amicus 4.9.1 → 4.9.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,63 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.2] - 2026-08-27
+
+*The instrument existed; nothing could read it.*
+
+Issue #202 deferred its retry-policy decision to evidence: "v4.9 W13 records per-leg
+time-to-first-token in `runStats`, so the next rev can derive this from observation instead of
+argument." That probe had never reported a value into any artifact CI uploads — `tally.js`'s
+hand-maintained allowlist stripped it one hop before `tally.json`. Reading it changed the
+diagnosis: first tokens on the CI egress are a continuous heavy tail (8.0 s to 384.2 s, no gap),
+not an upstream that accepts and never serves. This release fixes the instrument, then the
+kill switches that were set inside that tail.
+
+### Fixed
+
+- **`ttftMs` survives the runStats re-projection (#202).** `tally.js :: tally` re-projects every
+  row through a hand-maintained allowlist that never named the field, and `verdict.js` copies that
+  array verbatim — so the W13 probe emitted correctly into `tally-input.json` and was destroyed
+  before `tally.json` and `verdict.json`, the only artifacts CI uploads. MEASURED, run
+  33030485388: 11 of 12 rows carried it going in, 0 of 12 coming out. `tally.js` becomes the fifth
+  emit gate and the fourth importer of the shared `isMeasuredTtft` predicate. A drift pin now fails
+  for ANY future `buildRunStatsEntry` key the allowlist is not taught to carry.
+- **A zero-output leg now names its cause (#202).** `getSessionStatus` was called only inside
+  `if (mirror.output.length > 0)` — a gate a leg that produced nothing never satisfies — so the one
+  leg needing diagnosis was the only one that never asked. A bounded, non-throwing read now runs at
+  the two backstop firing sites (a living leg makes no extra call) and appends `busy` /`idle`/
+  `retry` with the upstream message. `busy` means provider-side, `idle` means engine-side, `retry`
+  names the cause; none is suppressed. Untrusted provider text is sanitized.
+- **Dead Stage-2 judge legs are announced (#202).** A dead judge leg still binds to its seat, so it
+  was neither `orphan` nor `unbound` and Stage 2 had no third case: it fell through into
+  `judgeResults` unremarked. Run 32956900910 shipped a four-column adjudication matrix that two of
+  its four judges never voted in, with no degrade recorded. New `stage2-judge` channel.
+- **B53 no longer kills healthy, billing legs.** `TOOL_CALL_STALL_MS` was 180 s, condemned by this
+  repo's own measurement — a real 190.6 s `task` call recorded in `headless.js`, taken on a
+  developer machine. That measurement had corrected its neighbour (the settle deferral) and left
+  its own subject alone. Now 300 s, with CI overriding to 480 s.
+- **The Stage-1 retry backstop no longer ties with the leg timeout.** `min(2 * backstop, legCap)`
+  made the deadlines equal whenever `2 * backstop >= legCap`; the backstop won only by the poll
+  loop's ordering. It now clamps strictly below, so a retry death keeps its named diagnosis
+  instead of degrading to a generic `timeout`.
+
+### Added
+
+- **`verdict.json` publishes `seatsReviewed {reviewed, of}`.** `deriveSeatLoss` returns null when
+  no `--critic` was requested, and CI requests none, so seat loss was structurally absent from
+  every CI verdict while a two-seat bench published a four-model street-cred table. Derived from
+  `runStats`, counting the bench roles `buildSeats` mints (`seat`, `critic`, `lens:<slug>`).
+  Surfaced in the check-run title and the sticky comment footer.
+
+### Changed
+
+- **A dead Stage-2 judge now degrades the run, so it exits 2.** Previously a half-adjudicated
+  verdict could exit 0. This changes CI signal: runs that passed before will now report degraded
+  when a judge dies.
+- **CI council caps.** Per-leg `--timeout` 10 -> 16 min and `timeout-minutes` 45 -> 75, to give the
+  tool-stall detector real reach (120 s -> 480 s of a leg). The job cap covers a worst case of
+  four leg caps; that figure is a floor, since Stage-2 repairs are serial.
+
 ## [4.9.1] - 2026-08-27
 
 *A silent provider failure, and the unservable model ids it produced.*

package/README.md

@@ -455,7 +455,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/docs/usage.md

@@ -538,7 +538,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/council-verdict.schema.json

@@ -229,6 +229,16 @@
         "criticSeated"
       ]
     },
+    "seatsReviewed": {
+      "type": "object",
+      "description": "#202, optional. How much of the BENCH actually reviewed, derived from runStats: `of` counts every BENCH-role row — `seat`, `critic`, or `lens:<slug>`, exactly the roles seats.js :: buildSeats mints (one per bench seat POST-retry, so a healed seat is counted once and its first attempt is `role:'superseded'`), and `reviewed` counts those whose leg completed. Judges, chair and repair rows are not bench seats and are excluded. EMIT-WHEN-SET: a record with no bench rows carries no key at all, because `0 of 0` would read as a measurement of an empty bench rather than as the absence it is. WHY IT EXISTS: the sibling `seatLoss` above is present only when --critic was requested, and CI runs none — so seat loss was structurally absent from every CI verdict while a two-seat bench published a four-model street-cred table whose dead seats rendered `n/a`, indistinguishable from the legend's neutral (MEASURED, run 4424218c). No `additionalProperties: false` at the top level of this schema means an additive field was always accepted here; this documents the shape rather than changing what is accepted.",
+      "properties": {
+        "reviewed": { "type": "integer", "minimum": 0, "description": "Bench seats whose leg completed." },
+        "of": { "type": "integer", "minimum": 1, "description": "Bench seats benched, post-retry." }
+      },
+      "required": ["reviewed", "of"],
+      "additionalProperties": false
+    },
     "degrades": {
       "description": "v4.6 Plan 2: what this run lost — copied verbatim from the sink at verdict assembly. Additive; absent when the sink recorded nothing. v4.9 widened kind with 'info': an announcement that is neither a loss nor a recovery (e.g. a task run's ledger-skipped note) — carried here without degrading the run.",
       "type": "array",

package/src/council/run-retry-window.js

@@ -0,0 +1,62 @@
+/**
+ * @module council/run-retry-window
+ * The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay
+ * silent before the backstop kills it.
+ *
+ * ⚠️ EXTRACTED, not shaved (release Constraint 6, and the 300-line gate that put
+ * `verdict-seat-loss.js` in its own leaf): #219's correction took run-retry.js to
+ * 314/300. Its own module also makes the property directly testable.
+ *
+ * SL-2 Task 5 (#129): a retry re-runs the SAME model under the SAME conditions,
+ * so a latency failure is structurally unhealable — double the window rather
+ * than repeat it. ⚠️ #135 C0 took the base 240s -> 600s; deliberate, see
+ * CHANGELOG (council A1, PR #182).
+ *
+ * ⚠️ CLAMPED STRICTLY BELOW the leg timeout, not TO it (#219, council gpt
+ * major). `Math.min(2 * backstop, legTimeoutMs)` made the two deadlines EQUAL
+ * whenever `2 * backstop >= legTimeoutMs` — exactly CI today (2 x 480000 ===
+ * 960000 === `--timeout 16`). The backstop still won, but only by epsilon and
+ * only because the poll loop tests its deadline BEFORE sleeping, so the final
+ * poll lands just past the wall. That is an undocumented accident of loop order;
+ * if it ever lost, the leg would die a generic `timeout` and throw away the
+ * named NO_OUTPUT_BACKSTOP diagnosis this clamp exists to preserve.
+ *
+ * A PROPORTIONAL headroom, not a fixed subtraction: a constant large enough to
+ * beat a poll cycle (seconds) would drive a small leg cap to zero or negative,
+ * and `ms <= 0` is the documented DISABLE hatch — silently disabling the backstop
+ * is far worse than the race it fixes. 5% of any realistic leg cap clears the 2 s
+ * poll interval by a wide margin.
+ *
+ * `2 * 0 === 0` still disables, because `Math.min(0, anything positive) === 0`.
+ */
+
+'use strict';
+
+/**
+ * @param {number} baseBackstopMs the first attempt's resolved no-output window
+ * @param {number} legTimeoutMs the per-leg hard cap ((o.timeout || 15) * 60_000)
+ * @returns {number} the retry's window: doubled, clamped strictly below the cap
+ */
+function retryBackstopMs(baseBackstopMs, legTimeoutMs) {
+  // ⚠️ NOT floored at the first attempt's window, and #219 round 2 (glm) asked
+  // for exactly that — correctly observing that when `legTimeoutMs <= 2 * base`
+  // the retry window comes out slightly SHORTER than the attempt it exists to
+  // give room to (480000/480000 -> 456000). The observation is right; the remedy
+  // is worse than what it fixes, MEASURED across all three regimes:
+  //
+  //   regime            first(effective)   unfloored   floored   unfloored gives
+  //   cap = 2x base           480000        912000     912000    NAMED backstop
+  //   cap = base              480000        456000     480000    NAMED backstop
+  //   cap < base (t=3)        180000        171000     180000    NAMED backstop
+  //
+  // Flooring pins the window ONTO the leg cap in both degenerate regimes, which
+  // is the tie the headroom exists to break — so the leg dies a generic
+  // `timeout` and the named diagnosis is lost. That diagnosis is this module's
+  // entire purpose. The unfloored cost is bounded at 5% of the window (24 s at
+  // CI scale, 9 s at `--timeout 3`), and it is paid only where the leg cap
+  // already dominates the backstop. Trading ≤5% of one retry's patience for a
+  // named cause on every retry death is the right side of that trade.
+  return Math.min(2 * baseBackstopMs, Math.floor(legTimeoutMs * 0.95));
+}
+
+module.exports = { retryBackstopMs };

package/src/council/run-retry.js

@@ -17,6 +17,7 @@
 const { materializeReviews, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
 const { resolveNoOutputBackstopMs } = require('../utils/no-output-backstop');
+const { retryBackstopMs } = require('./run-retry-window');
 const { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote }
   = require('./run-retry-notes');
 // briefingFor + bindRetryWave live in ./run-retry-launch (v4.8 T-A2 split); the pad/bind core it wraps is stage1-bind.js :: bindPaddedWave (SI-27).
@@ -54,17 +55,13 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [],
   const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [], twins,
     stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [],
     stillDeadRetryLegs: [], seatOf: new Map(), orphanLegs: [], attemptedSeats: new Set() };
-  // Task 5 (#129): SL-2 retries the SAME model under the SAME conditions, so a
-  // latency failure is structurally unhealable. Double the window, clamped to
-  // the leg timeout so the failure CLASS stays NO_OUTPUT_BACKSTOP rather than
-  // silently becoming an ordinary timeout at a low --timeout. 2*0 === 0 keeps
-  // the disable hatch. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
-  // ⚠️ #135 C0 took this 240s -> 600s; deliberate, see CHANGELOG (council A1, PR #182).
+  // The retry window: doubled and clamped strictly below the leg timeout.
+  // Reasoning (and #219's correction) lives in ./run-retry-window — extracted
+  // for the 300-line gate. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
   const legTimeoutMs = (o.timeout || 15) * 60 * 1000;
-  const escalatedBackstopMs = Math.min(
-    2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs()),
-    legTimeoutMs,
-  );
+  const escalatedBackstopMs = retryBackstopMs(
+    Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs(),
+    legTimeoutMs);
 
   for (const unit of groupStage1Losses(o, deadWaves, deadLegs, seatOf, twins)) {
     // Task-4 review hardening: a unit this pass cannot even ATTEMPT — an

package/src/council/run-stage2.js

@@ -23,6 +23,9 @@ const stage2 = require('./briefings-stage2');
 const { parseJudgeOutput } = require('./parse-stage2');
 const { sanitizeName, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
+// #219 (council, glm minor): `leg.error` is UNTRUSTED provider text. The house
+// sanitizer — one sanitizer, one dialect (utils/text-sanitize.js).
+const { collapseExcerpt } = require('../utils/text-sanitize');
 const { buildRunStatsEntry } = require('./run-assemble');
 // v4.8 PR3 Task 4: seat binding. artifactName is NOT re-exported from
 // run-launch.js (its exports stop at sanitizeName/isAbortExit), so it comes
@@ -169,9 +172,16 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
       fs.writeFileSync(path.join(o.runDir, name), leg.summary, { mode: 0o600 });
     }
     let conformance = 'clean';
-    let parsed = (leg.status === 'complete' && leg.summary)
-      ? parseJudgeOutput(leg.summary, parseCtx)
-      : { ok: false, errors: [{ code: 'DEAD_LEG', detail: leg.error || leg.status }] };
+    // #202: ONE predicate for "this judge never answered at all", shared by the
+    // DEAD_LEG classification below and by the degrade it now raises. Spelling it
+    // twice is how the two would drift into disagreeing about which judges died —
+    // and note it is NOT `leg.status !== 'complete'`: a leg that completes with an
+    // EMPTY summary produced nothing either, and the DEAD_LEG arm has always
+    // treated it that way.
+    const legDied = !(leg.status === 'complete' && leg.summary);
+    let parsed = legDied
+      ? { ok: false, errors: [{ code: 'DEAD_LEG', detail: leg.error || leg.status }] }
+      : parseJudgeOutput(leg.summary, parseCtx);
     let attempts = 0;
     // ⚠️ LC-12: the judging text the repair prompt must carry, tracked exactly like
     // Stage-1's `repairing` so `judging` and `parsed.errors` always describe the SAME
@@ -216,6 +226,40 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
       if (parsed.ok) { conformance = 'repaired'; }
     }
     if (!parsed.ok) {
+      // #202: THE MISSING THIRD CASE. A dead judge leg still comes back as a leg
+      // object, so bindPaddedWave binds it — it is neither `orphan` nor
+      // `unbound`, and stage 2 had no case for it. It fell through into
+      // judgeResults with `ok:false` and vanished: MEASURED on CI run
+      // 32956900910 (wave 9d8029c8-s2), where glm and qwen judges died at +300s
+      // with zero tokens and run.json recorded no degrade at all, while the
+      // verdict shipped a four-column adjudication matrix two of them never
+      // voted in. The one net that might have caught it, `thin-cross-review`,
+      // fires only at `usableJudges < 2`; that run had exactly 2 of 4.
+      //
+      // ⚠️ Emitted with the default kind ('degrade'), so run-degrade.js's sink
+      // sets `degraded.value` and the run exits 2. That is a deliberate
+      // behaviour change (owner's call): before it, a half-adjudicated verdict
+      // could exit 0, and W11 only exited 2 because of an unrelated
+      // cost-accounting degrade. An unparseable-but-ANSWERED judge is a
+      // different fact and is deliberately excluded — it already darkens the
+      // seat's row via `conformance: 'unstructured'`, and it is repairable.
+      if (legDied) {
+        ctx.degrade.note({
+          channel: 'stage2-judge',
+          what: `judge ${judge} did not adjudicate`,
+          // #219: `why` is PROSE — it renders into run.json, the report and the
+          // sticky PR comment — so the provider's text is collapsed to one
+          // bounded line. `data.reason` below stays VERBATIM on purpose: it is
+          // the machine surface, it is JSON (nothing to inject), and truncating
+          // it would cost exactly the fidelity a reader opens run.json for.
+          why: `its Stage-2 leg ended '${leg.status}'`
+            + (leg.error ? `: ${collapseExcerpt(leg.error, 200)}` : ''),
+          effect: `the cross-review was adjudicated by fewer than the ${judges.length} judges the `
+            + 'bench implies; the run continues and will exit degraded (2)',
+          data: { judge, seat: seat ? seat.id : null, waveId: `${o.runId}-s2`,
+            status: leg.status, reason: leg.error || null },
+        });
+      }
       judgeResults.push({ judge, seat, ok: false, order: null, orderSeats: null, adjudications: null,
         conformance: leg.status === 'complete' ? 'unstructured' : 'clean',
         // #83 (v4.6 Plan 2): the judge's ORIGINAL Stage-2 wave leg, mirroring

package/src/council/tally.js

@@ -6,6 +6,11 @@ const { peersOf, unattributedPeerDrops } = require('./peer-split');
 // the seat-keying in it — release Constraint 6 is EXTRACT, never shave).
 // computeStreetCred is re-exported below, so no existing import path moved.
 const { computeStreetCred } = require('./street-cred');
+// #202: the TTFT probe's LAST emit gate — a RE-PROJECTION, so omitting the field
+// here destroyed one already produced rather than failing to produce it. Through
+// v4.9.1 utils/ttft.js's docblock enumerated only the four PRODUCER gates and
+// stopped one short of this one; it now names all five.
+const { isMeasuredTtft } = require('../utils/ttft');
 
 /**
  * Peers-only tier cascade. a/d are agree/dispute counts among PEER judges
@@ -181,6 +186,13 @@ function tally(input) {
       ...(r.seat ? { seat: r.seat } : {}),
       status: r.status || 'unknown',
       durationMs: typeof r.durationMs === 'number' ? r.durationMs : null,
+      // #202: emit-when-VALID, in buildRunStatsEntry's own slot (between
+      // durationMs and usage) so G7b's key-order invariant holds for a row that
+      // carries it. NOT `durationMs`'s null-coercion above: a null here would be
+      // read as a measurement, and absence must keep its one meaning — "no
+      // substantive tick was ever observed". The shared predicate is imported
+      // rather than hand-spelled; this file has no require-free pin.
+      ...(isMeasuredTtft(r.ttftMs) ? { ttftMs: r.ttftMs } : {}),
       usage: r.usage || null,
     })),
     tierCounts: countTiers(outFindings),

package/src/council/verdict-seats-reviewed.js

@@ -0,0 +1,60 @@
+/**
+ * @module council/verdict-seats-reviewed
+ * #202: the bench-seat census for verdict.json, as a spreadable fragment.
+ *
+ * ⚠️ EXTRACTED, not shaved — release Constraint 6, and the same 300-line gate
+ * that put `verdict-seat-loss.js` in its own leaf: adding this to verdict.js
+ * took that file to 313/300. It could not join verdict-seat-loss.js either —
+ * that module is pinned to export EXACTLY its two functions.
+ *
+ * This is the ONE place that decides what "a bench seat" means, so the
+ * emit-when-set rule and the role filter cannot drift apart. `of` is every
+ * `role:'seat'` row — one per bench seat POST-retry, so a healed seat counts
+ * once while its first attempt is `role:'superseded'`; judges, chair and
+ * repairs are not bench seats. `reviewed` is those whose leg completed: a
+ * `timeout` is not a review any more than an `error` is.
+ *
+ * A LEAF: it requires nothing, matching its seat-loss sibling.
+ */
+
+'use strict';
+
+/**
+ * @param {Array<object>|undefined} runStats
+ * @returns {{seatsReviewed?: {reviewed: number, of: number}}}
+ */
+/**
+ * Is this runStats row a BENCH seat — something that was asked to review?
+ *
+ * ⚠️ These are exactly the three roles `seats.js :: buildSeats` mints, and that
+ * is the point: it is the producer, so this mirrors it rather than guessing.
+ * `role === 'seat'` alone (#219) counted ZERO on a `--lenses` run, where every
+ * seat carries `lens:<slug>` — so emit-when-set silently omitted the census from
+ * the runs using the richest bench. A critic counts too: it is an adversarial
+ * seat, but it reviews.
+ *
+ * An ALLOWLIST, not a denylist of judge/chair/repair/superseded: a new
+ * non-bench role added later must not silently inflate the denominator.
+ */
+function isBenchRole(role) {
+  return role === 'seat' || role === 'critic'
+    || (typeof role === 'string' && role.startsWith('lens:'));
+}
+
+function seatsReviewedOf(runStats) {
+  // ⚠️ `Array.isArray`, NOT `runStats || []`. buildVerdict is reachable on
+  // externally-supplied records that never touched tally() in-process — the MCP
+  // `record` param of mcp-tools.js :: amicus_verdict is `z.record(z.any())`,
+  // fully permissive — and this file's own tests hand it `runStats: {}`. A
+  // truthy non-array sails past `||` and throws on `.filter`, turning a missing
+  // census into a crashed verdict build. The closed-literal comment further down
+  // makes the same argument about the same caller.
+  const seats = (Array.isArray(runStats) ? runStats : []).filter(r => r && isBenchRole(r.role));
+  if (seats.length === 0) { return {}; }
+  return { seatsReviewed: {
+    reviewed: seats.filter(r => r.status === 'complete').length,
+    of: seats.length,
+  } };
+}
+
+module.exports = { seatsReviewedOf };

package/src/council/verdict.js

@@ -13,6 +13,10 @@ const { summarizeSeatLoss, deriveSeatLoss } = require('./verdict-seat-loss');
 // opts.overallVerdict, null in every Stage-4 manual path).
 const VERDICT_SCHEMA_VERSION = 2;
 
+// #202: the bench-seat census leaf (the 300-line gate — same reason
+// verdict-seat-loss.js is its own module).
+const { seatsReviewedOf } = require('./verdict-seats-reviewed');
+
 /**
  * Merge a tally record with Claude's Stage-4 decisions into the verdict record.
  * @param {object} record  tally() output
@@ -123,6 +127,25 @@ function buildVerdict(record, decisions = [], opts = {}) {
     // Additive and OPTIONAL (schemaVersion stays 2): present only when a critic
     // was requested, so its absence never has to be interpreted.
     ...(opts.seatLoss ? { seatLoss: opts.seatLoss } : {}),
+    // #202: how much of the bench actually reviewed. DERIVED here rather than
+    // passed in, because every caller that could pass it already has the same
+    // `runStats` this reads — and a parameter is one more thing a rebuild path
+    // can forget (the `intent` key needed a SECOND carrier for exactly that).
+    //
+    // Its sibling `seatLoss` cannot serve: `deriveSeatLoss` returns null when no
+    // `--critic` was requested, and CI runs `CRITIC: ''` — so seat loss is
+    // STRUCTURALLY absent from every CI verdict. MEASURED on run 4424218c, a
+    // two-seat bench that published a four-model street-cred table with the dead
+    // seats rendered `n/a`, indistinguishable from the legend's "neutral".
+    //
+    // Counts the BENCH roles buildSeats mints — `seat`, `critic` and `lens:<slug>`
+    // (#219 r2: this said "`role:'seat'` ONLY" after the filter was widened, and
+    // two seats caught the stale sentence). One row per bench seat POST-retry, so a
+    // healed seat is counted once (its first attempt is `role:'superseded'`), and
+    // judges/chair/repairs are not bench seats. Emit-when-set — a record with no
+    // bench rows carries no key, because `0 of 0` would read as a measurement of
+    // an empty bench rather than as the absence it is.
+    ...seatsReviewedOf(record.runStats),
     // v4.6 Plan 2 (spec §4): the canonical what-was-lost surface. Additive and
     // OPTIONAL — present only when the run actually degraded, so a clean run's
     // verdict is byte-for-byte unchanged. schemaVersion stays 2 (the v4.5.2

package/src/headless.js

@@ -25,6 +25,8 @@ const { envNumber } = require('./utils/env-num');
 const { engineErrorForSession } = require('./utils/engine-log');
 // v4.9 W10 (#133 piece 3): the standing engine version-skew record, if any.
 const { currentEngineSkew, formatSkewSuffix } = require('./utils/engine-skew');
+// #202: the session-status clause on a death report (see utils/session-status.js).
+const { formatSessionStatusSuffix } = require('./utils/session-status');
 // v4.9 W13 Task A (PR #207 round 3, B3): the one honesty predicate every ttftMs
 // emit gate shares — see src/utils/ttft.js for why `typeof` was not it.
 const { isMeasuredTtft } = require('./utils/ttft');
@@ -85,7 +87,18 @@ const STABLE_FINISHED_POLLS = Number(process.env.AMICUS_STABLE_FINISHED_POLLS) |
 const STABLE_IDLE_POLLS = Number(process.env.AMICUS_STABLE_IDLE_POLLS) || 30;          // ~60s at 2s — no completion signal
 const POLL_CALL_TIMEOUT_MS = Number(process.env.AMICUS_POLL_CALL_TIMEOUT_MS) || 30000; // per getMessages call (used by a later task)
 const MAX_CONSECUTIVE_POLL_FAILURES = Number(process.env.AMICUS_MAX_CONSECUTIVE_POLL_FAILURES) || 15; // ≈30s at 2s polls
-const TOOL_CALL_STALL_MS = Number(process.env.AMICUS_TOOL_CALL_STALL_MS) || 180000; // B53: wedged tool call w/ no progress
+// B53: wedged tool call w/ no progress.
+// ⚠️ 180000 -> 300000 (#219, council glm minor). 180 s was condemned by this
+// file's OWN measurement — the 190.6 s `task` call recorded below, taken on a
+// developer machine, not on CI. #202 widened only the CI override and left every
+// local and library consumer on the number the evidence had already disproved.
+// 300000 matches the sibling constant that same measurement set (USAGE/settle
+// deferral below), so one measurement now governs both windows it bears on.
+const TOOL_CALL_STALL_MS = Number(process.env.AMICUS_TOOL_CALL_STALL_MS) || 300000;
+// #202: budget for the ONE session-status read on a death report. Short on
+// purpose — this runs on a leg already known to be dying, so the report must not
+// wait on the same engine that just failed to produce anything.
+const STATUS_PROBE_MS = 5000;
 /**
  * v4.4 B1 — bounded post-loop usage reconciliation. The fold-marker (:~540) and
  * SDK-idle (:~568) fast paths break WITHOUT requiring `info.time.completed`, but
@@ -120,9 +133,11 @@ const USAGE_SETTLE_CALL_TIMEOUT_MS = envNumber('AMICUS_USAGE_SETTLE_CALL_TIMEOUT
  * unbounded wait is not an option.
  *
  * WHY 5 MINUTES. The measured duration of the real subagent call that exposed
- * this is **190.6 s** (`task`, 04:35:08.427 → 04:38:19.061) — already longer
- * than B53's 180 s TOOL_CALL_STALL_MS, so anything at that scale would kill a
- * healthy `task` leg 10 s short of its answer. 300 s clears the measured case
+ * this is **190.6 s** (`task`, 04:35:08.427 → 04:38:19.061) — which was longer
+ * than B53's THEN-180 s TOOL_CALL_STALL_MS, so anything at that scale would kill
+ * a healthy `task` leg 10 s short of its answer. (#219 finally moved B53 itself
+ * to 300 s for this exact reason; for four releases this measurement corrected
+ * the neighbour and left its own subject alone.) 300 s clears the measured case
  * with margin and still lands far inside the 15-minute default `--timeout`.
  * Set to 0 to disable the deferral entirely (pre-v4.4 behaviour).
  *
@@ -228,7 +243,7 @@ function withTimeout(promise, ms, label) {
  *          engineSkew?: {server: string, installed: string}|null}} args
  * @returns {string}
  */
-function formatNoOutputBackstopReason({ ms, fromEnv, engineLogExcerpt, engineSkew }) {
+function formatNoOutputBackstopReason({ ms, fromEnv, engineLogExcerpt, engineSkew, sessionStatus }) {
   const observed = 'NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in '
     + `${Math.round(ms / 1000)}s — `
     + (fromEnv
@@ -237,7 +252,11 @@ function formatNoOutputBackstopReason({ ms, fromEnv, engineLogExcerpt, engineSke
   // Append-only: absent/empty excerpt ⇒ the string above, unchanged byte for byte.
   const quoted = engineLogExcerpt ? `${observed} — engine log: ${engineLogExcerpt}` : observed;
   // Append-only for the same reason: no skew ⇒ formatSkewSuffix returns ''.
-  return `${quoted}${formatSkewSuffix(engineSkew)}`;
+  // #202 adds a THIRD clause on the same terms, and LAST so both clauses above
+  // stay byte-stable: no status (or an unreadable one) ⇒ '' — see
+  // utils/session-status.js. With none of the three the string is byte-for-byte
+  // what it was before any of them existed.
+  return `${quoted}${formatSkewSuffix(engineSkew)}${formatSessionStatusSuffix(sessionStatus)}`;
 }
 
 /**
@@ -259,6 +278,45 @@ function engineErrorExcerptSafe(sessionId, engineLogOptions) {
   }
 }
 
+/**
+ * #202: read the engine's session status FOR A DEATH REPORT — best-effort and
+ * bounded, with the same "never become the failure it reports on" discipline as
+ * `engineErrorExcerptSafe` above, and one more constraint that read does not
+ * have: this one does I/O against the very engine that just failed to produce
+ * anything, so it must also be unable to HANG. Both belts are load-bearing and
+ * both are pinned (S-W4 rejects, S-W5 hangs).
+ *
+ * A failed probe returns `null`, which `formatSessionStatusSuffix` renders as
+ * '' — so a leg whose status could not be read carries the byte-for-byte reason
+ * string it carried before #202, rather than a clause claiming nothing was
+ * happening. Absence keeps its one meaning.
+ *
+ * `readStatus` is a parameter rather than a module import because
+ * `getSessionStatus` is destructured inside runHeadless from the injectable
+ * client module — taking it here keeps this helper pure and directly testable.
+ * @returns {Promise<object|null>}
+ */
+async function sessionStatusSafe(readStatus, client, sessionId, dirArgs, ms) {
+  // `!(ms > 0)` covers 0 (the documented disable), negatives and NaN — and it is
+  // why 0 is never handed to withTimeout, which would read it as UNBOUNDED.
+  if (typeof readStatus !== 'function' || !sessionId || !(ms > 0)) { return null; }
+  try {
+    return await withTimeout(
+      readStatus(client, sessionId, ...(dirArgs || [])), ms, 'getSessionStatus(death-report)');
+  } catch (err) {
+    // #219 (council, deepseek minor): returning null is right for the REPORT —
+    // absence keeps its one meaning — but it made a probe that timed out on a
+    // loaded engine indistinguishable from a leg whose engine reported nothing,
+    // i.e. a silent revert to pre-#202 behaviour. The engine log is where that
+    // belongs: the death report stays byte-identical, and the degradation
+    // becomes diagnosable instead of invisible.
+    logger.debug('session-status probe failed; the death report will carry no session clause', {
+      sessionId, error: err && err.message,
+    });
+    return null;
+  }
+}
+
 /**
  * Wait for the OpenCode server to be ready using SDK health check
  */
@@ -616,6 +674,19 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // "time since the leg asked for output" (see the block comment above), so
     // the TTFT probe below measures from exactly the instant the backstop
     // starts counting — the two can never disagree about when the wait began.
+    // #202: resolved HERE, not with the poll-loop options below. The pre-send
+    // firing site calls noOutputBackstopReason() upstream of that block, so a
+    // later `const` put this in its TDZ and the death report became
+    // "Cannot access 'statusProbeMs' before initialization" — the exact class of
+    // silent-diagnosis loss #202 exists to remove. Pinned by S-W6.
+    // ⚠️ `=== undefined`, not `||` (#219 round 2, deepseek): 0 is a meaningful
+    // value in this codebase's convention (usageSettlePolls,
+    // AMICUS_NO_OUTPUT_BACKSTOP_MS) and must survive injection. It cannot be
+    // FORWARDED as 0 though — withTimeout reads `ms <= 0` as NO timeout, so an
+    // honest-looking 0 would make this probe unbounded on a leg already known to
+    // be dying. sessionStatusSafe therefore SKIPS on a non-positive window.
+    const statusProbeMs = options.statusProbeMs === undefined
+      ? STATUS_PROBE_MS : options.statusProbeMs;
     const outputClockStartedAt = Date.now();
     const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: outputClockStartedAt });
     let backstopFired = false;
@@ -642,10 +713,20 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // was fixed mid-run, or one that belongs to another server this process
     // also talks to, cannot ride out on this death report. The read is a Map
     // lookup and does no I/O, so unlike the log read it needs no guard.
-    const noOutputBackstopReason = () => formatNoOutputBackstopReason({
+    //
+    // #202 (piece 4): the closure is now ASYNC, because the third clause costs
+    // one bounded HTTP call. The engine's session status is asked for at
+    // :~1045 only when `mirror.output.length > 0` — a gate a zero-output leg
+    // never satisfies — so the leg that most needs diagnosing was the only one
+    // that never asked, and every silent death reported a window with no cause.
+    // Asked for HERE instead, at the two firing sites and nowhere else, so a
+    // living leg still makes no extra call. The read is best-effort and
+    // bounded: `sessionStatusSafe` can neither throw nor hang (S-W4/S-W5).
+    const noOutputBackstopReason = async () => formatNoOutputBackstopReason({
       ms: noOutputBackstopMs, fromEnv: backstopFromEnv,
       engineLogExcerpt: engineErrorExcerptSafe(sessionId, options._engineLog),
       engineSkew: currentEngineSkew(client),
+      sessionStatus: await sessionStatusSafe(getSessionStatus, client, sessionId, dirArgs, statusProbeMs),
     });
 
     // Send prompt asynchronously (returns immediately, we poll for results) —
@@ -696,7 +777,7 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // skipped entirely on this path — see the while-condition and the
     // backstop-abort block further down).
     if (backstopFired) {
-      sessionError = noOutputBackstopReason();
+      sessionError = await noOutputBackstopReason();
     }
 
     // Hard provider failure detected at the client boundary (#37): a non-2xx /
@@ -1065,7 +1146,7 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
         // loop; the post-loop block below mirrors the timeout path.
         if (noOutputBackstop.tick(substantiveActivity, Date.now()) === 'fired') {
           backstopFired = true;
-          sessionError = noOutputBackstopReason();
+          sessionError = await noOutputBackstopReason();
           logger.warn('No-output backstop fired', { taskId, backstopMs: noOutputBackstopMs });
           break;
         }

package/src/utils/degrade.js

@@ -24,6 +24,14 @@ const DEGRADE_CHANNELS = Object.freeze(new Set([
   // a leg that DID match a slot but whose join key names no judge the wave launched.
   // Never a guess — silent mis-attribution is the failure seat identity exists to kill (§4.4).
   'seat-unbound',
+  // #202: a Stage-2 JUDGE leg that came back dead — bound to its seat, so
+  // neither `seat-unbound` nor an orphan, and until now it had no channel at all
+  // and no case in run-stage2.js. Deliberately its own channel rather than
+  // `dead-leg`: that one is the Stage-1 BENCH roster's, feeds the retry pass and
+  // the seat-loss surface, and a judge death reused on it would be counted as a
+  // lost reviewer by consumers that only ever meant seats (verdict-seat-loss.js
+  // already gates the Stage-2 notes out of `seat-unbound` for the same reason).
+  'stage2-judge',
   'internal',
   // doctor channels
   'doctor-check-failed', 'doctor-fix',

package/src/utils/session-status.js

@@ -0,0 +1,73 @@
+/**
+ * @module utils/session-status
+ * #202: render the engine's SESSION STATUS as a clause on a leg's death report.
+ *
+ * ⚠️ The JSDoc leads this file, ahead of `'use strict'`, matching
+ * `utils/ttft.js` / `utils/text-sanitize.js` / `utils/engine-skew.js`:
+ * `scripts/generate-docs.js` only reads a block comment that starts at byte
+ * zero, so a `// path` line above it would leave this module's CLAUDE.md row
+ * blank.
+ *
+ * WHY THIS EXISTS. `headless.js` asks the engine for session status only inside
+ * `if (mirror.output.length > 0)` — a gate a zero-output leg never satisfies. So
+ * the one leg that needs diagnosing is precisely the one that never asks, and
+ * every silent death was reported as "no output in Ns" with no cause attached.
+ * The pinned SDK publishes `SessionStatus` as
+ * `{type:'idle'} | {type:'retry', attempt, message, next} | {type:'busy'}`, and
+ * the `retry` arm carries the upstream error verbatim.
+ *
+ * NONE of the three types is suppressed as uninteresting — they point in
+ * DIFFERENT directions, and which one comes back is the discrimination #202
+ * spent six CI runs failing to make by argument:
+ *   · `busy`  — the engine is still waiting on the provider ⇒ provider-side.
+ *   · `idle`  — the engine believes it is DONE having produced nothing ⇒
+ *               engine-side, which is the shape #133 turned out to be.
+ *   · `retry` — the engine is re-attempting, and says why ⇒ the named cause.
+ *
+ * ⚠️ APPEND-ONLY, exactly like `engine-skew.js :: formatSkewSuffix`: no status
+ * (or an unusable one) returns `''`, so a reason string built without one is
+ * byte-for-byte what it was before this module existed, and
+ * `sidecar/models-probe.js`'s `/^NO_OUTPUT_BACKSTOP:/` classification — a PREFIX
+ * test — is unaffected either way.
+ *
+ * ⚠️ `message` is UNTRUSTED third-party text: it originates at the provider,
+ * lands in run.json, and on CI is rendered into a sticky PR comment. It goes
+ * through the house sanitizer (`text-sanitize.js :: collapseExcerpt`) at a short
+ * cap rather than being trusted to the workflow's downstream sed rules — one
+ * sanitizer, one dialect, per that module's own ruling.
+ */
+
+'use strict';
+
+const { collapseExcerpt } = require('./text-sanitize');
+
+/** Short cap: this is a clause on a one-line death report, not a log dump. */
+const MAX_STATUS_MESSAGE_CHARS = 200;
+
+/**
+ * The death-report clause for an engine session status.
+ * @param {*} status - an SDK SessionStatus, or anything at all
+ * @returns {string} ` (session: …)`, or '' when nothing usable was observed
+ */
+function formatSessionStatusSuffix(status) {
+  if (!status || typeof status !== 'object') { return ''; }
+  // A non-string `type` is DROPPED rather than coerced: `String({})` renders
+  // '[object Object]', which would read as an observation rather than as the
+  // absence it actually is.
+  if (typeof status.type !== 'string') { return ''; }
+  // ⚠️ CLASSIFY on the RAW value, RENDER the sanitized one (#219 round 2,
+  // deepseek). Branching on the sanitized type let the sanitizer's own
+  // normalisation decide the arm — anything collapsing to 'retry' took the retry
+  // path — so a future SDK identifier could be misclassified by a function whose
+  // job is display, not semantics. Only the exact published identifier routes.
+  const type = collapseExcerpt(status.type, 40);
+  if (!type) { return ''; }
+  // An unrecognised type is still reported. A future SDK arm must not read as
+  // "no status was observed" — that silence is what this clause removes.
+  if (status.type !== 'retry') { return ` (session: ${type})`; }
+  const attempt = Number.isFinite(status.attempt) ? ` attempt ${status.attempt}` : '';
+  const raw = collapseExcerpt(status.message, MAX_STATUS_MESSAGE_CHARS);
+  return ` (session: retry${attempt}${raw ? ` — ${raw}` : ''})`;
+}
+
+module.exports = { formatSessionStatusSuffix, MAX_STATUS_MESSAGE_CHARS };

package/src/utils/ttft.js

@@ -9,12 +9,23 @@
  * blank the way `utils/result-schema.js`'s already is.
  *
  * `ttftMs` is produced once — in `src/headless.js`'s poll loop, as a
- * `Date.now()` delta — and then passes four EMIT GATES on its way to a
+ * `Date.now()` delta — and then passes five EMIT GATES on its way to a
  * document: `headless.js`'s three returns, `sidecar/fanout-leg.js`'s leg patch,
- * `utils/result-schema.js :: buildRunResult`, and
- * `council/run-stats-entry.js :: buildRunStatsEntry`. Every gate used to spell
- * its own `typeof x === 'number'` test, which is four chances to disagree and
- * four ways to publish a value both schemas forbid.
+ * `utils/result-schema.js :: buildRunResult`,
+ * `council/run-stats-entry.js :: buildRunStatsEntry`, and
+ * `council/tally.js :: tally`'s runStats re-projection. Every gate used to spell
+ * its own `typeof x === 'number'` test, which is five chances to disagree and
+ * five ways to publish a value both schemas forbid.
+ *
+ * ⚠️ The fifth gate is different in KIND from the four above it, which is why it
+ * was missed for a release (#202). Those four are PRODUCERS — each writes the
+ * field onto a document it is building. `tally.js` is a RE-PROJECTION: it copies
+ * an already-built row through a hand-maintained allowlist, so omitting the field
+ * there does not fail to produce it, it DESTROYS one already produced. Between
+ * v4.9.0 and v4.9.1 that is exactly what happened — the probe wrote real values
+ * into tally-input.json and every one was stripped before tally.json and
+ * verdict.json, the only run artifacts CI uploads (MEASURED, run 33030485388:
+ * 11 of 12 rows carried it going in, 0 of 12 coming out).
  *
  * ⚠️ `typeof` is not the schema's contract. `schemas/run.schema.json` and
  * `schemas/council-tally.schema.json` both declare this field
@@ -35,7 +46,7 @@
  * already means "no honest measurement was made", and a dishonest number is
  * exactly that. `0` itself stays a real, emittable measurement.
  *
- * ⚠️ Three of the four gates import this. The fourth,
+ * ⚠️ Four of the five gates import this. The one that does not,
  * `council/run-stats-entry.js`, is pinned REQUIRE-FREE (P3,
  * tests/council/run-stats-entry.test.js — the pin fires on the character
  * sequence anywhere in that file, comments included) so require-free consumers