amicus 4.9.7 → 4.9.8

package/src/cli-council-run-tools.js

@@ -0,0 +1,168 @@
+/**
+ * @module cli-council-run-tools
+ * `--tools`/`--agent` validation and the v4.7 out-dir fence for `council run`.
+ *
+ * Spec 2026-09-11 §4. Split out of cli-handlers-council-run.js (P2-R15, PR 2
+ * Task 5): that file sits at the 300-line pre-commit size gate and the
+ * combined block does not fit inline.
+ *
+ * Shape only — refusals and the engine's declared-tool check are NOT here,
+ * they live in `runCouncil` (Task 4) so MCP, the workflow and any direct
+ * `require('./council/run')` caller share them. The out-dir fence IS a
+ * CLI-only concern: MCP has fenced the out-dir since v4.5
+ * (mcp-council-run.js:137-141's own `isPathInside(runDir, project)`) — this
+ * module is what gives the CLI door the same fence, which is why it lives
+ * beside the flags it depends on rather than in the engine.
+ *
+ * The fence is the v4.7 PR6 rule (`--out-dir` must stay inside the project)
+ * RELAXED for a run whose seats carry a LOCAL tool (read, grep, glob, bash):
+ * spec §4 requires such a run's directory sit OUTSIDE the project tree, and
+ * `runCouncil` enforces that placement (outside AND under an allowed root)
+ * itself — this module only has to stop blocking it. `--agent` combined with
+ * `--tools` is refused outright (ruling P2-R28), before this fence is ever
+ * consulted — the escape hatch (no council agents, no allowlist) has no
+ * tools-based agent for the relaxation to apply to.
+ */
+
+'use strict';
+
+const { ERROR_CODES } = require('./utils/error-doc');
+const { isPathInside } = require('./project-root-allowlist');
+const { parseToolsFlag, isLocal, agentToolsConflict } = require('./council/seat-tools');
+
+/**
+ * @param {{args: object, explicitKeys: Set<string>, runDir: string, project: string}} ctx
+ * @returns {{error: ({code: string, message: string, hint?: string}|null),
+ *   toolIds?: string[], agentOverride?: ('Plan'|'Build'), notices?: string[]}}
+ */
+function checkCouncilRunTools({ args, explicitKeys, runDir, project }) {
+  // Spec 2026-09-11 §4: shape only (refusals + the engine check live in
+  // runCouncil so every door — CLI, MCP, workflow — shares them).
+  let toolIds;
+  // council #247 round 5 (P2-R51, B3): `tools: null` is the CLI house style
+  // for an unset option, exactly as `agent: null` below, and runCouncil's
+  // own preflight (preflightSeatTools) already treats a null `o.tools` as
+  // absent — so this door must too.
+  if (args.tools !== null && (explicitKeys.has('tools') || args.tools !== undefined)) {
+    // B6 (P2-R35): a repeated `--tools a --tools b` (or a caller that builds
+    // args directly, MCP-input style) can arrive as an array — join it before
+    // parseToolsFlag, which only ever spoke the comma-string shape.
+    const raw = Array.isArray(args.tools) ? args.tools.join(',') : args.tools;
+    const parsed = parseToolsFlag(raw);
+    if (!parsed.ok) { return { error: { code: ERROR_CODES.BAD_ARGS, message: `Error: ${parsed.message}` } }; }
+    toolIds = parsed.ids;
+  }
+  let agentOverride;
+  // council #247 D5: `agent: null` is the CLI house style for an unset
+  // option, never an invalid override and never `--agent`'s own skip branch.
+  if (args.agent !== null && (explicitKeys.has('agent') || args.agent !== undefined)) {
+    const a = typeof args.agent === 'string' ? args.agent.toLowerCase() : '';
+    if (a !== 'plan' && a !== 'build') {
+      // council #247 round 6 (P2-R55, C8a): a non-string --agent (schema-bypass,
+      // MCP-input style — agentToolsConflict already accepts any typeof for its
+      // first argument) used to render as the bare, unreadable `[object Object]`;
+      // JSON.stringify it instead. A genuine string still renders bare.
+      const got = typeof args.agent === 'string' ? args.agent : JSON.stringify(args.agent);
+      return {
+        error: {
+          code: ERROR_CODES.BAD_ARGS,
+          message: `Error: --agent must be Plan or Build; got '${got}'`,
+          hint: 'Chat is not supported headless; omit --agent to run seats on the council agents',
+        },
+      };
+    }
+    agentOverride = a === 'plan' ? 'Plan' : 'Build';
+  }
+
+  // Ruling P2-R28 (supersedes P2-R25): --tools/--agent are refused together,
+  // before either is consulted further, on every door.
+  const conflict = agentToolsConflict(agentOverride, toolIds);
+  if (conflict) { return { error: { code: ERROR_CODES.BAD_ARGS, message: `Error: ${conflict}` } }; }
+
+  // Spec 2026-09-11 §4: a run whose seats carry a LOCAL tool must put its run dir
+  // OUTSIDE the project tree (runCouncil refuses inside, and requires an allowed
+  // root); every other run keeps the v4.7 fence exactly as it was.
+  //
+  // Named mutant: FENCEALWAYS — dropping the `!wantsLocalTool &&` conjunct (so
+  // the condition is just `!isPathInside(...)`) restores the unconditional v4.7
+  // fence; reddens "a local tool lets --out-dir sit outside the project" in
+  // tests/cli-council-run-flags.test.js (a --tools read run with an
+  // out-of-project --out-dir would then fail BAD_ARGS instead of reaching
+  // runCouncil). `agentOverride` no longer needs its own conjunct here: the
+  // conflict check above already refuses any run where both are set.
+  //
+  // isLocal (not a hand-rolled `.some()`) — review r1 P2-R19: it is
+  // council/seat-tools.js's single source for the local/remote predicate
+  // (its own JSDoc names three other callers); re-deriving it here was a
+  // fourth, silently-driftable copy of the same test.
+  //
+  // council #247 round 5 (P2-R51, D4): an `--agent` run carries no toolIds of
+  // its own (the conflict check above refuses combining `--agent` with
+  // `--tools`), so `wantsLocalTool` is false and this same fence applies to
+  // it too — an outside run directory would put the `--agent` leg's working
+  // directory outside the tree it must read, and the engine's own
+  // `external_directory` default is `ask`, a prompt a headless leg can never
+  // answer.
+  const wantsLocalTool = Array.isArray(toolIds) && isLocal(toolIds);
+  if (!wantsLocalTool && !isPathInside(runDir, project)) {
+    return {
+      error: {
+        code: ERROR_CODES.BAD_ARGS,
+        message: `Error: --out-dir must stay inside the project: '${args['out-dir']}' resolves outside ${project}`,
+      },
+    };
+  }
+
+  const notices = [];
+  // council #247 round 6 (P2-R55, C2): `read` denies only .env/.env.*/.envrc
+  // at the engine — every OTHER file in the tree, including other secrets
+  // (.npmrc, key files, credentials), is readable. The CLI names the exact
+  // fence so a caller does not assume `read` is a general secrets guard.
+  if (Array.isArray(toolIds) && toolIds.includes('read')) {
+    notices.push('Notice: --tools read opens every file in the project tree except the names .env, ' +
+      '.env.* and .envrc (case-sensitive on Linux); keep any other secret (.npmrc, key files, ' +
+      'credentials) out of a tree you point a read seat at.');
+  }
+  // A1/D2: `bash` sits outside every fence (run directory, home, network) —
+  // the CLI names that in a Notice whenever a caller opts it in.
+  if (Array.isArray(toolIds) && toolIds.includes('bash')) {
+    notices.push('Notice: --tools bash gives every stage-1 seat a shell as you: no fence applies — it can ' +
+      'reach the run directory outside the tree (this run\'s own records included: the label map ' +
+      'that anonymizes the bench and every review already on disk, so bench anonymity and ' +
+      'independence do not hold under bash), your home directory and the network, and the webfetch ' +
+      'deny does not bind a shell.');
+  }
+  // council #247 round 5 (P2-R50, B2/D5/C2): `grep`/`glob` search the whole
+  // project tree with no per-file fence either (grep returns `.env`
+  // contents, glob lists `.env` names — the read fence only ever binds
+  // `read`), so the CLI names that in a Notice too, whenever either is
+  // opted in (both together name both ids, `grep/glob`).
+  const grepGlobIds = ['grep', 'glob'].filter((id) => Array.isArray(toolIds) && toolIds.includes(id));
+  if (grepGlobIds.length) {
+    notices.push(`Notice: --tools ${grepGlobIds.join('/')} search the whole project tree with no per-file fence — ` +
+      'grep returns .env contents and glob lists .env names; the read fence does not bind them. Opt them in ' +
+      'only on a tree without secrets.');
+  }
+  // Ruling P2-R41b (A4, round 3): --agent Build is the escape hatch running
+  // every leg on the engine's own agent, full tool set included — unlike the
+  // council-seat allowlist, Build can edit files and run commands, so the CLI
+  // names that in a Notice too.
+  if (agentOverride === 'Build') {
+    notices.push('Notice: --agent Build runs every leg on the engine\'s Build agent, which can edit files ' +
+      'and run commands, with the run directory (inside the project) as its ' +
+      'working directory.');
+  }
+  // council #247 round 5 (P2-R50, D3): --agent Plan runs every leg — judges
+  // and the chair included, not only stage-1 — on the engine's own Plan
+  // agent, which can read, search and run shell commands (only edits are
+  // denied); the CLI names that in a Notice too.
+  if (agentOverride === 'Plan') {
+    notices.push('Notice: --agent Plan runs every leg (judges and the chair included) on the engine\'s Plan ' +
+      'agent, which can read, search and run commands (edits denied) — v4.9.7\'s behaviour — with the run ' +
+      'directory (inside the project) as its working directory.');
+  }
+
+  return { error: null, toolIds, agentOverride, ...(notices.length ? { notices } : {}) };
+}
+
+module.exports = { checkCouncilRunTools };

package/src/cli-handlers-council-run.js

@@ -214,12 +214,11 @@ async function handleCouncilRun(args, depsOverride = {}) {
   const runDir = args['out-dir']
     ? path.resolve(project, String(args['out-dir']))
     : path.resolve(project, `council-${runId}`);
-  // v4.7 PR6: MCP has fenced this since v4.5 (mcp-council-run.js:137-141); the CLI
-  // never did, so `--out-dir ../../x` wrote outside the project and exited 0.
-  const { isPathInside } = require('./project-root-allowlist');
-  if (!isPathInside(runDir, project)) {
-    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --out-dir must stay inside the project: '${args['out-dir']}' resolves outside ${project}` });
-  }
+  // Spec 2026-09-11 §4 + the v4.7 PR6 fence: --tools/--agent shape and --out-dir placement — ./cli-council-run-tools.
+  const tf = require('./cli-council-run-tools').checkCouncilRunTools({ args, explicitKeys, runDir, project });
+  if (tf.error) { return failJson(useJson, tf.error); }
+  // A1/D2: e.g. the --tools bash Notice, printed either way (JSON still uses stderr for it).
+  for (const n of tf.notices || []) { process.stderr.write(n + '\n'); }
 
   const { resolveGatewayMode, loadConfig } = require('./utils/config');
   const { resolveFallbackConfig } = require('./sidecar/fallback-chains');
@@ -250,6 +249,7 @@ async function handleCouncilRun(args, depsOverride = {}) {
     tag: args.tag, // v4.7 F8: undefined when no --tag; Task 3 stores it on the run.json seed.
     // v4.9 W5.2: o.intent is 'task' or ABSENT, never 'review' (validated above).
     ...(args.intent === 'task' ? { intent: 'task' } : {}),
+    ...(tf.toolIds ? { tools: tf.toolIds } : {}), ...(tf.agentOverride ? { agent: tf.agentOverride } : {}),
     droppedMembers: benchRes.droppedMembers, // v4.5 Wave 2: [] when nothing dropped; additive on the run.json seed (run-state.js).
     // v4.1 §4.5b/§4.5d. `--claude-review` is resolved here but VALIDATED by the
     // engine's preflightClaudeReview (run-assemble.js): the reserved-seat and

package/src/cli.js

@@ -588,6 +588,7 @@ Subcommands for 'council':
       [--fallback] [--no-fallback] [--on-complete <cmd>]
       [--template <name|path>] [--artifact <file>] [--var <k=v>]
       [--pack <name|path>] [--tag <t>] [--intent review|task]
+      [--tools <a,b,c>] [--agent Plan|Build]
                                 Run the full headless council engine (v4.0).
                                 Chair default: deepseek (must NOT be a bench seat).
                                 --critic and --lenses are mutually exclusive.
@@ -619,6 +620,27 @@ Subcommands for 'council':
                                 explicit flags always override the pack's values.
                                 --intent task marks a task-mode run (v4.9);
                                 review is the default and is never stored.
+                                --tools <a,b,c> opts stage-1 seats into tools by the
+                                engine's own ids (task mode defaults to webfetch,
+                                review to none); task, skill, edit, write,
+                                apply_patch, question and invalid are refused.
+                                A local tool (read, grep, glob, bash) needs --out-dir OUTSIDE
+                                the project tree. read is denied exactly the
+                                names .env, .env.* and .envrc at the engine
+                                (case-sensitive on Linux; no other spelling is
+                                fenced); grep, glob and bash have no per-file
+                                fence — opt them in only on a tree without
+                                secrets. bash is outside every fence, this
+                                run's own records included (bench anonymity
+                                does not hold under it) — the CLI warns when
+                                you opt any of them in. --tools and --agent
+                                cannot be combined.
+                                --agent Plan|Build runs every leg on the
+                                engine's own agent instead (the escape hatch; no
+                                council agents, no allowlist). Plan's legs,
+                                judges and chair included, can read, search and
+                                run commands (edits denied); Build's can also
+                                edit. The CLI warns for either.
                                 Exit: 0 full run, 2 degraded, 1 quorum/cost/validation.
   save <name> --models a,b,c    Save a named council preset (>=2 resolvable members)
     --json                     Machine-readable output
@@ -718,7 +740,7 @@ const USAGE_TRAILER = `
 OpenCode Agent Types:
     Chat       Reads auto, writes/bash ask permission (interactive default)
     Build      Full tool access (headless default)
-    Plan       Read-only analysis and planning
+    Plan       Analysis without edits (reads, searches, shell allowed)
 
   NOTE: --agent chat is interactive-only (incompatible with --no-ui).
   Headless mode defaults to build agent.

package/src/council/briefings-chair.js

@@ -289,7 +289,7 @@ function chairRepairPromptFor(intent, args) {
 
 module.exports = {
   dateLine,
-  CHAIR_NO_TOOLS_PREAMBLE, chairRepairPromptFor,
+  CHAIR_NO_TOOLS_LEAD, CHAIR_NO_TOOLS_PREAMBLE, chairRepairPromptFor,
   CHAIR_VERDICT_VALUES,
   VERDICT_SCALE_ADDENDUM,
   CHAIR_TASK,

package/src/council/briefings-task.js

@@ -110,22 +110,28 @@ const TASK_CRITIC_BRIEF = [
 
 /** Task seat briefing (Stage-1 fanout wave). */
 function buildTaskSeatBriefing(args) {
-  return composeWith(TASK_SEAT_ROLE, TASK_ANTI_SYCOPHANCY_CLAUSE, TASK_FINDINGS_CONTRACT, args);
+  return composeWith(TASK_SEAT_ROLE, TASK_ANTI_SYCOPHANCY_CLAUSE, TASK_FINDINGS_CONTRACT, args, 'answer');
 }
 
 /** Task critic briefing (concurrent solo — --critic, ruling V13). */
 function buildTaskCriticBriefing(args) {
-  return composeWith(TASK_CRITIC_BRIEF, TASK_ANTI_SYCOPHANCY_CLAUSE, TASK_FINDINGS_CONTRACT, args);
+  return composeWith(TASK_CRITIC_BRIEF, TASK_ANTI_SYCOPHANCY_CLAUSE, TASK_FINDINGS_CONTRACT, args, 'answer');
 }
 
-/** Task expert-lens briefing (concurrent solo per seat — --lenses). */
-function buildTaskLensBriefing({ lens, briefing, date }) {
+/**
+ * Task expert-lens briefing (concurrent solo per seat — --lenses).
+ * Named mutant LENSTOOLSDROP (see briefings.js :: buildLensBriefing for the full account):
+ * dropping `tools` from the destructure or the rebuilt object below reddens the task-intent
+ * case in 'lens and critic briefings carry a real tools line too, not just the seat
+ * (LENSTOOLSDROP guard)', tests/council/briefings-tools.test.js.
+ */
+function buildTaskLensBriefing({ lens, briefing, date, tools, agent }) {
   return composeWith(
     `Do the work the briefing asks for strictly through the lens of a ${lens}. ` +
     'Produce only what that perspective is qualified to produce, at the depth a top ' +
     'practitioner of it would reach. Stay in-domain: if something matters but is outside ' +
     'your lens, leave it to the other analysts.',
-    TASK_ANTI_SYCOPHANCY_CLAUSE, TASK_FINDINGS_CONTRACT, { briefing, date }
+    TASK_ANTI_SYCOPHANCY_CLAUSE, TASK_FINDINGS_CONTRACT, { briefing, date, tools, agent }, 'answer'
   );
 }
 

package/src/council/briefings.js

@@ -98,15 +98,24 @@ function dateLine(date) {
 }
 
 /**
- * The generalized Stage-1 skeleton (v4.9 W6): role / clause / date / contract /
- * separator / briefing. Both intents compose through here, which is what makes
- * the `--- MATERIAL / BRIEFING ---` separator — a PRODUCTION contract,
+ * The generalized Stage-1 skeleton (v4.9 W6; tools sentence added spec
+ * 2026-09-11 §4): role / tools sentence / clause / date / contract /
+ * separator / briefing. Both intents compose through here, which is what
+ * makes the `--- MATERIAL / BRIEFING ---` separator — a PRODUCTION contract,
  * src/sidecar/list-search.js:14 splits briefing-stage1.md on it — a single
  * spelling in both modes. briefings-task.js top-requires this.
+ * @param {string} role @param {string} clause @param {string} contract
+ * @param {{briefing: string, date?: string, tools?: string[], agent?: string}} args
+ * @param {'review'|'answer'} [kind] the no-tools sentence's last word (spec §4:
+ *   the seat sentence forks exactly where the chair's does)
  */
-function composeWith(role, clause, contract, { briefing, date }) {
+function composeWith(role, clause, contract, { briefing, date, tools, agent }, kind = 'review') {
+  // lazy, defensively — not cycle-avoidance: seat-tools.js requires only ./briefings-chair,
+  // which itself requires only ./seats, so no require cycle with this module exists today.
+  const { seatToolsSentence } = require('./seat-tools');
   return [
     role,
+    seatToolsSentence(tools || [], kind, { agent }),
     clause,
     dateLine(date),
     contract,
@@ -134,14 +143,23 @@ function buildCriticBriefing(args) {
   return compose(CRITIC_BRIEF, args);
 }
 
-/** Expert-lens briefing (concurrent solo per seat — spec §4 --lenses). */
-function buildLensBriefing({ lens, briefing, date }) {
+/**
+ * Expert-lens briefing (concurrent solo per seat — spec §4 --lenses).
+ * `tools` must survive both the destructure below and the rebuilt object handed to
+ * `compose` — this builder (unlike buildSeatBriefing/buildCriticBriefing, which just
+ * forward the `args` they're given) reconstructs a NARROWER object, so dropping `tools`
+ * from either spot is silent. Named mutant LENSTOOLSDROP: drop `tools` here; reddens the
+ * review-intent case in 'lens and critic briefings carry a real tools line too, not just
+ * the seat (LENSTOOLSDROP guard)', tests/council/briefings-tools.test.js. The task-intent
+ * twin of this same mutant lives in briefings-task.js :: buildTaskLensBriefing.
+ */
+function buildLensBriefing({ lens, briefing, date, tools, agent }) {
   return compose(
     `Review this material strictly through the lens of a ${lens}. Raise only findings ` +
     'that perspective is qualified to raise, at the depth a top practitioner of it would ' +
     'reach. Stay in-domain: if something matters but is outside your lens, leave it to ' +
     'the other reviewers.',
-    { briefing, date }
+    { briefing, date, tools, agent }
   );
 }
 

package/src/council/report-lost-rows.js

@@ -0,0 +1,89 @@
+// src/council/report-lost-rows.js
+'use strict';
+
+/**
+ * @module council/report-lost-rows
+ * "What was lost" rows the tally already knows (#242, spec §5): one per runStats seat whose
+ * findings came from a repair nothing could verify (`findingsUnverified`), one per refused
+ * repair (`repairRefused`). Derived at RENDER time from `verdict.runStats` — never written into
+ * run.json or verdict.json's `degrades[]`, never handed to the degrade sink — so the run's exit
+ * code, its `degraded` state and every on-disk artifact are unchanged, and re-rendering an
+ * older verdict.json shows the rows too.
+ *
+ * A LEAF over utils/degrade: the rows are `makeDegrade` records so both renderers print them
+ * through `formatDegrade`, the report's one voice, and their channels sit in DEGRADE_CHANNELS
+ * (the degrade-contract drift pin reads this file's `channel:` literals).
+ *
+ * ⚠️ The wording never says "stub". The flag means exactly what run-stages.js :: runStage1 says:
+ * the ORIGINAL response carried no parseable findings block, so nothing could check the repair —
+ * true of a vacuous repair and of a good review whose trailing JSON was malformed alike (study
+ * run B2: a 19,064-byte review carried it). Both facts are tested with `=== true` / a plain
+ * object, matching what tally.js emits; a hand-assembled truthy string is not a flag.
+ *
+ * `data.seat` is the row's label — verdict-seats-reviewed.js :: seatLabel, shared with the end-of-run
+ * stderr line so no row is ever named two ways (council #248 r2, A3).
+ *
+ * Role and status ARE consulted, through the census's own predicates (verdict-seats-reviewed.js ::
+ * isUnverifiedSeat / isRefusedSeat — council #248 round 1, B1/C2/D2): a row renders here exactly
+ * when the census counts it, so the report and `seatsReviewed` can never disagree, and the row's
+ * "still counts as reviewed" is true of every row it is ever written for. A flagged row that is
+ * not a completed bench seat renders nothing — no review happened; a real dead leg has the sink's
+ * own dead-leg row. On engine-written records the gate is a no-op (run-launch.js ::
+ * materializeReviews drops non-complete legs before any repair runs; run-stages.js :: roleFor and
+ * seats.js :: buildSeats mint only bench roles).
+ */
+
+const { makeDegrade } = require('../utils/degrade');
+// The census's own predicates — one function, two readers, so the report and
+// `seatsReviewed` cannot disagree (a leaf that requires nothing; no cycle).
+// … and the one seat label every human surface uses (P3-R18).
+const { isUnverifiedSeat, isRefusedSeat, seatLabel } = require('./verdict-seats-reviewed');
+
+function unverifiedRow(r) {
+  const seat = seatLabel(r);
+  return makeDegrade({
+    channel: 'unverified-repair',
+    what: `seat ${seat}'s findings came from a repair of a response with no findings block`,
+    why: 'nothing verified them',
+    effect: 'the tiers they were given rest on the repair alone; the seat still counts as reviewed',
+    data: { seat },
+  });
+}
+
+// The engine's only refusal code today is REPAIR_CHANGED_FINDING_COUNT (run-stages.js); a
+// hand-assembled row without one gets "code not recorded", never an invented code (council #248
+// r2, C6).
+function refusedRow(r) {
+  const seat = seatLabel(r);
+  const { code: rawCode, detail: rawDetail } = r.repairRefused;
+  const code = (typeof rawCode === 'string' && rawCode.trim()) ? rawCode.trim() : null;
+  const detail = (typeof rawDetail === 'string' && rawDetail.trim()) ? rawDetail.trim() : 'the repair broke its contract';
+  return makeDegrade({
+    channel: 'repair-refused',
+    what: `seat ${seat}'s repair was refused (${code || 'code not recorded'})`,
+    why: detail,
+    effect: 'the seat contributed no findings; its review text still reached the judges and it counts as reviewed',
+    data: { seat, code },
+  });
+}
+
+function isPlainObject(v) { return !!v && typeof v === 'object' && !Array.isArray(v); }
+
+/**
+ * @param {*} runStats `verdict.runStats` — any shape: the report's entry points are schema-free
+ *   JSON.parse (see report.js :: isSeatSpace), so THIS LEAF yields no rows rather than a throw on a
+ *   non-array. That is the leaf's contract only — the cost table (report-cost.js) still throws on a
+ *   non-array runStats, pre-existing and untouched here.
+ * @returns {Array<object>} frozen makeDegrade records, in runStats order; `[]` when none.
+ */
+function lostRowsOf(runStats) {
+  const rows = [];
+  for (const r of (Array.isArray(runStats) ? runStats : [])) {
+    if (!isPlainObject(r)) { continue; }
+    if (isUnverifiedSeat(r)) { rows.push(unverifiedRow(r)); }
+    if (isRefusedSeat(r)) { rows.push(refusedRow(r)); }
+  }
+  return rows;
+}
+
+module.exports = { lostRowsOf };

package/src/council/report-md.js

@@ -47,7 +47,9 @@ function renderMd(m) {
   // (tests/council/report-intent.test.js).
   if (m.intent === 'task') { out.push('\n_Tiers report peer concurrence, never verification._'); }
 
-  // Heading-over-nothing: emitted ONLY when the run actually degraded, so a
+  // Heading-over-nothing: emitted ONLY when the model carries losses — the
+  // sink's records plus (v4.9.8, #242) the runStats-derived
+  // unverified/refused-repair rows report.js :: toModel appends — so a
   // clean verdict's report stays byte-identical to before this section
   // existed. Losses are headline news, so they sit directly under the
   // summary, before the reader reaches the adjudication detail.

package/src/council/report.js

@@ -18,6 +18,7 @@
 // v4.9 W8 T-A: the cost table's model lives in ./report-cost (extraction, this
 // file's headroom). Eager, not lazy: that module back-requires nothing here.
 const { buildCostModel } = require('./report-cost');
+const { lostRowsOf } = require('./report-lost-rows'); // #242: a leaf; back-requires nothing here
 
 const TIER_ORDER = ['Disputed', 'Contested', 'Confirmed', 'Singleton'];
 // __proto__: null — an inherited/unknown vote key (e.g. "toString") must fold as unrecognized, never resolve off Object.prototype.
@@ -263,7 +264,7 @@ function toModel(verdict, wave) {
     // Plan 2 final review F2 + v4.9 W8 T-A: LOSSES ONLY. A heal is announced on stderr/run.json
     // but is not a loss (spec D4, §8), and neither is v4.9's kind:'info' — `ledger-skipped` says
     // a task run wrote no reliability rows, which is speech, not damage. Info records ride
-    // `notes`, which both renderers list APART from "What was lost".
+    // `notes`, which both renderers list APART from "What was lost". v4.9.8 (#242): the runStats-derived unverified/refused-repair rows (./report-lost-rows) are appended AFTER the sink's records.
     // ⚠️ NOT the positive `kind === 'degrade'`, and the difference is measured: a record with NO
     // kind key — hand-written, or parsed off a verdict older than kinds, which
     // `utils/degrade.js :: formatDegrade` still deliberately serves as 'Notice' — is a loss at
@@ -276,7 +277,7 @@ function toModel(verdict, wave) {
     // 'degrade'`, citing THIS lesson by name. Their kind LISTS still differ from this one's, and
     // deliberately (over there the question is narrower: which announcements imply a LOST SEAT).
     // Align the treatment of an ABSENT kind; never the lists.
-    degrades: (verdict.degrades || []).filter(d => d.kind !== 'heal' && d.kind !== 'info'),
+    degrades: (verdict.degrades || []).filter(d => d.kind !== 'heal' && d.kind !== 'info').concat(lostRowsOf(verdict.runStats)),
     notes: (verdict.degrades || []).filter(d => d.kind === 'info'),
     cost: buildCostModel(verdict.runStats || [], wave),
   };

package/src/council/run-degrade.js

@@ -41,4 +41,25 @@ function createDegradeSink({ runDir, degraded, write }) {
   return { note, all: () => records.slice() };
 }
 
-module.exports = { createDegradeSink };
+/**
+ * Announce every dropped preset member (spec §5, Plan 4): a seat the user's
+ * preset requested that never resolved is a lost seat — announced like every
+ * other loss. Fires once per member, before any launch (zero spend), for BOTH
+ * transports. Moved verbatim out of run.js for the 300-line gate (P2-R14: PR 2
+ * of the council-leg-completion work needed the headroom this freed).
+ * @param {{note: Function}} degrade the run's degrade sink
+ * @param {Array<{member: string, reason: string}>} [droppedMembers]
+ */
+function noteDroppedMembers(degrade, droppedMembers) {
+  for (const dm of droppedMembers || []) {
+    degrade.note({
+      channel: 'dropped-members',
+      what: `seat ${dm.member} was not seated`,
+      why: dm.reason,
+      effect: 'the bench is smaller than the preset requested; the run will exit degraded (2)',
+      data: { member: dm.member, reason: dm.reason },
+    });
+  }
+}
+
+module.exports = { createDegradeSink, noteDroppedMembers };

package/src/council/run-finish.js

@@ -11,6 +11,7 @@ const { decorateRecord } = require('./debate');
 const runState = require('./run-state');
 const asm = require('./run-assemble');
 const { emitStageStarted, emitStageTerminal } = require('../observe/events');
+const { isUnverifiedSeat, isRefusedSeat, seatLabel } = require('./verdict-seats-reviewed');
 
 /**
  * Build the final tally, gate the ledger append, write tally+verdict
@@ -62,8 +63,29 @@ function finishRun({ o, chairRes, debatedInput, debateFindings, appendRunFn, deg
   emitStageTerminal(o.runDir, o.runId, tallyStage, 'complete', null, o.follow);
   // Verdict assembly is the degrade cut-off: anything noted after this line
   // reaches stderr + run.json but not verdict.json (spec §6 rule 1).
-  asm.writeVerdictFiles({ runDir: o.runDir, record, overallVerdict, chairText,
+  const verdict = asm.writeVerdictFiles({ runDir: o.runDir, record, overallVerdict, chairText,
     critic: o.critic, deadWaves, degrades: degrade.all() });
+  // council #248 round 1 (C1/D1): the census is in verdict.json and on the CI title, but a LOCAL
+  // run said nothing — the product principle's silent-degrade shape. One stderr line, read off the
+  // census the verdict already carries: no new computation, no artifact, no exit-code change, not a
+  // sink record (so `degraded` never flips). Emitted only when a count is non-zero, so every other
+  // run's stderr is byte-identical; names the seats so the reader need not open the report.
+  // report.html is written by writeVerdictFiles in the call just above, so the pointer is never
+  // dangling (council #248 r2, C3).
+  const census = verdict && verdict.seatsReviewed;
+  if (census && (census.unverified > 0 || census.refused > 0)) {
+    const rows = Array.isArray(verdict.runStats) ? verdict.runStats : [];
+    const parts = [];
+    if (census.unverified > 0) {
+      parts.push(`${census.unverified} of ${census.of} seats' findings came from a repair nothing could verify (${rows.filter(isUnverifiedSeat).map(seatLabel).join(', ')})`);
+    }
+    // council #248 round 2 (A2/C2, P3-R17): a refused repair — no findings tallied at all — is named
+    // on the same line, so a seat that contributed nothing is never silent locally either.
+    if (census.refused > 0) {
+      parts.push(`${census.refused} of ${census.of} seats' repairs were refused and contributed no findings (${rows.filter(isRefusedSeat).map(seatLabel).join(', ')})`);
+    }
+    process.stderr.write(`Notice: ${parts.join('; ')} — see "What was lost" in report.html\n`);
+  }
   runState.updateStage(o.runDir, 'verdict', { status: 'complete', completedAt: now() });
   emitStageStarted(o.runDir, o.runId, 'verdict', null, o.follow);
   emitStageTerminal(o.runDir, o.runId, 'verdict', 'complete', null, o.follow);

package/src/council/run-launch.js

@@ -63,12 +63,16 @@ function createLaunchers(deps = {}) {
   const reserveBudget = deps.reserveBudget || null;
   const onBudgetRefusal = deps.onBudgetRefusal || null;
   const sharedServer = deps.sharedServer || null;
+  // Spec 2026-09-11 §4: getters, like sharedServer — run.js builds the launchers
+  // before it has decided the seat policy.
+  const councilAgents = deps.councilAgents || (() => null);
+  const agentOverride = deps.agentOverride || (() => undefined);
 
   /**
    * @param {{models: string[], prompt: string, project: string, waveId: string,
    *   timeout?: number, gateway?: string, noValidateModel?: boolean, agent?: string,
    *   councilRunId?: string, councilName?: string, tag?: string, seats?: Array<object>,
-   *   fallback?: object, catalog?: Array, noOutputBackstopMs?: number}} opts
+   *   fallback?: object, catalog?: Array, noOutputBackstopMs?: number, role?: 'seat', directory?: string}} opts
    *   councilRunId/councilName (v4.3 Task 3, spec §7.2) are additive attribution
    *   ids forwarded verbatim into the runFanout call so it can stamp them onto
    *   every leg. tag (v4.7 F8 D16) rides the same forward — every call site
@@ -83,6 +87,13 @@ function createLaunchers(deps = {}) {
    *   noOutputBackstopMs (Task 5, #129) is opt-in and spread-guarded on
    *   Number.isFinite (0 is a valid disable value); only run-retry.js sets it,
    *   to escalate the window on a Stage-1 retry.
+   *   role (spec 2026-09-11 §4, P2-R11) is the LAUNCH role, not the per-leg
+   *   value run-stages.js's `roleFor()` returns — every stage-1 leg (seat,
+   *   critic, and lens alike) launches with the literal `role: 'seat'` to get
+   *   the tool-capable agent; a caller must pass that literal, never a leg's
+   *   own `seat.role`. It also gates `directory` (see the comment above that
+   *   option below): only a `role: 'seat'` launch may point tool-exec cwd
+   *   anywhere but `opts.project`.
    * @returns {Promise<{wave: object|null, exitCode: number}>}
    */
   async function launchWave(opts) {
@@ -100,6 +111,13 @@ function createLaunchers(deps = {}) {
     // `serverClient` (see the seam comment in fanout.js). Absent → the wave
     // starts and closes its own server, exactly as before.
     const shared = sharedServer ? sharedServer() : null;
+    const agents = councilAgents();
+    // Spec 2026-09-11 §4: stage-1 seats and their retries run as council-seat,
+    // every other role as council-support; an explicit agent (the --agent
+    // escape hatch) wins. Without council agents (non-council DI, older
+    // callers) the pre-§4 default 'Plan' stands.
+    const agent = opts.agent || agentOverride()
+      || (agents ? (opts.role === 'seat' ? 'council-seat' : 'council-support') : 'Plan');
     const { wave, exitCode, errorDoc } = await fanoutFn({
       ...(typeof remaining === 'number' ? { maxCost: remaining } : {}),
       ...(shared ? { serverClient: shared.serverClient, server: shared.server } : {}),
@@ -112,12 +130,13 @@ function createLaunchers(deps = {}) {
       // onto every leg and its spend-ledger row (v4.3 --retry-failed machinery).
       // Spread-guarded so a normal launch's transport call stays byte-identical.
       ...(opts.retryOfWaveId ? { retryOfWaveId: opts.retryOfWaveId } : {}),
+      ...(agents ? { serverAgents: agents } : {}),
       models: opts.models.join(','),
       prompt: opts.prompt,
       promptMeta: { source: 'council-engine', file: null, chars: opts.prompt.length },
       waveId: opts.waveId,
       project: opts.project,
-      agent: opts.agent || 'Plan',
+      agent,
       timeout: opts.timeout,
       summaryLength: 'verbose',
       includeContext: false,
@@ -160,8 +179,18 @@ function createLaunchers(deps = {}) {
       // own session dir (judges' `project` is `<runDir>/_scratch`, so this
       // scopes them there) and strip inherited MCP servers, so a tool-capable
       // judge can't read the de-anonymized review-*.md files or the plaintext
-      // labelMap in run.json sitting in the parent run dir.
-      directory: opts.project,
+      // labelMap in run.json sitting in the parent run dir. Every launch is
+      // scoped to `opts.project` — the ONLY exception is a stage-1 seat launch
+      // (`opts.role === 'seat'`) that also passes `opts.directory`: a later
+      // task uses that to point a local-tools seat at the real project tree
+      // while the run's own metadata stays in `opts.project` (P2-R11 review).
+      // Judge, debate, and chair legs never set `role: 'seat'`, so `_scratch`
+      // isolation cannot be escaped through this option.
+      // Named mutant DIRGATEDROP: dropping the `opts.role === 'seat' &&`
+      // conjunct below lets ANY caller redirect tool-exec cwd via
+      // `opts.directory` — reddens "a non-seat launch ignores opts.directory"
+      // (tests/council/run-launch.test.js).
+      directory: (opts.role === 'seat' && opts.directory) || opts.project,
       noMcp: true,
     });
     // A ceiling refusal returns `wave: null`, which the council driver's