amicus 4.9.6 → 4.9.8

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.6",
+  "version": "4.9.8",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,252 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.8] - 2026-09-13
+
+### Changed
+
+- **Council legs run as two per-run agents with an explicit tool allowlist.** Stage-1 seats and
+  their retries run as `council-seat` — task mode defaults to `webfetch`, review mode to no tools,
+  and `--tools <a,b,c>` (MCP: `tools`) opts more in, validated against the engine's own declared
+  ids before any leg launches; repair, judge, debate and chair legs run as `council-support` with
+  no tools at all. `task` and `skill` are refused (they spawn or escape the session), as are
+  `edit`/`write`/`apply_patch`/`question`/`invalid`; `--agent Plan|Build` is the escape hatch
+  (`Plan` = the pre-4.9.8 behaviour: edits denied, reads/searches/shell allowed). A local tool
+  needs `--out-dir` outside the project tree and scopes the seats to the tree with
+  `external_directory: deny`. With `read` opted in the seat is denied `.env`, `.env.*` and
+  `.envrc` files at the engine (the match is case-sensitive on Linux; the deny rules are
+  measured to render after the seat's own read allow; the refusal itself is exercised by the
+  release ritual's live run); `grep` and `bash` have no per-file fence. `bash` is outside
+  every fence (run directory, home, network) and the CLI says so when it is opted in; the CLI
+  also prints a Notice for `grep`/`glob` (no per-file fence) and for `--agent Plan` (every leg
+  can run commands); `tools: null` is treated as unset like `agent: null`; an `--agent` run's
+  directory stays inside the project; `--tools` and `--agent` cannot be combined; `todowrite`
+  counts as a tool that never touches the tree. After registration, the run also reads back
+  what the engine actually rendered for each council agent — over the run directory, its
+  `_scratch` support-leg directory, and the project tree when local — and refuses before
+  launch if an `opencode.json`/`.opencode/agent` file the engine loads for that directory (the
+  tree's, or your global config) widened it, or if the engine cannot be asked at all
+  once verification can run — including when the run's own shared OpenCode server fails to
+  start: a default (non-`--agent`) run now refuses before any launch instead of falling back,
+  and the per-wave fallback servers that used to absorb that failure for every run now serve
+  only an `--agent` run, whose verification is skipped by design; a reviewed tree's own config
+  was measured to merge into the registered agent by key order (ruling P2-R33; the
+  unconditional refusal on an unverifiable engine, a failed shared-server start included, is
+  P2-R38/P2-R43, `_scratch` coverage is P2-R39, and the external_directory exemption for the
+  engine's own tool-output cache — resolved XDG-first, matching `auth-json.js`/`engine-log.js`
+  — is narrowed by P2-R40/P2-R42). The tripwire also verifies the council agents' non-permission
+  surface (prompt, model, sampling, options, mode) as rendered, since a tree can set those too
+  (P2-R53); a council agent is registered by replacing any same-name entry; the local-tool
+  placement rule compares physical paths, so a run directory reached through a symlink into the
+  project is refused (P2-R54); the CLI prints a Notice for `read` naming its exact fence;
+  `tools: null` over MCP is unset (P2-R55).
+  Two of the three leg-loss classes in the 2026-09-11 study shared one
+  precondition — a seat reached for a tool it did not need (gemini `grep`/`glob` over the global
+  install, cohere `task {}`) — and this closes that door. Previously every leg ran as the engine's
+  `Plan` agent, which denies file edits but leaves the rest of the tool set available (the
+  study saw seats reach for `grep`, `glob` and `task` under it). (`docs/council.md` § Tool
+  access; spec §4; PR 2 of 3.)
+
+### Fixed
+
+- **Headless legs are no longer declared complete while the engine is still answering.**
+  The stable-idle heuristic (`headless.js`, the v4.4 B4 "measured defect site") now
+  defers to `session.status`: while the engine reports `busy` (or `retry`, provider
+  backoff) and no tool call is live, flat output is treated as activity rather than
+  silence, and the leg waits for its message to finalize. In-flight reasoning and text
+  are invisible to the poller, so a seat that narrated between tool calls and then
+  answered for longer than 60 s was harvested mid-answer — three complete council
+  deliverables were discarded 39–107 s before they finished in the 2026-09-11
+  study (run D0), and the run reported `complete` with no degrades. The B4 bounded
+  tool-settle ceiling is unchanged and still governs whenever a tool call is live. When
+  `session.status` is unavailable the heuristic runs as the fallback it was always meant
+  to be. The trade is explicit: a busy-but-wedged (or permanently retrying) leg that
+  already produced output now runs to its `--timeout` (15 min default) and is named
+  `timeout`, instead of being declared complete at 60 s on a stub; the debug trace
+  names the veto once per flat stretch (and again whenever a non-zero count is reset,
+  e.g. a status flip-flop) and the exit line records the last engine status. When the
+  fallback heuristic ends an unfinalized message the leg logs a warning naming the
+  status it saw, and a retry whose next attempt lies beyond the leg deadline ends the
+  leg at once as `RETRY_BEYOND_DEADLINE` instead of holding the seat (never once the
+  last message has finalized — that leg completes normally — and never while a tool
+  call is live, where the tool-settle ceiling governs).
+  (`docs/superpowers/specs/2026-09-11-council-leg-completion-design.md` §3; PR 1 of 3.)
+- **A seat whose findings nothing could verify is now visible in the report and in the verdict
+  census.** When a Stage-1 response carried no parseable findings block and the bounded repair
+  supplied one, the seat's `runStats` row has carried `findingsUnverified: true` since the repair
+  contract landed (LC-11) — through `tally.json` and `verdict.json` — and died at the renderer:
+  `report.html`'s **What was lost** table held only the degrade sink's records (dead legs and the
+  like), and `seatsReviewed` counted the seat as a full reviewer. Now the report (Markdown and
+  HTML) gains one **What was lost** row per such seat (channel `unverified-repair`: *seat X's
+  findings came from a repair of a response with no findings block — nothing verified them*) and
+  one per refused repair (channel `repair-refused`, naming the code), derived from `runStats` when
+  the report is built — so `amicus council report` on an older `verdict.json` shows them too, and
+  nothing in `run.json`, the exit code or the degrade sink changes. `verdict.json`'s census gains
+  two numbers, `seatsReviewed: {reviewed, unverified, refused, of}` (always written, never more
+  than `reviewed`; older documents still validate) — `refused` (council #248 round 2) counts
+  seats whose repair was refused: they tallied no findings and would otherwise read as full
+  reviewers on every gate surface, and the council-review check title and sticky comment print
+  `(N unverified)` and `(N refused)` when non-zero. A run also prints one `Notice:` line on
+  stderr at the end naming its unverified and refused seats, so a local run is no longer silent
+  about them; the exit code and every artifact are unchanged. The wording never says "stub":
+  the flag also fires on a real review whose trailing JSON block was malformed. Study run D0
+  (three narration stubs, three repairs) now reads `{reviewed: 3, unverified: 3, refused: 0,
+  of: 3}` in `verdict.json` — `seats reviewed: 3 of 3 (3 unverified)` in the sticky comment
+  — with three rows in the report, where it read `{reviewed: 3, of: 3}` and nothing. (#242;
+  `docs/superpowers/specs/2026-09-11-council-leg-completion-design.md` §5; PR 3 of 3.)
+
+## [4.9.7] - 2026-09-09
+
+Three findings deferred from the v4.9.6 cut, and the two open questions filed beside them. The
+council run that raised the three reviewed at **2 of 4 seats**, so each carried the weight of two
+seats — and on the one that mattered most, the filing turned out to be right about the defect and
+wrong about the fix.
+
+### Fixed
+
+- **A promote can no longer delete a working install that was cross-installed for another
+  platform.** v4.9.6 captured and restored a `path.txt` naming another platform's executable, but
+  the guard that decides whether a `dist/` may be removed in place still asked only about THIS
+  platform's default name. On a package installed through `npm_config_platform`, a promote whose
+  retirement rename failed therefore restored the pointer and deleted the tree it pointed at —
+  reproduced against the shipped code with a real filesystem and only `renameSync` injected to
+  throw the EPERM the fallback exists for.
+
+  The guard now judges by what `path.txt` actually names. **As a union with the platform default,
+  never as a replacement** — which is the part the finding did not say, and implementing its
+  sentence literally destroys a working `dist/electron.exe` on three shapes the old guard protected:
+  a whitespace-only `path.txt`, one with a trailing newline (`existsSync` of a name ending in `\n`
+  is false on Windows), and a TRUNCATED one — `electr`, the shape this function's own best-effort
+  put-back can leave. The platform-default arm runs first and is unchanged, so the set of trees a
+  promote will delete can only ever shrink.
+
+  The `path.txt` name additionally has to be **contained** in `dist/` and has to be a **file**: a
+  `path.txt` of `..`, `.` or `../SIBLING` names something that exists but that the delete never
+  touches, and every truncation of the darwin name (`Electron.app`, `Electron.app/Contents`,
+  `.../MacOS`) is a real directory — accepting either would refuse every promote forever while
+  reporting that `dist/` "holds a usable Electron.app". The refusal message now names the executable
+  that was found rather than the one that was looked for, because `docs/troubleshooting.md` tells
+  the user that refusal means the tree holds a usable executable.
+
+  An **unreadable** `path.txt` now refuses rather than guessing; an absent one still heals. The rule
+  itself moved to `src/sidecar/electron-exe-rel.js` and `resolveElectronBinary` now calls it, with a
+  table-driven test asserting both sides agree over seven `path.txt` shapes on three platforms with
+  and without `ELECTRON_OVERRIDE_DIST_PATH`. Two copies of one rule are what let these drift, and
+  the finding's own words for the defect were "did not carry one function over".
+
+- **(docs)** `.github/workflows/ci.yml` claimed `--omit=optional` "skips the Electron download". It
+  skips the optional *package*; there is no download on the default path to skip, because
+  `electron@43.1.1` ships no install script at all. Measured on run `34246117877` across all three
+  runner platforms.
+
+### Security
+
+- **The rescue boundary now reads BOTH tables an archive declares its entry names in.** A zip
+  carries its names twice — in the central directory and in each local file header — and amicus
+  read only the first. An archive can blind that one while leaving every local header whole: cutting
+  the tail off does it by accident, and four one-field edits to a *complete* end-of-central-directory
+  record do it on purpose. Measured against the real extractor with the hatch armed, **seven such
+  archives carrying a `../../../` entry reached a native extractor, and two ran to completion and
+  promoted the result.** Nothing escaped only because the Windows tools refuse `..` themselves — the
+  exact reliance this subsystem says amicus will not make.
+
+  The two tables can also disagree, and the tools do not agree on which to believe: measured,
+  `tar.exe` wrote the name from the local header while `Expand-Archive` wrote the one from the
+  central directory. A refusal in either table now refuses the archive.
+
+  **It costs no measured availability.** On six real Electron artifacts the local walk enumerates
+  every name in 0-1 ms and agrees with the central table entry-for-entry; on a truncated archive,
+  where the central walk goes blind, it still reads them all. The archives this rescue exists for
+  are still rescued. And the notice printed before a spawn now says *which* names were checked —
+  all of them, some of them, or none — because a real artifact truncated by a few kilobytes leaves
+  both walks incomplete while every name it found was read and cleared, and a two-state notice would
+  have claimed nothing was checked over dozens that were.
+
+  **Two council rounds then found the first cut of this incomplete, and the second cut of it
+  incomplete again — both in the same direction.** A walk that could not follow the chain used to
+  STOP, and an entry it never reached is an entry it cannot refuse: a lying size jumped one, and
+  later a *standard* data-descriptor entry (general-purpose bit 3 with a zero size — an ordinary
+  streaming encoding, not a malformed one) hid everything behind it. Neither needed an exotic
+  archive. So the walk now DEMOTES its claim and keeps going wherever it still has an offset to
+  follow — because a name it can still read is a name it can still refuse — and where it genuinely
+  has none, it SWEEPS the region it could not reach for local headers and puts their names through
+  the same rule. It can only add refusals, so an archive that is rescued today stops being rescued
+  only if it declares a hostile name. **The practical consequence for a user: an archive carrying a
+  traversal name behind an unreadable point is now refused where it previously reached the native
+  extractor.**
+
+  The claim "every name was checked" also became a conjunction rather than a disjunction. The two
+  tables carry different names and the two extractors read different ones, so one readable table
+  never meant both were clean — measured, a stopped local walk beside a benign central directory
+  reported all-clear and printed nothing while `tar.exe` reached a `../../../` entry only the local
+  table carried.
+
+### Added
+
+- **A macOS job that runs the real extract path over the real Electron `.app` artifact**
+  (`.github/workflows/darwin-bundle.yml`, `scripts/probe-darwin-extract.js`). v4.9.6 shipped a
+  symlink target-escape check that `extract-zip` does not have, and disclosed that it might *reject*
+  a layout that previously worked. **It does not** — measured against the real
+  `electron-v43.1.1-darwin-arm64.zip`: 585 records, 14 symlinks, every target relative, none with a
+  `..` component, none absolute, and none of the 585 entry names traversing a symlinked component.
+  The linux artifacts hold zero symlink entries, so that path is unreachable there at all.
+
+  What was left was coverage rather than risk, and the job closes it: a real `symlinkSync`, a real
+  `realpathSync` behind the chain control, the absolute-target branch on POSIX arithmetic, and
+  `Electron --version` loading the framework through two of the fourteen links. Ten assertions, each
+  naming the one-line mutation it catches. The parity diff against `@electron-internal/extract-zip`'s
+  own tree ships **report-only** on its first cut — that comparison has never been measured, and a
+  gate that has never been run once is not evidence.
+
+### Changed
+
+- **The claim that the native extractors refuse traversal themselves is now re-measured on every CI
+  run, instead of being asserted once.** That claim is the compensating control the rescue's
+  boundary leans on, and a claim nothing re-measures is a claim that rots.
+  `tests/sidecar/native-extractor-containment.test.js` drives 12 escape shapes through every
+  strategy that resolves on the machine. Newly measured this way: Info-ZIP `unzip` contains its own
+  escapes by stripping them, and GNU `tar` cannot read a zip at all — both were previously written
+  down as unmeasured. **`ditto`, the first macOS strategy, is now the only unmeasured one**, and the
+  macOS runner already in the matrix measures it the first time this suite runs there.
+
+  A proposed runtime "fence" around the Electron package directory was **refused rather than
+  deferred**, and the reasons are recorded because they were measured: a names-diff fence is blind
+  to an overwrite of `dist/electron.exe` or `path.txt`; and signalling a breach through the
+  available channel deletes the user's cached artifact and reports it corrupt — which a *false*
+  breach, reachable from a concurrent provision, would then do to the air-gapped machine this whole
+  feature exists for.
+
+  Half of the finding that prompted it was already false: everything the rescue writes lives under a
+  private incoming directory that is deleted unconditionally, so only an absolute write outside that
+  tree survives a failed strategy. Two shipped documents said otherwise and are corrected. The child
+  now also runs with that directory as its working directory — measured neutral, and it costs a line.
+
+- **The CI council bench reserves 64,000 output tokens per leg instead of the engine's 32,000
+  default** — for every PR whose base carries the change. The alias map is fetched from the BASE
+  REF, so a branch cannot change the reviewers of its own PR; the config therefore lands on `main`
+  separately and takes effect for runs opened after it, never for the branch carrying it. Measured:
+  the run on the PR that first carried this reported `outputBudget is unset` and lost a seat at the
+  32,000 default exactly as before. Across the five paid council runs on the v4.9.6 branch the bench averaged **2.8 of 4
+  seats**, and four of the six lost seats died at the reservation with `finish: 'length'` and
+  0–651 usable output tokens.
+
+  **64,000 is measured, not chosen.** Against the pinned engine with the bare descriptors CI
+  registers, it lands unclamped on all four seats and the chair in both catalogue states. The
+  binding ceiling is **65,536**, and on a cold read it is shared by **two** rows — the chair and
+  `deepseek-v4-flash-0731` — not by the chair alone: the flag at 100,000 arrives as
+  `max_tokens 65536` on both. A budget above it would land in full on three seats while two were
+  silently clamped, and a run would stop reserving one number. The pre-flight step now fails before
+  any spend on a budget above the ceiling or on one amicus would reject and silently replace with
+  32,000; the alias map's own validator inspects aliases only, so nothing caught that before.
+
+  **What it does not fix, said up front:** the other two lost seats — and ten of the eleven failed
+  first attempts — produced nothing at all and never reached a reservation. Expect roughly 3.6 of 4,
+  not 4 of 4. Read the death class rather than the seat count: three of the four targeted legs ran
+  529–596 s of a 960 s leg cap, so an `OUTPUT_LENGTH` death can convert into a generic timeout,
+  which is the same lost seat with a worse diagnosis. The leg cap deliberately did not move in the
+  same change — raising it busts the 75-minute job cap, and a bust cancels the job, which deletes
+  the run-directory artifact every diagnosis of this class rests on.
+
 ## [4.9.6] - 2026-09-08
 
 *Amicus never itself writes, or reports as verified, bytes it did not hash.*

package/README.md

@@ -455,7 +455,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.6",
+  "version": "4.9.8",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/docs/ROADMAP.md

@@ -13,13 +13,13 @@ lives under **Backlog (tracked, not scheduled)** with everything else that is re
 Nothing about the content changed and no judgment about its value is implied; only its status. When
 an org buyer and the org to support them exist, it earns a number then.
 
-Amicus is at **v4.9.6** (2026-09-08). Each 4.x rev below leads with the benefit, not the
+Amicus is at **v4.9.8** (2026-09-13). Each 4.x rev below leads with the benefit, not the
 plumbing; the patch releases since v4.9.0 carry no section of their own, because each corrected a
 defect rather than adding scope — where one added a surface (v4.9.4's `--thinking` refusals and
-`output-budget` doctor row, v4.9.5's Electron digest gate, v4.9.6's artifact custody) it did so to
+`output-budget` doctor row, v4.9.5's Electron digest gate, v4.9.6's artifact custody, v4.9.7's dual name-table rescue boundary, v4.9.8's per-run seat tool allowlist and its unverified/refused seat census) it did so to
 make an existing promise true, not to widen it. See `CHANGELOG.md` for what each one contained.
 
-**Status:** v4.0 through **v4.9.0** have **shipped**, plus the v4.9.1–v4.9.6 patch releases —
+**Status:** v4.0 through **v4.9.0** have **shipped**, plus the v4.9.1–v4.9.8 patch releases —
 everything on this page is a record of what landed, not a plan. Composition — the scope that
 carried the number v4.6 here until the degrade-announcement-invariant milestone took the v4.6.0
 release (2026-08-02) — is now an unscheduled candidate for the next rev, tabled in its own section

package/docs/architecture-map.md

@@ -38,6 +38,7 @@ src/
 │   ├── presets-cli.js
 │   ├── report-cost.js
 │   ├── report-html.js
+│   ├── report-lost-rows.js
 │   ├── report-md.js
 │   ├── report.js
 │   ├── run-assemble.js
@@ -56,6 +57,8 @@ src/
 │   ├── run-retry-notes.js
 │   ├── run-retry-window.js  # The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay
 │   ├── run-retry.js
+│   ├── run-seat-tools-verify.js  # The engine-rendering tripwire's pure pieces, plus `verificationDirectories`'
+│   ├── run-seat-tools.js
 │   ├── run-server.js
 │   ├── run-stage1-launch.js  # Stage-1 launch pass for the council engine.
 │   ├── run-stage1-rows.js
@@ -66,6 +69,7 @@ src/
 │   ├── run-stats-entry.js
 │   ├── run-verdict-files.js
 │   ├── run.js
+│   ├── seat-tools.js
 │   ├── seats.js
 │   ├── stage1-bind.js
 │   ├── street-cred.js
@@ -112,6 +116,7 @@ src/
 │   ├── electron-custody.js  # CUSTODY of the Electron artifact: one open, one read, one Buffer.
 │   ├── electron-ensure.js  # ensureElectron() — lazy first-GUI provisioning (#55).
 │   ├── electron-env-scrub.js  # The ENV SCRUB — which environment names a hostile REPOSITORY can plant.
+│   ├── electron-exe-rel.js  # WHICH exe a package resolves through, and whether a `dist/` HOLDS one.
 │   ├── electron-install.js  # Electron self-heal primitive (#53, #59).
 │   ├── electron-layout.js  # The on-disk LAYOUT of an installed `electron` package: where the executable
 │   ├── electron-lock.js  # Stale-aware single-flight lock for the electron self-heal (#53).
@@ -134,6 +139,7 @@ src/
 │   ├── fanout-validate.js
 │   ├── fanout-wave-io.js
 │   ├── fanout.js
+│   ├── heartbeat.js
 │   ├── interactive-abort.js
 │   ├── interactive-mirror.js
 │   ├── interactive-process.js  # Sidecar Interactive Process Helpers - Electron probe/env/process-exit plumbing
@@ -166,6 +172,7 @@ src/
 │   ├── workspace-window.js  # Council Workspace launcher (v4.4 §4.3/§4.4) — setup-window.js pattern:
 │   ├── zip-entry-write.js  # ONE ENTRY of an in-memory archive, and the classified failures every caller
 │   ├── zip-from-buffer.js  # Extract an archive that is ALREADY IN MEMORY and ALREADY HASHED.
+│   ├── zip-local-name-scan.js  # THE OTHER TABLE AN ARCHIVE DECLARES ITS NAMES IN — the local file headers.
 │   ├── zip-name-scan.js  # WHAT NAMES DOES THIS ARCHIVE DECLARE? A read-only walk of the central
 │   └── zip-stall-bound.js  # WHEN AMICUS GIVES UP ON AN IN-MEMORY EXTRACTION, and how it stops the work.
 ├── template/
@@ -306,6 +313,7 @@ src/
 │   └── seat-space.js  # Council Workspace — the seat-space PREDICATES (v4.8 PR5b).
 ├── cli-council-run-bench.js  # Bench and input resolution for the council run command.
 ├── cli-council-run-render.js
+├── cli-council-run-tools.js  # `--tools`/`--agent` validation and the v4.7 out-dir fence for `council run`.
 ├── cli-handlers-abort.js  # CLI Abort Handler (B21-rest extraction)
 ├── cli-handlers-council-run.js
 ├── cli-handlers-council.js
@@ -334,6 +342,7 @@ src/
 ├── jsonl-parser.js  # JSONL Parser
 ├── mcp-council-awareness.js
 ├── mcp-council-bench.js
+├── mcp-council-pack-map.js  # COUNCIL_PACK_PARAM_MAP, split out of mcp-council-run.js for the 300-line size gate (P2-R16).
 ├── mcp-council-run.js
 ├── mcp-notify.js  # Pure helpers + in-process registry for the MCP `onComplete: 'mcp-notify'`
 ├── mcp-server.js  # @module mcp-server — Amicus MCP Server (stdio transport)
@@ -417,6 +426,8 @@ scripts/
 ├── integration-test.sh
 ├── mark-test-passed.js  # Writes the current git HEAD SHA to .test-passed for the pre-push SHA cache
 ├── postinstall.js  # Post-install script for amicus
+├── probe-council-agents.js  # Spec 2026-09-11 §4 — the ENGINE side of the council agents (ruling P2-R21).
+├── probe-darwin-extract.js
 ├── probe-max-tokens.js  # Wire probe for issue #218: what max_tokens / reasoning / thinking does the
 ├── run-integration-keyless.js
 ├── setup-hooks.js  # Configure git to run the version-controlled hooks in .husky/.
@@ -449,6 +460,7 @@ evals/
 |--------|---------|-------------|
 | `cli-council-run-bench.js` | Bench and input resolution for the council run command. | `resolveBench()`, `resolveChair()`, `resolveCritic()`, `CHAIR_DEFAULT()`, `parseList()` |
 | `cli-council-run-render.js` |  | `renderRunHuman()` |
+| `cli-council-run-tools.js` | `--tools`/`--agent` validation and the v4.7 out-dir fence for `council run`. | `checkCouncilRunTools()` |
 | `cli-handlers-abort.js` | CLI Abort Handler (B21-rest extraction) | `handleAbort()` |
 | `cli-handlers-council-run.js` |  | `handleCouncilRun()`, `renderRunHuman()`, `CHAIR_DEFAULT()` |
 | `cli-handlers-council.js` |  | `handleCouncil()` |
@@ -477,6 +489,7 @@ evals/
 | `jsonl-parser.js` | JSONL Parser | `parseJSONLLine()`, `readJSONL()`, `extractTimestamp()`, `formatMessage()`, `formatContext()` |
 | `mcp-council-awareness.js` |  | `subWaveIds()`, `countWaveLegs()`, `elapsedOf()`, `enginePid()`, `buildCouncilStatusPayload()` |
 | `mcp-council-bench.js` |  | `resolveBenchInput()`, `auditBenchAliases()` |
+| `mcp-council-pack-map.js` | COUNCIL_PACK_PARAM_MAP, split out of mcp-council-run.js for the 300-line size gate (P2-R16). | `COUNCIL_PACK_PARAM_MAP()` |
 | `mcp-council-run.js` |  | `handleCouncilRunTool()`, `COUNCIL_PACK_PARAM_MAP()`, `buildCouncilStatusPayload()`, `listCouncilRuns()`, `abortCouncilRun()` |
 | `mcp-notify.js` | Pure helpers + in-process registry for the MCP `onComplete: 'mcp-notify'` | `validateOnComplete()`, `buildNotifyPayload()`, `requestMcpNotify()`, `consumeMcpNotify()` |
 | `mcp-server.js` | @module mcp-server — Amicus MCP Server (stdio transport) | `handlers()`, `startMcpServer()`, `getProjectDir()`, `resolveProjectDir()`, `getClientRoot()` |
@@ -491,7 +504,7 @@ evals/
 | `spend-query.js` |  | `filterRows()`, `groupRows()`, `computeWasted()`, `emptyTokens()`, `addTokens()` |
 | `council/anonymize.js` |  | `assignLabels()`, `toGlobalId()`, `toGlobalFindings()`, `rankingToOrder()`, `LETTERS()` |
 | `council/briefings-chair-task.js` |  | `CHAIR_ANSWER_VALUES()`, `ANSWER_SCALE_ADDENDUM()`, `TASK_CHAIR_SYNTHESIS()`, `TASK_CHAIR_SYNTHESIS_NO_CLAIMS()`, `TASK_CONCURRENCE_CAVEAT()` |
-| `council/briefings-chair.js` |  | `dateLine()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `chairRepairPromptFor()`, `CHAIR_VERDICT_VALUES()`, `VERDICT_SCALE_ADDENDUM()` |
+| `council/briefings-chair.js` |  | `dateLine()`, `CHAIR_NO_TOOLS_LEAD()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `chairRepairPromptFor()`, `CHAIR_VERDICT_VALUES()` |
 | `council/briefings-debate.js` |  | `DEBATE_NO_TOOLS_PREAMBLE()`, `DEFENSE_CONTRACT()`, `REVOTE_CONTRACT()`, `buildDefenseBrief()`, `buildRevoteBundle()` |
 | `council/briefings-stage2-task.js` |  | `TASK_JUDGE_FRAME()`, `TASK_JUDGE_A()`, `TASK_JUDGE_B()`, `TASK_JUDGE_B_NO_CLAIMS()`, `NO_CLAIMS_INDEX()` |
 | `council/briefings-stage2.js` |  | `JUDGE_NO_TOOLS_PREAMBLE()`, `CHAIR_NO_TOOLS_PREAMBLE()`, `CHAIR_VERDICT_VALUES()`, `JUDGE_OUTPUT_CONTRACT()`, `VERDICT_SCALE_ADDENDUM()` |
@@ -508,6 +521,7 @@ evals/
 | `council/presets-cli.js` |  | `runSave()`, `runList()`, `runShow()` |
 | `council/report-cost.js` |  | `buildCostModel()` |
 | `council/report-html.js` |  | `renderHtml()` |
+| `council/report-lost-rows.js` |  | `lostRowsOf()` |
 | `council/report-md.js` |  | `renderMd()` |
 | `council/report.js` |  | `buildReport()`, `toModel()`, `TIER_ORDER()`, `SYMBOL()`, `isSeatSpace()` |
 | `council/run-assemble.js` |  | `buildRunStatsEntry()`, `worseConformance()`, `buildTallyInput()`, `writeTallyFiles()`, `writeVerdictFiles()` |
@@ -516,7 +530,7 @@ evals/
 | `council/run-debate-revote.js` |  | `legOpts()`, `legRow()`, `runRevoteWave()` |
 | `council/run-debate-stage.js` |  | `runDebateStage()` |
 | `council/run-debate.js` |  | `runDebate()`, `nothingToDebate()`, `disputingJudges()`, `debateTargets()` |
-| `council/run-degrade.js` |  | `createDegradeSink()` |
+| `council/run-degrade.js` |  | `createDegradeSink()`, `noteDroppedMembers()` |
 | `council/run-finalize.js` |  | `statusForExit()`, `resolveTerminalExit()`, `writeRunTerminal()`, `SIGNAL_EXIT()` |
 | `council/run-finish.js` |  | `finishRun()` |
 | `council/run-launch.js` |  | `createLaunchers()`, `materializeReviews()`, `materializeDebate()`, `sanitizeName()`, `isAbortExit()` |
@@ -526,7 +540,9 @@ evals/
 | `council/run-retry-notes.js` |  | `waveStillDeadNote()`, `skippedWaveNote()`, `srcLegStillDeadNote()`, `retryLegStillDeadNote()`, `missingLegStillDeadNote()` |
 | `council/run-retry-window.js` | The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay | `retryBackstopMs()` |
 | `council/run-retry.js` |  | `groupStage1Losses()`, `retryStage1Losses()` |
-| `council/run-server.js` |  | `acquireRunServer()`, `releaseRunServer()`, `resolveRunServerModels()`, `recordServerFate()` |
+| `council/run-seat-tools-verify.js` | The engine-rendering tripwire's pure pieces, plus `verificationDirectories`' | `verificationDirectories()`, `listEngineAgents()`, `verifyAgentRendering()`, `verifyAgentFields()`, `resolvePhysicalPath()` |
+| `council/run-seat-tools.js` |  | `preflightSeatTools()`, `validateSeatToolsAgainstEngine()`, `listEngineAgents()`, `verifyAgentRendering()`, `verifyAgentFields()` |
+| `council/run-server.js` |  | `acquireRunServer()`, `releaseRunServer()`, `resolveRunServerModels()`, `recordServerFate()`, `listEngineToolIds()` |
 | `council/run-stage1-launch.js` | Stage-1 launch pass for the council engine. | `launchStage1()` |
 | `council/run-stage1-rows.js` |  | `pushDeadSeatRows()`, `supersededRows()` |
 | `council/run-stage1-superseded.js` |  | `supersededRows()` |
@@ -536,12 +552,13 @@ evals/
 | `council/run-stats-entry.js` |  | `buildRunStatsEntry()` |
 | `council/run-verdict-files.js` |  | `writeVerdictFiles()` |
 | `council/run.js` |  | `runCouncil()`, `pickFallbackChair()`, `SIGNAL_EXIT()` |
+| `council/seat-tools.js` |  | `REFUSED_TOOL_IDS()`, `REMOTE_TOOL_IDS()`, `NON_LOCAL_TOOL_IDS()`, `SEAT_READ_DENY_PATTERNS()`, `defaultToolsFor()` |
 | `council/seats.js` |  | `buildSeats()`, `roleAt()`, `bindSeats()`, `artifactName()`, `displayName()` |
 | `council/stage1-bind.js` |  | `bindStage1Waves()`, `orphanLegNote()`, `missingSeatDeadWave()`, `bindPaddedWave()` |
 | `council/street-cred.js` |  | `computeStreetCred()`, `rankPositions()`, `credSeats()` |
 | `council/tally.js` |  | `assignTier()`, `computeStreetCred()`, `tally()`, `COUNCIL_SCHEMA_VERSION()` |
 | `council/verdict-seat-loss.js` |  | `summarizeSeatLoss()`, `deriveSeatLoss()` |
-| `council/verdict-seats-reviewed.js` | #202: the bench-seat census for verdict.json, as a spreadable fragment. | `seatsReviewedOf()` |
+| `council/verdict-seats-reviewed.js` | #202: the bench-seat census for verdict.json, as a spreadable fragment. | `seatsReviewedOf()`, `isBenchRole()`, `isUnverifiedSeat()`, `isRefusedSeat()`, `seatLabel()` |
 | `council/verdict.js` |  | `buildVerdict()`, `summarizeSeatLoss()`, `deriveSeatLoss()`, `readOverallVerdict()`, `readPriorVerdictSurfaces()` |
 | `design/tokens.js` |  | `tokenCss()`, `TOKENS()` |
 | `observe/council-legs.js` |  | `buildLegRows()` |
@@ -566,6 +583,7 @@ evals/
 | `sidecar/electron-custody.js` | CUSTODY of the Electron artifact: one open, one read, one Buffer. | `readArtifactBytes()`, `isSafeArtifactName()`, `MAX_ARTIFACT_BYTES()`, `READ_CHUNK()` |
 | `sidecar/electron-ensure.js` | ensureElectron() — lazy first-GUI provisioning (#55). | `ensureElectron()`, `_resetEnsureElectron()` |
 | `sidecar/electron-env-scrub.js` | The ENV SCRUB — which environment names a hostile REPOSITORY can plant. | `isRepoPlantedName()`, `withScrubbedRepoEnv()`, `REPO_ENV_PREFIXES()` |
+| `sidecar/electron-exe-rel.js` | WHICH exe a package resolves through, and whether a `dist/` HOLDS one. | `platformExe()`, `writePathTxt()`, `heldExeRel()`, `distHeldExe()` |
 | `sidecar/electron-install.js` | Electron self-heal primitive (#53, #59). | `resolveElectronBinary()`, `isElectronUsable()`, `cachedZip()`, `repairElectron()`, `platformExe()` |
 | `sidecar/electron-layout.js` | The on-disk LAYOUT of an installed `electron` package: where the executable | `platformExe()`, `writePathTxt()`, `promoteDist()`, `extractBytesToDist()`, `sweepPromoteLitter()` |
 | `sidecar/electron-lock.js` | Stale-aware single-flight lock for the electron self-heal (#53). | `acquireRepairLock()`, `isStaleLock()`, `lockPathFor()`, `STALE_MS()` |
@@ -588,6 +606,7 @@ evals/
 | `sidecar/fanout-validate.js` |  | `parseModelsList()`, `DEFAULT_MAX_LEGS()`, `validateFanoutModels()` |
 | `sidecar/fanout-wave-io.js` |  | `writeWaveMetadata()`, `writeWaveDoc()`, `finishWave()`, `stampLegAttribution()` |
 | `sidecar/fanout.js` |  | `parseModelsList()`, `deriveLegIds()`, `validateFanoutModels()`, `DEFAULT_MAX_LEGS()`, `runFanout()` |
+| `sidecar/heartbeat.js` |  | `HEARTBEAT_INTERVAL()`, `createHeartbeat()` |
 | `sidecar/interactive-abort.js` |  | `startAbortWatch()`, `markResultAborted()`, `readAbortedMarker()`, `DEFAULT_INTERVAL_MS()` |
 | `sidecar/interactive-mirror.js` |  | `startInteractiveMirror()` |
 | `sidecar/interactive-process.js` | Sidecar Interactive Process Helpers - Electron probe/env/process-exit plumbing | `getElectronPath()`, `checkElectronAvailable()`, `buildElectronEnv()`, `handleElectronProcess()` |
@@ -620,6 +639,7 @@ evals/
 | `sidecar/workspace-window.js` | Council Workspace launcher (v4.4 §4.3/§4.4) — setup-window.js pattern: | `launchWorkspaceWindow()`, `launchWorkspaceWindowDetached()` |
 | `sidecar/zip-entry-write.js` | ONE ENTRY of an in-memory archive, and the classified failures every caller | `failure()`, `badArchive()`, `badDestination()`, `outOfBound()`, `extractorUnavailable()` |
 | `sidecar/zip-from-buffer.js` | Extract an archive that is ALREADY IN MEMORY and ALREADY HASHED. | `extractZipBuffer()` |
+| `sidecar/zip-local-name-scan.js` | THE OTHER TABLE AN ARCHIVE DECLARES ITS NAMES IN — the local file headers. | `scanLocalNames()`, `declaredCentralOffset()` |
 | `sidecar/zip-name-scan.js` | WHAT NAMES DOES THIS ARCHIVE DECLARE? A read-only walk of the central | `scanEntryNames()`, `nameRefusal()`, `SCAN_MS()`, `MAX_ENTRIES()` |
 | `sidecar/zip-stall-bound.js` | WHEN AMICUS GIVES UP ON AN IN-MEMORY EXTRACTION, and how it stops the work. | `IDLE_MS()`, `MAX_MS()`, `UNWIND_MS()`, `stalled()`, `awaitUnwind()` |
 | `template/apply.js` |  | `applyTemplate()`, `ARTIFACT_CAP_BYTES()` |

package/docs/configuration.md

@@ -405,26 +405,54 @@ These variables control the polling loop that drives headless sessions. The defa
 > entry early in the archive ends the walk before any later name is looked at.
 > Measured — the same three-entry archive, one flag bit apart — that moves it out
 > of the terminal class and into the rescuable one. Amicus therefore also **reads
-> the archive's central directory and refuses any entry name yauzl would have
-> refused**, before it hands anything to a native extractor. Two residuals
-> survive, and neither is engineered away:
+> the entry names the archive declares and refuses any that yauzl would have
+> refused**, before it hands anything to a native extractor — and it reads them in
+> **both of the tables a zip declares them in**, the central directory and the
+> local file headers. That second walk is not belt-and-braces. An archive can
+> blind the central directory while leaving every local header whole — a
+> truncation does it by accident, and four one-field edits to a complete
+> end-of-central-directory record do it on purpose — and measured, seven such
+> archives carrying a `../../../` entry reached a native extractor before this
+> was added, two of them running to completion. The tables can also **disagree**,
+> and the tools do not agree on which one to believe: measured, `tar.exe` wrote
+> the name from the LOCAL header and `Expand-Archive` the one from the CENTRAL
+> directory. A refusal in either table refuses the archive.
 >
-> - An archive whose **central directory cannot be read at all** — a truncated
->   zip, which is the commonest thing this rescue exists for — declares no names
->   amicus can see, and it still goes to the native extractor. The only remaining
->   check is that extractor's own. `tar` and `Expand-Archive` were measured to
->   refuse a `..` entry themselves (`tar.exe`: `Path contains '..'`, exit 1;
->   `Expand-Archive`: `Can not process invalid archive entry '…'`; nothing written
->   outside the destination in either case). **`ditto` and Info-ZIP `unzip`, the
->   macOS and Linux strategies, are unmeasured.**
+> Residuals survive, and none is engineered away:
+>
+> - An archive that defeats **both** walks still reaches the native extractor.
+>   That is rarer than it was — a truncated zip, the commonest thing this rescue
+>   exists for, still yields all of its local names — but it is not impossible,
+>   and the notice printed before the spawn now tells you **which** names were
+>   checked rather than letting you assume they all were.
 > - A **symlink whose target escapes** the extraction root is a payload, not a
 >   name, so no name scan can see it. Amicus's own in-memory extractor refuses
 >   those; a native extractor is not asked to.
+> - The name walk trusts a local header's declared size to find the next one, and
+>   a wrong size is a property of exactly the corrupt archives this rescue is for.
+>   A desynchronised walk can read a "name" out of payload bytes. It fails toward
+>   **refusing**, so it can cost a rescue and never grant one.
+>
+> When a name check cannot see it, the remaining check is the extractor's own, and
+> those are measured on every CI run rather than asserted here
+> (`tests/sidecar/native-extractor-containment.test.js`, 12 escape shapes per
+> strategy). At the time of writing: `tar.exe` refuses `..` (`Path contains '..'`,
+> exit 1) and strips absolute and drive-letter names into the destination;
+> `Expand-Archive` refuses `..` (`Can not process invalid archive entry '…'`) and
+> errors out on drive-letter and `\\?\` shapes with an empty destination; Info-ZIP
+> `unzip` contains by stripping the escaping components and writing the entry
+> inside the destination under a mangled name (its own `-hh` text documents this
+> as the default, with `-:` as the opt-out, which amicus does not pass); GNU `tar`
+> cannot read a zip at all. **`ditto`, the first macOS strategy, is the one that
+> remains unmeasured.**
 >
-> Amicus cleans up only *inside* the directory it asked the extractor to write to,
-> so anything a native tool wrote outside it would survive a failed strategy. This
-> is the concrete shape of "not a safe operation": if the archive came from
-> somewhere you do not trust, do not set this variable — get another copy.
+> Everything amicus writes for a rescue goes under a private incoming directory
+> that is deleted unconditionally afterwards, and the child is run with that
+> directory as its working directory, so a relative write lands where the cleanup
+> reaches. What amicus cannot clean up is a write a native tool makes to an
+> absolute path outside that tree. This is the concrete shape of "not a safe
+> operation": if the archive came from somewhere you do not trust, do not set this
+> variable — get another copy.
 >
 > **The one thing the strip does not cover, stated precisely** (measured against
 > `@electron/get` 5.0.0, and re-measured by