amicus 4.4.0 → 4.5.0

package/src/utils/config.js

@@ -401,14 +401,57 @@ function getCouncilWithSource(name, catalog = []) {
   return { members: null, builtin: false };
 }
 
+/**
+ * Per-member alias/catalog classification — the SAME check `resolveCouncilMembers`
+ * (below) uses to decide the real run path's bench, extracted so `amicus council
+ * show` (council/presets-cli.js) can reuse it verbatim instead of re-deriving a
+ * parallel (and, pre-v4.5-Wave-2, drifted) check. Each member is resolved to its
+ * full model id (alias → id via effective aliases; a member containing '/' is
+ * taken as-is) and that id checked against the cached catalog. Tri-state catalog
+ * rule: an EMPTY catalog (offline / never fetched) never drops anything —
+ * "unknown" is not "delisted" — and a local-vendor member is never dropped on
+ * catalog absence either way (v4.2 §4.4: a local server may simply have been off
+ * at the last refresh; the leg itself fails pre-flight with the actionable
+ * local_endpoint_unreachable error if it is truly down). Only a NON-EMPTY
+ * catalog that omits the resolved id is a definitive drop.
+ * @param {string[]} members raw council members (aliases or provider/model ids)
+ * @param {Array<{id:string}>} [catalog]
+ * @returns {{models:string[], dropped:string[], droppedMembers:Array<{member:string, reason:string}>}}
+ *   `dropped` is the flat member-ref list (unchanged shape, pre-v4.5-Wave-2
+ *   callers keep working); `droppedMembers` additively pairs each with WHY.
+ */
+function classifyCouncilMembers(members, catalog = []) {
+  const aliases = getEffectiveAliases();
+  const known = new Set((Array.isArray(catalog) ? catalog : []).map(m => m && m.id).filter(Boolean));
+  const { isLocalProvider } = require('./local-providers');
+  const models = [];
+  const dropped = [];
+  const droppedMembers = [];
+  for (const member of members) {
+    const id = member.includes('/') ? member : aliases[member];
+    if (!id) { // alias no longer resolves
+      dropped.push(member);
+      droppedMembers.push({ member, reason: 'alias no longer resolves to a known model' });
+      continue;
+    }
+    const vendor = typeof id === 'string' ? id.split('/')[0] : '';
+    if (isLocalProvider(vendor)) { models.push(member); continue; }
+    if (known.size > 0 && !known.has(id)) { // delisted model
+      dropped.push(member);
+      droppedMembers.push({ member, reason: 'resolved id is not present in the cached model catalog' });
+      continue;
+    }
+    models.push(member);
+  }
+  return { models, dropped, droppedMembers };
+}
+
 /**
  * Expand a saved council into a runnable members list, degrading gracefully.
- * Each member is resolved to its full model id (alias → id via effective
- * aliases; a member containing '/' is taken as-is) and that id checked against
- * the cached catalog. Unresolvable aliases and delisted ids are dropped with a
- * warning rather than fail-fast-aborting the whole wave. The catalog check is
- * skipped when the catalog is empty (offline). Returns members RAW (alias or
- * id) — leg-time validation resolves them again.
+ * Unresolvable aliases and delisted ids are dropped with a warning rather than
+ * fail-fast-aborting the whole wave (classification: classifyCouncilMembers
+ * above). Returns members RAW (alias or id) — leg-time validation resolves
+ * them again.
  *
  * Resolution order: user config (`config.councils`) is checked first; when
  * `name` is absent there, the built-in benches (`free`/`budget`/`frontier`)
@@ -416,7 +459,7 @@ function getCouncilWithSource(name, catalog = []) {
  * shadows a built-in of the same name.
  * @param {string} name
  * @param {Array<{id:string}>} [catalog]
- * @returns {{models:string[], dropped:string[]} | {error:string}}
+ * @returns {{models:string[], dropped:string[], droppedMembers:Array<{member:string, reason:string}>} | {error:string}}
  */
 function resolveCouncilMembers(name, catalog = []) {
   const { members } = getCouncilWithSource(name, catalog);
@@ -426,23 +469,7 @@ function resolveCouncilMembers(name, catalog = []) {
   if (!Array.isArray(members) || members.length === 0) {
     return { error: `Council '${name}' is empty. Run 'amicus setup' to populate it.` };
   }
-  const aliases = getEffectiveAliases();
-  const known = new Set((Array.isArray(catalog) ? catalog : []).map(m => m && m.id).filter(Boolean));
-  const { isLocalProvider } = require('./local-providers');
-  const models = [];
-  const dropped = [];
-  for (const member of members) {
-    const id = member.includes('/') ? member : aliases[member];
-    if (!id) { dropped.push(member); continue; }                 // alias no longer resolves
-    const vendor = typeof id === 'string' ? id.split('/')[0] : '';
-    // v4.2 §4.4: a local server may simply have been off at the last catalog
-    // refresh — that is "unknown", not "delisted". Never drop a local-vendor
-    // member on catalog absence; the leg itself fails pre-flight with the
-    // actionable local_endpoint_unreachable error if the server is truly down.
-    if (isLocalProvider(vendor)) { models.push(member); continue; }
-    if (known.size > 0 && !known.has(id)) { dropped.push(member); continue; } // delisted model
-    models.push(member);
-  }
+  const { models, dropped, droppedMembers } = classifyCouncilMembers(members, catalog);
   if (models.length < 2) {
     return {
       error: `Council '${name}' has fewer than 2 usable members` +
@@ -450,7 +477,7 @@ function resolveCouncilMembers(name, catalog = []) {
         '. Run \'amicus setup\' to refresh it.',
     };
   }
-  return { models, dropped };
+  return { models, dropped, droppedMembers };
 }
 
 /** @returns {{prefer:'direct'|'openrouter', migration_notified:Object}} routing config with defaults */
@@ -503,6 +530,17 @@ function hasTierOnboarded() {
   return !!(config.routing && config.routing.tier_onboarded === true);
 }
 
+/**
+ * v4.5 auto-open (spec §6 guard 4): the Workspace auto-opens on MCP council
+ * runs from Claude Code (local) unless config.workspace.autoOpen === false. Only an
+ * explicit false disables — absent/junk values stay ON (opt-out semantics).
+ * @returns {boolean}
+ */
+function getWorkspaceAutoOpen() {
+  const config = loadConfig() || {};
+  return !(config.workspace && config.workspace.autoOpen === false);
+}
+
 /**
  * Persist the one-time onboarding-notice flag, preserving any other routing
  * keys (prefer, tier, migration_notified). Best-effort: swallows any
@@ -562,6 +600,7 @@ module.exports = {
   getCouncils,
   getCouncil,
   getCouncilWithSource,
+  classifyCouncilMembers,
   resolveCouncilMembers,
   getRoutingConfig,
   resolveGatewayMode,
@@ -571,4 +610,5 @@ module.exports = {
   setCostTier,
   hasTierOnboarded,
   markTierOnboarded,
+  getWorkspaceAutoOpen,
 };

package/src/utils/error-doc.js

@@ -24,6 +24,11 @@ const ERROR_CODES = Object.freeze({
   COST_EXCEEDED: 'COST_EXCEEDED',   // council run: whole-run --max-cost ceiling hit pre-tally (v4.0 §4)
   // council run: --claude-review file unreadable/invalid, or --chair claude (v4.1 §4.4)
   COUNCIL_CLAUDE_REVIEW_INVALID: 'COUNCIL_CLAUDE_REVIEW_INVALID',
+  TEMPLATE_NOT_FOUND: 'TEMPLATE_NOT_FOUND', // --template name/path unresolvable at run time (v4.5 F9)
+  TEMPLATE_RENDER: 'TEMPLATE_RENDER',       // strict render rule violated: unknown var, slot/data mismatch (v4.5 F9)
+  PACK_NOT_FOUND: 'PACK_NOT_FOUND',         // --pack name not in packs dir / path unreadable (v4.5 B7/F5)
+  PACK_INVALID: 'PACK_INVALID',             // pack schema/structural/seat validation failure (v4.5 B7/F5)
+  PACK_KIND_MISMATCH: 'PACK_KIND_MISMATCH', // e.g. a council pack passed to fanout (v4.5 B7/F5)
 });
 
 /**

package/src/utils/lifecycle.js

@@ -41,4 +41,40 @@ function armExitWatchdog(code = 0, ms = 1500, deps = {}) {
   return t;
 }
 
-module.exports = { isOneShotCommand, armExitWatchdog, ONE_SHOT_COMMANDS };
+/**
+ * An `exit` hook for armExitWatchdog that REAPS an OpenCode server this process
+ * is using but does not own, on its way out (v4.4.1 fix wave, finding F3).
+ *
+ * The force-exit path is the one place where "not ours to close" stops being the
+ * safe answer. A wave running on an injected server deliberately never closes it
+ * — the owner does, once, in its own finalize. But if the watchdog fires first
+ * the parent dies anyway, and the Go server survives it: an orphan still holding
+ * the OpenCode SQLite lock that the per-run shared server exists to stop
+ * contending on. Before the external-server seam, fanout's own close() covered
+ * this by accident; this restores it deliberately.
+ *
+ * SIGTERM only, and synchronous: process.exit cannot await server.close()'s
+ * escalation, so this sends the one signal that fits in the window and gets out
+ * of the way. Never signals this process, and never lets a dead/absent pid throw
+ * — the exit must happen regardless.
+ *
+ * @param {{goPid?: number|null}|null} server the injected server handle
+ * @param {{kill?: Function, exit?: Function}} [deps] test seams
+ * @returns {(code: number) => void}
+ */
+function exitReaping(server, deps = {}) {
+  return (code) => {
+    // Resolved at CALL time, not creation time: this hook is built the instant a
+    // signal lands and invoked up to 10s later, so binding process.kill/exit
+    // early would freeze whatever was installed at signal time.
+    const kill = deps.kill || ((p, sig) => process.kill(p, sig));
+    const exit = deps.exit || ((c) => process.exit(c));
+    const pid = server && server.goPid;
+    if (pid && pid !== process.pid) {
+      try { kill(pid, 'SIGTERM'); } catch { /* already gone: nothing to reap */ }
+    }
+    exit(code);
+  };
+}
+
+module.exports = { isOneShotCommand, armExitWatchdog, exitReaping, ONE_SHOT_COMMANDS };

package/src/utils/path-fence.js

@@ -7,7 +7,10 @@
  * for truthiness by src/council/run-state.js's readPointer, so nothing
  * upstream of this check guarantees it stays inside the project).
  *
- * It is a LEAF: `fs` + `path` and nothing else, no require cycle possible.
+ * It is a LEAF: `fs` + `path` at load time and nothing else, no require cycle
+ * possible. (SEC-3's debug-mode diagnostic requires src/utils/logger.js lazily,
+ * inside the flag branch — logger.js has zero requires of its own, so even that
+ * cannot introduce a cycle, and nothing is loaded at all with the flag unset.)
  * That was first needed inside the v4.4 workspace layer —
  * src/workspace/artifact-guard.js requires src/workspace/run-scan.js for
  * readPointer, so if run-scan.js also required artifact-guard.js for this
@@ -30,6 +33,39 @@
 const fs = require('fs');
 const path = require('path');
 
+/**
+ * ⚠️ SEC-3: isRealpathContained is a pure string-prefix comparison, and it is only SOUND
+ * if both arguments were already resolved through realpathSync. Nothing enforced that, so
+ * a caller who forgot got a silently WEAKER check rather than an error — a raw
+ * (unresolved) path containing a symlink can prefix-match a directory it does not
+ * physically live under.
+ *
+ * This is a DIAGNOSTIC, opt-in via `AMICUS_DEBUG_FENCE=1`, and it MUST NEVER THROW: the
+ * fence must never become the failure it exists to prevent. Every step is wrapped, and a
+ * non-existent path is a legitimate argument here (callers fence paths before probing
+ * them), so it is not reported. The logger is required lazily so this module keeps its
+ * `fs` + `path` load-time surface (see the header) for the 99.99% of calls that run with
+ * the flag unset.
+ * @param {string} dir already-stringified dirRealPath
+ * @param {string} target already-stringified targetRealPath
+ */
+function assertResolvedArgs(dir, target) {
+  try {
+    const { logger } = require('./logger');
+    for (const [name, p] of [['dirRealPath', dir], ['targetRealPath', target]]) {
+      if (!path.isAbsolute(p)) {
+        logger.warn('path-fence: argument is not absolute', { arg: name, value: p });
+        continue;
+      }
+      try {
+        if (fs.existsSync(p) && fs.realpathSync(p) !== p) {
+          logger.warn('path-fence: argument is not realpath-resolved', { arg: name, value: p });
+        }
+      } catch { /* unreadable / dangling: not this diagnostic's business */ }
+    }
+  } catch { /* a broken logger must never break the fence */ }
+}
+
 /**
  * True when `targetRealPath` is exactly `dirRealPath` or a proper descendant
  * of it. Both arguments MUST already be resolved through realpathSync — this
@@ -41,6 +77,8 @@ const path = require('path');
 function isRealpathContained(dirRealPath, targetRealPath) {
   const dir = String(dirRealPath);
   const target = String(targetRealPath);
+  // SEC-3: debug-mode contract check only — never a gate, never a throw (see above).
+  if (process.env.AMICUS_DEBUG_FENCE === '1') { assertResolvedArgs(dir, target); }
   if (target === dir) { return true; }
   // ⚠️ COUNCIL REVIEW R2 (A6): when dirRealPath IS a filesystem root, it already
   // ends in a separator ('/' on POSIX, 'C:\\' on Windows) — blindly appending

package/src/utils/pricing.js

@@ -63,24 +63,37 @@ function lookupPricing(modelId) {
 }
 
 /**
- * Did we actually OBSERVE any token usage for this leg? (v4.4 B2)
+ * Did we actually OBSERVE tokens THIS MODULE'S ESTIMATE CAN PRICE? (v4.4 B2,
+ * narrowed by v4.4.1 CA-7)
  *
  * This is the predicate that separates "the provider billed us for a $0 tier"
  * from "we never saw a usage payload at all" — a distinction the old
  * `pricing && tokens` guard could not make, because it only inspected the
- * PRICE. Accepts both the normalized totals shape (cacheRead/cacheWrite, as
- * produced by sumPerMessageUsage) and OpenCode's raw per-message shape
- * (`cache: {read, write}`), so callers holding either can ask one question.
+ * PRICE. It reads the normalized totals shape (input/output, as produced by
+ * sumPerMessageUsage) and OpenCode's raw per-message shape alike, because both
+ * carry `input`/`output` at the top level.
+ *
+ * ⚠️ CA-7: deliberately narrower than "did we see any token count at all". The
+ * estimate in resolveLegCost prices input/output ONLY, so accepting
+ * cacheRead/cacheWrite — and `reasoning`, which this predicate also used to
+ * accept and which the estimate likewise never prices — let a leg observed with
+ * none of input/output pass the observation gate and resolve to `estimated $0`:
+ * the same false-zero class the v4.4 observed-tokens fix exists to kill, in the
+ * one corner its predicate did not cover. Such a leg is now `unknown`, which is
+ * true, rather than free, which is not. Pricing cache or reasoning tokens
+ * properly needs catalog fields that may not exist; when they do, widen this and
+ * the estimate together, never one alone.
+ *
+ * Live-validated 2026-07-26: a real local leg reports `input: 25953, output: 3`,
+ * so the shipped v4.2 free-local `$0` promise (a local seat costs nothing but
+ * still reports real input/output) is untouched — tests/pricing-local.test.js
+ * is the standing guard on that.
  * @param {object|null|undefined} tokens
  * @returns {boolean}
  */
 function hasObservedTokens(tokens) {
   if (!tokens || typeof tokens !== 'object') { return false; }
-  const cache = tokens.cache && typeof tokens.cache === 'object' ? tokens.cache : {};
-  const cacheRead = tokens.cacheRead || cache.read || 0;
-  const cacheWrite = tokens.cacheWrite || cache.write || 0;
-  return (tokens.input || 0) > 0 || (tokens.output || 0) > 0
-    || (tokens.reasoning || 0) > 0 || cacheRead > 0 || cacheWrite > 0;
+  return (tokens.input || 0) > 0 || (tokens.output || 0) > 0;
 }
 
 /** @returns {{amount:number|null, currency:'USD', source:'reported'|'estimated'|'unknown'}} */
@@ -96,7 +109,10 @@ function resolveLegCost({ reportedCost, tokens, pricing }) {
   // The v4.2 §4.5 free-local-tier carve-out is DELIBERATELY preserved: a local
   // Ollama/LM Studio seat legitimately costs $0 but still reports tokens, so
   // hasObservedTokens() is true for it and it still resolves to `estimated $0`.
-  // Only a leg where we observed no tokens at all falls through to `unknown`.
+  // v4.4.1 CA-7: a leg with no input/output falls through to `unknown` even when
+  // it reported cache or reasoning tokens — those are real observations, but not
+  // ones THIS estimate can turn into a price, so calling the result $0 would be
+  // the same fabrication one corner over. See hasObservedTokens above.
   if (pricing && hasObservedTokens(tokens)) {
     const est = (tokens.input || 0) * pricing.prompt + (tokens.output || 0) * pricing.completion;
     if (est >= 0) { return { amount: est, currency: 'USD', source: 'estimated' }; }

package/src/utils/result-schema-rebuild.js

@@ -90,6 +90,7 @@ function buildWaveResultFromSession(project, waveId) {
     waveId,
     legs,
     promptMeta: meta.promptMeta || null,
+    ...(meta.pack ? { pack: meta.pack } : {}), // v4.5 Task 13: absent-not-null, mirrors promptMeta's sourcing above.
     createdAt: meta.createdAt || null,
     completedAt: meta.completedAt || null,
   });

package/src/utils/result-schema.js

@@ -44,7 +44,9 @@ function durationBetween(createdAt, completedAt) {
  * @param {string|null} [opts.modelInput] - What the caller typed (alias), if known
  * @param {string|null} [opts.sessionDir]
  * @param {string|null} [opts.waveId] - Explicit wave id (falls back to metadata.parentWave)
- * @returns {object} run document
+ * @returns {object} run document; `pack` (v4.5 Task 13) is additive — present only when
+ *   metadata.pack was recorded (solo session launched via --pack), sourced straight off
+ *   `metadata` like `usage`/`opencodeSessionId` already are (no new function parameter needed).
  */
 function buildRunResult({ taskId, metadata = {}, result = null, summary = null, modelInput = null, sessionDir = null, waveId = null, usage = null }) {
   const status = result ? statusFromResult(result) : (metadata.status || 'unknown');
@@ -68,6 +70,7 @@ function buildRunResult({ taskId, metadata = {}, result = null, summary = null,
     sessionDir,
     opencodeSessionId: metadata.opencodeSessionId || null,
     usage: usage !== null ? usage : (metadata.usage || null),
+    ...(metadata.pack ? { pack: metadata.pack } : {}),
   };
 }
 
@@ -122,9 +125,11 @@ function waveExitCode(waveStatus) {
  * @param {string|null} [opts.completedAt]
  * @param {string|null} [opts.status] - Override (e.g. 'aborted' on signal); default aggregates legs
  * @param {string[]} [opts.notices] - Advisory per-leg migration notices (#61 FIX 2); never affects status/exitCode.
+ * @param {{name: string, version: string, hash: string, source: string}|null} [opts.pack] - v4.5 Task 13:
+ *   additive — present only when the wave was launched via --pack (absent, never null, otherwise).
  * @returns {object} wave document
  */
-function buildWaveResult({ waveId, legs = [], promptMeta = null, createdAt = null, completedAt = null, status = null, notices = [] }) {
+function buildWaveResult({ waveId, legs = [], promptMeta = null, createdAt = null, completedAt = null, status = null, notices = [], pack = null }) {
   const { sumWaveUsage } = require('./pricing');
   // Named buckets only (see "COUNTS REMAINDER RULE" above). 'crashed' and
   // 'idle-timeout' legs are intentionally NOT bucketed — they land in `total`
@@ -151,6 +156,7 @@ function buildWaveResult({ waveId, legs = [], promptMeta = null, createdAt = nul
     durationMs,
     usage: sumWaveUsage(legs),
     notices: Array.isArray(notices) ? notices.filter(Boolean) : [],
+    ...(pack ? { pack } : {}),
   };
 }
 

package/src/utils/server-setup.js

@@ -75,10 +75,88 @@ function ensurePortAvailable(port = DEFAULT_PORT) {
   return false;
 }
 
+/**
+ * A start failure that is a LOCK RACE, not a deterministic error.
+ *
+ * OpenCode opens one shared SQLite database (~/.local/share/opencode/opencode.db)
+ * at startup, so two servers starting in the same instant can collide on it and
+ * the loser exits 1 with `database is locked`. Measured: council run v441plan01
+ * lost four of five seats in 736ms to exactly this.
+ *
+ * Deliberately NARROW. A missing binary, a bad key, a busy port and a config
+ * error are all deterministic — retrying them only triples the latency before
+ * the same failure, so they must fall straight through untouched.
+ */
+const LOCK_CLASS_START_FAILURE = /database is locked|database table is locked|SQLITE_BUSY/i;
+
+/**
+ * Backoff between start attempts; 5 attempts total, ≤3.75s of added latency.
+ *
+ * ⚠️ WIDENED from 3 attempts at 250/500ms (≤750ms) by v4.4.1 Step 10.5. 750ms is
+ * thin against a multi-megabyte WAL and any concurrent process touching the same
+ * OpenCode database: run v441plan02 exhausted it, the council degraded to one
+ * server per wave, and then lost four of five seats to the very race the retry
+ * exists to survive. The wait is bounded and paid at most once per acquisition;
+ * the cost of not waiting is a dead bench.
+ *
+ * Still lock-class ONLY — a deterministic failure (missing binary, bad key, busy
+ * port, config error) never sleeps a single millisecond here.
+ */
+const LOCK_RETRY_DELAYS_MS = [250, 500, 1000, 2000];
+
+/**
+ * @param {Error|null} error
+ * @returns {boolean} true only for a lock-class (retryable) start failure
+ */
+function isLockClassStartFailure(error) {
+  if (!error) { return false; }
+  // The real failure arrives as a message with the server's own stdout inlined
+  // ("Server exited with code 1 / Server output: … database is locked"), but
+  // check the usual carriers too so a wrapped/spawn-shaped error still matches.
+  const carriers = [error.message, error.stderr, error.stdout, error.cause && error.cause.message];
+  return carriers.some(c => typeof c === 'string' && LOCK_CLASS_START_FAILURE.test(c));
+}
+
+/**
+ * Run `attempt` with a BOUNDED retry on a lock-class failure only.
+ *
+ * Never fails closed: the final failure is rethrown unchanged, so every caller
+ * that already degrades on a start failure (runFanout writes an error wave; a
+ * council run falls back to per-wave servers) degrades exactly as before —
+ * just later, and far less often. This is the half of the fix that covers what
+ * a per-run shared server cannot: two separate `amicus` processes, or a CLI run
+ * beside a live MCP server, still contend for the same database.
+ *
+ * @param {(attempt: number) => Promise<T>} attempt
+ * @param {{retryDelayMs?: number}} [opts] retryDelayMs: test seam — collapses
+ *   every backoff to this value so a retry test does not sleep for real.
+ * @returns {Promise<T>}
+ * @template T
+ */
+async function retryOnLockRace(attempt, opts = {}) {
+  const delays = opts.retryDelayMs === undefined
+    ? LOCK_RETRY_DELAYS_MS
+    : LOCK_RETRY_DELAYS_MS.map(() => opts.retryDelayMs);
+  for (let i = 0; ; i += 1) {
+    try {
+      return await attempt(i);
+    } catch (error) {
+      if (i >= delays.length || !isLockClassStartFailure(error)) { throw error; }
+      logger.warn('OpenCode server start lost a lock race — retrying', {
+        attempt: i + 1, of: delays.length + 1, delayMs: delays[i], error: error.message,
+      });
+      await new Promise(resolve => setTimeout(resolve, delays[i]));
+    }
+  }
+}
+
 module.exports = {
   DEFAULT_PORT,
+  LOCK_RETRY_DELAYS_MS,
   isPortInUse,
   getPortPid,
   killPortProcess,
-  ensurePortAvailable
+  ensurePortAvailable,
+  isLockClassStartFailure,
+  retryOnLockRace
 };

package/src/utils/spend-ledger.js

@@ -45,7 +45,10 @@ const SPEND_LEDGER_FILE = 'spend-ledger.jsonl';
  * @param {string} [opts.waveId] present for a fanout leg
  * @param {string} opts.model resolved model id (or alias, if that's all the caller has)
  * @param {'headless'|'interactive'|'leg'} opts.mode
- * @param {{tokens:object, cost:{amount:number|null,currency:string,source:string}}|null} opts.usage
+ * @param {{tokens:object, cost:{amount:number|null,currency:string,source:string},
+ *   subtreeUnknown?:boolean}|null} opts.usage `subtreeUnknown` (v4.4.1 CA-2) is
+ *   copied onto the row when truthy — this leg's own cost resolved, but a child
+ *   session it spawned could not be priced, so the row's `cost` is a FLOOR
  * @param {string} [opts.op] 'leg' | 'start' | 'continue' | 'resume'
  * @param {string} [opts.status] terminal status
  * @param {string} [opts.councilRunId] council run id (additive attribution)
@@ -86,18 +89,36 @@ function appendSpend({ taskId, waveId, model, mode, usage,
     if (attempt !== undefined) { row.attempt = attempt; }
     if (substitutedFor !== undefined) { row.substitutedFor = substitutedFor; }
     if (retryOfWaveId !== undefined) { row.retryOfWaveId = retryOfWaveId; }
+    // v4.4.1 CA-2: a leg whose OWN cost is known but which spawned a child
+    // session the walk could not price writes a PRICED row — so `unpricedRows`
+    // never catches it and `amicus spend` reads as a complete measurement while
+    // `council run` says `costExact:false` about the same dollars. Omitted (not
+    // `|| false`) so a pre-4.4.1 row and an ordinary row stay identical, matching
+    // the linkage-field convention above.
+    if (usage.subtreeUnknown) { row.subtreeUnknown = true; }
     fs.appendFileSync(path.join(dir, SPEND_LEDGER_FILE), JSON.stringify(row) + '\n');
   } catch (e) {
     logger.debug('spend-ledger append failed (best-effort, run unaffected)', { taskId, error: e.message });
   }
 }
 
-/** @param {string} [dir] @returns {Array<object>} parsed rows; corrupt lines skipped */
+/**
+ * Read the ledger. Corrupt lines are skipped — and v4.4.1 A2 widens "corrupt"
+ * from "does not parse" to "does not parse AS A ROW". A line that is valid JSON
+ * but not a plain object (`"foo"`, `42`, `[1,2]`) used to survive `filter(Boolean)`
+ * and be treated as a row by every consumer: `aggregateSpend` counted it in
+ * `runs`, scored it into `unpricedRows`/`sourceMix.unknown` off its absent cost
+ * block, and `--rows` echoed it into a published document that says rows are
+ * objects. A scalar in a JSONL ledger of row objects is a corrupt line, so it is
+ * now dropped like any other — one fewer way the totals can be inflated by damage.
+ * @param {string} [dir] @returns {Array<object>} parsed rows; corrupt lines skipped
+ */
 function readSpendRows(dir) {
   const file = path.join(dir || getConfigDir(), SPEND_LEDGER_FILE);
   if (!fs.existsSync(file)) { return []; }
   return fs.readFileSync(file, 'utf-8').split('\n').map(l => l.trim()).filter(Boolean)
-    .map(l => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+    .map(l => { try { return JSON.parse(l); } catch { return null; } })
+    .filter(r => r !== null && typeof r === 'object' && !Array.isArray(r));
 }
 
 module.exports = { appendSpend, readSpendRows, SPEND_LEDGER_FILE, SPEND_LEDGER_SCHEMA_VERSION };

package/src/workspace/artifact-guard.js

@@ -24,6 +24,9 @@ const FIXED_ARTIFACTS = Object.freeze(['briefing-stage1.md', 'bundle-stage2.md',
 // `artifact not allowed: <name>`. Writers: tally-provisional.json = src/council/run.js:199;
 // revote-bundle.md = run-debate.js:119; debate.json = run-debate.js:261; the per-seat
 // rebuttal-/revote- pair = materializeDebate (run-launch.js:127-136).
+// ⚠️ FIVE KINDS, THREE ENTRIES — that is not a miscount (v4.4.1 DOC-7, re-verified). This const
+// holds only the three RUN-LEVEL names; the last two of the five, the rebuttal-/revote- pair, are
+// per BENCH MODEL and are appended inside artifactAllowlist below, next to review-/judge-.
 const DEBATE_ARTIFACTS = Object.freeze(['tally-provisional.json', 'revote-bundle.md', 'debate.json']);
 const MAX_ARTIFACT_BYTES = 200 * 1024;
 
@@ -93,14 +96,37 @@ function artifactAllowlist(run) {
     }
   }
 
+  // ⚠️ Task 18 (RN-1): the collision above is a real run-integrity defect — the run directory
+  // physically holds ONE file where two models' artifacts should be, and no renderer trick can
+  // recover both. What the renderer CAN stop doing is showing model A's prose under model B's
+  // name. Deterministic disambiguation: per colliding sanitized name, sort the RAW models
+  // (sorting, not insertion order, is what keeps this reproducible across processes/runs); the
+  // first (sorted) keeps the bare sanitized name, the rest get `~2`, `~3`, ... The suffixed
+  // names deliberately do not exist on disk — the presence manifest (run-detail.js, via
+  // fs.statSync over this same allowlist) marks them absent, so the renderer shows the honest
+  // "not written yet" empty state for every model but the first, instead of cross-matching.
+  const nameFor = new Map(); // raw model -> its (possibly suffixed) sanitized name
   for (const m of uniqueModels) {
-    names.push(`review-${sanitizeName(m)}.md`);
-    names.push(`judge-${sanitizeName(m)}.md`);
-    // rebuttal-/revote- are keyed on the same BENCH ALIAS through the same sanitizeName
-    // (materializeDebate is called with `d.raiser` / the revote leg's model — both aliases).
+    let s = sanitizeName(m);
+    const collision = collisionModels.get(s);
+    if (collision) {
+      const sortedRaw = [...collision].sort();
+      const index = sortedRaw.indexOf(m);
+      if (index > 0) { s = `${s}~${index + 1}`; }
+    }
+    nameFor.set(m, s);
+  }
+
+  for (const m of uniqueModels) {
+    const s = nameFor.get(m);
+    names.push(`review-${s}.md`);
+    names.push(`judge-${s}.md`);
+    // rebuttal-/revote- are keyed on the same BENCH ALIAS through the same (now possibly
+    // suffixed) name — materializeDebate is called with `d.raiser` / the revote leg's model
+    // (both aliases), so a colliding pair's debate artifacts are disambiguated the same way.
     if (debated) {
-      names.push(`rebuttal-${sanitizeName(m)}.md`);
-      names.push(`revote-${sanitizeName(m)}.md`);
+      names.push(`rebuttal-${s}.md`);
+      names.push(`revote-${s}.md`);
     }
   }
   // `uniqueModels` already collapsed genuinely-repeated bench entries, so this final Set is
@@ -112,6 +138,21 @@ function artifactAllowlist(run) {
       sanitized, models: [...models],
     }));
   }
+  // Consumed by workspace-panels.js (wireLazyPanels' file lists + drillIntoJudge's artifact
+  // lookup), which prefers this map over re-deriving names via sanitizeName(model) directly —
+  // that re-derivation is exactly what would ignore the suffixing above and misattribute prose.
+  // ⚠️ Fix-wave (review finding 1) residual limit this map cannot close: the BARE (unsuffixed)
+  // name is still exactly ONE physical file on disk, and its actual bytes belong to whichever
+  // colliding model's writer ran LAST — no map can recover which one that was. The guarantee
+  // delivered here is narrower than "attribution is fully sound": at most the sorted-first
+  // model can still be misattributed under the bare name; artifactCollisions (the run-integrity
+  // banner rendered by workspace-app.js's renderBanners) is what covers that residual case.
+  list.artifactsByModel = Object.fromEntries(
+    [...nameFor].map(([m, s]) => [m, {
+      review: `review-${s}.md`, judge: `judge-${s}.md`,
+      rebuttal: `rebuttal-${s}.md`, revote: `revote-${s}.md`,
+    }]),
+  );
   return list;
 }
 
@@ -167,7 +208,25 @@ function readRunArtifact(project, runId, name, deps = {}) {
 
   let realTarget;
   try { realTarget = realpathSync(path.join(ptr.runDir, name)); }
-  catch { return { error: `not written yet: ${name}` }; }
+  catch (err) {
+    // ⚠️ v4.4.1 RN-10: this catch used to answer `not written yet: <name>` for ANY realpath
+    // failure — ENOENT, EACCES, EPERM, EIO, ELOOP, a dangling symlink — so a permission problem
+    // was indistinguishable from a file the council simply has not produced yet. That is not a
+    // cosmetic conflation: electron/ipc-workspace.js's workspace:fold reads chair-output.md
+    // through this function, and on a permission error it produced a silent CHAIRLESS fold that
+    // still reported {ok: true}. The logger.warn it now emits was the mitigation — but it logged
+    // this string, so the log said "not written yet" about a file that was right there.
+    //
+    // ⚠️ Keep the sanitization. Do NOT re-interpolate `err.message`: a realpath failure's message
+    // embeds the full resolved path it tried to open, which round 4 deliberately stopped handing
+    // back over IPC (see the run.json catch above). `err.code` is a bare symbolic errno with no
+    // path in it, and it is the one piece an operator reading the fold warning actually needs —
+    // whitelisted to the errno character class so nothing else can ever ride out through here.
+    const code = err && typeof err.code === 'string' && /^[A-Z][A-Z0-9_]{1,15}$/.test(err.code)
+      ? err.code : 'unknown';
+    if (code === 'ENOENT') { return { error: `not written yet: ${name}` }; }
+    return { error: `artifact unreadable (${code}): ${name}` };
+  }
   if (!isRealpathContained(realDir, realTarget)) {
     return { error: 'artifact escapes run directory' };
   }