amicus 4.6.3 → 4.7.1

package/electron/workspace-ui/workspace-panels.js

@@ -1,14 +1,23 @@
 /**
- * Council Workspace — lazy/prose panels + the matrix/verdict panel adapters
- * (v4.4 §5, ⚠️ DE-ROT F05 split of workspace-app.js).
+ * Council Workspace — name resolution + the matrix/verdict/seats panel adapters
+ * (v4.4 §5, ⚠️ DE-ROT F05 split of workspace-app.js). v4.7 PR7 (Task 1) moved the lazy
+ * prose-panel loading machinery (loaders/loading/lastWiredRunId state, loadPanel,
+ * proseLoader, wireLazyPanels) out to workspace-lazy.js — this file was pressed up against
+ * the 300-line size gate with the T19 stale-paint fixes still to land, the same treatment
+ * workspace-seats.js got in v4.6.2 PR4 (D8).
+ *
+ * Split line: this file owns NAME RESOLUTION (sanitizeName / resolveArtifactName — the RN-1
+ * disambiguation pair, pinned by tests/electron/workspace-ui-static.test.js) and the panel
+ * adapters; workspace-lazy.js owns WHEN and WHETHER an artifact read is issued and which
+ * reply is allowed to paint.
  *
  * Loads BEFORE workspace-app.js (md-lite → live-model → workspace-render →
- * workspace-matrix → workspace-seats → workspace-panels → workspace-verbs →
- * workspace-app), so every function here reads `window.AmicusApp` /
- * `window.AmicusVerbs` at CALL time (never captured at this file's own load
- * time — neither namespace exists yet when this IIFE runs). window.AmicusApp
- * publishes its namespace at the top of its own boot, before calling into this
- * file, so by the time any function below actually executes, both are present.
+ * workspace-matrix → workspace-seats → workspace-lazy → workspace-panels →
+ * workspace-verbs → workspace-app), so every function here reads `window.AmicusApp` /
+ * `window.AmicusVerbs` / `window.AmicusLazy` at CALL time (never captured at this file's
+ * own load time — none of those namespaces exist yet when this IIFE runs). window.AmicusApp
+ * publishes its namespace at the top of its own boot, before calling into this file, so by
+ * the time any function below actually executes, all three are present.
  */
 (function () {
   'use strict';
@@ -67,167 +76,10 @@
     }
   }
 
-  // ---- lazy prose panels (spec §5.2: load on first open, cache) ---------
-  // ⚠️ DE-ROT (F09): a NEW toggle listener stacking on every renderDetail() call is the bug this
-  // shape exists to avoid — see wireLazyPanels()/proseLoader() below. Register the three
-  // listeners ONCE at boot (workspace-app.js's boot block calls proseLoader per panel id) and
-  // dispatch through this module-level `loaders` map, which renderDetail (via wireLazyPanels)
-  // overwrites per run.
-  //
-  // ⚠️ PRE-FLIGHT (P4): the load is AWAITABLE — drillIntoJudge needs to know when it has
-  // settled (the old code guessed with setTimeout(render, 300), which could fire before an
-  // unbounded N-artifact IPC round trip finished and silently render nothing). loadPanel()
-  // is idempotent per panel id and returns its in-flight promise; the promise cache
-  // (`loading`) and the per-run spec (`loaders`) are both keyed by panel id, but only
-  // `loading` is cleared by wireLazyPanels() — on a run CHANGE only (Task 19, RN-5) — and
-  // that clearing is what stops F09's stale-run artifact requests.
-  var loaders = {};  // panelId -> {bodyId, files}  (rewritten per run by wireLazyPanels)
-  var loading = {};  // panelId -> Promise           (cleared per run by wireLazyPanels)
-  // Task 19 (RN-5): the run wireLazyPanels() last reset panels/loading for — gates the reset
-  // below to run CHANGES only. A same-run call (renderDetail() runs this on every blind toggle
-  // too, and on the live loop's terminal refresh) instead refreshes any open panel (Fix 1).
-  var lastWiredRunId = null;
-
-  function loadPanel(panelId, bodyId, files) {
-    var A = window.AmicusApp;
-    if (loading[panelId]) { return loading[panelId]; }
-    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): this is the third
-    // instance of the F09 class of bug (a stale async response overwriting shared DOM after
-    // the user has navigated away) — already fixed once for the toggle-listener stack (F09
-    // itself) and once for the fire-and-forget debate.json fetch in workspace-app.js (guards
-    // with `if (state.runId !== runId) return;`). wireLazyPanels() clearing `loading[panelId]`
-    // on every run switch permits a NEW request to be issued, but never fenced the PRIOR
-    // request's eventual resolution — open reviews-panel on run A, switch to run B (which
-    // issues its own request), and A's response — however late — used to overwrite whatever
-    // B had just rendered. Capture the runId this request was issued for, and guard as the
-    // FIRST statement of the completion handler, exactly like the debate.json fix.
-    var runId = A.state.runId;
-    loading[panelId] = Promise.all(files().map(function (f) {
-      return A.invoke('workspace:read-artifact', runId, f.name).then(function (res) {
-        return { name: f.name, title: f.title, text: res.text || '', truncated: res.truncated, error: res.error };
-      });
-    })).then(function (sections) {
-      if (A.state.runId !== runId) { return; } // stale: superseded by a later run switch
-      window.AmicusRender.renderProseSections(A.$(bodyId), sections.map(function (s) {
-        return s.error ? { name: s.name, title: s.title, error: s.name + ' — ' + s.error } : s;
-      }));
-      A.$(panelId).dataset.loaded = '1';   // display/debug marker only — `loading` is the real gate
-    });
-    return loading[panelId];
-  }
-
-  /** Registered ONCE at boot (per panel id); reads the current run's spec off `loaders`. */
-  function proseLoader(panelId) {
-    var A = window.AmicusApp;
-    var panel = A.$(panelId);
-    panel.addEventListener('toggle', function () {
-      if (!panel.open) { return; }
-      var spec = loaders[panelId];
-      if (spec) { loadPanel(panelId, spec.bodyId, spec.files); }
-    });
-  }
-
-  /**
-   * Rewrites the per-run spec map on every call. On a run CHANGE (tracked via the module-level
-   * `lastWiredRunId`, above), resets panel open/loaded state and drops the previous run's
-   * cached load promises — exactly what F09's stale-run protection needs. On a SAME-run call
-   * (Task 19, RN-5: renderDetail() calls this on every blind toggle too, and the live loop's
-   * terminal refresh) any panel the user already has open is instead refreshed in place — see
-   * Fix 1 below — never left showing stale-blind content, never collapsed. Registers no
-   * listeners itself.
-   */
-  function wireLazyPanels() {
-    var A = window.AmicusApp;
-    // ⚠️ Fix-wave (Fix 4): keyed off `A.state.detail.runId`, not `A.state.runId` — the latter is
-    // set synchronously at the top of openRun(), before its workspace:get-run reply lands, so an
-    // out-of-order reply could make the two diverge. workspace-app.js's own run-change gate
-    // (renderDetail(), above `d.runId`) reads off the SAME `state.detail.runId`, so the two
-    // provably agree on whether this is a run change.
-    var sameRun = A.state.detail.runId === lastWiredRunId;
-    if (!sameRun) {
-      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
-        var p = A.$(id);
-        p.dataset.loaded = '0';
-        p.open = false;
-        delete loading[id];
-      });
-      lastWiredRunId = A.state.detail.runId;
-    }
-    var bench = A.state.detail.run.bench || [];
-    var debated = !!A.state.detail.run.debate;
-    // ⚠️ CODE REVIEW (round 2, finding 2): readRunArtifact's error for a genuinely-missing
-    // artifact is NOT translated into a friendly "not written yet" note anywhere in this
-    // read path — it lands in the panel verbatim, absolute host path and all. `run.debate` is
-    // seeded on run.json's FIRST write, so it's truthy on every --debate run, including ones
-    // where the re-vote wave never actually ran (no contested findings, cost ceiling, abort) —
-    // requesting revote-<model>.md speculatively in that (near-certain) case means one ugly
-    // error row per bench model for a condition that isn't an error at all. run-detail.js
-    // already computes a presence manifest (state.detail.artifacts) for exactly these
-    // allowlisted names via fs.statSync — filter on it instead of requesting known-absent
-    // files. Applies to review-/judge- too (the same latent gap, just plan-mandated rather
-    // than new).
-    var artifacts = A.state.detail.artifacts || {};
-    function present(name) { return !!(artifacts[name] && artifacts[name].present); }
-    // ⚠️ v4.4.1 RN-9: these two titles used to hand-roll `A.state.blind && label ? label : m`
-    // inline. Both now go through AmicusRender.display() — the single blind-flip definition the
-    // re-vote title below already used — so the next blind-mode ruling lands in one place instead
-    // of being re-applied by hand in every file that happens to render an identity.
-    loaders['reviews-panel'] = { bodyId: 'reviews-body', files: function () {
-      return bench.map(function (m) {
-        var label = A.state.labelByModel[m];
-        return { name: resolveArtifactName(m, 'review'), title: window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
-      }).filter(function (f) { return present(f.name); });
-    } };
-    loaders['bundle-panel'] = { bodyId: 'bundle-body', files: function () {
-      // ⚠️ v4.4.1 RN-4: the presence filter is NOT optional here either. Without it, a run whose
-      // Stage 2 never ran (a one-seat bench, an abort before the cross-review, a cost ceiling)
-      // requested a file the manifest already knows is absent and rendered readRunArtifact's raw
-      // error string in the panel — "absolute host path and all", per this file's own round-2
-      // note above `present()`. reviews-panel and judges-panel have always filtered; this was the
-      // odd one out.
-      return [{ name: 'bundle-stage2.md', title: 'bundle-stage2.md (verbatim)' }]
-        .filter(function (f) { return present(f.name); });
-    } };
-    loaders['judges-panel'] = { bodyId: 'judges-body', files: function () {
-      var files = bench.map(function (m) {
-        var label = A.state.labelByModel[m];
-        return { name: resolveArtifactName(m, 'judge'), title: 'Judge ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
-      });
-      if (debated) {
-        // ⚠️ DE-ROT (F38): on a --debate run, a matrix dispute cell can be a RE-VOTE whose
-        // prose lives in revote-<model>.md (not judge-<model>.md). Included per bench model
-        // like judge-*.md above, but — per the presence filter — only when the manifest
-        // confirms the file actually exists (see the code-review note above `present()`).
-        // ⚠️ CODE REVIEW (round 2, finding 3): this title is new code (unlike the review-/
-        // judge- titles above, which mirror the brief verbatim), so it goes through
-        // AmicusRender.display() — the single blind-flip definition — rather than adding a
-        // fourth hand-rolled copy of the same ternary.
-        // ⚠️ Task 18 fix-wave (RN-1, review finding 1): this name used to be recomputed via a
-        // bare sanitizeName(m) call, ignoring the disambiguation map entirely — for a colliding
-        // pair BOTH models resolved to the same bare revote-<sanitized>.md name, reintroducing
-        // for re-votes the exact cross-match bug Task 18 fixed for review-/judge-. Routed
-        // through resolveArtifactName(m, 'revote') like the other three sites; its built-in
-        // legacy fallback keeps older detail payloads (no artifactsByModel map) correct too.
-        files = files.concat(bench.map(function (m) {
-          var label = A.state.labelByModel[m];
-          return { name: resolveArtifactName(m, 'revote'), title: 'Re-vote ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
-        }));
-      }
-      return files.filter(function (f) { return present(f.name); });
-    } };
-    // ⚠️ Fix-wave (Fix 1, RN-9): a same-run call (the blind toggle, or the live loop's
-    // running -> terminal refresh) must re-render any panel the user already has open, or it
-    // keeps showing content painted under the PREVIOUS blind state. renderProseSections()
-    // (workspace-render.js) clears its container before repainting, so this replaces sections
-    // in place rather than appending duplicates. Drop the cached promise first so loadPanel()
-    // actually re-fetches instead of returning its already-settled one.
-    if (sameRun) {
-      ['reviews-panel', 'bundle-panel', 'judges-panel'].forEach(function (id) {
-        var p = A.$(id);
-        if (p.open) { delete loading[id]; loadPanel(id, loaders[id].bodyId, loaders[id].files); }
-      });
-    }
-  }
+  // ⚠️ v4.7 PR7 extraction: bodies moved verbatim to workspace-lazy.js
+  // (window.AmicusLazy), which loads immediately before this file.
+  function proseLoader(panelId) { window.AmicusLazy.proseLoader(panelId); }
+  function wireLazyPanels() { window.AmicusLazy.wireLazyPanels(); }
 
   // ⚠️ DE-ROT (F38): on a --debate run the FINAL tally.json is rebuilt from the debate's
   // replaced adjudications, so a matrix `dispute` cell can be a re-vote — gate per
@@ -240,9 +92,9 @@
     var A = window.AmicusApp;
     var panel = A.$('judges-panel');
     panel.open = true;
-    var spec = loaders['judges-panel'];
+    var spec = window.AmicusLazy.panelSpec('judges-panel');
     if (!spec) { return Promise.resolve(); }
-    return loadPanel('judges-panel', spec.bodyId, spec.files).then(function () {
+    return window.AmicusLazy.loadPanel('judges-panel', spec.bodyId, spec.files).then(function () {
       var rv = ((A.state.debate && A.state.debate.revotes) || []).find(function (r) {
         return r.judge === judgePair.model && r.id === findingId;
       });
@@ -290,5 +142,6 @@
     proseLoader: proseLoader,
     drillIntoJudge: drillIntoJudge,
     sanitizeName: sanitizeName,
+    resolveArtifactName: resolveArtifactName,
   };
 })();

package/electron/workspace-ui/workspace-render.js

@@ -183,11 +183,11 @@
     // did) while the stored `dataset.key` stays raw means a key containing `"` or `\` can
     // never match its own row — the lookup misses every tick and the row is re-appended
     // forever. A plain object lookup sidesteps the escaping problem entirely.
-    var existing = {};
+    var existing = Object.create(null);
     Array.prototype.slice.call(tbody.children).forEach(function (row) {
       existing[row.dataset.key] = row;
     });
-    var seen = {};
+    var seen = Object.create(null);
     seats.forEach(function (seat) {
       // ⚠️ DE-ROT (F37): `seat.id` is now always set by seatsFromRunStats (`model:role`), so
       // debate rebuttal/revote rows no longer collide with the seat row. The `|| seat.model`
@@ -217,6 +217,10 @@
     // RN-11 (v4.5): the keyed update added and removed rows but never MOVED
     // them, so table order was frozen at first render — wrong the moment a
     // repair solo or new wave changes the composed doc's leg order mid-run.
+    // The O(n²) `find()` per seat is deliberate: bench is capped at 26 (anonymize.js:21),
+    // so this is ~100 rows worst case on a debate run, every 1.5s. `existing` above is
+    // already the map an O(n) rewrite would need — reach for it only if this table ever
+    // renders unbounded rows.
     seats.forEach(function (seat, i) {
       var key = String(seat.id || seat.model);
       var current = tbody.children[i];

package/electron/workspace-ui/workspace-seats.js

@@ -41,6 +41,42 @@
 (function () {
   'use strict';
 
+  /**
+   * Aliases of seats whose degrade record says they were retried. PR1F-4 (v4.7 PR7).
+   *
+   * ⚠️ Mirrors window.AmicusLive.deadSeats' own predicate (live-model.js:227-241) EXACTLY, and
+   * must keep mirroring it. The kind/channel filter is load-bearing: run.degrades[] also carries
+   * kind:'heal' / channel:'stage1-retry' records with the SAME retryWaveId/firstFailure fields
+   * for seats that RECOVERED, and a field-only scan would tag a recovered seat "retried once".
+   *
+   * ⚠️ firstFailure is TRUTHINESS ONLY. It has two shapes — run-retry.js:98 emits
+   * {seat, class:'leg', status, reason}; :86/:90/:93 emit {seat, class:'wave', waveId, reason}
+   * with NO status key — so any read of firstFailure.status is undefined on every wave-origin
+   * seat.
+   */
+  function retriedAliases(degrades) {
+    var out = Object.create(null);
+    (degrades || []).forEach(function (d) {
+      if (!d || d.kind !== 'degrade') { return; }
+      if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave') { return; }
+      var data = d.data || {};
+      if (!(data.retryWaveId || data.firstFailure)) { return; }
+      if (d.channel === 'dead-leg') {
+        if (data.seat) { out[data.seat] = true; }
+      } else {
+        (data.models || []).forEach(function (m) { if (m) { out[m] = true; } });
+      }
+    });
+    return out;
+  }
+
+  // Mirrors isReviewing at live-model.js:261-264 — a chair/judge/rebuttal/revote row must not
+  // carry a reviewer's retry marker.
+  function isReviewingRole(role) {
+    return role === 'seat' || role === 'critic' ||
+      (typeof role === 'string' && role.indexOf('lens:') === 0);
+  }
+
   function renderSeatsPanel() {
     var A = window.AmicusApp;
     var d = A.state.detail;
@@ -55,6 +91,38 @@
     // records for the SAME run, and the persisted run.json copy is authoritative when present.
     var deg = (d.run && d.run.degrades && d.run.degrades.length) ? d.run.degrades
       : ((d.verdict && d.verdict.degrades) || []);
+    var retried = retriedAliases(deg);
+    // ⚠️ Look rows up by data-key, NEVER by position. renderSeats (workspace-render.js:179-216)
+    // keys every row on String(seat.id || seat.model) and RN-11 made it REORDER rows to match the
+    // composed doc's leg order — so tbody.children[i] is not seats[i]. Build the key exactly the
+    // way renderSeats does or the lookup silently misses.
+    var rowsByKey = Object.create(null);
+    Array.prototype.slice.call(tbody.children).forEach(function (row) {
+      rowsByKey[row.dataset.key] = row;
+    });
+    seats.forEach(function (s) {
+      var row = rowsByKey[String(s.id || s.model)];
+      if (!row || !row.children[8]) { return; }
+      // Column 8 is the table's unlabeled trailing flag cell (index.html:51's final <th></th>).
+      // It carries '⏳ stalled' on the LIVE path; on this terminal path seatsFromRunStats
+      // hardcodes stalled:false (live-model.js:128), so it is always empty here and free to use.
+      // If that ever changes, this is the collision site.
+      // Fix wave (whole-branch review, finding 2): this pass must be SYMMETRIC. renderSeats
+      // reuses rows keyed on `model:role` across calls — including across two different
+      // terminal runs opened in sequence that happen to share an alias+role — and never resets
+      // row.className itself. An add-only write here both duplicates the token on every repaint
+      // of the SAME run and leaves a stale 'seat-retried' class on a row that belonged to a
+      // PREVIOUS run's non-retried seat. classList.add/remove (not string concatenation) so a
+      // repeat add never duplicates the token and a seat that is no longer retried gets cleared.
+      var isRetried = isReviewingRole(s.role) && !!retried[s.modelInput || s.model];
+      if (isRetried) {
+        row.classList.add('seat-retried');
+        row.children[8].textContent = '↻ retried once';
+      } else {
+        row.classList.remove('seat-retried');
+        row.children[8].textContent = '';
+      }
+    });
     var dead = window.AmicusLive.deadSeats(deg, seatLoss, seats, runMeta);
     renderDeadSeatRows(tbody, dead, A.state.blind, A.labelOf);
   }

package/electron/workspace-ui/workspace.css

@@ -176,3 +176,9 @@ td.vote-cell.dispute { cursor: pointer; text-decoration: underline dotted; }
 
 .empty-note { color: var(--text-3); font-size: var(--fs-12); }
 .truncate-note { color: var(--warn); font-size: var(--fs-11); margin-top: var(--space-3); }
+
+/* PR1F-4: a seat that was retried and still failed — the surviving errored row's own marker.
+   ⚠️ Plan snippet said var(--muted), which does not exist in src/design/tokens.css (verified
+   repo-wide). --text-3 is this file's own established "muted" token — see tr.seat-dead td
+   above, the sibling dead-row treatment. */
+.seat-retried td:last-child { color: var(--text-3); white-space: nowrap; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.6.3",
+  "version": "4.7.1",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
@@ -55,7 +55,7 @@
     "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='worktrees' && node scripts/mark-test-passed.js",
     "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",
     "posttest": "node scripts/mark-test-passed.js",
-    "lint": "eslint src/ electron/",
+    "lint": "eslint src/ electron/ tests/helpers/",
     "postinstall": "node scripts/postinstall.js",
     "test:thinking": "node scripts/benchmark-thinking.js",
     "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",
@@ -68,6 +68,7 @@
     "generate-docs:check": "node scripts/generate-docs.js --check",
     "validate-docs": "node scripts/validate-docs.js --full",
     "setup-hooks": "node scripts/setup-hooks.js",
+    "graphify:index": "graphify extract . --backend claude-cli",
     "check:secrets": "node scripts/check-secrets.js --all",
     "check:sizes": "node scripts/check-file-sizes.js --all",
     "check:tarball": "node scripts/check-tarball-lifecycle.js"
@@ -75,10 +76,10 @@
   "dependencies": {
     "@electron/get": "^5.0.0",
     "@modelcontextprotocol/sdk": "^1.27.0",
-    "@opencode-ai/sdk": "^1.1.36",
+    "@opencode-ai/sdk": "1.18.15",
     "dotenv": "^17.2.3",
     "extract-zip": "^2.0.1",
-    "opencode-ai": "^1.2.20",
+    "opencode-ai": "1.18.15",
     "tiktoken": "^1.0.0",
     "update-notifier": "^7.3.1",
     "zod": "^3.0.0"
@@ -107,6 +108,9 @@
     ],
     "electron/**/*.js": [
       "eslint --fix"
+    ],
+    "tests/helpers/**/*.js": [
+      "eslint --fix"
     ]
   }
 }

package/schemas/council-run.schema.json

@@ -45,6 +45,7 @@
     "labelMap": { "type": ["object", "null"], "additionalProperties": { "type": "string" } },
     "options": { "type": "object" },
     "pack": { "type": "object" },
+    "tag": { "type": "string" },
     "template": { "type": "object" },
     "usage": { "type": "object" },
     "exitCode": { "type": ["number", "null"] },

package/schemas/council-stats.schema.json

@@ -20,7 +20,15 @@
           "avgStreetCredPeersOnly": { "type": ["number", "null"] },
           "lifetimeConfirmRate": { "type": ["number", "null"] },
           "lifetimeFactErrorRate": { "type": ["number", "null"] },
-          "conformance": { "type": "object" }
+          "conformance": { "type": "object" },
+          "aliases": {
+            "type": "array", "items": { "type": "string" },
+            "description": "Every alias observed for this group, most recently observed first — aliases[0] is the launch-preferred name (v4.7 GOA-7)."
+          },
+          "legacy": {
+            "type": "boolean",
+            "description": "True when every row in the group lacks resolvedModel — alias-keyed history from before resolved-id segmentation, or leg-less rows whose resolution is unknowable (v4.7 GOA-7, spec R2)."
+          }
         }
       }
     }

package/schemas/run.schema.json

@@ -22,6 +22,7 @@
     "sessionDir": { "type": ["string", "null"] },
     "opencodeSessionId": { "type": ["string", "null"] },
     "usage": { "type": ["object", "null"] },
-    "pack": { "type": "object" }
+    "pack": { "type": "object" },
+    "tag": { "type": "string" }
   }
 }

package/schemas/spend.schema.json

@@ -33,7 +33,7 @@
     },
     "credit": { "type": ["object", "null"] },
     "filters": { "type": "object" },
-    "groupBy": { "enum": ["model", "wave", "council", "project", "op", "day"] },
+    "groupBy": { "enum": ["model", "wave", "council", "project", "op", "day", "tag"] },
     "groups": {
       "type": "array",
       "items": {

package/schemas/wave.schema.json

@@ -29,6 +29,7 @@
     "durationMs": { "type": ["number", "null"] },
     "usage": { "type": "object" },
     "notices": { "type": "array", "items": { "type": "string" } },
-    "pack": { "type": "object" }
+    "pack": { "type": "object" },
+    "tag": { "type": "string" }
   }
 }

package/scripts/postinstall.js

@@ -110,9 +110,12 @@ async function provisionElectron(deps = {}) {
  * path.
  *
  * Hook setup still needs to happen for devs, so we run setup-hooks.js here.
- * It is a no-op for consumers: setup-hooks.js exits 0 outside a git checkout
- * (the published tarball / github: export has no .git), so this changes
- * nothing for end users while keeping `npm install` wiring hooks for devs.
+ * It is a no-op for consumers, but NOT merely because the published tarball
+ * has no .git: git resolves a repository by walking UP, so during a consumer's
+ * `npm install amicus` (cwd = node_modules/amicus) it finds the CONSUMER'S
+ * .git. setup-hooks.js is what makes this safe — it configures hooks only when
+ * git's toplevel IS the amicus package root, so a dependency install can never
+ * repoint someone else's core.hooksPath. See its docstring for the full story.
  *
  * Best-effort and self-contained: never throws (a hook-setup failure must
  * never roll back the install), so it is safe to call before the optional

package/scripts/setup-hooks.js

@@ -21,20 +21,66 @@
  *
  *   npm run setup-hooks      # or: node scripts/setup-hooks.js
  *
+ * ONLY EVER CONFIGURES THE AMICUS CHECKOUT ITSELF.
+ * ------------------------------------------------
+ * "Are we in a git checkout?" is NOT a sufficient guard, because git resolves
+ * a repository by walking UP the directory tree. When a consumer runs
+ * `npm install amicus` inside their own repo, npm runs this postinstall with
+ * cwd = <consumer>/node_modules/amicus — where `git rev-parse` finds the
+ * CONSUMER'S .git and happily reports success. Writing core.hooksPath there
+ * pointed their repository at a .husky directory that does not exist (it is
+ * not in package.json "files", so it never ships), which silently disabled
+ * every hook in their .git/hooks — no error, no warning, `git commit` just
+ * stops running them. The damage also outlived a failed install: npm rolls
+ * back node_modules, but not writes to someone else's .git/config.
+ *
+ * So the guard asks `git rev-parse --show-prefix` from the package root. That
+ * prints the path of the current directory RELATIVE to the top of the work
+ * tree, so it is empty exactly when the package root IS the repository root,
+ * and non-empty ("node_modules/amicus/") when amicus merely sits inside
+ * someone else's checkout. A dependency install, a vendored copy and a global
+ * install all land below their enclosing repo's root; the dev checkout — and
+ * every linked worktree of it, whose root is the worktree — comes back empty.
+ *
+ * DO NOT "simplify" this into comparing `--show-toplevel` against the package
+ * root as strings. That was the first attempt and it broke on Windows CI: the
+ * runners' %TEMP% is an 8.3 short path (C:\Users\RUNNER~1\...), Node's
+ * fs.realpathSync PRESERVES short components while git always reports the long
+ * form, so the two spellings of one directory never compared equal and the
+ * guard refused to configure a legitimate checkout. Case, separators, symlinks
+ * and 8.3 are four different ways for equal paths to spell differently; asking
+ * git to compute the relationship sidesteps all of them at once.
+ *
+ * Every git call is anchored at the package root rather than process.cwd() for
+ * the same reason: what gets configured must depend on where amicus lives, not
+ * on where the script happened to be invoked from.
+ *
  * Safe to run anywhere: exits 0 outside a git checkout (npm tarball
  * installs, exported archives) and never fails the install.
  */
 
 const { execFileSync } = require('node:child_process');
+const path = require('node:path');
+
+/** This package's root — the parent of the scripts/ directory holding this file. */
+const PKG_ROOT = path.resolve(__dirname, '..');
 
 function git(...args) {
-  return execFileSync('git', args, { encoding: 'utf-8' }).trim();
+  return execFileSync('git', args, { cwd: PKG_ROOT, encoding: 'utf-8' }).trim();
 }
 
+let prefix;
 try {
-  git('rev-parse', '--git-dir');
+  prefix = git('rev-parse', '--show-prefix');
 } catch {
-  process.exit(0); // not a git checkout — nothing to configure
+  process.exit(0); // not a git checkout (or a bare repo) — nothing to configure
+}
+
+if (prefix !== '') {
+  // amicus is nested inside someone else's repository — a dependency install,
+  // a vendored copy, a global install under a tracked directory. Their hooks
+  // are none of our business. Silent: this is the normal consumer path.
+  process.exit(0);
 }
 
 try {

package/skills/second-opinion/MANUAL-ORCHESTRATION.md

@@ -146,6 +146,18 @@ As each judge's ranking + adjudication response returns, collect it (the raw per
 3. **Translate each judge's `FINAL RANKING:` block** — convert the label order (`1. Review C / 2. Review A / 3. Review B`) into a model `order` array via the same map (e.g. `{C→mistral, A→deepseek, B→gpt}` ⇒ `order: ["mistral","deepseek","gpt"]`). This is each entry in `rankings[]`.
 4. **Populate `runStats`** from the per-leg run documents emitted by `fanout --json` (and any solo red-team/chair `start --json` docs): copy `model`, `status`, `durationMs`, `usage` verbatim. Any leg with no run doc gets `durationMs: null` and `usage: null` — never invent a value. Attach `role` (`council` | `redteam` | `claude`), `wasChair`, and `conformance` (`clean` | `repaired` | `unstructured`) as council-domain labels.
 
+⚠️ **v4.7 CA-4 note:** the headless engine driver (`amicus council run`) now emits extra
+non-primary `runStats` rows (`chair-attempt`/`repair`/`superseded` — failed chair launches,
+repair solos, and superseded legs) alongside one seat-primary row per model. This manual
+orchestration path is unaffected and still produces exactly one seat-primary row per model as
+described above — no contract change here — but any code or report template reading `runStats`
+should be a **tolerant reader** (filter by role rather than assume one row per model), since an
+engine-produced tally.json can now carry rows this recipe never does. Hand-assembled `runStats`
+rows carry no `resolvedModel`; their ledger rows therefore aggregate as alias-keyed `legacy`
+groups in `council stats` (legacy-by-absence, by design) — expected, not an error. Add
+`resolvedModel` (the executable id that served) to a row only if you know it; never copy the
+alias into it.
+
 **Five-keys checklist — verify `tally-input.json` has ALL of:** `meta` (with `meta.models`), `findings`, `adjudications`, `rankings`, `runStats` (`runStats` may be `[]`; the other four are required). Do not call `tally` until all five are present.
 
 Then call, saving the printed `record` to `<run-folder>/tally.json` (Stage 5's `amicus council verdict` reads it back from disk):

package/skills/second-opinion/MODEL-NOTES.md

@@ -101,10 +101,11 @@ the peer-consensus≠evidence rule upstreamed from the field ledger; see changel
   OpenRouter balance — gemini/gpt/anthropic bill directly against their own keys, so inferring cost
   from that balance under-reports it badly (observed: ~6x low). A 3-model bench + chair + debate is
   roughly **$0.60-0.80 per run**, not cents; budget `--max-cost` accordingly or the chair gets
-  skipped mid-run (exit 2, degraded) when the debate legs push the total past the ceiling. As of
-  v4.6, `runStats` also carries Stage-2 judge rows (judge-tagged), so totals read higher than
-  pre-4.6 runs for the same bench; anything keying `runStats` by model should exclude
-  `role: 'judge'`.
+  skipped mid-run (exit 2, degraded) when the debate legs push the total past the ceiling. Totals
+  read higher again as of v4.7 — repairs, failed chair attempts, and superseded legs now get their
+  own `runStats` rows too — so anything keying `runStats` by model must use an **allowlist**, not a
+  judge exclusion; see `docs/council.md`'s `runStats[].role` roster (under `amicus council tally`)
+  for the exact set.
 - **Expect agreement inflation in Stage-2 adjudication.** The judge contract defines `agree` by
   worked example ("an 'I missed this — it's valid' counts as agree") but gives no example for
   `dispute` and no positive definition of `neutral`, while requiring a verdict on EVERY finding —

package/skills/sidecar/SKILL.md

@@ -367,16 +367,23 @@ The catalog is cached at `~/.config/amicus/model-catalog.json` and refreshes aut
 ```bash
 amicus list
 amicus list --status complete
-amicus list --all  # All projects
-amicus list --json # Output as JSON
+amicus list --all          # All projects
+amicus list --search foo   # Substring match: id, tag, briefing material
+amicus list --json         # Output as JSON
 ```
 
 **Optional:**
 - `--status <filter>`: Filter by status (`running`, `complete`)
 - `--all`: Show sessions from all projects
+- `--search <q>`: Case-insensitive substring filter over id/tag/briefing material
 - `--json`: Output as JSON format (for programmatic use)
 - `--cwd <path>`: Project directory (default: current directory)
 
+Rows show the `--tag <t>` label set at launch time (`start`/`fanout`/`council run` —
+not a `list` flag itself), or inherited automatically from the parent session on
+`continue`/`resume` (neither accepts its own `--tag` — the tag comes from the
+parent, so there's nothing new to set); untagged sessions show blank.
+
 ### Resume a Sidecar
 
 ```bash