amicus 4.6.3 → 4.7.1

package/src/council/ledger.js

@@ -3,11 +3,55 @@
 const fs = require('fs');
 const path = require('path');
 const { getConfigDir } = require('../utils/config');
-const { DEBATE_ROLES } = require('./debate');
 
-const LEDGER_SCHEMA_VERSION = 1;
+// v4.7 GOA-7 D9: v2 rows may carry `resolvedModel` (the executable id that
+// served, copied from the joined runStats row, emit-only-when-set). Absent
+// resolvedModel ⇒ legacy row, aggregated under its alias (spec R2) — this
+// covers ALL pre-v2 history AND leg-less v2 rows (give-up chair, dead seats,
+// claude, hand-assembled tally input), whose resolution is genuinely
+// unknowable. Legacy-READ only: readers never inspect schemaVersion, rows are
+// never migrated.
+const LEDGER_SCHEMA_VERSION = 2;
 const LEDGER_FILE = 'council-ledger.jsonl';
 
+// v4.7 D4/E1/E2/E6 (Task-7, task-6/task-7 adjudications): fail-closed
+// ALLOWLIST of runStats roles the ledger join (below) may consume as a
+// model's ledger identity. 'council' is the legacy default role (pre-#83
+// runs, and the av-receiver golden fixture — errata E2, must stay green).
+// 'redteam' is the second-opinion skill's documented primary-seat role
+// (skills/second-opinion/MANUAL-ORCHESTRATION.md:147; red-team runs record
+// to the ledger per COUNCIL-DESIGN.md:266 — errata E6, task-7 review: without
+// it a red-team row's role/wasChair/conformance never join, silently
+// fabricating conformance:'clean' via the `|| 'clean'` fallback below).
+// 'judge' stays excluded (#83's overwrite-guard: judges ARE bench models, and
+// their Stage-2 cost-attribution row must never win over the seat row). Every
+// OTHER non-primary row-per-launch producer — 'chair-attempt', 'repair',
+// 'superseded', and the debate pair 'rebuttal'/'revote' — shares a model with
+// that model's real bench row and must never join either: skipped by
+// omission, including any future role never added here (fail-closed, not a
+// skip-list that a new producer could silently slip past). This is the E6
+// trade, made explicit: any free-form/custom role label a future producer
+// invents is rejected BY DESIGN until someone deliberately adds it here —
+// the allowlist would rather silently drop a legitimate new role's
+// role/wasChair/conformance (falling back to 'council'/false/'clean') than
+// ever let an unreviewed role win the model-keyed join.
+//
+// Final-review consolidated wave (owner-ruled): the ABSENCE of a role
+// (null/undefined) is a DIFFERENT case from a NAMED-unknown role and joins
+// too — this is the docs/council.md:562-blessed hand-assembled tally-input
+// shape ("the legacy default `council` … pre-#83 rows, or hand-assembled
+// tally input that never set a role"), and mirrors GOA-7's absent-field⇒
+// legacy pattern elsewhere in this codebase: a field that was never set gets
+// treated as the oldest/legacy shape, not silently dropped like an
+// unreviewed value would be. A NAMED custom label (e.g. 'custom-thing') is
+// still rejected exactly as E6 describes — only the missing-field case is
+// legacy; an actively wrong or unreviewed one is not.
+const LEDGER_JOIN_ROLES = new Set(['seat', 'critic', 'chair', 'claude', 'council', 'redteam']);
+function joinsLedger(role) {
+  return role === null || role === undefined ||
+    LEDGER_JOIN_ROLES.has(role) || (typeof role === 'string' && role.startsWith('lens:'));
+}
+
 function countSeverity(findings) {
   const c = { blocker: 0, major: 0, minor: 0, nit: 0 };
   for (const f of findings) { if (c[f.severity] !== undefined) { c[f.severity] += 1; } }
@@ -18,10 +62,10 @@ function countSeverity(findings) {
 function buildLedgerRows(record) {
   const { meta, findings, streetCred, runStats, judged } = record;
   const sc = new Map(streetCred.map(s => [s.model, s]));
-  // Judge rows (#83, v4.6 Plan 2) are Stage-2 cost attribution, not seats: the
-  // join below is keyed by MODEL, and judges ARE bench models — without this
-  // exclusion the judge row would silently overwrite the seat row.
-  const rs = new Map(runStats.filter(r => !DEBATE_ROLES.has(r.role) && r.role !== 'judge')
+  // The join below is keyed by MODEL — only allowlisted roles (joinsLedger,
+  // above) may win it, so a non-primary row-per-launch row can never
+  // silently overwrite a model's real bench (seat) row.
+  const rs = new Map(runStats.filter(r => joinsLedger(r.role))
     .map(r => [r.model, r]));
   return meta.models.map(model => {
     const raised = findings.filter(f => f.raiser === model);
@@ -39,6 +83,7 @@ function buildLedgerRows(record) {
       confirmRate: judged && denom ? raised.filter(f => f.tier === 'Confirmed').length / denom : null,
       factErrorRate: judged && denom ? raised.filter(f => f.tier === 'Disputed').length / denom : null,
       conformance: r.conformance || 'clean',
+      ...(r.resolvedModel ? { resolvedModel: r.resolvedModel } : {}),
     };
   });
 }
@@ -61,25 +106,41 @@ function readRows(dir) {
 
 function avg(nums) { return nums.length ? nums.reduce((s, x) => s + x, 0) / nums.length : null; }
 
-/** Aggregate the ledger per model. peersOnly nulls excluded; lowN flags < 3 runs. */
+/**
+ * Aggregate the ledger per model. peersOnly nulls excluded; lowN flags < 3 runs.
+ * v4.7 GOA-7 D10: groups by `row.resolvedModel || row.model` — v2 rows segment
+ * by the executable id that actually served; rows without a resolvedModel
+ * (pre-v2 history, leg-less rows, hand-assembled tally input) stay alias-keyed
+ * with `legacy: true`. `aliases` lists every row-level `model` (alias) observed
+ * for the group, most recently observed FIRST — ledger append order is the only
+ * recency signal (`date` is day-granular, free-form on the MCP path), so
+ * aliases[0] is the launch-preferred name (pickFallbackChair, D11).
+ * Version-blind by design: schemaVersion is never read (legacy-read, R2).
+ */
 function deriveReliability(opts = {}) {
   const dir = opts.dir || getConfigDir();
-  const byModel = new Map();
+  const byKey = new Map();
   for (const row of readRows(dir)) {
-    if (!byModel.has(row.model)) { byModel.set(row.model, []); }
-    byModel.get(row.model).push(row);
+    const key = row.resolvedModel || row.model;
+    if (!byKey.has(key)) { byKey.set(key, []); }
+    byKey.get(key).push(row);
   }
-  return [...byModel.entries()].map(([model, rows]) => {
+  return [...byKey.entries()].map(([model, rows]) => {
     const peers = rows.map(r => r.streetCredPeersOnly).filter(v => typeof v === 'number');
     const confirms = rows.map(r => r.confirmRate).filter(v => typeof v === 'number');
     const facts = rows.map(r => r.factErrorRate).filter(v => typeof v === 'number');
     const conformance = rows.reduce((acc, r) => { acc[r.conformance] = (acc[r.conformance] || 0) + 1; return acc; }, {});
+    const lastSeen = new Map();
+    rows.forEach((r, i) => { lastSeen.set(r.model, i); });
+    const aliases = [...lastSeen.entries()].sort((a, b) => b[1] - a[1]).map(([m]) => m);
     return {
       model, runs: rows.length, lowN: rows.length < 3,
       avgStreetCredPeersOnly: avg(peers),
       lifetimeConfirmRate: avg(confirms),
       lifetimeFactErrorRate: avg(facts),
       conformance,
+      aliases,
+      ...(rows.every(r => !r.resolvedModel) ? { legacy: true } : {}),
     };
   });
 }

package/src/council/report.js

@@ -66,13 +66,24 @@ function toModel(verdict, wave) {
       .map(f => ({ id: f.id, previousTier: f.debate.previousTier, tier: f.tier })),
   };
   const runStats = verdict.runStats || [];
-  // Cost-row role tag (Plan 2 final review F1): #83 gave judges their own
-  // runStats row, so a bench model can now appear twice (seat + judge),
-  // indistinguishable by `model` alone. Tag ONLY judge rows — old verdicts have
-  // no judge rows at all, so chair/critic/lens/seat rows stay byte-identical to
-  // their historical rendering.
+  // Cost-row role tag (Plan 2 final review F1, extended v4.7 D6): #83 gave
+  // judges their own runStats row, so a bench model can now appear twice
+  // (seat + judge), indistinguishable by `model` alone. v4.7's row-per-launch
+  // producers (chair-attempt/repair/superseded) create the exact same
+  // collision for their model. Tag ONLY these four roles — old verdicts have
+  // none of them, so chair/critic/lens/seat rows stay byte-identical to their
+  // historical rendering (report.test.js:189-199 pins the judge case exactly).
+  // Object.create(null): a plain `{...}` literal inherits Object.prototype, so a role
+  // literally named 'constructor'/'toString'/etc would resolve to an inherited (truthy)
+  // function via bracket lookup instead of `undefined` — silently corrupting that row's
+  // rendered model label. A null-prototype object has no inherited keys to collide with.
+  const ROLE_SUFFIX = Object.create(null);
+  ROLE_SUFFIX.judge = 'judge';
+  ROLE_SUFFIX['chair-attempt'] = 'chair-attempt';
+  ROLE_SUFFIX.repair = 'repair';
+  ROLE_SUFFIX.superseded = 'superseded';
   const costRows = runStats.map(r => ({
-    model: r.role === 'judge' ? `${r.model} (judge)` : r.model,
+    model: ROLE_SUFFIX[r.role] ? `${r.model} (${ROLE_SUFFIX[r.role]})` : r.model,
     status: r.status, durationMs: r.durationMs,
     cost: r.usage && r.usage.cost ? r.usage.cost : null,
   }));

package/src/council/run-assemble.js

@@ -40,6 +40,9 @@ function worseConformance(a, b) {
  * leg doc yields durationMs/usage null (never invent a value). `model` (the
  * council alias) overrides leg.model (the resolved executable id) so ledger
  * rows join meta.models by exact string (ledger.js:20-24).
+ * `resolvedModel` (v4.7 GOA-7) preserves leg.model — the executable id that
+ * actually served, post-fallback-substitution — emit-only-when-set and never
+ * sourced from modelInput (an alias must never masquerade as a resolved id).
  *
  * ⚠️ LC-11 / review F1: `findingsUnverified` and `repairRefused` are the same
  * class of fact as `conformance` and ride the same row. They are the two halves
@@ -60,6 +63,8 @@ function buildRunStatsEntry({ leg, model, role, wasChair, conformance, findingsU
     conformance: conformance || 'clean',
     ...(findingsUnverified ? { findingsUnverified: true } : {}),
     ...(repairRefused ? { repairRefused } : {}),
+    ...(leg && leg.waveId ? { waveId: leg.waveId } : {}),
+    ...(leg && leg.model ? { resolvedModel: leg.model } : {}),
     status: leg ? leg.status : 'error',
     durationMs: leg && typeof leg.durationMs === 'number' ? leg.durationMs : null,
     usage: (leg && leg.usage) || null,
@@ -131,14 +136,17 @@ function claudeRunStatsRow() {
  * @param {{runId: string, date: string, bench: string[], chair: string,
  *   reviews: Array<{model, role, conformance, leg, globalFindings}>,
  *   judgeResults: Array<{judge, ok, order, adjudications}>,
- *   chairStats: object|null, claudeReview?: object|null}} args
+ *   chairStats: object|null, claudeReview?: object|null, extraRows?: Array<object>}} args
  *   `claudeReview` (v4.1 §4.4) amends the v4.0 meta pin: present ⇒ claudeInCouncil
  *   true, 'claude' joins meta.models (the street-cred universe), its findings join
  *   the pool and it gets the synthesized null-usage runStats row. Absent ⇒ v4.0
- *   output byte-for-byte.
+ *   output byte-for-byte. `extraRows` (v4.7 D2/E4) are pre-built runStats rows
+ *   (repair/superseded/dead-seat-error, from runStage1 today) appended right
+ *   after the primary review rows, before judge/chair accounting — absent or
+ *   empty ⇒ byte-for-byte unchanged, so the pre-v4.7 length-7 pins stay green.
  */
 function buildTallyInput({ runId, date, bench, chair, reviews, judgeResults, chairStats,
-  claudeReview }) {
+  claudeReview, extraRows }) {
   const meta = {
     runId, date, runType: 'headless',
     models: bench.slice(),          // bench seats exactly: critic included, chair excluded
@@ -154,6 +162,10 @@ function buildTallyInput({ runId, date, bench, chair, reviews, judgeResults, cha
     leg: r.leg, model: r.model, role: r.role, wasChair: false, conformance: r.conformance,
     findingsUnverified: r.findingsUnverified, repairRefused: r.repairRefused,
   }));
+  // v4.7 D2/E4: pre-built rows (repair/superseded/dead-seat-error) ride right
+  // after the primary review rows — same "primary-adjacent" shape, just not
+  // sourced from a surviving review. Absent/empty ⇒ no-op (pre-v4.7 byte parity).
+  runStats.push(...(extraRows || []));
   if (claudeReview) {
     meta.models.push(CLAUDE_SEAT);      // last, mirroring its review-N+1 label
     meta.claudeInCouncil = true;

package/src/council/run-budget.js

@@ -153,9 +153,9 @@ function createBudget({ allLegs, maxCost, runDir, degrade, write }) {
       channel: 'budget-refusal',
       what: `wave ${rec.waveId} (${rec.models.join(', ') || 'no models'}) — those seats DID NOT `
         + 'LAUNCH and are missing from this council',
-      why: `the $${maxCost} --max-cost ceiling refused it${message ? `: ${message}` : ''}`,
+      why: `the $${maxCost} cost ceiling for this run refused it${message ? `: ${message}` : ''}`,
       effect: 'The run continues with the bench that did launch and will exit degraded (2)',
-      remedy: 'Raise --max-cost, or pass --no-cost-gate, to seat them',
+      remedy: "Raise this run's cost ceiling, or turn the cost gate off, to seat them",
     });
     if (runDir) {
       // Never let bookkeeping sink a run that is otherwise fine.

package/src/council/run-chair.js

@@ -20,6 +20,7 @@ const { parseChairVerdict } = require('./parse-stage2');
 const runState = require('./run-state');
 const { isAbortExit } = require('./run-stages');
 const { emitStageStarted, emitStageTerminal } = require('../observe/events');
+const { buildRunStatsEntry } = require('./run-assemble');
 
 /**
  * Chair fallback promotion (spec §4): the highest peers-only street-cred
@@ -31,15 +32,33 @@ const { emitStageStarted, emitStageTerminal } = require('../observe/events');
  * a --claude-review run puts a real 'claude' row in the ledger, so without this
  * filter a LATER run could promote it and walk straight past the pre-flight
  * --chair claude guard — with no Claude leg to launch.
+ *
+ * v4.7 GOA-7 D11: exclusions test the group key AND aliases[]; the promoted
+ * name is aliases[0] (most-recent alias) so the launch string stays routable
+ * through the same alias policy both call sites (run.js mid-walk, run-server.js
+ * pre-seed) already resolve.
  * @returns {string|null}
  */
 function pickFallbackChair(statsRows, bench, failedChair) {
   const benchSet = new Set(bench);
+  // v4.7 GOA-7 D11: an aggregate's identity is its key PLUS every alias it was
+  // observed under — post-D10 keys may be executable ids while bench/o.chair
+  // stay alias-space, so every exclusion tests the whole name set (a bench
+  // seat's resolved-keyed group must never be promoted as its own chair).
+  // The LAUNCHED name is aliases[0] (most-recent alias): alias-space names
+  // re-enter the router's alias bridge and current key/gateway policy; a raw
+  // executable id would dodge them (divergent-vendor forms, openrouter-
+  // literals under --gateway direct, dropped aliases). aliases[] is non-empty
+  // for every ledger-derived group; the bare-model fallback covers pre-D10
+  // aggregate shapes only.
+  const names = (r) => [r.model, ...(Array.isArray(r.aliases) ? r.aliases : [])];
+  const excluded = (r) => names(r).some(n => n === 'claude' || benchSet.has(n) || n === failedChair);
   const candidates = (statsRows || [])
-    .filter(r => r.model !== 'claude' && !benchSet.has(r.model) && r.model !== failedChair
-      && typeof r.avgStreetCredPeersOnly === 'number')
+    .filter(r => !excluded(r) && typeof r.avgStreetCredPeersOnly === 'number')
     .sort((a, b) => a.avgStreetCredPeersOnly - b.avgStreetCredPeersOnly);
-  return candidates.length ? candidates[0].model : null;
+  if (!candidates.length) { return null; }
+  const top = candidates[0];
+  return (Array.isArray(top.aliases) && top.aliases.length) ? top.aliases[0] : top.model;
 }
 
 /**
@@ -98,6 +117,7 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
       // v4.3 Task 3 (spec §7.2 named defect): without this, chair spend is
       // ledgered with councilRunId:null and is unattributable.
       councilRunId: o.runId, councilName: o.councilName,
+      tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
     });
     addWave(solo.wave);
     const ok = solo.leg && solo.leg.status === 'complete'
@@ -117,12 +137,24 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
   // cost-skipped chair (the `if` branch) simply never calls recordAttempt —
   // chairAttempts is never checkpointed and the key stays absent on run.json.
   const chairAttempts = [];
+  // v4.7 D2 (spec "the count is the count"): a non-primary row per launch so
+  // spend is fully attributable — one 'chair-attempt' row per FAILED attempt
+  // that produced a rawLeg (null rawLeg = no wave = no money = no row), plus
+  // one 'repair' row for a launched ch4 (pushed below, after the ch4 block).
+  // The eventual SUCCESSFUL attempt's leg is never pushed here — it becomes
+  // the primary 'chair' row (wasChair:true) via run.js's own chairStats.
+  const chairRows = [];
   const recordAttempt = (attempt, waveId, model) => {
     const cls = classifyChairAttempt(attempt.rawLeg, attempt.errorDoc);
     chairAttempts.push({ waveId, model, outcome: cls.outcome, reason: cls.reason });
     // Checkpointed HERE, before the caller's own isAbortExit bail — a mid-walk
     // kill must not lose the attempts already resolved (spec §8 kill-mid-walk).
     runState.checkpoint(o.runDir, { chairAttempts });
+    if (!attempt.leg && attempt.rawLeg) {
+      chairRows.push(buildRunStatsEntry({
+        leg: attempt.rawLeg, model, role: 'chair-attempt', wasChair: false,
+      }));
+    }
   };
   if (overBudget()) {
     // Ceiling hit after the tally is computable: skip the chair, write the
@@ -183,19 +215,37 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
   // ---- Chair VERDICT line (one repair re-prompt, spec §5) ----
   let overallVerdict = chairText ? parseChairVerdict(chairText) : null;
   if (chairText && !overallVerdict && !overBudget()) {
-    runState.appendStageWave(o.runDir, 'chair', `${o.runId}-ch4`);
+    const waveId4 = `${o.runId}-ch4`;
+    runState.appendStageWave(o.runDir, 'chair', waveId4);
     const repair = await launchers.launchSolo({
       // ⚠️ LC-12: the synthesis rides along. The chair leg SUCCEEDED — only the
       // VERDICT line is missing — so a fresh repair session that cannot see the
       // synthesis is picking a verdict on an artifact it has never read.
       model: actualChair, prompt: stage2.buildChairRepairPrompt({ synthesis: chairText }),
-      project: o.runDir, waveId: `${o.runId}-ch4`,
+      project: o.runDir, waveId: waveId4,
       timeout: o.timeout, gateway: o.gateway, noValidateModel: o.noValidateModel,
       noCostGate: o.noCostGate,
       councilRunId: o.runId, councilName: o.councilName,
+      tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
     });
     addWave(repair.wave);
     if (isAbortExit(repair.exitCode) || isSignalled()) { return bail(repair.exitCode || isSignalled()); }
+    // repair.leg is the raw leg document — launchSolo DOES null it, but only
+    // on a wave-less failure (a pre-flight refusal with no wave launched at
+    // all: run-launch.js's launchSolo derives `leg` from `wave.legs[0]`, so
+    // no wave means no leg, no waveId, no money spent — the errata E3 "no
+    // leg = no wave = no money = no row" case). A wave that DID launch
+    // always yields a leg document, whatever its status. The `if
+    // (repair.leg)` guard below is therefore load-bearing on that exact
+    // distinction: a launched ch4 (a leg document exists, whatever its
+    // status) gets its own row so the repair's spend is attributed even when
+    // it never supplies a VERDICT; a ch4 that never even launched gets no
+    // row at all, because there is nothing billed to attribute.
+    if (repair.leg) {
+      chairRows.push(buildRunStatsEntry({
+        leg: repair.leg, model: actualChair, role: 'repair', wasChair: false,
+      }));
+    }
     overallVerdict = parseChairVerdict((repair.leg && repair.leg.summary) || '');
     chairConformance = overallVerdict ? 'repaired' : 'unstructured';
   }
@@ -216,6 +266,12 @@ async function runChair(ctx, { packet, degrade, statsFn, isSignalled }) {
 
   return {
     aborted: null, chairLeg, actualChair, chairText, chairConformance, overallVerdict,
+    // Additive (v4.7 D2): chairRows holds the non-primary rows (attempts +
+    // repair); chairAttempts is handed back too so run.js can key the
+    // give-up row on "the walk actually happened" without re-reading disk —
+    // NOT on chairRows, since attempts that die pre-wave record an outcome
+    // but produce no row (errata E3: no wave = no money = no row).
+    chairRows, chairAttempts,
   };
 }
 

package/src/council/run-debate.js

@@ -13,62 +13,38 @@ const fs = require('fs');
 const path = require('path');
 const dbrief = require('./briefings-debate');
 const { parseDebateDefense, parseRevote } = require('./parse-stage2');
-const { applyDebate, debateRunStatsRows, PAST_TENSE } = require('./debate');
+const { applyDebate, debateRunStatsRows, PAST_TENSE,
+  allNoResponse, nothingToDebate, disputingJudges, debateTargets, bundleFor } = require('./debate');
 const { materializeDebate } = require('./run-launch');
 const { tally } = require('./tally');
 const { isAbortExit } = require('./run-stages');
 const runState = require('./run-state');
 const { emitStageStarted } = require('../observe/events');
 
-/** Spec §5.7 fallback: a dead/unparseable defense means every bundled id's original stands. */
-function allNoResponse(ids) {
-  const byId = {};
-  for (const id of ids) { byId[id] = { action: 'no-response' }; }
-  return byId;
-}
-
-/** True when there is nothing to challenge (spec §5.1). */
-function nothingToDebate(provisionalRecord) {
-  if (!provisionalRecord || provisionalRecord.judged === false) { return true; }
-  const n = provisionalRecord.findings.filter(f => f.tier === 'Contested' || f.tier === 'Disputed').length;
-  return n === 0;
-}
-
-/** Judges whose provisional adjudications dispute at least one bundled id. */
-function disputingJudges(provisionalRecord, bundledIds) {
-  const ids = new Set(bundledIds);
-  const judges = new Set();
-  for (const f of provisionalRecord.findings) {
-    if (!ids.has(f.id)) { continue; }
-    for (const adj of f.adjudications || []) {
-      if (adj.verdict === 'dispute') { judges.add(adj.judge); }
-    }
-  }
-  return [...judges];
-}
-
-/** Group Contested+Disputed findings by raiser (defense targets). */
-function debateTargets(provisionalRecord, tallyInput) {
-  const claimById = new Map(tallyInput.findings.map(f => [f.id, f]));
-  const byRaiser = {};
-  const previousTier = {};
-  for (const f of provisionalRecord.findings) {
-    if (f.tier !== 'Contested' && f.tier !== 'Disputed') { continue; }
-    previousTier[f.id] = f.tier;
-    const src = claimById.get(f.id) || {};
-    const peerVerdicts = (f.adjudications || []).filter(a => a.judge !== f.raiser).map(a => a.verdict);
-    (byRaiser[f.raiser] = byRaiser[f.raiser] || []).push({ id: f.id, claim: src.claim,
-      severity: f.severity, location: src.location, peerVerdicts, disputeReasons: [] });
-  }
-  return { byRaiser, previousTier };
-}
-
 /** Common launch options for every debate leg (judge-isolated `_scratch` cwd). */
 function legOpts(ctx, waveId) {
   return { project: ctx.scratchDir, waveId, timeout: ctx.o.timeout, gateway: ctx.o.gateway,
     noValidateModel: ctx.o.noValidateModel, noCostGate: ctx.o.noCostGate,
     // v4.3 Task 3 (spec §7.2): attribution ids for every defense/re-vote leg.
-    councilRunId: ctx.o.runId, councilName: ctx.o.councilName };
+    councilRunId: ctx.o.runId, councilName: ctx.o.councilName,
+    tag: ctx.o.tag }; // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
+}
+
+/**
+ * v4.7 D2/E4: normalize a raw (possibly leg-absent) leg into the shape
+ * debateRunStatsRows' superseded/repair lists expect. Same never-invent-a-waveId
+ * discipline as buildRunStatsEntry (run-assemble.js) — only spread `waveId` when
+ * the leg genuinely carries one — but keyed on an explicit `model` (the raiser or
+ * judge identity), since a leg-absent attempt has no `.model` of its own to read.
+ * Threads resolvedModel (the raw leg's .model, the executable id) emit-only-when-set — v4.7 GOA-7 D8.
+ */
+function legRow(model, leg, conformance) {
+  return leg
+    ? { model, status: leg.status, durationMs: typeof leg.durationMs === 'number' ? leg.durationMs : null,
+        usage: leg.usage || null, conformance, summary: leg.summary || '',
+        ...(leg.waveId ? { waveId: leg.waveId } : {}),
+        ...(leg.model ? { resolvedModel: leg.model } : {}) }
+    : { model, status: 'error', durationMs: null, usage: null, conformance, summary: '' };
 }
 
 async function runDefenseSolo(ctx, raiser, findings, idx) {
@@ -90,6 +66,12 @@ async function runDefenseSolo(ctx, raiser, findings, idx) {
   let parsed = leg ? parseDebateDefense(leg.summary, expectedIds)
     : { ok: false, byId: allNoResponse(expectedIds), errors: [{ code: 'DEAD_LEG', detail: 'no summary' }] };
   let conformance = leg ? 'clean' : 'unstructured';
+  // v4.7 D2/E4: the repair's loser leg — the ORIGINAL when the repair produced a
+  // usable (complete) leg (today's leg-swap below is unchanged), or the failed
+  // repair attempt itself when it did not — retained so runDebate can turn it
+  // into an extra debate-defense runStats row. Both stay null when no repair is
+  // attempted at all (today's single-row shape, byte-identical).
+  let supersededLeg = null, repairLeg = null;
   if (leg && !parsed.ok) {
     const repairId = `${waveId}r`;
     runState.appendStageWave(ctx.o.runDir, 'debate-defense', repairId);
@@ -103,13 +85,17 @@ async function runDefenseSolo(ctx, raiser, findings, idx) {
     const leg2 = res2.leg && res2.leg.status === 'complete' ? res2.leg : null;
     parsed = leg2 ? parseDebateDefense(leg2.summary, expectedIds) : parsed;
     conformance = parsed.ok ? 'repaired' : 'unstructured';
-    if (leg2) { leg = leg2; }
+    if (leg2) { supersededLeg = legRow(raiser, leg, 'unstructured'); leg = leg2; }
+    else { repairLeg = legRow(raiser, res2.leg, 'unstructured'); }
   }
   // A dead leg (no complete summary) OR an 'unstructured' conformance after the one
   // repair is a debate degradation (spec §5.7) — surfaced via the returned leg.
   const stub = { model: raiser, status: 'error', durationMs: null, usage: null, conformance: 'unstructured', summary: '' };
   return { raiser, byId: parsed.byId,
-    leg: leg ? { model: raiser, status: leg.status, durationMs: leg.durationMs, usage: leg.usage, conformance, summary: leg.summary } : stub };
+    leg: leg ? { model: raiser, status: leg.status, durationMs: leg.durationMs, usage: leg.usage,
+      conformance, summary: leg.summary, waveId: leg.waveId,
+      ...(leg.model ? { resolvedModel: leg.model } : {}) } : stub,
+    supersededLeg, repairLeg };
 }
 
 async function runRevoteWave(ctx, judges, bundleFindings) {
@@ -131,6 +117,9 @@ async function runRevoteWave(ctx, judges, bundleFindings) {
   ctx.addWave(res.wave);
   if (isAbortExit(res.exitCode)) { return { aborted: res.exitCode }; }
   const byJudge = {}, legs = [];
+  // v4.7 D2/E4: mirrors runDefenseSolo's supersededLeg/repairLeg — one list each,
+  // accumulated across every judge in this wave (most judges contribute neither).
+  const supersededLegs = [], repairLegs = [];
   for (const leg of ((res.wave && res.wave.legs) || [])) {
     // The council ALIAS, not the resolved executable id — runStats rows join
     // meta.models by exact string (run-assemble.js's buildRunStatsEntry).
@@ -154,27 +143,15 @@ async function runRevoteWave(ctx, judges, bundleFindings) {
       conformance = parsed.ok ? 'repaired' : 'unstructured';
       // Symmetric with runDefenseSolo's `if (leg2) { leg = leg2; }` — otherwise
       // revote-<model>.md and the runStats row keep the PRE-repair output.
-      if (leg2) { outLeg = leg2; }
+      if (leg2) { supersededLegs.push(legRow(judge, leg, 'unstructured')); outLeg = leg2; }
+      else { repairLegs.push(legRow(judge, r2.leg, 'unstructured')); }
     }
     byJudge[judge] = parsed.byId;
-    legs.push({ model: judge, status: outLeg.status, durationMs: outLeg.durationMs, usage: outLeg.usage, conformance, summary: outLeg.summary || '' });
-  }
-  return { byJudge, legs };
-}
-
-/** The re-vote bundle: defended-or-amended findings ONLY (spec §5.1 — withdrawn never appear). */
-function bundleFor(defenseResults, tallyInput) {
-  const out = [];
-  for (const dr of defenseResults) {
-    for (const [id, resp] of Object.entries(dr.byId)) {
-      if (resp.action !== 'defend' && resp.action !== 'amend') { continue; }
-      const src = tallyInput.findings.find(f => f.id === id) || {};
-      out.push({ id, severity: src.severity, amended: resp.action === 'amend',
-        claim: resp.action === 'amend' ? resp.claim : src.claim,
-        argument: resp.argument || 'defended without extra argument' });
-    }
+    legs.push({ model: judge, status: outLeg.status, durationMs: outLeg.durationMs, usage: outLeg.usage,
+      conformance, summary: outLeg.summary || '', waveId: outLeg.waveId,
+      ...(outLeg.model ? { resolvedModel: outLeg.model } : {}) });
   }
-  return out;
+  return { byJudge, legs, supersededLegs, repairLegs };
 }
 
 /**
@@ -221,7 +198,7 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
   const stampedInput = { ...tallyInput, findings: tallyInput.findings.map(f => ({ ...f, previousTier: previousTier[f.id] })) };
 
   // ---- Re-vote mini-wave (disputing judges only) ----
-  let revoteByJudge = {}, revoteLegs = [];
+  let revoteByJudge = {}, revoteLegs = [], revoteSuperseded = [], revoteRepairs = [];
   const defendedOrAmended = bundleFor(defenseResults, tallyInput);
   const judges = disputingJudges(provisionalRecord, defendedOrAmended.map(f => f.id));
   // A re-vote is warranted only when something was defended/amended AND ≥1 judge disputed it.
@@ -238,6 +215,8 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
     if (rv.aborted) { return { aborted: rv.aborted, contested, disputed }; }
     revoteByJudge = rv.byJudge;
     revoteLegs = rv.legs;
+    revoteSuperseded = rv.supersededLegs;
+    revoteRepairs = rv.repairLegs;
     // revote-<model>.md per surviving judge leg, mirroring rebuttal-<model>.md
     // (spec §5.1 'raw outputs revote-<model>.md').
     materializeDebate(ctx.o.runDir, revoteLegs, 'revote');
@@ -247,7 +226,12 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
   const { input: debatedInput, debateFindings } = applyDebate({
     tallyInput: stampedInput, provisionalRecord, defenseByRaiser, revoteByJudge });
   debatedInput.runStats = [...(debatedInput.runStats || []),
-    ...debateRunStatsRows({ defenseLegs: defenseResults.map(d => d.leg), revoteLegs })];
+    ...debateRunStatsRows({ defenseLegs: defenseResults.map(d => d.leg), revoteLegs,
+      // v4.7 D2/E4: the retained loser legs from every raiser's defense repair
+      // plus every judge's re-vote repair — same append, no new channel into
+      // buildTallyInput.
+      supersededLegs: [...defenseResults.map(d => d.supersededLeg).filter(Boolean), ...revoteSuperseded],
+      repairLegs: [...defenseResults.map(d => d.repairLeg).filter(Boolean), ...revoteRepairs] })];
 
   // verdictChanges: findings whose tier moved from provisional to debated.
   const provTierById = new Map(provisionalRecord.findings.map(f => [f.id, f.tier]));

package/src/council/run-launch.js

@@ -63,12 +63,18 @@ function createLaunchers(deps = {}) {
   /**
    * @param {{models: string[], prompt: string, project: string, waveId: string,
    *   timeout?: number, gateway?: string, noValidateModel?: boolean, agent?: string,
-   *   councilRunId?: string, councilName?: string, fallback?: object, catalog?: Array}} opts
+   *   councilRunId?: string, councilName?: string, tag?: string, fallback?: object,
+   *   catalog?: Array, noOutputBackstopMs?: number}} opts
    *   councilRunId/councilName (v4.3 Task 3, spec §7.2) are additive attribution
    *   ids forwarded verbatim into the runFanout call so it can stamp them onto
-   *   every leg. fallback/catalog (v4.3 Task 18, spec §6.2) are likewise
+   *   every leg. tag (v4.7 F8 D16) rides the same forward — every call site
+   *   below that sets councilRunId/councilName sets `tag: o.tag` alongside it.
+   *   fallback/catalog (v4.3 Task 18, spec §6.2) are likewise
    *   additive/opt-in — omitted by callers that must never substitute (the
    *   chair, debate legs); run-stages.js's Stage-1/Stage-2 launches pass them.
+   *   noOutputBackstopMs (Task 5, #129) is opt-in and spread-guarded on
+   *   Number.isFinite (0 is a valid disable value); only run-retry.js sets it,
+   *   to escalate the window on a Stage-1 retry.
    * @returns {Promise<{wave: object|null, exitCode: number}>}
    */
   async function launchWave(opts) {
@@ -111,6 +117,18 @@ function createLaunchers(deps = {}) {
       noValidateModel: opts.noValidateModel,
       councilRunId: opts.councilRunId,
       councilName: opts.councilName,
+      // v4.7 F8 D16: rides the SAME forward as councilRunId/councilName above —
+      // undefined when no --tag, so stampLegAttribution's `if (options.tag)`
+      // guard (fanout-wave-io.js) simply no-ops, byte-identical to today.
+      tag: opts.tag,
+      // Task 5 (#129): spread-guarded on Number.isFinite, NOT on truthiness —
+      // an explicit 0 is this knob's documented disable hatch
+      // (no-output-backstop.js:13-15) and a truthiness guard would silently
+      // drop it. Guarding at all — rather than a plain
+      // `noOutputBackstopMs: opts.noOutputBackstopMs` — keeps the transport
+      // call key-identical for run-stage1-launch / run-stage2 / run-chair /
+      // run-debate, none of which set it.
+      ...(Number.isFinite(opts.noOutputBackstopMs) ? { noOutputBackstopMs: opts.noOutputBackstopMs } : {}),
       // v4.3 Task 18 (spec §6.2): additive/opt-in. Callers that must never
       // substitute (run-chair.js, run-debate.js) simply omit these — runLeg's
       // fallback path only activates when `fallback.enabled` is true.

package/src/council/run-retry.js

@@ -17,6 +17,7 @@
 const briefings = require('./briefings');
 const { materializeReviews, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
+const { resolveNoOutputBackstopMs } = require('../utils/no-output-backstop');
 const { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote }
   = require('./run-retry-notes');
 
@@ -141,7 +142,18 @@ function briefingFor(o, unit) {
 async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts = { reviewed: 0, total: 0 } } = {}) {
   const { o, launchers } = ctx;
   const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [],
-    stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [] };
+    stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [],
+    stillDeadRetryLegs: [] };
+  // Task 5 (#129): SL-2 retries the SAME model under the SAME conditions, so a
+  // latency failure is structurally unhealable. Double the window, clamped to
+  // the leg timeout so the failure CLASS stays NO_OUTPUT_BACKSTOP rather than
+  // silently becoming an ordinary timeout at a low --timeout. 2*0 === 0 keeps
+  // the disable hatch. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
+  const legTimeoutMs = (o.timeout || 15) * 60 * 1000;
+  const escalatedBackstopMs = Math.min(
+    2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs()),
+    legTimeoutMs,
+  );
 
   for (const unit of groupStage1Losses(o, deadWaves, deadLegs)) {
     // Task-4 review hardening: a unit this pass cannot even ATTEMPT — an
@@ -168,8 +180,10 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts =
     const common = { project: o.runDir, timeout: o.timeout, gateway: o.gateway,
       noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
       councilRunId: o.runId, councilName: o.councilName,
+      tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
       fallback: o.fallback, catalog: o.catalog,
-      waveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, prompt: briefingFor(o, unit) };
+      waveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, prompt: briefingFor(o, unit),
+      noOutputBackstopMs: escalatedBackstopMs };
     // Dispatch by UNIT TYPE, not model count (spec §4: bench is always a wave —
     // even down to its last surviving seat — critic/lens are always solos).
     // A model-count proxy (`models.length === 1`) is wrong for a bench unit
@@ -234,6 +248,7 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts =
           data: { seat, retryWaveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, firstFailure: ff } });
       } else {
         out.stillDeadNotes.push(retryLegStillDeadNote(seat, ff, leg, unit, counts));
+        out.stillDeadRetryLegs.push(leg);
         if (ff && ff.class === 'wave') {
           if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
           lostWaveSeats.get(ff.waveId).push(seat);