amicus 4.5.4 → 4.6.1

package/src/council/run-retry-notes.js

@@ -0,0 +1,74 @@
+'use strict';
+
+/**
+ * @module council/run-retry-notes
+ * Pure note-builders for the SL-2 Stage-1 retry pass (split out of
+ * run-retry.js for the 300-line gate — same rationale as run-stage2.js
+ * splitting off run-stages.js, v4.4.1 Task 2). No I/O, no ctx: each function
+ * takes plain data and returns a still-dead note ready for
+ * `ctx.degrade.note(...)` (D5 final-failure granularity, spec §5). The heal
+ * note is built inline in run-retry.js's orchestrator (it is the one place
+ * that decides recovery, and stays small).
+ */
+
+/** D-effect parity: still-dead leg notes reuse today's count phrasing, with the
+ *  FIRST attempt's counts — the why carries the retry story (spec §5). */
+const legEffect = (counts) =>
+  `${counts.reviewed} of ${counts.total} seats reviewed; `
+  + 'the run continues with the bench that did and will exit degraded (2)';
+
+/** Wave-origin, retry wave died wholesale (D5 wave granularity). */
+function waveStillDeadNote(w, unit) {
+  return { channel: 'dead-wave',
+    what: `Stage-1 wave ${w.waveId} (${(w.models || []).join(', ') || 'no models'}) produced NO legs`,
+    // Coordinator-review MINOR-7c: a falsy w.reason must not render as the
+    // literal string "undefined" in the why text.
+    why: `${w.reason || 'no reason recorded'}; the once-only retry wave also produced no legs`,
+    effect: 'Those seats are NOT in this council. The run continues with the bench that did '
+      + 'launch and will exit degraded (2)',
+    data: { waveId: w.waveId, models: w.models, reason: w.reason, retryWaveId: unit.waveId } };
+}
+
+/** Leg-origin, retry wave died wholesale (bench-batch case). */
+function srcLegStillDeadNote(leg, unit, counts) {
+  const seat = leg.modelInput || leg.model;
+  return { channel: 'dead-leg', what: `seat ${seat} did not review`,
+    why: `the leg ended '${leg.status}'${leg.error ? `: ${leg.error}` : ''} with no usable output; `
+      + 'its once-only retry wave produced no legs',
+    effect: legEffect(counts),
+    data: { seat, status: leg.status, reason: leg.error || null, retryWaveId: unit.waveId } };
+}
+
+/** Either origin, the retry produced legs but THIS seat's retry leg died. */
+function retryLegStillDeadNote(seat, ff, retryLeg, unit, counts) {
+  const why = ff && ff.class === 'wave'
+    ? `its first wave ${ff.waveId} produced no legs (${ff.reason}); `
+      + `its once-only retry leg ended '${retryLeg.status}' with no usable output`
+    : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} `
+      + `with no usable output; its once-only retry also ended '${retryLeg.status}'`;
+  return { channel: 'dead-leg', what: `seat ${seat} did not review`, why,
+    effect: legEffect(counts),
+    data: { seat, status: retryLeg.status, reason: retryLeg.error || null,
+      firstFailure: ff, retryWaveId: unit.waveId } };
+}
+
+/**
+ * CRITICAL fix (coordinator review): a launched seat can be missing a leg
+ * record ENTIRELY from the retry response — a partial wave return (unit
+ * models [a,b], the wave comes back with only a's leg). This is distinct
+ * from `retryLegStillDeadNote` (the seat's retry leg came back but was
+ * unusable) — here there is no retry-attempt status/error to report at all,
+ * only the ORIGINAL first-failure fact plus the fact that nothing came back
+ * this time.
+ */
+function missingLegStillDeadNote(seat, ff, unit, counts) {
+  const fact = ff && ff.class === 'wave'
+    ? `its first wave ${ff.waveId} produced no legs (${ff.reason})`
+    : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} with no usable output`;
+  return { channel: 'dead-leg', what: `seat ${seat} did not review`,
+    why: `${fact}; its once-only retry produced no leg for this seat`,
+    effect: legEffect(counts),
+    data: { seat, status: null, reason: null, firstFailure: ff, retryWaveId: unit.waveId } };
+}
+
+module.exports = { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote };

package/src/council/run-retry.js

@@ -0,0 +1,280 @@
+'use strict';
+
+/**
+ * @module council/run-retry
+ * SL-2 (spec: docs/superpowers/specs/2026-08-03-sl2-stage1-retry-design.md):
+ * the Stage-1 once-only retry pass. A sub-wave that died before its legs
+ * existed, or a leg that ended with no usable output, is relaunched exactly
+ * once — serially, after every surviving launch settled — and the outcome is
+ * announced in the one voice: a `stage1-retry` HEAL per recovered seat; the
+ * ordinary dead-wave/dead-leg degrade, noted by the CALLER (run-stages.js),
+ * when the retry also died. This module emits heals only — it never notes a
+ * degrade and never touches `degraded.value`, so the sink invariant holds by
+ * construction. No retry of a retry: the pass consumes first-attempt losses
+ * only.
+ */
+
+const briefings = require('./briefings');
+const { materializeReviews, isAbortExit } = require('./run-launch');
+const runState = require('./run-state');
+const { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote }
+  = require('./run-retry-notes');
+
+/** 1-based lens index for a loss, from the waveId convention or the model. */
+function lensIndexOf(o, waveId, model) {
+  const m = /-l(\d+)$/.exec(waveId || '');
+  if (m) { return Number(m[1]); }
+  const i = (o.models || []).indexOf(model);
+  return i === -1 ? null : i + 1;
+}
+
+/**
+ * Dedup helper (Task-4 review hardening): the same seat can arrive twice in
+ * one grouping pass — two dead legs naming it, or a dead wave and a dead leg
+ * both naming it. One seat must still mean ONE `firstFailures` entry — first
+ * occurrence wins — while every SOURCE record is kept regardless (srcWaves/
+ * srcLegs are the audit trail and are never deduped). The critic unit's
+ * `.models` is fixed at creation (there is only ever one critic seat), so
+ * only bench/lens units grow `.models` here — the critic call sites pass
+ * `trackModel: false`.
+ */
+function recordFailure(unit, seat, ff, trackModel = true) {
+  if (unit.firstFailures.some(f => f.seat === seat)) { return; }
+  unit.firstFailures.push(ff);
+  if (trackModel) { unit.models.push(seat); }
+}
+
+/**
+ * Group Stage-1 losses into retry units. Pure — no I/O.
+ * Bench losses (a dead bench wave's models + dead bench legs) collapse into
+ * ONE retry wave; the critic and each lens retry as solos (their briefings
+ * differ). Stable order: bench, critic, lenses ascending. The critic matches
+ * on EITHER carrier — waveId convention or model — mirroring
+ * verdict.js summarizeSeatLoss.
+ */
+function groupStage1Losses(o, deadWaves = [], deadLegs = []) {
+  const isCriticWave = (w) =>
+    w.waveId === `${o.runId}-c1` || (!!o.critic && (w.models || []).includes(o.critic));
+  const bench = { unit: 'bench', waveId: `${o.runId}-s1r1`, retryOfWaveId: `${o.runId}-s1`,
+    models: [], firstFailures: [], srcWaves: [], srcLegs: [] };
+  const lensUnits = new Map(); // lensIndex (number, or null for unmappable) -> unit
+  const criticUnit = { unit: 'critic', waveId: `${o.runId}-c1r1`, retryOfWaveId: `${o.runId}-c1`,
+    models: o.critic ? [o.critic] : [], firstFailures: [], srcWaves: [], srcLegs: [] };
+
+  const lensUnitFor = (i) => {
+    if (!lensUnits.has(i)) {
+      // Task-4 review hardening: an unmappable loss (lensIndexOf resolved
+      // neither the waveId convention nor a model-roster membership) must
+      // still be GROUPABLE — dropping it here would let it vanish before the
+      // orchestrator ever sees it — but must not manufacture a fake
+      // `-lnullr1` waveId. The orchestrator refuses to launch any unit with
+      // `lensIndex === null` and routes its sources to skipped instead.
+      lensUnits.set(i, i === null
+        ? { unit: 'lens', lensIndex: null, waveId: null, retryOfWaveId: null,
+          models: [], firstFailures: [], srcWaves: [], srcLegs: [] }
+        : { unit: 'lens', lensIndex: i, waveId: `${o.runId}-l${i}r1`,
+          retryOfWaveId: `${o.runId}-l${i}`, models: [], firstFailures: [], srcWaves: [], srcLegs: [] });
+    }
+    return lensUnits.get(i);
+  };
+
+  for (const w of deadWaves) {
+    const models = w.models || [];
+    if (o.lenses) {
+      const u = lensUnitFor(lensIndexOf(o, w.waveId, models[0]));
+      u.srcWaves.push(w);
+      models.forEach(seat => recordFailure(u, seat, { seat, class: 'wave', waveId: w.waveId, reason: w.reason }));
+    } else if (isCriticWave(w)) {
+      criticUnit.srcWaves.push(w);
+      recordFailure(criticUnit, o.critic,
+        { seat: o.critic, class: 'wave', waveId: w.waveId, reason: w.reason }, false);
+    } else {
+      bench.srcWaves.push(w);
+      models.forEach(seat => recordFailure(bench, seat, { seat, class: 'wave', waveId: w.waveId, reason: w.reason }));
+    }
+  }
+  for (const leg of deadLegs) {
+    const seat = leg.modelInput || leg.model;
+    const ff = { seat, class: 'leg', status: leg.status, reason: leg.error || null };
+    if (o.lenses) {
+      const u = lensUnitFor(lensIndexOf(o, null, seat));
+      u.srcLegs.push(leg);
+      recordFailure(u, seat, ff);
+    } else if (o.critic && seat === o.critic) {
+      criticUnit.srcLegs.push(leg);
+      recordFailure(criticUnit, seat, ff, false);
+    } else {
+      bench.srcLegs.push(leg);
+      recordFailure(bench, seat, ff);
+    }
+  }
+
+  const out = [];
+  // Task-4 review hardening: gate on whether the unit received any SOURCE
+  // record, not on firstFailures.length — a zero-model dead wave contributes
+  // a srcWaves entry but nothing to firstFailures/models (nothing for the
+  // `.forEach` above to iterate), and must still surface here so the
+  // orchestrator can route it to skipped instead of it vanishing silently.
+  if (bench.srcWaves.length > 0 || bench.srcLegs.length > 0) { out.push(bench); }
+  if (criticUnit.srcWaves.length > 0 || criticUnit.srcLegs.length > 0) { out.push(criticUnit); }
+  // Coordinator-review MINOR-7a: null sorts LAST (Infinity), not first (0) —
+  // an unmappable loss is not "lens index 0"; it should not perturb the
+  // ascending order of the real, well-indexed lens retries.
+  out.push(...[...lensUnits.values()].sort((a, b) => (a.lensIndex ?? Infinity) - (b.lensIndex ?? Infinity)));
+  return out;
+}
+
+/** The briefing a retry unit re-issues — same builders Stage 1 used. */
+function briefingFor(o, unit) {
+  if (unit.unit === 'critic') { return briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }); }
+  if (unit.unit === 'lens') {
+    return briefings.buildLensBriefing({ lens: o.lenses[unit.lensIndex - 1], briefing: o.briefing, date: o.date });
+  }
+  return briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date });
+}
+
+/**
+ * The retry pass. Serial by design (spec D-order: bench, critic, lenses) —
+ * the per-wave-fallback path, where waves actually die, is exactly where
+ * concurrent relaunches would race the same server start again.
+ */
+async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts = { reviewed: 0, total: 0 } } = {}) {
+  const { o, launchers } = ctx;
+  const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [],
+    stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [] };
+
+  for (const unit of groupStage1Losses(o, deadWaves, deadLegs)) {
+    // Task-4 review hardening: a unit this pass cannot even ATTEMPT — an
+    // unmappable lens loss (no carrier resolved an index), a lens index
+    // outside the run's actual lens roster (coordinator-review MINOR-7b: a
+    // malformed waveId like "...-l99" must not become an out-of-range
+    // `o.lenses[98]` access inside briefingFor), or a unit whose sources
+    // named zero models — is never launched. Its sources fall back to the
+    // ordinary skipped-loss path so the caller's normal degrade notes still
+    // fire; being unmappable is not an exemption from the record.
+    const lensOutOfRange = unit.unit === 'lens' && unit.lensIndex !== null
+      && (unit.lensIndex < 1 || unit.lensIndex > (o.lenses || []).length);
+    if (unit.lensIndex === null || lensOutOfRange || unit.models.length === 0) {
+      out.skippedDeadWaves.push(...unit.srcWaves);
+      out.skippedDeadLegs.push(...unit.srcLegs);
+      continue;
+    }
+    if (ctx.overBudget()) { // D7: skip silently — the loss is already announced by the caller
+      out.skippedDeadWaves.push(...unit.srcWaves);
+      out.skippedDeadLegs.push(...unit.srcLegs);
+      continue;
+    }
+    runState.appendStageWave(o.runDir, 'stage1', unit.waveId); // BEFORE launch: abort cascade
+    const common = { project: o.runDir, timeout: o.timeout, gateway: o.gateway,
+      noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
+      councilRunId: o.runId, councilName: o.councilName,
+      fallback: o.fallback, catalog: o.catalog,
+      waveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, prompt: briefingFor(o, unit) };
+    // Dispatch by UNIT TYPE, not model count (spec §4: bench is always a wave —
+    // even down to its last surviving seat — critic/lens are always solos).
+    // A model-count proxy (`models.length === 1`) is wrong for a bench unit
+    // that lost exactly one seat: it would route that retry through
+    // launchSolo, which no bench caller wires up.
+    const res = unit.unit === 'bench'
+      ? await launchers.launchWave({ ...common, models: unit.models.slice() })
+      : await launchers.launchSolo({ ...common, model: unit.models[0] });
+    ctx.addWave(res.wave); // reservation released + measured legs counted (run-budget)
+    if (isAbortExit(res.exitCode)) { out.aborted = res.exitCode; return out; }
+
+    const legs = (res.wave && Array.isArray(res.wave.legs)) ? res.wave.legs : [];
+    if (legs.length === 0) {
+      // The retry wave itself died wholesale — final failure keeps each
+      // source's granularity (D5): wave-origin stays a dead-wave, leg-origin
+      // stays a dead-leg, both enriched with the retry fact. Coordinator-
+      // review MINOR-4: emitted ONCE per SEAT — the grouping dedup (Task-4
+      // hardening) keeps BOTH src records when a seat arrives via a srcWave
+      // AND a srcLeg (or via two srcLegs), so without this a single lost
+      // seat could be announced twice. Waves are processed first (mirrors
+      // the "wave wins" precedent from the grouping-level dedup); a seat
+      // already covered by its wave's note is skipped when its srcLeg is
+      // reached.
+      const notedSeats = new Set();
+      for (const w of unit.srcWaves) {
+        out.stillDeadNotes.push(waveStillDeadNote(w, unit));
+        out.stillDeadWaves.push(w);
+        for (const m of (w.models || [])) { notedSeats.add(m); }
+      }
+      for (const l of unit.srcLegs) {
+        const seat = l.modelInput || l.model;
+        if (notedSeats.has(seat)) { continue; }
+        notedSeats.add(seat);
+        out.stillDeadNotes.push(srcLegStillDeadNote(l, unit, counts));
+        out.stillDeadLegs.push(l);
+      }
+      continue;
+    }
+    const usable = new Set(materializeReviews(o.runDir, legs).map(m => m.leg));
+    const seenSeats = new Set(legs.map(leg => leg.modelInput || leg.model));
+    const lostWaveSeats = new Map(); // waveId -> seats still lost from a wave-origin
+    for (const leg of legs) {
+      const seat = leg.modelInput || leg.model;
+      const ff = unit.firstFailures.find(f => f.seat === seat) || null;
+      // SL-2 fix-wave: a retry response should only ever name seats THIS unit
+      // launched for (unit.models is built in lockstep with firstFailures via
+      // groupStage1Losses's recordFailure) — but if a leg turns up for a seat
+      // with no firstFailures entry, that seat never lost its seat in the
+      // first place. Skip it entirely: no heal (it would fabricate an "ended
+      // 'unknown'" why for a seat that never failed) and no still-dead note —
+      // the seat's first-attempt review stands untouched, rather than this
+      // stray leg doubling it into a duplicate bench entry alongside the real one.
+      if (!ff) { continue; }
+      if (usable.has(leg)) {
+        out.recoveredLegs.push(leg);
+        ctx.degrade.note({ channel: 'stage1-retry', kind: 'heal',
+          what: `seat ${seat} reviewed on retry`,
+          why: ff && ff.class === 'wave'
+            ? `its first wave ${ff.waveId} produced no legs (${ff.reason}) and was relaunched once`
+            : `its first leg ended '${ff ? ff.status : 'unknown'}' with no usable output and was relaunched once`,
+          effect: 'The seat is in this council; nothing was lost',
+          data: { seat, retryWaveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, firstFailure: ff } });
+      } else {
+        out.stillDeadNotes.push(retryLegStillDeadNote(seat, ff, leg, unit, counts));
+        if (ff && ff.class === 'wave') {
+          if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
+          lostWaveSeats.get(ff.waveId).push(seat);
+        } else {
+          const src = unit.srcLegs.find(l => (l.modelInput || l.model) === seat);
+          if (src) { out.stillDeadLegs.push(src); }
+        }
+      }
+    }
+    // CRITICAL fix (coordinator review): the loop above only visits seats
+    // that came back WITH a leg record. A partial wave return (unit models
+    // [a,b], the wave comes back with only a's leg) leaves 'b' invisible to
+    // that loop entirely — no heal, no still-dead note, no skip: it would
+    // vanish from every array. Reconcile against the full launched-seat set
+    // (the union of unit.models, every srcWave's models, and every srcLeg's
+    // seat — not just unit.models alone, so this holds even if some future
+    // change to the grouping made unit.models an incomplete union) so every
+    // launched seat lands in exactly one of recovered / still-dead / skipped.
+    const launchedSeats = new Set(unit.models);
+    for (const w of unit.srcWaves) { for (const m of (w.models || [])) { launchedSeats.add(m); } }
+    for (const l of unit.srcLegs) { launchedSeats.add(l.modelInput || l.model); }
+    for (const seat of launchedSeats) {
+      if (seenSeats.has(seat)) { continue; } // already handled above (healed or still-dead)
+      const ff = unit.firstFailures.find(f => f.seat === seat) || null;
+      out.stillDeadNotes.push(missingLegStillDeadNote(seat, ff, unit, counts));
+      if (ff && ff.class === 'wave') {
+        if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
+        lostWaveSeats.get(ff.waveId).push(seat);
+      } else {
+        const src = unit.srcLegs.find(l => (l.modelInput || l.model) === seat);
+        if (src) { out.stillDeadLegs.push(src); }
+      }
+    }
+    // Wave-origin seats still lost: the return-contract wave entry carries only
+    // the still-lost subset (a partially healed wave is not wholly dead).
+    for (const w of unit.srcWaves) {
+      const lost = lostWaveSeats.get(w.waveId) || [];
+      if (lost.length > 0) { out.stillDeadWaves.push({ ...w, models: lost }); }
+    }
+  }
+  return out;
+}
+
+module.exports = { groupStage1Losses, retryStage1Losses };

package/src/council/run-server.js

@@ -145,7 +145,12 @@ async function resolveRunServerModels(o, deps = {}) {
  * cannot clobber `budgetRefusals[]` or anything else already on the document.
  * Verified, not assumed — `tests/council/run-state.test.js` pins it.
  *
- * @param {object} o the council run's resolved options
+ * @param {object} o the council run's resolved options (carries `degrade`, the
+ *   council sink, for the `sharedServerUnavailable` announcement below). `o.degrade`
+ *   is expected to be set on that path — run.js threads it — but the call below is
+ *   still guarded rather than assumed: a throw from this module would escape
+ *   runCouncil past its "never rejects for run errors" contract (see this file's
+ *   own docblock), which is worse than a missed note.
  * @param {object} patch a single top-level run.json key
  * @param {string} what the field name, for the failure log
  */
@@ -155,6 +160,21 @@ function recordServerFate(o, patch, what) {
   catch (writeErr) {
     logger.warn(`Could not record ${what} on run.json`, { runId: o.runId, error: writeErr.message });
   }
+  if (what === 'sharedServerUnavailable') {
+    const unavailable = patch.sharedServerUnavailable;
+    const reason = typeof unavailable === 'string' ? unavailable
+      : (unavailable && unavailable.error) || 'unknown error';
+    if (o.degrade) {
+      o.degrade.note({
+        channel: 'shared-server-unavailable',
+        kind: 'degrade',
+        what: 'could not start a shared OpenCode server',
+        why: reason,
+        effect: 'each wave will start its own, which is the configuration that races; the run '
+          + 'will exit degraded (2)',
+      });
+    }
+  }
 }
 
 /**
@@ -222,14 +242,11 @@ async function acquireRunServer(o, deps = {}) {
     // DURABLE: it lands on the run's own record, next to `budgetRefusals[]`,
     // for the same reason — a silent partial is the failure mode this whole
     // release exists to remove.
-    const degrade = { error: err.message, at: new Date().toISOString() };
-    recordServerFate(o, { sharedServerUnavailable: degrade }, 'sharedServerUnavailable');
+    const serverFailure = { error: err.message, at: new Date().toISOString() };
+    recordServerFate(o, { sharedServerUnavailable: serverFailure }, 'sharedServerUnavailable');
     logger.warn('Shared OpenCode server unavailable — falling back to one server per wave', {
       runId: o.runId, error: err.message,
     });
-    process.stderr.write(
-      `Notice: could not start a shared OpenCode server (${err.message}); each wave will start `
-      + 'its own, which is the configuration that races. Expect degraded results.\n');
     return null;
   }
 }
@@ -245,4 +262,4 @@ async function releaseRunServer(shared) {
   try { await shared.server.close(); } catch { /* best-effort: the run is over */ }
 }
 
-module.exports = { acquireRunServer, releaseRunServer, resolveRunServerModels };
+module.exports = { acquireRunServer, releaseRunServer, resolveRunServerModels, recordServerFate };

package/src/council/run-stage2.js

@@ -106,11 +106,19 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
     }
     if (!parsed.ok) {
       judgeResults.push({ judge, ok: false, order: null, adjudications: null,
-        conformance: leg.status === 'complete' ? 'unstructured' : 'clean' });
+        conformance: leg.status === 'complete' ? 'unstructured' : 'clean',
+        // #83 (v4.6 Plan 2): the judge's ORIGINAL Stage-2 wave leg, mirroring
+        // Stage-1's convention (reviews carry the original wave leg even when a
+        // repair ran — repairs are separately recorded via appendStageWave).
+        // A repair solo's leg is NOT preferred here: attributing it instead
+        // would leave every non-repaired (the common case) judge with a false
+        // `status: 'error'` row — worse than the missing row #83 complained about.
+        leg: leg || null });
       continue;
     }
     const { order } = rankingToOrder(parsed.ranking, labels.labelMap);
-    judgeResults.push({ judge, ok: true, order, adjudications: parsed.adjudications, conformance });
+    judgeResults.push({ judge, ok: true, order, adjudications: parsed.adjudications, conformance,
+      leg: leg || null });
   }
   return { aborted: null, judgeResults };
 }

package/src/council/run-stages.js

@@ -20,6 +20,7 @@
 const { validateFindings, countAttemptedFindings } = require('./findings');
 const briefings = require('./briefings');
 const { materializeReviews, isAbortExit } = require('./run-launch');
+const { retryStage1Losses } = require('./run-retry');
 const runState = require('./run-state');
 const { runStage2 } = require('./run-stage2');
 
@@ -107,25 +108,6 @@ async function launchStage1(ctx) {
   return { aborted, legs, deadWaves };
 }
 
-/**
- * Announce Stage-1 sub-waves that never produced a leg.
- *
- * POLICY (the standing "never fail closed on availability" ruling, applied the
- * same way run-budget.js applies it to cost): the run CONTINUES with the bench
- * that did launch. What it must never do is lose the seats SILENTLY — so every
- * dead wave is announced on stderr, kept on run.json's stage entry (run.js) and
- * degrades the run's exit code to 2.
- * @param {Array<{waveId: string, models: string[], reason: string}>} deadWaves
- * @param {(s: string) => void} [write] stderr seam
- */
-function reportDeadStage1Waves(deadWaves, write = (s) => process.stderr.write(s)) {
-  for (const d of deadWaves) {
-    write(`Notice: Stage-1 wave ${d.waveId} (${d.models.join(', ') || 'no models'}) produced NO legs `
-      + `— ${d.reason}. Those seats are NOT in this council. The run continues with the bench that `
-      + 'did launch and will exit degraded (2).\n');
-  }
-}
-
 /** Role of a seat by its input alias. */
 function roleFor(o, alias) {
   if (o.lenses) {
@@ -151,11 +133,56 @@ async function runStage1(ctx) {
   const { o } = ctx;
   const { aborted, legs, deadWaves } = await launchStage1(ctx);
   if (aborted) { return { aborted, reviews: [], deadLegs: [], deadWaves: [], degraded: false }; }
-  reportDeadStage1Waves(deadWaves);
 
-  const materialized = materializeReviews(o.runDir, legs);
-  const alive = new Set(materialized.map(m => m.leg));
-  const deadLegs = legs.filter(l => !alive.has(l));
+  const firstPass = materializeReviews(o.runDir, legs);
+  const alive0 = new Set(firstPass.map(m => m.leg));
+  const deadLegs0 = legs.filter(l => !alive0.has(l));
+
+  // SL-2: one retry BEFORE anything is recorded lost — the sink never
+  // un-flips, so a degrade for a seat the retry saves must never fire at all.
+  const retry = await retryStage1Losses(ctx, { deadWaves, deadLegs: deadLegs0,
+    counts: { reviewed: firstPass.length, total: legs.length } });
+  if (retry.aborted) {
+    // Final whole-branch review: same bug class as the post-retry-repair
+    // abort fixed ~87 lines below ("Must be the post-retry set") — subtract
+    // whatever retry.recoveredLegs already healed before this abort landed.
+    const healed = new Set(retry.recoveredLegs.map(l => l.modelInput || l.model));
+    return { aborted: retry.aborted, reviews: [], degraded: false,
+      deadLegs: deadLegs0.filter(l => !healed.has(l.modelInput || l.model)),
+      deadWaves: deadWaves.map(w => ({ ...w, models: (w.models || []).filter(m => !healed.has(m)) })).filter(w => w.models.length > 0) };
+  }
+
+  for (const d of retry.skippedDeadWaves) {
+    ctx.degrade.note({
+      channel: 'dead-wave',
+      what: `Stage-1 wave ${d.waveId} (${d.models.join(', ') || 'no models'}) produced NO legs`,
+      why: d.reason,
+      effect: 'Those seats are NOT in this council. The run continues with the bench that did '
+        + 'launch and will exit degraded (2)',
+      data: { waveId: d.waveId, models: d.models, reason: d.reason },
+    });
+  }
+  for (const leg of retry.skippedDeadLegs) {
+    ctx.degrade.note({
+      channel: 'dead-leg',
+      what: `seat ${leg.modelInput || leg.model} did not review`,
+      why: `the leg ended '${leg.status}'${leg.error ? `: ${leg.error}` : ''} with no usable output`,
+      effect: `${firstPass.length} of ${legs.length} seats reviewed; `
+        + 'the run continues with the bench that did and will exit degraded (2)',
+      data: { seat: leg.modelInput || leg.model, status: leg.status, reason: leg.error || null },
+    });
+  }
+  for (const rec of retry.stillDeadNotes) { ctx.degrade.note(rec); }
+
+  // Invariant this merge relies on: retry.recoveredLegs only ever names seats
+  // that actually lost their seat on the first pass (run-retry.js's recovery
+  // loop drops any leg for a seat with no firstFailures entry) — so `legs`
+  // and `recoveredLegs` can never both carry a leg for the same seat here.
+  // materializeReviews re-writing an already-materialized recovered leg's
+  // review-*.md a second time is accepted as an idempotent no-op, not a bug.
+  const materialized = materializeReviews(o.runDir, [...legs, ...retry.recoveredLegs]);
+  const stillDeadLegs = [...retry.skippedDeadLegs, ...retry.stillDeadLegs];
+  const stillDeadWaves = [...retry.skippedDeadWaves, ...retry.stillDeadWaves];
 
   const reviews = [];
   let repairSeq = 0;
@@ -204,7 +231,12 @@ async function runStage1(ctx) {
       });
       ctx.addWave(solo.wave);
       if (isAbortExit(solo.exitCode)) {
-        return { aborted: solo.exitCode, reviews, deadLegs, deadWaves, degraded: false };
+        // SL-2 fix-wave: this used to read the pre-retry `deadWaves` binding —
+        // run.js persists this return into stage-1 state before the abort
+        // short-circuit, so a heal-then-abort run was recording seats as dead
+        // that had actually reviewed on retry. Must be the post-retry set,
+        // same as the normal-completion return below.
+        return { aborted: solo.exitCode, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves, degraded: false };
       }
       const repaired = (solo.leg && solo.leg.summary) || '';
       if (repaired.trim()) { repairing = repaired; }
@@ -253,8 +285,8 @@ async function runStage1(ctx) {
       ...(repairRefused ? { repairRefused } : {}),
     });
   }
-  return { aborted: null, reviews, deadLegs, deadWaves,
-    degraded: deadLegs.length > 0 || deadWaves.length > 0 };
+  return { aborted: null, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves,
+    degraded: stillDeadLegs.length > 0 || stillDeadWaves.length > 0 };
 }
 
 // runStage2 lives in ./run-stage2.js (300-line gate) but is re-exported here so
@@ -263,4 +295,4 @@ async function runStage1(ctx) {
 // module that produces the exit codes — so the child no longer imports from its
 // parent (v4.4.1 review F5). isAbortExit is still re-exported for run-chair.js
 // and run-debate.js, which have always taken it from here.
-module.exports = { runStage1, runStage2, isAbortExit, slug, roleFor, reportDeadStage1Waves };
+module.exports = { runStage1, runStage2, isAbortExit, slug, roleFor };