amicus 4.6.2 → 4.7.0

package/src/cli.js

@@ -105,8 +105,12 @@ function parseArgs(argv) {
       // Single short-flag alias, scoped to exactly '-o' (council verdict's
       // --out shorthand). No general short-flag support is implemented —
       // any other leading-dash token still falls through to positionals.
+      // R5: deliberately lockstep with the long-option branch above
+      // (`!next.startsWith('--')`) — '-o' and '--out' must consume values
+      // identically. A dash-leading value is still accepted here (parsing
+      // only normalizes); cli-handlers-council.js's R1 guard rejects it.
       const next = argv[i + 1];
-      if (next && !next.startsWith('-')) {
+      if (next && !next.startsWith('--')) {
         result.out = next;
         i++;
       } else {
@@ -455,6 +459,7 @@ Options for 'start':
   --artifact <file>            File whose content fills {{artifact}} (256 KB cap; needs --template)
   --var <k=v>                  Template variable, repeatable (needs --template)
   --pack <name|path>           Load a saved pack (model/options/template); explicit flags override it
+  --tag <t>                    Label this session for list/search/spend grouping (1-64 chars, [A-Za-z0-9_-])
 `,
   fanout: `
 Options for 'fanout':
@@ -465,31 +470,34 @@ Options for 'fanout':
                                ~32KB Windows argument cap). Mutually exclusive
                                with --prompt. Also works with 'start'.
   --wave-id <id>               Explicit wave ID (leg IDs become <id>-1..N)
-  --retry-failed <waveId>       Relaunch ONLY that wave's failed/timed-out/crashed/
-                                aborted legs as a NEW linked wave, using each leg's
-                                own saved context (byte-identical retry). Skips
-                                --prompt/--models; --models filters which failed
-                                legs to retry. wave.json is never modified.
+  --retry-failed <waveId>      Relaunch ONLY that wave's failed/timed-out/crashed/
+                               aborted legs as a NEW linked wave, using each leg's
+                               own saved context (byte-identical retry). Skips
+                               --prompt/--models; --models filters which failed
+                               legs to retry. wave.json is never modified.
   --json                       Emit the wave result as stable JSON on stdout
+  --quiet                      Suppress per-leg progress ticks, the wave-result summary, and
+                               preflight errors
   --max-cost <$>               Refuse the wave if the estimated total exceeds $ (soft ceiling)
   --no-cost-gate               Disable the budget gate (per-$/Mtok threshold + ceiling) for this run
   --fallback / --no-fallback   Opt-in cheaper-model substitution on a classified
                                rate-limit/overload leg failure (spec 6.2). Overrides
                                config fallbacks.enabled when passed; default: config, else off.
-  --gateway <mode>              Routing: auto (direct-first), direct, or openrouter
-  --follow                      Stream this run's events to stderr as they happen (--json -> NDJSON)
-  --on-complete <cmd>           Run a shell command once, at terminal state, after
-                                wave.json is durable. The command is user-authored
-                                on THIS command line (CLI-only — never sourced from
-                                config/briefings/model output); payload rides via
-                                env only (AMICUS_TASK_ID/TYPE/STATUS/EXIT_CODE/
-                                RESULT_FILE/EVENTS_FILE/COST/PROJECT), never model
-                                text. Child stdout/stderr go to amicus stderr.
-                                Never changes the wave's exit code, docs, or events.
+  --gateway <mode>             Routing: auto (direct-first), direct, or openrouter
+  --follow                     Stream this run's events to stderr as they happen (--json -> NDJSON)
+  --on-complete <cmd>          Run a shell command once, at terminal state, after
+                               wave.json is durable. The command is user-authored
+                               on THIS command line (CLI-only — never sourced from
+                               config/briefings/model output); payload rides via
+                               env only (AMICUS_TASK_ID/TYPE/STATUS/EXIT_CODE/
+                               RESULT_FILE/EVENTS_FILE/COST/PROJECT), never model
+                               text. Child stdout/stderr go to amicus stderr.
+                               Never changes the wave's exit code, docs, or events.
   --template <name|path>       Render a briefing template ({{prompt}}, {{artifact}}, {{var.*}})
   --artifact <file>            File whose content fills {{artifact}} (256 KB cap; needs --template)
   --var <k=v>                  Template variable, repeatable (needs --template)
   --pack <name|path>           Load a saved pack (bench/options/template); explicit flags override it
+  --tag <t>                    Label this wave for list/search/spend grouping (1-64 chars, [A-Za-z0-9_-])
   Shared per-leg knobs: --agent, --thinking, --timeout, --summary-length,
   --no-context, --context-*, --mcp*, --no-validate-model, --cwd
   Exit codes: 0 all legs complete, 2 partial, 1 none complete / hard failure
@@ -511,6 +519,8 @@ Options for 'models':
 Options for 'list':
   --status <filter>            Filter by status (running, complete)
   --all                        Show all projects
+  --search <q>                 Case-insensitive substring filter over id, tag, and briefing
+  --limit <n>                  Show only the n newest rows (0 = unlimited)
   --json                       Output as JSON
 `,
   status: `
@@ -580,7 +590,7 @@ Subcommands for 'council':
       [--debate] [--claude-review <file>] [--no-cost-gate] [--follow]
       [--fallback] [--no-fallback] [--on-complete <cmd>]
       [--template <name|path>] [--artifact <file>] [--var <k=v>]
-      [--pack <name|path>]
+      [--pack <name|path>] [--tag <t>]
                                 Run the full headless council engine (v4.0).
                                 Chair default: deepseek (must NOT be a bench seat).
                                 --critic and --lenses are mutually exclusive.
@@ -633,7 +643,7 @@ Options for 'spend':
   --model <id-or-prefix>        Only rows whose model starts with this
   --op <start|continue|resume|leg>   Only rows with this operation
   --failed                      Only non-complete (wasted) rows
-  --group-by <model|wave|council|project|op|day>   Rollup dimension (default model)
+  --group-by <model|wave|council|project|op|day|tag>   Rollup dimension (default model)
   --rows                        Include matching raw rows (capped at 1000)
   --json                        Machine-readable output (versioned spend doc)
   Reads ~/.config/amicus/spend-ledger.jsonl (one row per completed run/leg).
@@ -691,34 +701,17 @@ Options for 'template':
   pack: `
 Options for 'pack':
   amicus pack save <name> --kind council|fanout|solo [flags]
-                                Save a pack built from flags:
-                                --bench <a,b,c|name>    council/fanout: comma-
-                                                         separated members, or a
-                                                         saved council name
-                                --model <model>          solo kind only
-                                --chair/--critic/--lenses    council kind only
-                                --timeout/--max-cost/--gateway   shared run
-                                                         options
-                                --agent/--thinking/--summary-length   fanout/
-                                                         solo kind only
-                                --debate / --no-debate   council kind only
-                                --template <name|path>   briefing template
-                                                         reference (not rendered)
-                                --version <semver>       default 1.0.0 (an
-                                                         unchanged re-save is a
-                                                         no-op; a changed one
-                                                         auto-bumps the patch)
-                                --description <text>
-  amicus pack save <name> --from-run <id>
-                                Build a pack from an existing council run /
-                                fanout wave / solo session instead of flags
-                                (models, options, and a template REFERENCE only
-                                — briefing text is never captured)
-  amicus pack list [--json]    List saved packs
-  amicus pack show <name|path> [--json]
-                                Print a pack plus its validation report (never
-                                fails on an invalid pack — see 'validation')
-  amicus pack rm <name> [--json]   Remove a saved pack
+  amicus pack save <name> --from-run <id>   Build from an existing run (models/
+                                            options/template reference only — briefing never captured)
+  amicus pack list [--json]                 List saved packs
+  amicus pack show <name|path> [--json]     Print a pack + validation report
+  amicus pack rm <name> [--json]            Remove a saved pack
+  Flags: --bench <a,b,c|name> (council/fanout) · --model (solo) · --chair/--critic/--lenses
+  (council) · --debate/--no-debate (council) · --timeout/--max-cost/--gateway (shared) ·
+  --agent/--thinking/--summary-length (fanout/solo) · --template <name|path> (reference only,
+  not rendered) · --pack-version <semver> (the SAVED PACK's version, default 1.0.0; unchanged
+  re-save is a no-op, changed auto-bumps patch — NOT --version, which is amicus's own global
+  flag) · --description <text>
 `
 };
 

package/src/council/debate.js

@@ -8,12 +8,17 @@
  * new tally input plus the debate.json findings rows. run.js then re-runs
  * tally() on the returned input and decorates the record. Keeps run.js under the
  * line gate.
+ * Also holds the pure pre-debate helpers (target selection, dispute detection, re-vote bundling) moved from run-debate.js (v4.7 PR0).
  */
 
 const PAST_TENSE = { defend: 'defended', amend: 'amended', withdraw: 'withdrawn', 'no-response': 'no-response' };
 
-// runStats roles the ledger join must skip (ledger.js): a debate leg is an extra leg by an
-// already-benched model, never an extra ledger row and never that model's ledger identity.
+// The debate-role vocabulary: a debate leg is an extra leg by an already-benched model,
+// never an extra ledger row and never that model's ledger identity. Through v4.6 this Set
+// ALSO drove ledger.js's join skip-set directly; Task 7 (v4.7 D4) replaced that with
+// ledger.js's own LEDGER_JOIN_ROLES allowlist (fail-closed: everything not named there is
+// excluded, not just DEBATE_ROLES), so this Set no longer has any runtime consumer outside
+// this module — kept exported because debate.test.js pins its exact contents.
 const DEBATE_ROLES = new Set(['rebuttal', 'revote']);
 
 /**
@@ -78,21 +83,95 @@ function decorateRecord(record, debateFindings) {
 }
 
 /**
- * runStats rows for the debate legs (spec §5.5). role is 'rebuttal' | 'revote';
- * these legs never enter meta.models, so the ledger stays one row per (run×model),
- * and ledger.js skips DEBATE_ROLES when joining runStats so a debate leg cannot
- * overwrite the bench row's role/wasChair/conformance on that model's ledger row.
- * @param {{defenseLegs: Array, revoteLegs: Array}} args leg metadata
+ * runStats rows for the debate legs (spec §5.5), plus v4.7 D2/E4's row-per-launch
+ * extras: role is 'rebuttal' | 'revote' for the primary defense/re-vote legs,
+ * 'superseded' for an original leg a successful repair replaced, and 'repair' for
+ * a repair attempt that itself never became usable (error status rides naturally
+ * off the raw leg). The rebuttal/revote legs never enter meta.models, so the
+ * ledger stays one row per (run×model). DEBATE_ROLES remains the debate-role
+ * vocabulary (rebuttal/revote); the ledger's overwrite protection for ALL FOUR
+ * of these row-per-launch roles — rebuttal, revote, superseded AND repair —
+ * lives in ledger.js's own LEDGER_JOIN_ROLES allowlist (v4.7 D4, Task 7):
+ * a role not named there never joins, full stop, regardless of which module
+ * produced the row or whether it is even in DEBATE_ROLES.
+ * @param {{defenseLegs: Array, revoteLegs: Array, supersededLegs?: Array,
+ *   repairLegs?: Array}} args leg metadata
  * @returns {Array<object>}
  */
-function debateRunStatsRows({ defenseLegs, revoteLegs }) {
+function debateRunStatsRows({ defenseLegs, revoteLegs, supersededLegs, repairLegs }) {
   const mk = (role) => (l) => ({
     model: l.model, role, wasChair: false, conformance: l.conformance || 'clean',
     status: l.status || 'unknown',
     durationMs: typeof l.durationMs === 'number' ? l.durationMs : null,
     usage: l.usage || null,
+    ...(l.waveId ? { waveId: l.waveId } : {}),
+    ...(l.resolvedModel ? { resolvedModel: l.resolvedModel } : {}),
   });
-  return [...(defenseLegs || []).map(mk('rebuttal')), ...(revoteLegs || []).map(mk('revote'))];
+  return [
+    ...(defenseLegs || []).map(mk('rebuttal')),
+    ...(revoteLegs || []).map(mk('revote')),
+    ...(supersededLegs || []).map(mk('superseded')),
+    ...(repairLegs || []).map(mk('repair')),
+  ];
 }
 
-module.exports = { applyDebate, decorateRecord, debateRunStatsRows, PAST_TENSE, DEBATE_ROLES };
+/** Spec §5.7 fallback: a dead/unparseable defense means every bundled id's original stands. */
+function allNoResponse(ids) {
+  const byId = {};
+  for (const id of ids) { byId[id] = { action: 'no-response' }; }
+  return byId;
+}
+
+/** True when there is nothing to challenge (spec §5.1). */
+function nothingToDebate(provisionalRecord) {
+  if (!provisionalRecord || provisionalRecord.judged === false) { return true; }
+  const n = provisionalRecord.findings.filter(f => f.tier === 'Contested' || f.tier === 'Disputed').length;
+  return n === 0;
+}
+
+/** Judges whose provisional adjudications dispute at least one bundled id. */
+function disputingJudges(provisionalRecord, bundledIds) {
+  const ids = new Set(bundledIds);
+  const judges = new Set();
+  for (const f of provisionalRecord.findings) {
+    if (!ids.has(f.id)) { continue; }
+    for (const adj of f.adjudications || []) {
+      if (adj.verdict === 'dispute') { judges.add(adj.judge); }
+    }
+  }
+  return [...judges];
+}
+
+/** Group Contested+Disputed findings by raiser (defense targets). */
+function debateTargets(provisionalRecord, tallyInput) {
+  const claimById = new Map(tallyInput.findings.map(f => [f.id, f]));
+  const byRaiser = {};
+  const previousTier = {};
+  for (const f of provisionalRecord.findings) {
+    if (f.tier !== 'Contested' && f.tier !== 'Disputed') { continue; }
+    previousTier[f.id] = f.tier;
+    const src = claimById.get(f.id) || {};
+    const peerVerdicts = (f.adjudications || []).filter(a => a.judge !== f.raiser).map(a => a.verdict);
+    (byRaiser[f.raiser] = byRaiser[f.raiser] || []).push({ id: f.id, claim: src.claim,
+      severity: f.severity, location: src.location, peerVerdicts, disputeReasons: [] });
+  }
+  return { byRaiser, previousTier };
+}
+
+/** The re-vote bundle: defended-or-amended findings ONLY (spec §5.1 — withdrawn never appear). */
+function bundleFor(defenseResults, tallyInput) {
+  const out = [];
+  for (const dr of defenseResults) {
+    for (const [id, resp] of Object.entries(dr.byId)) {
+      if (resp.action !== 'defend' && resp.action !== 'amend') { continue; }
+      const src = tallyInput.findings.find(f => f.id === id) || {};
+      out.push({ id, severity: src.severity, amended: resp.action === 'amend',
+        claim: resp.action === 'amend' ? resp.claim : src.claim,
+        argument: resp.argument || 'defended without extra argument' });
+    }
+  }
+  return out;
+}
+
+module.exports = { applyDebate, decorateRecord, debateRunStatsRows, PAST_TENSE, DEBATE_ROLES,
+  allNoResponse, nothingToDebate, disputingJudges, debateTargets, bundleFor };

package/src/council/ledger.js

@@ -3,11 +3,55 @@
 const fs = require('fs');
 const path = require('path');
 const { getConfigDir } = require('../utils/config');
-const { DEBATE_ROLES } = require('./debate');
 
-const LEDGER_SCHEMA_VERSION = 1;
+// v4.7 GOA-7 D9: v2 rows may carry `resolvedModel` (the executable id that
+// served, copied from the joined runStats row, emit-only-when-set). Absent
+// resolvedModel ⇒ legacy row, aggregated under its alias (spec R2) — this
+// covers ALL pre-v2 history AND leg-less v2 rows (give-up chair, dead seats,
+// claude, hand-assembled tally input), whose resolution is genuinely
+// unknowable. Legacy-READ only: readers never inspect schemaVersion, rows are
+// never migrated.
+const LEDGER_SCHEMA_VERSION = 2;
 const LEDGER_FILE = 'council-ledger.jsonl';
 
+// v4.7 D4/E1/E2/E6 (Task-7, task-6/task-7 adjudications): fail-closed
+// ALLOWLIST of runStats roles the ledger join (below) may consume as a
+// model's ledger identity. 'council' is the legacy default role (pre-#83
+// runs, and the av-receiver golden fixture — errata E2, must stay green).
+// 'redteam' is the second-opinion skill's documented primary-seat role
+// (skills/second-opinion/MANUAL-ORCHESTRATION.md:147; red-team runs record
+// to the ledger per COUNCIL-DESIGN.md:266 — errata E6, task-7 review: without
+// it a red-team row's role/wasChair/conformance never join, silently
+// fabricating conformance:'clean' via the `|| 'clean'` fallback below).
+// 'judge' stays excluded (#83's overwrite-guard: judges ARE bench models, and
+// their Stage-2 cost-attribution row must never win over the seat row). Every
+// OTHER non-primary row-per-launch producer — 'chair-attempt', 'repair',
+// 'superseded', and the debate pair 'rebuttal'/'revote' — shares a model with
+// that model's real bench row and must never join either: skipped by
+// omission, including any future role never added here (fail-closed, not a
+// skip-list that a new producer could silently slip past). This is the E6
+// trade, made explicit: any free-form/custom role label a future producer
+// invents is rejected BY DESIGN until someone deliberately adds it here —
+// the allowlist would rather silently drop a legitimate new role's
+// role/wasChair/conformance (falling back to 'council'/false/'clean') than
+// ever let an unreviewed role win the model-keyed join.
+//
+// Final-review consolidated wave (owner-ruled): the ABSENCE of a role
+// (null/undefined) is a DIFFERENT case from a NAMED-unknown role and joins
+// too — this is the docs/council.md:562-blessed hand-assembled tally-input
+// shape ("the legacy default `council` … pre-#83 rows, or hand-assembled
+// tally input that never set a role"), and mirrors GOA-7's absent-field⇒
+// legacy pattern elsewhere in this codebase: a field that was never set gets
+// treated as the oldest/legacy shape, not silently dropped like an
+// unreviewed value would be. A NAMED custom label (e.g. 'custom-thing') is
+// still rejected exactly as E6 describes — only the missing-field case is
+// legacy; an actively wrong or unreviewed one is not.
+const LEDGER_JOIN_ROLES = new Set(['seat', 'critic', 'chair', 'claude', 'council', 'redteam']);
+function joinsLedger(role) {
+  return role === null || role === undefined ||
+    LEDGER_JOIN_ROLES.has(role) || (typeof role === 'string' && role.startsWith('lens:'));
+}
+
 function countSeverity(findings) {
   const c = { blocker: 0, major: 0, minor: 0, nit: 0 };
   for (const f of findings) { if (c[f.severity] !== undefined) { c[f.severity] += 1; } }
@@ -18,10 +62,10 @@ function countSeverity(findings) {
 function buildLedgerRows(record) {
   const { meta, findings, streetCred, runStats, judged } = record;
   const sc = new Map(streetCred.map(s => [s.model, s]));
-  // Judge rows (#83, v4.6 Plan 2) are Stage-2 cost attribution, not seats: the
-  // join below is keyed by MODEL, and judges ARE bench models — without this
-  // exclusion the judge row would silently overwrite the seat row.
-  const rs = new Map(runStats.filter(r => !DEBATE_ROLES.has(r.role) && r.role !== 'judge')
+  // The join below is keyed by MODEL — only allowlisted roles (joinsLedger,
+  // above) may win it, so a non-primary row-per-launch row can never
+  // silently overwrite a model's real bench (seat) row.
+  const rs = new Map(runStats.filter(r => joinsLedger(r.role))
     .map(r => [r.model, r]));
   return meta.models.map(model => {
     const raised = findings.filter(f => f.raiser === model);
@@ -39,6 +83,7 @@ function buildLedgerRows(record) {
       confirmRate: judged && denom ? raised.filter(f => f.tier === 'Confirmed').length / denom : null,
       factErrorRate: judged && denom ? raised.filter(f => f.tier === 'Disputed').length / denom : null,
       conformance: r.conformance || 'clean',
+      ...(r.resolvedModel ? { resolvedModel: r.resolvedModel } : {}),
     };
   });
 }
@@ -61,25 +106,41 @@ function readRows(dir) {
 
 function avg(nums) { return nums.length ? nums.reduce((s, x) => s + x, 0) / nums.length : null; }
 
-/** Aggregate the ledger per model. peersOnly nulls excluded; lowN flags < 3 runs. */
+/**
+ * Aggregate the ledger per model. peersOnly nulls excluded; lowN flags < 3 runs.
+ * v4.7 GOA-7 D10: groups by `row.resolvedModel || row.model` — v2 rows segment
+ * by the executable id that actually served; rows without a resolvedModel
+ * (pre-v2 history, leg-less rows, hand-assembled tally input) stay alias-keyed
+ * with `legacy: true`. `aliases` lists every row-level `model` (alias) observed
+ * for the group, most recently observed FIRST — ledger append order is the only
+ * recency signal (`date` is day-granular, free-form on the MCP path), so
+ * aliases[0] is the launch-preferred name (pickFallbackChair, D11).
+ * Version-blind by design: schemaVersion is never read (legacy-read, R2).
+ */
 function deriveReliability(opts = {}) {
   const dir = opts.dir || getConfigDir();
-  const byModel = new Map();
+  const byKey = new Map();
   for (const row of readRows(dir)) {
-    if (!byModel.has(row.model)) { byModel.set(row.model, []); }
-    byModel.get(row.model).push(row);
+    const key = row.resolvedModel || row.model;
+    if (!byKey.has(key)) { byKey.set(key, []); }
+    byKey.get(key).push(row);
   }
-  return [...byModel.entries()].map(([model, rows]) => {
+  return [...byKey.entries()].map(([model, rows]) => {
     const peers = rows.map(r => r.streetCredPeersOnly).filter(v => typeof v === 'number');
     const confirms = rows.map(r => r.confirmRate).filter(v => typeof v === 'number');
     const facts = rows.map(r => r.factErrorRate).filter(v => typeof v === 'number');
     const conformance = rows.reduce((acc, r) => { acc[r.conformance] = (acc[r.conformance] || 0) + 1; return acc; }, {});
+    const lastSeen = new Map();
+    rows.forEach((r, i) => { lastSeen.set(r.model, i); });
+    const aliases = [...lastSeen.entries()].sort((a, b) => b[1] - a[1]).map(([m]) => m);
     return {
       model, runs: rows.length, lowN: rows.length < 3,
       avgStreetCredPeersOnly: avg(peers),
       lifetimeConfirmRate: avg(confirms),
       lifetimeFactErrorRate: avg(facts),
       conformance,
+      aliases,
+      ...(rows.every(r => !r.resolvedModel) ? { legacy: true } : {}),
     };
   });
 }

package/src/council/presets-cli.js

@@ -45,18 +45,22 @@ function runSave(name, modelsArg, useJson) {
       hint: 'each member must be a known alias (see `amicus models`) or a provider/model id containing "/"' });
   }
   const overwritten = !!getCouncil(name);
+  const shadowsBuiltin = listBuiltinCouncilNames().includes(name);
   const cfg = loadConfig() || {};
   if (!cfg.councils) { cfg.councils = {}; }
   cfg.councils[name] = members;
   saveConfig(cfg);
-  const doc = { ok: true, name, models: members, overwritten };
+  const doc = { ok: true, name, models: members, overwritten, shadowsBuiltin };
   process.stdout.write(useJson ? JSON.stringify(doc, null, 2) + '\n' : renderSave(doc));
   return 0;
 }
 
 function renderSave(doc) {
   const notice = doc.overwritten ? ' (overwritten)' : '';
-  return `Saved council '${doc.name}'${notice}: ${doc.models.join(', ')}\n` +
+  const shadow = doc.shadowsBuiltin
+    ? `  note: '${doc.name}' now shadows the built-in bench of the same name — 'amicus council list' shows both\n`
+    : '';
+  return `Saved council '${doc.name}'${notice}: ${doc.models.join(', ')}\n` + shadow +
     "  for full run configuration — chair, options, templates — see 'amicus pack'\n";
 }
 

package/src/council/report.js

@@ -66,13 +66,24 @@ function toModel(verdict, wave) {
       .map(f => ({ id: f.id, previousTier: f.debate.previousTier, tier: f.tier })),
   };
   const runStats = verdict.runStats || [];
-  // Cost-row role tag (Plan 2 final review F1): #83 gave judges their own
-  // runStats row, so a bench model can now appear twice (seat + judge),
-  // indistinguishable by `model` alone. Tag ONLY judge rows — old verdicts have
-  // no judge rows at all, so chair/critic/lens/seat rows stay byte-identical to
-  // their historical rendering.
+  // Cost-row role tag (Plan 2 final review F1, extended v4.7 D6): #83 gave
+  // judges their own runStats row, so a bench model can now appear twice
+  // (seat + judge), indistinguishable by `model` alone. v4.7's row-per-launch
+  // producers (chair-attempt/repair/superseded) create the exact same
+  // collision for their model. Tag ONLY these four roles — old verdicts have
+  // none of them, so chair/critic/lens/seat rows stay byte-identical to their
+  // historical rendering (report.test.js:189-199 pins the judge case exactly).
+  // Object.create(null): a plain `{...}` literal inherits Object.prototype, so a role
+  // literally named 'constructor'/'toString'/etc would resolve to an inherited (truthy)
+  // function via bracket lookup instead of `undefined` — silently corrupting that row's
+  // rendered model label. A null-prototype object has no inherited keys to collide with.
+  const ROLE_SUFFIX = Object.create(null);
+  ROLE_SUFFIX.judge = 'judge';
+  ROLE_SUFFIX['chair-attempt'] = 'chair-attempt';
+  ROLE_SUFFIX.repair = 'repair';
+  ROLE_SUFFIX.superseded = 'superseded';
   const costRows = runStats.map(r => ({
-    model: r.role === 'judge' ? `${r.model} (judge)` : r.model,
+    model: ROLE_SUFFIX[r.role] ? `${r.model} (${ROLE_SUFFIX[r.role]})` : r.model,
     status: r.status, durationMs: r.durationMs,
     cost: r.usage && r.usage.cost ? r.usage.cost : null,
   }));

package/src/council/run-assemble.js

@@ -40,6 +40,9 @@ function worseConformance(a, b) {
  * leg doc yields durationMs/usage null (never invent a value). `model` (the
  * council alias) overrides leg.model (the resolved executable id) so ledger
  * rows join meta.models by exact string (ledger.js:20-24).
+ * `resolvedModel` (v4.7 GOA-7) preserves leg.model — the executable id that
+ * actually served, post-fallback-substitution — emit-only-when-set and never
+ * sourced from modelInput (an alias must never masquerade as a resolved id).
  *
  * ⚠️ LC-11 / review F1: `findingsUnverified` and `repairRefused` are the same
  * class of fact as `conformance` and ride the same row. They are the two halves
@@ -60,6 +63,8 @@ function buildRunStatsEntry({ leg, model, role, wasChair, conformance, findingsU
     conformance: conformance || 'clean',
     ...(findingsUnverified ? { findingsUnverified: true } : {}),
     ...(repairRefused ? { repairRefused } : {}),
+    ...(leg && leg.waveId ? { waveId: leg.waveId } : {}),
+    ...(leg && leg.model ? { resolvedModel: leg.model } : {}),
     status: leg ? leg.status : 'error',
     durationMs: leg && typeof leg.durationMs === 'number' ? leg.durationMs : null,
     usage: (leg && leg.usage) || null,
@@ -131,14 +136,17 @@ function claudeRunStatsRow() {
  * @param {{runId: string, date: string, bench: string[], chair: string,
  *   reviews: Array<{model, role, conformance, leg, globalFindings}>,
  *   judgeResults: Array<{judge, ok, order, adjudications}>,
- *   chairStats: object|null, claudeReview?: object|null}} args
+ *   chairStats: object|null, claudeReview?: object|null, extraRows?: Array<object>}} args
  *   `claudeReview` (v4.1 §4.4) amends the v4.0 meta pin: present ⇒ claudeInCouncil
  *   true, 'claude' joins meta.models (the street-cred universe), its findings join
  *   the pool and it gets the synthesized null-usage runStats row. Absent ⇒ v4.0
- *   output byte-for-byte.
+ *   output byte-for-byte. `extraRows` (v4.7 D2/E4) are pre-built runStats rows
+ *   (repair/superseded/dead-seat-error, from runStage1 today) appended right
+ *   after the primary review rows, before judge/chair accounting — absent or
+ *   empty ⇒ byte-for-byte unchanged, so the pre-v4.7 length-7 pins stay green.
  */
 function buildTallyInput({ runId, date, bench, chair, reviews, judgeResults, chairStats,
-  claudeReview }) {
+  claudeReview, extraRows }) {
   const meta = {
     runId, date, runType: 'headless',
     models: bench.slice(),          // bench seats exactly: critic included, chair excluded
@@ -154,6 +162,10 @@ function buildTallyInput({ runId, date, bench, chair, reviews, judgeResults, cha
     leg: r.leg, model: r.model, role: r.role, wasChair: false, conformance: r.conformance,
     findingsUnverified: r.findingsUnverified, repairRefused: r.repairRefused,
   }));
+  // v4.7 D2/E4: pre-built rows (repair/superseded/dead-seat-error) ride right
+  // after the primary review rows — same "primary-adjacent" shape, just not
+  // sourced from a surviving review. Absent/empty ⇒ no-op (pre-v4.7 byte parity).
+  runStats.push(...(extraRows || []));
   if (claudeReview) {
     meta.models.push(CLAUDE_SEAT);      // last, mirroring its review-N+1 label
     meta.claudeInCouncil = true;

package/src/council/run-budget.js

@@ -153,9 +153,9 @@ function createBudget({ allLegs, maxCost, runDir, degrade, write }) {
       channel: 'budget-refusal',
       what: `wave ${rec.waveId} (${rec.models.join(', ') || 'no models'}) — those seats DID NOT `
         + 'LAUNCH and are missing from this council',
-      why: `the $${maxCost} --max-cost ceiling refused it${message ? `: ${message}` : ''}`,
+      why: `the $${maxCost} cost ceiling for this run refused it${message ? `: ${message}` : ''}`,
       effect: 'The run continues with the bench that did launch and will exit degraded (2)',
-      remedy: 'Raise --max-cost, or pass --no-cost-gate, to seat them',
+      remedy: "Raise this run's cost ceiling, or turn the cost gate off, to seat them",
     });
     if (runDir) {
       // Never let bookkeeping sink a run that is otherwise fine.