amicus 4.6.2 → 4.7.0

package/electron/workspace-ui/workspace-seats.js

@@ -41,6 +41,42 @@
 (function () {
   'use strict';
 
+  /**
+   * Aliases of seats whose degrade record says they were retried. PR1F-4 (v4.7 PR7).
+   *
+   * ⚠️ Mirrors window.AmicusLive.deadSeats' own predicate (live-model.js:227-241) EXACTLY, and
+   * must keep mirroring it. The kind/channel filter is load-bearing: run.degrades[] also carries
+   * kind:'heal' / channel:'stage1-retry' records with the SAME retryWaveId/firstFailure fields
+   * for seats that RECOVERED, and a field-only scan would tag a recovered seat "retried once".
+   *
+   * ⚠️ firstFailure is TRUTHINESS ONLY. It has two shapes — run-retry.js:98 emits
+   * {seat, class:'leg', status, reason}; :86/:90/:93 emit {seat, class:'wave', waveId, reason}
+   * with NO status key — so any read of firstFailure.status is undefined on every wave-origin
+   * seat.
+   */
+  function retriedAliases(degrades) {
+    var out = Object.create(null);
+    (degrades || []).forEach(function (d) {
+      if (!d || d.kind !== 'degrade') { return; }
+      if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave') { return; }
+      var data = d.data || {};
+      if (!(data.retryWaveId || data.firstFailure)) { return; }
+      if (d.channel === 'dead-leg') {
+        if (data.seat) { out[data.seat] = true; }
+      } else {
+        (data.models || []).forEach(function (m) { if (m) { out[m] = true; } });
+      }
+    });
+    return out;
+  }
+
+  // Mirrors isReviewing at live-model.js:261-264 — a chair/judge/rebuttal/revote row must not
+  // carry a reviewer's retry marker.
+  function isReviewingRole(role) {
+    return role === 'seat' || role === 'critic' ||
+      (typeof role === 'string' && role.indexOf('lens:') === 0);
+  }
+
   function renderSeatsPanel() {
     var A = window.AmicusApp;
     var d = A.state.detail;
@@ -48,13 +84,52 @@
     var tbody = A.$('seats-body');
     window.AmicusRender.renderSeats(tbody, seats, A.state.blind, A.labelOf);
     var seatLoss = d.verdict && d.verdict.seatLoss;
-    var dead = window.AmicusLive.deadSeats(d.run.degrades, seatLoss, seats);
+    var runMeta = { critic: (d.run && d.run.critic) || null };
+    // Source-selection (v4.6.3 PR2, spec D4): run-degrade.js swallows checkpoint failures, so
+    // verdict.json can carry degrade records run.json's own checkpoint lost — fall back to it
+    // ONLY when run.degrades is empty/absent. A fallback, never a union: both docs can carry
+    // records for the SAME run, and the persisted run.json copy is authoritative when present.
+    var deg = (d.run && d.run.degrades && d.run.degrades.length) ? d.run.degrades
+      : ((d.verdict && d.verdict.degrades) || []);
+    var retried = retriedAliases(deg);
+    // ⚠️ Look rows up by data-key, NEVER by position. renderSeats (workspace-render.js:179-216)
+    // keys every row on String(seat.id || seat.model) and RN-11 made it REORDER rows to match the
+    // composed doc's leg order — so tbody.children[i] is not seats[i]. Build the key exactly the
+    // way renderSeats does or the lookup silently misses.
+    var rowsByKey = Object.create(null);
+    Array.prototype.slice.call(tbody.children).forEach(function (row) {
+      rowsByKey[row.dataset.key] = row;
+    });
+    seats.forEach(function (s) {
+      var row = rowsByKey[String(s.id || s.model)];
+      if (!row || !row.children[8]) { return; }
+      // Column 8 is the table's unlabeled trailing flag cell (index.html:51's final <th></th>).
+      // It carries '⏳ stalled' on the LIVE path; on this terminal path seatsFromRunStats
+      // hardcodes stalled:false (live-model.js:128), so it is always empty here and free to use.
+      // If that ever changes, this is the collision site.
+      // Fix wave (whole-branch review, finding 2): this pass must be SYMMETRIC. renderSeats
+      // reuses rows keyed on `model:role` across calls — including across two different
+      // terminal runs opened in sequence that happen to share an alias+role — and never resets
+      // row.className itself. An add-only write here both duplicates the token on every repaint
+      // of the SAME run and leaves a stale 'seat-retried' class on a row that belonged to a
+      // PREVIOUS run's non-retried seat. classList.add/remove (not string concatenation) so a
+      // repeat add never duplicates the token and a seat that is no longer retried gets cleared.
+      var isRetried = isReviewingRole(s.role) && !!retried[s.modelInput || s.model];
+      if (isRetried) {
+        row.classList.add('seat-retried');
+        row.children[8].textContent = '↻ retried once';
+      } else {
+        row.classList.remove('seat-retried');
+        row.children[8].textContent = '';
+      }
+    });
+    var dead = window.AmicusLive.deadSeats(deg, seatLoss, seats, runMeta);
     renderDeadSeatRows(tbody, dead, A.state.blind, A.labelOf);
   }
 
   /**
    * Paints the dead-seat rows appended after live rows. Deliberately NOT
-   * folded into workspace-render.js's renderSeats (287/300 — must not grow)
+   * folded into workspace-render.js's renderSeats (293/300 — must not grow)
    * and NOT run through its keyed diff: dead rows carry no per-tick-changing
    * field, so a full rebuild every call is correct and cheap, and renderSeats
    * just above already self-cleans any PRIOR dead row as an unrecognized
@@ -74,7 +149,7 @@
   function renderDeadSeatRows(tbody, dead, blindOn, labelOf) {
     (dead || []).forEach(function (seat) {
       var cells = window.AmicusLive.seatCells(
-        { model: seat.model, status: seat.statusText, stalled: false }, blindOn, labelOf);
+        { model: seat.model, role: seat.role, status: seat.statusText, stalled: false }, blindOn, labelOf);
       // Fix wave 2 (smoke-caught, GUI smoke on real degraded run 12c96b6b): dead seats never
       // produce a review, so state.labelByModel (built from the run's names derivation — models
       // that DID review) never carries them; seatCells' own `blindOn && label ? label : alias`
@@ -88,7 +163,7 @@
         { className: 'seat-dead', dataset: { key: 'dead:' + seat.model } },
         cells.map(function (c, i) {
           return window.AmicusRender.el('td',
-            { className: i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : '') }, [c]);
+            { className: window.AmicusRender.seatCellClass(i) }, [c]);
         }));
       tbody.appendChild(row);
     });
@@ -105,7 +180,15 @@
     var A = window.AmicusApp;
     var d = A.state.detail;
     var seatLoss = d && d.verdict ? d.verdict.seatLoss : null;
-    var dead = window.AmicusLive.deadSeats(live.degrades, seatLoss, live.seats || []);
+    var runMeta = { critic: (d && d.run && d.run.critic) || null };
+    // Source-selection (v4.6.3 PR2, spec D4), live-path twin of renderSeatsPanel's fallback
+    // above: the tick's own live.degrades wins when non-empty; state.detail.verdict.degrades is
+    // usually absent mid-run (verdict.json doesn't exist until the run finishes) — fine, this
+    // branch only matters for the rare same-run reopen where a prior terminal fetch already
+    // populated state.detail.verdict.
+    var deg = (live.degrades && live.degrades.length) ? live.degrades
+      : ((d && d.verdict && d.verdict.degrades) || []);
+    var dead = window.AmicusLive.deadSeats(deg, seatLoss, live.seats || [], runMeta);
     renderDeadSeatRows(A.$('seats-body'), dead, A.state.blind, A.labelOf);
   }
 

package/electron/workspace-ui/workspace-verbs.js

@@ -66,7 +66,7 @@
     var A = window.AmicusApp;
     stopLiveLoop();
     var d = A.state.detail;
-    if (!d || !d.run || window.AmicusLive.TERMINAL_STATUSES.indexOf(d.run.status) !== -1) { return; }
+    if (!d || !d.run || window.AmicusLive.isTerminal(d.run.status)) { return; }
     var epoch = A.state.liveEpoch; // F42: stopLiveLoop() above just bumped it; this chain owns it
     var tick = function () {
       // F42: pin the id PER TICK and SEND the pinned id — matching the reply against

package/electron/workspace-ui/workspace.css

@@ -176,3 +176,9 @@ td.vote-cell.dispute { cursor: pointer; text-decoration: underline dotted; }
 
 .empty-note { color: var(--text-3); font-size: var(--fs-12); }
 .truncate-note { color: var(--warn); font-size: var(--fs-11); margin-top: var(--space-3); }
+
+/* PR1F-4: a seat that was retried and still failed — the surviving errored row's own marker.
+   ⚠️ Plan snippet said var(--muted), which does not exist in src/design/tokens.css (verified
+   repo-wide). --text-3 is this file's own established "muted" token — see tr.seat-dead td
+   above, the sibling dead-row treatment. */
+.seat-retried td:last-child { color: var(--text-3); white-space: nowrap; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.6.2",
+  "version": "4.7.0",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
@@ -55,7 +55,7 @@
     "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='worktrees' && node scripts/mark-test-passed.js",
     "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",
     "posttest": "node scripts/mark-test-passed.js",
-    "lint": "eslint src/ electron/",
+    "lint": "eslint src/ electron/ tests/helpers/",
     "postinstall": "node scripts/postinstall.js",
     "test:thinking": "node scripts/benchmark-thinking.js",
     "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",
@@ -107,6 +107,9 @@
     ],
     "electron/**/*.js": [
       "eslint --fix"
+    ],
+    "tests/helpers/**/*.js": [
+      "eslint --fix"
     ]
   }
 }

package/schemas/council-run.schema.json

@@ -45,6 +45,7 @@
     "labelMap": { "type": ["object", "null"], "additionalProperties": { "type": "string" } },
     "options": { "type": "object" },
     "pack": { "type": "object" },
+    "tag": { "type": "string" },
     "template": { "type": "object" },
     "usage": { "type": "object" },
     "exitCode": { "type": ["number", "null"] },

package/schemas/council-stats.schema.json

@@ -20,7 +20,15 @@
           "avgStreetCredPeersOnly": { "type": ["number", "null"] },
           "lifetimeConfirmRate": { "type": ["number", "null"] },
           "lifetimeFactErrorRate": { "type": ["number", "null"] },
-          "conformance": { "type": "object" }
+          "conformance": { "type": "object" },
+          "aliases": {
+            "type": "array", "items": { "type": "string" },
+            "description": "Every alias observed for this group, most recently observed first — aliases[0] is the launch-preferred name (v4.7 GOA-7)."
+          },
+          "legacy": {
+            "type": "boolean",
+            "description": "True when every row in the group lacks resolvedModel — alias-keyed history from before resolved-id segmentation, or leg-less rows whose resolution is unknowable (v4.7 GOA-7, spec R2)."
+          }
         }
       }
     }

package/schemas/run.schema.json

@@ -22,6 +22,7 @@
     "sessionDir": { "type": ["string", "null"] },
     "opencodeSessionId": { "type": ["string", "null"] },
     "usage": { "type": ["object", "null"] },
-    "pack": { "type": "object" }
+    "pack": { "type": "object" },
+    "tag": { "type": "string" }
   }
 }

package/schemas/spend.schema.json

@@ -33,7 +33,7 @@
     },
     "credit": { "type": ["object", "null"] },
     "filters": { "type": "object" },
-    "groupBy": { "enum": ["model", "wave", "council", "project", "op", "day"] },
+    "groupBy": { "enum": ["model", "wave", "council", "project", "op", "day", "tag"] },
     "groups": {
       "type": "array",
       "items": {

package/schemas/wave.schema.json

@@ -29,6 +29,7 @@
     "durationMs": { "type": ["number", "null"] },
     "usage": { "type": "object" },
     "notices": { "type": "array", "items": { "type": "string" } },
-    "pack": { "type": "object" }
+    "pack": { "type": "object" },
+    "tag": { "type": "string" }
   }
 }

package/skills/second-opinion/MANUAL-ORCHESTRATION.md

@@ -146,6 +146,18 @@ As each judge's ranking + adjudication response returns, collect it (the raw per
 3. **Translate each judge's `FINAL RANKING:` block** — convert the label order (`1. Review C / 2. Review A / 3. Review B`) into a model `order` array via the same map (e.g. `{C→mistral, A→deepseek, B→gpt}` ⇒ `order: ["mistral","deepseek","gpt"]`). This is each entry in `rankings[]`.
 4. **Populate `runStats`** from the per-leg run documents emitted by `fanout --json` (and any solo red-team/chair `start --json` docs): copy `model`, `status`, `durationMs`, `usage` verbatim. Any leg with no run doc gets `durationMs: null` and `usage: null` — never invent a value. Attach `role` (`council` | `redteam` | `claude`), `wasChair`, and `conformance` (`clean` | `repaired` | `unstructured`) as council-domain labels.
 
+⚠️ **v4.7 CA-4 note:** the headless engine driver (`amicus council run`) now emits extra
+non-primary `runStats` rows (`chair-attempt`/`repair`/`superseded` — failed chair launches,
+repair solos, and superseded legs) alongside one seat-primary row per model. This manual
+orchestration path is unaffected and still produces exactly one seat-primary row per model as
+described above — no contract change here — but any code or report template reading `runStats`
+should be a **tolerant reader** (filter by role rather than assume one row per model), since an
+engine-produced tally.json can now carry rows this recipe never does. Hand-assembled `runStats`
+rows carry no `resolvedModel`; their ledger rows therefore aggregate as alias-keyed `legacy`
+groups in `council stats` (legacy-by-absence, by design) — expected, not an error. Add
+`resolvedModel` (the executable id that served) to a row only if you know it; never copy the
+alias into it.
+
 **Five-keys checklist — verify `tally-input.json` has ALL of:** `meta` (with `meta.models`), `findings`, `adjudications`, `rankings`, `runStats` (`runStats` may be `[]`; the other four are required). Do not call `tally` until all five are present.
 
 Then call, saving the printed `record` to `<run-folder>/tally.json` (Stage 5's `amicus council verdict` reads it back from disk):

package/skills/second-opinion/MODEL-NOTES.md

@@ -101,10 +101,11 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
   OpenRouter balance — gemini/gpt/anthropic bill directly against their own keys, so inferring cost
   from that balance under-reports it badly (observed: ~6x low). A 3-model bench + chair + debate is
   roughly **$0.60-0.80 per run**, not cents; budget `--max-cost` accordingly or the chair gets
-  skipped mid-run (exit 2, degraded) when the debate legs push the total past the ceiling. As of
-  v4.6, `runStats` also carries Stage-2 judge rows (judge-tagged), so totals read higher than
-  pre-4.6 runs for the same bench; anything keying `runStats` by model should exclude
-  `role: 'judge'`.
+  skipped mid-run (exit 2, degraded) when the debate legs push the total past the ceiling. Totals
+  read higher again as of v4.7 — repairs, failed chair attempts, and superseded legs now get their
+  own `runStats` rows too — so anything keying `runStats` by model must use an **allowlist**, not a
+  judge exclusion; see `docs/council.md`'s `runStats[].role` roster (under `amicus council tally`)
+  for the exact set.
 - **Expect agreement inflation in Stage-2 adjudication.** The judge contract defines `agree` by
   worked example ("an 'I missed this — it's valid' counts as agree") but gives no example for
   `dispute` and no positive definition of `neutral`, while requiring a verdict on EVERY finding —

package/skills/sidecar/SKILL.md

@@ -367,16 +367,21 @@ The catalog is cached at `~/.config/amicus/model-catalog.json` and refreshes aut
 ```bash
 amicus list
 amicus list --status complete
-amicus list --all  # All projects
-amicus list --json # Output as JSON
+amicus list --all          # All projects
+amicus list --search foo   # Substring match: id, tag, briefing material
+amicus list --json         # Output as JSON
 ```
 
 **Optional:**
 - `--status <filter>`: Filter by status (`running`, `complete`)
 - `--all`: Show sessions from all projects
+- `--search <q>`: Case-insensitive substring filter over id/tag/briefing material
 - `--json`: Output as JSON format (for programmatic use)
 - `--cwd <path>`: Project directory (default: current directory)
 
+Rows show the `--tag <t>` label set at launch time (`start`/`fanout`/`council run` —
+not a `list` flag itself); untagged sessions show blank.
+
 ### Resume a Sidecar
 
 ```bash

package/src/cli-council-run-bench.js

@@ -0,0 +1,86 @@
+/**
+ * Bench and input resolution for the council run command.
+ *
+ * Exports parseList, sanitizeCouncilName, resolveBench, extracted verbatim
+ * from cli-handlers-council-run.js (v4.7 PR0). ⚠️ The top-level cli*.js
+ * name is LOAD-BEARING: the known-flags source scan covers only src/cli*.js,
+ * and resolveBench reads args['dropped-members'].
+ */
+
+'use strict';
+
+const { failJson, ERROR_CODES } = require('./utils/error-doc');
+
+function parseList(value) {
+  return String(value).split(',').map(s => s.trim()).filter(Boolean);
+}
+
+/**
+ * Sanitize the internal `--council-name` passthrough before it can reach the
+ * spend ledger's `councilName` column (v4.3 Task 4 review fix, spec §7.3:
+ * spend docs hold only ids/numbers/paths "by construction"). That value is
+ * user-supplied (via mcp-council-run.js, ultimately an MCP caller's `input`),
+ * unbounded, and unvalidated — unlike a real `--council <preset>`, which is
+ * catalog-validated upstream. Strips control/non-printable characters, trims,
+ * and caps length so a hostile/malformed passthrough can't land raw in a
+ * `--group-by council` rollup. Precedence is untouched by this: it's applied
+ * only to the passthrough branch, never to the catalog-validated preset name.
+ * @param {string} name @returns {string|null} sanitized name, or null if empty after cleanup
+ */
+function sanitizeCouncilName(name) {
+  // eslint-disable-next-line no-control-regex -- deliberately stripping C0/DEL control chars
+  const cleaned = String(name).replace(/[\x00-\x1F\x7F]/g, '').trim().slice(0, 64);
+  return cleaned || null;
+}
+
+/**
+ * Resolve bench models from --models XOR --council (mirrors handleFanout).
+ * Also returns `presetName` (v4.3 Task 3, spec §7.1: trimmed --council name,
+ * else null) and `droppedMembers`: a preset's own drops, or — bare --models —
+ * the parsed `--dropped-members` MCP→child passthrough (v4.6 Plan 4 Task 4b).
+ * Parallel twin: mcp-council-bench.js's `resolveBenchInput` hand-rolls the same
+ * models-XOR-council wrapper around the shared `resolveCouncilMembers` core.
+ * They have already diverged (this side has a third guard for a valueless
+ * --council, and the min-seat rule lives in both callers, not here) — change
+ * a validation rule on one side, change the other.
+ */
+function resolveBench(args, useJson) {
+  const hasModels = typeof args.models === 'string' && args.models.trim();
+  const hasCouncil = args.council !== undefined && args.council !== false;
+  if (hasModels && hasCouncil) {
+    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
+      message: 'Error: pass exactly one of --models / --council, not both' }) };
+  }
+  if (!hasModels && !hasCouncil) {
+    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
+      message: 'Error: council run needs --models a,b,c or --council <preset> (at least 2 seats)' }) };
+  }
+  if (hasCouncil) {
+    if (typeof args.council !== 'string' || !args.council.trim()) {
+      return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
+        message: 'Error: --council requires a council name (e.g. --council budget)' }) };
+    }
+    const { resolveCouncilMembers } = require('./utils/config');
+    const { readCache } = require('./utils/model-catalog');
+    const catalog = (readCache() || {}).models || [];
+    const presetName = args.council.trim();
+    const expanded = resolveCouncilMembers(presetName, catalog);
+    if (expanded.error) {
+      return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: ${expanded.error}` }) };
+    }
+    // v4.5 Wave 2 → Plan 4 Task 4: threaded into runCouncil's options — the
+    // sink now announces each dropped member, with reason, on every transport and surface.
+    return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
+  }
+  if (args['dropped-members'] === undefined) {
+    return { bench: parseList(args.models), presetName: null, droppedMembers: [] };
+  }
+  let dm; try { dm = JSON.parse(args['dropped-members']); } catch { dm = null; }
+  if (!Array.isArray(dm) || !dm.every(d => d && typeof d.member === 'string' && typeof d.reason === 'string')) {
+    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
+      message: 'Error: --dropped-members must be a JSON array of {member, reason} entries' }) };
+  }
+  return { bench: parseList(args.models), presetName: null, droppedMembers: dm };
+}
+
+module.exports = { parseList, sanitizeCouncilName, resolveBench };

package/src/cli-handlers-council-run.js

@@ -11,82 +11,17 @@
 
 const path = require('path');
 const { failJson, buildErrorDoc, ERROR_CODES } = require('./utils/error-doc');
-const { validateTaskId } = require('./utils/validators');
+const { validateTaskId, validateTag } = require('./utils/validators');
 const { GATEWAY_MODES } = require('./utils/model-descriptor');
 // v4.6 Plan 4 Task 2: renderRunHuman moved to its own leaf (size gate); this
 // file re-exports it below so every existing require() of this path still
 // resolves it unchanged.
 const { renderRunHuman } = require('./cli-council-run-render');
+const { parseList, sanitizeCouncilName, resolveBench } = require('./cli-council-run-bench');
+const { applyTemplateForArgs } = require('./cli-template-args');
 
 const CHAIR_DEFAULT = 'deepseek';
 
-function parseList(value) {
-  return String(value).split(',').map(s => s.trim()).filter(Boolean);
-}
-
-/**
- * Sanitize the internal `--council-name` passthrough before it can reach the
- * spend ledger's `councilName` column (v4.3 Task 4 review fix, spec §7.3:
- * spend docs hold only ids/numbers/paths "by construction"). That value is
- * user-supplied (via mcp-council-run.js, ultimately an MCP caller's `input`),
- * unbounded, and unvalidated — unlike a real `--council <preset>`, which is
- * catalog-validated upstream. Strips control/non-printable characters, trims,
- * and caps length so a hostile/malformed passthrough can't land raw in a
- * `--group-by council` rollup. Precedence is untouched by this: it's applied
- * only to the passthrough branch, never to the catalog-validated preset name.
- * @param {string} name @returns {string|null} sanitized name, or null if empty after cleanup
- */
-function sanitizeCouncilName(name) {
-  // eslint-disable-next-line no-control-regex -- deliberately stripping C0/DEL control chars
-  const cleaned = String(name).replace(/[\x00-\x1F\x7F]/g, '').trim().slice(0, 64);
-  return cleaned || null;
-}
-
-/**
- * Resolve bench models from --models XOR --council (mirrors handleFanout).
- * Also returns `presetName` (v4.3 Task 3, spec §7.1: trimmed --council name,
- * else null) and `droppedMembers`: a preset's own drops, or — bare --models —
- * the parsed `--dropped-members` MCP→child passthrough (v4.6 Plan 4 Task 4b).
- */
-function resolveBench(args, useJson) {
-  const hasModels = typeof args.models === 'string' && args.models.trim();
-  const hasCouncil = args.council !== undefined && args.council !== false;
-  if (hasModels && hasCouncil) {
-    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: 'Error: pass exactly one of --models / --council, not both' }) };
-  }
-  if (!hasModels && !hasCouncil) {
-    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: 'Error: council run needs --models a,b,c or --council <preset> (at least 2 seats)' }) };
-  }
-  if (hasCouncil) {
-    if (typeof args.council !== 'string' || !args.council.trim()) {
-      return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-        message: 'Error: --council requires a council name (e.g. --council budget)' }) };
-    }
-    const { resolveCouncilMembers } = require('./utils/config');
-    const { readCache } = require('./utils/model-catalog');
-    const catalog = (readCache() || {}).models || [];
-    const presetName = args.council.trim();
-    const expanded = resolveCouncilMembers(presetName, catalog);
-    if (expanded.error) {
-      return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: ${expanded.error}` }) };
-    }
-    // v4.5 Wave 2 → Plan 4 Task 4: threaded into runCouncil's options — the
-    // sink now announces each dropped member, with reason, on every transport and surface.
-    return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
-  }
-  if (args['dropped-members'] === undefined) {
-    return { bench: parseList(args.models), presetName: null, droppedMembers: [] };
-  }
-  let dm; try { dm = JSON.parse(args['dropped-members']); } catch { dm = null; }
-  if (!Array.isArray(dm) || !dm.every(d => d && typeof d.member === 'string' && typeof d.reason === 'string')) {
-    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: 'Error: --dropped-members must be a JSON array of {member, reason} entries' }) };
-  }
-  return { bench: parseList(args.models), presetName: null, droppedMembers: dm };
-}
-
 /**
  * Default real helpers; tests override via depsOverride (mirrors
  * cli-handlers-spend.js's realDeps()/depsOverride convention).
@@ -112,6 +47,27 @@ async function handleCouncilRun(args, depsOverride = {}) {
   // existing application point exactly like a typed --template.
   let packRecord = null;
   const explicitKeys = args.__explicit || new Set();
+  // v4.7 PR6: these all parse as boolean `true` when typed without a value
+  // (src/cli.js:101) and reached runCouncil as `true`, a NaN, or a bogus path.
+  // Voice matches the R5 -o/--out precedent (cli-handlers-council.js:183).
+  for (const flag of ['out-dir', 'claude-review', 'run-id']) {
+    if (!explicitKeys.has(flag)) { continue; }
+    const v = args[flag];
+    if (typeof v !== 'string' || v === '') {
+      return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --${flag} requires a value` });
+    }
+    if (v.startsWith('-')) {
+      return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --${flag} cannot start with '-': got '${v}'` });
+    }
+  }
+  // --timeout is DEFAULTS-seeded to 15 (src/cli.js:31), so `!== undefined` proves
+  // nothing; NaN is the real hole — it passes the `<= 0` guard below.
+  if (explicitKeys.has('timeout') && (typeof args.timeout !== 'number' || !Number.isFinite(args.timeout))) {
+    // Do NOT echo args.timeout: parseArgs already ran parseInt, so a typed
+    // `--timeout abc` reads back as NaN and quoting it shows the user a value
+    // they never typed. Boolean `true` (bare flag) has the same problem.
+    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --timeout requires a number' });
+  }
   if (args.pack !== undefined) {
     const { applyPackToArgs } = require('./pack/pack-resolve');
     const pr = applyPackToArgs({
@@ -146,17 +102,14 @@ async function handleCouncilRun(args, depsOverride = {}) {
     promptRes = { prompt: undefined, promptMeta: null };
   }
   let templateMeta = null;
-  if (args.template !== undefined) {
-    const { applyTemplate } = require('./template/apply');
-    const t = applyTemplate({ templateRef: args.template, prompt: promptRes.prompt,
-      artifactFile: args.artifact, varList: args.var, project: args.cwd || process.cwd() });
-    if (t.error) { return failJson(useJson, t.error); }
-    for (const n of t.notices) { process.stderr.write(n + '\n'); }
-    promptRes = { prompt: t.prompt, promptMeta: t.promptMeta };
-    templateMeta = t.promptMeta.template;
-  } else if (args.artifact !== undefined || args.var !== undefined) {
-    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --artifact/--var require --template (expansion happens only in template files)' });
-  }
+  const tpl = applyTemplateForArgs(args, promptRes.prompt, useJson);
+  if (tpl.fail !== undefined) { return tpl.fail; }
+  // The trailing `templateMeta =` is NOT copy-paste drift against handleFanout's
+  // otherwise-identical call: it feeds `template: templateMeta` on the run.json
+  // seed below (the `template:` field of the runCouncil options object). Drop it
+  // and every --template council run silently records
+  // `template: null`. handleFanout has no such field, which is why its call is shorter.
+  if (tpl.applied) { promptRes = { prompt: tpl.prompt, promptMeta: tpl.promptMeta }; templateMeta = tpl.templateMeta; }
 
   const benchRes = resolveBench(args, useJson);
   if (benchRes.fail !== undefined) { return benchRes.fail; }
@@ -194,14 +147,29 @@ async function handleCouncilRun(args, depsOverride = {}) {
   }
   const lenses = (typeof args.lenses === 'string' && args.lenses.trim()) ? parseList(args.lenses) : null;
   if (critic && lenses) {
+    // T11-d: no packSuffix() here (unlike the chair/critic-in-bench checks
+    // above) — it would only ever contribute ''. pack-validate.js now rejects
+    // a pack supplying both critic and lenses before this handler ever runs
+    // (PACK_INVALID, pre-spend, via pack-resolve.js's validatePack call), and
+    // pack-resolve.js:140/143 already suppress the mixed pack-field x
+    // explicit-flag crossings (a pack-filled critic is skipped when --lenses
+    // is explicit, and vice versa). So whenever this branch fires, both
+    // critic and lenses are always explicit flags, never pack-attributed.
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: `Error: --critic and --lenses are mutually exclusive in v4.0${packSuffix('critic') || packSuffix('lenses')}` });
+      message: 'Error: --critic and --lenses are mutually exclusive in v4.0' });
   }
   if (lenses && lenses.length !== bench.length) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
       message: `Error: --lenses needs exactly one lens per seat (${bench.length} seats, got ${lenses.length})` });
   }
-  if (args.timeout !== undefined && args.timeout <= 0) {
+  // v4.7 PR6: this check is POST-pack-merge and ungated, so it is the only one a
+  // pack-filled value passes through — `timeout` is a legal council pack option
+  // (pack-validate.js KIND_OPTIONS) and validatePack checks the key name, never
+  // the value type. The old `<= 0` test alone let `{timeout: true}` past (true
+  // coerces to 1) and `{timeout: "abc"}` past as NaN, reproducing the very bug
+  // the typed-flag guard above closes. Same shape as --max-cost's check below.
+  if (args.timeout !== undefined
+      && (typeof args.timeout !== 'number' || !Number.isFinite(args.timeout) || args.timeout <= 0)) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --timeout must be a positive number' });
   }
   const mc = args['max-cost'];
@@ -212,6 +180,15 @@ async function handleCouncilRun(args, depsOverride = {}) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
       message: `Error: --gateway must be one of: ${GATEWAY_MODES.join(', ')}` });
   }
+  // v4.7 F8 (D13): reject-style (unlike sanitizeCouncilName, which cleans) —
+  // a stored tag is a user-chosen search key, so silent truncation/stripping
+  // would make --search/--group-by tag miss it.
+  if (args.tag !== undefined) {
+    const tagCheck = validateTag(args.tag);
+    if (!tagCheck.ok) {
+      return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: tagCheck.error });
+    }
+  }
   let runId;
   if (args['run-id']) {
     const check = validateTaskId(String(args['run-id']));
@@ -227,6 +204,12 @@ async function handleCouncilRun(args, depsOverride = {}) {
   const runDir = args['out-dir']
     ? path.resolve(project, String(args['out-dir']))
     : path.resolve(project, `council-${runId}`);
+  // v4.7 PR6: MCP has fenced this since v4.5 (mcp-council-run.js:137-141); the CLI
+  // never did, so `--out-dir ../../x` wrote outside the project and exited 0.
+  const { isPathInside } = require('./project-root-allowlist');
+  if (!isPathInside(runDir, project)) {
+    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --out-dir must stay inside the project: '${args['out-dir']}' resolves outside ${project}` });
+  }
 
   const { resolveGatewayMode, loadConfig } = require('./utils/config');
   const { resolveFallbackConfig } = require('./sidecar/fallback-chains');
@@ -254,6 +237,7 @@ async function handleCouncilRun(args, depsOverride = {}) {
     councilName,
     template: templateMeta, // F9 (v4.5): null when no --template; additive on the run.json seed (run-state.js).
     pack: packRecord, // v4.5 Task 12 (B7/F5): null when no --pack; additive on the run.json seed (run-state.js).
+    tag: args.tag, // v4.7 F8: undefined when no --tag; Task 3 stores it on the run.json seed.
     droppedMembers: benchRes.droppedMembers, // v4.5 Wave 2: [] when nothing dropped; additive on the run.json seed (run-state.js).
     // v4.1 §4.5b/§4.5d. `--claude-review` is resolved here but VALIDATED by the
     // engine's preflightClaudeReview (run-assemble.js): the reserved-seat and

package/src/cli-handlers-council.js

@@ -60,10 +60,14 @@ function renderRecord(r) {
 }
 function renderStats(agg) {
   if (!agg.length) { return 'No council runs recorded yet.\n'; }
-  return 'model            runs  avg-cred  confirm  fact-err  notes\n' +
-    agg.map(a => `${a.model.padEnd(16)} ${String(a.runs).padStart(4)}  ` +
+  // v4.7 GOA-7 D10: group keys may be executable ids (>16 chars) — size the
+  // model column to the longest key; legacy (alias-keyed) groups get a notes
+  // marker beside low-N.
+  const w = Math.max(16, ...agg.map(a => String(a.model).length));
+  return 'model'.padEnd(w) + ' runs  avg-cred  confirm  fact-err  notes\n' +
+    agg.map(a => `${String(a.model).padEnd(w)} ${String(a.runs).padStart(4)}  ` +
       `${fmt(a.avgStreetCredPeersOnly)}     ${fmt(a.lifetimeConfirmRate)}    ${fmt(a.lifetimeFactErrorRate)}` +
-      `${a.lowN ? '   low-N' : ''}`).join('\n') + '\n';
+      `${a.lowN ? '   low-N' : ''}${a.legacy ? '   legacy' : ''}`).join('\n') + '\n';
 }
 function fmt(v) { return (v === null || v === undefined) ? '  —  ' : v.toFixed(2); }
 
@@ -162,6 +166,23 @@ function runVerdict(args, useJson) {
         hint: 'pass a valid decisions.json array or omit --decisions' });
     }
   }
+  // R1 (v4.6.3): parseArgs records a valueless trailing -o/--out as boolean
+  // true (and --out= as ''). The boolean crashes writeVerdictAtomic mid-write
+  // (renameSync TypeError on a non-string path) leaving an orphaned
+  // true.tmp-<pid>; the empty string silently falls through to the default
+  // path. Name the flag and refuse both — the unknown-flag precedent.
+  // R5 (v4.7): a dash-leading value ('-x') is a well-formed string as far as
+  // parseArgs is concerned (it normalizes, it does not validate) — refuse it
+  // here too, or it resolves straight through to writeVerdictAtomic('-x', ...)
+  // and writes a file literally named '-x' in cwd. Same failure class as R1,
+  // one form short.
+  if (args.out !== undefined && (typeof args.out !== 'string' || args.out === '' || args.out.startsWith('-'))) {
+    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
+      message: (typeof args.out !== 'string' || args.out === '')
+        ? '-o/--out requires a value'
+        : `-o/--out cannot start with '-': got '${args.out}'`,
+      hint: 'amicus council verdict <tally.json> [--decisions <decisions.json>] [-o|--out <out.json>]' });
+  }
   const outPath = args.out || './verdict.json';
   let verdict;
   try {