amicus 4.9.3 → 4.9.4

package/src/pack/pack-validate.js

@@ -64,6 +64,9 @@ function validatePack(pack, { mode } = { mode: 'run' }) {
     for (const key of Object.keys(opts)) {
       if (!KIND_OPTIONS[pack.kind].includes(key)) { errors.push(`unknown option '${key}' for kind '${pack.kind}'`); }
     }
+    // #218 PR 4 whole-branch review (VCMD-2): the VALUE too — a saved 'turbo' would reach the wire.
+    const { VARIANT_LEVELS } = require('../utils/thinking-validators');
+    if (opts.thinking !== undefined && !VARIANT_LEVELS.includes(opts.thinking)) { errors.push(`options.thinking must be one of: ${VARIANT_LEVELS.join(', ')}`); }
   }
 
   const { getEffectiveAliases, getCouncilWithSource } = require('../utils/config');

package/src/session-manager.js

@@ -78,7 +78,7 @@ function resolveExistingSessionDir(projectDir, taskId) {
  * @param {string} metadata.project - Project path
  * @param {string} [metadata.briefing] - Task briefing
  * @param {string} [metadata.mode] - Mode: 'interactive' or 'headless'
- * @param {string} [metadata.thinking='medium'] - Thinking/reasoning intensity level
+ * @param {string} [metadata.thinking] - Reasoning effort requested; recorded only when one was (#218 PR 4)
  * @throws {Error} If session already exists
  */
 function createSession(projectDir, taskId, metadata) {
@@ -99,7 +99,7 @@ function createSession(projectDir, taskId, metadata) {
     project: metadata.project || projectDir,
     briefing: metadata.briefing || '',
     mode: metadata.mode || 'interactive',
-    thinking: metadata.thinking || 'medium',
+    ...(metadata.thinking ? { thinking: metadata.thinking } : {}), // #218 PR 4: emit-when-requested (see start-metadata.js)
     status: SESSION_STATUS.RUNNING,
     createdAt: new Date().toISOString(),
     completedAt: null,

package/src/sidecar/continue.js

@@ -15,6 +15,7 @@ const {
   createHeartbeat
 } = require('./session-utils');
 const { acquireLock, releaseLock } = require('../utils/session-lock');
+const { noticeDroppedLevel } = require('./reopen-notices');
 const { runHeadless } = require('../headless');
 const { buildPrompts } = require('../prompt-builder');
 const { generateFoldNonce } = require('../utils/fold-marker');
@@ -140,6 +141,7 @@ async function continueSidecar(options) {
   // Load previous session data
   const { metadata: oldMetadata, summary: previousSummary, conversation: previousConversation } =
     loadPreviousSession(oldTaskId, project);
+  noticeDroppedLevel(oldMetadata, { taskId: oldTaskId, kind: 'continue' }); // council #235 r5 (J1/A3): read against the PARENT's metadata — a continuation opens a NEW session, sends no variant, and `continue` rejects --thinking, so a level the parent ran with silently becomes the provider's default here. Named mutant "CONTINUELEVELSILENT" (tests/sidecar/reopen-thinking-notice.test.js).
 
   // Lock the previous (EXISTING) session directory to prevent concurrent
   // continue operations — resolve dual-dir so a legacy session is locked too.
@@ -245,11 +247,14 @@ async function continueSidecar(options) {
   if (terminal.status === 'error') {
     meta.status = 'error';
     meta.reason = (result && result.error) ? String(result.error) : 'Incomplete';
+    if (result && typeof result.finish === 'string') { meta.finish = result.finish; } // #218 PR 3: emit-when-set; a fresh session's metadata has no prior finish to remove (resume's does -- resume.js)
+    if (result && typeof result.variant === 'string') { meta.variant = result.variant; } // #218 PR 4: emit-when-set, like finish (named mutant "CONTINUEERRORNOVARIANT", tests/continue-resume-spend.test.js)
+    if (result && result.variantUnverified === true) { meta.variantUnverified = true; }
     meta.completedAt = new Date().toISOString();
     writeFileAtomic(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
     logger.error('Continuation completed with error', { taskId: newTaskId, error: meta.reason });
   } else {
-    finalizeSession(sessionDir, summary, project, meta, { quietStdout: json, status: terminal.status });
+    finalizeSession(sessionDir, summary, project, meta, { quietStdout: json, status: terminal.status, finish: result && result.finish, variant: result && result.variant, variantUnverified: result && result.variantUnverified }); // named mutant "CONTINUEVARIANTDROPPED" (tests/continue-resume-spend.test.js): drop the variant args
   }
   // v4.3: attribute continue spend (C9/E4). Reload meta, write usage + append a
   // ledger row (status: statusFromResult, matching start.js — not terminal.status).

package/src/sidecar/conversation-mirror.js

@@ -32,18 +32,39 @@ function createMirrorState() {
     receivingReported: false,
     output: '',                 // accumulated assistant text
     seenReasoningParts: new Map(), // partId -> last captured reasoning length
-    reasoningOutput: '',        // accumulated reasoning text (promoted to output only if no text part arrives)
+    reasoningOutput: '',        // accumulated reasoning text (promoted to output when no text part has arrived; see promotedOutput)
     usageByMsg: new Map(),      // msgId -> {tokens, cost}
+    // #218 PR 3: three facts about the LAST assistant message in the snapshot
+    // -- its `finish` (stamped at finalization, beside tokens/cost), whether it
+    // carries answer text, whether it carries reasoning -- the whole input of
+    // the death test in utils/output-length.js. Per MESSAGE on purpose: `output`
+    // above accumulates across a tool loop's messages and would let earlier
+    // text hide a final length stop, or earlier promoted reasoning condemn a
+    // later message that answered (council #232 r1 B2/D1).
+    lastAssistantFinish: null,
+    lastAssistantHasText: false,
+    lastAssistantHasReasoning: false,
+    promotedOutput: '',         // the reasoning a promotion put into `output` as a stand-in; the first real answer text on a later message replaces it (council #232 r1)
   };
 }
 
 /**
- * Capture one assistant message's usage snapshot into `state.usageByMsg`.
+ * Capture one assistant message's usage snapshot AND its finish into the state.
  * The poll loop re-reads ALL messages every poll, so the latest snapshot per
  * message id wins (keyed Map, never additive) — see pricing.sumPerMessageUsage.
  * @returns {boolean} true when this message carried a usage payload
  */
 function captureMsgUsage(msg, state) {
+  // #218 PR 3: `finish` was observed beside tokens/cost on every probe L row, so
+  // both mirror passes record it here; the last assistant message in the
+  // snapshot wins, and one still streaming (no finish yet) resets it to null; '' counts as none (council #232 r3 C1; mutant "EMPTYFINISH").
+  // The two part flags are read off THIS message's parts, never off `output`
+  // (council #232 r1 B2/D1). Named mutants "NOFINISH", "TEXTOFFOUTPUT"
+  // (tests/conversation-mirror.test.js).
+  state.lastAssistantFinish = (typeof msg.info.finish === 'string' && msg.info.finish.length > 0) ? msg.info.finish : null;
+  const parts = Array.isArray(msg.parts) ? msg.parts : [];
+  state.lastAssistantHasText = parts.some((p) => p && p.type === 'text' && typeof p.text === 'string' && p.text.trim().length > 0);
+  state.lastAssistantHasReasoning = parts.some((p) => p && p.type === 'reasoning' && typeof p.text === 'string' && p.text.length > 0);
   if (msg.info.tokens || typeof msg.info.cost === 'number') {
     state.usageByMsg.set(msg.info.id, { tokens: msg.info.tokens, cost: msg.info.cost });
     return true;
@@ -52,9 +73,9 @@ function captureMsgUsage(msg, state) {
 }
 
 /**
- * USAGE-ONLY mirror pass (v4.4 B1). Captures `info.tokens`/`info.cost` from a
- * fresh getMessages() snapshot and NOTHING else — no appendLines, no
- * `state.output` growth, no progress updates, no pending-tool bookkeeping.
+ * USAGE-ONLY mirror pass (v4.4 B1). Captures `info.tokens`/`info.cost` — and, since #218 PR 3,
+ * the last assistant message's `finish` — from a fresh getMessages() snapshot and NOTHING else —
+ * no appendLines, no `state.output` growth, no progress updates, no pending-tool bookkeeping.
  *
  * This exists because the headless poll loop's fast-path exits (trailing fold
  * marker, SDK `idle`) break BEFORE OpenCode stamps usage at finalization, so a
@@ -63,7 +84,7 @@ function captureMsgUsage(msg, state) {
  * conversation.jsonl a second time; this function cannot, because it never
  * touches seenTextParts/output at all.
  * @param {Array} messages getMessages() snapshot
- * @param {object} state from createMirrorState() (only usageByMsg is mutated)
+ * @param {object} state from createMirrorState() (only usageByMsg and the three lastAssistant* facts are mutated)
  * @returns {number} count of messages whose usage was captured
  */
 function mirrorUsageOnly(messages, state) {
@@ -138,6 +159,9 @@ function mirrorMessages(messages, state, opts = {}) {
         if (part.text.length > prevLen) {
           // Append only the new portion (handles streaming growth)
           const newText = part.text.slice(prevLen);
+          // The first non-whitespace text replaces the stand-in; output restarts from the answer;
+          // conversation.jsonl keeps its reasoning. KEEPPROMOTED; WHITESPACERESET drops the trim.
+          if (state.promotedOutput && newText.trim().length > 0) { state.output = ''; state.promotedOutput = ''; }
           state.output += newText;
           state.seenTextParts.set(partId, part.text.length);
           appendLines.push({ role: 'assistant', content: newText, timestamp: now() });
@@ -244,12 +268,12 @@ function mirrorMessages(messages, state, opts = {}) {
   const lastAssistant = list.filter(m => m.info && m.info.role === 'assistant').pop();
   assistantFinished = !!(lastAssistant && lastAssistant.info.time && lastAssistant.info.time.completed);
 
-  // Reasoning-only fallback: if the assistant finished but emitted only reasoning
-  // parts (no visible text), promote the reasoning text to `output` so the headless
-  // completion gates fire and the answer isn't lost as "No Output". Runs once — once
-  // `output` is non-empty this is skipped on subsequent polls.
+  // Reasoning-only fallback: if the assistant finished but emitted only reasoning parts (no
+  // visible text), promote the reasoning text to `output` so the headless completion gates fire
+  // and the answer isn't lost as "No Output". Runs once — a non-empty `output` skips it on later
+  // polls. `promotedOutput` records the stand-in, which the first real text part replaces above.
   if (assistantFinished && !state.output && state.reasoningOutput) {
-    state.output = state.reasoningOutput;
+    state.output = state.promotedOutput = state.reasoningOutput;
     appendLines.push({ role: 'assistant', content: state.reasoningOutput, timestamp: now() });
   }
 

package/src/sidecar/fanout-leg-fallback.js

@@ -47,6 +47,7 @@ function recordAttemptSpend({ doc, leg, currentModel, legId, waveId, project, at
       project, attempt: leg && leg.attempt, substitutedFor: leg && leg.substitutedFor,
       retryOfWaveId: leg && leg.retryOfWaveId,
       tag: (leg && leg.tag) || null,
+      finish: doc.finish, variant: doc.variant, // #218 PR 3 / PR 4: appendSpend keeps each only when it is a string (named mutant "LEGROWNOVARIANT", tests/sidecar/fanout.test.js)
     };
     if (attempt > 0) { row.attempt = attempt; row.substitutedFor = originalModel; }
     appendSpend(row, deps.spendDir ? { dir: deps.spendDir } : undefined);

package/src/sidecar/fanout-leg.js

@@ -76,7 +76,7 @@ function buildRoutingFailureLeg({ leg, legId, waveId, quiet }) {
  * Adds `.reason` (alias of buildRunResult's `.error`) and `.legId` so the
  * fallback loop reads a stable shape without re-deriving them.
  */
-async function runSingleAttempt({ leg, legId, waveId, project, directory, follow, systemPrompt, userMessage, timeoutMs, agent, client, server, summaryLength, reasoning, quiet, foldNonce, noOutputBackstopMs }) {
+async function runSingleAttempt({ leg, legId, waveId, project, directory, follow, systemPrompt, userMessage, timeoutMs, agent, client, server, summaryLength, variant, quiet, foldNonce, noOutputBackstopMs }) {
   const { IdleWatchdog } = require('../utils/idle-watchdog');
   const { markAborted } = require('../utils/session-abort');
   const { runHeadless } = require('../headless');
@@ -123,7 +123,7 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     result = await runHeadless(
       leg.model, systemPrompt, userMessage, legId, project,
       timeoutMs, agent || 'build',
-      { client, server, watchdog, summaryLength, reasoning, nonce: foldNonce, directory, noOutputBackstopMs }
+      { client, server, watchdog, summaryLength, variant, nonce: foldNonce, directory, noOutputBackstopMs }
     );
   } catch (err) {
     result = { summary: '', completed: false, timedOut: false, aborted: false, error: err.message, taskId: legId };
@@ -215,6 +215,14 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     // nothing whichever one holds: it is one `&&` against a value already in a
     // register, and it is dead code if `result` is truly always assigned.
     ttftMs: result && isMeasuredTtft(result.ttftMs) ? result.ttftMs : undefined,
+    // #218 PR 3: the engine's `finish` for the leg's last assistant message
+    // ('length' = stopped at the reservation), emit-when-set like ttftMs above.
+    finish: (result && typeof result.finish === 'string') ? result.finish : undefined,
+    // #218 PR 4: the effort level SENT (emit-when-sent) and whether the engine's
+    // catalogue knew the model when it was sent. Named mutant "LEGVARIANTDROPPED"
+    // (tests/sidecar/fanout.test.js).
+    variant: (result && typeof result.variant === 'string') ? result.variant : undefined,
+    variantUnverified: (result && result.variantUnverified === true) ? true : undefined,
   };
   let finalMeta = legPatch;
   if (legDir) {

package/src/sidecar/fanout.js

@@ -246,7 +246,7 @@ async function runFanout(options) {
         HEARTBEAT_INTERVAL
       );
   const timeoutMs = (options.timeout || 15) * 60 * 1000;
-  const reasoning = options.thinking ? { effort: options.thinking } : undefined;
+  const variant = options.thinking || undefined; // #218 PR 4: one level for every leg, sent as the engine's `variant` field (named mutant "FANOUTVARIANTDROPPED", tests/sidecar/fanout.test.js: drop `variant` from the runLeg args)
   let legDocs;
   try {
     // retryContexts/retryOfWaveId (v4.3 Task 19): absent on a normal wave, so
@@ -261,7 +261,7 @@ async function runFanout(options) {
         systemPrompt: saved ? rc.systemPrompt : systemPrompt,
         userMessage: saved ? rc.userMessage : userMessage,
         timeoutMs, agent: options.agent, client, server,
-        summaryLength: options.summaryLength, reasoning, quiet: options.quiet,
+        summaryLength: options.summaryLength, variant, quiet: options.quiet,
         foldNonce, directory: options.directory, follow,
         fallback: options.fallback, catalog: options.catalog, noOutputBackstopMs: options.noOutputBackstopMs,
       });

package/src/sidecar/interactive.js

@@ -18,6 +18,7 @@ const { canonicalProjectPath } = require('../utils/project-path');
 const { ensureElectron } = require('./electron-ensure');
 const { writeProgress } = require('./progress');
 const { getElectronPath, buildElectronEnv, handleElectronProcess } = require('./interactive-process');
+const { readOutputBudgetSafe } = require('../headless');
 
 /** Run sidecar in interactive mode (Electron GUI) */
 async function runInteractive(model, systemPrompt, userMessage, taskId, project, options = {}) {
@@ -33,7 +34,7 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
     };
   }
 
-  const { agent, isResume, conversation, mcp, reasoning, opencodeSessionId, client, foldNonce } = options;
+  const { agent, isResume, conversation, mcp, variant, opencodeSessionId, client, foldNonce } = options;
 
   // F6c: mirror headless's lifecycle stages (best-effort — a write failure must
   // never break the GUI) so the heartbeat/status never read "Starting up...".
@@ -70,6 +71,7 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
     };
   }
 
+  let sent = null; // #218 PR 4 whole-branch review (EP-4): what sendPrompt SENT, for the record
   // Create or reconnect to session
   let sessionId;
   try {
@@ -93,9 +95,29 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
 
       // Always set agent — defaults to 'chat' when not specified
       promptOptions.agent = agentConfig.agent;
-      if (reasoning) { promptOptions.reasoning = reasoning; }
-
-      await sendPromptAsync(ocClient, sessionId, promptOptions);
+      // #218 PR 4: the engine's `variant` field, validated in sendPrompt; the
+      // spawn-time budget rides the handle (PR 3). A refusal lands in the catch
+      // below as "Session setup failed: VARIANT_…" — nothing was sent.
+      // Named mutants "GUIBUDGETDROPPED" / "GUIREFUSALPREFIX" (tests/sidecar/interactive-variant.test.js).
+      if (variant) {
+        promptOptions.variant = variant;
+        promptOptions.outputBudget = readOutputBudgetSafe(server); // council #235 r1 (A1): the SAME reader headless uses (src/headless.js :: readOutputBudgetSafe) — the handle's spawn value, else config
+      }
+
+      const promptResult = await sendPromptAsync(ocClient, sessionId, promptOptions);
+      sent = promptResult && promptResult.sentVariant;
+      if (sent && !sent.verified) {
+        const { formatUnverifiedVariantNote } = require('../utils/engine-variants');
+        const note = formatUnverifiedVariantNote({ model, variant: sent.variant, waitedMs: sent.waitedMs, unreadable: sent.unreadable });
+        logger.warn('Variant sent unverified', { taskId, sessionId, note });
+        // council #235 r2 (B2): logger.warn is DROPPED at the shipped default
+        // (LOG_LEVEL defaults to 'error', utils/logger.js), so the structured line alone
+        // told the user nothing — the silent degrade the product principle forbids, and the
+        // same invisibility this release cites against 4.9.3's silent adjustment. stderr
+        // carries it in every mode; stdout keeps the run document intact. Named mutant
+        // "UNVERIFIEDNOTICESILENT": drop the stderr write.
+        process.stderr.write(`Notice: ${note}\n`);
+      }
       progressStage('prompt_sent');
     }
     logger.debug('Interactive session ready', { sessionId, isResume: !!isResume });
@@ -201,6 +223,11 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
       } catch (err) { logger.debug('mirror stop failed', { error: err.message }); }
       try { await server.close(); } catch { /* best-effort */ }
       logger.debug('OpenCode server closed after Electron exit');
+      // #218 PR 4 whole-branch review (EP-4/REC-2/PRT-2): the level SENT rides the interactive
+      // result too (emit-when-sent, the derivation headless.js:811-814 makes), so start.js's
+      // writers stamp `variant` / `variantUnverified` for the default GUI mode as well.
+      // Named mutant "INTERACTIVEVARIANTDROPPED" (tests/sidecar/interactive-variant.test.js).
+      if (sent) { result.variant = sent.variant; if (!sent.verified) { result.variantUnverified = true; } }
       result.opencodeSessionId = sessionId;
       resolve(result);
     });

package/src/sidecar/models-ceiling-line.js

@@ -0,0 +1,72 @@
+/**
+ * @module models-ceiling-line
+ * The one `Ceilings:` line `amicus models --refresh` prints (#218 P3).
+ *
+ * It is an honest report of where the direct-provider context/output ceilings
+ * came from, or why they did not come at all — filled, already complete, still
+ * missing a number, failed, or skipped.
+ *
+ * Extracted from `models.js` (council #230 r4) because that file sat at 298 of
+ * the 300-line budget and this round adds two more branches to the formatter.
+ * It owns the WORDING only: the outcome object it renders is built by
+ * `src/utils/model-ceilings-modelsdev.js` and persisted by
+ * `src/utils/model-catalog.js` as the cache document's `ceilingEnrichment`.
+ */
+
+'use strict';
+
+/**
+ * How a ceiling-enrichment failure is worded, keyed by its `failure.reason`
+ * (council #230 D4/C1). `http-status`, `parse-error`, `too-large` and
+ * `bad-shape` all mean models.dev ANSWERED; `exception` — and any reason a later
+ * failure invents — is a local bug, so it falls through to a neutral lead.
+ */
+const CEILING_FAILURE_LEAD = {
+  timeout: 'models.dev unreachable',
+  'network-error': 'models.dev unreachable',
+  'http-status': 'models.dev answered but could not be used',
+  'parse-error': 'models.dev answered but could not be used',
+  'too-large': 'models.dev answered but could not be used',
+  'bad-shape': 'models.dev answered but could not be used',
+};
+
+/**
+ * #218 P3: one honest line about where the direct-provider ceilings came from.
+ * @param {object|null} e the persisted `ceilingEnrichment` outcome
+ * @returns {string}
+ */
+function fmtCeilingLine(e) {
+  // Unreachable in production after #218 P3 (every successful refresh persists a
+  // ceilingEnrichment object); kept for a hand-built or pre-field cache doc.
+  if (!e) { return 'Ceilings: not attempted'; }
+  if (e.failure) {
+    const f = e.failure;
+    const why = f.reason + (f.status ? ` ${f.status}` : '') + (f.detail ? `: ${f.detail}` : '');
+    const lead = CEILING_FAILURE_LEAD[f.reason] || 'ceiling enrichment failed';
+    // #218 PR 4 (whole-branch review VCMD-4): the flag never reaches a direct openai row — M5/M13/M22, the same fact the disabled literal below states.
+    return `Ceilings: ${lead} (${why}); rows without a ceiling get an outputBudget through the engine flag alone, clamped only where the engine's own catalog knows the model; direct openai rows send no output reservation at all (#218 PR 4, M5/M13/M22)`;
+  }
+  // A skip is not a failure and not a fill: naming which one it was is the
+  // difference between "you turned this off" and "there was nothing to do".
+  if (e.skipped === 'disabled') {
+    // Named, not "direct routes": Google publishes its own ceiling first-party
+    // and OpenRouter rows keep OpenRouter's. Since PR 2 the budget still
+    // reaches the anthropic/deepseek rows through the engine flag, clamped by
+    // the engine's own catalog (probe K5/K12); it never reaches a direct
+    // openai row at all (#218 PR 4, M5/M13/M22).
+    return 'Ceilings: models.dev lookup disabled (modelsDevCeilings: false); anthropic/deepseek direct rows carry no ceiling here and are clamped by the engine\'s own catalog instead; direct openai rows send no output reservation at all (#218 PR 4) (Google publishes its own ceiling and OpenRouter rows keep OpenRouter\'s)';
+  }
+  if (e.skipped === 'nothing-to-fill') {
+    // NOT "every row": routers, local rows and malformed rows are not
+    // candidates and are never asked about (council #230 C2).
+    return 'Ceilings: nothing to fill (no candidate row is missing a number)';
+  }
+  // `?? 0`: a hand-built or pre-field cache doc can carry a partial object, and
+  // `undefined already complete` would be a worse lie than a zero. `stillMissing`
+  // deliberately overlaps the other counters — it is the STATE the pass left,
+  // and it is the number that says whether outputBudget can clamp those rows.
+  return `Ceilings: ${e.filled ?? 0} rows filled from models.dev (${e.alreadyKnown ?? 0} already complete, ` +
+    `${e.unknown ?? 0} unknown to models.dev, ${e.stillMissing ?? 0} still missing a number)`;
+}
+
+module.exports = { fmtCeilingLine };

package/src/sidecar/models.js

@@ -22,6 +22,7 @@ const { pickCurrent } = require('../utils/quick-picks');
 const { probeStoredAliases, selectStoredAliases } = require('./models-probe');
 const { DEFAULT_MAX_LEGS } = require('./fanout-validate');
 const { fmtRow, fmtGatewayFinding, fmtProbeLine, fmtProviderFailure } = require('./models-render');
+const { fmtCeilingLine } = require('./models-ceiling-line');
 
 const CHECK_EXIT_CAP = 100;
 
@@ -87,7 +88,7 @@ function fmtLiveSkipped(reason) {
 
 async function runRefresh(args) {
   const models = await refreshCatalog();
-  const { fetchedAt, lastRefreshAttempt, lastRefreshError } = await getCatalogInfo({ maxAgeMs: Number.POSITIVE_INFINITY });
+  const { fetchedAt, lastRefreshAttempt, lastRefreshError, ceilingEnrichment } = await getCatalogInfo({ maxAgeMs: Number.POSITIVE_INFINITY });
   // --refresh short-circuits --check below (args.check is guaranteed true here) — must announce, not silently skip.
   if (args.live) {
     const line = fmtLiveSkipped('refresh-precedes-check');
@@ -95,7 +96,7 @@ async function runRefresh(args) {
   }
   if (args.json) {
     process.stdout.write(JSON.stringify(buildCatalogDoc({
-      models, fetchedAt, refreshed: true, lastRefreshAttempt, lastRefreshError
+      models, fetchedAt, refreshed: true, lastRefreshAttempt, lastRefreshError, ceilingEnrichment
     }), null, 2) + '\n');
     return models.length === 0 && !fetchedAt ? 1 : 0;
   }
@@ -112,6 +113,7 @@ async function runRefresh(args) {
     return 1; // no cache at all: a real failure
   }
   process.stdout.write(`Refreshed catalog: ${models.length} models.\n`);
+  process.stdout.write(fmtCeilingLine(ceilingEnrichment) + '\n');
   process.stdout.write(`Cache: ${catalogPath()}\n`);
   return 0;
 }

package/src/sidecar/reopen-notices.js

@@ -0,0 +1,97 @@
+/**
+ * @module reopen-notices
+ * The stderr Notice a reopen owes the user for the effort level it does NOT carry (#218 PR 4, council #235 r5 J1/A3).
+ * A session started with `--thinking <level>` sends no variant on any resumed or
+ * continued leg, and since council #235 r2 both commands REJECT the flag, so the
+ * user cannot ask for one there either. Level inheritance was scoped out of this PR
+ * deliberately and stays out (filed, not built) — but the silence is the defect: it
+ * is the same mid-conversation degrade this release cites against 4.9.3, and the
+ * project's rule is that a level which will not take effect says so. Named mutants
+ * "RESUMELEVELSILENT" / "CONTINUELEVELSILENT" (tests/sidecar/reopen-thinking-notice.test.js):
+ * drop the call at either reopen site.
+ *
+ * Notices go to STDERR only — stdout carries the `--json` run document and the
+ * fold summary, and nothing here may perturb either (same rule as the unverified
+ * note in src/headless.js and src/sidecar/interactive.js).
+ */
+
+const { collapseExcerpt } = require('../utils/text-sanitize');
+
+/** Longest LEVEL echoed from on-disk metadata into a one-line Notice — a level is one word. */
+const MAX_LEVEL_CHARS = 40;
+/**
+ * Longest TASK ID echoed. It is not an attacker-shaped fragment: `validators.js ::
+ * TASK_ID_PATTERN` is `/^[a-zA-Z0-9_-]{1,64}$/`, which already excludes every character the
+ * sanitizer strips — so the cap is what a VALID id can be. Capping it at the LEVEL's 40
+ * named a session that does not exist (council #235 r5 wave 6 repair).
+ */
+const MAX_TASK_ID_CHARS = 64;
+
+/**
+ * Collapse an on-disk fragment to one safe line.
+ * metadata.json is a FILE — a hand-edited or corrupted `thinking` value must not be
+ * able to forge a second `Notice:` line or smuggle control characters into a terminal
+ * (the hazard src/utils/alias-shadow.js :: safeFragment was written against).
+ *
+ * The SANITIZING is the house sanitizer's: `utils/text-sanitize.js :: collapseExcerpt` is the
+ * only one ("a second implementation would be a second set of holes", and the holes are the
+ * point — ANSI sequences and the PRINTABLE-range bidi controls are classes a private
+ * control-character regex cannot see, and this module quotes both straight out of a file).
+ * The fence/tag defang here is ADDITIVE and runs BEFORE that pass, so the house whitespace
+ * collapse and cap still govern the result: it adds a class, it never replaces one. Same
+ * shape as src/utils/alias-shadow.js :: safeFragment (council #235 r5 wave 6 repair).
+ * @param {unknown} value
+ * @param {number} maxChars
+ * @returns {string}
+ */
+function safeFragment(value, maxChars) {
+  return collapseExcerpt(String(value).replace(/[`<>]/g, ' '), maxChars);
+}
+
+/**
+ * The value 4.9.3 and earlier stamped on EVERY session's metadata whether or not the flag was
+ * typed — and never sent (probe F1). It is the one recorded level whose provenance is unknowable
+ * from disk, so the line SAYS that rather than reporting it as something the user asked for.
+ */
+const LEGACY_UNCONDITIONAL_STAMP = 'medium';
+
+/**
+ * The Notice line for a reopen that drops the session's recorded effort level, or null.
+ * Null whenever the session records no level — nothing was asked for, so nothing is dropped.
+ *
+ * It reports what the metadata RECORDS, not what was typed (council #235 r5 wave 6 repair).
+ * Those are not the same proposition: 4.9.3 and earlier wrote `thinking: 'medium'` on every
+ * session, flag or no flag, so the entire on-disk session history at upgrade time reaches this
+ * line carrying a level nobody requested — and for those legs nothing degraded, because that
+ * `medium` was never sent either. Nothing on disk tells the two apart (the same reason this
+ * release refuses a pack migration), so the line states the record and names the ambiguity.
+ * @param {{taskId: string, level: unknown, kind: 'resume'|'continue'}} a
+ * @returns {string|null}
+ */
+function formatDroppedLevelNotice({ taskId, level, kind }) {
+  if (typeof level !== 'string') { return null; }
+  const shown = safeFragment(level, MAX_LEVEL_CHARS);
+  if (!shown) { return null; }
+  // Named mutant "NOTICECLAIMSINTENT": say "was started with" again, or drop this clause.
+  const provenance = shown === LEGACY_UNCONDITIONAL_STAMP
+    ? ' (4.9.3 and earlier recorded medium on every session, typed or not, and never sent it)'
+    : '';
+  const what = kind === 'continue'
+    ? 'this continuation opens a NEW session and sends no effort level, so it runs at the provider\'s default — a level belongs on the `start` that opens a session and is not carried across a reopen'
+    : 'this resumed leg sends no effort level and runs at the provider\'s default — a level is not carried across a reopen';
+  return `Notice: session ${safeFragment(taskId, MAX_TASK_ID_CHARS)} records --thinking ${shown}${provenance}; ${what}`;
+}
+
+/**
+ * Write that Notice to stderr when the session recorded a level. No-op otherwise.
+ * @param {object} metadata - the session metadata whose `thinking` is read (resume: the session's own; continue: the PARENT's)
+ * @param {{taskId: string, kind: 'resume'|'continue'}} a
+ * @returns {string|null} the line written, or null when nothing was written
+ */
+function noticeDroppedLevel(metadata, { taskId, kind }) {
+  const note = formatDroppedLevelNotice({ taskId, level: metadata && metadata.thinking, kind });
+  if (note) { process.stderr.write(`${note}\n`); }
+  return note;
+}
+
+module.exports = { formatDroppedLevelNotice, noticeDroppedLevel };

package/src/sidecar/reopen-spend.js

@@ -23,8 +23,9 @@ function finalizeSpendForReopen({ taskId, model, mode, op, result, status, proje
       const { gatewayOf } = require('../utils/gateway-router');
       const gateway = metadata.gateway || gatewayOf(model);
       // v4.7.1 Task 7 D16: null-not-absent, the OPPOSITE convention from
-      // metadata.tag's absent-not-null (D13) — same `|| null` idiom as start.js:237.
-      appendSpend({ taskId, model, mode, usage, op, status, project, gateway, tag: metadata.tag || null }, ctx);
+      // metadata.tag's absent-not-null (D13) — same `|| null` idiom as start.js:240.
+      // #218 PR 3/PR 4: `finish` and `variant` are the OPPOSITE — absent-not-null: appendSpend writes each key only when it is a string. Named mutant "SOLOROWNOVARIANT" (tests/continue-resume-spend.test.js): drop `variant`.
+      appendSpend({ taskId, model, mode, usage, op, status, project, gateway, tag: metadata.tag || null, finish: result && result.finish, variant: result && result.variant }, ctx);
     } catch { /* best-effort */ }
   }
   return { usage };

package/src/sidecar/resume.js

@@ -16,6 +16,7 @@ const {
   checkSessionLiveness
 } = require('./session-utils');
 const { acquireLock, releaseLock } = require('../utils/session-lock');
+const { noticeDroppedLevel } = require('./reopen-notices');
 const { runHeadless } = require('../headless');
 const { extractNonceFromText, generateFoldNonce, stripFoldMarkers } = require('../utils/fold-marker');
 const { logger } = require('../utils/logger');
@@ -41,7 +42,8 @@ function loadInitialContext(sessionDir) {
 /** Check for file drift - files that were read may have changed */
 function checkFileDrift(metadata, project) {
   const filesRead = metadata.filesRead || [];
-  const lastActivity = metadata.completedAt || metadata.createdAt;
+  // council #235 r5 (J2/A4): the previous attempt's terminal timestamps are all deleted on every running write (updateSessionStatus below), so this — their one legitimate reader — falls back through them. `abortedAt` is a terminal stamp of that attempt and later than its start, so it is read first (wave 6 repair); `resumedAt` is when a crashed attempt STARTED, strictly more accurate than the previous attempt's completion. Named mutants "DRIFTNORESUMEDAT" / "DRIFTNOABORTEDAT": drop either middle term.
+  const lastActivity = metadata.completedAt || metadata.abortedAt || metadata.resumedAt || metadata.createdAt;
   const lastActivityTime = new Date(lastActivity).getTime();
   const changedFiles = [];
 
@@ -112,6 +114,13 @@ function updateSessionStatus(sessionDir, status) {
   meta.status = status;
   if (status === 'running') {
     meta.resumedAt = new Date().toISOString();
+    // #218 PR 4 whole-branch review (REC-3): the per-attempt fields are this attempt's to stamp
+    // — an abort or crash of the resumed run must not ship the previous attempt's as its own
+    // (the terminal writers preserve every key they do not set). Named mutant
+    // "RESUMESTALEVARIANT" (tests/sidecar/resume.test.js): drop the three deletes.
+    // council #235 r5 (J2/A4): `reason` and the terminal timestamps are stamped ONLY by a terminal writer, so an attempt that never reaches one must not inherit the previous attempt's — a resume that crashes mid-attempt used to leave `status: 'running'` beside the last failure's reason and completion time, and both are read (src/utils/result-schema.js reports `metadata.reason` for every non-complete status and `completedAt || abortedAt` as the end; the MCP server prints the reason and adds `crashedAt` to that chain). ALL THREE timestamps go (wave 6 repair): `abortedAt` is the one an `amicus abort` writes and `completedAt` is never written on that path, so clearing only `completedAt` left the defect live on the commonest precursor to a resume — and, for an attempt that stamped both, made the reported end fall through to the OLDER one. Named mutants "RESUMESTALEREASON" (drop `reason`/`completedAt`) and "RESUMESTALEABORTEDAT" (drop `abortedAt`/`crashedAt`).
+    delete meta.finish; delete meta.variant; delete meta.variantUnverified;
+    delete meta.reason; delete meta.completedAt; delete meta.abortedAt; delete meta.crashedAt;
   }
   writeFileAtomic(metaPath, JSON.stringify(meta, null, 2));
   return meta;
@@ -135,6 +144,7 @@ async function resumeSidecar(options) {
 
   // Load previous session data
   const metadata = loadSessionMetadata(sessionDir);
+  noticeDroppedLevel(metadata, { taskId, kind: 'resume' }); // council #235 r5 (J1/A3): this leg sends no variant and `resume` rejects --thinking, so a session started with a level silently degrades to the provider's default — the very degrade this release cites against 4.9.3. Inheritance stays filed, not built; the silence does not. Named mutant "RESUMELEVELSILENT" (tests/sidecar/reopen-thinking-notice.test.js).
   const systemPrompt = loadInitialContext(sessionDir);
 
   // Dead-process detection: log if the previous process is no longer alive
@@ -242,11 +252,14 @@ async function resumeSidecar(options) {
     if (terminal.status === 'error') {
       updatedMetadata.status = 'error';
       updatedMetadata.reason = (result && result.error) ? String(result.error) : 'Incomplete';
+      if (result && typeof result.finish === 'string') { updatedMetadata.finish = result.finish; } else { delete updatedMetadata.finish; } // #218 PR 3: emit-when-set; a stale one is removed (council #232 r1 B1)
+      if (result && typeof result.variant === 'string') { updatedMetadata.variant = result.variant; } else { delete updatedMetadata.variant; } // #218 PR 4: same rule as finish (named mutant "RESUMEERRORNOVARIANT", tests/continue-resume-spend.test.js)
+      if (result && result.variantUnverified === true) { updatedMetadata.variantUnverified = true; } else { delete updatedMetadata.variantUnverified; }
       updatedMetadata.completedAt = new Date().toISOString();
       writeFileAtomic(metaPath, JSON.stringify(updatedMetadata, null, 2), { mode: 0o600 });
       logger.error('Resume completed with error', { taskId, error: updatedMetadata.reason });
     } else {
-      finalizeSession(sessionDir, summary, project, updatedMetadata, { quietStdout: json, status: terminal.status });
+      finalizeSession(sessionDir, summary, project, updatedMetadata, { quietStdout: json, status: terminal.status, finish: result && result.finish, variant: result && result.variant, variantUnverified: result && result.variantUnverified }); // named mutant "RESUMEVARIANTDROPPED" (tests/continue-resume-spend.test.js)
     }
     // v4.3: attribute resume spend (C9/E4). Reload metadata, write usage + append
     // a ledger row (status: statusFromResult, matching start.js — not terminal.status).

package/src/sidecar/session-finalize.js

@@ -51,6 +51,9 @@ function finalizeHeadlessResult(sessionDir, result, project, metadata) {
     fs.writeFileSync(SessionPaths.summaryFile(sessionDir), result && result.summary ? result.summary : '', { mode: 0o600 });
     metadata.status = 'error';
     metadata.reason = (result && result.error) ? String(result.error) : 'Incomplete';
+    if (result && typeof result.finish === 'string') { metadata.finish = result.finish; } else { delete metadata.finish; } // #218 PR 3: emit-when-set; a stale one is removed (council #232 r1 B1)
+    if (result && typeof result.variant === 'string') { metadata.variant = result.variant; } else { delete metadata.variant; } // #218 PR 4: same rule as finish (named mutant "SHAREDNOVARIANT", tests/shared-server-finalize.test.js)
+    if (result && result.variantUnverified === true) { metadata.variantUnverified = true; } else { delete metadata.variantUnverified; }
     metadata.completedAt = new Date().toISOString();
     writeFileAtomic(
       path.join(sessionDir, 'metadata.json'),
@@ -61,7 +64,7 @@ function finalizeHeadlessResult(sessionDir, result, project, metadata) {
   }
   // complete / timed-out / aborted: persist the (possibly partial) summary with
   // the resolved status. Explicit status means the #36 guard won't re-classify.
-  finalizeSession(sessionDir, (result && result.summary) || '', project, metadata, { status: terminal.status });
+  finalizeSession(sessionDir, (result && result.summary) || '', project, metadata, { status: terminal.status, finish: result && result.finish, variant: result && result.variant, variantUnverified: result && result.variantUnverified });
 }
 
 module.exports = { resolveTerminalState, finalizeHeadlessResult };

package/src/sidecar/session-utils.js

@@ -70,7 +70,7 @@ function saveInitialContext(sessionDir, systemPrompt, userMessage) {
   fs.writeFileSync(SessionPaths.contextFile(sessionDir), content, { mode: 0o600 });
 }
 
-/** Finalize session - detect conflicts, save summary, update metadata */
+/** Finalize session - detect conflicts, save summary, update metadata. opts.finish (#218 PR 3) stamps metadata.finish when set and REMOVES a prior one otherwise; opts.variant / opts.variantUnverified (#218 PR 4) follow the same rule — a resumed run reuses the same metadata and must not inherit the last attempt's finish (council #232 r1 B1). */
 function finalizeSession(sessionDir, summary, project, metadata, opts = {}) {
   const metaPath = SessionPaths.metadataFile(sessionDir);
 
@@ -102,6 +102,10 @@ function finalizeSession(sessionDir, summary, project, metadata, opts = {}) {
   // summary must never silently default to 'complete' — that hid errored/empty
   // shared-server runs behind a 0-byte summary and a false success.
   const hasSummary = typeof summary === 'string' && summary.trim().length > 0;
+  if (typeof opts.finish === 'string') { metadata.finish = opts.finish; } else { delete metadata.finish; }
+  // #218 PR 4: the effort level SENT and whether the engine's catalogue knew the model — the same emit-when-set / delete-when-absent rule as finish. Named mutants "SOLOVARIANTDROPPED" / "STALEVARIANT" (tests/sidecar/session-utils.test.js).
+  if (typeof opts.variant === 'string') { metadata.variant = opts.variant; } else { delete metadata.variant; }
+  if (opts.variantUnverified === true) { metadata.variantUnverified = true; } else { delete metadata.variantUnverified; }
   metadata.status = opts.status || (hasSummary ? 'complete' : 'error');
   metadata.completedAt = new Date().toISOString();
   writeFileAtomic(metaPath, JSON.stringify(metadata, null, 2), { mode: 0o600 });

package/src/sidecar/start-metadata.js

@@ -42,7 +42,7 @@ function createSessionMetadata(taskId, project, options) {
     briefing: effectiveBriefing,
     mode: isHeadless ? 'headless' : 'interactive',
     agent: agent || (isHeadless ? 'build' : 'chat'),
-    thinking: thinking || 'medium',
+    ...(thinking ? { thinking } : {}), // #218 PR 4: emit-when-requested — 'medium' was never sent (probe F1), so a run with no --thinking runs at the provider's default and records none (named mutant "MEDIUMDEFAULT")
     status: 'running',
     pid: existing.pid || process.pid,
     createdAt: existing.createdAt || new Date().toISOString(),