amicus 4.6.2 → 4.7.0

package/docs/usage.md

@@ -9,7 +9,7 @@ The `am` alias is interchangeable with `amicus` everywhere.
 amicus start --model <model> --prompt "<task>"
 amicus start --model <model> --prompt-file briefing.md --no-ui --json
 amicus fanout --models "gemini,deepseek,gpt" --prompt "Review this" --json
-amicus list [--status <filter>] [--all] [--json]
+amicus list [--status <filter>] [--all] [--search <q>] [--limit <n>] [--json]
 amicus resume <task_id> [--no-ui --json]
 amicus continue <task_id> --prompt "Next step..." [--no-ui --json]
 amicus read <task_id> [--conversation|--metadata|--json]
@@ -96,6 +96,7 @@ amicus start --model deepseek --prompt "Generate tests" --no-ui --timeout 30
 | `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`). | |
 | `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. | |
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. | |
+| `--tag <t>` | Label this session for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; invalid values are rejected, never silently cleaned). | *(none)* |
 
 > Agents: **Chat** auto-approves reads and asks before writes/bash (interactive default); **Build** has full tool access (headless default); **Plan** is read-only analysis. `--agent Chat` is interactive-only and incompatible with `--no-ui`.
 
@@ -126,6 +127,7 @@ amicus fanout --council free --prompt "Review this design" --json
 | `--wave-id <id>` | Set the wave ID explicitly; leg IDs become `<wave-id>-1` … `<wave-id>-N`. |
 | `--session-id <id\|"current">` | Session ID to pull shared context from (default `current`). Same semantics as on `start`. |
 | `--json` | Emit the wave document on stdout. |
+| `--quiet` | Suppress per-leg progress ticks and the final wave-result summary (preflight errors are suppressed too). |
 | `--max-cost <$>` | Refuse the wave if the estimated total exceeds `$` (soft ceiling). |
 | `--no-cost-gate` | Disable the budget gate (per-$/Mtok threshold + ceiling) for this run. |
 | `--no-validate-model` | Skip catalog validation. |
@@ -134,6 +136,7 @@ amicus fanout --council free --prompt "Review this design" --json
 | `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`), shared by every leg. |
 | `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. |
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
+| `--tag <t>` | Label this wave (and every leg's spend row) for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; rejected, not cleaned). Mutually exclusive with `--retry-failed` (`BAD_ARGS`). |
 
 **Shared per-leg knobs.** Every leg in the wave also accepts the same per-leg options as `start`:
 `--agent`, `--thinking`, `--timeout`, `--summary-length`, `--no-context`, `--context-*`, `--mcp*`,
@@ -187,7 +190,7 @@ amicus council run --prompt-file briefing.md --models gemini,glm --chair deepsee
 | `--chair <model>` | Verdict synthesizer. Default `deepseek`; must **not** be a bench seat (pre-flight error). |
 | `--critic <model>` | Optional adversarial seat; must **be** a bench seat. Mutually exclusive with `--lenses`. |
 | `--lenses <s1,s2,...>` | Expert lenses, one per seat (count must equal seat count); forces `--no-ledger` semantics. |
-| `--out-dir <dir>` | Run directory. Default `./council-<runId>/`. |
+| `--out-dir <dir>` | Run directory. Default `./council-<runId>/`. Must resolve inside the project directory — a path that escapes it is rejected with `BAD_ARGS`. |
 | `--json` | Emit the council-run document on stdout (error envelope + documented exit codes on failure). |
 | `--max-cost <$>` | **Whole-run** ceiling on **known** spend, checked before each paid stage launch. A leg whose cost cannot be determined does not count against it and never halts the run; when the total is inexact and a ceiling is set, the run exits `2`. |
 | `--timeout <min>` | **Per-leg** timeout (fanout semantics); bound the aggregate with your CI job timeout. |
@@ -199,6 +202,7 @@ amicus council run --prompt-file briefing.md --models gemini,glm --chair deepsee
 | `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`). |
 | `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. |
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
+| `--tag <t>` | Label this run for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; rejected, not cleaned). Every stage's sub-waves (Stage-1, critic/lens solos, Stage-2, chair, debate) carry the same tag on their wave metadata. |
 
 **Exit codes:** `0` full run · `2` degraded but reportable (fewer than 2 judges, chair failure —
 `overallVerdict: null` — a cost ceiling hit after the tally, or a `--max-cost` ceiling set over a
@@ -254,7 +258,7 @@ amicus template show review                # Print a template's raw text
 amicus start --model gemini --template review --artifact plan.md --var focus=performance --no-ui --json
 ```
 
-**Known variables** (`src/template/render.js`): `{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}` (`YYYY-MM-DD`), `{{project}}`, `{{var.<key>}}` (from repeatable `--var key=value`). There is no `{{input}}` in v4.5 — that chaining variable, and the `critique`/`refine` built-ins that need it, arrive with v4.6's composable waves.
+**Known variables** (`src/template/render.js`): `{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}` (`YYYY-MM-DD`), `{{project}}`, `{{var.<key>}}` (from repeatable `--var key=value`). There is no `{{input}}` in v4.5 — that chaining variable, and the `critique`/`refine` built-ins that need it, arrive with composable waves (`--input-from`) in a future release.
 
 **Strict by design — a typo fails loudly instead of silently dropping text:**
 
@@ -302,6 +306,8 @@ Then invoke it with `--pack <name|path>` on `start` / `fanout` / `council run`
 
 Every kind may also carry `description`, `version` (semver, default `1.0.0`), and `briefing.template` (a template **reference**, not rendered text — a pack never captures briefing prose).
 
+The `version` field is set with **`--pack-version <semver>`**, not `--version` — the latter is amicus's own global "print the version" flag, which is intercepted before command dispatch and so can never carry a pack's version. `pack save --version` is rejected with `BAD_ARGS` naming the right spelling.
+
 **Precedence: flag > pack > config default > built-in default.** A pack only fills in values you didn't type explicitly on the command line — anything you do pass always wins, and the pack is recorded on the run either way (see below), so a hand-tuned invocation of a saved pack is never ambiguous about what actually ran.
 
 **`--from-run <id>`** builds a pack from an existing council run, fanout wave, or solo session instead of flags — resolution order is council pointer → wave `metadata.json` → solo `metadata.json`. It captures the bench/model, chair/critic/lenses, and the run options that were actually used; **briefing text is never captured**, only a template *reference* when the source run recorded one.
@@ -356,7 +362,7 @@ pack. Confirmed against the run's own `run.json` for this exact invocation (irre
 {
   "bench": ["gemini", "deepseek", "gpt"],
   "chair": "opus",
-  "pack": { "name": "review-bench", "hash": "da084ba56162", "source": "dir" },
+  "pack": { "name": "review-bench", "version": "1.0.0", "hash": "da084ba56162", "source": "dir" },
   "options": { "timeout": 20, "maxCost": 2, "gateway": "auto", "outDir": "..." }
 }
 ```
@@ -372,16 +378,23 @@ pack is still recorded on the run either way.
 Amicus does **not** ship a frozen table of model names. Aliases and validation resolve against a **live catalog** fetched from provider APIs and cached at `~/.config/amicus/model-catalog.json` (24-hour TTL; the fetch works without an API key).
 
 ```bash
-amicus models                 # List the catalog
-amicus models --search gemini # Filter by substring over id and name
-amicus models --refresh       # Force-refresh from provider APIs
-amicus models --check         # Audit your aliases against the catalog
-amicus models --check --live  # + probe every stored alias with a real leg (spends)
+amicus models                  # List the catalog
+amicus models --search gemini  # Filter by substring over id and name
+amicus models --refresh        # Force-refresh from provider APIs
+amicus models --check          # Audit your aliases against the catalog
+amicus models --check --strict # + exit non-zero on curated per-gateway drift too
+amicus models --check --live   # + probe every stored alias with a real leg (spends)
 ```
 
 `amicus models --check` exits with the **number of stale aliases** (capped at 100) and prints same-vendor replacement suggestions for each, so it drops cleanly into CI.
 
-**Drifted aliases.** `--check` (and the `doctor` aliases row) also flags **`DRIFTED:`** stored aliases — a stored alias whose target is still catalog-listed but no longer matches any route its family currently resolves to (the v4.6.1 `gemini` release-gate class, where `doctor` stayed green while the model behind it had moved on). Each drift line prints the exact `amicus setup --add-alias <alias>=<current>` refresh command. Drift is informational only — unlike stale aliases, it never changes the exit code.
+**Gateway-only routes.** A curated alias whose direct form is *derived* from its OpenRouter route (rather than
+authored) is not reported STALE when that direct form is missing from the vendor's
+direct namespace while the OpenRouter route still serves — a gateway-only route with
+no direct sibling is a routing choice, not staleness. Deliberately gateway-only
+entries (e.g. `gpt-pro`) are annotated as such and are never offered a retarget.
+
+**Drifted aliases.** `--check` (and the `doctor` aliases row) also flags **`DRIFTED:`** stored aliases — a stored alias whose target is still catalog-listed but no longer matches any route its family currently resolves to (the v4.6.1 `gemini` release-gate class, where `doctor` stayed green while the model behind it had moved on). Each drift line prints the exact `amicus setup --add-alias <alias>=<current>` refresh command. Drift is informational only by default and does not change the exit code — pass `--strict` alongside `--check` to make curated per-gateway drift (stale or divergent direct/OpenRouter forms) exit non-zero too.
 
 **Live probe (`--check --live`).** Presence in the catalog is not proof of service — a stored alias can point at a model id the catalog still lists but the provider has quietly stopped serving (the v4.6.1 `gemini` incident). `--check` alone can't see that; `--live` can, by actually asking. Scope is **stored aliases only** (`amicus setup --add-alias`) — curated defaults follow the catalog by construction and have no "was it actually served" question for a live probe to answer. **This spends real money — one tiny leg per stored alias** — every probed alias gets one ordinary engine leg on a single quiet fan-out wave, with a real session dir and a real spend-ledger row, exactly as if you'd run it yourself.
 
@@ -418,7 +431,9 @@ Each stored alias resolves to one of three outcomes:
 amicus list                          # Current project
 amicus list --status running         # Filter: running, complete, error, timed-out,
                                       #         aborted, crashed, idle-timeout
-amicus list --all                    # All projects
+amicus list --all                    # All projects (cross-project, via the session index)
+amicus list --search foo             # Substring match: id, tag, briefing material (case-insensitive)
+amicus list --limit 20               # Only the 20 newest rows (0 = unlimited); pairs well with --all
 amicus list --json                   # Machine-readable
 
 amicus read <id>                     # Fold summary (default)
@@ -444,6 +459,43 @@ amicus setup --api-keys              # Open just the API-key window
 amicus setup --add-alias fast=google/gemini-2.5-flash   # Add/override one alias (bare canonical)
 ```
 
+**`amicus list` flags.** The CLI and the MCP `amicus_list` tool share one enumeration
+(`src/sidecar/read.js`'s `enumerateSessions`) for ordinary start/fanout rows, so those rows carry
+the same core fields everywhere: `id`, `model`, `status`, `mode` (`interactive`/`headless`),
+`type` (`run` by default), `parentWave` (`null` unless the row is a fan-out leg), `legCount`
+(`null` unless the row is a wave), and `tag` — the one field that's omitted, not `null`, when the
+session has none. The human-readable CLI table adds a `TAG` column. Council-run rows are an
+**MCP-only** row class: the CLI's own directory scan skips their `council-<runId>.json` pointer
+files (a pointer's filename fails the session-ID pattern every other row's directory name must
+match), so `amicus list` never shows a council run — only the MCP `amicus_list` tool merges them
+in, each carrying `type: 'council-run'`, a fixed `mode: 'headless'`, and its own 80-char sanitized
+`briefing` preview plus a `stage` field naming whichever stage is currently running. The MCP tool
+also re-sanitizes every other row's `briefing` to that same 80-char cap and, for any row still
+`status: 'running'`, adds live-progress fields (`phase`, `messageCount`, `lastActivityAt`,
+`latestPreview`) — enrichments the CLI table doesn't apply, since it prints the raw 30-char slice
+in-line instead. `--all` (CLI only) enumerates every project the global, advisory sessions-index
+knows about, deduped by canonical project identity, and stamps each row's `project` field (the
+CLI table adds a trailing `PROJECT` column whenever `--all` is set); a stale index entry pointing
+at a missing or unreadable project is skipped rather than surfaced as an error. `--search <q>`
+(both surfaces) is a case-insensitive substring filter over `id`, `tag`, and briefing material: a
+fan-out wave row reads its full `briefing.md` off disk (falling back to the row's 200-char excerpt
+if that file isn't readable), and a leg row (one spawned by a wave) matches on `id`/`tag` only —
+its briefing is the parent wave's, and matching it there would surface the same wave once per leg
+it spawned. On the MCP tool specifically, a council-run row's search material is `briefing.md`
+written at MCP launch time, or falls back to the portion of `briefing-stage1.md` after
+`--- MATERIAL / BRIEFING ---` (CLI-launched runs only ever have the latter file) — this clause is
+MCP-only, since the CLI never lists a council row to search in the first place. A bare `--search`
+with no value is a usage error on the CLI. Tag itself is set at launch with `--tag <t>` on
+`start`/`fanout`/`council run` (see those sections above), and is also a dimension for
+`amicus spend --group-by tag`.
+
+**Known limitation: a tag is not inherited.** `--tag` only ever gets written at launch. `amicus
+continue` and `amicus resume` write their spend rows with no tag, and a `fanout --retry-failed`
+wave does not carry the original wave's tag either (`--tag` combined with `--retry-failed` is
+rejected as a usage error). Since the spend ledger writes `tag: null` whenever none was set, those
+rows group under `(unattributed)` in `amicus spend --group-by tag` rather than under the tag their
+lineage started with.
+
 **`amicus status <id>` output.** Human-readable:
 
 ```
@@ -462,7 +514,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.6.2",
+  "version": "4.7.0",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
@@ -514,7 +566,7 @@ Runs every check below, in order, and prints a ✓/⚠/✗ line for each plus a
 
 | Check | What it verifies | Can fail as |
 |---|---|---|
-| `node` | Node.js ≥ 18 | error |
+| `node` | Node.js ≥ 22.12 | error |
 | `config-dir` | The resolved config directory | *(always ok)* |
 | `keys` | At least one cloud-vendor key configured | error |
 | `default-model` | Your default model alias resolves | error |
@@ -528,13 +580,14 @@ Runs every check below, in order, and prints a ✓/⚠/✗ line for each plus a
 | `mcp` | Amicus is registered as an MCP server in Claude Code | warn |
 | `mcp-legacy` | No duplicate legacy `sidecar` MCP entry survives alongside `amicus` | warn |
 | `sessions-index-tmp` | No orphaned `sessions-index.json.*.tmp` files | warn |
+| `session-metadata-tmp` | No orphaned per-session `.metadata.json.*.tmp` files (the B09 class) | warn |
 | `openrouter-credit` | Remaining OpenRouter credit (skipped — reports `ok` — when no OpenRouter key is set) | warn |
 | `local-providers` **(v4.2)** | Every provider in `config.providers` is reachable | warn |
 | `project-root` | Your cwd looks like a real project, not an app/install dir | warn |
 
 **`local-providers`** probes every configured local provider (2s timeout each) the same way `amicus provider test` does, and reports per-id reachability in one line, e.g. `ollama: 3 models @ http://127.0.0.1:11434/v1; my-vllm: unreachable @ http://127.0.0.1:8000/v1`. No providers configured at all is a plain `ok` ("none configured") — this check can never fail your doctor run outright, only warn: a napping `ollama serve` isn't treated as broken setup.
 
-`--fix` self-heals four of the checks above in place: reprovisions Electron, copies the OpenCode engine into a broken npx-cache install, removes a duplicate legacy MCP entry, and sweeps orphaned session-index tmp files (only ones older than 60s). It does **not** start a local server for you — `local-providers` stays a warning until you start the server yourself.
+`--fix` self-heals five of the checks above in place: reprovisions Electron, copies the OpenCode engine into a broken npx-cache install, removes a duplicate legacy MCP entry, sweeps orphaned session-index tmp files, and sweeps orphaned per-session metadata tmp files (both tmp sweeps only ones older than 60s). It does **not** start a local server for you — `local-providers` stays a warning until you start the server yourself.
 
 Exit code is `1` if anything is `error`, else `0` (same rule drives `--json`'s `ok` field).
 
@@ -568,7 +621,7 @@ Reads `~/.config/amicus/spend-ledger.jsonl` (one row per completed run/leg) and
 | `--model <id-or-prefix>` | rows whose model id starts with the given string |
 | `--op <op>` | rows for one operation (`start`, `leg`, `continue`, `resume`, …) |
 | `--failed` | rows with an explicit non-`complete` status (see the caveat below) |
-| `--group-by <dim>` | bucket totals by `model` (default) \| `wave` \| `council` \| `project` \| `op` \| `day` |
+| `--group-by <dim>` | bucket totals by `model` (default) \| `wave` \| `council` \| `project` \| `op` \| `day` \| `tag` (untagged rows group under `(unattributed)`) |
 | `--rows` | also emit the raw filtered rows (capped at 1000; `--json` sets `rowsTruncated: true` past the cap) |
 
 All filters compose, e.g. `amicus spend --project . --group-by model --since 7d`.

package/electron/workspace-ui/index.html

@@ -105,6 +105,9 @@
   <!-- ⚠️ D8 extraction (Task 1, v4.6.2 PR4): workspace-seats.js must load BEFORE
        workspace-panels.js, whose renderSeatsPanel delegates to it. -->
   <script src="./workspace-seats.js"></script>
+  <!-- ⚠️ v4.7 PR7 extraction: workspace-lazy.js must load BEFORE workspace-panels.js,
+       whose wireLazyPanels/proseLoader delegate to it. -->
+  <script src="./workspace-lazy.js"></script>
   <!-- ⚠️ DE-ROT (F05): panels + verbs are the Task 13 split of workspace-app.js.
        Load order matters: workspace-app.js boots last and owns `state`. -->
   <script src="./workspace-panels.js"></script>

package/electron/workspace-ui/live-model.js

@@ -37,9 +37,17 @@
     return (state.visible && state.focused) ? 1500 : 5000;
   }
 
+  /** True when `status` is a terminal run status. The single consumption
+   * point for TERMINAL_STATUSES membership (v4.6.3 PR2 dedup) — the array
+   * itself stays exported and byte-identical to src/workspace/run-detail.js
+   * (drift-pinned). */
+  function isTerminal(status) {
+    return TERMINAL_STATUSES.indexOf(status) !== -1;
+  }
+
   /** Blind default per spec resolved Q2: ON live, OFF terminal. */
   function defaultBlind(status) {
-    return TERMINAL_STATUSES.indexOf(status) === -1;
+    return !isTerminal(status);
   }
 
   function dash(v) {
@@ -86,9 +94,27 @@
     ];
   }
 
+  // v4.7 D6/E1: three row-per-launch producer roles added alongside the
+  // existing chair-attempt (run-chair.js), repair (run-stages.js/
+  // run-stage2.js/run-chair.js) and superseded (run-stages.js + debate.js)
+  // rows — launch-accounting extras, not seats, and unlike rebuttal/revote
+  // (F37, kept rendering on purpose below) they have no seats-panel meaning
+  // of their own. There is no pre-existing allowlist in this function (E1) —
+  // this is a plain exclusion added on top of the untouched id/shape logic.
+  // Object.create(null): a plain `{...}` literal inherits Object.prototype, so a role
+  // literally named 'constructor'/'toString'/etc would resolve to an inherited (truthy)
+  // function via bracket lookup instead of `undefined` — silently mis-excluding (or
+  // mis-including) that seat. A null-prototype object has no inherited keys to collide with.
+  var SEATS_PANEL_EXCLUDED_ROLES = Object.create(null);
+  SEATS_PANEL_EXCLUDED_ROLES['chair-attempt'] = true;
+  SEATS_PANEL_EXCLUDED_ROLES.repair = true;
+  SEATS_PANEL_EXCLUDED_ROLES.superseded = true;
+
   /** Terminal fallback: derive seat-shaped rows from tally runStats cost rows. */
   function seatsFromRunStats(costRows) {
-    return (costRows || []).map(function (r) {
+    return (costRows || []).filter(function (r) {
+      return !SEATS_PANEL_EXCLUDED_ROLES[r.role];
+    }).map(function (r) {
       return {
         // ⚠️ DE-ROT (F37): composite id — a v4.1 `--debate` run emits extra runStats rows for
         // the SAME bench alias (role 'rebuttal'/'revote', src/council/debate.js:88-96). With no
@@ -122,28 +148,79 @@
    * loss, an out-of-range index, or a zero-model unit) carry neither, so they
    * correctly fall back to the plain phrasing.
    *
-   * D6 filter (zero usable legs ONLY, "no ghost when a retry succeeded"): a
-   * candidate already present in `liveSeats` (it has a cost row — SL-2 healed
-   * it) is dropped. This is the one thing standing between a recovered seat
-   * and a duplicate/ghost row — same failure family as the F37 debate-role
-   * collision and the RN-11 keyed-row lessons just above (seatsFromRunStats,
-   * seatCells): an identity that is not carefully matched silently
-   * duplicates or overwrites instead of failing loud.
+   * D6 filter (zero usable legs ONLY, "no ghost when a live row already
+   * exists"): a candidate already present in `liveSeats` is dropped. Two
+   * different things can put it there, and both are reasons to suppress:
+   * an SL-2 retry actually healed it (a real recovered review), OR
+   * (owner-ruled, v4.7 CA-4 dead-seat convergence) the seat never recovered
+   * at all but the row-per-launch machinery still gives its dead leg an
+   * honest primary ERROR row (every billed leg gets a row now, including
+   * failures — run-stages.js/run-assemble.js) — so "it has a cost row" no
+   * longer implies "it healed". Either way that live row IS the seat's
+   * record; rendering a second "did not review" ghost row beside it would
+   * be a duplicate, not new information, so suppressing it here is the
+   * ACCEPTED terminal-path behavior: exactly one row per seat, whatever its
+   * status. This is the one thing standing between a recovered (or
+   * honestly-erred) seat and a duplicate/ghost row — same failure family as
+   * the F37 debate-role collision and the RN-11 keyed-row lessons just above
+   * (seatsFromRunStats, seatCells): an identity that is not carefully
+   * matched silently duplicates or overwrites instead of failing loud.
+   *
+   * Role-aware D6 (v4.6.3 PR2, spec D3): a bare model match used to suppress
+   * regardless of what the LIVE row's role was — so a model that died as
+   * critic but whose chair-fallback walk happened to land on that same alias
+   * (and succeeded, producing a live `role: 'chair'` cost row) silently
+   * erased the dead-critic row it was never a replacement for (spec §5, the
+   * PR 102 rider). Candidates now carry a `role` (`'critic'` via alias equality
+   * with `runMeta.critic` — mirroring `deriveSeatLoss`, verdict.js:72 — or
+   * `null`), and only REVIEWING-role live legs (`seat`/`critic`/`lens:*`)
+   * suppress at all; a `'critic'` candidate is cleared only by a live
+   * CRITIC-role leg for that alias, never by a chair/judge/rebuttal/revote
+   * row landing on the same model. Hidden dependency: the recovered-critic
+   * suppression below (`byRole[alias + '|critic']`) relies on `roleFor`'s
+   * critic branch (src/council/run-stages.js), which only fires when lenses
+   * are absent — safe today only because --critic and --lenses are mutually
+   * exclusive (src/cli-handlers-council-run.js's `critic && lenses` check); if
+   * that exclusion ever loosens, a healed critic on a lens run would carry
+   * role 'seat' and this suppression would render a ghost dead row for it.
+   *
+   * Old-run resilience (v4.6.3 PR2, spec D4): pre-`degrades[]` runs (v4.5.2)
+   * carry the BENCH half of a seat loss only in `seatLoss.deadBenchSeats`
+   * (string[] of aliases, verdict.js deriveSeatLoss) — `degrades[]` never
+   * existed on either doc for these runs. Consumed after the critic backstop,
+   * candidates get `role: null` (deadBenchSeats carries no critic/bench
+   * distinction beyond what `criticRequested` already covers above) and flow
+   * through the same `seen`-keyed dedup and role-aware suppression as every
+   * other candidate — deriveSeatLoss does not dedup its own array, so `seen`
+   * is what keeps a repeated alias (or one also named by a real degrade
+   * record) from rendering twice.
    *
    * @param {Array<object>} degrades  run.json's `degrades[]` (may be absent)
-   * @param {?object} seatLoss  verdict.json's `seatLoss` (may be absent)
+   * @param {?object} seatLoss  verdict.json's `seatLoss` (may be absent) —
+   *   `criticRequested`/`criticSeated` back the critic candidate above,
+   *   `deadBenchSeats` (string[] of aliases) feeds the bench candidates below
    * @param {Array<{model: string}>} liveSeats  seatsFromRunStats(...)'s output
    *   (or any seat list keyed the same way — the live seat map)
-   * @returns {Array<{model: string, statusText: string}>}
+   * @param {?{critic: ?string}} runMeta  run.critic (alias, or null/absent
+   *   when no critic was requested) — degrade records carry no role field, so
+   *   this is the ONLY way a degrade-sourced candidate is identified as critic
+   * @returns {Array<{model: string, statusText: string, role: ?string}>}
    */
-  function deadSeats(degrades, seatLoss, liveSeats) {
-    var seen = {};
+  function deadSeats(degrades, seatLoss, liveSeats, runMeta) {
+    var critic = runMeta && runMeta.critic ? runMeta.critic : null;
+    // ⚠️ Object.create(null) throughout this family (also workspace-render.js's
+    // `existing`/`seen` and workspace-app.js's `labelByModel`): a model literally
+    // named `toString` is truthy off a bare object, so it was dropped here and —
+    // worse — crashed workspace-render.js:212 reading `.children` off an inherited
+    // function, killing the seats repaint and every tick after it.
+    var seen = Object.create(null);
     var order = [];
-    function add(model, retried) {
+    function add(model, retried, role) {
       if (!model || seen[model]) { return; }
       seen[model] = true;
       order.push({
         model: model,
+        role: role || null,
         statusText: retried ? 'did not review — retried once' : 'did not review',
       });
     }
@@ -152,16 +229,41 @@
       if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave') { return; }
       var data = d.data || {};
       var retried = !!(data.retryWaveId || data.firstFailure);
+      // Critic identification mirrors deriveSeatLoss (verdict.js): alias
+      // equality with run.critic — degrade records carry no role field.
       if (d.channel === 'dead-leg') {
-        add(data.seat, retried);
+        add(data.seat, retried, critic && data.seat === critic ? 'critic' : null);
       } else {
-        (data.models || []).forEach(function (m) { add(m, retried); });
+        (data.models || []).forEach(function (m) {
+          add(m, retried, critic && m === critic ? 'critic' : null);
+        });
       }
     });
     if (seatLoss && seatLoss.criticRequested && !seatLoss.criticSeated) {
-      add(seatLoss.criticRequested, false);
+      add(seatLoss.criticRequested, false, 'critic');
     }
-    var live = {};
+    if (seatLoss) {
+      // Pre-degrades[] era (v4.5.2): the bench half of a seat loss lives
+      // only here. Alias strings; deriveSeatLoss does not dedup — `seen`
+      // absorbs repeats and degrade-sourced duplicates.
+      (seatLoss.deadBenchSeats || []).forEach(function (m) { add(m, false, null); });
+    }
+    // Role-aware D6 (v4.6.3 PR2): only REVIEWING-role live legs suppress —
+    // a chair/judge/rebuttal/revote row must not hide a dead reviewer, and
+    // a dead-critic candidate is cleared only by a live CRITIC leg. A null
+    // role is NOT reviewing: counting it would suppress silently, the exact
+    // class the announcement invariant forbids.
+    // Role 'claude' is deliberately absent: it is emitted only by claudeRunStatsRow
+    // (src/council/run-assemble.js:129-132) for a seat that never launches a leg, and
+    // preflightClaudeReview (run-assemble.js:86-102) rejects 'claude' as chair/critic/
+    // bench — so no 'claude' leg can die. If that reservation ever loosens, this
+    // allowlist is the single place to extend.
+    function isReviewing(role) {
+      return role === 'seat' || role === 'critic' ||
+        (typeof role === 'string' && role.indexOf('lens:') === 0);
+    }
+    var reviewing = Object.create(null);
+    var byRole = Object.create(null);
     // ⚠️ Fable review (PR4b fix wave): same F34/F36 alias-selection seatCells already uses
     // (`seat.modelInput || seat.model`, above) — a LIVE payload seat's `model` is the RESOLVED
     // executable id, not the alias a degrade record names; `modelInput` carries the alias.
@@ -170,14 +272,23 @@
     // so D6 failed to suppress it — both rows rendered until the stage boundary dropped the
     // errored row. Terminal-path cost rows (seatsFromRunStats) carry no `modelInput` at all and
     // are already alias-only, so `|| s.model` leaves that path unchanged.
-    (liveSeats || []).forEach(function (s) { live[s.modelInput || s.model] = true; });
-    return order.filter(function (s) { return !live[s.model]; });
+    (liveSeats || []).forEach(function (s) {
+      if (!isReviewing(s.role)) { return; }
+      var alias = s.modelInput || s.model; // F36: alias space, never resolved ids
+      reviewing[alias] = true;
+      byRole[alias + '|' + s.role] = true;
+    });
+    return order.filter(function (s) {
+      if (s.role === 'critic') { return !byRole[s.model + '|critic']; }
+      return !reviewing[s.model];
+    });
   }
 
   // ⚠️ DE-ROT (F41): STAGE_LABELS is exported so applyLive() can label post-open stages.
   var api = { pollDelay: pollDelay, seatCells: seatCells, seatsFromRunStats: seatsFromRunStats,
     deadSeats: deadSeats,
-    defaultBlind: defaultBlind, dash: dash, TERMINAL_STATUSES: TERMINAL_STATUSES, STAGE_LABELS: STAGE_LABELS };
+    defaultBlind: defaultBlind, isTerminal: isTerminal, dash: dash,
+    TERMINAL_STATUSES: TERMINAL_STATUSES, STAGE_LABELS: STAGE_LABELS };
   if (typeof module !== 'undefined' && module.exports) { module.exports = api; }
   if (typeof window !== 'undefined') { window.AmicusLive = api; }
 })();

package/electron/workspace-ui/workspace-app.js

@@ -26,6 +26,9 @@
     debate: null,   // ⚠️ DE-ROT (F38): parsed debate.json, fetched once per run-open; stays
                      // null on a non-debate run, an aborted/skipped debate, or a parse failure —
                      // drillIntoJudge's judge-*.md fallback covers all three.
+    debateFetch: null, // T18-m1: test seam — the fire-and-forget debate.json fetch promise
+                        // (null when no fetch was issued for the open run). Nothing renders
+                        // from this; tests may `await state.debateFetch` to sequence past it.
     blind: false,
     // Task 19 (RN-5) + fix-wave (RN-5 amendment): the (run id, status) pair renderDetail() last
     // computed state.blind's default for. Together they gate the recompute (in renderDetail(),
@@ -34,7 +37,7 @@
     // live loop's running -> terminal refresh, or the abort-confirm re-read) still auto-reveals.
     detailRunId: null,
     detailRunStatus: null,
-    labelByModel: {},
+    labelByModel: Object.create(null),
     listTimer: null,
     liveTimer: null, // LIVE (Task 15)
     liveEpoch: 0,    // LIVE (Task 15): bumped by stopLiveLoop() to invalidate in-flight ticks
@@ -66,7 +69,19 @@
   function openRun(runId) {
     state.runId = runId;
     state.debate = null;
+    // Fix-wave item 2: reset synchronously alongside state.debate so the contract comment
+    // above ("null when no fetch was issued for the open run") holds in EVERY window —
+    // including between this openRun(runId) call and its get-run reply, where the old
+    // in-.then reset left state.debateFetch pointing at the PREVIOUS run's promise. The F09
+    // stale-reply guard (below) early-returns before ever touching debateFetch again, so
+    // moving the reset here changes no other behavior.
+    state.debateFetch = null;
     return invoke('workspace:get-run', runId).then(function (detail) {
+      // F09 guard (v4.6.3 PR2): a reply for a run the user has since
+      // navigated away from must never overwrite the run now open. Guard on
+      // runId movement ONLY — a same-run re-open (the live loop's terminal
+      // refresh) must still apply its fresher reply.
+      if (state.runId !== runId) { return; }
       state.detail = detail;
       // ⚠️ DE-ROT (F38): debate.json is the re-vote index the matrix drill-in needs — fetched
       // once per run-open (never per render), fire-and-forget. An aborted or cost-ceiling
@@ -78,8 +93,9 @@
       // navigated away from must never overwrite the run now open. Capture `runId` and check
       // it's still `state.runId` before writing; a rejection (dead channel, closed window) is
       // caught too, so it never surfaces as an unhandled rejection in the renderer.
+      // (state.debateFetch reset moved synchronously above, beside state.debate — fix-wave item 2.)
       if (detail && detail.run && detail.run.debate) {
-        invoke('workspace:read-artifact', runId, 'debate.json').then(function (res) {
+        state.debateFetch = invoke('workspace:read-artifact', runId, 'debate.json').then(function (res) {
           if (state.runId !== runId) { return; }
           try { state.debate = JSON.parse(res.text); } catch (err) { state.debate = null; }
         }).catch(function () {
@@ -128,7 +144,7 @@
       state.detailRunStatus = d.run.status;
     }
     $('blind-toggle').checked = state.blind;
-    state.labelByModel = {};
+    state.labelByModel = Object.create(null);
     d.derived.names.forEach(function (p) { state.labelByModel[p.model] = p.label; });
 
     $('run-title').textContent = d.runId;
@@ -146,7 +162,7 @@
     P.renderVerdictPanel();
     R.renderCost($('cost-body'), d.derived.cost, state.blind, labelOf);
     P.wireLazyPanels();
-    var isTerminal = window.AmicusLive.TERMINAL_STATUSES.indexOf(d.run.status) !== -1;
+    var isTerminal = window.AmicusLive.isTerminal(d.run.status);
     $('abort-btn').hidden = isTerminal;
     V.startLiveLoop();
   }