amicus 4.6.3 → 4.7.1

package/docs/usage.md

@@ -9,7 +9,7 @@ The `am` alias is interchangeable with `amicus` everywhere.
 amicus start --model <model> --prompt "<task>"
 amicus start --model <model> --prompt-file briefing.md --no-ui --json
 amicus fanout --models "gemini,deepseek,gpt" --prompt "Review this" --json
-amicus list [--status <filter>] [--all] [--json]
+amicus list [--status <filter>] [--all] [--search <q>] [--limit <n>] [--json]
 amicus resume <task_id> [--no-ui --json]
 amicus continue <task_id> --prompt "Next step..." [--no-ui --json]
 amicus read <task_id> [--conversation|--metadata|--json]
@@ -96,6 +96,7 @@ amicus start --model deepseek --prompt "Generate tests" --no-ui --timeout 30
 | `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`). | |
 | `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. | |
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. | |
+| `--tag <t>` | Label this session for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; invalid values are rejected, never silently cleaned). | *(none)* |
 
 > Agents: **Chat** auto-approves reads and asks before writes/bash (interactive default); **Build** has full tool access (headless default); **Plan** is read-only analysis. `--agent Chat` is interactive-only and incompatible with `--no-ui`.
 
@@ -126,6 +127,7 @@ amicus fanout --council free --prompt "Review this design" --json
 | `--wave-id <id>` | Set the wave ID explicitly; leg IDs become `<wave-id>-1` … `<wave-id>-N`. |
 | `--session-id <id\|"current">` | Session ID to pull shared context from (default `current`). Same semantics as on `start`. |
 | `--json` | Emit the wave document on stdout. |
+| `--quiet` | Suppress per-leg progress ticks and the final wave-result summary (preflight errors are suppressed too). |
 | `--max-cost <$>` | Refuse the wave if the estimated total exceeds `$` (soft ceiling). |
 | `--no-cost-gate` | Disable the budget gate (per-$/Mtok threshold + ceiling) for this run. |
 | `--no-validate-model` | Skip catalog validation. |
@@ -134,6 +136,7 @@ amicus fanout --council free --prompt "Review this design" --json
 | `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`), shared by every leg. |
 | `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. |
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
+| `--tag <t>` | Label this wave (and every leg's spend row) for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; rejected, not cleaned). Mutually exclusive with `--retry-failed` (`BAD_ARGS`). |
 
 **Shared per-leg knobs.** Every leg in the wave also accepts the same per-leg options as `start`:
 `--agent`, `--thinking`, `--timeout`, `--summary-length`, `--no-context`, `--context-*`, `--mcp*`,
@@ -187,7 +190,7 @@ amicus council run --prompt-file briefing.md --models gemini,glm --chair deepsee
 | `--chair <model>` | Verdict synthesizer. Default `deepseek`; must **not** be a bench seat (pre-flight error). |
 | `--critic <model>` | Optional adversarial seat; must **be** a bench seat. Mutually exclusive with `--lenses`. |
 | `--lenses <s1,s2,...>` | Expert lenses, one per seat (count must equal seat count); forces `--no-ledger` semantics. |
-| `--out-dir <dir>` | Run directory. Default `./council-<runId>/`. |
+| `--out-dir <dir>` | Run directory. Default `./council-<runId>/`. Must resolve inside the project directory — a path that escapes it is rejected with `BAD_ARGS`. |
 | `--json` | Emit the council-run document on stdout (error envelope + documented exit codes on failure). |
 | `--max-cost <$>` | **Whole-run** ceiling on **known** spend, checked before each paid stage launch. A leg whose cost cannot be determined does not count against it and never halts the run; when the total is inexact and a ceiling is set, the run exits `2`. |
 | `--timeout <min>` | **Per-leg** timeout (fanout semantics); bound the aggregate with your CI job timeout. |
@@ -199,6 +202,7 @@ amicus council run --prompt-file briefing.md --models gemini,glm --chair deepsee
 | `--template <name\|path>` | Render a [briefing template](#briefing-templates) (`{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}`, `{{project}}`, `{{var.*}}`). |
 | `--artifact <file>` | File whose content fills `{{artifact}}`/`{{artifact_path}}` (256 KB cap). Requires `--template`. |
 | `--var <k=v>` | Set `{{var.<key>}}`; repeatable. Requires `--template`. |
+| `--tag <t>` | Label this run for `list`/`--search`/`spend --group-by tag` (1-64 chars, `[A-Za-z0-9_-]`; rejected, not cleaned). Every stage's sub-waves (Stage-1, critic/lens solos, Stage-2, chair, debate) carry the same tag on their wave metadata. |
 
 **Exit codes:** `0` full run · `2` degraded but reportable (fewer than 2 judges, chair failure —
 `overallVerdict: null` — a cost ceiling hit after the tally, or a `--max-cost` ceiling set over a
@@ -254,7 +258,7 @@ amicus template show review                # Print a template's raw text
 amicus start --model gemini --template review --artifact plan.md --var focus=performance --no-ui --json
 ```
 
-**Known variables** (`src/template/render.js`): `{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}` (`YYYY-MM-DD`), `{{project}}`, `{{var.<key>}}` (from repeatable `--var key=value`). There is no `{{input}}` in v4.5 — that chaining variable, and the `critique`/`refine` built-ins that need it, arrive with v4.6's composable waves.
+**Known variables** (`src/template/render.js`): `{{prompt}}`, `{{artifact}}`, `{{artifact_path}}`, `{{date}}` (`YYYY-MM-DD`), `{{project}}`, `{{var.<key>}}` (from repeatable `--var key=value`). There is no `{{input}}` in v4.5 — that chaining variable, and the `critique`/`refine` built-ins that need it, arrive with composable waves (`--input-from`) in a future release.
 
 **Strict by design — a typo fails loudly instead of silently dropping text:**
 
@@ -302,6 +306,8 @@ Then invoke it with `--pack <name|path>` on `start` / `fanout` / `council run`
 
 Every kind may also carry `description`, `version` (semver, default `1.0.0`), and `briefing.template` (a template **reference**, not rendered text — a pack never captures briefing prose).
 
+The `version` field is set with **`--pack-version <semver>`**, not `--version` — the latter is amicus's own global "print the version" flag, which is intercepted before command dispatch and so can never carry a pack's version. `pack save --version` is rejected with `BAD_ARGS` naming the right spelling.
+
 **Precedence: flag > pack > config default > built-in default.** A pack only fills in values you didn't type explicitly on the command line — anything you do pass always wins, and the pack is recorded on the run either way (see below), so a hand-tuned invocation of a saved pack is never ambiguous about what actually ran.
 
 **`--from-run <id>`** builds a pack from an existing council run, fanout wave, or solo session instead of flags — resolution order is council pointer → wave `metadata.json` → solo `metadata.json`. It captures the bench/model, chair/critic/lenses, and the run options that were actually used; **briefing text is never captured**, only a template *reference* when the source run recorded one.
@@ -356,7 +362,7 @@ pack. Confirmed against the run's own `run.json` for this exact invocation (irre
 {
   "bench": ["gemini", "deepseek", "gpt"],
   "chair": "opus",
-  "pack": { "name": "review-bench", "hash": "da084ba56162", "source": "dir" },
+  "pack": { "name": "review-bench", "version": "1.0.0", "hash": "da084ba56162", "source": "dir" },
   "options": { "timeout": 20, "maxCost": 2, "gateway": "auto", "outDir": "..." }
 }
 ```
@@ -372,11 +378,12 @@ pack is still recorded on the run either way.
 Amicus does **not** ship a frozen table of model names. Aliases and validation resolve against a **live catalog** fetched from provider APIs and cached at `~/.config/amicus/model-catalog.json` (24-hour TTL; the fetch works without an API key).
 
 ```bash
-amicus models                 # List the catalog
-amicus models --search gemini # Filter by substring over id and name
-amicus models --refresh       # Force-refresh from provider APIs
-amicus models --check         # Audit your aliases against the catalog
-amicus models --check --live  # + probe every stored alias with a real leg (spends)
+amicus models                  # List the catalog
+amicus models --search gemini  # Filter by substring over id and name
+amicus models --refresh        # Force-refresh from provider APIs
+amicus models --check          # Audit your aliases against the catalog
+amicus models --check --strict # + exit non-zero on curated per-gateway drift too
+amicus models --check --live   # + probe every stored alias with a real leg (spends)
 ```
 
 `amicus models --check` exits with the **number of stale aliases** (capped at 100) and prints same-vendor replacement suggestions for each, so it drops cleanly into CI.
@@ -387,7 +394,7 @@ direct namespace while the OpenRouter route still serves — a gateway-only rout
 no direct sibling is a routing choice, not staleness. Deliberately gateway-only
 entries (e.g. `gpt-pro`) are annotated as such and are never offered a retarget.
 
-**Drifted aliases.** `--check` (and the `doctor` aliases row) also flags **`DRIFTED:`** stored aliases — a stored alias whose target is still catalog-listed but no longer matches any route its family currently resolves to (the v4.6.1 `gemini` release-gate class, where `doctor` stayed green while the model behind it had moved on). Each drift line prints the exact `amicus setup --add-alias <alias>=<current>` refresh command. Drift is informational only — unlike stale aliases, it never changes the exit code.
+**Drifted aliases.** `--check` (and the `doctor` aliases row) also flags **`DRIFTED:`** stored aliases — a stored alias whose target is still catalog-listed but no longer matches any route its family currently resolves to (the v4.6.1 `gemini` release-gate class, where `doctor` stayed green while the model behind it had moved on). Each drift line prints the exact `amicus setup --add-alias <alias>=<current>` refresh command. Drift is informational only by default and does not change the exit code — pass `--strict` alongside `--check` to make curated per-gateway drift (stale or divergent direct/OpenRouter forms) exit non-zero too.
 
 **Live probe (`--check --live`).** Presence in the catalog is not proof of service — a stored alias can point at a model id the catalog still lists but the provider has quietly stopped serving (the v4.6.1 `gemini` incident). `--check` alone can't see that; `--live` can, by actually asking. Scope is **stored aliases only** (`amicus setup --add-alias`) — curated defaults follow the catalog by construction and have no "was it actually served" question for a live probe to answer. **This spends real money — one tiny leg per stored alias** — every probed alias gets one ordinary engine leg on a single quiet fan-out wave, with a real session dir and a real spend-ledger row, exactly as if you'd run it yourself.
 
@@ -424,7 +431,9 @@ Each stored alias resolves to one of three outcomes:
 amicus list                          # Current project
 amicus list --status running         # Filter: running, complete, error, timed-out,
                                       #         aborted, crashed, idle-timeout
-amicus list --all                    # All projects
+amicus list --all                    # All projects (cross-project, via the session index)
+amicus list --search foo             # Substring match: id, tag, briefing material (case-insensitive)
+amicus list --limit 20               # Only the 20 newest rows (0 = unlimited); pairs well with --all
 amicus list --json                   # Machine-readable
 
 amicus read <id>                     # Fold summary (default)
@@ -450,6 +459,47 @@ amicus setup --api-keys              # Open just the API-key window
 amicus setup --add-alias fast=google/gemini-2.5-flash   # Add/override one alias (bare canonical)
 ```
 
+**`amicus list` flags.** The CLI and the MCP `amicus_list` tool share one enumeration
+(`src/sidecar/read.js`'s `enumerateSessions`) for ordinary start/fanout rows, so those rows carry
+the same core fields everywhere: `id`, `model`, `status`, `mode` (`interactive`/`headless`),
+`type` (`run` by default), `parentWave` (`null` unless the row is a fan-out leg), `legCount`
+(`null` unless the row is a wave), and `tag` — the one field that's omitted, not `null`, when the
+session has none. The human-readable CLI table adds a `TAG` column. Council-run rows are an
+**MCP-only** row class: the CLI's own directory scan skips their `council-<runId>.json` pointer
+files (a pointer's filename fails the session-ID pattern every other row's directory name must
+match), so `amicus list` never shows a council run — only the MCP `amicus_list` tool merges them
+in, each carrying `type: 'council-run'`, a fixed `mode: 'headless'`, and its own 80-char sanitized
+`briefing` preview plus a `stage` field naming whichever stage is currently running. The MCP tool
+also re-sanitizes every other row's `briefing` to that same 80-char cap and, for any row still
+`status: 'running'`, adds live-progress fields (`phase`, `messageCount`, `lastActivityAt`,
+`latestPreview`) — enrichments the CLI table doesn't apply, since it prints the raw 30-char slice
+in-line instead. `--all` (CLI only) enumerates every project the global, advisory sessions-index
+knows about, deduped by canonical project identity, and stamps each row's `project` field (the
+CLI table adds a trailing `PROJECT` column whenever `--all` is set); a stale index entry pointing
+at a missing or unreadable project is skipped rather than surfaced as an error. `--search <q>`
+(both surfaces) is a case-insensitive substring filter over `id`, `tag`, and briefing material: a
+fan-out wave row reads its full `briefing.md` off disk (falling back to the row's 200-char excerpt
+if that file isn't readable), and a leg row (one spawned by a wave) matches on `id`/`tag` only —
+its briefing is the parent wave's, and matching it there would surface the same wave once per leg
+it spawned. On the MCP tool specifically, a council-run row's search material is `briefing.md`
+written at MCP launch time, or falls back to the portion of `briefing-stage1.md` after
+`--- MATERIAL / BRIEFING ---` (CLI-launched runs only ever have the latter file) — this clause is
+MCP-only, since the CLI never lists a council row to search in the first place. A bare `--search`
+with no value is a usage error on the CLI. Tag itself is set at launch with `--tag <t>` on
+`start`/`fanout`/`council run` (see those sections above), and is also a dimension for
+`amicus spend --group-by tag`. `amicus continue` and `amicus resume` don't take a `--tag` of
+their own — they automatically inherit the parent session's tag (see below).
+
+**Tag inheritance.** `amicus continue` and `amicus resume` carry the parent session's tag forward
+onto the new/reopened session's metadata and spend row, with no `--tag` flag needed — resume reuses
+the parent's own session directory, and continue copies the tag onto the new session it creates, so
+a multi-hop `continue` chain keeps the same tag at every depth. A `fanout --retry-failed` wave
+likewise replays the original wave's tag automatically. Because the tag in each of these cases
+comes from the session/wave being reopened rather than a fresh launch, `--tag` is rejected as a
+usage error when combined with `continue`, `resume`, or `--retry-failed` — there is nothing new to
+set. An untagged parent still leaves the key absent (not `null`) on the new metadata, and its spend
+row still groups under `(unattributed)`, exactly as an untagged `start`/`fanout` would.
+
 **`amicus status <id>` output.** Human-readable:
 
 ```
@@ -468,7 +518,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.6.3",
+  "version": "4.7.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }
@@ -528,7 +578,7 @@ Runs every check below, in order, and prints a ✓/⚠/✗ line for each plus a
 | `aliases` | Your configured aliases still resolve against the catalog | warn |
 | `anthropic-base-url` | `ANTHROPIC_BASE_URL` isn't host-form (host-form 404s every direct-Anthropic leg unless normalized) | warn |
 | `opencode-bin` | The OpenCode engine binary is on `PATH` | error |
-| `engine-mcp` | The engine copy `npx -y amicus@latest mcp` would actually launch (catches a broken npx-cache copy a healthy local install would hide) | warn (error only if there's exactly one npx-cache copy and it's broken) |
+| `engine-mcp` | The engine copy `npx -y amicus@latest mcp` would actually launch (catches a broken npx-cache copy a healthy local install would hide, and a version-skewed one — present but the wrong opencode-ai release vs. the global install, #133) | warn (error only if there's exactly one npx-cache copy and it's broken; also warns, never errors, on engine version skew between the npx copies and the global install) |
 | `electron` | Electron (the interactive GUI) is installed | warn — headless still works |
 | `skills` | Both skills exist under `~/.claude/skills/` | warn |
 | `mcp` | Amicus is registered as an MCP server in Claude Code | warn |
@@ -575,7 +625,7 @@ Reads `~/.config/amicus/spend-ledger.jsonl` (one row per completed run/leg) and
 | `--model <id-or-prefix>` | rows whose model id starts with the given string |
 | `--op <op>` | rows for one operation (`start`, `leg`, `continue`, `resume`, …) |
 | `--failed` | rows with an explicit non-`complete` status (see the caveat below) |
-| `--group-by <dim>` | bucket totals by `model` (default) \| `wave` \| `council` \| `project` \| `op` \| `day` |
+| `--group-by <dim>` | bucket totals by `model` (default) \| `wave` \| `council` \| `project` \| `op` \| `day` \| `tag` (untagged rows group under `(unattributed)`) |
 | `--rows` | also emit the raw filtered rows (capped at 1000; `--json` sets `rowsTruncated: true` past the cap) |
 
 All filters compose, e.g. `amicus spend --project . --group-by model --since 7d`.

package/electron/workspace-ui/index.html

@@ -105,6 +105,9 @@
   <!-- ⚠️ D8 extraction (Task 1, v4.6.2 PR4): workspace-seats.js must load BEFORE
        workspace-panels.js, whose renderSeatsPanel delegates to it. -->
   <script src="./workspace-seats.js"></script>
+  <!-- ⚠️ v4.7 PR7 extraction: workspace-lazy.js must load BEFORE workspace-panels.js,
+       whose wireLazyPanels/proseLoader delegate to it. -->
+  <script src="./workspace-lazy.js"></script>
   <!-- ⚠️ DE-ROT (F05): panels + verbs are the Task 13 split of workspace-app.js.
        Load order matters: workspace-app.js boots last and owns `state`. -->
   <script src="./workspace-panels.js"></script>

package/electron/workspace-ui/live-model.js

@@ -94,9 +94,27 @@
     ];
   }
 
+  // v4.7 D6/E1: three row-per-launch producer roles added alongside the
+  // existing chair-attempt (run-chair.js), repair (run-stages.js/
+  // run-stage2.js/run-chair.js) and superseded (run-stages.js + debate.js)
+  // rows — launch-accounting extras, not seats, and unlike rebuttal/revote
+  // (F37, kept rendering on purpose below) they have no seats-panel meaning
+  // of their own. There is no pre-existing allowlist in this function (E1) —
+  // this is a plain exclusion added on top of the untouched id/shape logic.
+  // Object.create(null): a plain `{...}` literal inherits Object.prototype, so a role
+  // literally named 'constructor'/'toString'/etc would resolve to an inherited (truthy)
+  // function via bracket lookup instead of `undefined` — silently mis-excluding (or
+  // mis-including) that seat. A null-prototype object has no inherited keys to collide with.
+  var SEATS_PANEL_EXCLUDED_ROLES = Object.create(null);
+  SEATS_PANEL_EXCLUDED_ROLES['chair-attempt'] = true;
+  SEATS_PANEL_EXCLUDED_ROLES.repair = true;
+  SEATS_PANEL_EXCLUDED_ROLES.superseded = true;
+
   /** Terminal fallback: derive seat-shaped rows from tally runStats cost rows. */
   function seatsFromRunStats(costRows) {
-    return (costRows || []).map(function (r) {
+    return (costRows || []).filter(function (r) {
+      return !SEATS_PANEL_EXCLUDED_ROLES[r.role];
+    }).map(function (r) {
       return {
         // ⚠️ DE-ROT (F37): composite id — a v4.1 `--debate` run emits extra runStats rows for
         // the SAME bench alias (role 'rebuttal'/'revote', src/council/debate.js:88-96). With no
@@ -130,13 +148,23 @@
    * loss, an out-of-range index, or a zero-model unit) carry neither, so they
    * correctly fall back to the plain phrasing.
    *
-   * D6 filter (zero usable legs ONLY, "no ghost when a retry succeeded"): a
-   * candidate already present in `liveSeats` (it has a cost row — SL-2 healed
-   * it) is dropped. This is the one thing standing between a recovered seat
-   * and a duplicate/ghost row — same failure family as the F37 debate-role
-   * collision and the RN-11 keyed-row lessons just above (seatsFromRunStats,
-   * seatCells): an identity that is not carefully matched silently
-   * duplicates or overwrites instead of failing loud.
+   * D6 filter (zero usable legs ONLY, "no ghost when a live row already
+   * exists"): a candidate already present in `liveSeats` is dropped. Two
+   * different things can put it there, and both are reasons to suppress:
+   * an SL-2 retry actually healed it (a real recovered review), OR
+   * (owner-ruled, v4.7 CA-4 dead-seat convergence) the seat never recovered
+   * at all but the row-per-launch machinery still gives its dead leg an
+   * honest primary ERROR row (every billed leg gets a row now, including
+   * failures — run-stages.js/run-assemble.js) — so "it has a cost row" no
+   * longer implies "it healed". Either way that live row IS the seat's
+   * record; rendering a second "did not review" ghost row beside it would
+   * be a duplicate, not new information, so suppressing it here is the
+   * ACCEPTED terminal-path behavior: exactly one row per seat, whatever its
+   * status. This is the one thing standing between a recovered (or
+   * honestly-erred) seat and a duplicate/ghost row — same failure family as
+   * the F37 debate-role collision and the RN-11 keyed-row lessons just above
+   * (seatsFromRunStats, seatCells): an identity that is not carefully
+   * matched silently duplicates or overwrites instead of failing loud.
    *
    * Role-aware D6 (v4.6.3 PR2, spec D3): a bare model match used to suppress
    * regardless of what the LIVE row's role was — so a model that died as
@@ -152,9 +180,9 @@
    * suppression below (`byRole[alias + '|critic']`) relies on `roleFor`'s
    * critic branch (src/council/run-stages.js), which only fires when lenses
    * are absent — safe today only because --critic and --lenses are mutually
-   * exclusive (cli-handlers-council-run.js:196); if that exclusion ever
-   * loosens, a healed critic on a lens run would carry role 'seat' and this
-   * suppression would render a ghost dead row for it.
+   * exclusive (src/cli-handlers-council-run.js's `critic && lenses` check); if
+   * that exclusion ever loosens, a healed critic on a lens run would carry
+   * role 'seat' and this suppression would render a ghost dead row for it.
    *
    * Old-run resilience (v4.6.3 PR2, spec D4): pre-`degrades[]` runs (v4.5.2)
    * carry the BENCH half of a seat loss only in `seatLoss.deadBenchSeats`
@@ -180,7 +208,12 @@
    */
   function deadSeats(degrades, seatLoss, liveSeats, runMeta) {
     var critic = runMeta && runMeta.critic ? runMeta.critic : null;
-    var seen = {};
+    // ⚠️ Object.create(null) throughout this family (also workspace-render.js's
+    // `existing`/`seen` and workspace-app.js's `labelByModel`): a model literally
+    // named `toString` is truthy off a bare object, so it was dropped here and —
+    // worse — crashed workspace-render.js:212 reading `.children` off an inherited
+    // function, killing the seats repaint and every tick after it.
+    var seen = Object.create(null);
     var order = [];
     function add(model, retried, role) {
       if (!model || seen[model]) { return; }
@@ -220,12 +253,17 @@
     // a dead-critic candidate is cleared only by a live CRITIC leg. A null
     // role is NOT reviewing: counting it would suppress silently, the exact
     // class the announcement invariant forbids.
+    // Role 'claude' is deliberately absent: it is emitted only by claudeRunStatsRow
+    // (src/council/run-assemble.js:129-132) for a seat that never launches a leg, and
+    // preflightClaudeReview (run-assemble.js:86-102) rejects 'claude' as chair/critic/
+    // bench — so no 'claude' leg can die. If that reservation ever loosens, this
+    // allowlist is the single place to extend.
     function isReviewing(role) {
       return role === 'seat' || role === 'critic' ||
         (typeof role === 'string' && role.indexOf('lens:') === 0);
     }
-    var reviewing = {};
-    var byRole = {};
+    var reviewing = Object.create(null);
+    var byRole = Object.create(null);
     // ⚠️ Fable review (PR4b fix wave): same F34/F36 alias-selection seatCells already uses
     // (`seat.modelInput || seat.model`, above) — a LIVE payload seat's `model` is the RESOLVED
     // executable id, not the alias a degrade record names; `modelInput` carries the alias.

package/electron/workspace-ui/workspace-app.js

@@ -26,6 +26,9 @@
     debate: null,   // ⚠️ DE-ROT (F38): parsed debate.json, fetched once per run-open; stays
                      // null on a non-debate run, an aborted/skipped debate, or a parse failure —
                      // drillIntoJudge's judge-*.md fallback covers all three.
+    debateFetch: null, // T18-m1: test seam — the fire-and-forget debate.json fetch promise
+                        // (null when no fetch was issued for the open run). Nothing renders
+                        // from this; tests may `await state.debateFetch` to sequence past it.
     blind: false,
     // Task 19 (RN-5) + fix-wave (RN-5 amendment): the (run id, status) pair renderDetail() last
     // computed state.blind's default for. Together they gate the recompute (in renderDetail(),
@@ -34,7 +37,7 @@
     // live loop's running -> terminal refresh, or the abort-confirm re-read) still auto-reveals.
     detailRunId: null,
     detailRunStatus: null,
-    labelByModel: {},
+    labelByModel: Object.create(null),
     listTimer: null,
     liveTimer: null, // LIVE (Task 15)
     liveEpoch: 0,    // LIVE (Task 15): bumped by stopLiveLoop() to invalidate in-flight ticks
@@ -66,6 +69,13 @@
   function openRun(runId) {
     state.runId = runId;
     state.debate = null;
+    // Fix-wave item 2: reset synchronously alongside state.debate so the contract comment
+    // above ("null when no fetch was issued for the open run") holds in EVERY window —
+    // including between this openRun(runId) call and its get-run reply, where the old
+    // in-.then reset left state.debateFetch pointing at the PREVIOUS run's promise. The F09
+    // stale-reply guard (below) early-returns before ever touching debateFetch again, so
+    // moving the reset here changes no other behavior.
+    state.debateFetch = null;
     return invoke('workspace:get-run', runId).then(function (detail) {
       // F09 guard (v4.6.3 PR2): a reply for a run the user has since
       // navigated away from must never overwrite the run now open. Guard on
@@ -83,8 +93,9 @@
       // navigated away from must never overwrite the run now open. Capture `runId` and check
       // it's still `state.runId` before writing; a rejection (dead channel, closed window) is
       // caught too, so it never surfaces as an unhandled rejection in the renderer.
+      // (state.debateFetch reset moved synchronously above, beside state.debate — fix-wave item 2.)
       if (detail && detail.run && detail.run.debate) {
-        invoke('workspace:read-artifact', runId, 'debate.json').then(function (res) {
+        state.debateFetch = invoke('workspace:read-artifact', runId, 'debate.json').then(function (res) {
           if (state.runId !== runId) { return; }
           try { state.debate = JSON.parse(res.text); } catch (err) { state.debate = null; }
         }).catch(function () {
@@ -133,7 +144,7 @@
       state.detailRunStatus = d.run.status;
     }
     $('blind-toggle').checked = state.blind;
-    state.labelByModel = {};
+    state.labelByModel = Object.create(null);
     d.derived.names.forEach(function (p) { state.labelByModel[p.model] = p.label; });
 
     $('run-title').textContent = d.runId;

package/electron/workspace-ui/workspace-lazy.js

@@ -0,0 +1,233 @@
+/**
+ * Council Workspace — lazy prose-panel loading (v4.4 §5.2). v4.7 PR7 extraction of the
+ * loading machinery out of workspace-panels.js, which was at 294/300 with the T19 stale-paint
+ * fixes still to land; the same treatment workspace-seats.js got in v4.6.2 PR4 (D8).
+ *
+ * Split line: this file owns WHEN and WHETHER an artifact read is issued and which reply is
+ * allowed to paint (the `loading` promise cache, the run/issue staleness fences).
+ * workspace-panels.js keeps NAME RESOLUTION (sanitizeName / resolveArtifactName — the RN-1
+ * disambiguation pair, pinned by tests/electron/workspace-ui-static.test.js) and the panel
+ * adapters. Cross-calls resolve `window.Amicus*` at CALL time, never at this file's load time
+ * — the house discipline for every renderer script.
+ *
+ * Loads AFTER workspace-seats.js and BEFORE workspace-panels.js (index.html), whose
+ * wireLazyPanels/proseLoader are thin delegates into this namespace.
+ */
+(function () {
+  'use strict';
+
+  // ---- lazy prose panels (spec §5.2: load on first open; NOT cached across a same-run rewire
+  // — a blind flip or the live loop's terminal refresh both drop it, T19-m1) -----------------
+  // ⚠️ DE-ROT (F09): a NEW toggle listener stacking on every renderDetail() call is the bug this
+  // shape exists to avoid — see wireLazyPanels()/proseLoader() below. Register the three
+  // listeners ONCE at boot (workspace-app.js's boot block calls proseLoader per panel id) and
+  // dispatch through this module-level `loaders` map, which renderDetail (via wireLazyPanels)
+  // overwrites per run.
+  //
+  // ⚠️ PRE-FLIGHT (P4): the load is AWAITABLE — drillIntoJudge needs to know when it has
+  // settled (the old code guessed with setTimeout(render, 300), which could fire before an
+  // unbounded N-artifact IPC round trip finished and silently render nothing). loadPanel()
+  // is idempotent per panel id and returns its in-flight promise; the promise cache
+  // (`loading`) and the per-run spec (`loaders`) are both keyed by panel id. `loading` is
+  // dropped by wireLazyPanels() on BOTH a run CHANGE and a same-run rewire (T19-m1, Task 3) —
+  // the run-change drop is what stops F09's stale-run artifact requests; the same-run drop is
+  // what T19-m1's `issue` token (below) fences against repainting a superseded same-run wave.
+  var loaders = {};  // panelId -> {bodyId, files}  (rewritten per run by wireLazyPanels)
+  var loading = {};  // panelId -> Promise           (dropped on every run CHANGE or same-run rewire)
+  // Task 19 (RN-5): the run wireLazyPanels() last reset panels/loading for — gates the reset
+  // below to run CHANGES only. A same-run call (renderDetail() runs this on every blind toggle
+  // too, and on the live loop's terminal refresh) instead drops the cached load for EVERY
+  // tracked panel — open or closed (T19-m1, Task 3) — and reissues a fetch for whichever panel
+  // is currently open (Fix 1).
+  var lastWiredRunId = null;
+  // ⚠️ T19-m1 (v4.7 PR7): the only staleness fence used to be the runId captured at issue time,
+  // which cannot distinguish two requests issued for the SAME run — a blind flip, a manifest that
+  // grew, or any same-run rewire issues a second load while the first is still in flight, and
+  // whichever settles LAST won the paint. Monotonic per-panel issue number: the completion handler
+  // paints only if it is still the newest issue. Keys are the three fixed panel-id literals (never
+  // a model name), so a bare object is safe here — unlike the model-keyed maps in live-model.js.
+  var issue = {};    // panelId -> monotonically increasing issue number
+
+  function loadPanel(panelId, bodyId, files) {
+    var A = window.AmicusApp;
+    if (loading[panelId]) { return loading[panelId]; }
+    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): this is the third
+    // instance of the F09 class of bug (a stale async response overwriting shared DOM after
+    // the user has navigated away) — already fixed once for the toggle-listener stack (F09
+    // itself) and once for the fire-and-forget debate.json fetch in workspace-app.js (guards
+    // with `if (state.runId !== runId) return;`). wireLazyPanels() clearing `loading[panelId]`
+    // on every run switch permits a NEW request to be issued, but never fenced the PRIOR
+    // request's eventual resolution — open reviews-panel on run A, switch to run B (which
+    // issues its own request), and A's response — however late — used to overwrite whatever
+    // B had just rendered. Capture the runId this request was issued for, and guard as the
+    // FIRST statement of the completion handler, exactly like the debate.json fix.
+    var runId = A.state.runId;
+    // ⚠️ T19-m1 (v4.7 PR7): captured the same way as `runId` above — read once, at issue time —
+    // so the completion guard below compares against the value in force when THIS request was
+    // issued, not whatever `issue[panelId]` has become by the time it resolves.
+    var token = (issue[panelId] = (issue[panelId] || 0) + 1);
+    var pending = Promise.all(files().map(function (f) {
+      return A.invoke('workspace:read-artifact', runId, f.name).then(function (res) {
+        return { name: f.name, title: f.title, text: res.text || '', truncated: res.truncated, error: res.error };
+      });
+    })).then(function (sections) {
+      if (A.state.runId !== runId || issue[panelId] !== token) { return; } // stale: superseded
+      window.AmicusRender.renderProseSections(A.$(bodyId), sections.map(function (s) {
+        return s.error ? { name: s.name, title: s.title, error: s.name + ' — ' + s.error } : s;
+      }));
+      A.$(panelId).dataset.loaded = '1';   // display/debug marker only — `loading` is the real gate
+    }, function (err) {
+      // ⚠️ T19-m2 (v4.7 PR7). Two-argument .then(onFulfilled, onRejected) — NOT a trailing
+      // .catch. workspace-verbs.js:76-84 already ruled on this exact construct: with a trailing
+      // .catch a THROW inside onFulfilled is routed here too, so a painter bug would be absorbed
+      // into a silent blank panel that ALSO evicts its own cache and therefore retries forever.
+      // With the two-argument form this handler only ever sees a genuinely rejected invoke().
+      // The `=== pending` self-check is load-bearing: without it a late rejection can evict a
+      // NEWER in-flight promise from `loading[panelId]`. That newer promise still resolves and
+      // paints fine on its own — it is not stranded — but the eviction leaves no cache entry
+      // behind for it, so a toggle that lands before it settles finds `loading[panelId]` empty
+      // and fires a spurious duplicate fetch. And the log is not optional — a silent
+      // eviction is the correct-but-silent degrade the product principle rejects.
+      if (loading[panelId] === pending) { delete loading[panelId]; }
+      console.error('workspace lazy panel: read-artifact failed for ' + panelId, err);
+    });
+    loading[panelId] = pending;
+    return pending;
+  }
+
+  /** Registered ONCE at boot (per panel id); reads the current run's spec off `loaders`. */
+  function proseLoader(panelId) {
+    var A = window.AmicusApp;
+    var panel = A.$(panelId);
+    panel.addEventListener('toggle', function () {
+      if (!panel.open) { return; }
+      var spec = loaders[panelId];
+      if (spec) { loadPanel(panelId, spec.bodyId, spec.files); }
+    });
+  }
+
+  /**
+   * Rewrites the per-run spec map on every call. On a run CHANGE (tracked via the module-level
+   * `lastWiredRunId`, above), resets panel open/loaded state and drops the previous run's
+   * cached load promises — exactly what F09's stale-run protection needs. On a SAME-run call
+   * (Task 19, RN-5: renderDetail() calls this on every blind toggle too, and the live loop's
+   * terminal refresh) any panel the user already has open is instead refreshed in place — see
+   * Fix 1 below — never left showing stale-blind content, never collapsed. Registers no
+   * listeners itself.
+   */
+  function wireLazyPanels() {
+    var A = window.AmicusApp;
+    // ⚠️ Fix-wave (Fix 4): keyed off `A.state.detail.runId`, not `A.state.runId` — the latter is
+    // set synchronously at the top of openRun(), before its workspace:get-run reply lands, so an
+    // out-of-order reply could make the two diverge. workspace-app.js's own run-change gate
+    // (renderDetail(), above `d.runId`) reads off the SAME `state.detail.runId`, so the two
+    // provably agree on whether this is a run change.
+    var sameRun = A.state.detail.runId === lastWiredRunId;
+    if (!sameRun) {
+      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
+        var p = A.$(id);
+        p.dataset.loaded = '0';
+        p.open = false;
+        delete loading[id];
+      });
+      lastWiredRunId = A.state.detail.runId;
+    }
+    var bench = A.state.detail.run.bench || [];
+    var debated = !!A.state.detail.run.debate;
+    // ⚠️ CODE REVIEW (round 2, finding 2): readRunArtifact's error for a genuinely-missing
+    // artifact is NOT translated into a friendly "not written yet" note anywhere in this
+    // read path — it lands in the panel verbatim, absolute host path and all. `run.debate` is
+    // seeded on run.json's FIRST write, so it's truthy on every --debate run, including ones
+    // where the re-vote wave never actually ran (no contested findings, cost ceiling, abort) —
+    // requesting revote-<model>.md speculatively in that (near-certain) case means one ugly
+    // error row per bench model for a condition that isn't an error at all. run-detail.js
+    // already computes a presence manifest (state.detail.artifacts) for exactly these
+    // allowlisted names via fs.statSync — filter on it instead of requesting known-absent
+    // files. Applies to review-/judge- too (the same latent gap, just plan-mandated rather
+    // than new).
+    var artifacts = A.state.detail.artifacts || {};
+    function present(name) { return !!(artifacts[name] && artifacts[name].present); }
+    // ⚠️ v4.4.1 RN-9: these two titles used to hand-roll `A.state.blind && label ? label : m`
+    // inline. Both now go through AmicusRender.display() — the single blind-flip definition the
+    // re-vote title below already used — so the next blind-mode ruling lands in one place instead
+    // of being re-applied by hand in every file that happens to render an identity.
+    loaders['reviews-panel'] = { bodyId: 'reviews-body', files: function () {
+      return bench.map(function (m) {
+        var label = A.state.labelByModel[m];
+        return { name: window.AmicusPanels.resolveArtifactName(m, 'review'), title: window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+      }).filter(function (f) { return present(f.name); });
+    } };
+    loaders['bundle-panel'] = { bodyId: 'bundle-body', files: function () {
+      // ⚠️ v4.4.1 RN-4: the presence filter is NOT optional here either. Without it, a run whose
+      // Stage 2 never ran (a one-seat bench, an abort before the cross-review, a cost ceiling)
+      // requested a file the manifest already knows is absent and rendered readRunArtifact's raw
+      // error string in the panel — "absolute host path and all", per this file's own round-2
+      // note above `present()`. reviews-panel and judges-panel have always filtered; this was the
+      // odd one out.
+      return [{ name: 'bundle-stage2.md', title: 'bundle-stage2.md (verbatim)' }]
+        .filter(function (f) { return present(f.name); });
+    } };
+    loaders['judges-panel'] = { bodyId: 'judges-body', files: function () {
+      var files = bench.map(function (m) {
+        var label = A.state.labelByModel[m];
+        return { name: window.AmicusPanels.resolveArtifactName(m, 'judge'), title: 'Judge ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+      });
+      if (debated) {
+        // ⚠️ DE-ROT (F38): on a --debate run, a matrix dispute cell can be a RE-VOTE whose
+        // prose lives in revote-<model>.md (not judge-<model>.md). Included per bench model
+        // like judge-*.md above, but — per the presence filter — only when the manifest
+        // confirms the file actually exists (see the code-review note above `present()`).
+        // ⚠️ CODE REVIEW (round 2, finding 3): this title is new code (unlike the review-/
+        // judge- titles above, which mirror the brief verbatim), so it goes through
+        // AmicusRender.display() — the single blind-flip definition — rather than adding a
+        // fourth hand-rolled copy of the same ternary.
+        // ⚠️ Task 18 fix-wave (RN-1, review finding 1): this name used to be recomputed via a
+        // bare sanitizeName(m) call, ignoring the disambiguation map entirely — for a colliding
+        // pair BOTH models resolved to the same bare revote-<sanitized>.md name, reintroducing
+        // for re-votes the exact cross-match bug Task 18 fixed for review-/judge-. Routed
+        // through resolveArtifactName(m, 'revote') like the other three sites; its built-in
+        // legacy fallback keeps older detail payloads (no artifactsByModel map) correct too.
+        files = files.concat(bench.map(function (m) {
+          var label = A.state.labelByModel[m];
+          return { name: window.AmicusPanels.resolveArtifactName(m, 'revote'), title: 'Re-vote ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+        }));
+      }
+      return files.filter(function (f) { return present(f.name); });
+    } };
+    // ⚠️ Fix-wave (Fix 1, RN-9): a same-run call (the blind toggle, or the live loop's
+    // running -> terminal refresh) must re-render any panel the user already has open, or it
+    // keeps showing content painted under the PREVIOUS blind state. renderProseSections()
+    // (workspace-render.js) clears its container before repainting, so this replaces sections
+    // in place rather than appending duplicates. Drop the cached promise first so loadPanel()
+    // actually re-fetches instead of returning its already-settled one.
+    if (sameRun) {
+      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
+        var p = A.$(id);
+        // ⚠️ T19-m1 (v4.7 PR7): the cache drop used to be INSIDE the `p.open` guard, so a panel
+        // the user had collapsed kept its settled promise across a blind flip — reopening it
+        // returned that promise and repainted the previous blind state with no new fetch (recon
+        // path A). Dropping unconditionally closes path A — but by itself it only CONVERTS path D
+        // (collapse mid-flight) into a race: it drops the cache entry even while that panel's
+        // fetch is still outstanding, so a reopen before it settles issues a SECOND concurrent
+        // fetch, and the orphaned first one has no fence but `runId` (unchanged for a same-run
+        // rewire). `issue` (declared above) and loadPanel()'s completion guard are what actually
+        // close D. Unconditional drop costs a re-read of that panel's artifacts on the next open;
+        // renderDetail fires on run open, blind toggle, and the live loop's terminal refresh only
+        // (the tick calls applyLive, not renderDetail), so this is not a per-poll storm.
+        delete loading[id];
+        if (p.open) { loadPanel(id, loaders[id].bodyId, loaders[id].files); }
+      });
+    }
+  }
+
+  // `loaders` stays module-private; drillIntoJudge (still in workspace-panels.js) needs to ask
+  // whether this run has a spec for a panel, and nothing else needs the map itself.
+  function panelSpec(panelId) { return loaders[panelId] || null; }
+
+  window.AmicusLazy = {
+    loadPanel: loadPanel,
+    proseLoader: proseLoader,
+    wireLazyPanels: wireLazyPanels,
+    panelSpec: panelSpec,
+  };
+})();

package/electron/workspace-ui/workspace-matrix.js

@@ -76,7 +76,18 @@
           'aria-label': verdictTitle(cell),
         }, [cell.sym + (cell.isRaiser ? '*' : '')]);
         if (cell.verdict === 'dispute') {
-          td.addEventListener('click', function () { onDrill(cell.judge, row.id); });
+          // ⚠️ T19-m2 (v4.7 PR7): drillIntoJudge's derived promise was discarded here, so a
+          // rejection — or a throw inside its own post-load body, which loadPanel's onRejected
+          // does NOT cover — escaped unhandled. `Promise.resolve(onDrill(...))` would NOT fix the
+          // synchronous half: onDrill(...) is evaluated BEFORE Promise.resolve sees it, so the
+          // throw escapes anyway (measured). Calling it inside the .then callback moves both the
+          // sync and async failure modes onto the chain. A trailing .catch is correct HERE
+          // (unlike loadPanel — see workspace-verbs.js:76-84) because there is no separate
+          // onFulfilled whose throw it could absorb: the callback IS the whole operation.
+          td.addEventListener('click', function () {
+            Promise.resolve().then(function () { return onDrill(cell.judge, row.id); })
+              .catch(function (err) { console.error('workspace matrix: drill into judge failed', err); });
+          });
         }
         cells.push(td);
       });