amicus 4.7.0 → 4.8.0

package/src/council/ledger.js

@@ -3,6 +3,11 @@
 const fs = require('fs');
 const path = require('path');
 const { getConfigDir } = require('../utils/config');
+// The read/aggregate half lives in ./ledger-stats (v4.8 Phase 3 T3.0 size-gate split).
+// readRows/avg/countRuns/deriveReliability/buildStatsDoc/LEDGER_FILE are re-exported
+// below — existing consumers keep importing them from here.
+const { LEDGER_FILE, readRows, avg, countRuns, deriveReliability,
+  buildStatsDoc } = require('./ledger-stats');
 
 // v4.7 GOA-7 D9: v2 rows may carry `resolvedModel` (the executable id that
 // served, copied from the joined runStats row, emit-only-when-set). Absent
@@ -12,7 +17,6 @@ const { getConfigDir } = require('../utils/config');
 // unknowable. Legacy-READ only: readers never inspect schemaVersion, rows are
 // never migrated.
 const LEDGER_SCHEMA_VERSION = 2;
-const LEDGER_FILE = 'council-ledger.jsonl';
 
 // v4.7 D4/E1/E2/E6 (Task-7, task-6/task-7 adjudications): fail-closed
 // ALLOWLIST of runStats roles the ledger join (below) may consume as a
@@ -20,7 +24,7 @@ const LEDGER_FILE = 'council-ledger.jsonl';
 // runs, and the av-receiver golden fixture — errata E2, must stay green).
 // 'redteam' is the second-opinion skill's documented primary-seat role
 // (skills/second-opinion/MANUAL-ORCHESTRATION.md:147; red-team runs record
-// to the ledger per COUNCIL-DESIGN.md:266 — errata E6, task-7 review: without
+// to the ledger per COUNCIL-DESIGN.md:268 — errata E6, task-7 review: without
 // it a red-team row's role/wasChair/conformance never join, silently
 // fabricating conformance:'clean' via the `|| 'clean'` fallback below).
 // 'judge' stays excluded (#83's overwrite-guard: judges ARE bench models, and
@@ -58,34 +62,169 @@ function countSeverity(findings) {
   return c;
 }
 
-/** One model-level row per council model. Rates are over RAW raised findings. */
+// v4.8 PR4b (R4b-4): a LOCAL COPY of run-assemble.js's CONFORMANCE_RANK +
+// worseConformance. Deliberately copied, not imported: this module requires
+// fs/path/utils-config directly, plus its own two size-gate extractions —
+// ./ledger-stats and ./ledger-join (v4.8 T3.0/T3.3) — and neither deepens the
+// graph: ./ledger-join is require-free and ./ledger-stats requires only the
+// same three, plus a LAZY require('./tally') inside buildStatsDoc that never
+// runs at module load. run-assemble pulls findings → anonymize →
+// seats, atomic-write, and — since v4.8 PR4c moved writeVerdictFiles out —
+// run-verdict-files → verdict → report. The graph is one hop longer than the
+// comment PR4b wrote, not one hop shorter. The duplication is paid for
+// by a drift guard (tests/council/ledger.test.js T13a) that asserts pairwise
+// agreement with the exported original — including an UNKNOWN value, which is
+// where the two spellings can silently diverge.
+const CONFORMANCE_RANK = { clean: 0, repaired: 1, unstructured: 2 };
+/** Worst-wins merge; returns its FIRST argument on a rank tie (mirrors worseConformance). */
+function mergeConformance(a, b) {
+  return (CONFORMANCE_RANK[a] || 0) >= (CONFORMANCE_RANK[b] || 0) ? a : b;
+}
+
+// v4.8 T3.3/SI-18: the JOIN SEMANTICS — SI-17 normalise (benchLegs), the
+// seat-aware street-cred join (credFor), and the seat-aware findings split
+// (splitFindingsBySeat) — live in ./ledger-join, the same one-directional
+// split T3.0 used for ./ledger-stats. Read their docblocks there before
+// changing any call site below.
+const { benchLegs, credFor, splitFindingsBySeat } = require('./ledger-join');
+
+/**
+ * One row per distinct (model, resolvedModel) pair on the bench. Rates are over
+ * RAW raised findings.
+ *
+ * v4.8 PR4b (spec §4.7/§4.9): the runStats join is a FAN-OUT, not a last-wins
+ * Map. `alias → resolvedKey → row[]`, so a bench where one executable served
+ * more than one seat (a twin `--models a,a`, two aliases sharing a resolution,
+ * a chair that is also a bench seat) no longer erases the losing rows, emits
+ * byte-identical duplicates, or double-weights deriveReliability's averages.
+ *
+ * EMISSION ORDER: one block per DISTINCT alias, blocks ordered ascending by
+ * that alias's LAST index in meta.models (ties impossible — lastIndexOf is
+ * unique per alias); within a block, pair groups in first-observed runStats
+ * order. ⚠️ `lastIndexOf`, not `indexOf`: deriveReliability builds `aliases[]`
+ * most-recently-seen-first, and pickFallbackChair LAUNCHES `aliases[0]`, so
+ * first-occurrence anchoring (what a naive `new Map(model+'\0'+resolved)`
+ * gives for free) promotes the executable-id-shaped name over the short alias
+ * on `--models gpt-5,openai/gpt-5,gpt-5` — the form run-chair.js:48-52 argues
+ * against. On a bench where no alias repeats AND no alias has more than one
+ * joinable runStats row, lastIndexOf === indexOf and the row set and its order
+ * are unchanged from pre-PR4b.
+ *
+ * ⚠️ `meta.models` stays the row driver. Two of the three appendRun call sites
+ * feed hand-assembled input (cli-handlers-council.js, mcp-server.js) where
+ * runStats may be empty; a runStats-driven loop would emit zero rows there.
+ * The dedup of meta.models is UNCONDITIONAL — `['a','a']` with `runStats: []`
+ * is one row, not two.
+ */
 function buildLedgerRows(record) {
   const { meta, findings, streetCred, runStats, judged } = record;
-  const sc = new Map(streetCred.map(s => [s.model, s]));
-  // The join below is keyed by MODEL — only allowlisted roles (joinsLedger,
-  // above) may win it, so a non-primary row-per-launch row can never
-  // silently overwrite a model's real bench (seat) row.
-  const rs = new Map(runStats.filter(r => joinsLedger(r.role))
-    .map(r => [r.model, r]));
-  return meta.models.map(model => {
+  // The SEATED street-cred rows only, keyed by seat id. ⚠️ Not `s.seat ||
+  // s.model`: an alias key here cannot serve a row whose alias has ONLY seated
+  // street cred, which is the fix-round-1 regression — credFor's second lookup
+  // filters the array by alias instead. The hazard, the emit rule and both
+  // lookups are written out at ledger-join.js :: credFor. Named mutant
+  // tests/council/street-cred-mutants.js :: LEDGERALIAS.
+  const sc = new Map(streetCred.filter(s => s && s.seat).map(s => [s.seat, s]));
+  // Only allowlisted roles (joinsLedger, above) may join, so a non-primary
+  // row-per-launch row can never contribute a model's role/conformance.
+  const byAlias = new Map();
+  for (const r of runStats) {
+    if (!joinsLedger(r.role)) { continue; }
+    if (!byAlias.has(r.model)) { byAlias.set(r.model, new Map()); }
+    const pairs = byAlias.get(r.model);
+    const key = r.resolvedModel || '';
+    if (!pairs.has(key)) { pairs.set(key, []); }
+    pairs.get(key).push(r);
+  }
+  const aliases = [...new Set(meta.models)]
+    .sort((a, b) => meta.models.lastIndexOf(a) - meta.models.lastIndexOf(b));
+  const rows = [];
+  for (const model of aliases) {
     const raised = findings.filter(f => f.raiser === model);
-    const s = sc.get(model) || {};
-    const r = rs.get(model) || {};
-    const denom = raised.length;
-    return {
-      schemaVersion: LEDGER_SCHEMA_VERSION,
-      runId: meta.runId, date: meta.date, runType: meta.runType, model,
-      role: r.role || 'council', wasChair: !!r.wasChair, judged: judged === true,
-      streetCredWithSelf: judged ? (s.withSelf ?? null) : null,
-      streetCredPeersOnly: judged ? (s.peersOnly ?? null) : null,
-      findingsRaised: denom,
-      bySeverity: countSeverity(raised),
-      confirmRate: judged && denom ? raised.filter(f => f.tier === 'Confirmed').length / denom : null,
-      factErrorRate: judged && denom ? raised.filter(f => f.tier === 'Disputed').length / denom : null,
-      conformance: r.conformance || 'clean',
-      ...(r.resolvedModel ? { resolvedModel: r.resolvedModel } : {}),
-    };
-  });
+    const pairs = byAlias.get(model);
+    // An alias with NO joinable runStats row yields exactly ONE row with an
+    // empty group — the shape the founding ledger commit (c073995e) wrote as
+    // `rs.get(model) || {}`; `rs` itself is gone, replaced by `byAlias`/`pairs`
+    // during the R4b-2 pair-group split, but the empty-group fallback is not.
+    const groups = pairs ? [...pairs.entries()] : [['', []]];
+    // v4.8 SI-18: findings now split by SEAT across this block's pair groups —
+    // ledger-join.js :: splitFindingsBySeat. R4b-2's concentration ("within a
+    // block exactly ONE row — the FIRST pair group — carries the findings
+    // statistics") is now the FALLBACK for whatever that split cannot resolve
+    // to a specific group, not the rule for every finding: a finding whose
+    // raiserSeat names a seat one of THIS alias's own runStats rows carries is
+    // credited to that seat's group; everything else — every pre-seat
+    // document, every hand-assembled one, and the asymmetric quadrant
+    // tally.js documents (`meta.seats` declared while runStats carries no seat
+    // at all) — still concentrates on the block's FIRST pair group, exactly as
+    // before. This comment used to forecast that findings were alias-attributed
+    // "until PR4c"; that forecast EXPIRED UNFULFILLED, and the comment's own
+    // claim that this join "still has no seat to split on" went unfixed until
+    // SI-18 measured it false: tally.js:114-115 has emitted `raiserSeat` since
+    // v4.8 PR3 Task 5, and this join simply never read it. Splitting on the raw
+    // executable alone would still fabricate a per-executable confirmRate —
+    // this instead reads the seat id itself, the signal that actually names
+    // which occurrence raised a finding. The row SET does not move — PR4b's
+    // (alias, resolvedModel) pairing is unchanged, only which pair group a
+    // finding's numbers land on. Street cred deliberately does NOT concentrate
+    // (§0) and is untouched by this change (ledger-join.js :: credFor). Named
+    // mutant tests/council/street-cred-mutants.js :: FINDINGALIAS.
+    const mineByGroup = splitFindingsBySeat(groups.map(([, group]) => group), raised);
+    groups.forEach(([resolvedKey, group], i) => {
+      // The other rows' null rates still fall out of the `judged && denom`
+      // guards at denom 0, exactly as before.
+      const mine = mineByGroup[i];
+      const denom = mine.length;
+      // SI-17's normalise: a chair-synthesis row never decides a bench leg's
+      // role or conformance (ledger-join.js :: benchLegs). `group` is unchanged, so
+      // `wasChair` below still reads every row.
+      const legs = benchLegs(group);
+      const last = legs[legs.length - 1] || {};
+      const s = credFor(sc, group, model, streetCred);
+      rows.push({
+        schemaVersion: LEDGER_SCHEMA_VERSION,
+        runId: meta.runId, date: meta.date, runType: meta.runType, model,
+        // `role`: last row of the PAIR GROUP wins, chair rows excluded while a
+        // bench leg is present. No role ordering exists anywhere in src/, so
+        // with no principled merge this stays closest to today's last-wins.
+        // Lens twins are genuinely undecidable.
+        role: last.role || 'council',
+        // `wasChair`: any-wins over the WHOLE group. A boolean fact has no
+        // last-wins reading, and this is the one field a chair row contributes
+        // to a bench seat's row.
+        wasChair: group.some(r => !!r.wasChair),
+        judged: judged === true,
+        streetCredWithSelf: judged ? (s.withSelf ?? null) : null,
+        streetCredPeersOnly: judged ? (s.peersOnly ?? null) : null,
+        findingsRaised: denom,
+        bySeverity: countSeverity(mine),
+        confirmRate: judged && denom ? mine.filter(f => f.tier === 'Confirmed').length / denom : null,
+        factErrorRate: judged && denom ? mine.filter(f => f.tier === 'Disputed').length / denom : null,
+        // ⚠️ SEED THE FOLD FROM THE GROUP'S FIRST ROW, never from 'clean':
+        // mergeConformance returns its first argument on a rank tie and an
+        // unknown value ranks 0, so a 'clean' seed would rewrite an unknown
+        // conformance to 'clean' on a SINGLE-row group — i.e. on an ordinary
+        // unique-alias bench, where today emits it verbatim. T13b is the pin.
+        // The seed means group[0] is folded twice (once as seed, once as the
+        // first element); that is deliberate and a no-op, because
+        // mergeConformance(x, x) === x. Do NOT "simplify" it away.
+        // ⚠️ Consequence, inherited from worseConformance's own tie rule and
+        // NOT introduced here: an unknown value survives only in position 0.
+        // ['weird','clean'] folds to 'weird', ['clean','weird'] to 'clean',
+        // because unknown and 'clean' both rank 0 and the accumulator wins the
+        // tie. T13c pins it so nobody "fixes" it into a divergence.
+        // ⚠️ The fold runs over `legs`, not `group` — SI-17's normalise. On
+        // every group without a chair row the two arrays ARE the same array's
+        // contents, so T13b/T13c and the seed rule above are untouched.
+        conformance: legs.length
+          ? legs.reduce((acc, r) => mergeConformance(acc, r.conformance || 'clean'),
+            legs[0].conformance || 'clean')
+          : 'clean',
+        ...(resolvedKey ? { resolvedModel: resolvedKey } : {}),
+      });
+    });
+  }
+  return rows;
 }
 
 function appendRun(record, opts = {}) {
@@ -97,64 +236,14 @@ function appendRun(record, opts = {}) {
   return rows;
 }
 
-function readRows(dir) {
-  const file = path.join(dir, LEDGER_FILE);
-  if (!fs.existsSync(file)) { return []; }
-  return fs.readFileSync(file, 'utf-8').split('\n').map(l => l.trim()).filter(Boolean)
-    .map(l => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
-}
-
-function avg(nums) { return nums.length ? nums.reduce((s, x) => s + x, 0) / nums.length : null; }
-
-/**
- * Aggregate the ledger per model. peersOnly nulls excluded; lowN flags < 3 runs.
- * v4.7 GOA-7 D10: groups by `row.resolvedModel || row.model` — v2 rows segment
- * by the executable id that actually served; rows without a resolvedModel
- * (pre-v2 history, leg-less rows, hand-assembled tally input) stay alias-keyed
- * with `legacy: true`. `aliases` lists every row-level `model` (alias) observed
- * for the group, most recently observed FIRST — ledger append order is the only
- * recency signal (`date` is day-granular, free-form on the MCP path), so
- * aliases[0] is the launch-preferred name (pickFallbackChair, D11).
- * Version-blind by design: schemaVersion is never read (legacy-read, R2).
- */
-function deriveReliability(opts = {}) {
-  const dir = opts.dir || getConfigDir();
-  const byKey = new Map();
-  for (const row of readRows(dir)) {
-    const key = row.resolvedModel || row.model;
-    if (!byKey.has(key)) { byKey.set(key, []); }
-    byKey.get(key).push(row);
-  }
-  return [...byKey.entries()].map(([model, rows]) => {
-    const peers = rows.map(r => r.streetCredPeersOnly).filter(v => typeof v === 'number');
-    const confirms = rows.map(r => r.confirmRate).filter(v => typeof v === 'number');
-    const facts = rows.map(r => r.factErrorRate).filter(v => typeof v === 'number');
-    const conformance = rows.reduce((acc, r) => { acc[r.conformance] = (acc[r.conformance] || 0) + 1; return acc; }, {});
-    const lastSeen = new Map();
-    rows.forEach((r, i) => { lastSeen.set(r.model, i); });
-    const aliases = [...lastSeen.entries()].sort((a, b) => b[1] - a[1]).map(([m]) => m);
-    return {
-      model, runs: rows.length, lowN: rows.length < 3,
-      avgStreetCredPeersOnly: avg(peers),
-      lifetimeConfirmRate: avg(confirms),
-      lifetimeFactErrorRate: avg(facts),
-      conformance,
-      aliases,
-      ...(rows.every(r => !r.resolvedModel) ? { legacy: true } : {}),
-    };
-  });
-}
-
-/**
- * v4.0 §7: wrap the deriveReliability() rows in the council v2 envelope —
- * THE one sanctioned breaking shape change (`council stats --json` used to
- * emit the bare array). Human rendering keeps consuming the bare rows.
- * @param {Array<object>} models deriveReliability() output
- * @returns {{schemaVersion: number, type: 'council-stats', models: Array<object>}}
- */
-function buildStatsDoc(models) {
-  const { COUNCIL_SCHEMA_VERSION } = require('./tally');
-  return { schemaVersion: COUNCIL_SCHEMA_VERSION, type: 'council-stats', models };
-}
-
-module.exports = { buildLedgerRows, appendRun, deriveReliability, buildStatsDoc, LEDGER_FILE, LEDGER_SCHEMA_VERSION };
+// ⚠️ CLAUDE.md's AUTO:modules marker truncates at five exports — append new
+// ones at the END so the generated table stays stable.
+module.exports = {
+  buildLedgerRows, appendRun, deriveReliability, buildStatsDoc, LEDGER_FILE,
+  LEDGER_SCHEMA_VERSION,
+  // Both exported for the drift guard against run-assemble.js's sibling copy.
+  mergeConformance, CONFORMANCE_RANK,
+  // Re-exported from ./ledger-stats (v4.8 Phase 3 T3.0 split); no import path
+  // in the tree moved.
+  readRows, avg, countRuns,
+};

package/src/council/peer-split.js

@@ -0,0 +1,196 @@
+// src/council/peer-split.js
+'use strict';
+
+/**
+ * @module council/peer-split
+ * The peer-split predicate: which adjudications on a finding count as PEER
+ * signal, excluding the raiser's own vote — and, since v4.8 T-B4, excluding
+ * every vote that CANNOT BE TOLD APART from the raiser's own. Extracted
+ * verbatim from tally.js@115bc861:93-112 (v4.8 Phase 2 T-B1, zero behavior
+ * change); T-B4 is the first change to what it computes. BOTH consumers call
+ * it: tally.js since T-B1, debate.js since
+ * T-B2 — which is this module's whole reason to exist, because the tally the
+ * chair reads and the defense brief the raiser reads must be ONE computation,
+ * not two spellings of it. The exact tally.js comment split this extraction
+ * made is recorded in task-1-report.md
+ * (.superpowers/sdd/2026-08-19-v48-t23-peer-split/, gitignored). No mutation
+ * record lives there: every named mutant on this module is in the tree and
+ * tracked, in tests/council/peer-split-mutants.js :: SPLITDROP.
+ *
+ * ⚠️ REQUIRE-FREE by design, like ./seats and ./run-stats-entry: debate.js's
+ * own docblock declares it DI-free, so any module it requires must itself
+ * pull in nothing else. Do not add a `require` call here — a pin
+ * (tests/council/peer-split.test.js) strips this file's comments and scans the
+ * executable text that is left, so it fires on a real call and no longer on the
+ * same sequence written inside a comment. ⚠️ v4.8 T-B5 narrowed THIS pin only;
+ * run-stats-entry.js's twin still scans raw text, so the two are no longer
+ * symmetric — do not assume one from the other.
+ */
+
+/**
+ * Peer votes for one finding: every adjudication in `votes` except the ones
+ * that are, or might be, the raiser's own. One principle — attribute when you
+ * can, mark only when you cannot (ruling R2) — in three branches:
+ *   P0  the vote AND the finding both carry a seat id ⇒ the SEATS decide, for
+ *       ANY raiser. Equal ⇒ the raiser's own vote, excluded and NOT marked
+ *       (we know what it is). Different ⇒ a real peer, counted.
+ *   P3  else, a NAMED raiser ⇒ exclude by alias, exactly as before v4.8 T-B4.
+ *   P1/P2  else (falsy raiser) ⇒ keep every NAMED judge, because a named judge
+ *       is provably not the unnamed raiser; drop every falsy one, because it
+ *       may be the raiser's own, and count it in `unattributedPeerDrops`.
+ * @param {{raiser?: string, raiserSeat?: string}} f - the finding
+ * @param {Array<{judge?: string, seat?: string, verdict?: string}>} votes - its adjudications
+ * @returns {Array} the peer-filtered votes
+ */
+function peersOf(f, votes) {
+  // Only exclude the raiser's own vote BY NAME when a raiser is known; the
+  // raiser is populated by the orchestrator (not the reviewer JSON), so an
+  // unset raiser must not silently drop a real peer vote (L8).
+  //
+  // v4.8 PR4c §3.3 (#137): compare SEATS when both sides carry one, aliases
+  // otherwise. On a twin bench the alias compare drops a twin's real vote —
+  // measured on ['deepseek','deepseek','gpt'], one corroborating peer reported
+  // as `Singleton {a:0,d:0}`; on three deepseeks the whole cross-review was
+  // discarded. The guard is NOT the naive `v.seat !== f.raiserSeat`: both
+  // producers are `X && X.id !== alias` over independent bind operations
+  // (anonymize.js's raiserSeat over Stage 1, run-assemble.js's adjudication
+  // seat over Stage 2), each `|| null` by design, so exactly one side carrying
+  // a seat id is ENGINE-reachable in both directions whenever bindSeats
+  // orphans a twin leg — and there the naive form reads `undefined !== 'x#1'`
+  // and silently promotes a Singleton to Confirmed on the raiser's own vote.
+  // debate.js :: debateTargets CALLS this function as of v4.8 T-B2, so the
+  // defense brief's peer split can no longer disagree with the tally.
+  //
+  // v4.8 T-B4 (council C1 on PR #174, chair verdict "fix these first") changed
+  // the FALSY-raiser arm, which until then handed `votes` back whole. `''` and
+  // `undefined` are not identities (ruling R2), so a vote whose `judge` is also
+  // falsy may be the unnamed raiser's own — and it was being counted as peer
+  // signal. Measured on the council's fixture: `raiser:''` with votes
+  // `['' agree, 'gpt' agree]` gave `basis {a:2}` Confirmed SOLID where the
+  // named-raiser control gives `{a:1}` thin, with nothing emitted to say so.
+  // Reachable in production: mcp-tools.js:416 declares a bare `z.string()` for
+  // `raiser`, so '' validates, and that path reaches the append-only ledger.
+  // The defect is PRE-EXISTING — measured at base e7cf54b0, the tally read
+  // `{a:2}` there too — so T-B2 propagated it to the brief rather than causing
+  // it. R2 governs the fix: mark explicitly, attribute nothing.
+  //
+  // The falsy-raiser branch keeps every NAMED judge, which is what L8's
+  // rationale actually protects — a named judge is provably not the unnamed
+  // raiser, so no real peer is dropped for want of a raiser. What stops is the
+  // silent self-corroboration.
+  //
+  // ⚠️ WHY THE SEAT COMPARE RUNS FIRST, FOR ANY RAISER, AND NOT INSIDE THE
+  // NAMED-RAISER BRANCH. T-B4 round 1 put it inside, on the reading that a
+  // NAMED judge always counts beside a falsy raiser. Measured, that left 36
+  // cases where a vote carrying the raiser's OWN seat id was counted as its own
+  // peer signal — self-corroboration through a second door, the same defect the
+  // council raised one layer down. The clause that matters is "provably not the
+  // raiser", and a seat id is the strongest proof either way: it decides FIRST,
+  // and only when it cannot decide does the judge field get a say.
+  //
+  // Four spellings were enumerated over the 1875-case truthiness cross-product
+  // of (raiser, raiserSeat, judge, seat, verdict) — 5 values for each of the
+  // four IDENTITY fields (`undefined`, `null`, `''` and two distinct names or
+  // seat ids) times the 3 verdicts, so 5^4 x 3 = 1875, not 5^5 — and scored
+  // against P0-P3 above. Only this one reaches zero violations. `64b835b8`
+  // breaks P0 in 90 cases and P1 in 567; T-B4 round 1's form breaks P0's peer
+  // rule in 90 and its no-mark rule in 108; a "named judge AND not the raiser's
+  // own seat" variant breaks them in 54 and 108. The 36-case residual round 1
+  // disclosed is measured at ZERO here.
+  //
+  // ⚠️ FOUR named mutants guard this predicate — SPLITDROP, NAIVESPLIT,
+  // SELFCORROB and SEATBLIND. Each mutation, its MEASURED red set and the
+  // history of how that set moved are recorded byte-for-byte in
+  // tests/council/peer-split-mutants.js :: SPLITDROP, moved out of this file at
+  // v4.8 T-B5 because it stood at 289 of 300 lines. RE-RUN them, never renumber
+  // them, whenever this expression or its consumers change.
+  const peers = votes.filter(v => (v.seat && f.raiserSeat)
+    ? v.seat !== f.raiserSeat                       // P0 — the seats decide
+    : f.raiser ? v.judge !== f.raiser               // P3 — the alias compare
+      : !!v.judge);                                 // P1/P2 — named, or nothing
+  // The filter above has THREE branches and they are ORDERED: the seat compare
+  // decides first and does not consult `f.raiser` at all, so `peers` never
+  // holds a vote carrying the raiser's own seat id, whatever its `judge` says.
+  // It CAN hold a seat-carrying vote whose judge is falsy — that is P0
+  // admitting a provable peer — which is why tally.js's `sameModelCorroboration`
+  // guard still has to reckon with `v.judge === f.raiser` reading
+  // `undefined === undefined` on the CLI path (cli-handlers-council.js parses
+  // raw JSON with no schema) and `'' === ''` on the MCP path (whose z.string()
+  // accepts the empty string). Measured at that guard's own site, its leading
+  // `f.raiser &&` is a DECIDER again after round 2.
+  return peers;
+}
+
+/**
+ * How many of `votes` `peersOf` excluded WITHOUT being able to attribute them.
+ * Two families, one per FALLBACK arm of `peersOf` (never a seat-decided drop):
+ *   - raiser NAMED: the drop happened on the ALIAS branch while exactly ONE
+ *     side of the pair carried a seat id — the finding has a `raiserSeat` and
+ *     the vote has no `seat`, or the reverse. A seat-less `deepseek` vote
+ *     cannot be told apart from the raiser's own, so dropping it is the safe
+ *     call AND may be discarding a real twin's signal (SI-22.1 / SI-22.2).
+ *   - raiser FALSY (v4.8 T-B4): the vote's `judge` is falsy too, so it may be
+ *     the unnamed raiser's own. ⚠️ The test is `!v.judge`, NOT
+ *     `v.judge === f.raiser` — the pair is judged by TRUTHINESS, so a
+ *     `raiser:''` finding beside a `judge:undefined` vote is the same
+ *     unattributable pair as `''`/`''` and an `===` spelling would miss it.
+ * ⚠️ NEITHER family includes a drop the SEATS decided (P0). When the vote and
+ * the finding both carry a seat id the engine knows whose vote it is, so
+ * excluding it ATTRIBUTES it rather than losing it, and it is not counted here.
+ * That is what the leading `!(v.seat && f.raiserSeat)` says. Marking an
+ * attributed drop would make one number mean two different things.
+ * This number is what says so out loud instead of leaving the drop silently
+ * correct.
+ *
+ * Both documents call THIS function rather than each spelling the count, so
+ * tally.json's mark and the defense brief's mark agree by construction.
+ * @param {{raiser?: string, raiserSeat?: string}} f - the finding
+ * @param {Array<{judge?: string, seat?: string, verdict?: string}>} votes - its adjudications
+ * @returns {number} how many exclusions nobody can attribute (0 when none)
+ */
+function unattributedPeerDrops(f, votes) {
+  // ⚠️ `f.raiser` was a leading `&&` guard until v4.8 T-B4 and is now the
+  // TERNARY CONDITION, because the two FALLBACK arms of `peersOf` drop for two
+  // different reasons and this function must count both. The guard existed
+  // because a falsy raiser used to drop nothing at all, so any non-zero count
+  // would have announced a drop that never happened; T-B4 made those drops real,
+  // and the same fixtures that pinned 0 now pin 1.
+  //
+  // ⚠️ `!(v.seat && f.raiserSeat)` IS NOW A DECIDER AND IS NOW PINNED — retiring
+  // a claim this file carried from T-B2 through T-B4 round 1, which read
+  // "DOCUMENTATION, not a live test … dropping it flips ZERO … a test claiming
+  // to pin it would be green against its own mutant." That was true while it sat
+  // inside the named-raiser arm, where the XOR beside it already implied it
+  // (exactly one side truthy ⇒ their AND is falsy). Round 2 HOISTED it in front
+  // of the ternary to state what P0 requires — a seat-decided exclusion is
+  // attributed, so it is never marked — and in the falsy-raiser arm there is no
+  // XOR to imply it.
+  // RE-MEASURED at round 2 over the 1296-case truthiness cross-product of
+  // (f.raiser, f.raiserSeat, v.judge, v.seat), 6 values apiece, three falsy and
+  // three truthy: dropping the hoisted conjunct flips 81 cases — ALL 81 in the
+  // falsy-raiser arm and ZERO in the named one, so the retired sentence was
+  // right about where the conjunct WAS and wrong the moment it moved.
+  // Collapsing the ternary to its named arm flips 189 and to its falsy arm 297;
+  // dropping the XOR flips 27; dropping `v.judge === f.raiser` flips 270;
+  // weakening `!v.judge` to `true` flips 243. All five ARE pinned. The hoisted
+  // conjunct's own MEASURED red set, taken by dropping it and running the FULL
+  // suite, and RE-RUN at T-B5 fix rounds 2 AND 3: 2 suites / 5 tests, out of
+  // 541 / 7674 — peer-split 3 (P0b, P0c and the exhaustive cross-product
+  // invariant) and tally 2 (T7b, T7d). UNCHANGED through both, and measured
+  // rather than assumed each time: dropping this conjunct is a same-line-count
+  // edit, so round 1's volume pin never fired on it and round 3's removal of
+  // that pin changed nothing here. Only the denominator moved. An earlier
+  // draft of this line said "P0b and P0c", which UNDERSTATED it by three; the
+  // count is measured now rather than named from the tests written for it.
+  //
+  // ⚠️ Named mutant "ZEROEMIT" guards the EMIT rule both callers share — the key
+  // is present only when > 0. Its mutation, its MEASURED red set and the record
+  // of how that number went stale once already live with the other four, in
+  // tests/council/peer-split-mutants.js :: ZEROEMIT. Re-run it, never renumber
+  // it, whenever this expression or either producer changes.
+  return votes.filter(v => !(v.seat && f.raiserSeat) && (f.raiser
+    ? ((!!v.seat !== !!f.raiserSeat) && v.judge === f.raiser)
+    : !v.judge)).length;
+}
+
+module.exports = { peersOf, unattributedPeerDrops };

package/src/council/report-html.js

@@ -43,11 +43,18 @@ function renderHtml(m) {
     }).join('');
     return `<tr style="background:${TIER_VAR[f.tier] || '#fff'}">` +
       `<td>${esc(f.id)}</td><td>${esc(f.severity)}</td><td>${esc(f.raiser)}</td>${cells}` +
-      `<td style="color:${TIER_INK[f.tier] || 'inherit'};font-weight:600">${esc(f.tier)}</td>` +
+      // v4.8 PR5a T6 (R5-10): the R8 marker on the TIER cell, mirroring renderMd. A
+      // SEPARATE test pins each renderer — a shared one would let either regress silently.
+      `<td style="color:${TIER_INK[f.tier] || 'inherit'};font-weight:600">${esc(f.tier)}${f.sameModelCorroboration ? '<sup>†</sup>' : ''}</td>` +
       `<td>${esc(f.decision || '')}</td></tr>`;
   }).join('');
+  // v4.8 SI-22.4 rider (R22.4-6): the seat-keyed label, mirroring renderMd's
+  // street-cred loop. A SEPARATE test pins each renderer — a shared one would
+  // let either regress silently (the same rule the R8 marker above follows).
+  // `seat` is emit-when-DIFFERENT, so a unique-alias bench renders byte-
+  // identically to before. Named mutant: tests/council/preset-trim-mutants.js :: ROWSEATDROP.
   const credRows = m.streetCred.map(s =>
-    `<tr><td>${esc(s.model)}</td><td>${num(s.peersOnly)}</td><td>${num(s.withSelf)}</td></tr>`).join('');
+    `<tr><td>${esc(s.seat || s.model)}</td><td>${num(s.peersOnly)}</td><td>${num(s.withSelf)}</td></tr>`).join('');
   const tierRows = TIER_ORDER.map(t =>
     `<tr><td>${t}</td><td>${m.tierCounts[t]}</td></tr>`).join('');
   const costRows = m.cost.rows.map(r =>
@@ -64,7 +71,7 @@ function renderHtml(m) {
   // Heading-over-nothing, same guard idiom as debateSection below: absent or
   // empty degrades ⇒ no section at all, so a clean verdict's HTML stays
   // byte-identical to before this section existed. Losses are headline news,
-  // so the section sits directly after the Verdict-summary table (report.js's
+  // so the section sits directly after the Verdict-summary table (report-md.js's
   // renderMd mirrors this placement immediately after the tier loop).
   const lostSection = lostRows
     ? `<h2>What was lost</h2><table><tr><th>Channel</th><th>Notice</th></tr>${lostRows}</table>`
@@ -74,7 +81,7 @@ function renderHtml(m) {
   // renderHtml directly with no debate key) — the guard must tolerate that, and
   // absent/empty ⇒ no section at all so a no-debate report stays byte-identical
   // to v4.0's HTML output. no-response findings get their own list (same
-  // reasoning as report.js's renderMd) so the heading never dangles over
+  // reasoning as report-md.js's renderMd) so the heading never dangles over
   // nothing when a run's only debating raiser never responded.
   let debateSection = '';
   if (m.debate && m.debate.present) {
@@ -131,7 +138,7 @@ td.c { text-align: center; }
 <table><tr><th>Tier</th><th>Count</th></tr>${tierRows}</table>${lostSection}
 <h2>Adjudication matrix</h2>
 <table><tr><th>Finding</th><th>Sev</th><th>Raiser</th>${judgeHead}<th>Tier</th><th>Decision</th></tr>${matrixRows}</table>
-<p class="legend">✓ agree · ✗ dispute · – neutral · <sup>*</sup> raiser's own vote</p>
+<p class="legend">✓ agree · ✗ dispute · – neutral · <sup>*</sup> raiser's own vote</p>${m.findings.some(f => f.sameModelCorroboration) ? '\n<p class="legend"><sup>†</sup> corroborated only by another seat running the SAME model — concurrence, not independent support.</p>' : ''}
 <h2>Street-cred <span class="meta">(peers-only; lower = better)</span></h2>
 <table><tr><th>Model</th><th>peers-only</th><th>with-self</th></tr>${credRows}</table>${debateSection}
 <h2>Cost</h2>