat'` alone (#219) counted ZERO on a `--lenses` run, where every
+ * seat carries `lens:<slug>` — so emit-when-set silently omitted the census from
+ * the runs using the richest bench. A critic counts too: it is an adversarial
+ * seat, but it reviews.
+ *
+ * An ALLOWLIST, not a denylist of judge/chair/repair/superseded: a new
+ * non-bench role added later must not silently inflate the denominator.
+ */
+function isBenchRole(role) {
+  return role === 'seat' || role === 'critic'
+    || (typeof role === 'string' && role.startsWith('lens:'));
+}
+
+function seatsReviewedOf(runStats) {
+  // ⚠️ `Array.isArray`, NOT `runStats || []`. buildVerdict is reachable on
+  // externally-supplied records that never touched tally() in-process — the MCP
+  // `record` param of mcp-tools.js :: amicus_verdict is `z.record(z.any())`,
+  // fully permissive — and this file's own tests hand it `runStats: {}`. A
+  // truthy non-array sails past `||` and throws on `.filter`, turning a missing
+  // census into a crashed verdict build. The closed-literal comment further down
+  // makes the same argument about the same caller.
+  const seats = (Array.isArray(runStats) ? runStats : []).filter(r => r && isBenchRole(r.role));
+  if (seats.length === 0) { return {}; }
+  return { seatsReviewed: {
+    reviewed: seats.filter(r => r.status === 'complete').length,
+    of: seats.length,
+  } };
+}
+
+module.exports = { seatsReviewedOf };

package/src/council/verdict.js

@@ -13,6 +13,10 @@ const { summarizeSeatLoss, deriveSeatLoss } = require('./verdict-seat-loss');
 // opts.overallVerdict, null in every Stage-4 manual path).
 const VERDICT_SCHEMA_VERSION = 2;
 
+// #202: the bench-seat census leaf (the 300-line gate — same reason
+// verdict-seat-loss.js is its own module).
+const { seatsReviewedOf } = require('./verdict-seats-reviewed');
+
 /**
  * Merge a tally record with Claude's Stage-4 decisions into the verdict record.
  * @param {object} record  tally() output
@@ -123,6 +127,25 @@ function buildVerdict(record, decisions = [], opts = {}) {
     // Additive and OPTIONAL (schemaVersion stays 2): present only when a critic
     // was requested, so its absence never has to be interpreted.
     ...(opts.seatLoss ? { seatLoss: opts.seatLoss } : {}),
+    // #202: how much of the bench actually reviewed. DERIVED here rather than
+    // passed in, because every caller that could pass it already has the same
+    // `runStats` this reads — and a parameter is one more thing a rebuild path
+    // can forget (the `intent` key needed a SECOND carrier for exactly that).
+    //
+    // Its sibling `seatLoss` cannot serve: `deriveSeatLoss` returns null when no
+    // `--critic` was requested, and CI runs `CRITIC: ''` — so seat loss is
+    // STRUCTURALLY absent from every CI verdict. MEASURED on run 4424218c, a
+    // two-seat bench that published a four-model street-cred table with the dead
+    // seats rendered `n/a`, indistinguishable from the legend's "neutral".
+    //
+    // Counts the BENCH roles buildSeats mints — `seat`, `critic` and `lens:<slug>`
+    // (#219 r2: this said "`role:'seat'` ONLY" after the filter was widened, and
+    // two seats caught the stale sentence). One row per bench seat POST-retry, so a
+    // healed seat is counted once (its first attempt is `role:'superseded'`), and
+    // judges/chair/repairs are not bench seats. Emit-when-set — a record with no
+    // bench rows carries no key, because `0 of 0` would read as a measurement of
+    // an empty bench rather than as the absence it is.
+    ...seatsReviewedOf(record.runStats),
     // v4.6 Plan 2 (spec §4): the canonical what-was-lost surface. Additive and
     // OPTIONAL — present only when the run actually degraded, so a clean run's
     // verdict is byte-for-byte unchanged. schemaVersion stays 2 (the v4.5.2

package/src/headless.js

@@ -25,6 +25,8 @@ const { envNumber } = require('./utils/env-num');
 const { engineErrorForSession } = require('./utils/engine-log');
 // v4.9 W10 (#133 piece 3): the standing engine version-skew record, if any.
 const { currentEngineSkew, formatSkewSuffix } = require('./utils/engine-skew');
+// #202: the session-status clause on a death report (see utils/session-status.js).
+const { formatSessionStatusSuffix } = require('./utils/session-status');
 // v4.9 W13 Task A (PR #207 round 3, B3): the one honesty predicate every ttftMs
 // emit gate shares — see src/utils/ttft.js for why `typeof` was not it.
 const { isMeasuredTtft } = require('./utils/ttft');
@@ -85,7 +87,18 @@ const STABLE_FINISHED_POLLS = Number(process.env.AMICUS_STABLE_FINISHED_POLLS) |
 const STABLE_IDLE_POLLS = Number(process.env.AMICUS_STABLE_IDLE_POLLS) || 30;          // ~60s at 2s — no completion signal
 const POLL_CALL_TIMEOUT_MS = Number(process.env.AMICUS_POLL_CALL_TIMEOUT_MS) || 30000; // per getMessages call (used by a later task)
 const MAX_CONSECUTIVE_POLL_FAILURES = Number(process.env.AMICUS_MAX_CONSECUTIVE_POLL_FAILURES) || 15; // ≈30s at 2s polls
-const TOOL_CALL_STALL_MS = Number(process.env.AMICUS_TOOL_CALL_STALL_MS) || 180000; // B53: wedged tool call w/ no progress
+// B53: wedged tool call w/ no progress.
+// ⚠️ 180000 -> 300000 (#219, council glm minor). 180 s was condemned by this
+// file's OWN measurement — the 190.6 s `task` call recorded below, taken on a
+// developer machine, not on CI. #202 widened only the CI override and left every
+// local and library consumer on the number the evidence had already disproved.
+// 300000 matches the sibling constant that same measurement set (USAGE/settle
+// deferral below), so one measurement now governs both windows it bears on.
+const TOOL_CALL_STALL_MS = Number(process.env.AMICUS_TOOL_CALL_STALL_MS) || 300000;
+// #202: budget for the ONE session-status read on a death report. Short on
+// purpose — this runs on a leg already known to be dying, so the report must not
+// wait on the same engine that just failed to produce anything.
+const STATUS_PROBE_MS = 5000;
 /**
  * v4.4 B1 — bounded post-loop usage reconciliation. The fold-marker (:~540) and
  * SDK-idle (:~568) fast paths break WITHOUT requiring `info.time.completed`, but
@@ -120,9 +133,11 @@ const USAGE_SETTLE_CALL_TIMEOUT_MS = envNumber('AMICUS_USAGE_SETTLE_CALL_TIMEOUT
  * unbounded wait is not an option.
  *
  * WHY 5 MINUTES. The measured duration of the real subagent call that exposed
- * this is **190.6 s** (`task`, 04:35:08.427 → 04:38:19.061) — already longer
- * than B53's 180 s TOOL_CALL_STALL_MS, so anything at that scale would kill a
- * healthy `task` leg 10 s short of its answer. 300 s clears the measured case
+ * this is **190.6 s** (`task`, 04:35:08.427 → 04:38:19.061) — which was longer
+ * than B53's THEN-180 s TOOL_CALL_STALL_MS, so anything at that scale would kill
+ * a healthy `task` leg 10 s short of its answer. (#219 finally moved B53 itself
+ * to 300 s for this exact reason; for four releases this measurement corrected
+ * the neighbour and left its own subject alone.) 300 s clears the measured case
  * with margin and still lands far inside the 15-minute default `--timeout`.
  * Set to 0 to disable the deferral entirely (pre-v4.4 behaviour).
  *
@@ -228,7 +243,7 @@ function withTimeout(promise, ms, label) {
  *          engineSkew?: {server: string, installed: string}|null}} args
  * @returns {string}
  */
-function formatNoOutputBackstopReason({ ms, fromEnv, engineLogExcerpt, engineSkew }) {
+function formatNoOutputBackstopReason({ ms, fromEnv, engineLogExcerpt, engineSkew, sessionStatus }) {
   const observed = 'NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in '
     + `${Math.round(ms / 1000)}s — `
     + (fromEnv
@@ -237,7 +252,11 @@ function formatNoOutputBackstopReason({ ms, fromEnv, engineLogExcerpt, engineSke
   // Append-only: absent/empty excerpt ⇒ the string above, unchanged byte for byte.
   const quoted = engineLogExcerpt ? `${observed} — engine log: ${engineLogExcerpt}` : observed;
   // Append-only for the same reason: no skew ⇒ formatSkewSuffix returns ''.
-  return `${quoted}${formatSkewSuffix(engineSkew)}`;
+  // #202 adds a THIRD clause on the same terms, and LAST so both clauses above
+  // stay byte-stable: no status (or an unreadable one) ⇒ '' — see
+  // utils/session-status.js. With none of the three the string is byte-for-byte
+  // what it was before any of them existed.
+  return `${quoted}${formatSkewSuffix(engineSkew)}${formatSessionStatusSuffix(sessionStatus)}`;
 }
 
 /**
@@ -259,6 +278,45 @@ function engineErrorExcerptSafe(sessionId, engineLogOptions) {
   }
 }
 
+/**
+ * #202: read the engine's session status FOR A DEATH REPORT — best-effort and
+ * bounded, with the same "never become the failure it reports on" discipline as
+ * `engineErrorExcerptSafe` above, and one more constraint that read does not
+ * have: this one does I/O against the very engine that just failed to produce
+ * anything, so it must also be unable to HANG. Both belts are load-bearing and
+ * both are pinned (S-W4 rejects, S-W5 hangs).
+ *
+ * A failed probe returns `null`, which `formatSessionStatusSuffix` renders as
+ * '' — so a leg whose status could not be read carries the byte-for-byte reason
+ * string it carried before #202, rather than a clause claiming nothing was
+ * happening. Absence keeps its one meaning.
+ *
+ * `readStatus` is a parameter rather than a module import because
+ * `getSessionStatus` is destructured inside runHeadless from the injectable
+ * client module — taking it here keeps this helper pure and directly testable.
+ * @returns {Promise<object|null>}
+ */
+async function sessionStatusSafe(readStatus, client, sessionId, dirArgs, ms) {
+  // `!(ms > 0)` covers 0 (the documented disable), negatives and NaN — and it is
+  // why 0 is never handed to withTimeout, which would read it as UNBOUNDED.
+  if (typeof readStatus !== 'function' || !sessionId || !(ms > 0)) { return null; }
+  try {
+    return await withTimeout(
+      readStatus(client, sessionId, ...(dirArgs || [])), ms, 'getSessionStatus(death-report)');
+  } catch (err) {
+    // #219 (council, deepseek minor): returning null is right for the REPORT —
+    // absence keeps its one meaning — but it made a probe that timed out on a
+    // loaded engine indistinguishable from a leg whose engine reported nothing,
+    // i.e. a silent revert to pre-#202 behaviour. The engine log is where that
+    // belongs: the death report stays byte-identical, and the degradation
+    // becomes diagnosable instead of invisible.
+    logger.debug('session-status probe failed; the death report will carry no session clause', {
+      sessionId, error: err && err.message,
+    });
+    return null;
+  }
+}
+
 /**
  * Wait for the OpenCode server to be ready using SDK health check
  */
@@ -616,6 +674,19 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // "time since the leg asked for output" (see the block comment above), so
     // the TTFT probe below measures from exactly the instant the backstop
     // starts counting — the two can never disagree about when the wait began.
+    // #202: resolved HERE, not with the poll-loop options below. The pre-send
+    // firing site calls noOutputBackstopReason() upstream of that block, so a
+    // later `const` put this in its TDZ and the death report became
+    // "Cannot access 'statusProbeMs' before initialization" — the exact class of
+    // silent-diagnosis loss #202 exists to remove. Pinned by S-W6.
+    // ⚠️ `=== undefined`, not `||` (#219 round 2, deepseek): 0 is a meaningful
+    // value in this codebase's convention (usageSettlePolls,
+    // AMICUS_NO_OUTPUT_BACKSTOP_MS) and must survive injection. It cannot be
+    // FORWARDED as 0 though — withTimeout reads `ms <= 0` as NO timeout, so an
+    // honest-looking 0 would make this probe unbounded on a leg already known to
+    // be dying. sessionStatusSafe therefore SKIPS on a non-positive window.
+    const statusProbeMs = options.statusProbeMs === undefined
+      ? STATUS_PROBE_MS : options.statusProbeMs;
     const outputClockStartedAt = Date.now();
     const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: outputClockStartedAt });
     let backstopFired = false;
@@ -642,10 +713,20 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // was fixed mid-run, or one that belongs to another server this process
     // also talks to, cannot ride out on this death report. The read is a Map
     // lookup and does no I/O, so unlike the log read it needs no guard.
-    const noOutputBackstopReason = () => formatNoOutputBackstopReason({
+    //
+    // #202 (piece 4): the closure is now ASYNC, because the third clause costs
+    // one bounded HTTP call. The engine's session status is asked for at
+    // :~1045 only when `mirror.output.length > 0` — a gate a zero-output leg
+    // never satisfies — so the leg that most needs diagnosing was the only one
+    // that never asked, and every silent death reported a window with no cause.
+    // Asked for HERE instead, at the two firing sites and nowhere else, so a
+    // living leg still makes no extra call. The read is best-effort and
+    // bounded: `sessionStatusSafe` can neither throw nor hang (S-W4/S-W5).
+    const noOutputBackstopReason = async () => formatNoOutputBackstopReason({
       ms: noOutputBackstopMs, fromEnv: backstopFromEnv,
       engineLogExcerpt: engineErrorExcerptSafe(sessionId, options._engineLog),
       engineSkew: currentEngineSkew(client),
+      sessionStatus: await sessionStatusSafe(getSessionStatus, client, sessionId, dirArgs, statusProbeMs),
     });
 
     // Send prompt asynchronously (returns immediately, we poll for results) —
@@ -696,7 +777,7 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // skipped entirely on this path — see the while-condition and the
     // backstop-abort block further down).
     if (backstopFired) {
-      sessionError = noOutputBackstopReason();
+      sessionError = await noOutputBackstopReason();
     }
 
     // Hard provider failure detected at the client boundary (#37): a non-2xx /
@@ -1065,7 +1146,7 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
         // loop; the post-loop block below mirrors the timeout path.
         if (noOutputBackstop.tick(substantiveActivity, Date.now()) === 'fired') {
           backstopFired = true;
-          sessionError = noOutputBackstopReason();
+          sessionError = await noOutputBackstopReason();
           logger.warn('No-output backstop fired', { taskId, backstopMs: noOutputBackstopMs });
           break;
         }

package/src/sidecar/fanout-leg-fallback.js

@@ -15,6 +15,7 @@ const fs = require('fs');
 const { logger } = require('../utils/logger');
 const { classifyLegError, isRetryable } = require('../utils/error-classify');
 const { deriveChain } = require('./fallback-chains');
+const { gatewayOf } = require('../utils/gateway-router');
 
 /**
  * Append ONE attributed ledger row for a single attempt (spec 6.2/7.1). At
@@ -38,7 +39,7 @@ function recordAttemptSpend({ doc, leg, currentModel, legId, waveId, project, at
     // a substitution carries the substitute's resolved gateway on
     // `routeGateway` (threaded in by the loop, incl. v4.2 'local').
     const gateway = routeGateway || (leg && leg.gateway) ||
-      (String(currentModel).startsWith('openrouter/') ? 'openrouter' : 'direct');
+      gatewayOf(currentModel);
     const row = {
       taskId: legId, waveId, model: currentModel, mode: 'leg', usage,
       op: 'leg', status: doc.status, gateway,

package/src/sidecar/models-render.js

@@ -0,0 +1,71 @@
+/**
+ * Presentation helpers for `amicus models` -- pure string formatting, no I/O.
+ *
+ * Split out of models.js when the per-provider failure line (issue 209) pushed
+ * that file past the 300-line ceiling. Formatting and command flow are
+ * separable concerns, so the ceiling picked the seam: everything here takes a
+ * plain object and returns a string.
+ */
+
+'use strict';
+
+/** '0.000003' per token → '3.00' per Mtok; '—' when unknown or variable (-1) */
+function perMtok(perToken) {
+  if (perToken === null || perToken === undefined) { return '—'; }
+  const n = Number(perToken);
+  if (Number.isNaN(n) || n < 0) { return '—'; }
+  return (n * 1e6).toFixed(2);
+}
+
+function fmtRow(m, aliasesById) {
+  const alias = aliasesById.get(m.id);
+  const aliasCol = alias ? `[${alias}] ` : '';
+  const ctx = m.contextLength ?? '—';
+  const pIn = perMtok(m.pricing && m.pricing.prompt);
+  const pOut = perMtok(m.pricing && m.pricing.completion);
+  return `${aliasCol}${m.id}\n    ${m.name}  ctx ${ctx}  $/Mtok in ${pIn} out ${pOut}`;
+}
+
+/** One readable line per gateway-route finding (Task 6, #gwid). @param {object} f @returns {string} */
+function fmtGatewayFinding(f) {
+  if (f.kind === 'stale') {
+    return `  GATEWAY STALE (${f.gateway}): ${f.alias} -> ${f.model}`;
+  }
+  if (f.kind === 'divergent-missing') {
+    return `  GATEWAY DIVERGENT: ${f.alias} has no direct form; catalog confirms ${f.model}`;
+  }
+  return `  GATEWAY DIVERGENT: ${f.alias} direct form ${f.model} no longer matches catalog (now ${f.expected})`;
+}
+
+const PROBE_LABELS = { served: 'SERVED', 'accepted-but-silent': 'SILENT', error: 'ERROR' };
+
+/** '$0.0004' | '$1.23' | '—' (unknown). Deliberately NOT formatCost (pricing.js):
+ * a probe result's `cost` is a bare number (models-probe.js doesn't carry the
+ * reported/estimated source tag), so this never claims a precision it can't back. */
+function fmtProbeCost(cost) {
+  if (cost === null || cost === undefined || Number.isNaN(cost)) { return '—'; }
+  return cost < 1 ? `$${cost.toFixed(4)}` : `$${cost.toFixed(2)}`;
+}
+
+/** One readable line per probed alias (`--check --live`, v4.6.2 PR3): uppercase
+ * class prefix padded to a fixed column, two-space indent — mirrors the STALE/
+ * DRIFTED/GATEWAY line style above. @param {object} r probeStoredAliases() row */
+function fmtProbeLine(r) {
+  const head = `  ${(PROBE_LABELS[r.outcome] + ':').padEnd(8)}${r.alias} -> ${r.target}`;
+  if (r.outcome === 'served') { return `${head} (${fmtProbeCost(r.cost)})`; }
+  if (r.outcome === 'accepted-but-silent') { return `${head} — ${r.detail} (no output within the probe window)`; }
+  return `${head} — ${r.detail}`;
+}
+
+/** One readable line per REJECTED provider fetch (issue 209): a namespace that is
+ * empty because its key was refused explains stale/absent aliases downstream.
+ * @param {{provider: string, reason: string, status?: number, detail?: string}} f
+ * @returns {string} */
+function fmtProviderFailure(f) {
+  const why = f.reason === 'http-status' ? `HTTP ${f.status}` : (f.detail || f.reason);
+  return `PROVIDER FETCH FAILED: ${f.provider} (${why}) — its models are absent from the catalog`;
+}
+
+module.exports = {
+  perMtok, fmtRow, fmtGatewayFinding, PROBE_LABELS, fmtProbeCost, fmtProbeLine, fmtProviderFailure,
+};

package/src/sidecar/models.js

@@ -21,25 +21,11 @@ const { getFamilies } = require('../utils/curated-models');
 const { pickCurrent } = require('../utils/quick-picks');
 const { probeStoredAliases, selectStoredAliases } = require('./models-probe');
 const { DEFAULT_MAX_LEGS } = require('./fanout-validate');
+const { fmtRow, fmtGatewayFinding, fmtProbeLine, fmtProviderFailure } = require('./models-render');
 
 const CHECK_EXIT_CAP = 100;
 
-/** '0.000003' per token → '3.00' per Mtok; '—' when unknown or variable (-1) */
-function perMtok(perToken) {
-  if (perToken === null || perToken === undefined) { return '—'; }
-  const n = Number(perToken);
-  if (Number.isNaN(n) || n < 0) { return '—'; }
-  return (n * 1e6).toFixed(2);
-}
 
-function fmtRow(m, aliasesById) {
-  const alias = aliasesById.get(m.id);
-  const aliasCol = alias ? `[${alias}] ` : '';
-  const ctx = m.contextLength ?? '—';
-  const pIn = perMtok(m.pricing && m.pricing.prompt);
-  const pOut = perMtok(m.pricing && m.pricing.completion);
-  return `${aliasCol}${m.id}\n    ${m.name}  ctx ${ctx}  $/Mtok in ${pIn} out ${pOut}`;
-}
 
 /** alias marks: id → comma-joined alias names (effective user aliases) */
 function aliasMarks() {
@@ -130,36 +116,9 @@ async function runRefresh(args) {
   return 0;
 }
 
-/** One readable line per gateway-route finding (Task 6, #gwid). @param {object} f @returns {string} */
-function fmtGatewayFinding(f) {
-  if (f.kind === 'stale') {
-    return `  GATEWAY STALE (${f.gateway}): ${f.alias} -> ${f.model}`;
-  }
-  if (f.kind === 'divergent-missing') {
-    return `  GATEWAY DIVERGENT: ${f.alias} has no direct form; catalog confirms ${f.model}`;
-  }
-  return `  GATEWAY DIVERGENT: ${f.alias} direct form ${f.model} no longer matches catalog (now ${f.expected})`;
-}
 
-const PROBE_LABELS = { served: 'SERVED', 'accepted-but-silent': 'SILENT', error: 'ERROR' };
 
-/** '$0.0004' | '$1.23' | '—' (unknown). Deliberately NOT formatCost (pricing.js):
- * a probe result's `cost` is a bare number (models-probe.js doesn't carry the
- * reported/estimated source tag), so this never claims a precision it can't back. */
-function fmtProbeCost(cost) {
-  if (cost === null || cost === undefined || Number.isNaN(cost)) { return '—'; }
-  return cost < 1 ? `$${cost.toFixed(4)}` : `$${cost.toFixed(2)}`;
-}
 
-/** One readable line per probed alias (`--check --live`, v4.6.2 PR3): uppercase
- * class prefix padded to a fixed column, two-space indent — mirrors the STALE/
- * DRIFTED/GATEWAY line style above. @param {object} r probeStoredAliases() row */
-function fmtProbeLine(r) {
-  const head = `  ${(PROBE_LABELS[r.outcome] + ':').padEnd(8)}${r.alias} -> ${r.target}`;
-  if (r.outcome === 'served') { return `${head} (${fmtProbeCost(r.cost)})`; }
-  if (r.outcome === 'accepted-but-silent') { return `${head} — ${r.detail} (no output within the probe window)`; }
-  return `${head} — ${r.detail}`;
-}
 
 async function runCheck(args) {
   // v4.9 W13 Task B (BACKLOG C5). FIRST — ahead of the catalog-unavailable return
@@ -171,13 +130,17 @@ async function runCheck(args) {
   require('../utils/alias-shadow').auditAliasShadows();
   const catalogInfo = await getCatalogInfo();
   const catalog = catalogInfo.models;
+  const providerFailures = Array.isArray(catalogInfo.providerFailures) ? catalogInfo.providerFailures : [];
   if (!catalog || catalog.length === 0) {
     const probeSkipped = args.live ? 'catalog-unavailable' : null;
     if (args.json) {
       process.stdout.write(JSON.stringify(buildAuditDoc({
-        stale: [], catalogAvailable: false, probeSkipped
+        stale: [], catalogAvailable: false, probeSkipped, providerFailures
       }), null, 2) + '\n');
     } else {
+      // Council C2 (PR 215): "catalog unavailable" is precisely when the user
+      // needs to know WHICH provider refused them.
+      for (const f of providerFailures) { process.stdout.write(fmtProviderFailure(f) + '\n'); }
       process.stdout.write('Catalog unavailable (offline or no providers reachable); cannot check.\n');
       if (probeSkipped) { process.stdout.write(fmtLiveSkipped(probeSkipped) + '\n'); }
     }
@@ -186,7 +149,7 @@ async function runCheck(args) {
   const sources = collectAliasSources();
   const stale = findStaleAliases(sources, catalog)
     .map(s => ({ ...s, suggestions: suggestReplacements(s.model, catalog) }));
-  const drifted = findDriftedStoredAliases(sources, catalog);
+  const drifted = findDriftedStoredAliases(sources, catalogInfo);
   // Task 6 (#gwid): per-gateway-form audit of the curated DEFAULTS
   // (toGatewayRoutes()) — additive to the flat audit above. Informational by
   // default; --strict promotes it to a build-breaking exit code (CI gate).
@@ -221,10 +184,14 @@ async function runCheck(args) {
 
   if (args.json) {
     process.stdout.write(JSON.stringify(buildAuditDoc({
-      stale, catalogAvailable: true, gatewayFindings, drifted, probe: probeResults
+      stale, catalogAvailable: true, gatewayFindings, drifted, probe: probeResults, providerFailures
     }), null, 2) + '\n');
     return exitCode;
   }
+  // issue 209: report REJECTED provider fetches before the alias findings -- an
+  // empty namespace explains stale/absent aliases downstream, and staying
+  // silent about it is the original defect.
+  for (const f of providerFailures) { process.stdout.write(fmtProviderFailure(f) + '\n'); }
   const driftLines = buildFallbackDriftReport(catalog);
   if (stale.length === 0 && drifted.length === 0) {
     process.stdout.write(`All aliases resolve to catalog models (${sources.length} checked).\n`);

package/src/sidecar/reopen-spend.js

@@ -20,7 +20,8 @@ function finalizeSpendForReopen({ taskId, model, mode, op, result, status, proje
     metadata.usage = usage; // buildRunResult surfaces metadata.usage into the --json doc for free
     try {
       const { appendSpend } = require('../utils/spend-ledger');
-      const gateway = metadata.gateway || (String(model).startsWith('openrouter/') ? 'openrouter' : 'direct');
+      const { gatewayOf } = require('../utils/gateway-router');
+      const gateway = metadata.gateway || gatewayOf(model);
       // v4.7.1 Task 7 D16: null-not-absent, the OPPOSITE convention from
       // metadata.tag's absent-not-null (D13) — same `|| null` idiom as start.js:237.
       appendSpend({ taskId, model, mode, usage, op, status, project, gateway, tag: metadata.tag || null }, ctx);

package/src/sidecar/setup.js

@@ -475,9 +475,17 @@ async function runReadlineSetup() {
       await warnOnLowOpenRouterCredit();
     }
 
-    const { getCatalog } = require('../utils/model-catalog');
+    const { getCatalogInfo } = require('../utils/model-catalog');
     let catalog = [];
-    try { catalog = await getCatalog(); } catch (_err) { /* offline: pinned */ }
+    // #208: carry the per-provider fetch outcomes alongside the rows, so the
+    // vendor shortlist below cannot synthesise a bare direct id for a
+    // namespace whose fetch was rejected rather than never attempted.
+    let providerFailures = [];
+    try {
+      const info = await getCatalogInfo();
+      catalog = info.models;
+      providerFailures = info.providerFailures || [];
+    } catch (_err) { /* offline: pinned */ }
 
     // Task 7 (cost-aware defaults P2): per-provider picker, once per keyed
     // provider, BEFORE the mode prompt -- orthogonal to standard-vs-free-council.
@@ -537,7 +545,7 @@ async function runReadlineSetup() {
     }
 
     // Read-modify-write — never rebuild the alias table (no-clobber rule).
-    const cfg = loadConfig() || { aliases: toLiveSeedAliases(catalog) };
+    const cfg = loadConfig() || { aliases: toLiveSeedAliases({ models: catalog, providerFailures }) };
     if (!cfg.aliases) { cfg.aliases = {}; }
     if (chosen.alias) {
       cfg.default = chosen.alias;
@@ -548,7 +556,7 @@ async function runReadlineSetup() {
       // choice), but the alias's VALUE must stay the vendor phase's tier choice --
       // skip the curated-flagship upgrade so it isn't discarded.
       if (pick && !chosen.noUpgrade && !vendorAliasesWritten.has(chosen.alias)) {
-        cfg.aliases[chosen.alias] = toStorableRoute(pick);
+        cfg.aliases[chosen.alias] = toStorableRoute(pick, { models: catalog, providerFailures });
       } else if (cfg.aliases[chosen.alias] === undefined) {
         const fallback = getDefaultAliases()[chosen.alias];
         if (fallback !== undefined) { cfg.aliases[chosen.alias] = fallback; }
@@ -599,6 +607,7 @@ async function runReadlineSetup() {
           const { buildModelShortlist } = require('../utils/model-shortlist');
           const shortlist = buildModelShortlist(pick.vendorPath, {
             catalog,
+            providerFailures,
             recommendedId: cfg.aliases[chosen.alias],
           });
           const specific = await promptForVendorModel(

package/src/sidecar/start.js

@@ -219,6 +219,7 @@ async function startSidecar(options) {
     try {
       const { appendSpend } = require('../utils/spend-ledger');
       const { statusFromResult } = require('../utils/result-schema');
+      const { gatewayOf } = require('../utils/gateway-router');
       appendSpend({
         taskId, model, mode: effectiveHeadless ? 'headless' : 'interactive', usage: runUsage,
         op: 'start', status: statusFromResult(result), project: effectiveProject,
@@ -227,7 +228,7 @@ async function startSidecar(options) {
         // inside createSessionMetadata. Reading `metadata.gateway` throws a ReferenceError the
         // best-effort catch swallows → EVERY start-mode spend row silently dropped + start-json.test.js
         // goes red. Use an in-scope value (spec-complete for direct/openrouter):
-        gateway: String(model).startsWith('openrouter/') ? 'openrouter' : 'direct',
+        gateway: gatewayOf(model),
         // (To also attribute v4.2 'local': thread the resolved route gateway — dropped today at
         // cli-handlers-run.js:47 — into createSessionMetadata and read `meta.gateway`, as continue.js:111 does.)
         // v4.7 F8 D16: same in-scope-value rule as gateway above — `m` is the

package/src/utils/alias-audit.js

@@ -172,13 +172,20 @@ function suggestReplacements(staleModel, catalog, n = 3) {
  * @param {Array<{id:string}>} catalog
  * @returns {Array<{alias:string,stored:string,current:string}>}
  */
-function findDriftedStoredAliases(sources, catalog) {
-  if (!catalog || catalog.length === 0) { return []; }
+function findDriftedStoredAliases(sources, catalogOrInfo) {
+  // Council #216 A1/B2/C1: accepts catalogInfo (or a bare array, for existing
+  // callers). Passing models WITHOUT providerFailures made this compute the bare
+  // direct form for a REJECTED namespace while sidecar/setup.js persists the
+  // gateway form -- reporting drift that does not exist, and suggesting a repair
+  // that writes back the unservable direct id issue 208 removed.
+  const info = Array.isArray(catalogOrInfo) ? { models: catalogOrInfo } : (catalogOrInfo || { models: [] });
+  const catalog = info.models || [];
+  if (catalog.length === 0) { return []; }
   const { resolveQuickPicks, toStorableRoute } = require('./quick-picks');
   const current = new Map();
   for (const r of resolveQuickPicks(catalog)) {
     if (r.source !== 'live') { continue; }
-    const stored = toStorableRoute(r);
+    const stored = toStorableRoute(r, info);
     if (stored) { current.set(r.alias, { display: stored, routeValues: new Set(Object.values(r.routes)) }); }
   }
   const byProvider = idsByProvider(catalog);

package/src/utils/alias-shadow.js

@@ -103,7 +103,7 @@ const { collapseExcerpt } = require('./text-sanitize');
  */
 function findAliasShadows(names) {
   const { loadConfig } = require('./config');
-  const { toDefaultAliases, toCanonicalDefault } = require('./curated-models');
+  const { toDefaultAliases, stripGatewayPrefix } = require('./curated-models');
   const cfg = loadConfig();
   const userAliases = (cfg && cfg.aliases && typeof cfg.aliases === 'object') ? cfg.aliases : {};
   // Own keys only: a user config.json can carry a literal `__proto__`/`toString`
@@ -131,7 +131,7 @@ function findAliasShadows(names) {
     // ROUTING has its own audit (`models --check`'s per-gateway section); this
     // notice speaks only when the alias names a different MODEL. The rows still
     // report both sides RAW, so the user can grep their own config.
-    if (toCanonicalDefault(local) === toCanonicalDefault(shipped)) { continue; }
+    if (stripGatewayPrefix(local) === stripGatewayPrefix(shipped)) { continue; }
     out.push({ alias, local, curated: shipped });
   }
   return out;

package/src/utils/curated-models.js

@@ -142,9 +142,11 @@ function getFamilies() {
 }
 
 /**
- * Direct-first canonicalization for a pinned `openrouter/<vendor>/<rest>`
- * route: when `<vendor>` has a direct integration (provider-registry
- * `isDirectProvider`), strip the `openrouter/` prefix so the resulting bare
+ * ⚠️ MECHANICAL primitive, NOT a routing decision (renamed from `toCanonicalDefault`,
+ * issue 214 — model-canonicalization.js explains why that name was a trap). An id that
+ * will be CALLED or STORED must come from directFormIfSafe/directFormIfProven. Strips
+ * the `openrouter/` prefix off a pinned route when `<vendor>` has a direct integration
+ * (provider-registry `isDirectProvider`), so the resulting bare
  * `<vendor>/<rest>` id is policy-routed by the gateway router (direct when a
  * direct key exists, OpenRouter otherwise). Gateway-only vendors (no direct
  * integration — e.g. qwen, x-ai, z-ai, mistralai, minimax, moonshotai,
@@ -154,7 +156,7 @@ function getFamilies() {
  * @param {string} route
  * @returns {string}
  */
-function toCanonicalDefault(route) {
+function stripGatewayPrefix(route) {
   if (typeof route === 'string' && route.startsWith('openrouter/')) {
     const rest = route.slice('openrouter/'.length); // '<vendor>/<rest...>'
     const slashIdx = rest.indexOf('/');
@@ -211,7 +213,7 @@ function vendorOf(orRoute) {
 function directFormFor(vendorPath, obj) {
   if (obj[vendorPath]) { return obj[vendorPath]; } // explicit, authored, current direct id
   if (DIVERGENT_VENDORS.has(vendorPath)) { return undefined; } // no explicit form + divergent → omit
-  const bare = toCanonicalDefault(obj.openrouter); // safe only when ids are identical across gateways
+  const bare = stripGatewayPrefix(obj.openrouter); // safe only when ids are identical across gateways
   return bare !== obj.openrouter ? bare : undefined; // gateway-only vendor → undefined
 }
 
@@ -293,6 +295,6 @@ function toDefaultAliases() {
 }
 
 module.exports = {
-  getFamilies, toDefaultAliases, toCanonicalDefault, listCuratedRoutes, toGatewayRoutes,
+  getFamilies, toDefaultAliases, stripGatewayPrefix, listCuratedRoutes, toGatewayRoutes,
   directFormProvenance, DIVERGENT_VENDORS
 };

package/src/utils/degrade.js

@@ -24,6 +24,14 @@ const DEGRADE_CHANNELS = Object.freeze(new Set([
   // a leg that DID match a slot but whose join key names no judge the wave launched.
   // Never a guess — silent mis-attribution is the failure seat identity exists to kill (§4.4).
   'seat-unbound',
+  // #202: a Stage-2 JUDGE leg that came back dead — bound to its seat, so
+  // neither `seat-unbound` nor an orphan, and until now it had no channel at all
+  // and no case in run-stage2.js. Deliberately its own channel rather than
+  // `dead-leg`: that one is the Stage-1 BENCH roster's, feeds the retry pass and
+  // the seat-loss surface, and a judge death reused on it would be counted as a
+  // lost reviewer by consumers that only ever meant seats (verdict-seat-loss.js
+  // already gates the Stage-2 notes out of `seat-unbound` for the same reason).
+  'stage2-judge',
   'internal',
   // doctor channels
   'doctor-check-failed', 'doctor-fix',