amicus 4.6.1 → 4.6.3

package/electron/workspace-ui/index.html

@@ -102,6 +102,9 @@
   <script src="./live-model.js"></script>
   <script src="./workspace-render.js"></script>
   <script src="./workspace-matrix.js"></script>
+  <!-- ⚠️ D8 extraction (Task 1, v4.6.2 PR4): workspace-seats.js must load BEFORE
+       workspace-panels.js, whose renderSeatsPanel delegates to it. -->
+  <script src="./workspace-seats.js"></script>
   <!-- ⚠️ DE-ROT (F05): panels + verbs are the Task 13 split of workspace-app.js.
        Load order matters: workspace-app.js boots last and owns `state`. -->
   <script src="./workspace-panels.js"></script>

package/electron/workspace-ui/live-model.js

@@ -37,9 +37,17 @@
     return (state.visible && state.focused) ? 1500 : 5000;
   }
 
+  /** True when `status` is a terminal run status. The single consumption
+   * point for TERMINAL_STATUSES membership (v4.6.3 PR2 dedup) — the array
+   * itself stays exported and byte-identical to src/workspace/run-detail.js
+   * (drift-pinned). */
+  function isTerminal(status) {
+    return TERMINAL_STATUSES.indexOf(status) !== -1;
+  }
+
   /** Blind default per spec resolved Q2: ON live, OFF terminal. */
   function defaultBlind(status) {
-    return TERMINAL_STATUSES.indexOf(status) === -1;
+    return !isTerminal(status);
   }
 
   function dash(v) {
@@ -104,9 +112,145 @@
     });
   }
 
+  /**
+   * D6 (v4.6.2 PR4 Task 2, "dead-seat rows"): announced-dead seats, unioned
+   * from the run's own `degrades[]` (dead-leg/dead-wave channels — the live
+   * announcement; shapes verified against src/council/run-retry-notes.js and
+   * the skipped-path notes at src/council/run-stages.js:155-174) and the
+   * verdict's derived `seatLoss` (verdict.js summarizeSeatLoss/deriveSeatLoss
+   * — the critic-loss backstop, kept for verdicts written before `degrades[]`
+   * existed, v4.5.2 precedent). De-duped by seat model: `degrades` is scanned
+   * FIRST, so a real record's retry marker always beats the backstop's
+   * no-data guess for the same seat.
+   *
+   * `retried` reads `data.retryWaveId` / `data.firstFailure`: every
+   * still-dead-after-retry note (run-retry-notes.js's four builders) carries
+   * `retryWaveId`; the two run-stages.js skipped-path notes (fired when the
+   * once-only retry pass never even attempted the seat — an unmappable lens
+   * loss, an out-of-range index, or a zero-model unit) carry neither, so they
+   * correctly fall back to the plain phrasing.
+   *
+   * D6 filter (zero usable legs ONLY, "no ghost when a retry succeeded"): a
+   * candidate already present in `liveSeats` (it has a cost row — SL-2 healed
+   * it) is dropped. This is the one thing standing between a recovered seat
+   * and a duplicate/ghost row — same failure family as the F37 debate-role
+   * collision and the RN-11 keyed-row lessons just above (seatsFromRunStats,
+   * seatCells): an identity that is not carefully matched silently
+   * duplicates or overwrites instead of failing loud.
+   *
+   * Role-aware D6 (v4.6.3 PR2, spec D3): a bare model match used to suppress
+   * regardless of what the LIVE row's role was — so a model that died as
+   * critic but whose chair-fallback walk happened to land on that same alias
+   * (and succeeded, producing a live `role: 'chair'` cost row) silently
+   * erased the dead-critic row it was never a replacement for (spec §5, the
+   * PR 102 rider). Candidates now carry a `role` (`'critic'` via alias equality
+   * with `runMeta.critic` — mirroring `deriveSeatLoss`, verdict.js:72 — or
+   * `null`), and only REVIEWING-role live legs (`seat`/`critic`/`lens:*`)
+   * suppress at all; a `'critic'` candidate is cleared only by a live
+   * CRITIC-role leg for that alias, never by a chair/judge/rebuttal/revote
+   * row landing on the same model. Hidden dependency: the recovered-critic
+   * suppression below (`byRole[alias + '|critic']`) relies on `roleFor`'s
+   * critic branch (src/council/run-stages.js), which only fires when lenses
+   * are absent — safe today only because --critic and --lenses are mutually
+   * exclusive (cli-handlers-council-run.js:196); if that exclusion ever
+   * loosens, a healed critic on a lens run would carry role 'seat' and this
+   * suppression would render a ghost dead row for it.
+   *
+   * Old-run resilience (v4.6.3 PR2, spec D4): pre-`degrades[]` runs (v4.5.2)
+   * carry the BENCH half of a seat loss only in `seatLoss.deadBenchSeats`
+   * (string[] of aliases, verdict.js deriveSeatLoss) — `degrades[]` never
+   * existed on either doc for these runs. Consumed after the critic backstop,
+   * candidates get `role: null` (deadBenchSeats carries no critic/bench
+   * distinction beyond what `criticRequested` already covers above) and flow
+   * through the same `seen`-keyed dedup and role-aware suppression as every
+   * other candidate — deriveSeatLoss does not dedup its own array, so `seen`
+   * is what keeps a repeated alias (or one also named by a real degrade
+   * record) from rendering twice.
+   *
+   * @param {Array<object>} degrades  run.json's `degrades[]` (may be absent)
+   * @param {?object} seatLoss  verdict.json's `seatLoss` (may be absent) —
+   *   `criticRequested`/`criticSeated` back the critic candidate above,
+   *   `deadBenchSeats` (string[] of aliases) feeds the bench candidates below
+   * @param {Array<{model: string}>} liveSeats  seatsFromRunStats(...)'s output
+   *   (or any seat list keyed the same way — the live seat map)
+   * @param {?{critic: ?string}} runMeta  run.critic (alias, or null/absent
+   *   when no critic was requested) — degrade records carry no role field, so
+   *   this is the ONLY way a degrade-sourced candidate is identified as critic
+   * @returns {Array<{model: string, statusText: string, role: ?string}>}
+   */
+  function deadSeats(degrades, seatLoss, liveSeats, runMeta) {
+    var critic = runMeta && runMeta.critic ? runMeta.critic : null;
+    var seen = {};
+    var order = [];
+    function add(model, retried, role) {
+      if (!model || seen[model]) { return; }
+      seen[model] = true;
+      order.push({
+        model: model,
+        role: role || null,
+        statusText: retried ? 'did not review — retried once' : 'did not review',
+      });
+    }
+    (degrades || []).forEach(function (d) {
+      if (!d || d.kind !== 'degrade') { return; }
+      if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave') { return; }
+      var data = d.data || {};
+      var retried = !!(data.retryWaveId || data.firstFailure);
+      // Critic identification mirrors deriveSeatLoss (verdict.js): alias
+      // equality with run.critic — degrade records carry no role field.
+      if (d.channel === 'dead-leg') {
+        add(data.seat, retried, critic && data.seat === critic ? 'critic' : null);
+      } else {
+        (data.models || []).forEach(function (m) {
+          add(m, retried, critic && m === critic ? 'critic' : null);
+        });
+      }
+    });
+    if (seatLoss && seatLoss.criticRequested && !seatLoss.criticSeated) {
+      add(seatLoss.criticRequested, false, 'critic');
+    }
+    if (seatLoss) {
+      // Pre-degrades[] era (v4.5.2): the bench half of a seat loss lives
+      // only here. Alias strings; deriveSeatLoss does not dedup — `seen`
+      // absorbs repeats and degrade-sourced duplicates.
+      (seatLoss.deadBenchSeats || []).forEach(function (m) { add(m, false, null); });
+    }
+    // Role-aware D6 (v4.6.3 PR2): only REVIEWING-role live legs suppress —
+    // a chair/judge/rebuttal/revote row must not hide a dead reviewer, and
+    // a dead-critic candidate is cleared only by a live CRITIC leg. A null
+    // role is NOT reviewing: counting it would suppress silently, the exact
+    // class the announcement invariant forbids.
+    function isReviewing(role) {
+      return role === 'seat' || role === 'critic' ||
+        (typeof role === 'string' && role.indexOf('lens:') === 0);
+    }
+    var reviewing = {};
+    var byRole = {};
+    // ⚠️ Fable review (PR4b fix wave): same F34/F36 alias-selection seatCells already uses
+    // (`seat.modelInput || seat.model`, above) — a LIVE payload seat's `model` is the RESOLVED
+    // executable id, not the alias a degrade record names; `modelInput` carries the alias.
+    // Keying this map on `s.model` alone meant a dead-leg seat whose errored roster row was
+    // still in the active stage's `liveSeats` never matched its alias-keyed degrade candidate,
+    // so D6 failed to suppress it — both rows rendered until the stage boundary dropped the
+    // errored row. Terminal-path cost rows (seatsFromRunStats) carry no `modelInput` at all and
+    // are already alias-only, so `|| s.model` leaves that path unchanged.
+    (liveSeats || []).forEach(function (s) {
+      if (!isReviewing(s.role)) { return; }
+      var alias = s.modelInput || s.model; // F36: alias space, never resolved ids
+      reviewing[alias] = true;
+      byRole[alias + '|' + s.role] = true;
+    });
+    return order.filter(function (s) {
+      if (s.role === 'critic') { return !byRole[s.model + '|critic']; }
+      return !reviewing[s.model];
+    });
+  }
+
   // ⚠️ DE-ROT (F41): STAGE_LABELS is exported so applyLive() can label post-open stages.
   var api = { pollDelay: pollDelay, seatCells: seatCells, seatsFromRunStats: seatsFromRunStats,
-    defaultBlind: defaultBlind, dash: dash, TERMINAL_STATUSES: TERMINAL_STATUSES, STAGE_LABELS: STAGE_LABELS };
+    deadSeats: deadSeats,
+    defaultBlind: defaultBlind, isTerminal: isTerminal, dash: dash,
+    TERMINAL_STATUSES: TERMINAL_STATUSES, STAGE_LABELS: STAGE_LABELS };
   if (typeof module !== 'undefined' && module.exports) { module.exports = api; }
   if (typeof window !== 'undefined') { window.AmicusLive = api; }
 })();

package/electron/workspace-ui/workspace-app.js

@@ -6,8 +6,8 @@
  * ⚠️ DE-ROT (F05) / PRE-FLIGHT (P2): this file is the last of the three-way
  * split (workspace-app.js / workspace-panels.js / workspace-verbs.js). It
  * loads LAST (md-lite → live-model → workspace-render → workspace-matrix →
- * workspace-panels → workspace-verbs → workspace-app), so panels/verbs
- * already exist and may be captured once, here, at load time.
+ * workspace-seats → workspace-panels → workspace-verbs → workspace-app), so
+ * panels/verbs already exist and may be captured once, here, at load time.
  */
 (function () {
   'use strict';
@@ -67,6 +67,11 @@
     state.runId = runId;
     state.debate = null;
     return invoke('workspace:get-run', runId).then(function (detail) {
+      // F09 guard (v4.6.3 PR2): a reply for a run the user has since
+      // navigated away from must never overwrite the run now open. Guard on
+      // runId movement ONLY — a same-run re-open (the live loop's terminal
+      // refresh) must still apply its fresher reply.
+      if (state.runId !== runId) { return; }
       state.detail = detail;
       // ⚠️ DE-ROT (F38): debate.json is the re-vote index the matrix drill-in needs — fetched
       // once per run-open (never per render), fire-and-forget. An aborted or cost-ceiling
@@ -146,7 +151,7 @@
     P.renderVerdictPanel();
     R.renderCost($('cost-body'), d.derived.cost, state.blind, labelOf);
     P.wireLazyPanels();
-    var isTerminal = window.AmicusLive.TERMINAL_STATUSES.indexOf(d.run.status) !== -1;
+    var isTerminal = window.AmicusLive.isTerminal(d.run.status);
     $('abort-btn').hidden = isTerminal;
     V.startLiveLoop();
   }

package/electron/workspace-ui/workspace-panels.js

@@ -3,12 +3,12 @@
  * (v4.4 §5, ⚠️ DE-ROT F05 split of workspace-app.js).
  *
  * Loads BEFORE workspace-app.js (md-lite → live-model → workspace-render →
- * workspace-matrix → workspace-panels → workspace-verbs → workspace-app), so
- * every function here reads `window.AmicusApp` / `window.AmicusVerbs` at CALL
- * time (never captured at this file's own load time — neither namespace
- * exists yet when this IIFE runs). window.AmicusApp publishes its namespace
- * at the top of its own boot, before calling into this file, so by the time
- * any function below actually executes, both are present.
+ * workspace-matrix → workspace-seats → workspace-panels → workspace-verbs →
+ * workspace-app), so every function here reads `window.AmicusApp` /
+ * `window.AmicusVerbs` at CALL time (never captured at this file's own load
+ * time — neither namespace exists yet when this IIFE runs). window.AmicusApp
+ * publishes its namespace at the top of its own boot, before calling into this
+ * file, so by the time any function below actually executes, both are present.
  */
 (function () {
   'use strict';
@@ -37,11 +37,10 @@
     return kind + '-' + sanitizeName(model) + '.md';
   }
 
+  // ⚠️ D8 extraction (Task 1): body moved verbatim to workspace-seats.js
+  // (window.AmicusSeats), which loads immediately before this file.
   function renderSeatsPanel() {
-    var A = window.AmicusApp;
-    var d = A.state.detail;
-    var seats = window.AmicusLive.seatsFromRunStats(d.derived.cost.rows);
-    window.AmicusRender.renderSeats(A.$('seats-body'), seats, A.state.blind, A.labelOf);
+    window.AmicusSeats.renderSeatsPanel();
   }
 
   function renderMatrixPanel() {

package/electron/workspace-ui/workspace-render.js

@@ -36,6 +36,12 @@
     return el('span', { className: 'chip ' + (kind || ''), title: text }, [text]);
   }
 
+  /** td className for seat-table cell index i — one source for the three
+   * call sites (renderSeats create + update, renderDeadSeatRows). */
+  function seatCellClass(i) {
+    return i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : '');
+  }
+
   /** Dual-name display flip (blind mode). pair = {model, label}. */
   function display(pair, blind) {
     if (!pair) { return '—'; }
@@ -197,7 +203,7 @@
       var cells = window.AmicusLive.seatCells(view, blindOn, labelOf);
       if (!row) {
         row = el('tr', { dataset: { key: key } }, cells.map(function (c, i) {
-          return el('td', { className: i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : '') }, [c]);
+          return el('td', { className: seatCellClass(i) }, [c]);
         }));
         tbody.appendChild(row);
         return;
@@ -205,7 +211,7 @@
       cells.forEach(function (c, i) {
         var td = row.children[i];
         if (td && td.textContent !== c) { td.textContent = c; }
-        if (td) { td.className = i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : ''); }
+        if (td) { td.className = seatCellClass(i); }
       });
     });
     // RN-11 (v4.5): the keyed update added and removed rows but never MOVED
@@ -282,6 +288,6 @@
     el: el, chip: chip, display: display, relTime: relTime, renderRunList: renderRunList,
     renderHeaderChips: renderHeaderChips, renderGauge: renderGauge, renderStageRail: renderStageRail,
     renderSeats: renderSeats, renderBanner: renderBanner, renderCost: renderCost,
-    renderProseSections: renderProseSections,
+    renderProseSections: renderProseSections, seatCellClass: seatCellClass,
   };
 })();

package/electron/workspace-ui/workspace-seats.js

@@ -0,0 +1,132 @@
+/**
+ * Council Workspace — seats panel painter (v4.4 §5). D8 extraction (Task 1,
+ * v4.6.2 PR4): moved verbatim out of workspace-panels.js, which was pressed
+ * up against the 300-line size gate — this file is where Task 2 adds
+ * dead-seat rows. Loads immediately before workspace-panels.js (index.html),
+ * which keeps a thin delegate; reads `window.AmicusApp` at CALL time, same
+ * discipline as every sibling renderer file (workspace-app.js boots last and
+ * owns `state`).
+ *
+ * Task 2 ("dead-seat rows"): `state.detail.run` and `state.detail.verdict`
+ * are the raw run.json/verdict.json docs (src/workspace/run-detail.js —
+ * `getRunDetail` returns them wholesale, unfiltered), so `run.degrades` and
+ * `verdict.seatLoss` are already on `state.detail` today; no data-layer
+ * threading was needed. Only the derivation (window.AmicusLive.deadSeats,
+ * live-model.js) and this file's painting are new.
+ *
+ * NOTE (scope, matches the plan's file list): renderSeatsPanel() (below) is reached from
+ * renderDetail() — called both from openRun() (a fresh run open) and from the blind toggle
+ * (workspace-app.js:197-227), which must repaint dead rows too so the mask flip reaches
+ * them. A dead-leg/dead-wave degrade is checkpointed to run.json as soon as Stage 1's
+ * once-only retry pass resolves for that seat — which can be well before the rest of the run
+ * reaches a terminal status, so a seat CAN be "announced dead" in the data while the run is
+ * still live-polling.
+ *
+ * HISTORY: dead rows first shipped gated on terminal status (Task 2's fix wave, task
+ * review, controller ruling) — appended ONLY when window.AmicusLive.TERMINAL_STATUSES
+ * matched d.run.status, the same predicate startLiveLoop() uses at workspace-verbs.js:69 to
+ * decide whether a run is even worth polling. Reason at the time: renderDetail()'s
+ * unconditional V.startLiveLoop() call (workspace-app.js:151) schedules a
+ * setTimeout(tick, 0) on any still-running run; that tick's first resolution repainted
+ * #seats-body via applyLive's direct renderSeats() call (workspace-verbs.js:130), whose own
+ * leaver-removal (workspace-render.js:220-222) immediately deleted the `dead:`-keyed row
+ * renderSeatsPanel had just appended — a one-frame flash-then-vanish that read as a glitch,
+ * not a feature — so gating on terminal simply hid dead rows until no further tick could
+ * un-paint them. PR4b (Christian's mid-poll ruling on PR 102) replaced that gate with tick
+ * re-append: applyLive() now calls appendDeadRows() (below) immediately after every
+ * renderSeats() repaint (workspace-verbs.js:130-131), restoring the row the SAME tick that
+ * just wiped it instead of leaving it hidden. renderSeatsPanel() below no longer checks
+ * TERMINAL_STATUSES at all — dead rows paint unconditionally, on a live run or a done one.
+ */
+(function () {
+  'use strict';
+
+  function renderSeatsPanel() {
+    var A = window.AmicusApp;
+    var d = A.state.detail;
+    var seats = window.AmicusLive.seatsFromRunStats(d.derived.cost.rows);
+    var tbody = A.$('seats-body');
+    window.AmicusRender.renderSeats(tbody, seats, A.state.blind, A.labelOf);
+    var seatLoss = d.verdict && d.verdict.seatLoss;
+    var runMeta = { critic: (d.run && d.run.critic) || null };
+    // Source-selection (v4.6.3 PR2, spec D4): run-degrade.js swallows checkpoint failures, so
+    // verdict.json can carry degrade records run.json's own checkpoint lost — fall back to it
+    // ONLY when run.degrades is empty/absent. A fallback, never a union: both docs can carry
+    // records for the SAME run, and the persisted run.json copy is authoritative when present.
+    var deg = (d.run && d.run.degrades && d.run.degrades.length) ? d.run.degrades
+      : ((d.verdict && d.verdict.degrades) || []);
+    var dead = window.AmicusLive.deadSeats(deg, seatLoss, seats, runMeta);
+    renderDeadSeatRows(tbody, dead, A.state.blind, A.labelOf);
+  }
+
+  /**
+   * Paints the dead-seat rows appended after live rows. Deliberately NOT
+   * folded into workspace-render.js's renderSeats (293/300 — must not grow)
+   * and NOT run through its keyed diff: dead rows carry no per-tick-changing
+   * field, so a full rebuild every call is correct and cheap, and renderSeats
+   * just above already self-cleans any PRIOR dead row as an unrecognized
+   * `data-key` (its own seen-set only knows about the live `seats` it was
+   * just given), so nothing here needs to track dead rows across calls.
+   *
+   * Cells route through window.AmicusLive.seatCells(...) — the SAME function
+   * live rows use — so name masking (and every other column's blank/em-dash
+   * convention) matches exactly, not a reimplementation. Two overrides after
+   * the call: index 0 (name, blind-ON-and-unlabeled dead seats only — see the
+   * comment at that line) and index 6 (cost). seatCells would dash() a
+   * missing costDisplay to '—', indistinguishable from a seat that ran but
+   * whose cost is merely unmeasured (see cost-unknown-display.test.js) — a
+   * dead seat has no cost concept at all, so that cell renders empty instead
+   * (D6: "no cost cell").
+   */
+  function renderDeadSeatRows(tbody, dead, blindOn, labelOf) {
+    (dead || []).forEach(function (seat) {
+      var cells = window.AmicusLive.seatCells(
+        { model: seat.model, role: seat.role, status: seat.statusText, stalled: false }, blindOn, labelOf);
+      // Fix wave 2 (smoke-caught, GUI smoke on real degraded run 12c96b6b): dead seats never
+      // produce a review, so state.labelByModel (built from the run's names derivation — models
+      // that DID review) never carries them; seatCells' own `blindOn && label ? label : alias`
+      // fallback is LOAD-BEARING for LIVE rows (RN-9/F36, live-model.js) and stays untouched, but
+      // for a dead seat that fallback leaks the raw model name under blind — precisely the seat
+      // blind mode most needs to hide. Placeholder ONLY when blind is on AND no label resolved;
+      // a label that DOES resolve (possible in principle) still wins via seatCells' own cell.
+      if (blindOn && !(labelOf && labelOf(seat.model))) { cells[0] = '(masked)'; }
+      cells[6] = '';
+      var row = window.AmicusRender.el('tr',
+        { className: 'seat-dead', dataset: { key: 'dead:' + seat.model } },
+        cells.map(function (c, i) {
+          return window.AmicusRender.el('td',
+            { className: window.AmicusRender.seatCellClass(i) }, [c]);
+        }));
+      tbody.appendChild(row);
+    });
+  }
+
+  /**
+   * Live-tick twin of renderSeatsPanel's dead block (PR4b, Christian's mid-poll
+   * ruling on PR 102): applyLive's renderSeats repaint wipes dead:-keyed rows
+   * (leaver-removal), so every tick re-appends from the tick's own payload.
+   * seatLoss comes from state.detail (absent mid-run — the critic's own
+   * dead-leg degrade covers it live; the terminal refresh unions the rest).
+   */
+  function appendDeadRows(live) {
+    var A = window.AmicusApp;
+    var d = A.state.detail;
+    var seatLoss = d && d.verdict ? d.verdict.seatLoss : null;
+    var runMeta = { critic: (d && d.run && d.run.critic) || null };
+    // Source-selection (v4.6.3 PR2, spec D4), live-path twin of renderSeatsPanel's fallback
+    // above: the tick's own live.degrades wins when non-empty; state.detail.verdict.degrades is
+    // usually absent mid-run (verdict.json doesn't exist until the run finishes) — fine, this
+    // branch only matters for the rare same-run reopen where a prior terminal fetch already
+    // populated state.detail.verdict.
+    var deg = (live.degrades && live.degrades.length) ? live.degrades
+      : ((d && d.verdict && d.verdict.degrades) || []);
+    var dead = window.AmicusLive.deadSeats(deg, seatLoss, live.seats || [], runMeta);
+    renderDeadSeatRows(A.$('seats-body'), dead, A.state.blind, A.labelOf);
+  }
+
+  window.AmicusSeats = {
+    renderSeatsPanel: renderSeatsPanel,
+    renderDeadSeatRows: renderDeadSeatRows,
+    appendDeadRows: appendDeadRows,
+  };
+})();

package/electron/workspace-ui/workspace-verbs.js

@@ -66,7 +66,7 @@
     var A = window.AmicusApp;
     stopLiveLoop();
     var d = A.state.detail;
-    if (!d || !d.run || window.AmicusLive.TERMINAL_STATUSES.indexOf(d.run.status) !== -1) { return; }
+    if (!d || !d.run || window.AmicusLive.isTerminal(d.run.status)) { return; }
     var epoch = A.state.liveEpoch; // F42: stopLiveLoop() above just bumped it; this chain owns it
     var tick = function () {
       // F42: pin the id PER TICK and SEND the pinned id — matching the reply against
@@ -128,6 +128,7 @@
     // `live.ok` is true, so this is simply "always paint," empty roster included.
     if (live.seats) {
       R.renderSeats(A.$('seats-body'), live.seats, A.state.blind, A.labelOf);
+      window.AmicusSeats.appendDeadRows(live);
     }
     // F42: state.detail can be swapped/absent under a tick — never deref .derived unguarded.
     var derived = A.state.detail && A.state.detail.derived ? A.state.detail.derived : null;

package/electron/workspace-ui/workspace.css

@@ -112,6 +112,12 @@ mark { background: var(--gold-soft); color: var(--gold-400); border-radius: var(
 .table td { border-bottom: var(--bd); padding: var(--space-3) var(--space-4); }
 .table td.num, .table th.num { text-align: right; font-family: var(--font-mono); }
 .stalled-flag { color: var(--warn); }
+/* Task 2 (v4.6.2 PR4, "dead-seat rows"): an announced-dead seat's row —
+   muted like every other "nothing to see here" surface (.empty-note,
+   .chip.aborted, .stage.skipped, .rail-project all key off --text-3), never
+   the warn/danger colors those two-line notes use — a dead seat is a fact
+   already fully explained in the banner/verdict, not a NEW alarm here. */
+tr.seat-dead td { color: var(--text-3); }
 
 /* ---- matrix tier rows (report-html light-ground pairs, as token vars) -- */
 .matrix-wrap { overflow-x: auto; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.6.1",
+  "version": "4.6.3",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/alias-audit.schema.json

@@ -12,6 +12,11 @@
     "staleCount": { "type": "number" },
     "stale": { "type": "array", "items": { "type": "object" } },
     "gatewayFindingsCount": { "type": "number" },
-    "gatewayFindings": { "type": "array", "items": { "type": "object" } }
+    "gatewayFindings": { "type": "array", "items": { "type": "object" } },
+    "driftedCount": { "type": "number" },
+    "drifted": { "type": "array", "items": { "type": "object" } },
+    "probeCount": { "type": "number" },
+    "probe": { "type": "array", "items": { "type": "object" } },
+    "probeSkipped": { "type": ["string", "null"] }
   }
 }

package/schemas/council-run.schema.json

@@ -102,6 +102,20 @@
         }
       }
     },
+    "chairAttempts": {
+      "description": "v4.6.2 PR5 (LC-5): one entry per resolved chair fallback-walk attempt (ch1/ch2/ch3 — the ch4 VERDICT-line repair is not an attempt, see classifyChairAttempt), checkpointed incrementally so a mid-walk kill preserves the attempts already resolved. Additive; absent on chairless (cost-skipped) runs and on every pre-PR5 run.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["waveId", "model", "outcome"],
+        "properties": {
+          "waveId": { "type": "string" },
+          "model": { "type": "string" },
+          "outcome": { "enum": ["completed", "error", "timeout", "no-output"] },
+          "reason": { "type": ["string", "null"] }
+        }
+      }
+    },
     "debate": {
       "type": "object",
       "properties": {

package/src/cli-handlers-council.js

@@ -162,6 +162,15 @@ function runVerdict(args, useJson) {
         hint: 'pass a valid decisions.json array or omit --decisions' });
     }
   }
+  // R1 (v4.6.3): parseArgs records a valueless trailing -o/--out as boolean
+  // true (and --out= as ''). The boolean crashes writeVerdictAtomic mid-write
+  // (renameSync TypeError on a non-string path) leaving an orphaned
+  // true.tmp-<pid>; the empty string silently falls through to the default
+  // path. Name the flag and refuse both — the unknown-flag precedent.
+  if (args.out !== undefined && (typeof args.out !== 'string' || args.out === '')) {
+    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: '-o/--out requires a value',
+      hint: 'amicus council verdict <tally.json> [--decisions <decisions.json>] [-o|--out <out.json>]' });
+  }
   const outPath = args.out || './verdict.json';
   let verdict;
   try {

package/src/cli-handlers-doctor.js

@@ -12,6 +12,8 @@ const electronMcpCheck = require('./utils/doctor-electron-mcp-check');
 // local-providers check body (v4.2 §4.7 C8) — split out to keep this file
 // under the gate (mirrors the engineCheck/mcpChecks split above).
 const localProvidersCheck = require('./utils/doctor-local-providers-check');
+// v4.6.2 PR1 (spec §4) — the 'anthropic-base-url' check body.
+const baseUrlCheck = require('./utils/doctor-base-url-check');
 
 const MAX_CATALOG_AGE_MS = 24 * 60 * 60 * 1000; // 24h (mirrors model-catalog DEFAULT_MAX_AGE_MS)
 
@@ -38,6 +40,7 @@ function realDeps() {
     readCache: () => require('./utils/model-catalog').readCache(),
     collectAliasSources: () => require('./utils/alias-audit').collectAliasSources(),
     findStaleAliases: (s, c) => require('./utils/alias-audit').findStaleAliases(s, c),
+    findDriftedStoredAliases: (s, c) => require('./utils/alias-audit').findDriftedStoredAliases(s, c),
     hasOpencodeBinary: () => {
       // Single source of truth shared with the runtime server-start guard.
       const { ensureNodeModulesBinInPath, hasOpencodeBinary } = require('./utils/path-setup');
@@ -77,10 +80,14 @@ function realDeps() {
     now: () => Date.now(),
     listSessionIndexTmpFiles: () => tmpSweep.listSessionIndexTmpFiles(), // B15
     unlinkSessionIndexTmp: (n) => tmpSweep.unlinkSessionIndexTmp(n),
+    listSessionMetadataTmpFiles: () => metaSweep.listSessionMetadataTmpFiles(), // D8
+    unlinkSessionMetadataTmp: (n) => metaSweep.unlinkSessionMetadataTmp(n),
   };
 }
 // B15: sweep logic in utils/session-index-tmp-sweep.js (mirrors mcp-legacy's split).
 const tmpSweep = require('./utils/session-index-tmp-sweep');
+// D8: per-session metadata.json sibling sweep — utils/session-metadata-tmp-sweep.js.
+const metaSweep = require('./utils/session-metadata-tmp-sweep');
 
 /** Run one guarded check; a thrown fn becomes an error line. */
 function guard(id, name, fn) {
@@ -105,10 +112,10 @@ async function runDoctorChecks(depsOverride = {}) {
   const checks = [];
 
   checks.push(guard('node', 'Node.js', () => {
-    const major = parseInt(String(d.nodeVersion).replace(/^v/, '').split('.')[0], 10);
-    return major >= 18
+    const [maj, min] = String(d.nodeVersion).replace(/^v/, '').split('.').map(n => parseInt(n, 10));
+    return (maj > 22 || (maj === 22 && min >= 12))
       ? { id: 'node', name: 'Node.js', status: 'ok', message: d.nodeVersion, hint: null }
-      : { id: 'node', name: 'Node.js', status: 'error', message: `${d.nodeVersion} (need >=18)`, hint: 'Install Node 18 or newer from https://nodejs.org' };
+      : { id: 'node', name: 'Node.js', status: 'error', message: `${d.nodeVersion} (need >=22.12)`, hint: 'Install Node 22.12 or newer from https://nodejs.org' };
   }));
 
   checks.push(guard('config-dir', 'Config directory', () => (
@@ -148,12 +155,21 @@ async function runDoctorChecks(depsOverride = {}) {
   checks.push(guard('aliases', 'Model aliases', () => {
     const cache = d.readCache();
     const catalog = (cache && cache.models) || [];
-    const stale = d.findStaleAliases(d.collectAliasSources(), catalog);
-    return stale.length === 0
-      ? { id: 'aliases', name: 'Model aliases', status: 'ok', message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null }
-      : { id: 'aliases', name: 'Model aliases', status: 'warn', message: `${stale.length} stale: ${stale.map(s => s.alias).join(', ')}`, hint: 'amicus models --check' };
+    const sources = d.collectAliasSources();
+    const stale = d.findStaleAliases(sources, catalog);
+    const drifted = d.findDriftedStoredAliases(sources, catalog);
+    if (stale.length === 0 && drifted.length === 0) {
+      return { id: 'aliases', name: 'Model aliases', status: 'ok', message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null };
+    }
+    const parts = [];
+    if (stale.length) { parts.push(`${stale.length} stale: ${stale.map(s => s.alias).join(', ')}`); }
+    if (drifted.length) { parts.push(`${drifted.length} drifted: ${drifted.map(s => s.alias).join(', ')}`); }
+    return { id: 'aliases', name: 'Model aliases', status: 'warn', message: parts.join('; '), hint: 'amicus models --check' };
   }));
 
+  checks.push(guard('anthropic-base-url', 'ANTHROPIC_BASE_URL',
+    () => baseUrlCheck.evaluateAnthropicBaseUrl(d)));
+
   checks.push(guard('opencode-bin', 'OpenCode binary', () => (
     d.hasOpencodeBinary()
       ? { id: 'opencode-bin', name: 'OpenCode binary', status: 'ok', message: 'found', hint: null }
@@ -189,6 +205,8 @@ async function runDoctorChecks(depsOverride = {}) {
 
   checks.push(guard('sessions-index-tmp', 'Session index tmp files', () => tmpSweep.evaluateSessionIndexTmpSweep(d)));
 
+  checks.push(guard('session-metadata-tmp', 'Session metadata tmp files', () => metaSweep.evaluateSessionMetadataTmpSweep(d)));
+
   // #43: OpenRouter credit/free-tier — warns (never errors); skipped when no key.
   checks.push(await guardAsync('openrouter-credit', 'OpenRouter credit', async () => {
     const values = d.readApiKeyValues() || {};

package/src/cli.js

@@ -149,6 +149,7 @@ const BOOLEAN_FLAGS = [
      'md',                   // council report: emit Markdown (default)
      'fix',                  // doctor: self-heal fixable checks in place (#56)
      'strict',               // models --check: exit non-zero on curated per-gateway drift (#gwid Task 6)
+     'live',                 // models --check: opt-in probe of stored aliases with real engine legs (v4.6.2 PR3, spec §6)
      'render',               // council verdict: also refresh report.html next to the decided verdict
      'claude',               // init: register for Claude Code only (Task 15)
      'desktop',              // init: register for Claude Desktop only (Task 15)
@@ -501,6 +502,9 @@ Options for 'models':
   --strict                     With --check: also exit non-zero on curated
                                per-gateway drift (stale/divergent direct or
                                openrouter forms). Informational without it.
+  --live                       With --check: probe every stored alias with one real
+                               engine leg (spends) — served / accepted-but-silent /
+                               error. Requires --check.
   --json                       Machine-readable output
 `,
   list: `

package/src/council/presets-cli.js

@@ -45,18 +45,22 @@ function runSave(name, modelsArg, useJson) {
       hint: 'each member must be a known alias (see `amicus models`) or a provider/model id containing "/"' });
   }
   const overwritten = !!getCouncil(name);
+  const shadowsBuiltin = listBuiltinCouncilNames().includes(name);
   const cfg = loadConfig() || {};
   if (!cfg.councils) { cfg.councils = {}; }
   cfg.councils[name] = members;
   saveConfig(cfg);
-  const doc = { ok: true, name, models: members, overwritten };
+  const doc = { ok: true, name, models: members, overwritten, shadowsBuiltin };
   process.stdout.write(useJson ? JSON.stringify(doc, null, 2) + '\n' : renderSave(doc));
   return 0;
 }
 
 function renderSave(doc) {
   const notice = doc.overwritten ? ' (overwritten)' : '';
-  return `Saved council '${doc.name}'${notice}: ${doc.models.join(', ')}\n` +
+  const shadow = doc.shadowsBuiltin
+    ? `  note: '${doc.name}' now shadows the built-in bench of the same name — 'amicus council list' shows both\n`
+    : '';
+  return `Saved council '${doc.name}'${notice}: ${doc.models.join(', ')}\n` + shadow +
     "  for full run configuration — chair, options, templates — see 'amicus pack'\n";
 }