amicus 4.9.2 → 4.9.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.2",
+  "version": "4.9.4",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,330 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.4] - 2026-09-07
+
+*The effort level was never on the wire, and the budget stopped at the routes the catalog could clamp.*
+
+Every `--thinking <level>` Amicus has ever sent went out as a `reasoning` object the engine's prompt
+endpoint does not read — a silent no-op on every run since the flag existed, measured on the wire
+(probe F1). It now goes out as the engine's `variant` field, checked first against what the engine's
+own catalogue declares for the model, so a level the model does not declare is refused before
+anything is sent instead of being dropped in silence. Beside it, `outputBudget` becomes
+bidirectional and reaches every route but the direct `openai` one, whose request carries no
+output-limit field at all; direct-provider rows gain real context and ceiling numbers from
+models.dev; and the death that opened #218 — a leg that spends its whole reservation on reasoning
+and finalizes with no answer text — is named `OUTPUT_LENGTH` rather than passing as a completion
+with an empty summary. Every claim here was measured by a zero-spend wire probe that plays the
+provider, so the pinned engine's outbound fields can be read under each shape Amicus can produce.
+
+### Added
+
+- **Direct-provider output ceilings (#218 P3).** `amicus models --refresh` now fills
+  `contextLength` / `maxOutputTokens` for any `anthropic`, `openai`, `google`, `deepseek` or
+  `openrouter` row still missing a number, from the keyless [models.dev](https://models.dev)
+  index, and lifts Google's own `outputTokenLimit` first-party. The provider's own number
+  always wins — Google's own ceiling and OpenRouter's own value included; models.dev fills
+  only fields the provider left empty or unusable, never a zero, and `openrouter/openrouter/*`
+  routers and local rows are never filled at all. The models.dev call is keyless, bounded by a
+  10 s timeout, and its failure is reported on the refresh line rather than hidden — including
+  a 200 that parses but carries no recognised vendor limits, which is a `bad-shape` failure
+  and not a silent no-op. It is also skippable both ways: a refresh where every candidate row
+  already carries both numbers never makes the call at all, and the new top-level `config.json`
+  key **`modelsDevCeilings: false`** opts out of contacting models.dev entirely (the anthropic /
+  deepseek direct rows then carry no ceiling in the Amicus catalog and are clamped by the engine's
+  own catalog instead, and the direct openai rows send no output reservation at all regardless
+  — M5/M13/M22; Google publishes its own ceiling and OpenRouter rows keep OpenRouter's). The
+  refresh prints the outcome (`Ceilings: …`), naming which of those happened, and `--json`
+  carries it as `ceilingEnrichment`. Effect: no request changes with `outputBudget` unset;
+  direct-provider rows now carry context and ceiling numbers (visible in `amicus models`), and
+  `outputBudget` can clamp the direct `google` / `deepseek` routes once the catalog is refreshed
+  — which 4.9.3 documented as impossible because those lists "don't publish one". The direct
+  `openai` route is the exception, measured in PR 4 (probe M5/M13/M22): the engine drives that
+  provider through the Responses API, whose request carries no output-limit field at all, so
+  neither the descriptor nor the flag changes what goes out there and a budget never reaches it;
+  `doctor` lists such routes apart. Direct `anthropic/*` was held out of clamping by the council
+  review of PR #230 until the thinking-budget interaction was measured; PR 2 measured it and
+  lifted the hold-out — see the next bullet.
+- **`outputBudget` now works in both directions (#218 PR 2).** A budget above the engine's 32,000
+  default is honoured: Amicus starts every engine with `OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX` set to
+  the budget — around the spawn only, restored before anything is awaited, never written to the
+  caller's shell; a value you exported yourself is honoured untouched when no budget is set — so
+  every leg reserves `min(budget, ceiling)` wherever a ceiling is known (every leg but a direct
+  `openai` one — that route carries no reservation field, see the previous bullet), by the Amicus
+  catalog through the per-model descriptor or else by the engine's own, and a model neither knows
+  receives the budget as-is, exactly as it received the raw 32,000 before. Direct `anthropic/*`
+  routes are no longer held out: the probe measured the descriptor lowering the reservation there
+  (K1), a thinking variant's budget added on top (K2: 8,000 + 16,000 = 24,000) and the sum clamped
+  to the model's real ceiling (K3/K4/K10), so no budget can push a thinking leg over it. Thirteen
+  new probe rows (K1–K13) pin every shape this ships, and the full 32-case matrix is filed in the
+  BACKLOG. New `doctor` row **`output-budget`** says what the value reaches — routes the catalog can
+  clamp, routes it cannot, an ambient flag honoured or overridden — and flags the one silent failure
+  the engine has here: a malformed budget or flag, on which it falls back to 32,000 without a word.
+- **`scripts/probe-max-tokens.js`.** A zero-spend wire probe: a local capture server plays the
+  provider so the pinned engine's outbound `max_tokens` / `reasoning` / `thinking` fields can be
+  read under every descriptor, env-flag and prompt shape amicus can produce. Re-run after every
+  engine bump.
+- **The "Mode 2" death is named (#218 PR 3).** A leg whose provider stopped at the `max_tokens`
+  reservation before any answer text on the message it finalized — the whole reservation spent on
+  reasoning; a tool loop's earlier text or promoted reasoning does not count — now ends `error`
+  with a reason starting `OUTPUT_LENGTH:` that carries the engine's own reasoning/output counts for
+  the leg and the `outputBudget` in force (or the ambient `OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX`
+  the engine was started with, when no budget is set), and the poll loop exits the moment the engine
+  finalizes such a message instead of waiting out the no-output backstop. The engine records `finish`
+  on the finalized assistant message (measured on both provider families for a length stop); it now
+  rides every leg document (`metadata.json`, `run.json`, the wave doc), the spend-ledger row
+  (`finish`, present only when recorded) and solo session metadata. A review that was cut at the
+  reservation but still answered is kept, announced as a `Note:` on the new `output-truncated` channel
+  (`kind: "info"` — never a loss, never an exit-code change), and marked as cut in its chair-packet
+  header. Five probe rows (L1–L5) measured the shapes: `finish: 'length'` on both provider families;
+  reasoning subtracted from completion on OpenAI-compatible routes but no split on direct Anthropic;
+  a `reasoning` part and no `text` part when the reasoning was visible; and a descriptor above the
+  engine's own ceiling clamped to that ceiling with no thinking variant in play. The probe's capture
+  server now answers with a per-case body and speaks the Anthropic messages SSE, so the direct rows
+  record the assistant message instead of an APIError; the full 37-case matrix is filed in the
+  BACKLOG.
+- **`--thinking` reaches the engine (#218 PR 4).** Every `--thinking <level>` amicus ever sent went
+  out as a `reasoning` object the engine's prompt endpoint does not read — a silent no-op on every
+  run (probe F1). It now goes out as the engine's `variant` field (F2, M1, M12), and it is checked
+  first against what the engine's own catalogue declares for the model (`/config/providers`): a
+  level the model does not declare is refused before anything is sent (`VARIANT_UNDECLARED`, naming
+  the declared set — the engine would have dropped it silently and still echoed it on the message,
+  F3/M7); a declared level whose thinking budget the direct Anthropic route adds on top of the
+  reservation (Haiku 4.5 — M2: 24,000 + 16,000 = 40,000; Opus 4.5 declares the same shape, M0) is
+  refused when `outputBudget` is below the model's ceiling, and also when no ceiling is declared
+  anywhere — there the sum has no clamp to land under (`VARIANT_OVER_BUDGET`, with the reservation
+  the leg would have made and the remedies for each case); a model the engine's catalogue does not
+  know within a five-second wait — its bundled catalogue predates the model and the models.dev fetch
+  has not landed yet, the state of a cold `~/.cache/opencode` (M0 cold vs M12 warm) — gets the level
+  unverified, logged and marked `variantUnverified: true` on the leg document. The same note is
+  printed as a `Notice:` line on stderr, because the structured warning alone is dropped at the
+  default log level. Whether a level counts as declared does not depend on `outputBudget` — the
+  `VARIANT_OVER_BUDGET` fit above is the only refusal a budget can add: `/config/providers` returns a
+  model's row with the catalogue's own release date, family, display name, pricing, capabilities and
+  variants, and Amicus writes only `limit` into it, so a row carrying any of those is a
+  declaration (an empty variants set is a refusal) and a row carrying none of them is Amicus's own
+  descriptor (unknown — the bounded wait, then an unverified send). That dump is the engine's MERGED
+  view of its own catalogue and your `opencode.json`, so model metadata you declare yourself reads as
+  a declaration too. Measured as record M23 and
+  pinned by a keyless engine canary. The wait polls every 500 ms. The ceiling that
+  `VARIANT_OVER_BUDGET` fit judges against is Amicus's own catalog's row for
+  the model — its `maxOutputTokens`, the number a budget-derived descriptor is clamped TO, not the
+  value that descriptor carries — because the engine echoes that descriptor back once a budget is
+  set (M3); for a model that catalog has no row for it is the dump's own value, the engine's own
+  ceiling (K5/K12). `docs/configuration.md` records what a divergence from the engine's own ceiling
+  costs in each direction: a row above it can refuse a leg the engine would have clamped under the
+  budget, and a row below it goes silent on one it never judged. A refusal is a zero-spend leg death
+  through the usual channel (`error` with the reason; a fanout's other legs run; `start --no-ui`
+  exits 1). The MCP `amicus_start` tool's in-process (shared-server) path carries the level too —
+  its `thinking` had been argv-only, which that path never read. A backstop window that fires while
+  a leg is still inside its declaration wait (bounded at five seconds; one read on a warm, declared
+  model) ends the leg `NO_OUTPUT_BACKSTOP` before anything is sent (an abandon signal stops the
+  orphaned send); an unreadable `/config/providers` (a non-2xx, or a read that throws — a transport
+  error, a dead engine) sends the level unverified after ONE read, and the log line says so. `max`
+  joins the vocabulary (`none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max` — the levels the
+  curated routes declare between them, M0). The level SENT rides the run document (`variant`), the
+  spend-ledger row (`variant`, present only when one was sent) and the leg patch. Twenty-four probe
+  rows (M0–M17 and M22, plus M18–M21 through amicus's own `sendPrompt`) measured every shape this
+  ships — the full 61-case matrix is filed in the BACKLOG — and CI's keyless job now also runs M1,
+  M2, M10b and M17. Council seats have no effort knob in this release (filed as the owner's
+  decision).
+
+### Changed
+
+- **A configured `outputBudget` no longer weakens the `--thinking` guard (#218 PR 4, council #235
+  round 3 C1/B1).** Earlier on this unreleased branch, a model whose `/config/providers` row
+  reported no variants was, *with a budget set*, polled for five seconds, reported ambiguous and
+  then sent the level unverified — while the same command with no budget refused it at once. What
+  flips: a model the engine's own catalogue supplied that declares no variants (`openai/gpt-4o`, and
+  the shipped aliases `minimax`, `qwen-coder`, `qwen-flash`) is now refused before anything is sent
+  when a budget is set, exactly as it already was without one — and the five-second wait disappears
+  with it, so a 12-leg fanout on such a model no longer burns 12 × 5 s before failing. What stops
+  being sent is a level nobody could ever use: probe F3/M7 measured an undeclared variant as a
+  certain no-op on the wire, echoed back on the assistant message. The no-budget path is unchanged
+  except for four zero-context openai image rows (`chatgpt-image-latest`, `gpt-image-1.5`,
+  `gpt-image-1-mini`, `gpt-image-2`), which are now refused rather than silently no-op'd. A model
+  the engine has NOT learned yet is unchanged bit for bit: the bounded wait, then an unverified send
+  with `variantUnverified: true` and the `Notice:` line. Under a budget, a stale bundled catalogue
+  can now refuse a level the next run accepts — the refusal says so. The `ambiguous` key is gone
+  from `sentVariant` (it existed only on this unreleased branch, in no schema or document). C1 is
+  not fully closed: its second clause — a genuinely cold direct-Anthropic model with an
+  `enabled + budgetTokens` entry still sending `24,000 + 16,000 = 40,000` marked only
+  `variantUnverified: true` — survives, because N exists only in the post-spawn dump; the filed
+  pre-spawn fit (descriptor = budget − N, proven M17) is the answer and is not built here.
+- **`outputBudget` below 32,000 now reaches every leg but a direct `openai` one (#218 PR 2; the
+  openai exception measured in PR 4, M5/M13/M22).** On 4.9.3 a budget applied only to routes whose
+  ceiling the catalog knew; rows it could not clamp kept the engine's 32,000. The engine flag now
+  carries the budget to those rows too — clamped by the engine's own catalog where it knows the
+  model (K5, K12), as-is on a model it does not (J2, K13). A user who set `outputBudget: 8000` on
+  4.9.3 sees those rows reserve 8,000 after upgrading — except a direct `openai` route, which
+  carries no reservation field at all. A model neither catalog knows receives a raised budget as-is
+  and may be refused by a provider that enforces its ceiling — loudly; `doctor`'s `output-budget`
+  row names such routes.
+- **A length-stopped leg with no answer text is an error, not a completion (#218 PR 3).** On 4.9.3
+  such a leg ended `complete` with an empty summary (a council dropped it as "ended 'complete' with
+  no usable output"; `amicus start --no-ui` exited 0 with "No Output") or, when the provider streamed
+  its reasoning, `complete` with the *thinking* as the review — adjudicated as one. It now ends
+  `error` with the `OUTPUT_LENGTH:` reason — decided on the message the engine finalized, so a tool
+  loop's earlier text neither hides the death nor, once promoted reasoning is replaced by the
+  answer, pollutes a kept review — and a council treats it as any other dead leg: the once-only
+  Stage-1 retry fires and the run degrades if the retry dies too. For the no-output shape that retry
+  is unchanged from 4.9.3; for the promoted-thinking shape it is new — 4.9.3 counted that leg as a
+  review and never retried it, so such a seat now bills one more reservation. `start --no-ui` exits
+  1 with the reason. The ledger row for such a leg reads `status: "error"` where it read `complete`.
+- **A `--thinking` level the model does not declare is refused, not adjusted (#218 PR 4).** On 4.9.3
+  the CLI rewrote `minimal` to `low` and any other unsupported level to `medium` from a static
+  per-model table (gpt-5 "without minimal", gemini "with everything") with a warning, then sent the
+  result as a field the engine never read; the table is gone (a static guess that the engine's
+  catalogue confirms on one row and contradicts on the other: both exclude `minimal` for gpt-5,
+  while the table gave gemini `none` and `xhigh` and gemini-3.6-flash declares neither — M0), the
+  CLI checks only the vocabulary, and the model's own declaration decides at send time. Solo session
+  metadata records `thinking` only when one was requested — it used to record `medium` for every
+  run, including runs that sent nothing. That stamp landed on EVERY session's metadata, **a fanout
+  leg's included**, so a pack saved with `pack save --from-run` on 4.9.3 or earlier copied that
+  `medium` into its `options.thinking` on **fanout packs as well as solo ones** — where it then
+  applies to every seat of the bench at once. Such a pack now SENDS it: refused on every model that
+  does not declare `medium` (kimi-k3, Haiku 4.5, deepseek-v4-pro among the curated routes), and on
+  a model that DOES declare it the level really goes out — so a pack that was inert can now change
+  a run's cost and behaviour. Delete the key or re-save the pack from a run that requested a level.
+  MCP `thinking` parameters no longer claim "Default: medium": omitted means nothing is sent and the provider's
+  default effort governs (on the direct OpenAI route the engine sends `medium` itself, M13). The one
+  case the removal makes worse is the row the table got right: `--thinking minimal` on a gpt-5 route
+  used to be rewritten to `low`, a level the engine really declares, and is now refused — loudly,
+  before anything is sent, which is the trade this release makes deliberately.
+- `src/utils/http-get.js` now owns the always-resolves HTTPS GET that `model-fetcher.js` carried
+  inline; the failure vocabulary (`timeout` / `http-status` / `network-error` / `parse-error`) gains
+  one reason, `too-large`. A response-stream error mid-body and a synchronous throw from `https.get`
+  (a URL it cannot parse) now resolve as `network-error` instead of escaping the promise. Redirects
+  are opt-in per call (`followRedirects`, default off, so the keyed provider fetches are unchanged
+  and a 3xx stays their terminal `http-status` failure); with it on, up to two `https` redirects are
+  followed under one deadline for the whole chain, and a cross-origin hop carries only an allowlist
+  of headers (`user-agent`, `accept`, `accept-language`) so no credential can
+  follow a `Location` to another host. A redirect to a non-`https` target, one with no `Location`,
+  and a third hop are each an `http-status` failure whose `detail` names which, and every one of
+  those refusals releases the connection — the response is retired and the live request destroyed —
+  so a refused 3xx whose body never ends cannot hold the socket open after the promise has settled. Response bodies are capped at 16 MiB
+  (`maxBytes`); an over-size body is destroyed and reported as `too-large` rather than accumulated.
+- CI council bench: `deepseek` moves from `deepseek-v4-pro` to `deepseek-v4-flash-0731` — 1.3M context
+  (was 1M), input ~$0.05/M and output ~$0.10/M on OpenRouter (was ~$0.69/M and ~$1.38/M), output
+  ceiling 131,072 (was 384,000). Bench-only; the shipped alias table is unchanged. The alias-shadow
+  notice now names `deepseek` beside `qwen` as a bench pin that differs from the shipped one.
+- **`amicus continue` / `amicus resume` reject `--thinking` instead of ignoring it (#218 PR 4).**
+  The flag parses on every command (the unknown-flag gate is built from the whole usage string), but
+  neither handler ever read it and the vocabulary check runs only on `start` — so a level typed on a
+  continuation, valid or not, used to exit 0 having done nothing. Both now fail with `BAD_ARGS`
+  naming where the level belongs, the same way `--tag` already does. Each also prints a stderr
+  `Notice:` when the session being reopened records a level, naming it and saying the leg runs at
+  the provider's default — worded as what the metadata RECORDS, since 4.9.3 and earlier stamped
+  `medium` on every session typed or not, so an older session's `medium` may be that stamp rather
+  than a request. Forwarding a level on `continue` is filed, not built.
+
+### Fixed
+
+- **The curated `qwen` alias pointed at a model OpenRouter no longer lists.** Between 2026-09-04 and
+  2026-09-05 both OpenRouter and models.dev renamed `qwen/qwen3.8-max` to `qwen/qwen3.8-max-0902`;
+  the #218 PR 2 probe run caught it (a variant sent for the old id went silent, and its ceiling read
+  `0/0`). The pin now names the dated id. Found and fixed in PR #231; the CI bench map already
+  pinned `qwen3.8-27b` and is unchanged.
+- **`startServer` read `config.json` twice for one budget.** The per-model descriptor and the engine
+  flag each called `loadConfig()`; a config write between the two reads could hand the engine a
+  descriptor from one budget and a flag from another (bounded — the engine takes the smaller — but
+  split). One read now feeds both (#218 PR 3).
+- **CI council read its alias map from the PR's frozen base sha.** `council-review.yml` provisioned
+  `.github/amicus-ci-aliases.json` from `github.event.pull_request.base.sha`, which GitHub fixes at
+  PR creation — so a bench change merged to `main` afterwards never reached an open PR (PR #232's
+  round 3 still reviewed with the pre-#233 map). The map is now read from the base branch name,
+  which resolves to its current tip on every run; still never the PR head.
+- **A cancelled council run discarded its spend receipt (#220).** The receipt step was gated on
+  `!cancelled()`, so the one path where the cost is least visible — a superseded or hand-cancelled
+  run — recorded nothing at all, though the legs it had launched still billed. The receipt now runs
+  on `always()`, and a ledger-only artifact fires ahead of it on the cancelled path so the smallest
+  upload takes the first claim on the runner's bounded post-cancellation grace; the full evidence
+  upload stays `!cancelled()`, because a truncated artifact is worse than none. It is best-effort by
+  construction and the step now says so rather than promising a record, and a test pins the
+  workflow's ledger path against the engine's own.
+
+## [4.9.3] - 2026-08-28
+
+*Doctor stops vouching for things it never checked.*
+
+`doctor`'s `keys` row tested PRESENCE only, and `validateApiKey` was called at exactly two
+save-time sites — so a key that rotted after it was entered was never re-checked. On the
+reporting machine `doctor` printed a green row while the stored DeepSeek key returned 401 and
+the catalog served zero deepseek rows. Closing that gap surfaced a family of the same shape:
+several places reported health they had not established, and two of them were introduced by
+the fixes for the others. Every one is now the same rule — a check that did not complete says
+so, and only a definitive 401 is a verdict about a credential.
+
+### Added
+
+- **`outputBudget` (#218), opt-in, no default change.** Each council leg reserved
+  `max_tokens: 32000` regardless of the model's real ceiling, and OpenRouter validates that
+  RESERVATION against remaining credit *before* serving — so legs died in 2.2 s with zero
+  tokens and "You requested up to 32000 tokens, but can only afford 354". Set `outputBudget`
+  in `config.json` and each leg reserves `min(budget, that model's real ceiling)`; leave it
+  unset and every model is registered exactly as before. A new `maxOutputTokens` catalog field
+  (OpenRouter's `top_provider.max_completion_tokens`, present on 411 of 417 rows) supplies the
+  ceiling, and a model without one keeps the old behaviour rather than receiving a guess.
+  MEASURED in the pinned engine binary: `maxOutputTokens = Math.min(limit.output, 32000)`, so
+  this can only LOWER a reservation — a value at or above 32000 leaves it unchanged. It does
+  not address a reasoning-heavy leg spending its whole allowance and emitting nothing; that is
+  governed by reasoning effort, not by `max_tokens`, and no claim is made otherwise.
+
+### Fixed
+
+- **`doctor` re-validates stored API keys (#210).** New `key-auth` row probes every stored key
+  against its provider's own endpoint, in parallel — sequential 10 s timeouts would have added
+  ~50 s to every run. Only HTTP 401 fails the check; a timeout, DNS failure, 5xx or 429 warns,
+  because being offline is not a rotted key and a false error sends someone to re-enter a
+  working one. A stored key for a provider with no validation endpoint warns rather than
+  reporting ok — it cannot be probed, so the check cannot vouch for it.
+- **403 is no longer treated as a credential verdict.** Google returns 403 for "API not
+  enabled" and for quota; a WAF returns it for bot protection. It warns now, and `amicus key`
+  saves on it rather than refusing — as it does for 429 and 5xx. Only a definitive 401 blocks
+  a save, expressed as an allowlist so it cannot rot as new status codes appear.
+- **The OpenRouter credit row means CHECKED.** `checkOpenRouterCredit` resolves `warning: null`
+  for a healthy account, for a skipped probe, and for every failure alike — so the row rendered
+  "credit ok" for an account nobody had reached, concealing quota exhaustion behind a green
+  line. It now distinguishes all three.
+- **A key can no longer escape in an error message.** `https.get` can throw synchronously, and
+  the Google probe embeds the key in the URL as `?key=…` — so an error quoting that URL quoted
+  the key. Redaction happens at the source now, covering the raw, percent-encoded and
+  form-encoded spellings, which protects the two save-time call sites that have no handling of
+  their own: `electron/ipc-setup.js` returns the message to the renderer *and* logs it, and
+  `src/cli-handlers.js` awaits with no try/catch at all.
+- **`validateApiKey` honours its "always resolves" contract (#224).** `req.on('error')` covered
+  the connection phase only; an error once the response existed — a socket reset mid-body — was
+  an unhandled `'error'` event, which Node turns into a THROW rather than a rejection: the
+  promise never settled and the process died. Both functions in the module handle it now, and
+  the message coercion itself can no longer throw for a null-prototype object or one whose
+  `toString` throws.
+- **Diagnostics no longer make live authenticated requests outside the CLI.** Probes are opt-in,
+  enabled once by `bin/amicus.js`; a skipped probe is reported as unverified, never as healthy.
+  `AMICUS_NO_NETWORK_PROBES=1` forces them off.
+- **The setup wizard renders the aliases you actually have (#213).** The alias editor grouped
+  rows from a hardcoded list of alias NAMES and iterated that whitelist rather than your
+  aliases, so any alias whose name missed the list rendered nowhere — including the `lmstudio`
+  local-provider alias and every `free-*` alias the `councils.free` preset references. Grouping
+  derives from the alias's route vendor now. Measured against a real 33-alias config: 21
+  rendered before, 33 after, none dropped, none duplicated.
+- **A stale pin no longer looks like a recommendation (#211).** When nothing in the catalog
+  matched an alias's current value, the dropdown echoed that value back as a bare ungrouped
+  option — indistinguishable from a real offer, and observed presenting an id that exists on no
+  gateway above 13 genuine ones. It now sits in a labelled "Current — not found in catalog"
+  group. What gets saved is unchanged.
+- **Alias names and routes are HTML-escaped** in the wizard; a quote in an alias name broke the
+  row's `data-alias` attribute.
+
+### Changed
+
+- **CI: the macOS/node-24 jest-worker `SIGSEGV` mitigation switches levers.** A fifth
+  occurrence landed with the 512 MB idle ceiling in force, so per the rule recorded beside it
+  the lever changes rather than the number: `--maxWorkers=1` now caps concurrent worker heaps.
+  A "Runner capacity" step reports cpus/mem on every leg, which established what five previous
+  hit records had assumed — macOS runners have 3 vCPU and 8 GB against 4 vCPU and 17 GB
+  elsewhere, so `--maxWorkers=2` would have been the default spelled out and changed nothing.
+  That leg runs ~4m → 6.5m as a result.
+
 ## [4.9.2] - 2026-08-27
 
 *The instrument existed; nothing could read it.*

package/README.md

@@ -455,7 +455,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.2",
+  "version": "4.9.4",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/bin/amicus.js

@@ -16,6 +16,12 @@ if (!_nv.ok) { process.stderr.write(_nv.message + '\n'); process.exit(1); }
 const { loadCredentials } = require('../src/utils/env-loader');
 loadCredentials();
 
+// Diagnostics probe live provider endpoints with those keys. That is allowed
+// HERE and nowhere else: utils/live-probes.js defaults to off, so a module
+// required outside this CLI (a test, a script) can never spend them. A skipped
+// probe is reported as unverified, never as healthy — see live-probes.js.
+require('../src/utils/live-probes').enableLiveProbes();
+
 const { parseArgs, getUsage, getCommandNames } = require('../src/cli');
 const { handleSetup, handleAbort, handleUpdate, handleMcp, handleKey } = require('../src/cli-handlers');
 const { handleStart, handleFanout, handleRead } = require('../src/cli-handlers-run');

package/docs/ROADMAP.md

@@ -13,11 +13,12 @@ lives under **Backlog (tracked, not scheduled)** with everything else that is re
 Nothing about the content changed and no judgment about its value is implied; only its status. When
 an org buyer and the org to support them exist, it earns a number then.
 
-Amicus is at **v4.9.0** (2026-08-26). Each 4.x rev below leads with the benefit, not the
-plumbing.
+Amicus is at **v4.9.3** (2026-08-28). Each 4.x rev below leads with the benefit, not the
+plumbing; the patch releases since v4.9.0 carry no section of their own, because they fixed
+defects rather than adding scope — see `CHANGELOG.md` for what each one contained.
 
-**Status:** v4.0 through **v4.9.0** have **shipped** — everything on this page is a record of what
-landed, not a plan. Composition — the scope that
+**Status:** v4.0 through **v4.9.0** have **shipped**, plus the v4.9.1–v4.9.3 patch releases —
+everything on this page is a record of what landed, not a plan. Composition — the scope that
 carried the number v4.6 here until the degrade-announcement-invariant milestone took the v4.6.0
 release (2026-08-02) — is now an unscheduled candidate for the next rev, tabled in its own section
 below (dropped from v4.7, 2026-08-05); its contents are decided at kickoff per the anti-rot rule,