amicus 4.6.3 → 4.7.1

package/src/council/run-stage1-launch.js

@@ -0,0 +1,94 @@
+/**
+ * Stage-1 launch pass for the council engine.
+ *
+ * launchStage1 moved verbatim from run-stages.js (v4.7 PR1 Task 1) to free
+ * gate headroom before the row-per-launch edits land there.
+ */
+'use strict';
+
+const briefings = require('./briefings');
+const runState = require('./run-state');
+const { isAbortExit } = require('./run-launch');
+
+/** Launch all Stage-1 legs (wave + critic/lens solos), collect run docs. */
+async function launchStage1(ctx) {
+  const { o, launchers } = ctx;
+  // `noCostGate` rides EVERY launch object in this file (here, the findings
+  // repair, the judge wave, the judge repair) — see run-launch.js's fanout call.
+  const common = {
+    project: o.runDir, timeout: o.timeout, gateway: o.gateway,
+    noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
+    // v4.3 Task 3 (spec §7.2): attribution ids, forwarded verbatim to runFanout
+    // via run-launch.js so every Stage-1 leg's ledger row carries them.
+    councilRunId: o.runId, councilName: o.councilName,
+    tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
+    // v4.3 Task 18 (spec §6.2): fallback chains apply to STAGE legs only —
+    // the chair (run-chair.js) and debate legs (run-debate.js) never receive
+    // this, so they never substitute via chains.
+    fallback: o.fallback, catalog: o.catalog,
+  };
+  const launches = [];
+  const seated = []; // parallel to `launches`: what each one was SUPPOSED to seat
+  // Record every sub-wave BEFORE it launches: `amicus abort` cascades over
+  // stages[].waveIds, so an id written after the launch leaves that leg
+  // reachable only by the pid kill (no per-leg abort marker).
+  const record = (waveId) => runState.appendStageWave(o.runDir, 'stage1', waveId);
+  if (o.lenses) {
+    o.models.forEach((m, i) => {
+      const waveId = `${o.runId}-l${i + 1}`;
+      record(waveId);
+      seated.push({ waveId, models: [m] });
+      launches.push(launchers.launchSolo({
+        ...common, model: m, waveId,
+        prompt: briefings.buildLensBriefing({ lens: o.lenses[i], briefing: o.briefing, date: o.date }),
+      }));
+    });
+  } else {
+    const seats = o.models.filter(m => m !== o.critic);
+    if (seats.length > 0) {
+      record(`${o.runId}-s1`);
+      seated.push({ waveId: `${o.runId}-s1`, models: seats.slice() });
+      launches.push(launchers.launchWave({
+        ...common, models: seats, waveId: `${o.runId}-s1`,
+        prompt: briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date }),
+      }));
+    }
+    if (o.critic) {
+      record(`${o.runId}-c1`);
+      seated.push({ waveId: `${o.runId}-c1`, models: [o.critic] });
+      launches.push(launchers.launchSolo({
+        ...common, model: o.critic, waveId: `${o.runId}-c1`,
+        prompt: briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }),
+      }));
+    }
+  }
+  const results = await Promise.all(launches);
+  let aborted = null;
+  const legs = [];
+  const deadWaves = [];
+  results.forEach((r, i) => {
+    ctx.addWave(r.wave);
+    const abort = isAbortExit(r.exitCode);
+    if (abort) { aborted = r.exitCode; }
+    const got = (r.wave && Array.isArray(r.wave.legs)) ? r.wave.legs : [];
+    legs.push(...got);
+    // ⚠️ Step 10's uncovered half. A wave that died BEFORE its legs (the server
+    // never started; `database is locked`) contributes NOTHING to `legs`, so
+    // deadLegs cannot see it either — which is how run v441plan01 recorded
+    // stage1 'complete' with four seats missing and no trace of them. In lens
+    // mode every seat is its own wave, so a run could lose seats and still exit
+    // 0; the quorum gate only catches the non-lens seat wave. A budget refusal
+    // has its own louder channel already (run-budget.noteBudgetRefusal) and
+    // must not be double-counted here.
+    if (got.length > 0 || abort) { return; }
+    if (r.errorDoc && r.errorDoc.code === 'BUDGET_EXCEEDED') { return; }
+    deadWaves.push({
+      waveId: seated[i].waveId, models: seated[i].models,
+      reason: (r.wave && (r.wave.reason || r.wave.error))
+        || (r.errorDoc && r.errorDoc.message) || 'the wave produced no legs',
+    });
+  });
+  return { aborted, legs, deadWaves };
+}
+
+module.exports = { launchStage1 };

package/src/council/run-stage2.js

@@ -23,6 +23,7 @@ const stage2 = require('./briefings-stage2');
 const { parseJudgeOutput } = require('./parse-stage2');
 const { sanitizeName, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
+const { buildRunStatsEntry } = require('./run-assemble');
 
 /**
  * Stage 2: shared anonymized bundle → judge wave in _scratch → parse + repair.
@@ -31,7 +32,12 @@ const runState = require('./run-state');
  *   extraLabeled?: Array<{label: string, text: string}>}} args
  *   `extraLabeled` (v4.1 §4.4) are labeled reviews sourced from a FILE rather than
  *   a leg (the Claude review): they join the judged BUNDLE, never the judge ROSTER.
- * @returns {Promise<{aborted: number|null, judgeResults: Array}>}
+ * @returns {Promise<{aborted: number|null, judgeResults: Array, extraRows: Array}>}
+ *   `extraRows` (v4.7 D2, mirroring runStage1's channel) is one `role:'repair'`
+ *   row per `-q<N>` judge-repair solo (error status when the repair itself
+ *   failed) — the judge's own judgeResults entry keeps attributing its ORIGINAL
+ *   Stage-2 wave leg throughout (the #83 comment below), so a repair never
+ *   overwrites the primary judge row; it only adds this separate one.
  */
 async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled = [] }) {
   const { o } = ctx;
@@ -59,12 +65,18 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
     timeout: o.timeout, gateway: o.gateway, noValidateModel: o.noValidateModel,
     noCostGate: o.noCostGate,
     councilRunId: o.runId, councilName: o.councilName,
+    tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
     fallback: o.fallback, catalog: o.catalog,
   });
   ctx.addWave(wave);
-  if (isAbortExit(exitCode)) { return { aborted: exitCode, judgeResults: [] }; }
+  if (isAbortExit(exitCode)) { return { aborted: exitCode, judgeResults: [], extraRows: [] }; }
 
   const judgeResults = [];
+  // v4.7 D2: every judge-repair launch is a billed leg of its own, distinct from
+  // the judge's original Stage-2 wave leg it is trying to fix — it gets its own
+  // row so its cost is never folded into, or lost from, the judge's row (mirrors
+  // runStage1's -p<N> extraRows, ./run-stages.js:117-120).
+  const extraRows = [];
   let repairSeq = 0;
   for (const leg of (wave && wave.legs) || []) {
     const judge = leg.modelInput || leg.model;
@@ -95,10 +107,19 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
         project: ctx.scratchDir, waveId, timeout: o.timeout,
         gateway: o.gateway, noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
         councilRunId: o.runId, councilName: o.councilName,
+        tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
         fallback: o.fallback, catalog: o.catalog,
       });
       ctx.addWave(solo.wave);
-      if (isAbortExit(solo.exitCode)) { return { aborted: solo.exitCode, judgeResults }; }
+      if (isAbortExit(solo.exitCode)) {
+        // Abort paths add no rows (aborted runs never reach tally) — extraRows
+        // is returned only for shape consistency, never read past this point.
+        return { aborted: solo.exitCode, judgeResults, extraRows };
+      }
+      // Every -q<N> launch gets a row — INCLUDING a repair that failed: the
+      // error status rides naturally off solo.leg (null/'error'-status leg ⇒
+      // buildRunStatsEntry's own never-invent defaults), no special-casing needed.
+      extraRows.push(buildRunStatsEntry({ leg: solo.leg, model: judge, role: 'repair', wasChair: false }));
       const out = (solo.leg && solo.leg.summary) || '';
       if (out.trim()) { judging = out; }
       parsed = parseJudgeOutput(out, parseCtx);
@@ -120,7 +141,7 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
     judgeResults.push({ judge, ok: true, order, adjudications: parsed.adjudications, conformance,
       leg: leg || null });
   }
-  return { aborted: null, judgeResults };
+  return { aborted: null, judgeResults, extraRows };
 }
 
 module.exports = { runStage2 };

package/src/council/run-stages.js

@@ -23,91 +23,13 @@ const { materializeReviews, isAbortExit } = require('./run-launch');
 const { retryStage1Losses } = require('./run-retry');
 const runState = require('./run-state');
 const { runStage2 } = require('./run-stage2');
+const { launchStage1 } = require('./run-stage1-launch');
+const { buildRunStatsEntry } = require('./run-assemble');
 
 function slug(text) {
   return String(text).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
 }
 
-/** Launch all Stage-1 legs (wave + critic/lens solos), collect run docs. */
-async function launchStage1(ctx) {
-  const { o, launchers } = ctx;
-  // `noCostGate` rides EVERY launch object in this file (here, the findings
-  // repair, the judge wave, the judge repair) — see run-launch.js's fanout call.
-  const common = {
-    project: o.runDir, timeout: o.timeout, gateway: o.gateway,
-    noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
-    // v4.3 Task 3 (spec §7.2): attribution ids, forwarded verbatim to runFanout
-    // via run-launch.js so every Stage-1 leg's ledger row carries them.
-    councilRunId: o.runId, councilName: o.councilName,
-    // v4.3 Task 18 (spec §6.2): fallback chains apply to STAGE legs only —
-    // the chair (run-chair.js) and debate legs (run-debate.js) never receive
-    // this, so they never substitute via chains.
-    fallback: o.fallback, catalog: o.catalog,
-  };
-  const launches = [];
-  const seated = []; // parallel to `launches`: what each one was SUPPOSED to seat
-  // Record every sub-wave BEFORE it launches: `amicus abort` cascades over
-  // stages[].waveIds, so an id written after the launch leaves that leg
-  // reachable only by the pid kill (no per-leg abort marker).
-  const record = (waveId) => runState.appendStageWave(o.runDir, 'stage1', waveId);
-  if (o.lenses) {
-    o.models.forEach((m, i) => {
-      const waveId = `${o.runId}-l${i + 1}`;
-      record(waveId);
-      seated.push({ waveId, models: [m] });
-      launches.push(launchers.launchSolo({
-        ...common, model: m, waveId,
-        prompt: briefings.buildLensBriefing({ lens: o.lenses[i], briefing: o.briefing, date: o.date }),
-      }));
-    });
-  } else {
-    const seats = o.models.filter(m => m !== o.critic);
-    if (seats.length > 0) {
-      record(`${o.runId}-s1`);
-      seated.push({ waveId: `${o.runId}-s1`, models: seats.slice() });
-      launches.push(launchers.launchWave({
-        ...common, models: seats, waveId: `${o.runId}-s1`,
-        prompt: briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date }),
-      }));
-    }
-    if (o.critic) {
-      record(`${o.runId}-c1`);
-      seated.push({ waveId: `${o.runId}-c1`, models: [o.critic] });
-      launches.push(launchers.launchSolo({
-        ...common, model: o.critic, waveId: `${o.runId}-c1`,
-        prompt: briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }),
-      }));
-    }
-  }
-  const results = await Promise.all(launches);
-  let aborted = null;
-  const legs = [];
-  const deadWaves = [];
-  results.forEach((r, i) => {
-    ctx.addWave(r.wave);
-    const abort = isAbortExit(r.exitCode);
-    if (abort) { aborted = r.exitCode; }
-    const got = (r.wave && Array.isArray(r.wave.legs)) ? r.wave.legs : [];
-    legs.push(...got);
-    // ⚠️ Step 10's uncovered half. A wave that died BEFORE its legs (the server
-    // never started; `database is locked`) contributes NOTHING to `legs`, so
-    // deadLegs cannot see it either — which is how run v441plan01 recorded
-    // stage1 'complete' with four seats missing and no trace of them. In lens
-    // mode every seat is its own wave, so a run could lose seats and still exit
-    // 0; the quorum gate only catches the non-lens seat wave. A budget refusal
-    // has its own louder channel already (run-budget.noteBudgetRefusal) and
-    // must not be double-counted here.
-    if (got.length > 0 || abort) { return; }
-    if (r.errorDoc && r.errorDoc.code === 'BUDGET_EXCEEDED') { return; }
-    deadWaves.push({
-      waveId: seated[i].waveId, models: seated[i].models,
-      reason: (r.wave && (r.wave.reason || r.wave.error))
-        || (r.errorDoc && r.errorDoc.message) || 'the wave produced no legs',
-    });
-  });
-  return { aborted, legs, deadWaves };
-}
-
 /** Role of a seat by its input alias. */
 function roleFor(o, alias) {
   if (o.lenses) {
@@ -120,8 +42,15 @@ function roleFor(o, alias) {
 /**
  * Stage 1: independent reviews + findings validation + bounded repair.
  * @returns {Promise<{aborted: number|null, reviews: Array, deadLegs: Array,
- *   deadWaves: Array, degraded: boolean}>} `degraded` covers BOTH ways a seat
- *   can go missing: a leg that ran and died (deadLegs) and a whole sub-wave that
+ *   deadWaves: Array, degraded: boolean, extraRows: Array}>} `extraRows` (v4.7
+ *   D2/E4) is the row-per-launch channel for legs that never became — or
+ *   stopped being — a seat's primary review: one `role:'repair'` row per
+ *   findings-repair solo (error status when the repair itself failed), one
+ *   `role:'superseded'` row per first leg a later attempt replaced (healed OR
+ *   still-dead — either way the first leg stopped being primary), and one
+ *   PRIMARY error row per seat with no surviving review at all.
+ *   `degraded` covers BOTH ways a seat can go missing: a leg that ran and died
+ *   (deadLegs) and a whole sub-wave that
  *   died before its legs existed (deadWaves). A pushed review carries
  *   `findingsUnverified: true` (LC-11) when its findings came from a repair whose
  *   contract could not be checked — the original block was absent or unparseable,
@@ -132,7 +61,7 @@ function roleFor(o, alias) {
 async function runStage1(ctx) {
   const { o } = ctx;
   const { aborted, legs, deadWaves } = await launchStage1(ctx);
-  if (aborted) { return { aborted, reviews: [], deadLegs: [], deadWaves: [], degraded: false }; }
+  if (aborted) { return { aborted, reviews: [], deadLegs: [], deadWaves: [], degraded: false, extraRows: [] }; }
 
   const firstPass = materializeReviews(o.runDir, legs);
   const alive0 = new Set(firstPass.map(m => m.leg));
@@ -147,7 +76,7 @@ async function runStage1(ctx) {
     // abort fixed ~87 lines below ("Must be the post-retry set") — subtract
     // whatever retry.recoveredLegs already healed before this abort landed.
     const healed = new Set(retry.recoveredLegs.map(l => l.modelInput || l.model));
-    return { aborted: retry.aborted, reviews: [], degraded: false,
+    return { aborted: retry.aborted, reviews: [], degraded: false, extraRows: [],
       deadLegs: deadLegs0.filter(l => !healed.has(l.modelInput || l.model)),
       deadWaves: deadWaves.map(w => ({ ...w, models: (w.models || []).filter(m => !healed.has(m)) })).filter(w => w.models.length > 0) };
   }
@@ -185,6 +114,10 @@ async function runStage1(ctx) {
   const stillDeadWaves = [...retry.skippedDeadWaves, ...retry.stillDeadWaves];
 
   const reviews = [];
+  // v4.7 D2/E4: every repair launch is a billed leg of its own, distinct from
+  // the seat's own review leg (m.leg) it is trying to fix — it gets its own
+  // row so its cost is never folded into, or lost from, the review's row.
+  const extraRows = [];
   let repairSeq = 0;
   for (const m of materialized) {
     let conformance = 'clean';
@@ -227,6 +160,7 @@ async function runStage1(ctx) {
         project: o.runDir, waveId, timeout: o.timeout,
         gateway: o.gateway, noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
         councilRunId: o.runId, councilName: o.councilName,
+        tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
         fallback: o.fallback, catalog: o.catalog,
       });
       ctx.addWave(solo.wave);
@@ -236,8 +170,15 @@ async function runStage1(ctx) {
         // short-circuit, so a heal-then-abort run was recording seats as dead
         // that had actually reviewed on retry. Must be the post-retry set,
         // same as the normal-completion return below.
-        return { aborted: solo.exitCode, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves, degraded: false };
+        // Abort paths add no rows (aborted runs never reach tally) — extraRows
+        // is returned only for shape consistency, never read past this point.
+        return { aborted: solo.exitCode, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves,
+          degraded: false, extraRows };
       }
+      // Every -p<N> launch gets a row — INCLUDING a repair that failed: the
+      // error status rides naturally off solo.leg (null/'error'-status leg ⇒
+      // buildRunStatsEntry's own never-invent defaults), no special-casing needed.
+      extraRows.push(buildRunStatsEntry({ leg: solo.leg, model: m.modelInput, role: 'repair', wasChair: false }));
       const repaired = (solo.leg && solo.leg.summary) || '';
       if (repaired.trim()) { repairing = repaired; }
       res = validateFindings(repaired);
@@ -285,8 +226,60 @@ async function runStage1(ctx) {
       ...(repairRefused ? { repairRefused } : {}),
     });
   }
+
+  // v4.7 D2/E4 — superseded rows: a leg-origin seat's FIRST leg stops being
+  // primary the moment a retry was actually attempted for it, healed or not
+  // (deadLegs0 × recovered-or-still-dead seats — mirrors the healed-set idiom
+  // above, extended to the still-dead half E4 also requires). A skipped seat
+  // (cost ceiling / unmappable — never got a second leg) keeps NO superseded
+  // row: nothing replaced it. Wave-origin seats never had a first leg at all,
+  // so they can never appear here regardless of healed/dead outcome (E4).
+  const supersededAliases = new Set([
+    ...retry.recoveredLegs.map(l => l.modelInput || l.model),
+    ...retry.stillDeadLegs.map(l => l.modelInput || l.model),
+  ]);
+  for (const dead of deadLegs0) {
+    const alias = dead.modelInput || dead.model;
+    if (supersededAliases.has(alias)) {
+      extraRows.push(buildRunStatsEntry({ leg: dead, model: alias, role: 'superseded', wasChair: false }));
+    }
+  }
+
+  // v4.7 D2/E4 — primary error rows: one per seat with NO surviving review
+  // (every alias still in stillDeadLegs/stillDeadWaves after retry). E5
+  // amended (Task-4 review, owner-ruled): run-retry.js now surfaces the real
+  // retry leg (stillDeadRetryLegs), from the ONE branch it exists in —
+  // retryLegStillDeadNote, a retry leg that came back unusable. Prefer that
+  // REAL leg: status/waveId/usage/duration all real, all from the SAME
+  // attempt (no more pairing a retry's waveId with a different attempt's
+  // status). The other two dead-leg note classes — srcLegStillDeadNote (retry
+  // wave died wholesale, zero legs) and missingLegStillDeadNote (partial
+  // return never named this seat) — never get a real leg, so `leg: null`
+  // (no phantom waveId: one must never appear without a real billed leg).
+  // No 'dead-leg' note at all ⇒ never retried (skipped) ⇒ the original dead
+  // leg is this seat's only, and therefore final, leg.
+  const retryLegByAlias = new Map();
+  for (const leg of retry.stillDeadRetryLegs) { retryLegByAlias.set(leg.modelInput || leg.model, leg); }
+  const attemptedAliases = new Set();
+  for (const n of retry.stillDeadNotes) {
+    if (n.channel === 'dead-leg' && n.data && n.data.seat) { attemptedAliases.add(n.data.seat); }
+  }
+  const deadAliases = new Set([
+    ...stillDeadLegs.map(l => l.modelInput || l.model),
+    ...stillDeadWaves.flatMap(w => w.models || []),
+  ]);
+  for (const alias of deadAliases) {
+    let finalLeg = retryLegByAlias.get(alias);
+    if (!finalLeg) {
+      finalLeg = attemptedAliases.has(alias)
+        ? null                                                              // retried; no leg at all for this seat
+        : (deadLegs0.find(l => (l.modelInput || l.model) === alias) || null); // never retried
+    }
+    extraRows.push(buildRunStatsEntry({ leg: finalLeg, model: alias, role: roleFor(o, alias), wasChair: false }));
+  }
+
   return { aborted: null, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves,
-    degraded: stillDeadLegs.length > 0 || stillDeadWaves.length > 0 };
+    degraded: stillDeadLegs.length > 0 || stillDeadWaves.length > 0, extraRows };
 }
 
 // runStage2 lives in ./run-stage2.js (300-line gate) but is re-exported here so

package/src/council/run-state.js

@@ -101,13 +101,21 @@ function initCouncilRun(o) {
     // "no debate key" contract and fail the object-typed schema), and with a VALID
     // outcome from the first write so a run killed mid-debate stays schema-valid.
     ...(o.debate ? { debate: { enabled: true, outcome: 'nothing-to-debate' } } : {}),
-    // F9 (v4.5): additive-only — absent (not null) without --template; the MCP
-    // seed (mcp-council-run.js, initRun directly) never sets this in v4.5.
+    // F9 (v4.5): additive-only — absent (not null) without --template. T15-m2
+    // (v4.7): the MCP handler (mcp-council-run.js) now pre-seeds this directly
+    // via its own initRun call when a pack forwards briefing.template; the
+    // spawned CLI child's own seed here still passes o.template: null (no
+    // --template flag crosses that spawn boundary), so this spread omits the
+    // key and mergeRun's shallow merge preserves the parent's pre-seeded value.
     ...(o.template ? { template: o.template } : {}),
     // v4.5 Task 12 (B7/F5): additive-only — absent (not null) without --pack.
     // Preserved across a later MCP-child initRun whose own seed omits it —
     // mergeRun's plain shallow merge never drops a key patch doesn't mention.
     ...(o.pack ? { pack: o.pack } : {}),
+    // v4.7 F8 (D13): additive-only — absent (not null) without --tag. Same
+    // merge-preserve precedent as pack above (mergeRun's shallow merge never
+    // drops a key a later patch doesn't mention).
+    ...(o.tag ? { tag: o.tag } : {}),
     // v4.5 Wave 2 (post-HOLD chip, task-23-report.md Anomaly 1): additive-only
     // — absent (never an empty array) when nothing was dropped. Handler-computed
     // (cli-handlers-council-run.js's resolveBench, via resolveCouncilMembers) so

package/src/council/run.js

@@ -207,9 +207,15 @@ async function runCouncil(options, deps = {}) {
     }
 
     // ---- Chair synthesis (provisional tally feeds the packet) ----
+    // v4.7 D2: two independent extraRows channels — Stage 1's findings-repair
+    // rows and Stage 2's judge-repair rows — concatenate into the ONE array
+    // buildTallyInput appends after the primary review rows (run-assemble.js
+    // docblock). Neither stage invents a second mechanism for the other's kind
+    // of row.
     const mkInput = (chairStats, chairModel) => asm.buildTallyInput({
       runId: o.runId, date: o.date, bench: o.models.slice(), chair: chairModel,
       reviews: s1.reviews, judgeResults: s2.judgeResults, chairStats, claudeReview,
+      extraRows: [...s1.extraRows, ...s2.extraRows],
     });
     const provisionalInput = mkInput(null, o.chair);
     const provisional = tally(provisionalInput);
@@ -231,17 +237,35 @@ async function runCouncil(options, deps = {}) {
       packet, degrade, statsFn, isSignalled: () => signalled,
     });
     if (chairRes.aborted !== null) { return finalize(chairRes.aborted); }
-    const { chairLeg, actualChair, chairText, chairConformance, overallVerdict } = chairRes;
+    const { chairLeg, actualChair, chairText, chairConformance, overallVerdict, chairRows, chairAttempts } = chairRes;
 
     // ---- Final tally (chair row included) + ledger + artifacts ----
     const chairStats = chairLeg ? asm.buildRunStatsEntry({
       leg: chairLeg, model: actualChair, role: 'chair', wasChair: true,
       conformance: chairConformance,
     }) : null;
+    // v4.7 D2: a give-up (no chairLeg) with at least one recorded attempt gets
+    // an explicit error row so the walk's outcome isn't silently absorbed.
+    // Keyed on chairAttempts, NOT chairRows — attempts that die pre-wave (no
+    // money spent) record an outcome but yield no row (errata E3).
+    const giveUpRow = (!chairLeg && chairAttempts && chairAttempts.length)
+      ? asm.buildRunStatsEntry({ leg: null, model: o.chair, role: 'chair', wasChair: false })
+      : null;
     // Built on the (possibly debated) input so the debate's amended claims, replaced
     // adjudications and rebuttal/revote runStats rows all reach the final record.
     const finalInput = { ...debatedInput, meta: { ...debatedInput.meta, chair: actualChair || o.chair } };
-    if (chairStats) { finalInput.runStats = [...(finalInput.runStats || []), chairStats]; }
+    // Item 8, final-review consolidated wave: was three sequential
+    // reassignments (chairStats, then chairRows, then giveUpRow), each
+    // rebuilding finalInput.runStats from scratch — collapsed into the one
+    // spread that was always the net effect. The `|| []` fallbacks were
+    // dead: `runStats` is a real array on every debatedInput
+    // (asm.buildTallyInput always returns one via .map()), never undefined.
+    finalInput.runStats = [
+      ...finalInput.runStats,
+      ...(chairStats ? [chairStats] : []),
+      ...chairRows,
+      ...(giveUpRow ? [giveUpRow] : []),
+    ];
     const record = tally(finalInput);
     if (debateFindings) { decorateRecord(record, debateFindings); }
     if (!o.lenses) {

package/src/council/tally.js

@@ -120,10 +120,14 @@ function tally(input) {
       // travel with it: LC-11's `findingsUnverified` (contract uncheckable) and
       // F1's `repairRefused` (contract checked and broken). Additive, emitted only
       // when set, and the runStats schema declares no additionalProperties, so a
-      // run without either is byte-for-byte unchanged. The append-only LEDGER is
-      // deliberately NOT extended — that is a schema-versioned product decision.
+      // run without either is byte-for-byte unchanged. v4.7 GOA-7 exercised the
+      // ledger's schema-versioned extension slot: `resolvedModel` rides this
+      // allowlist and reaches ledger rows via the ledger's model-keyed join of
+      // primary rows (ledger.js, LEDGER_SCHEMA_VERSION 2).
       ...(r.findingsUnverified ? { findingsUnverified: true } : {}),
       ...(r.repairRefused ? { repairRefused: r.repairRefused } : {}),
+      ...(r.waveId ? { waveId: r.waveId } : {}),
+      ...(r.resolvedModel ? { resolvedModel: r.resolvedModel } : {}),
       status: r.status || 'unknown',
       durationMs: typeof r.durationMs === 'number' ? r.durationMs : null,
       usage: r.usage || null,

package/src/headless.js

@@ -154,6 +154,58 @@ function withTimeout(promise, ms, label) {
   ]);
 }
 
+/**
+ * Task 6 (#129, #133): build the NO_OUTPUT_BACKSTOP reason string. Report
+ * ONLY what the mechanism observed — a deadline passed with no substantive
+ * activity (output/reasoning/tool calls) — never a cause. At the pre-send
+ * firing site (runHeadless, ~:506-518) the backstop can win the race against
+ * sendPromptAsync before the send ever resolves, so "the endpoint accepted
+ * the request" is not even something that site observed. The previous text
+ * asserted "likely a listed-but-not-serving model or a dead endpoint" — a
+ * canned guess with no evidence gate — which sent 30 minutes of #133's
+ * debugging at model ids and API keys while the real cause (an opencode
+ * engine version skew) sat in ~/.local/share/opencode/log/opencode.log the
+ * whole time.
+ *
+ * `fromEnv` distinguishes two ways `ms` was decided, NOT whether
+ * AMICUS_NO_OUTPUT_BACKSTOP_MS is relevant — it is relevant on both branches:
+ *   - fromEnv=true: `ms` IS the live env-resolved value (or its documented
+ *     default) — the message says so directly, "(0 disables)" included,
+ *     because raising the env var changes exactly this window.
+ *   - fromEnv=false: `ms` arrived as a direct, caller-set numeric option.
+ *     Task 6 review (Important finding): this is NOT synonymous with "the
+ *     env var doesn't apply" — src/council/run-retry.js:154 computes a
+ *     Stage-1 retry's escalated window as
+ *     `2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs :
+ *     resolveNoOutputBackstopMs())` and forwards that as a direct
+ *     `noOutputBackstopMs` (line 186) — so a 240s retry-fired backstop is
+ *     "caller-set" by this predicate while still being *derived from* the
+ *     env default doubled. Only src/sidecar/models-probe.js:79's hardcoded,
+ *     non-tunable 30s (PROBE_WINDOW_MS; docs/usage.md:406 promises it's "not
+ *     tunable") is truly independent of the env var. Because a real
+ *     `fromEnv` flag distinguishing those two cases would have to ride the
+ *     same value through src/sidecar/fanout.js, which is line-locked at
+ *     EXACTLY 300/300 this release, the caller-set branch instead names the
+ *     var as something this window *overrides* rather than either claiming
+ *     it governs (false on the probe) or omitting it (false/unhelpful on the
+ *     retry) — true on both, and still points a user at the remedy.
+ *
+ * Kept module-scope and pure (not a closure over runHeadless locals) so it
+ * can be asserted on directly in tests without driving the poll loop; the
+ * `noOutputBackstopReason` closure inside runHeadless just forwards to this
+ * with the per-run `noOutputBackstopMs`/`backstopFromEnv` values, so the two
+ * firing sites there stay identical to what's tested here.
+ * @param {{ms: number, fromEnv: boolean}} args
+ * @returns {string}
+ */
+function formatNoOutputBackstopReason({ ms, fromEnv }) {
+  return 'NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in '
+    + `${Math.round(ms / 1000)}s — `
+    + (fromEnv
+      ? 'the AMICUS_NO_OUTPUT_BACKSTOP_MS window (0 disables)'
+      : 'a caller-set window overriding the AMICUS_NO_OUTPUT_BACKSTOP_MS default');
+}
+
 /**
  * Wait for the OpenCode server to be ready using SDK health check
  */
@@ -473,16 +525,26 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // deadline `nowMs >= deadline` can never satisfy — the backstop would
     // silently never fire. Finite zero (the documented explicit-disable
     // value) still takes the direct branch: Number.isFinite(0) === true.
-    const noOutputBackstopMs = Number.isFinite(options.noOutputBackstopMs)
-      ? options.noOutputBackstopMs : resolveNoOutputBackstopMs(options._env);
+    // Capture the source-of-truth predicate ONCE and reuse it (do not call
+    // Number.isFinite a second time below) — `backstopFromEnv` is just its
+    // complement: options.noOutputBackstopMs is a direct, caller-set value
+    // exactly when Number.isFinite is true, so the window came from
+    // resolveNoOutputBackstopMs's env-resolution seam exactly when it's false.
+    // Reused both to pick noOutputBackstopMs and to decide whether the reason
+    // string below may name the env var, so the two can never drift apart.
+    const backstopFromEnv = !Number.isFinite(options.noOutputBackstopMs);
+    const noOutputBackstopMs = backstopFromEnv
+      ? resolveNoOutputBackstopMs(options._env) : options.noOutputBackstopMs;
     const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: Date.now() });
     let backstopFired = false;
     // Single source for the reason string so the pre-send firing site below and
     // the per-poll firing site further down (still ticking the SAME instance)
-    // can never drift apart.
-    const noOutputBackstopReason = () => 'NO_OUTPUT_BACKSTOP: model produced no '
-      + `output, reasoning, or tool calls in ${Math.round(noOutputBackstopMs / 1000)}s `
-      + '— likely a listed-but-not-serving model or a dead endpoint';
+    // can never drift apart. Forwards to the module-scope, pure
+    // formatNoOutputBackstopReason (below/exported) so tests can assert on the
+    // string shape directly without driving the whole poll loop.
+    const noOutputBackstopReason = () => formatNoOutputBackstopReason({
+      ms: noOutputBackstopMs, fromEnv: backstopFromEnv,
+    });
 
     // Send prompt asynchronously (returns immediately, we poll for results) —
     // bounded by the backstop: an endpoint that accepts but never answers must
@@ -1413,6 +1475,7 @@ module.exports = {
   extractSummary,
   findTrailingFoldMarker,
   formatFoldOutput,
+  formatNoOutputBackstopReason,
   DEFAULT_TIMEOUT,
   FOLD_MARKER,
   COMPLETE_MARKER,

package/src/mcp-council-awareness.js

@@ -223,6 +223,7 @@ function listCouncilRuns(project) {
       model: null, agent: 'Plan', createdAt: run.createdAt,
       briefing: sanitizePreview(briefing, 80),
       stage: active ? active.name : null,
+      ...(run.tag ? { tag: run.tag } : {}),
     });
   }
   return out;

package/src/mcp-council-bench.js

@@ -21,6 +21,10 @@
  * spawns the CLI child with an already-expanded `--models` list (never
  * `--council`), so the preset name would otherwise be lost; the caller
  * forwards it via the internal `--council-name` passthrough instead.
+ * Parallel twin: cli-council-run-bench.js's `resolveBench` wraps the same
+ * `resolveCouncilMembers` core with its own XOR rules (CLI failJson docs there,
+ * plain `{error}` strings here) and carries one guard this side lacks. The two
+ * wrappers evolve independently — change a validation rule on one, change both.
  */
 function resolveBenchInput(input) {
   const inputModels = Array.isArray(input.models) ? input.models : [];

package/src/mcp-council-run.js

@@ -94,11 +94,13 @@ async function handleCouncilRunTool(input, project, helpers) {
   // onto input.template above) is the only way one reaches this handler.
   // {{prompt}} = the briefingFile content; the RENDERED text is what lands in
   // briefing.md below (mirrors the CLI's single template-application point).
+  let templateMeta = null;
   if (input.template !== undefined) {
     const { applyTemplate } = require('./template/apply');
     const t = applyTemplate({ templateRef: input.template, prompt: briefing, project });
     if (t.error) { return textResult(t.error.message, true); }
     briefing = t.prompt;
+    templateMeta = t.promptMeta && t.promptMeta.template;
     notices.push(...t.notices);
   }
 
@@ -158,6 +160,10 @@ async function handleCouncilRunTool(input, project, helpers) {
       // v4.5 Wave 2: additive, same preserved-across-the-child's-own-initRun
       // precedent as `pack` above — absent (never []) when nothing dropped.
       ...(droppedMembers.length ? { droppedMembers } : {}),
+      // T15-m2 (v4.7): additive-only — absent (not null) without a pack-forwarded
+      // template. Same preserved-across-the-child's-own-initRun precedent as
+      // `pack`/`droppedMembers` above (run-state.js:104-110).
+      ...(templateMeta ? { template: templateMeta } : {}),
       usage: null, createdAt: new Date().toISOString(),
     });
     runState.writePointer(project, runId, runDir);
@@ -195,6 +201,9 @@ async function handleCouncilRunTool(input, project, helpers) {
   if (input.debate) { args.push('--debate'); }
   if (input.claudeReviewFile) { args.push('--claude-review', path.resolve(project, String(input.claudeReviewFile))); }
   if (input.noCostGate) { args.push('--no-cost-gate'); }
+  // v4.7 F8 (D13): the spawned CLI child's own cli-handlers-council-run.js
+  // stores the tag on the run.json seed (Task 3) — this handler only forwards.
+  if (input.tag) { args.push('--tag', input.tag); }
 
   let child;
   try { child = helpers.spawnFn(args, runDir); } catch (err) {
@@ -275,6 +284,7 @@ const awareness = require('./mcp-council-awareness');
 
 module.exports = {
   handleCouncilRunTool,
+  COUNCIL_PACK_PARAM_MAP,
   buildCouncilStatusPayload: awareness.buildCouncilStatusPayload,
   listCouncilRuns: awareness.listCouncilRuns,
   abortCouncilRun: awareness.abortCouncilRun,