amicus 4.3.0 → 4.4.0

package/electron/workspace-ui/workspace.css

@@ -0,0 +1,172 @@
+/* Council Workspace styles — every color/font/space from src/design/tokens.css. */
+
+* { box-sizing: border-box; }
+/* ⚠️ DE-ROT (F33): REQUIRED — do not drop. `.dialog-backdrop { display: flex }` below is an
+   AUTHOR rule, and author origin beats the UA's `[hidden] { display: none }` regardless of
+   specificity — so `#dialog-abort` (and `#run-view`, also `hidden`-attribute-gated) would be
+   visible from first paint and Task 16's `$('dialog-abort').hidden = true` would never hide it.
+   Nothing under electron/ or src/ defines a `[hidden]` reset today; this line is the only guard. */
+[hidden] { display: none !important; }
+html, body { height: 100%; margin: 0; }
+body {
+  background: var(--bg);
+  color: var(--text-1);
+  font-family: var(--font-sans);
+  font-size: var(--fs-13);
+  line-height: var(--lh-body);
+}
+.mono { font-family: var(--font-mono); }
+
+#app { display: flex; height: 100vh; }
+
+/* ---- left rail -------------------------------------------------------- */
+#rail {
+  width: 280px; min-width: 220px; flex: none;
+  border-right: var(--bd); background: var(--surface-1);
+  display: flex; flex-direction: column;
+}
+.rail-head {
+  padding: var(--pad-card); border-bottom: var(--bd);
+  display: flex; flex-direction: column; gap: var(--space-2);
+}
+.rail-title { font-weight: var(--w-semibold); letter-spacing: var(--ls-label); }
+.rail-project { color: var(--text-3); font-size: var(--fs-10); overflow: hidden; text-overflow: ellipsis; }
+#run-list { list-style: none; margin: 0; padding: var(--space-2); overflow-y: auto; flex: 1; }
+#run-list li {
+  padding: var(--space-4) var(--space-6); border-radius: var(--r-6);
+  cursor: pointer; border: 1px solid transparent;
+}
+#run-list li:hover { background: var(--surface-2); }
+#run-list li.selected { background: var(--surface-sel); border-color: var(--accent-line); }
+#run-list li.error-row { color: var(--text-3); cursor: default; }
+#run-list li:focus-visible, .btn:focus-visible, #blind-toggle:focus-visible, summary:focus-visible {
+  outline: 2px solid var(--focus-ring); outline-offset: 1px;
+}
+.run-row-top { display: flex; justify-content: space-between; gap: var(--space-4); }
+.run-row-sub { color: var(--text-3); font-size: var(--fs-11); display: flex; gap: var(--space-4); flex-wrap: wrap; }
+
+/* ---- chips / status --------------------------------------------------- */
+.chips { display: flex; gap: var(--space-3); flex-wrap: wrap; align-items: center; }
+.chip {
+  padding: var(--pad-pill); border-radius: var(--r-full); font-size: var(--fs-10);
+  border: var(--bd-strong); color: var(--text-2); background: var(--surface-2);
+}
+.chip.running { color: var(--running); border-color: var(--running); }
+.chip.running::before {
+  content: ''; display: inline-block; width: 6px; height: 6px; margin-right: var(--space-2);
+  border-radius: var(--r-full); background: var(--running); animation: ws-pulse 1.2s ease-in-out infinite;
+}
+.chip.complete { color: var(--ok); }
+.chip.partial { color: var(--warn); }
+.chip.error { color: var(--danger); }
+.chip.aborted { color: var(--text-3); }
+@keyframes ws-pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.25; } }
+@media (prefers-reduced-motion: reduce) { .chip.running::before { animation: none; } }
+
+/* ---- detail ----------------------------------------------------------- */
+#detail { flex: 1; overflow-y: auto; padding: var(--space-8); }
+.empty-state { color: var(--text-3); padding: var(--space-24); text-align: center; }
+#run-header { display: flex; flex-direction: column; gap: var(--space-4); margin-bottom: var(--space-6); }
+.run-head-row { display: flex; align-items: center; gap: var(--space-8); flex-wrap: wrap; }
+#run-title { font-size: var(--fs-18); margin: 0; }
+
+.banner {
+  padding: var(--pad-card); border-radius: var(--r-6); margin-bottom: var(--space-6);
+  border: 1px solid var(--danger); color: var(--danger); background: var(--surface-1);
+}
+.banner.warn { border-color: var(--warn); color: var(--warn); }
+.banner.info { border-color: var(--border-strong); color: var(--text-2); }
+
+.stage-rail { display: flex; gap: var(--space-4); flex-wrap: wrap; margin-bottom: var(--space-8); }
+.stage {
+  display: flex; align-items: center; gap: var(--space-3);
+  padding: var(--pad-pill); border-radius: var(--r-6); border: var(--bd);
+  color: var(--text-2); font-size: var(--fs-11);
+}
+.stage.complete { color: var(--ok); }
+.stage.running { color: var(--running); border-color: var(--running); }
+.stage.error { color: var(--danger); }
+.stage.partial { color: var(--warn); }
+.stage.skipped { color: var(--text-3); }
+
+.panel { margin-bottom: var(--space-10); border: var(--bd); border-radius: var(--r-8); background: var(--surface-1); padding: var(--pad-card); }
+.panel-title { font-size: var(--fs-13); font-weight: var(--w-semibold); margin: 0 0 var(--space-4) 0; cursor: default; }
+details.panel > summary { cursor: pointer; }
+.prose-host { color: var(--text-2); }
+.prose-host h3, .prose-host h4, .prose-host h5, .prose-host h6 { color: var(--text-1); margin: var(--space-6) 0 var(--space-2); }
+.prose-host pre {
+  background: var(--surface-3); border: var(--bd); border-radius: var(--r-6);
+  padding: var(--pad-card); overflow-x: auto; font-family: var(--font-mono); font-size: var(--fs-11);
+}
+.prose-host code { font-family: var(--font-mono); background: var(--surface-3); border-radius: var(--r-3); padding: 0 var(--space-2); }
+.prose-section { border-top: var(--bd); padding-top: var(--space-4); margin-top: var(--space-4); }
+.prose-section:first-child { border-top: none; margin-top: 0; padding-top: 0; }
+mark { background: var(--gold-soft); color: var(--gold-400); border-radius: var(--r-2); }
+
+/* ---- tables ------------------------------------------------------------ */
+.table { width: 100%; border-collapse: collapse; font-size: var(--fs-12); }
+.table th {
+  text-align: left; color: var(--text-3); font-weight: var(--w-medium);
+  border-bottom: var(--bd-strong); padding: var(--space-3) var(--space-4);
+}
+.table td { border-bottom: var(--bd); padding: var(--space-3) var(--space-4); }
+.table td.num, .table th.num { text-align: right; font-family: var(--font-mono); }
+.stalled-flag { color: var(--warn); }
+
+/* ---- matrix tier rows (report-html light-ground pairs, as token vars) -- */
+.matrix-wrap { overflow-x: auto; }
+tr.tier-Confirmed td { background: var(--tier-confirmed); color: var(--tier-confirmed-ink); }
+tr.tier-Contested td { background: var(--tier-contested); color: var(--tier-contested-ink); }
+tr.tier-Disputed td { background: var(--tier-disputed); color: var(--tier-disputed-ink); }
+tr.tier-Singleton td { background: var(--tier-singleton); color: var(--tier-singleton-ink); }
+td.vote-cell { text-align: center; font-family: var(--font-mono); }
+td.vote-cell.dispute { cursor: pointer; text-decoration: underline dotted; }
+.thin-badge, .override-badge, .debate-badge {
+  font-size: var(--fs-9); border-radius: var(--r-full); padding: 0 var(--space-3);
+  border: 1px solid currentColor; margin-left: var(--space-2);
+}
+
+/* ---- gauge -------------------------------------------------------------- */
+.gauge {
+  position: relative; flex: 1; min-width: 160px; max-width: 360px; height: 18px;
+  border: var(--bd-strong); border-radius: var(--r-full); background: var(--surface-2); overflow: hidden;
+}
+.gauge-fill { height: 100%; width: 0; background: var(--accent-soft); border-right: 2px solid var(--accent); }
+.gauge.over .gauge-fill { background: var(--danger); border-right-color: var(--danger); }
+/* v4.4 §8: `unknown` = at least one seat reported no usage, so the filled
+   fraction is a LOWER BOUND, not a measurement. Hatch the whole track (not just
+   the fill) so the empty remainder reads "indeterminate" rather than "headroom",
+   and dash the leading edge so it is visibly not a hard boundary. Paired with the
+   `≥` prefix renderGauge writes into .gauge-text. */
+.gauge.unknown {
+  background-image: repeating-linear-gradient(135deg,
+    transparent 0 4px, var(--surface-3, var(--surface-2)) 4px 8px);
+}
+.gauge.unknown .gauge-fill { border-right-style: dashed; }
+.gauge-text { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; font-size: var(--fs-10); color: var(--text-2); }
+
+/* ---- buttons / dialog ---------------------------------------------------- */
+.btn {
+  font-family: var(--font-sans); font-size: var(--fs-12); padding: var(--pad-btn-sm);
+  border-radius: var(--r-6); border: var(--bd-strong); background: var(--surface-2);
+  color: var(--text-1); cursor: pointer;
+}
+.btn:hover { background: var(--surface-3); }
+.btn.danger { border-color: var(--danger); color: var(--danger); }
+.btn.primary { background: var(--accent); border-color: var(--accent); color: var(--on-accent); }
+.btn[disabled] { opacity: 0.5; cursor: default; }
+.blind-label { display: flex; align-items: center; gap: var(--space-3); color: var(--text-2); font-size: var(--fs-12); }
+
+.dialog-backdrop {
+  position: fixed; inset: 0; background: var(--accent-glow);
+  backdrop-filter: blur(2px); display: flex; align-items: center; justify-content: center; z-index: 10;
+}
+.dialog {
+  background: var(--surface-2); border: var(--bd-strong); border-radius: var(--r-10);
+  box-shadow: var(--shadow-pop); padding: var(--space-12); max-width: 420px;
+}
+.dialog h2 { margin-top: 0; font-size: var(--fs-15); }
+.dialog-actions { display: flex; justify-content: flex-end; gap: var(--space-4); margin-top: var(--space-8); }
+
+.empty-note { color: var(--text-3); font-size: var(--fs-12); }
+.truncate-note { color: var(--warn); font-size: var(--fs-11); margin-top: var(--space-3); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/council-run-live.schema.json

@@ -27,7 +27,31 @@
     "legsComplete": { "type": ["number", "null"] },
     "elapsed": { "type": "string" },
     "exitCode": { "type": ["number", "null"] },
-    "usage": { "type": "object" }
+    "usage": { "type": "object" },
+    "legs": {
+      "description": "One row per active-stage leg id (DE-ROT Task 0.5 / F01), present unconditionally — a just-started leg with no usage flushed yet still gets a row.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["taskId", "model", "status"],
+        "properties": {
+          "taskId": { "type": "string" },
+          "model": { "type": ["string", "null"], "description": "Resolved executable id (metadata.model)." },
+          "modelInput": { "type": ["string", "null"], "description": "Council alias (run.json bench/chair/critic/lenses are keyed on this, not `model`); null when the leg's metadata.json has not been patched with it yet (F36)." },
+          "role": { "type": ["string", "null"], "description": "'seat' | 'critic' | 'lens:<slug>' | 'chair', derived via roleFor keyed on modelInput (chair via the owning stage's name instead, F34); null when modelInput is unknown." },
+          "status": { "type": "string" },
+          "messages": { "type": "number" },
+          "stage": { "type": "string" },
+          "latestPreview": { "type": ["string", "null"] },
+          "lastActivityAt": { "type": ["string", "null"] },
+          "stalled": { "type": "boolean" },
+          "usage": { "type": "object" },
+          "usageError": { "type": "string", "description": "Council review C3: set when enrichLegUsage (pricing resolution) throws for this leg's progress usage, so the failure is distinguishable from a leg that simply has not billed yet (no `usage` key, no `usageError` key either). Additive; absent on every leg that priced cleanly or has no usage yet." }
+        }
+      }
+    },
+    "stalled": { "type": "boolean" },
+    "stalledForSeconds": { "type": "number" }
   },
   "additionalProperties": true
 }

package/schemas/council-run.schema.json

@@ -34,6 +34,20 @@
     "options": { "type": "object" },
     "usage": { "type": "object" },
     "exitCode": { "type": ["number", "null"] },
+    "budgetRefusals": {
+      "description": "Waves the --max-cost ceiling refused at pre-flight (v4.4). Present only once at least one wave was refused. The run CONTINUES with a partial bench and exits degraded (2) — it is never rolled back and never aborted.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["waveId", "models"],
+        "properties": {
+          "waveId": { "type": ["string", "null"] },
+          "models": { "type": "array", "items": { "type": "string" } },
+          "reason": { "type": "string" },
+          "at": { "type": "string" }
+        }
+      }
+    },
     "debate": {
       "type": "object",
       "properties": {

package/schemas/progress.schema.json

@@ -16,7 +16,20 @@
       "type": "object",
       "properties": {
         "tokens": { "type": "object" },
-        "costReported": { "type": "number" }
+        "costReported": { "type": "number" },
+        "subtree": {
+          "description": "v4.4.1 CA-1. Spend of the CHILD (subagent) OpenCode sessions this leg spawned, which OpenCode bills separately and does NOT roll into the parent session's cost. Attributed to this leg by the terminal walk in src/headless.js; resolved into usage.subtree by src/observe/live-doc.js enrichLegUsage so the live GUI and run.json agree. Absent when the leg spawned none.",
+          "type": "object",
+          "properties": {
+            "sessions": { "type": "number" },
+            "tokens": { "type": "object" },
+            "costReported": { "type": "number" }
+          }
+        },
+        "subtreeUnknown": {
+          "description": "The leg's own cost is stated, but there is positive evidence of a subagent subtree whose spend the walk could not account for. The total is a floor, not the bill. Present only when true.",
+          "const": true
+        }
       }
     }
   },

package/skills/second-opinion/MODEL-NOTES.md

@@ -4,8 +4,8 @@ This file is the `second-opinion` skill's evolving memory of **how to actually d
 well**. Read it before Stage 0 (council selection and launch); update it, with the user's
 approval, at the end of each run (Stage 6). Keep it tight — merge and prune rather than append.
 
-_Last updated: 2026-07-14 (v2.2.0 fold-back: v3.1 optional council elements verified live;
-claim-class dedup adjudication limit; minimax and qwen-coder debut notes; see changelog)._
+_Last updated: 2026-07-26 (v4.4.0 fold-back: alias-resolution hygiene, `council run --run-id`,
+debate defense/re-vote waves now exercised, haiku and glm notes; see changelog)._
 
 ## Global operating rules (all models)
 - **Fast path:** `council run` applies `--agent Plan` / `--no-context` / `--summary-length
@@ -58,6 +58,20 @@ claim-class dedup adjudication limit; minimax and qwen-coder debut notes; see ch
   including ones outside a judge's focus. A council reviewing this contract flagged the asymmetry
   unanimously. Weigh a lone `Confirmed` tier accordingly, and prefer `Contested` evidence over
   vote counts when a finding matters.
+- **`council run` prints nothing until the run is terminal.** The run id is generated internally and
+  the only stdout write happens after the run resolves, so a backgrounded `council run` gives you no
+  id to watch. **Pin it up front with `--run-id <id>`** and point `amicus watch <id>` at it directly.
+- **Resolve every alias before you spend.** Two failure shapes, both cheap to pre-empt:
+  - **An alias that does not exist aborts the run before any spend** — `resolveModel` throws
+    `Unknown model alias '<x>'`. `deepseek-r1` is a recurring guess and is **not** shipped; the real
+    alias is `deepseek`. Check the alias table (`amicus models`) rather than inferring a name from a
+    model's marketing string.
+  - **A local alias override can silently upgrade a "cheap" seat to a frontier model.** Aliases in
+    `~/.config/amicus/config.json` take precedence over the shipped routes, so a bench you picked for
+    price can resolve to a Pro/preview tier and trip a low `--max-cost` (exit 1) — or quietly cost
+    5-10× what you budgeted. Confirm what each seat actually resolves to before a budget bench.
+- **The chair cannot also hold a bench seat**, so a bench built from budget aliases cannot chair
+  itself with one of them — pick the chair from *outside* the bench list.
 - **Stage-6 approvals:** write the proposed MODEL-NOTES diff to a run-folder file and put that path
   in the approval prompt — chat-text diffs can be hidden behind the approval dialog.
 
@@ -85,9 +99,13 @@ claim-class dedup adjudication limit; minimax and qwen-coder debut notes; see ch
 - **Optional council elements (v2.2.0) verified live:** critic seat (solo-alongside-fanout;
   `role: "critic"` passes through `council tally` untouched), debate mode's nothing-to-debate path
   (provisional `--no-ledger` tally → skip rebuttals → final ledger-recorded tally), and the chair
-  verdict scale (parseable `VERDICT:` line + hard questions) all behaved per SEAT-BRIEFS. **Debate
-  mode's defense/re-vote waves remain unexercised** — an all-Confirmed consensus run has no
-  rebuttal surface; exercise them on a contentious artifact before trusting that path blind.
+  verdict scale (parseable `VERDICT:` line + hard questions) all behaved per SEAT-BRIEFS.
+- **Debate's defense/re-vote waves have now been exercised** (an ideation council, where severity
+  means impact rather than correctness): they parse and tally cleanly, and the round behaves as a
+  **rescope** mechanism rather than a defense — raisers overwhelmingly AMEND (downgrade an
+  overstated severity, narrow a scope) rather than DEFEND, and amendments are re-confirmed on the
+  re-vote. Expect high-amend / low-defend; the idea usually survives, the severity claim often does
+  not.
 
 ## Per-model notes
 
@@ -136,6 +154,26 @@ claim-class dedup adjudication limit; minimax and qwen-coder debut notes; see ch
 ### Claude  (in-council, when toggle on)
 - Consistently the most *calibrated* reviewer (no severity inflation; findings overwhelmingly Confirmed; bench-best street-cred in recent runs) but sometimes the least *original* — it can miss the boldest single catch. Treat as a reliability floor, not a discovery engine.
 
+### haiku  (`--model haiku`) — **verify before using; it has been hard-404ing**
+- The direct-Anthropic route (`anthropic/claude-haiku-4-5-20251001`) returned a hard `Not Found`
+  on **every** invocation of a recent paid corpus — 3 of 3 legs across two separate runs, both as
+  **chair** (twice, incl. the fallback retry) and as a **bench seat** — in ~2 s with zero tokens.
+- Both runs degraded *around* it silently rather than failing: one fell back to another chair, the
+  other collapsed its bench from 3 seats to 2 and exited 2. **A dead alias does not stop a council;
+  it shrinks it.** In the bench-seat case every finding came out `confidence: "thin"` with a single
+  peer corroborator, purely because the bench had halved — and nothing in `verdict.json` said so.
+- Resolve the alias against the catalog (`amicus models --check`) before putting it on a paid
+  bench, and re-check the bench roster in `run.json` against what you asked for afterwards.
+
+### GLM  (`--model glm` → z-ai via OpenRouter)
+- Cheap and fast, and ranked best-by-peers on a clean debut — but a later run produced **35 KB of
+  prose with `conformance: unstructured` and 0 parsed findings**, twice. Its structured-output
+  reliability is **not** established; treat the debut as low-N.
+- Useful behavioural note: when its structured output failed it **refused to fabricate** on the
+  repair attempts. Honest — but an honest refusal still costs you the seat, so a bench that leans
+  on `glm` for quorum can silently adjudicate a seat short while still paying for its tokens.
+  Watch `conformance` per seat, not just the finding count.
+
 ### minimax  (`--model minimax` → via OpenRouter)
 - Fast (~2 min review legs), cheap, `clean` findings-JSON conformance on debut.
 - Took the **critic seat** brief exceptionally well: unanimously ranked #1 by its bench, full
@@ -209,6 +247,16 @@ This section keeps only per-model **qualitative quirks** and **structural-confor
   GUI-hangs-on-this-machine rule (resolved 2026-06-10; headless stays the council default by
   design). Config path updated to `~/.config/amicus/.env`.
 - **2026-07-02** — Folded back field lessons from runs 4-7 (AV-receiver, pork-shoulder, resume, novel ×2 councils): PowerShell `--models` quoting; current-date injection; long-read model selection; judge no-tools preamble; severity-inflation-justifies-dispute; five-keys tally schema; new Grok/Kimi/Mistral/Claude-in-council sections. Quantitative history stays in the ledger (`amicus council stats`).
+- **2026-07-26 (v4.4.0)** — Fold-back from six paid councils (workspace/renderer review ×4, a
+  frontier cost-pipeline council, and an ideation council). Operating lessons: alias-resolution
+  hygiene before spending (a non-existent alias aborts the run; a local `config.json` override can
+  silently upgrade a "cheap" seat to a Pro tier and trip `--max-cost`); the chair may not also hold
+  a bench seat; `council run` prints nothing until terminal, so pin `--run-id` when backgrounding.
+  Debate's defense/re-vote waves exercised for the first time — they work, and behave as a rescope
+  (amend-heavy) rather than a defense. New per-model notes: **haiku** hard-404ed 3/3 legs across two
+  runs and both councils silently degraded around it; **glm** returned `unstructured` conformance
+  with 0 findings twice after a clean debut, and honestly refused to fabricate on repair — which
+  still costs the seat.
 - **2026-07-14 (v2.2.0)** — Optional council elements shipped and verified on a planted-flaw
   ground-truth council (critic seat, debate mode nothing-to-debate path, chair verdict scale;
   expert lenses defined but not yet field-run). New lessons: claim-class dedup glosses

package/src/cli-handlers-council-run.js

@@ -82,8 +82,30 @@ function renderRunHuman(run) {
     `  bench: ${(run.bench || []).join(', ')}  chair: ${run.chair}`,
     `  dir:   ${run.options && run.options.outDir}`,
   ];
-  if (run.usage && run.usage.cost && typeof run.usage.cost.amount === 'number') {
-    lines.push(`  cost:  $${run.usage.cost.amount.toFixed(4)} (${run.usage.cost.source})`);
+  // v4.4: a cost line that omits unpriced legs reads as the whole bill. The
+  // diagnosis measured council-wsgate02 printing $0.3720 for a run that really
+  // spent $0.9859. Say what we know, then say what we cannot know — and print
+  // the line even when NOTHING resolved (the old `typeof amount === 'number'`
+  // guard silently dropped it, so a fully unpriced run looked free).
+  const u = run.usage || null;
+  const unknownLegs = u && typeof u.unknownLegs === 'number'
+    ? u.unknownLegs
+    : (u && u.cost && u.cost.unpricedLegs) || 0;
+  // v4.4 Task 2: a fully-priced run can still be short. `council-wsgate01`
+  // printed an unqualified $0.2821 for a run that really spent $0.3036 — every
+  // leg `reported`, and 100% of the gap one unattributed `explore` child session.
+  const subtreeLegs = u && typeof u.subtreeUnknownLegs === 'number'
+    ? u.subtreeUnknownLegs
+    : (u && u.cost && u.cost.subtreeUnknownLegs) || 0;
+  if (u && u.cost && (typeof u.cost.amount === 'number' || unknownLegs > 0 || subtreeLegs > 0)) {
+    const known = typeof u.cost.amount === 'number' ? `$${u.cost.amount.toFixed(4)}` : '$0.0000';
+    const gaps = [];
+    if (unknownLegs > 0) { gaps.push(`${unknownLegs} leg(s) unknown`); }
+    if (subtreeLegs > 0) { gaps.push(`${subtreeLegs} leg(s) with unattributed subagent child-session spend`); }
+    const tail = gaps.length > 0
+      ? ` + ${gaps.join(' + ')} — real spend is at least this much`
+      : '';
+    lines.push(`  cost:  ${known} (${u.cost.source})${tail}`);
   }
   if (run.error) { lines.push(`  error: ${run.error.code}: ${run.error.message}`); }
   return lines.join('\n') + '\n';
@@ -230,4 +252,4 @@ async function handleCouncilRun(args) {
   return exitCode;
 }
 
-module.exports = { handleCouncilRun, CHAIR_DEFAULT };
+module.exports = { handleCouncilRun, renderRunHuman, CHAIR_DEFAULT };

package/src/cli-handlers-spend.js

@@ -43,22 +43,31 @@ function parseSinceDays(since) {
  * A row with a null cost.amount contributes 0 to totals but is still counted
  * in `runs` and its source bucket — visibility into "how many runs are
  * unpriced" matters as much as the dollar figure.
+ *
+ * v4.4: `unpricedRows` is the count of rows that contributed NOTHING to
+ * `amount` (no numeric cost). `sourceMix.unknown` is adjacent but not the same
+ * question — it buckets by the row's declared source, whereas this counts what
+ * the arithmetic actually saw. It exists so the renderers can say "$X plus N
+ * unknown" instead of coercing null→0 and printing a measured-looking $0.0000
+ * (diagnosis §8, final paragraph).
  * @param {Array<object>} rows
  */
 function aggregateSpend(rows) {
-  const total = { amount: 0, tokens: emptyTokens(), runs: rows.length, sourceMix: { reported: 0, estimated: 0, unknown: 0 } };
+  const total = { amount: 0, tokens: emptyTokens(), runs: rows.length, unpricedRows: 0, sourceMix: { reported: 0, estimated: 0, unknown: 0 } };
   const byModelMap = new Map();
   for (const r of rows) {
     const model = r.model || 'unknown';
     if (!byModelMap.has(model)) {
-      byModelMap.set(model, { model, amount: 0, tokens: emptyTokens(), runs: 0, sourceMix: { reported: 0, estimated: 0, unknown: 0 } });
+      byModelMap.set(model, { model, amount: 0, tokens: emptyTokens(), runs: 0, unpricedRows: 0, sourceMix: { reported: 0, estimated: 0, unknown: 0 } });
     }
     const bucket = byModelMap.get(model);
     bucket.runs += 1;
     addTokens(bucket.tokens, r.tokens);
     addTokens(total.tokens, r.tokens);
     const cost = r.cost || {};
-    const amount = typeof cost.amount === 'number' ? cost.amount : 0;
+    const priced = typeof cost.amount === 'number';
+    const amount = priced ? cost.amount : 0;
+    if (!priced) { bucket.unpricedRows += 1; total.unpricedRows += 1; }
     bucket.amount += amount;
     total.amount += amount;
     // Any source string outside {reported,estimated} buckets as unknown —
@@ -139,6 +148,18 @@ async function fetchCreditFooter(deps) {
   return res || null;
 }
 
+/**
+ * Cost cell for one rollup bucket. v4.4: a bucket in which NO row carried a
+ * numeric amount has no dollar figure to show — it renders formatCost's `?`
+ * rather than `$0.0000`, which previously read as a measured zero and was the
+ * only thing contradicting the (correct but easily missed) `u` count.
+ */
+function bucketCost(bucket) {
+  const unpriced = bucket.unpricedRows || 0;
+  const hasKnown = (bucket.runs || 0) > unpriced;
+  return formatCost({ amount: hasKnown ? bucket.amount : null, source: dominantSource(bucket.sourceMix) });
+}
+
 function renderHuman({ total, byModel, windowDays, credit, wasted }) {
   if (total.runs === 0) { return 'No spend recorded yet.\n'; }
   let out = windowDays ? `amicus spend (last ${windowDays}d)\n\n` : 'amicus spend (all time)\n\n';
@@ -148,9 +169,15 @@ function renderHuman({ total, byModel, windowDays, credit, wasted }) {
     const tokCol = `${m.tokens.input}/${m.tokens.output}`;
     out += `${String(m.model).slice(0, 48).padEnd(48)} ${String(m.runs).padStart(4)}  ` +
       `${tokCol.padStart(15)}  ` +
-      `${formatCost({ amount: m.amount, source: dominantSource(m.sourceMix) }).padStart(9)}  ${mix}\n`;
+      `${bucketCost(m).padStart(9)}  ${mix}\n`;
+  }
+  out += `\nTotal: ${bucketCost(total)} across ${total.runs} run(s)\n`;
+  // v4.4: the total is a FLOOR whenever any row is unpriced. Stated on its own
+  // line rather than squeezed into the fixed-width cost column.
+  if (total.unpricedRows > 0) {
+    out += `${total.unpricedRows} unpriced row(s) — cost unknown and NOT in the total; `
+      + 'real spend is at least this much.\n';
   }
-  out += `\nTotal: ${formatCost({ amount: total.amount, source: dominantSource(total.sourceMix) })} across ${total.runs} run(s)\n`;
   if (wasted && wasted.runs > 0) {
     out += `Wasted (failed runs): ${formatCost({ amount: wasted.amount, source: 'mixed' })} across ${wasted.runs} rows — see amicus spend --failed\n`;
   }

package/src/cli-handlers-watch.js

@@ -29,8 +29,21 @@ function resolveWatchTarget(id, project) {
   const clean = String(id).replace(/^council-/, '');
 
   const { readPointer } = require('./council/run-state');
+  const { containsOnDisk } = require('./utils/path-fence');
   const ptr = readPointer(project, clean);
-  if (ptr) { return { kind: 'council', id: clean, runDir: ptr.runDir }; }
+  // readPointer validates `council-<id>.json`'s {runId, runDir} only for
+  // truthiness (run-state.js:133-139), so a tampered or stale pointer can point
+  // runDir anywhere on disk — and this resolver's runDir is what
+  // observe/watch-render.js opens events.jsonl from. Same realpath-containment
+  // fence the v4.4 workspace reads use (src/utils/path-fence.js); a real
+  // runDir is always nested inside project (src/mcp-council-run.js:109 enforces
+  // it at creation time), so nothing legitimate is refused. An escaping pointer
+  // falls through to the session lookup and then 'unknown' — the same outcome a
+  // missing pointer already produces, so handleWatch's BAD_SESSION contract is
+  // unchanged.
+  if (ptr && containsOnDisk(project, ptr.runDir)) {
+    return { kind: 'council', id: clean, runDir: ptr.runDir };
+  }
 
   // getSessionDir THROWS on a path-traversal id ('..' / separators) — this
   // resolver is exported and docblocked "pure over disk", so it must be
@@ -50,11 +63,33 @@ function resolveWatchTarget(id, project) {
 }
 
 /**
- * `amicus watch <id> [--json|--plain] [--interval <sec>] [--project <p>] [--ui]`
+ * `amicus watch [--ui] <id> [--json|--plain] [--interval <sec>] [--project <p>]`
  * @param {object} args parsed CLI args
  * @returns {Promise<number>} exit code (render loop: Task 12)
  */
 async function handleWatch(args) {
+  // v4.4: `amicus watch [--ui] [runId]` — GUI watch is the same verb (spec
+  // §4.4), not a separate command. Handled at the very top, above id
+  // resolution: unlike the machine-readable path, `--ui` alone (no runId)
+  // is valid and opens the Council Workspace run-list landing, so this
+  // branch must run BEFORE the "id is required" gate below.
+  if (args.ui) {
+    if (args.json) {
+      process.stderr.write('Error: --ui is interactive-only (no --json). Use amicus watch <id> --json for machine output.\n');
+      return 1;
+    }
+    // --project wins over --cwd (same precedence as the non-UI path below) —
+    // DE-ROT F46: `--project` is the documented first-priority option for
+    // `watch`; resolving from --cwd only would silently point the workspace
+    // at the wrong directory when a run was launched elsewhere.
+    const project = args.project || args.cwd || process.cwd();
+    const runId = args._[1] ? String(args._[1]) : '';
+    const { launchWorkspaceWindow } = require('./sidecar/workspace-window');
+    const res = await launchWorkspaceWindow({ project, runId });
+    if (res.error) { process.stderr.write(`${res.error}\n`); }
+    return res.code;
+  }
+
   const { failJson, ERROR_CODES } = require('./utils/error-doc');
   const id = args._[1];
   if (!id || id === true) {
@@ -64,14 +99,6 @@ async function handleWatch(args) {
   const check = validateTaskId(String(id));
   if (!check.valid) { process.stderr.write(`${check.error}\n`); return 1; }
 
-  // --ui is registered as the v4.4 Council Workspace seam only; this rev
-  // (v4.3) registers the flag + this fail-fast, the GUI itself is out of
-  // scope. --ui alone is accepted and falls through to the loop.
-  if (args.ui && args.json) {
-    process.stderr.write('Error: --ui is interactive-only and cannot be combined with --json\n');
-    return 1;
-  }
-
   const project = args.project || args.cwd || process.cwd();
   const target = resolveWatchTarget(String(id), project);
   if (target.kind === 'unknown') {

package/src/council/briefings.js

@@ -121,13 +121,46 @@ function buildLensBriefing({ lens, briefing, date }) {
  * repair loop). References ONLY the json-shape fragment — never the
  * "prose review THEN json" framing — so a headless model isn't handed license
  * to write a whole new prose review on a tight repair turn.
+ *
+ * ⚠️ LC-6. This used to carry the validation ERRORS without the REVIEW they
+ * were errors about, and a repair solo is a FRESH session with no memory of
+ * the review turn. Three of five paid councils burned a seat on it:
+ *   - wsgate02 `qwen`  — refused twice: "I don't have a previous review to correct"
+ *   - wsgate04 `glm`   — refused twice: "the previous review's content was
+ *                        excluded by the caller… I will not fabricate findings"
+ *   - costgate01 `grok` — COMPLIED, by inventing a self-referential finding
+ *                        about its own empty output, which then entered
+ *                        tally.json, the street-cred table and the chair
+ *                        synthesis as C1 and reached a human's decision.
+ * Honest models lose the seat (a 4-model bench silently adjudicating on 3,
+ * still paying for the fourth); compliant ones poison the record.
+ *
+ * `review` is the text that ACTUALLY failed — the original review on the first
+ * attempt, the previous repair's output on the second — so the errors and the
+ * artifact they describe are always the same thing. It is embedded verbatim and
+ * uncapped: the largest real case was 35 KB, and a silent truncation would
+ * recreate this defect in a subtler form (repairing a review the model can only
+ * half see).
+ * @param {{errors?: Array<{code: string, detail: string}>, review?: string}} args
  */
-function buildFindingsRepairPrompt({ errors }) {
+function buildFindingsRepairPrompt({ errors, review }) {
   const lines = (errors || []).map(e => `- ${e.code}: ${e.detail}`).join('\n');
+  const text = typeof review === 'string' ? review.trim() : '';
+  // The absent case is stated, never papered over with an empty block: a model
+  // asked to repair nothing must be told to report nothing rather than left to
+  // guess, which is precisely what produced grok's invented finding.
+  const prior = text
+    ? ['--- YOUR PREVIOUS REVIEW (verbatim — this is the text to correct) ---',
+      text,
+      '--- END OF YOUR PREVIOUS REVIEW ---'].join('\n')
+    : 'Your previous response was empty — there is no prior review text to correct. ' +
+      'Do not invent findings to satisfy the schema: emit an empty "findings" array ' +
+      'and say so in "overall".';
   return [
     'Do NOT use any tools or read any files; everything is in this message; begin ' +
     'immediately with the JSON block.',
-    'Your previous review\'s trailing findings JSON failed validation with these errors:',
+    prior,
+    'That review\'s trailing findings JSON failed validation with these errors:',
     lines,
     'Re-emit ONLY the corrected findings JSON block (the same findings, fixed — do not ' +
     'add or remove findings), as a single fenced ```json block:',