amicus 4.4.0 → 4.5.0

package/electron/fold.js

@@ -66,7 +66,7 @@ function createFoldHandler(state) {
         `Session: ${state.sessionId || state.taskId}`,
         `Client: ${state.client}`,
         `CWD: ${state.cwd}`,
-        `Mode: interactive`,
+        'Mode: interactive',
         '---',
         summary || 'Session ended without summary.'
       ].join('\n');

package/electron/main.js

@@ -142,7 +142,10 @@ function createAmicusWindow() {
   let updateInfo = null;
   const updateInfoRaw = process.env.AMICUS_UPDATE_INFO;
   if (updateInfoRaw) {
-    try { updateInfo = JSON.parse(updateInfoRaw); } catch (_) {}
+    try { updateInfo = JSON.parse(updateInfoRaw); } catch (_) {
+      // A malformed AMICUS_UPDATE_INFO is not worth failing launch over:
+      // updateInfo stays null and the direct check below takes over.
+    }
   }
   if (!updateInfo) {
     const { getUpdateInfo, initUpdateCheck } = require('../src/utils/updater');

package/electron/setup-ui-aliases.js

@@ -22,7 +22,7 @@ const ALIAS_GROUPS = [
  * @returns {string} HTML fragment with search, groups, rows, and add button
  */
 function buildAliasEditorHTML(aliases) {
-  const searchInput = `<input type="text" id="alias-search" class="alias-search" placeholder="Search aliases..." autocomplete="off" spellcheck="false">`;
+  const searchInput = '<input type="text" id="alias-search" class="alias-search" placeholder="Search aliases..." autocomplete="off" spellcheck="false">';
 
   const groups = ALIAS_GROUPS.map(group => {
     const rows = group.keys
@@ -31,10 +31,10 @@ function buildAliasEditorHTML(aliases) {
         const model = aliases[key];
         return `<div class="alias-row" data-alias="${key}">` +
           `<span class="alias-name">${key}</span>` +
-          `<span class="alias-arrow">\u2192</span>` +
+          '<span class="alias-arrow">\u2192</span>' +
           `<span class="alias-model">${model}</span>` +
           `<button class="alias-delete" data-alias="${key}">\u00d7</button>` +
-          `</div>`;
+          '</div>';
       }).join('\n        ');
 
     const count = group.keys.filter(key => aliases[key] !== undefined).length;
@@ -51,9 +51,9 @@ function buildAliasEditorHTML(aliases) {
   const exampleModel = aliases[exampleAlias] || 'openrouter/google/gemini-3.1-flash-lite-preview';
 
   // SVG icons for the example box
-  const terminalIcon = `<svg class="alias-icon-accent" width="16" height="16" viewBox="0 0 16 16" fill="none"><rect x="1" y="2" width="14" height="12" rx="2" stroke-width="1.5"/><path d="M4 6l2.5 2L4 10" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.5 10H11" class="alias-icon-faint-path" stroke-width="1.5" stroke-linecap="round"/></svg>`;
-  const arrowIcon = `<svg class="alias-icon-accent" width="20" height="12" viewBox="0 0 20 12" fill="none"><path d="M2 6h14" stroke-width="1.5" stroke-linecap="round"/><path d="M13 2l4 4-4 4" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
-  const modelIcon = `<svg class="alias-icon-ok" width="16" height="16" viewBox="0 0 16 16" fill="none"><circle cx="8" cy="5" r="3" stroke-width="1.5"/><path d="M8 8v3" stroke-width="1.5" stroke-linecap="round"/><circle cx="4" cy="13" r="1.5" stroke-width="1.2"/><circle cx="8" cy="13" r="1.5" stroke-width="1.2"/><circle cx="12" cy="13" r="1.5" stroke-width="1.2"/><path d="M4 11.5L8 11M8 11l4 .5" stroke-width="1" stroke-linecap="round"/></svg>`;
+  const terminalIcon = '<svg class="alias-icon-accent" width="16" height="16" viewBox="0 0 16 16" fill="none"><rect x="1" y="2" width="14" height="12" rx="2" stroke-width="1.5"/><path d="M4 6l2.5 2L4 10" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.5 10H11" class="alias-icon-faint-path" stroke-width="1.5" stroke-linecap="round"/></svg>';
+  const arrowIcon = '<svg class="alias-icon-accent" width="20" height="12" viewBox="0 0 20 12" fill="none"><path d="M2 6h14" stroke-width="1.5" stroke-linecap="round"/><path d="M13 2l4 4-4 4" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+  const modelIcon = '<svg class="alias-icon-ok" width="16" height="16" viewBox="0 0 16 16" fill="none"><circle cx="8" cy="5" r="3" stroke-width="1.5"/><path d="M8 8v3" stroke-width="1.5" stroke-linecap="round"/><circle cx="4" cy="13" r="1.5" stroke-width="1.2"/><circle cx="8" cy="13" r="1.5" stroke-width="1.2"/><circle cx="12" cy="13" r="1.5" stroke-width="1.2"/><path d="M4 11.5L8 11M8 11l4 .5" stroke-width="1" stroke-linecap="round"/></svg>';
 
   const exampleBox = `<div class="routing-example">
         <div class="example-label">How it works</div>

package/electron/workspace-ui/live-model.js

@@ -11,7 +11,10 @@
   // or idle-timed-out run would poll forever and never flip to its terminal rendering.
   // Must stay byte-identical to src/workspace/run-detail.js TERMINAL_STATUSES, which itself
   // mirrors the shipped src/observe/live-doc.js TERMINAL set. A drift pin asserts this.
-  var TERMINAL_STATUSES = ['complete', 'partial', 'error', 'crashed', 'aborted', 'timeout', 'idle-timeout'];
+  // ⚠️ v4.4.1 A1: 'timed-out' added alongside 'timeout'. Both spellings are real and are written
+  // by different producers — see src/observe/live-doc.js:18. Inert for the workspace (a council
+  // run.json's status vocabulary is aborted|complete|error|partial), carried for byte-identity.
+  var TERMINAL_STATUSES = ['complete', 'partial', 'error', 'crashed', 'aborted', 'timeout', 'timed-out', 'idle-timeout'];
 
   // ⚠️ DE-ROT (F41): STAGE_LABELS must be mirrored here too. The live loop labels stages that
   // START AFTER the run was opened, and those names are absent from the frozen derived.stageRail,
@@ -54,6 +57,14 @@
     // leg (terminal rows from runStats are already alias-only, so the fallback is exact there).
     var alias = seat.modelInput || seat.model;
     var label = labelOf ? labelOf(alias) : null;
+    // ⚠️ v4.4.1 RN-9: this hand-rolled flip is LOAD-BEARING — do NOT "fix" it into
+    // AmicusRender.display({model: seat.model, label: label}, blindOn). The other two copies
+    // (workspace-panels.js's review/judge titles) were routed through display() because their
+    // pair's `model` IS the identity they must print. Here it is not: the seat's printable
+    // identity is the council ALIAS resolved on the line above (F36 — a live leg's `seat.model`
+    // is the RESOLVED executable id, e.g. `google/gemini-2.5-pro`, which labelMap never keys on),
+    // so display()'s blind-OFF arm would print the resolved id and undo F36. This module is also
+    // node-tested with NO DOM and no window.AmicusRender to call. Deliberate third copy.
     var name = blindOn && label ? label : alias;
     var tokens = (seat.tokensIn === null || seat.tokensIn === undefined) &&
                  (seat.tokensOut === null || seat.tokensOut === undefined)

package/electron/workspace-ui/md-lite.js

@@ -15,16 +15,49 @@
   var UL_RE = /^\s*[-*]\s+/;
   var OL_RE = /^\s*\d+[.)]\s+/;
 
+  /**
+   * Split one line into literal / inline-code segments in a SINGLE linear pass.
+   *
+   * ⚠️ v4.4.1 A1/D1 (Confirmed 4/4), with its SEVERITY CLAIM CORRECTED. The
+   * previous form re-`exec`ed a freshly sliced `rest` each iteration
+   * (`rest = rest.slice(...)`) — quadratic as WRITTEN, but not as it ran. V8's
+   * `String.prototype.slice` returns a SlicedString (parent pointer + offset),
+   * not a copy, so the old code measured ~8 ms at artifact-guard.js's 200 KB cap
+   * and scaled LINEARLY (~2x per doubling out to 2.4 MB). A deliberately-copying
+   * control took 78,232 ms at that same 200 KB — that is the freeze the finding
+   * described, and it is not what shipped. Numbers:
+   * `.superpowers/sdd/task-10-report.md:127-148`.
+   *
+   * What the rewrite removes is therefore a silent dependence on an undocumented
+   * engine optimisation that nothing here states or tests — a latent PORTABILITY
+   * hazard on any engine without sliced strings — and not a live performance
+   * defect or an exploitable-DoS-that-was. The `lastIndex` cursor walks the
+   * ORIGINAL string once and never copies a tail, so linearity is now a property
+   * of the algorithm rather than of the engine.
+   *
+   * Output is identical to the old function for every input: the pattern is
+   * context-free — no `^`, `\b`, lookaround or backreference — so a /g scan
+   * resuming at `lastIndex` lands on exactly the same match positions that
+   * re-`exec`ing the remainder did. The three boundary cases match too: no
+   * match at all yields one literal segment, a trailing match yields no empty
+   * tail segment, and empty input yields [].
+   *
+   * The regex is constructed per call and deliberately NOT hoisted to module
+   * scope: a /g regex carries mutable `lastIndex`, so one shared instance would
+   * leak cursor state between calls and silently drop spans.
+   */
   function parseInline(text) {
     var out = [];
-    var rest = String(text);
-    while (rest.length) {
-      var m = /`([^`\n]+)`/.exec(rest);
-      if (!m) { out.push({ code: false, text: rest }); break; }
-      if (m.index > 0) { out.push({ code: false, text: rest.slice(0, m.index) }); }
+    var s = String(text);
+    var re = /`([^`\n]+)`/g;
+    var pos = 0;
+    var m;
+    while ((m = re.exec(s)) !== null) {
+      if (m.index > pos) { out.push({ code: false, text: s.slice(pos, m.index) }); }
       out.push({ code: true, text: m[1] });
-      rest = rest.slice(m.index + m[0].length);
+      pos = re.lastIndex;
     }
+    if (pos < s.length) { out.push({ code: false, text: s.slice(pos) }); }
     return out;
   }
 
@@ -43,7 +76,11 @@
         continue;
       }
       var h = H_RE.exec(line);
-      if (h) { blocks.push({ t: 'h', level: h[1].length, text: h[2] }); i += 1; continue; }
+      // ⚠️ v4.4.1 D3: trim the heading text. H_RE's `\s+` eats the run of
+      // whitespace after the hashes, but `(.*)$` keeps everything to end of
+      // line — so `# Title   ` rendered a heading with trailing blanks baked
+      // into its text node.
+      if (h) { blocks.push({ t: 'h', level: h[1].length, text: h[2].trim() }); i += 1; continue; }
       if (UL_RE.test(line)) {
         var ul = [];
         while (i < lines.length && UL_RE.test(lines[i])) { ul.push(lines[i].replace(UL_RE, '')); i += 1; }
@@ -91,7 +128,14 @@
       var b = blocks[i];
       var el;
       if (b.t === 'h') {
-        el = d.createElement('h' + Math.min(6, b.level + 2));
+        // ⚠️ v4.4.1 D4: the `Math.min(6, …)` that used to wrap this was
+        // unreachable — H_RE's `#{1,4}` bounds level to 1–4, so the tag is
+        // always h3–h6 and the clamp could never fire. Dead defensive code is
+        // worse than none here: it made the h6 ceiling look enforced when the
+        // real guarantee lives in H_RE. If that `#{1,4}` is ever widened, THIS
+        // line must widen with it — h7 is not an element. The
+        // `'#'.repeat(4) + ' X'` → h6 test pins the true boundary.
+        el = d.createElement('h' + (b.level + 2));
         applyInline(el, parseInline(b.text), d);
       } else if (b.t === 'code') {
         el = d.createElement('pre');

package/electron/workspace-ui/workspace-app.js

@@ -27,6 +27,13 @@
                      // null on a non-debate run, an aborted/skipped debate, or a parse failure —
                      // drillIntoJudge's judge-*.md fallback covers all three.
     blind: false,
+    // Task 19 (RN-5) + fix-wave (RN-5 amendment): the (run id, status) pair renderDetail() last
+    // computed state.blind's default for. Together they gate the recompute (in renderDetail(),
+    // below) to a run CHANGE or a STATUS change only: a same-run/same-status re-render (the
+    // blind toggle) keeps the user's own choice, while a same-run/CHANGED-status re-render (the
+    // live loop's running -> terminal refresh, or the abort-confirm re-read) still auto-reveals.
+    detailRunId: null,
+    detailRunStatus: null,
     labelByModel: {},
     listTimer: null,
     liveTimer: null, // LIVE (Task 15)
@@ -103,8 +110,23 @@
       return;
     }
 
-    // blind default: computed ONCE per run-open from status (resolution 9)
-    state.blind = window.AmicusLive.defaultBlind(d.run.status);
+    // blind default: computed from status (resolution 9) — only on a run CHANGE or a STATUS
+    // change for the same run. Task 19 (RN-5): a same-run/same-status re-render
+    // (renderDetail_preserveBlind, below, calls straight back in here on every blind toggle)
+    // must keep the user's own choice instead of recomputing the default every call —
+    // recomputing unconditionally is what forced the old code to paint twice and, via
+    // wireLazyPanels() a few lines down, collapse any lazy panel the user had open.
+    // ⚠️ Fix-wave (RN-5 amendment, controller ruling): run id ALONE also suppressed the
+    // pre-existing running -> terminal auto-reveal, since the live loop's terminal refresh
+    // (workspace-verbs.js's startLiveLoop tick) and the abort-confirm re-read both call
+    // openRun() on the SAME run id — same run, but a real status transition. Keying on run id
+    // AND status recomputes (auto-reveals) on that transition while still preserving a same-
+    // run/same-status call (the blind toggle).
+    if (state.detailRunId !== d.runId || state.detailRunStatus !== d.run.status) {
+      state.blind = window.AmicusLive.defaultBlind(d.run.status);
+      state.detailRunId = d.runId;
+      state.detailRunStatus = d.run.status;
+    }
     $('blind-toggle').checked = state.blind;
     state.labelByModel = {};
     d.derived.names.forEach(function (p) { state.labelByModel[p.model] = p.label; });
@@ -178,7 +200,6 @@
   });
 
   function renderDetail_preserveBlind() {
-    var keep = state.blind;
     // ⚠️ Fix-wave item 1: renderDetail() itself early-returns safely for an unreadable run
     // (!d || d.error || !d.derived) — but this wrapper used to run past that guard
     // unconditionally, dereferencing the (nonexistent) derived model via renderSeatsPanel()
@@ -187,22 +208,22 @@
     // the error branch unhides #run-view before the derived-model guard, so the Blind
     // checkbox is live with nothing behind it.
     if (!state.detail || state.detail.error || !state.detail.derived) {
-      $('blind-toggle').checked = keep;
+      $('blind-toggle').checked = state.blind;
       return;
     }
+    // ⚠️ Task 19 (RN-5): this used to call renderDetail() (which unconditionally stomped
+    // state.blind back to the run's status default), restore the user's pre-call value,
+    // and then re-paint header chips/seats/matrix/verdict/cost a SECOND time to compensate
+    // for the first call having painted with the wrong (default) blind state — a double
+    // paint, and (via wireLazyPanels(), called inside that first renderDetail()) a collapse
+    // of any lazy panel the user had open. Fixed at the root instead of compensated for:
+    // renderDetail() now recomputes the blind default only on a run CHANGE or a STATUS change
+    // (state.detailRunId/state.detailRunStatus, above) — this call changes neither, so it
+    // keeps state.blind exactly as the change listener above just set it, and
+    // workspace-panels.js's wireLazyPanels() (its own same-run guard, `lastWiredRunId`)
+    // refreshes any open panel in place rather than collapsing it (fix-wave, Fix 1). One
+    // renderDetail() call now paints correctly the first time — nothing left to restore.
     renderDetail();
-    state.blind = keep;
-    $('blind-toggle').checked = keep;
-    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): renderDetail() (just
-    // called above) resets state.blind to the run's DEFAULT before this function restores the
-    // user's chosen `keep` value — renderHeaderChips was painted during that inner call with
-    // the (temporarily wrong) default blind state and, unlike seats/matrix/verdict/cost below,
-    // was never repainted afterward. Re-render it here too, now that state.blind is correct.
-    window.AmicusRender.renderHeaderChips($('run-chips'), state.detail.run, state.blind, labelOf);
-    P.renderSeatsPanel();
-    P.renderMatrixPanel();
-    P.renderVerdictPanel();
-    window.AmicusRender.renderCost($('cost-body'), state.detail.derived.cost, state.blind, labelOf);
   }
 
   $('run-list').addEventListener('keydown', function (e) {
@@ -227,7 +248,8 @@
 
   // ⚠️ PRE-FLIGHT (P4) + DE-ROT (F09): register the three prose `toggle` listeners exactly ONCE,
   // here at boot. wireLazyPanels() (called from renderDetail, on every run-open and blind-toggle)
-  // only rewrites the per-run `loaders` spec map from now on — it never adds a listener.
+  // rewrites the per-run `loaders` spec map every call and — fix-wave, Fix 1 — refreshes any
+  // already-open lazy panel in place on a same-run call; it never adds a listener.
   P.proseLoader('reviews-panel');
   P.proseLoader('bundle-panel');
   P.proseLoader('judges-panel');

package/electron/workspace-ui/workspace-matrix.js

@@ -175,20 +175,57 @@
     return chairHost;
   }
 
-  /** Wrap every text-node occurrence of needle in <mark> (DOM-safe highlight). */
+  /**
+   * Wrap EVERY occurrence of `needle` in a `<mark>` (DOM-safe: splitText + replaceChild,
+   * never innerHTML).
+   *
+   * ⚠️ v4.4.1 RN-3 + DOC-6: this used to do exactly ONE `indexOf`/`splitText` per collected
+   * text node, so a finding id mentioned twice inside a single text node was highlighted once
+   * — and the reader, drilling in from a dispute cell, believed they had seen every reference
+   * to it in that judge's prose. This docblock nonetheless promised "every occurrence" (DOC-6),
+   * which is what made two `wsgate04` reviewers file the same bug from opposite directions.
+   * Behaviour and doc now agree.
+   *
+   * The rescan continues from `tail`, not from `cursor`, because `splitText` MUTATES the node
+   * being walked: the first call truncates `cursor` to the text BEFORE the match and returns the
+   * match-plus-remainder; the second peels the remainder off into a NEW node the TreeWalker's
+   * already-collected list does not contain. Advancing to that new node is what makes the loop
+   * both complete (it can reach later matches) and terminating (it can never re-find the match
+   * it just replaced).
+   *
+   * NOT idempotent — a second call re-walks the text nodes inside the marks this one created and
+   * nests a second `<mark>`. drillIntoJudge (workspace-panels.js) calls clearHighlight() first
+   * for exactly that reason.
+   *
+   * ⚠️ v4.4.1 M1: clearHighlight() (below) unwraps each `<mark>` back into a plain text node but
+   * never calls `normalize()`, so the sibling text nodes either side of the old mark are left
+   * un-merged — the drill-clear-drill cycle fragments the prose a little more every time. Because
+   * the scan above only ever calls `.indexOf`/`.splitText` on ONE text node at a time, a needle
+   * whose match now straddles one of those leftover boundaries is invisible to it — silently
+   * under-marking on a re-drilled panel, the opposite of this docblock's "every occurrence"
+   * promise. `container.normalize()` below re-merges adjacent text nodes before every scan, so
+   * highlightText is robust to fragmentation regardless of how the container got that way.
+   */
   function highlightText(container, needle) {
-    if (!needle) { return; }
+    if (!needle) { return; }  // also the loop's termination guard: a 0-length needle never advances
+    // v4.4.1 M1: undo any un-merged fragmentation clearHighlight() left behind (it does not
+    // normalize) — without this, a needle whose match spans a leftover node boundary is missed.
+    container.normalize();
     var walker = document.createTreeWalker(container, NodeFilter.SHOW_TEXT);
     var nodes = [];
     while (walker.nextNode()) { nodes.push(walker.currentNode); }
     nodes.forEach(function (node) {
-      var idx = node.nodeValue.indexOf(needle);
-      if (idx === -1) { return; }
-      var after = node.splitText(idx);
-      after.splitText(needle.length);
-      var mark = document.createElement('mark');
-      mark.textContent = needle;
-      after.parentNode.replaceChild(mark, after);
+      var cursor = node;
+      for (;;) {
+        var idx = cursor.nodeValue.indexOf(needle);
+        if (idx === -1) { return; }
+        var match = cursor.splitText(idx);            // `match` now starts with the needle
+        var tail = match.splitText(needle.length);    // `tail` is everything after it
+        var mark = document.createElement('mark');
+        mark.textContent = needle;
+        match.parentNode.replaceChild(mark, match);
+        cursor = tail;
+      }
     });
   }
 

package/electron/workspace-ui/workspace-panels.js

@@ -19,6 +19,24 @@
   // inverted back to the model id that keys state.labelByModel, so blind labels would break.
   function sanitizeName(model) { return String(model).replace(/[^a-zA-Z0-9._-]/g, '-'); }
 
+  // ⚠️ Task 18 (RN-1): review-/judge- filenames used to be recomputed here via a bare
+  // sanitizeName(model) call, which is NOT injective — two distinct bench models that sanitize
+  // to the same name would both resolve to the SAME filename, so drillIntoJudge's
+  // `[data-artifact="..."]` lookup handed back whichever section matched first (model A's prose
+  // rendered under model B's name). derived.artifactsByModel (src/workspace/artifact-guard.js's
+  // artifactAllowlist, threaded through by run-detail.js) already carries the disambiguated
+  // (possibly `~2`/`~3`-suffixed) name per raw model — consult it FIRST. Fall back to the legacy
+  // computation only when the map itself is absent: older detail payloads (pre-v4.5 runs,
+  // live-doc consumers not yet updated to build the map) never carry it, and re-deriving via
+  // sanitizeName is exactly what those payloads always did, so it stays correct for them too.
+  function resolveArtifactName(model, kind) {
+    var A = window.AmicusApp;
+    var map = A.state.detail.derived && A.state.detail.derived.artifactsByModel;
+    var entry = map && map[model];
+    if (entry && entry[kind]) { return entry[kind]; }
+    return kind + '-' + sanitizeName(model) + '.md';
+  }
+
   function renderSeatsPanel() {
     var A = window.AmicusApp;
     var d = A.state.detail;
@@ -60,12 +78,16 @@
   // ⚠️ PRE-FLIGHT (P4): the load is AWAITABLE — drillIntoJudge needs to know when it has
   // settled (the old code guessed with setTimeout(render, 300), which could fire before an
   // unbounded N-artifact IPC round trip finished and silently render nothing). loadPanel()
-  // is idempotent per panel id and returns its in-flight promise; both the promise cache
-  // (`loading`) and the per-run spec (`loaders`) are keyed by panel id and cleared/overwritten
-  // by wireLazyPanels() on every run-open — that clearing is what stops F09's stale-run
-  // artifact requests.
+  // is idempotent per panel id and returns its in-flight promise; the promise cache
+  // (`loading`) and the per-run spec (`loaders`) are both keyed by panel id, but only
+  // `loading` is cleared by wireLazyPanels() — on a run CHANGE only (Task 19, RN-5) — and
+  // that clearing is what stops F09's stale-run artifact requests.
   var loaders = {};  // panelId -> {bodyId, files}  (rewritten per run by wireLazyPanels)
   var loading = {};  // panelId -> Promise           (cleared per run by wireLazyPanels)
+  // Task 19 (RN-5): the run wireLazyPanels() last reset panels/loading for — gates the reset
+  // below to run CHANGES only. A same-run call (renderDetail() runs this on every blind toggle
+  // too, and on the live loop's terminal refresh) instead refreshes any open panel (Fix 1).
+  var lastWiredRunId = null;
 
   function loadPanel(panelId, bodyId, files) {
     var A = window.AmicusApp;
@@ -107,18 +129,31 @@
   }
 
   /**
-   * Rewrites the per-run spec map and drops the previous run's cached load promises — this
-   * is precisely what stops F09's stale-run artifact requests. Safe to call on every
-   * renderDetail() (run-open and blind-toggle alike); it registers no listeners itself.
+   * Rewrites the per-run spec map on every call. On a run CHANGE (tracked via the module-level
+   * `lastWiredRunId`, above), resets panel open/loaded state and drops the previous run's
+   * cached load promises — exactly what F09's stale-run protection needs. On a SAME-run call
+   * (Task 19, RN-5: renderDetail() calls this on every blind toggle too, and the live loop's
+   * terminal refresh) any panel the user already has open is instead refreshed in place — see
+   * Fix 1 below — never left showing stale-blind content, never collapsed. Registers no
+   * listeners itself.
    */
   function wireLazyPanels() {
     var A = window.AmicusApp;
-    ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
-      var p = A.$(id);
-      p.dataset.loaded = '0';
-      p.open = false;
-      delete loading[id];
-    });
+    // ⚠️ Fix-wave (Fix 4): keyed off `A.state.detail.runId`, not `A.state.runId` — the latter is
+    // set synchronously at the top of openRun(), before its workspace:get-run reply lands, so an
+    // out-of-order reply could make the two diverge. workspace-app.js's own run-change gate
+    // (renderDetail(), above `d.runId`) reads off the SAME `state.detail.runId`, so the two
+    // provably agree on whether this is a run change.
+    var sameRun = A.state.detail.runId === lastWiredRunId;
+    if (!sameRun) {
+      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
+        var p = A.$(id);
+        p.dataset.loaded = '0';
+        p.open = false;
+        delete loading[id];
+      });
+      lastWiredRunId = A.state.detail.runId;
+    }
     var bench = A.state.detail.run.bench || [];
     var debated = !!A.state.detail.run.debate;
     // ⚠️ CODE REVIEW (round 2, finding 2): readRunArtifact's error for a genuinely-missing
@@ -134,19 +169,30 @@
     // than new).
     var artifacts = A.state.detail.artifacts || {};
     function present(name) { return !!(artifacts[name] && artifacts[name].present); }
+    // ⚠️ v4.4.1 RN-9: these two titles used to hand-roll `A.state.blind && label ? label : m`
+    // inline. Both now go through AmicusRender.display() — the single blind-flip definition the
+    // re-vote title below already used — so the next blind-mode ruling lands in one place instead
+    // of being re-applied by hand in every file that happens to render an identity.
     loaders['reviews-panel'] = { bodyId: 'reviews-body', files: function () {
       return bench.map(function (m) {
         var label = A.state.labelByModel[m];
-        return { name: 'review-' + sanitizeName(m) + '.md', title: (A.state.blind && label ? label : m) };
+        return { name: resolveArtifactName(m, 'review'), title: window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
       }).filter(function (f) { return present(f.name); });
     } };
     loaders['bundle-panel'] = { bodyId: 'bundle-body', files: function () {
-      return [{ name: 'bundle-stage2.md', title: 'bundle-stage2.md (verbatim)' }];
+      // ⚠️ v4.4.1 RN-4: the presence filter is NOT optional here either. Without it, a run whose
+      // Stage 2 never ran (a one-seat bench, an abort before the cross-review, a cost ceiling)
+      // requested a file the manifest already knows is absent and rendered readRunArtifact's raw
+      // error string in the panel — "absolute host path and all", per this file's own round-2
+      // note above `present()`. reviews-panel and judges-panel have always filtered; this was the
+      // odd one out.
+      return [{ name: 'bundle-stage2.md', title: 'bundle-stage2.md (verbatim)' }]
+        .filter(function (f) { return present(f.name); });
     } };
     loaders['judges-panel'] = { bodyId: 'judges-body', files: function () {
       var files = bench.map(function (m) {
         var label = A.state.labelByModel[m];
-        return { name: 'judge-' + sanitizeName(m) + '.md', title: 'Judge ' + (A.state.blind && label ? label : m) };
+        return { name: resolveArtifactName(m, 'judge'), title: 'Judge ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
       });
       if (debated) {
         // ⚠️ DE-ROT (F38): on a --debate run, a matrix dispute cell can be a RE-VOTE whose
@@ -157,13 +203,31 @@
         // judge- titles above, which mirror the brief verbatim), so it goes through
         // AmicusRender.display() — the single blind-flip definition — rather than adding a
         // fourth hand-rolled copy of the same ternary.
+        // ⚠️ Task 18 fix-wave (RN-1, review finding 1): this name used to be recomputed via a
+        // bare sanitizeName(m) call, ignoring the disambiguation map entirely — for a colliding
+        // pair BOTH models resolved to the same bare revote-<sanitized>.md name, reintroducing
+        // for re-votes the exact cross-match bug Task 18 fixed for review-/judge-. Routed
+        // through resolveArtifactName(m, 'revote') like the other three sites; its built-in
+        // legacy fallback keeps older detail payloads (no artifactsByModel map) correct too.
         files = files.concat(bench.map(function (m) {
           var label = A.state.labelByModel[m];
-          return { name: 'revote-' + sanitizeName(m) + '.md', title: 'Re-vote ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+          return { name: resolveArtifactName(m, 'revote'), title: 'Re-vote ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
         }));
       }
       return files.filter(function (f) { return present(f.name); });
     } };
+    // ⚠️ Fix-wave (Fix 1, RN-9): a same-run call (the blind toggle, or the live loop's
+    // running -> terminal refresh) must re-render any panel the user already has open, or it
+    // keeps showing content painted under the PREVIOUS blind state. renderProseSections()
+    // (workspace-render.js) clears its container before repainting, so this replaces sections
+    // in place rather than appending duplicates. Drop the cached promise first so loadPanel()
+    // actually re-fetches instead of returning its already-settled one.
+    if (sameRun) {
+      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
+        var p = A.$(id);
+        if (p.open) { delete loading[id]; loadPanel(id, loaders[id].bodyId, loaders[id].files); }
+      });
+    }
   }
 
   // ⚠️ DE-ROT (F38): on a --debate run the FINAL tally.json is rebuilt from the debate's
@@ -183,9 +247,14 @@
       var rv = ((A.state.debate && A.state.debate.revotes) || []).find(function (r) {
         return r.judge === judgePair.model && r.id === findingId;
       });
+      // ⚠️ Task 18 fix-wave (RN-1, review finding 1): this branch used to recompute the name via
+      // bare sanitizeName(judgePair.model), independently of the (already-fixed) judge branch
+      // right below it — for a colliding pair, drilling a re-vote on the SECOND model resolved
+      // to the bare name and cross-matched the FIRST model's genuine revote section. Both arms
+      // of this ternary now go through the same disambiguation-aware helper.
       var artifactName = rv
-        ? 'revote-' + sanitizeName(judgePair.model) + '.md'
-        : 'judge-' + sanitizeName(judgePair.model) + '.md';
+        ? resolveArtifactName(judgePair.model, 'revote')
+        : resolveArtifactName(judgePair.model, 'judge');
       var section = A.$('judges-body').querySelector('[data-artifact="' + artifactName + '"]');
       // A genuinely absent artifact is not an error here — the panel renders its own
       // "<file> not written yet" empty state (spec §9, last row).

package/electron/workspace-ui/workspace-render.js

@@ -93,7 +93,13 @@
         ]),
         el('div', { className: 'run-row-sub' }, [
           relTime(row.startedAt),
-          String(row.bench.length) + ' seats',
+          // ⚠️ v4.4.1 RN-12: `String(row.bench.length)` was unguarded. scanCouncilRuns is written
+          // to "never throw on bad input" and degrade to a row instead — but this painter draws
+          // EVERY row, so one row arriving without a `bench` array threw a TypeError that blanked
+          // the entire run list, killing the data layer's degrade-never-throw guarantee one layer
+          // up. (scanCouncilRuns' own error rows take the early return above; this guards the
+          // contract with any OTHER row source, which is what the guarantee is actually worth.)
+          (Array.isArray(row.bench) ? row.bench.length : 0) + ' seats',
           'chair ' + displayModel(row.chair, blindOn, labelOf),
           row.overallVerdict || '',
           row.costDisplay || '',
@@ -199,8 +205,18 @@
       cells.forEach(function (c, i) {
         var td = row.children[i];
         if (td && td.textContent !== c) { td.textContent = c; }
+        if (td) { td.className = i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : ''); }
       });
     });
+    // RN-11 (v4.5): the keyed update added and removed rows but never MOVED
+    // them, so table order was frozen at first render — wrong the moment a
+    // repair solo or new wave changes the composed doc's leg order mid-run.
+    seats.forEach(function (seat, i) {
+      var key = String(seat.id || seat.model);
+      var current = tbody.children[i];
+      var target = Array.prototype.slice.call(tbody.children).find(function (r) { return r.dataset.key === key; });
+      if (target && target !== current) { tbody.insertBefore(target, current || null); }
+    });
     Array.prototype.slice.call(tbody.children).forEach(function (row) {
       if (!seen[row.dataset.key]) { row.remove(); }
     });

package/electron/workspace-ui/workspace-verbs.js

@@ -20,6 +20,13 @@
   function doFold() {
     var A = window.AmicusApp;
     var btn = A.$('fold-btn');
+    // ⚠️ v4.4.1 LC-8: this chain had NO rejection handler. workspace:fold's IPC handler catches
+    // its own errors and answers {ok:false, error}, so a REJECTION means the channel itself failed
+    // — and the user saw the Fold button sitting in its pre-click state with no explanation, while
+    // the renderer logged an unhandled rejection (which jest-circus fails the running test on).
+    // Two-argument .then(onFulfilled, onRejected), NOT .then().catch() — see the long note in
+    // startLiveLoop below: with a trailing .catch, a THROW inside onFulfilled would be routed here
+    // too and misreported as a channel failure.
     A.invoke('workspace:fold', A.state.runId).then(function (res) {
       if (res.ok) {
         btn.textContent = 'Folded ✓';
@@ -28,6 +35,9 @@
       } else {
         btn.title = res.error || 'fold failed';
       }
+    }, function (err) {
+      console.error('workspace fold: workspace:fold failed', err);
+      btn.title = 'fold failed — the workspace channel is unavailable' + (err && err.message ? ': ' + err.message : '');
     });
   }
 
@@ -180,7 +190,23 @@
       R.renderBanner(A.$('banner'),
         'No leg activity' + (mins ? ' for ' + mins + 'm' : '') + ' — the run may be dead. Abort to reclaim it; everything on disk stays browsable.',
         'live');
-      A.$('abort-btn').hidden = false; // the remedy ships beside the diagnosis (Task 16 wires it)
+      // ⚠️ v4.4.1 RN-6 — ARBITRATED, and deliberately NOT fixed as the backlog proposed. RN-6
+      // asked for a matching `hidden = true` in the clearing arm below, believing this line is
+      // what puts the Abort button on screen. It is not: workspace-app.js's renderDetail already
+      // sets `$('abort-btn').hidden = isTerminal` on every run-open (:128), and startLiveLoop only
+      // runs on a non-terminal run — so the button is ALREADY visible for the whole life of a live
+      // run, by design, and this assignment is a no-op on every path that reaches it. The proposed
+      // clearing-arm write would HIDE the button the moment a momentary stall recovered, leaving a
+      // healthy, still-running council with no way to abort it: the inverse defect, and worse.
+      // Full reasoning + the regression pin: "the Abort button survives a stall -> recover cycle"
+      // in tests/workspace/live-loop.test.js.
+      //
+      // v4.4.1 M4: this line is NOT "the remedy" (that framing, from Task 16, is what this note
+      // corrects) — it is redundant on every path except one: a run that dies WHILE stalled,
+      // whose terminal openRun() refresh then rejects. On THAT path it leaves Abort visible on a
+      // run that is already dead — a false affordance, not a working safety net. Kept anyway
+      // because it is harmless: aborting a dead run is a no-op.
+      A.$('abort-btn').hidden = false;
     } else if (A.$('banner').classList.contains('live')) {
       // Restores whatever the DURABLE banner actually says (nothing, a schemaVersion mismatch,
       // run.error, …) instead of just blanking it — a live-layer banner (info-unavailable or
@@ -216,7 +242,27 @@
         return;
       }
       stopLiveLoop();
-      A.openRun(A.state.runId); // re-read: status flips to aborted, grey chip, no live poll
+      // ⚠️ v4.4.1 LC-8: the re-read was fire-and-forget (wsgate01 C5) — inconsistent with the
+      // live loop's terminal branch above, which was explicitly given this same handler for this
+      // same reason. If the re-read fails, the status chip never leaves 'running' and the UI shows
+      // a live run that isn't. `.catch` (not the two-argument form) is EXACTLY equivalent here and
+      // matches the sibling at the terminal branch above: there is no onFulfilled for a trailing
+      // .catch to swallow a throw out of, which is the only thing the two-argument form buys.
+      A.openRun(A.state.runId).catch(function (err) { // re-read: status flips to aborted, grey chip, no live poll
+        console.error('workspace abort: post-abort get-run refresh failed', err);
+        window.AmicusRender.renderBanner(A.$('banner'),
+          'Abort succeeded, but refreshing the run failed — reopen the run to see its final state.', '');
+      });
+    }, function (err) {
+      // ⚠️ v4.4.1 LC-8 (same handler, same class): a REJECTED invoke() left `btn.disabled = true`
+      // and the dialog open forever — the confirm button wedged with no way back — plus an
+      // unhandled rejection. workspace:abort-run's IPC handler answers {ok:false} on its own
+      // errors, so reaching here means the channel failed, not the abort.
+      console.error('workspace abort: workspace:abort-run failed', err);
+      btn.disabled = false;
+      $('dialog-abort').hidden = true;
+      window.AmicusRender.renderBanner(A.$('banner'),
+        'Abort failed: the workspace channel is unavailable' + (err && err.message ? ' — ' + err.message : ''), '');
     });
   });