amicus 4.6.0 → 4.6.2

package/src/cli-handlers-doctor.js

@@ -12,6 +12,8 @@ const electronMcpCheck = require('./utils/doctor-electron-mcp-check');
 // local-providers check body (v4.2 §4.7 C8) — split out to keep this file
 // under the gate (mirrors the engineCheck/mcpChecks split above).
 const localProvidersCheck = require('./utils/doctor-local-providers-check');
+// v4.6.2 PR1 (spec §4) — the 'anthropic-base-url' check body.
+const baseUrlCheck = require('./utils/doctor-base-url-check');
 
 const MAX_CATALOG_AGE_MS = 24 * 60 * 60 * 1000; // 24h (mirrors model-catalog DEFAULT_MAX_AGE_MS)
 
@@ -38,6 +40,7 @@ function realDeps() {
     readCache: () => require('./utils/model-catalog').readCache(),
     collectAliasSources: () => require('./utils/alias-audit').collectAliasSources(),
     findStaleAliases: (s, c) => require('./utils/alias-audit').findStaleAliases(s, c),
+    findDriftedStoredAliases: (s, c) => require('./utils/alias-audit').findDriftedStoredAliases(s, c),
     hasOpencodeBinary: () => {
       // Single source of truth shared with the runtime server-start guard.
       const { ensureNodeModulesBinInPath, hasOpencodeBinary } = require('./utils/path-setup');
@@ -148,12 +151,21 @@ async function runDoctorChecks(depsOverride = {}) {
   checks.push(guard('aliases', 'Model aliases', () => {
     const cache = d.readCache();
     const catalog = (cache && cache.models) || [];
-    const stale = d.findStaleAliases(d.collectAliasSources(), catalog);
-    return stale.length === 0
-      ? { id: 'aliases', name: 'Model aliases', status: 'ok', message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null }
-      : { id: 'aliases', name: 'Model aliases', status: 'warn', message: `${stale.length} stale: ${stale.map(s => s.alias).join(', ')}`, hint: 'amicus models --check' };
+    const sources = d.collectAliasSources();
+    const stale = d.findStaleAliases(sources, catalog);
+    const drifted = d.findDriftedStoredAliases(sources, catalog);
+    if (stale.length === 0 && drifted.length === 0) {
+      return { id: 'aliases', name: 'Model aliases', status: 'ok', message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null };
+    }
+    const parts = [];
+    if (stale.length) { parts.push(`${stale.length} stale: ${stale.map(s => s.alias).join(', ')}`); }
+    if (drifted.length) { parts.push(`${drifted.length} drifted: ${drifted.map(s => s.alias).join(', ')}`); }
+    return { id: 'aliases', name: 'Model aliases', status: 'warn', message: parts.join('; '), hint: 'amicus models --check' };
   }));
 
+  checks.push(guard('anthropic-base-url', 'ANTHROPIC_BASE_URL',
+    () => baseUrlCheck.evaluateAnthropicBaseUrl(d)));
+
   checks.push(guard('opencode-bin', 'OpenCode binary', () => (
     d.hasOpencodeBinary()
       ? { id: 'opencode-bin', name: 'OpenCode binary', status: 'ok', message: 'found', hint: null }

package/src/cli.js

@@ -149,6 +149,7 @@ const BOOLEAN_FLAGS = [
      'md',                   // council report: emit Markdown (default)
      'fix',                  // doctor: self-heal fixable checks in place (#56)
      'strict',               // models --check: exit non-zero on curated per-gateway drift (#gwid Task 6)
+     'live',                 // models --check: opt-in probe of stored aliases with real engine legs (v4.6.2 PR3, spec §6)
      'render',               // council verdict: also refresh report.html next to the decided verdict
      'claude',               // init: register for Claude Code only (Task 15)
      'desktop',              // init: register for Claude Desktop only (Task 15)
@@ -501,6 +502,9 @@ Options for 'models':
   --strict                     With --check: also exit non-zero on curated
                                per-gateway drift (stale/divergent direct or
                                openrouter forms). Informational without it.
+  --live                       With --check: probe every stored alias with one real
+                               engine leg (spends) — served / accepted-but-silent /
+                               error. Requires --check.
   --json                       Machine-readable output
 `,
   list: `

package/src/council/run-chair.js

@@ -42,6 +42,32 @@ function pickFallbackChair(statsRows, bench, failedChair) {
   return candidates.length ? candidates[0].model : null;
 }
 
+/**
+ * Outcome taxonomy for one fallback-walk attempt (spec §8, LC-5). The ch4
+ * VERDICT repair is deliberately NOT an attempt: its chair leg already
+ * completed — only the verdict line is being re-prompted — and the outcome
+ * enum has no honest value for it.
+ * @param {object|null} rawLeg the UNFILTERED leg (attemptChair nulls `leg` on
+ *   failure; this is the one before that narrowing, so a failed leg document
+ *   is still visible here)
+ * @param {object|null} [errorDoc] set when the launch never produced a wave
+ *   at all (pre-flight refusal) — the only source of a reason in that case
+ * @returns {{outcome: 'completed'|'error'|'timeout'|'no-output', reason: string|null}}
+ */
+function classifyChairAttempt(rawLeg, errorDoc) {
+  if (!rawLeg) {
+    const reason = (errorDoc && (errorDoc.message || errorDoc.reason)) || 'no leg document';
+    return { outcome: 'error', reason };
+  }
+  if (rawLeg.status === 'timeout') { return { outcome: 'timeout', reason: rawLeg.reason || null }; }
+  if (rawLeg.status === 'complete') {
+    const hasOutput = rawLeg.summary && String(rawLeg.summary).trim();
+    return hasOutput ? { outcome: 'completed', reason: null }
+      : { outcome: 'no-output', reason: rawLeg.reason || null };
+  }
+  return { outcome: 'error', reason: rawLeg.reason || rawLeg.error || String(rawLeg.status) };
+}
+
 /**
  * Chair chain (attempt → retry → ledger-promoted fallback → give up) plus the
  * single VERDICT-line repair re-prompt.
@@ -76,12 +102,28 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
     addWave(solo.wave);
     const ok = solo.leg && solo.leg.status === 'complete'
       && solo.leg.summary && solo.leg.summary.trim();
-    return { leg: ok ? solo.leg : null, exitCode: solo.exitCode };
+    // rawLeg is the UN-nulled leg — the classifier needs to see a failed leg
+    // document, not just the ok/null collapse the rest of the walk consumes.
+    return { leg: ok ? solo.leg : null, exitCode: solo.exitCode, errorDoc: solo.errorDoc, rawLeg: solo.leg };
   };
 
   let chairLeg = null;
   let actualChair = null;
   let skippedForCost = false;
+  // Additive on run.json (LC-5): one entry per resolved attempt (ch1/ch2/ch3;
+  // ch4 is a repair, not an attempt — see classifyChairAttempt). Declared here
+  // (not inside the else branch below) so it stays in scope for the
+  // chair-failed why enrichment after the branch closes, and so a
+  // cost-skipped chair (the `if` branch) simply never calls recordAttempt —
+  // chairAttempts is never checkpointed and the key stays absent on run.json.
+  const chairAttempts = [];
+  const recordAttempt = (attempt, waveId, model) => {
+    const cls = classifyChairAttempt(attempt.rawLeg, attempt.errorDoc);
+    chairAttempts.push({ waveId, model, outcome: cls.outcome, reason: cls.reason });
+    // Checkpointed HERE, before the caller's own isAbortExit bail — a mid-walk
+    // kill must not lose the attempts already resolved (spec §8 kill-mid-walk).
+    runState.checkpoint(o.runDir, { chairAttempts });
+  };
   if (overBudget()) {
     // Ceiling hit after the tally is computable: skip the chair, write the
     // verdict with overallVerdict null, exit 2 (spec §4 degradation table).
@@ -102,9 +144,11 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
     // Fallback chain (spec §4): retry same chair once → promote best
     // non-bench model from the ledger → give up (no Claude fallback headless).
     let attempt = await attemptChair(o.chair, `${o.runId}-ch1`);
+    recordAttempt(attempt, `${o.runId}-ch1`, o.chair);
     if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
     if (!attempt.leg && !overBudget()) {
       attempt = await attemptChair(o.chair, `${o.runId}-ch2`);
+      recordAttempt(attempt, `${o.runId}-ch2`, o.chair);
       if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
     }
     if (attempt.leg) { actualChair = o.chair; }
@@ -114,6 +158,7 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
       const fallback = pickFallbackChair(statsRows, o.models, o.chair);
       if (fallback) {
         attempt = await attemptChair(fallback, `${o.runId}-ch3`);
+        recordAttempt(attempt, `${o.runId}-ch3`, fallback);
         if (isAbortExit(attempt.exitCode) || isSignalled()) { return bail(attempt.exitCode || isSignalled()); }
         if (attempt.leg) { actualChair = fallback; }
       }
@@ -160,7 +205,8 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
       what: 'the council has no chair synthesis',
       why: chairLeg
         ? 'the chair ran but its output carried no parseable VERDICT: line'
-        : 'no chair leg completed, including after the fallback chain',
+        : `no chair leg completed after the fallback walk — ${chairAttempts.map(a =>
+          `${a.waveId.split('-').pop()} ${a.model}: ${a.reason || a.outcome}`).join(' · ')}`,
       effect: 'the verdict is written with overallVerdict null; will exit degraded (2)',
     });
   }
@@ -170,4 +216,4 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
   };
 }
 
-module.exports = { runChair, pickFallbackChair };
+module.exports = { runChair, pickFallbackChair, classifyChairAttempt };

package/src/council/run-launch.js

@@ -94,6 +94,10 @@ function createLaunchers(deps = {}) {
       // part of that allowance in the meantime. This is the CLAIM that settles
       // it — synchronous by contract, so two callers can never interleave.
       ...(reserveBudget ? { reserveBudget: (est) => reserveBudget(opts.waveId, est) } : {}),
+      // SL-2: a Stage-1 retry names the wave it replaces; fanout threads this
+      // onto every leg and its spend-ledger row (v4.3 --retry-failed machinery).
+      // Spread-guarded so a normal launch's transport call stays byte-identical.
+      ...(opts.retryOfWaveId ? { retryOfWaveId: opts.retryOfWaveId } : {}),
       models: opts.models.join(','),
       prompt: opts.prompt,
       promptMeta: { source: 'council-engine', file: null, chars: opts.prompt.length },

package/src/council/run-retry-notes.js

@@ -0,0 +1,74 @@
+'use strict';
+
+/**
+ * @module council/run-retry-notes
+ * Pure note-builders for the SL-2 Stage-1 retry pass (split out of
+ * run-retry.js for the 300-line gate — same rationale as run-stage2.js
+ * splitting off run-stages.js, v4.4.1 Task 2). No I/O, no ctx: each function
+ * takes plain data and returns a still-dead note ready for
+ * `ctx.degrade.note(...)` (D5 final-failure granularity, spec §5). The heal
+ * note is built inline in run-retry.js's orchestrator (it is the one place
+ * that decides recovery, and stays small).
+ */
+
+/** D-effect parity: still-dead leg notes reuse today's count phrasing, with the
+ *  FIRST attempt's counts — the why carries the retry story (spec §5). */
+const legEffect = (counts) =>
+  `${counts.reviewed} of ${counts.total} seats reviewed; `
+  + 'the run continues with the bench that did and will exit degraded (2)';
+
+/** Wave-origin, retry wave died wholesale (D5 wave granularity). */
+function waveStillDeadNote(w, unit) {
+  return { channel: 'dead-wave',
+    what: `Stage-1 wave ${w.waveId} (${(w.models || []).join(', ') || 'no models'}) produced NO legs`,
+    // Coordinator-review MINOR-7c: a falsy w.reason must not render as the
+    // literal string "undefined" in the why text.
+    why: `${w.reason || 'no reason recorded'}; the once-only retry wave also produced no legs`,
+    effect: 'Those seats are NOT in this council. The run continues with the bench that did '
+      + 'launch and will exit degraded (2)',
+    data: { waveId: w.waveId, models: w.models, reason: w.reason, retryWaveId: unit.waveId } };
+}
+
+/** Leg-origin, retry wave died wholesale (bench-batch case). */
+function srcLegStillDeadNote(leg, unit, counts) {
+  const seat = leg.modelInput || leg.model;
+  return { channel: 'dead-leg', what: `seat ${seat} did not review`,
+    why: `the leg ended '${leg.status}'${leg.error ? `: ${leg.error}` : ''} with no usable output; `
+      + 'its once-only retry wave produced no legs',
+    effect: legEffect(counts),
+    data: { seat, status: leg.status, reason: leg.error || null, retryWaveId: unit.waveId } };
+}
+
+/** Either origin, the retry produced legs but THIS seat's retry leg died. */
+function retryLegStillDeadNote(seat, ff, retryLeg, unit, counts) {
+  const why = ff && ff.class === 'wave'
+    ? `its first wave ${ff.waveId} produced no legs (${ff.reason}); `
+      + `its once-only retry leg ended '${retryLeg.status}' with no usable output`
+    : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} `
+      + `with no usable output; its once-only retry also ended '${retryLeg.status}'`;
+  return { channel: 'dead-leg', what: `seat ${seat} did not review`, why,
+    effect: legEffect(counts),
+    data: { seat, status: retryLeg.status, reason: retryLeg.error || null,
+      firstFailure: ff, retryWaveId: unit.waveId } };
+}
+
+/**
+ * CRITICAL fix (coordinator review): a launched seat can be missing a leg
+ * record ENTIRELY from the retry response — a partial wave return (unit
+ * models [a,b], the wave comes back with only a's leg). This is distinct
+ * from `retryLegStillDeadNote` (the seat's retry leg came back but was
+ * unusable) — here there is no retry-attempt status/error to report at all,
+ * only the ORIGINAL first-failure fact plus the fact that nothing came back
+ * this time.
+ */
+function missingLegStillDeadNote(seat, ff, unit, counts) {
+  const fact = ff && ff.class === 'wave'
+    ? `its first wave ${ff.waveId} produced no legs (${ff.reason})`
+    : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} with no usable output`;
+  return { channel: 'dead-leg', what: `seat ${seat} did not review`,
+    why: `${fact}; its once-only retry produced no leg for this seat`,
+    effect: legEffect(counts),
+    data: { seat, status: null, reason: null, firstFailure: ff, retryWaveId: unit.waveId } };
+}
+
+module.exports = { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote };

package/src/council/run-retry.js

@@ -0,0 +1,280 @@
+'use strict';
+
+/**
+ * @module council/run-retry
+ * SL-2 (spec: docs/superpowers/specs/2026-08-03-sl2-stage1-retry-design.md):
+ * the Stage-1 once-only retry pass. A sub-wave that died before its legs
+ * existed, or a leg that ended with no usable output, is relaunched exactly
+ * once — serially, after every surviving launch settled — and the outcome is
+ * announced in the one voice: a `stage1-retry` HEAL per recovered seat; the
+ * ordinary dead-wave/dead-leg degrade, noted by the CALLER (run-stages.js),
+ * when the retry also died. This module emits heals only — it never notes a
+ * degrade and never touches `degraded.value`, so the sink invariant holds by
+ * construction. No retry of a retry: the pass consumes first-attempt losses
+ * only.
+ */
+
+const briefings = require('./briefings');
+const { materializeReviews, isAbortExit } = require('./run-launch');
+const runState = require('./run-state');
+const { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote }
+  = require('./run-retry-notes');
+
+/** 1-based lens index for a loss, from the waveId convention or the model. */
+function lensIndexOf(o, waveId, model) {
+  const m = /-l(\d+)$/.exec(waveId || '');
+  if (m) { return Number(m[1]); }
+  const i = (o.models || []).indexOf(model);
+  return i === -1 ? null : i + 1;
+}
+
+/**
+ * Dedup helper (Task-4 review hardening): the same seat can arrive twice in
+ * one grouping pass — two dead legs naming it, or a dead wave and a dead leg
+ * both naming it. One seat must still mean ONE `firstFailures` entry — first
+ * occurrence wins — while every SOURCE record is kept regardless (srcWaves/
+ * srcLegs are the audit trail and are never deduped). The critic unit's
+ * `.models` is fixed at creation (there is only ever one critic seat), so
+ * only bench/lens units grow `.models` here — the critic call sites pass
+ * `trackModel: false`.
+ */
+function recordFailure(unit, seat, ff, trackModel = true) {
+  if (unit.firstFailures.some(f => f.seat === seat)) { return; }
+  unit.firstFailures.push(ff);
+  if (trackModel) { unit.models.push(seat); }
+}
+
+/**
+ * Group Stage-1 losses into retry units. Pure — no I/O.
+ * Bench losses (a dead bench wave's models + dead bench legs) collapse into
+ * ONE retry wave; the critic and each lens retry as solos (their briefings
+ * differ). Stable order: bench, critic, lenses ascending. The critic matches
+ * on EITHER carrier — waveId convention or model — mirroring
+ * verdict.js summarizeSeatLoss.
+ */
+function groupStage1Losses(o, deadWaves = [], deadLegs = []) {
+  const isCriticWave = (w) =>
+    w.waveId === `${o.runId}-c1` || (!!o.critic && (w.models || []).includes(o.critic));
+  const bench = { unit: 'bench', waveId: `${o.runId}-s1r1`, retryOfWaveId: `${o.runId}-s1`,
+    models: [], firstFailures: [], srcWaves: [], srcLegs: [] };
+  const lensUnits = new Map(); // lensIndex (number, or null for unmappable) -> unit
+  const criticUnit = { unit: 'critic', waveId: `${o.runId}-c1r1`, retryOfWaveId: `${o.runId}-c1`,
+    models: o.critic ? [o.critic] : [], firstFailures: [], srcWaves: [], srcLegs: [] };
+
+  const lensUnitFor = (i) => {
+    if (!lensUnits.has(i)) {
+      // Task-4 review hardening: an unmappable loss (lensIndexOf resolved
+      // neither the waveId convention nor a model-roster membership) must
+      // still be GROUPABLE — dropping it here would let it vanish before the
+      // orchestrator ever sees it — but must not manufacture a fake
+      // `-lnullr1` waveId. The orchestrator refuses to launch any unit with
+      // `lensIndex === null` and routes its sources to skipped instead.
+      lensUnits.set(i, i === null
+        ? { unit: 'lens', lensIndex: null, waveId: null, retryOfWaveId: null,
+          models: [], firstFailures: [], srcWaves: [], srcLegs: [] }
+        : { unit: 'lens', lensIndex: i, waveId: `${o.runId}-l${i}r1`,
+          retryOfWaveId: `${o.runId}-l${i}`, models: [], firstFailures: [], srcWaves: [], srcLegs: [] });
+    }
+    return lensUnits.get(i);
+  };
+
+  for (const w of deadWaves) {
+    const models = w.models || [];
+    if (o.lenses) {
+      const u = lensUnitFor(lensIndexOf(o, w.waveId, models[0]));
+      u.srcWaves.push(w);
+      models.forEach(seat => recordFailure(u, seat, { seat, class: 'wave', waveId: w.waveId, reason: w.reason }));
+    } else if (isCriticWave(w)) {
+      criticUnit.srcWaves.push(w);
+      recordFailure(criticUnit, o.critic,
+        { seat: o.critic, class: 'wave', waveId: w.waveId, reason: w.reason }, false);
+    } else {
+      bench.srcWaves.push(w);
+      models.forEach(seat => recordFailure(bench, seat, { seat, class: 'wave', waveId: w.waveId, reason: w.reason }));
+    }
+  }
+  for (const leg of deadLegs) {
+    const seat = leg.modelInput || leg.model;
+    const ff = { seat, class: 'leg', status: leg.status, reason: leg.error || null };
+    if (o.lenses) {
+      const u = lensUnitFor(lensIndexOf(o, null, seat));
+      u.srcLegs.push(leg);
+      recordFailure(u, seat, ff);
+    } else if (o.critic && seat === o.critic) {
+      criticUnit.srcLegs.push(leg);
+      recordFailure(criticUnit, seat, ff, false);
+    } else {
+      bench.srcLegs.push(leg);
+      recordFailure(bench, seat, ff);
+    }
+  }
+
+  const out = [];
+  // Task-4 review hardening: gate on whether the unit received any SOURCE
+  // record, not on firstFailures.length — a zero-model dead wave contributes
+  // a srcWaves entry but nothing to firstFailures/models (nothing for the
+  // `.forEach` above to iterate), and must still surface here so the
+  // orchestrator can route it to skipped instead of it vanishing silently.
+  if (bench.srcWaves.length > 0 || bench.srcLegs.length > 0) { out.push(bench); }
+  if (criticUnit.srcWaves.length > 0 || criticUnit.srcLegs.length > 0) { out.push(criticUnit); }
+  // Coordinator-review MINOR-7a: null sorts LAST (Infinity), not first (0) —
+  // an unmappable loss is not "lens index 0"; it should not perturb the
+  // ascending order of the real, well-indexed lens retries.
+  out.push(...[...lensUnits.values()].sort((a, b) => (a.lensIndex ?? Infinity) - (b.lensIndex ?? Infinity)));
+  return out;
+}
+
+/** The briefing a retry unit re-issues — same builders Stage 1 used. */
+function briefingFor(o, unit) {
+  if (unit.unit === 'critic') { return briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }); }
+  if (unit.unit === 'lens') {
+    return briefings.buildLensBriefing({ lens: o.lenses[unit.lensIndex - 1], briefing: o.briefing, date: o.date });
+  }
+  return briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date });
+}
+
+/**
+ * The retry pass. Serial by design (spec D-order: bench, critic, lenses) —
+ * the per-wave-fallback path, where waves actually die, is exactly where
+ * concurrent relaunches would race the same server start again.
+ */
+async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts = { reviewed: 0, total: 0 } } = {}) {
+  const { o, launchers } = ctx;
+  const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [],
+    stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [] };
+
+  for (const unit of groupStage1Losses(o, deadWaves, deadLegs)) {
+    // Task-4 review hardening: a unit this pass cannot even ATTEMPT — an
+    // unmappable lens loss (no carrier resolved an index), a lens index
+    // outside the run's actual lens roster (coordinator-review MINOR-7b: a
+    // malformed waveId like "...-l99" must not become an out-of-range
+    // `o.lenses[98]` access inside briefingFor), or a unit whose sources
+    // named zero models — is never launched. Its sources fall back to the
+    // ordinary skipped-loss path so the caller's normal degrade notes still
+    // fire; being unmappable is not an exemption from the record.
+    const lensOutOfRange = unit.unit === 'lens' && unit.lensIndex !== null
+      && (unit.lensIndex < 1 || unit.lensIndex > (o.lenses || []).length);
+    if (unit.lensIndex === null || lensOutOfRange || unit.models.length === 0) {
+      out.skippedDeadWaves.push(...unit.srcWaves);
+      out.skippedDeadLegs.push(...unit.srcLegs);
+      continue;
+    }
+    if (ctx.overBudget()) { // D7: skip silently — the loss is already announced by the caller
+      out.skippedDeadWaves.push(...unit.srcWaves);
+      out.skippedDeadLegs.push(...unit.srcLegs);
+      continue;
+    }
+    runState.appendStageWave(o.runDir, 'stage1', unit.waveId); // BEFORE launch: abort cascade
+    const common = { project: o.runDir, timeout: o.timeout, gateway: o.gateway,
+      noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
+      councilRunId: o.runId, councilName: o.councilName,
+      fallback: o.fallback, catalog: o.catalog,
+      waveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, prompt: briefingFor(o, unit) };
+    // Dispatch by UNIT TYPE, not model count (spec §4: bench is always a wave —
+    // even down to its last surviving seat — critic/lens are always solos).
+    // A model-count proxy (`models.length === 1`) is wrong for a bench unit
+    // that lost exactly one seat: it would route that retry through
+    // launchSolo, which no bench caller wires up.
+    const res = unit.unit === 'bench'
+      ? await launchers.launchWave({ ...common, models: unit.models.slice() })
+      : await launchers.launchSolo({ ...common, model: unit.models[0] });
+    ctx.addWave(res.wave); // reservation released + measured legs counted (run-budget)
+    if (isAbortExit(res.exitCode)) { out.aborted = res.exitCode; return out; }
+
+    const legs = (res.wave && Array.isArray(res.wave.legs)) ? res.wave.legs : [];
+    if (legs.length === 0) {
+      // The retry wave itself died wholesale — final failure keeps each
+      // source's granularity (D5): wave-origin stays a dead-wave, leg-origin
+      // stays a dead-leg, both enriched with the retry fact. Coordinator-
+      // review MINOR-4: emitted ONCE per SEAT — the grouping dedup (Task-4
+      // hardening) keeps BOTH src records when a seat arrives via a srcWave
+      // AND a srcLeg (or via two srcLegs), so without this a single lost
+      // seat could be announced twice. Waves are processed first (mirrors
+      // the "wave wins" precedent from the grouping-level dedup); a seat
+      // already covered by its wave's note is skipped when its srcLeg is
+      // reached.
+      const notedSeats = new Set();
+      for (const w of unit.srcWaves) {
+        out.stillDeadNotes.push(waveStillDeadNote(w, unit));
+        out.stillDeadWaves.push(w);
+        for (const m of (w.models || [])) { notedSeats.add(m); }
+      }
+      for (const l of unit.srcLegs) {
+        const seat = l.modelInput || l.model;
+        if (notedSeats.has(seat)) { continue; }
+        notedSeats.add(seat);
+        out.stillDeadNotes.push(srcLegStillDeadNote(l, unit, counts));
+        out.stillDeadLegs.push(l);
+      }
+      continue;
+    }
+    const usable = new Set(materializeReviews(o.runDir, legs).map(m => m.leg));
+    const seenSeats = new Set(legs.map(leg => leg.modelInput || leg.model));
+    const lostWaveSeats = new Map(); // waveId -> seats still lost from a wave-origin
+    for (const leg of legs) {
+      const seat = leg.modelInput || leg.model;
+      const ff = unit.firstFailures.find(f => f.seat === seat) || null;
+      // SL-2 fix-wave: a retry response should only ever name seats THIS unit
+      // launched for (unit.models is built in lockstep with firstFailures via
+      // groupStage1Losses's recordFailure) — but if a leg turns up for a seat
+      // with no firstFailures entry, that seat never lost its seat in the
+      // first place. Skip it entirely: no heal (it would fabricate an "ended
+      // 'unknown'" why for a seat that never failed) and no still-dead note —
+      // the seat's first-attempt review stands untouched, rather than this
+      // stray leg doubling it into a duplicate bench entry alongside the real one.
+      if (!ff) { continue; }
+      if (usable.has(leg)) {
+        out.recoveredLegs.push(leg);
+        ctx.degrade.note({ channel: 'stage1-retry', kind: 'heal',
+          what: `seat ${seat} reviewed on retry`,
+          why: ff && ff.class === 'wave'
+            ? `its first wave ${ff.waveId} produced no legs (${ff.reason}) and was relaunched once`
+            : `its first leg ended '${ff ? ff.status : 'unknown'}' with no usable output and was relaunched once`,
+          effect: 'The seat is in this council; nothing was lost',
+          data: { seat, retryWaveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, firstFailure: ff } });
+      } else {
+        out.stillDeadNotes.push(retryLegStillDeadNote(seat, ff, leg, unit, counts));
+        if (ff && ff.class === 'wave') {
+          if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
+          lostWaveSeats.get(ff.waveId).push(seat);
+        } else {
+          const src = unit.srcLegs.find(l => (l.modelInput || l.model) === seat);
+          if (src) { out.stillDeadLegs.push(src); }
+        }
+      }
+    }
+    // CRITICAL fix (coordinator review): the loop above only visits seats
+    // that came back WITH a leg record. A partial wave return (unit models
+    // [a,b], the wave comes back with only a's leg) leaves 'b' invisible to
+    // that loop entirely — no heal, no still-dead note, no skip: it would
+    // vanish from every array. Reconcile against the full launched-seat set
+    // (the union of unit.models, every srcWave's models, and every srcLeg's
+    // seat — not just unit.models alone, so this holds even if some future
+    // change to the grouping made unit.models an incomplete union) so every
+    // launched seat lands in exactly one of recovered / still-dead / skipped.
+    const launchedSeats = new Set(unit.models);
+    for (const w of unit.srcWaves) { for (const m of (w.models || [])) { launchedSeats.add(m); } }
+    for (const l of unit.srcLegs) { launchedSeats.add(l.modelInput || l.model); }
+    for (const seat of launchedSeats) {
+      if (seenSeats.has(seat)) { continue; } // already handled above (healed or still-dead)
+      const ff = unit.firstFailures.find(f => f.seat === seat) || null;
+      out.stillDeadNotes.push(missingLegStillDeadNote(seat, ff, unit, counts));
+      if (ff && ff.class === 'wave') {
+        if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
+        lostWaveSeats.get(ff.waveId).push(seat);
+      } else {
+        const src = unit.srcLegs.find(l => (l.modelInput || l.model) === seat);
+        if (src) { out.stillDeadLegs.push(src); }
+      }
+    }
+    // Wave-origin seats still lost: the return-contract wave entry carries only
+    // the still-lost subset (a partially healed wave is not wholly dead).
+    for (const w of unit.srcWaves) {
+      const lost = lostWaveSeats.get(w.waveId) || [];
+      if (lost.length > 0) { out.stillDeadWaves.push({ ...w, models: lost }); }
+    }
+  }
+  return out;
+}
+
+module.exports = { groupStage1Losses, retryStage1Losses };

package/src/council/run-stages.js

@@ -20,6 +20,7 @@
 const { validateFindings, countAttemptedFindings } = require('./findings');
 const briefings = require('./briefings');
 const { materializeReviews, isAbortExit } = require('./run-launch');
+const { retryStage1Losses } = require('./run-retry');
 const runState = require('./run-state');
 const { runStage2 } = require('./run-stage2');
 
@@ -133,7 +134,25 @@ async function runStage1(ctx) {
   const { aborted, legs, deadWaves } = await launchStage1(ctx);
   if (aborted) { return { aborted, reviews: [], deadLegs: [], deadWaves: [], degraded: false }; }
 
-  for (const d of deadWaves) {
+  const firstPass = materializeReviews(o.runDir, legs);
+  const alive0 = new Set(firstPass.map(m => m.leg));
+  const deadLegs0 = legs.filter(l => !alive0.has(l));
+
+  // SL-2: one retry BEFORE anything is recorded lost — the sink never
+  // un-flips, so a degrade for a seat the retry saves must never fire at all.
+  const retry = await retryStage1Losses(ctx, { deadWaves, deadLegs: deadLegs0,
+    counts: { reviewed: firstPass.length, total: legs.length } });
+  if (retry.aborted) {
+    // Final whole-branch review: same bug class as the post-retry-repair
+    // abort fixed ~87 lines below ("Must be the post-retry set") — subtract
+    // whatever retry.recoveredLegs already healed before this abort landed.
+    const healed = new Set(retry.recoveredLegs.map(l => l.modelInput || l.model));
+    return { aborted: retry.aborted, reviews: [], degraded: false,
+      deadLegs: deadLegs0.filter(l => !healed.has(l.modelInput || l.model)),
+      deadWaves: deadWaves.map(w => ({ ...w, models: (w.models || []).filter(m => !healed.has(m)) })).filter(w => w.models.length > 0) };
+  }
+
+  for (const d of retry.skippedDeadWaves) {
     ctx.degrade.note({
       channel: 'dead-wave',
       what: `Stage-1 wave ${d.waveId} (${d.models.join(', ') || 'no models'}) produced NO legs`,
@@ -143,21 +162,27 @@ async function runStage1(ctx) {
       data: { waveId: d.waveId, models: d.models, reason: d.reason },
     });
   }
-
-  const materialized = materializeReviews(o.runDir, legs);
-  const alive = new Set(materialized.map(m => m.leg));
-  const deadLegs = legs.filter(l => !alive.has(l));
-
-  for (const leg of deadLegs) {
+  for (const leg of retry.skippedDeadLegs) {
     ctx.degrade.note({
       channel: 'dead-leg',
       what: `seat ${leg.modelInput || leg.model} did not review`,
       why: `the leg ended '${leg.status}'${leg.error ? `: ${leg.error}` : ''} with no usable output`,
-      effect: `${materialized.length} of ${legs.length} seats reviewed; `
+      effect: `${firstPass.length} of ${legs.length} seats reviewed; `
         + 'the run continues with the bench that did and will exit degraded (2)',
       data: { seat: leg.modelInput || leg.model, status: leg.status, reason: leg.error || null },
     });
   }
+  for (const rec of retry.stillDeadNotes) { ctx.degrade.note(rec); }
+
+  // Invariant this merge relies on: retry.recoveredLegs only ever names seats
+  // that actually lost their seat on the first pass (run-retry.js's recovery
+  // loop drops any leg for a seat with no firstFailures entry) — so `legs`
+  // and `recoveredLegs` can never both carry a leg for the same seat here.
+  // materializeReviews re-writing an already-materialized recovered leg's
+  // review-*.md a second time is accepted as an idempotent no-op, not a bug.
+  const materialized = materializeReviews(o.runDir, [...legs, ...retry.recoveredLegs]);
+  const stillDeadLegs = [...retry.skippedDeadLegs, ...retry.stillDeadLegs];
+  const stillDeadWaves = [...retry.skippedDeadWaves, ...retry.stillDeadWaves];
 
   const reviews = [];
   let repairSeq = 0;
@@ -206,7 +231,12 @@ async function runStage1(ctx) {
       });
       ctx.addWave(solo.wave);
       if (isAbortExit(solo.exitCode)) {
-        return { aborted: solo.exitCode, reviews, deadLegs, deadWaves, degraded: false };
+        // SL-2 fix-wave: this used to read the pre-retry `deadWaves` binding —
+        // run.js persists this return into stage-1 state before the abort
+        // short-circuit, so a heal-then-abort run was recording seats as dead
+        // that had actually reviewed on retry. Must be the post-retry set,
+        // same as the normal-completion return below.
+        return { aborted: solo.exitCode, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves, degraded: false };
       }
       const repaired = (solo.leg && solo.leg.summary) || '';
       if (repaired.trim()) { repairing = repaired; }
@@ -255,8 +285,8 @@ async function runStage1(ctx) {
       ...(repairRefused ? { repairRefused } : {}),
     });
   }
-  return { aborted: null, reviews, deadLegs, deadWaves,
-    degraded: deadLegs.length > 0 || deadWaves.length > 0 };
+  return { aborted: null, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves,
+    degraded: stillDeadLegs.length > 0 || stillDeadWaves.length > 0 };
 }
 
 // runStage2 lives in ./run-stage2.js (300-line gate) but is re-exported here so

package/src/council/verdict.js

@@ -73,8 +73,15 @@ function deriveSeatLoss({ runId, critic, degrades = [] } = {}) {
   return {
     ...base,
     criticSeated: base.criticSeated && !criticLeg,
+    // SL-2 handoff: a reconciliation note (run-retry-notes.js's
+    // missingLegStillDeadNote) carries data.status: null when the retry
+    // produced no leg for the seat at all — there is no status to name, so
+    // the old `ended '${status}'` template rendered the literal string
+    // "ended 'null'". A status-carrying record keeps the original text.
     reason: base.reason || (criticLeg
-      ? (criticLeg.data.reason || `the critic leg ended '${criticLeg.data.status}' with no usable output`)
+      ? (criticLeg.data.reason || (criticLeg.data.status
+        ? `the critic leg ended '${criticLeg.data.status}' with no usable output`
+        : 'the critic leg produced no usable output'))
       : null),
     deadBenchSeats: [...base.deadBenchSeats,
       ...legs.filter(l => l.data.seat !== critic).map(l => l.data.seat)],