amicus 4.7.0 → 4.8.0

package/src/council/run-assemble.js

@@ -7,22 +7,35 @@
  * the `--claude-review` pre-flight it now also owns: the five-keys tally input
  * (meta pins: claudeInCouncil false, models = bench seats exactly — critic
  * included, chair excluded — runType 'headless'), runStats rows copied
- * verbatim from leg docs, the run-dir artifact set (tally-input.json,
- * tally.json, verdict.json with overallVerdict, report.html, chair-output.md),
+ * verbatim from leg docs, the tally half of the run-dir artifact set
+ * (tally-input.json, tally.json — the verdict half moved to
+ * ./run-verdict-files and is re-exported below), the chair packet,
  * v4.1 §4.4 pre-flight validation of the file-sourced Claude review
  * (preflightClaudeReview — the reserved-seat/chair/critic guards), its review-N+1
  * labelling (labelClaudeReview), and its synthesized null-usage runStats row
  * (claudeRunStatsRow). Raiser self-votes are INCLUDED in adjudications —
- * exclusion is tally's job (tally.js:95); judged is tally's job (tally.js:110).
+ * exclusion is tally's job (tally.js :: tally — its `peers` filter, and `judged`).
  */
 
 const fs = require('fs');
 const path = require('path');
 const { writeFileAtomic } = require('../utils/atomic-write');
-const { buildVerdict, summarizeSeatLoss, deriveSeatLoss, writeVerdictAtomic } = require('./verdict');
-const { buildReport } = require('./report');
 const { validateFindings } = require('./findings');
 const { toGlobalFindings } = require('./anonymize');
+// Seat identity lives in ./seats (v4.8 PR1) — that module is require-free by
+// design, so preflightSeats' body lives there and is re-exported here to keep
+// the asm.preflightSeats(o) call spelling and this file under the size gate.
+const { preflightSeats } = require('./seats');
+// Same precedent (v4.8 PR4c): writeVerdictFiles' body lives in
+// ./run-verdict-files — with the ./verdict and ./report requires it was the
+// sole consumer of — and is re-exported here so the asm.writeVerdictFiles(...)
+// call spelling and every existing test survive the move untouched.
+const { writeVerdictFiles } = require('./run-verdict-files');
+// Same precedent (v4.8 Phase 1 T1.1): buildRunStatsEntry's body lives in
+// ./run-stats-entry — which is require-free so consumers outside this file's
+// graph can use it — and is re-exported here so every existing call spelling
+// survives the move untouched.
+const { buildRunStatsEntry } = require('./run-stats-entry');
 
 const CONFORMANCE_RANK = { clean: 0, repaired: 1, unstructured: 2 };
 
@@ -35,42 +48,6 @@ function worseConformance(a, b) {
   return (CONFORMANCE_RANK[a] || 0) >= (CONFORMANCE_RANK[b] || 0) ? a : b;
 }
 
-/**
- * One runStats row from a leg run document. Verbatim copies only — a missing
- * leg doc yields durationMs/usage null (never invent a value). `model` (the
- * council alias) overrides leg.model (the resolved executable id) so ledger
- * rows join meta.models by exact string (ledger.js:20-24).
- * `resolvedModel` (v4.7 GOA-7) preserves leg.model — the executable id that
- * actually served, post-fallback-substitution — emit-only-when-set and never
- * sourced from modelInput (an alias must never masquerade as a resolved id).
- *
- * ⚠️ LC-11 / review F1: `findingsUnverified` and `repairRefused` are the same
- * class of fact as `conformance` and ride the same row. They are the two halves
- * of the repair contract's outcome: `findingsUnverified` marks a 'repaired' seat
- * whose contract could NOT be checked (the original block was absent or
- * unparseable, so there was no finding count to compare), and `repairRefused`
- * ({code, detail}) marks the stronger case — the contract WAS checked and broken,
- * which is otherwise indistinguishable from a seat that never emitted JSON at
- * all. Both are additive and present only when set, so a run without either is
- * byte-for-byte unchanged.
- */
-function buildRunStatsEntry({ leg, model, role, wasChair, conformance, findingsUnverified,
-  repairRefused }) {
-  return {
-    model: model !== undefined ? model : (leg ? leg.model : null),
-    role,
-    wasChair: !!wasChair,
-    conformance: conformance || 'clean',
-    ...(findingsUnverified ? { findingsUnverified: true } : {}),
-    ...(repairRefused ? { repairRefused } : {}),
-    ...(leg && leg.waveId ? { waveId: leg.waveId } : {}),
-    ...(leg && leg.model ? { resolvedModel: leg.model } : {}),
-    status: leg ? leg.status : 'error',
-    durationMs: leg && typeof leg.durationMs === 'number' ? leg.durationMs : null,
-    usage: (leg && leg.usage) || null,
-  };
-}
-
 /**
  * Pre-flight for `--claude-review <path>` (v4.1 §4.4). Runs AFTER initRun (so the
  * error doc lands in a run dir that exists) and BEFORE any launch, so an invalid
@@ -135,8 +112,9 @@ function claudeRunStatsRow() {
  * Assemble the five-keys tally input (spec §5 / SKILL.md Stage-2 recipe).
  * @param {{runId: string, date: string, bench: string[], chair: string,
  *   reviews: Array<{model, role, conformance, leg, globalFindings}>,
- *   judgeResults: Array<{judge, ok, order, adjudications}>,
- *   chairStats: object|null, claudeReview?: object|null, extraRows?: Array<object>}} args
+ *   judgeResults: Array<{judge, seat, ok, order, orderSeats, adjudications, conformance, leg}>,
+ *   chairStats: object|null, claudeReview?: object|null, extraRows?: Array<object>,
+ *   seats?: Array<object>}} args
  *   `claudeReview` (v4.1 §4.4) amends the v4.0 meta pin: present ⇒ claudeInCouncil
  *   true, 'claude' joins meta.models (the street-cred universe), its findings join
  *   the pool and it gets the synthesized null-usage runStats row. Absent ⇒ v4.0
@@ -144,23 +122,74 @@ function claudeRunStatsRow() {
  *   (repair/superseded/dead-seat-error, from runStage1 today) appended right
  *   after the primary review rows, before judge/chair accounting — absent or
  *   empty ⇒ byte-for-byte unchanged, so the pre-v4.7 length-7 pins stay green.
+ *   `seats` (v4.8 PR4c §3.2) is run.json's seat table; see meta.seats below.
  */
 function buildTallyInput({ runId, date, bench, chair, reviews, judgeResults, chairStats,
-  claudeReview, extraRows }) {
+  claudeReview, extraRows, seats }) {
   const meta = {
     runId, date, runType: 'headless',
     models: bench.slice(),          // bench seats exactly: critic included, chair excluded
     chair,
     claudeInCouncil: false,         // pinned for headless runs
+    // v4.8 PR4c §3.2 (R4c-1 as amended by R4c-7): the seat table, a pure TAIL so
+    // the shipped six-key order above is byte-identical in every case. Emitted
+    // ONLY when the bench repeats an alias — the one case where the `alias#N`
+    // seat ids on findings[].raiserSeat, adjudications[].seat and runStats[].seat
+    // resolve to nothing else in the document (meta.models is the ALIAS list).
+    // ⚠️ `seats ?` alone would be VACUOUS: run.js:133 sets o.seats unconditionally
+    // past the preflight and buildSeats always returns an ARRAY ([] is still
+    // truthy), so that spelling writes a full table into tally-input.json,
+    // tally.json AND verdict.json on every unique-alias bench.
+    // ⚠️ NARROW BY RULING, not by oversight. The guard asks "does the bench
+    // repeat an alias?", which is a DIFFERENT question from "is anything in
+    // seats[] unrecoverable?" — they part on a UNIQUE-alias lens/critic bench.
+    // `position` and the raw lens text (runStats[].role has only the slug) ride
+    // in meta.seats EXACTLY when it ships, i.e. on a repeated-alias bench, and
+    // are absent BY DESIGN otherwise (measured 2026-08-16; BACKLOG SI-21, HOLD).
+    // ⚠️ Consumers: absence means "no seat table available", NEVER "the bench was
+    // unique" — two of appendRun's three call sites feed hand-assembled input no
+    // seat machinery touches. And seats[] is BENCH-ONLY, so it must never be
+    // joined positionally to meta.models (`claude` is pushed onto that inside
+    // run-assemble.js :: buildTallyInput) or to streetCred[].
+    // .slice() is defence-in-depth only: the array is shared with
+    // runState.checkpoint (run.js:135) and with both tally inputs. Nothing
+    // mutates meta.seats — unlike models, which meta.models.push mutates below —
+    // so no test can distinguish the copy from the reference.
+    ...(Array.isArray(seats) && seats.some(s => s.id !== s.alias) ? { seats: seats.slice() } : {}),
   };
   const findings = reviews.flatMap(r => r.globalFindings);
   const okJudges = judgeResults.filter(j => j.ok);
   const adjudications = okJudges.flatMap(j =>
-    j.adjudications.map(a => ({ findingId: a.id, judge: j.judge, verdict: a.verdict })));
-  const rankings = okJudges.map(j => ({ judge: j.judge, order: j.order }));
+    j.adjudications.map(a => ({ findingId: a.id, judge: j.judge, verdict: a.verdict,
+      // v4.8 PR3 Task 5, re-based by PR4c R4c-9: emit-when-DIFFERENT against
+      // the seat's OWN alias, matching buildRunStatsEntry and run.js's
+      // raiserSeat call site. It was `!== j.judge` — the alias as the LEG
+      // reported it — which emitted a seat id equal to its own alias whenever
+      // the two strings drifted (a padded --council member; a leg with no
+      // modelInput), i.e. exactly where the field carries no information.
+      ...(j.seat && j.seat.id !== j.seat.alias ? { seat: j.seat.id } : {}) })));
+  // v4.8 T3.2: the SAME predicate as the adjudication map immediately above —
+  // the judge's own seat, emit-when-DIFFERENT. `order` itself is untouched
+  // (still alias-valued).
+  // v4.8 T3.3 carries `orderSeats` the one further hop T3.2 deliberately
+  // stopped short of: it reached judgeResults[] in run-stage2.js, but
+  // `computeStreetCred` reads `rankings`, so without this the seat channel
+  // never arrives where SI-20's collapse happens.
+  // ⚠️ EMIT ONLY WHEN IT CARRIES AT LEAST ONE NON-NULL. rankingToOrder returns
+  // a PARITY SHAPE, not an absence: on a unique-alias bench `orderSeats` is
+  // `[null, null, null]`, and emitting that would add a key to rankings[] in
+  // tally-input.json, tally.json and tally-provisional.json on every run that
+  // has ever happened. `.flat()` is depth-1 because a tie group is the only
+  // nesting rankingToOrder can produce (anonymize.js :: rankingToOrder maps
+  // one level of `Array.isArray(slot)`). The named mutant that guards this
+  // predicate is tests/council/street-cred-mutants.js :: EMITSET.
+  const rankings = okJudges.map(j => ({ judge: j.judge, order: j.order,
+    ...(Array.isArray(j.orderSeats) && j.orderSeats.flat().some(Boolean)
+      ? { orderSeats: j.orderSeats } : {}),
+    ...(j.seat && j.seat.id !== j.seat.alias ? { seat: j.seat.id } : {}) }));
   const runStats = reviews.map(r => buildRunStatsEntry({
     leg: r.leg, model: r.model, role: r.role, wasChair: false, conformance: r.conformance,
-    findingsUnverified: r.findingsUnverified, repairRefused: r.repairRefused,
+    findingsUnverified: r.findingsUnverified, repairRefused: r.repairRefused, seat: r.seat,
   }));
   // v4.7 D2/E4: pre-built rows (repair/superseded/dead-seat-error) ride right
   // after the primary review rows — same "primary-adjacent" shape, just not
@@ -177,9 +206,15 @@ function buildTallyInput({ runId, date, bench, chair, reviews, judgeResults, cha
   // One row per judge, attributing the judge's ORIGINAL Stage-2 wave leg (never
   // a repair solo's — run-stage2.js mirrors Stage-1's convention there); a judge
   // whose wave leg died still gets an honest error row.
+  // v4.8 PR5a T4 (R5-8): the judge row carries its SEAT. PR4c withheld it because
+  // `joinsLedger` has no 'judge' member, so nothing consumed it; report.js's cost
+  // table does now, and without it a twin bench's two judge rows are identical.
+  // `buildRunStatsEntry` (run-stats-entry.js :: buildRunStatsEntry) applies the
+  // shared emit-when-DIFFERENT predicate, so a unique bench stays byte-identical
+  // and no new predicate enters the tree.
   for (const j of (judgeResults || [])) {
     runStats.push(buildRunStatsEntry({
-      leg: j.leg, model: j.judge, role: 'judge', conformance: j.conformance,
+      leg: j.leg, model: j.judge, role: 'judge', conformance: j.conformance, seat: j.seat,
     }));
   }
   if (chairStats) { runStats.push(chairStats); }
@@ -194,36 +229,6 @@ function writeTallyFiles({ runDir, tallyInput, record }) {
     JSON.stringify(record, null, 2), { mode: 0o600 });
 }
 
-/**
- * Undecided verdict + deterministic report. Sets the nullable overallVerdict
- * (council family v2, Plan A) on buildVerdict's output — independent of
- * buildVerdict's own signature.
- * @param {{runDir: string, record: object, overallVerdict?: (string|null),
- *   chairText?: string, critic?: string, deadWaves?: Array<object>,
- *   degrades?: Array<object>}} o `degrades` (v4.6 Plan 2), when present, is
- *   both carried onto the verdict and used to DERIVE `seatLoss` (deriveSeatLoss)
- *   in preference to summarizing it from `deadWaves` (summarizeSeatLoss).
- * @returns {object} the verdict written to disk
- */
-function writeVerdictFiles({ runDir, record, overallVerdict, chairText, critic, deadWaves, degrades }) {
-  // v4.6 Plan 2 (spec D3): when the sink's records are available they are the
-  // single source of truth — seatLoss derives from them so it can never
-  // disagree with degrades[]. deadWaves remains the fallback for direct
-  // callers that predate the sink (their tests pass unedited).
-  const seatLoss = degrades
-    ? deriveSeatLoss({ runId: record.meta.runId, critic, degrades })
-    : summarizeSeatLoss({ runId: record.meta.runId, critic, deadWaves });
-  const verdict = buildVerdict(record, [], { seatLoss, degrades });
-  verdict.overallVerdict = (overallVerdict === undefined) ? null : overallVerdict;
-  writeVerdictAtomic(path.join(runDir, 'verdict.json'), verdict);
-  const html = buildReport({ verdict }, { format: 'html' });
-  fs.writeFileSync(path.join(runDir, 'report.html'), html, { mode: 0o600 });
-  if (chairText) {
-    fs.writeFileSync(path.join(runDir, 'chair-output.md'), chairText, { mode: 0o600 });
-  }
-  return verdict;
-}
-
 /**
  * Build the chair packet and persist it as `chair-packet.md`. Lifted verbatim
  * out of run.js for the 300-line gate (v4.4.1 Task 0.5) — same composition,
@@ -240,10 +245,21 @@ function buildChairPacketFile({ runDir, reviews, claudeReview, tallyInput, recor
   const packet = buildChairPacket({
     // §4.4: the chair sees Claude's de-anonymized review like any other; it casts
     // no rankings/adjudications, so it appears ONLY as one more review block.
-    reviews: reviews.map(r => ({ model: r.model, text: r.text }))
+    // The projection is DELIBERATE — it drops findings/conformance/role/leg; v4.8
+    // SI-25 adds `seat`, ⚠️ EMIT-WHEN-DIFFERENT like rankings/adjudications above:
+    // `r.model` is the leg's `modelInput || model`, which falls back to the RESOLVED
+    // id, so an unconditional forward breaks §4.2 byte identity on a NO-TWIN bench.
+    // Mutant: tests/council/chair-packet-seat-mutants.js :: HDRSEATFWD.
+    // ⚠️ The Claude review keeps NO seat and renders `claude` via the fallback.
+    reviews: reviews.map(r => ({ model: r.model, text: r.text,
+      ...(r.seat && r.seat.id !== r.seat.alias ? { seat: r.seat } : {}) }))
       .concat(claudeReview ? [{ model: 'claude', text: claudeReview.text }] : []),
     rankings: tallyInput.rankings,
     adjudications: tallyInput.adjudications,
+    // v4.8 PR5a T7: `record` is the TALLIED record, so its findings already carry
+    // tally.js's R8 stamp. Passing the array the packet already has access to costs one
+    // line here and keeps every rendering decision in briefings-chair.js.
+    findings: record.findings,
     tierCounts: record.tierCounts, date,
   }) + (debateOutcomes ? '\n\n' + buildDebateAddendum({ outcomes: debateOutcomes }) : '');
   fs.writeFileSync(path.join(runDir, 'chair-packet.md'), packet, { mode: 0o600 });
@@ -254,4 +270,9 @@ module.exports = {
   buildRunStatsEntry, worseConformance, buildTallyInput, writeTallyFiles, writeVerdictFiles,
   buildChairPacketFile,
   preflightClaudeReview, labelClaudeReview, claudeRunStatsRow, CLAUDE_SEAT,
+  preflightSeats,
+  // Exported for ledger.js's drift guard only (v4.8 PR4b council A1): ledger.js
+  // keeps a LOCAL copy of this table, and the guard deep-compares the two so a
+  // level added here can never silently go missing there.
+  CONFORMANCE_RANK,
 };

package/src/council/run-chair.js

@@ -53,9 +53,25 @@ function pickFallbackChair(statsRows, bench, failedChair) {
   // aggregate shapes only.
   const names = (r) => [r.model, ...(Array.isArray(r.aliases) ? r.aliases : [])];
   const excluded = (r) => names(r).some(n => n === 'claude' || benchSet.has(n) || n === failedChair);
+  // v4.8 PR4a: every sort term is read off the row, so CANDIDATE SELECTION is
+  // independent of the order `statsRows` arrives in — previously that order
+  // (deriveReliability's Map insertion order = council-ledger.jsonl row order)
+  // silently decided every exact street-cred tie, and such ties are an ordinary
+  // arithmetic outcome. Terms: street cred (lower mean rank = better), then
+  // council appearances, then model id for a guaranteed total order. ⚠️ `runs`
+  // is the count of DISTINCT runIds across the group's ledger rows (v4.8 PR4b
+  // R4b-1, ledger-stats.js's countRuns) — one council run contributes 1 however many
+  // seats that executable filled, and rows from `judged:false` runs that
+  // contributed no street cred still count. It is a tie-break, never a ranking
+  // signal. Always present on deriveReliability output; the default serves
+  // fixtures.
+  // Full rationale + the tie arithmetic: tests/council/run-chair.test.js.
+  const runsOf = (r) => (typeof r.runs === 'number' ? r.runs : 0);
   const candidates = (statsRows || [])
     .filter(r => !excluded(r) && typeof r.avgStreetCredPeersOnly === 'number')
-    .sort((a, b) => a.avgStreetCredPeersOnly - b.avgStreetCredPeersOnly);
+    .sort((a, b) => (a.avgStreetCredPeersOnly - b.avgStreetCredPeersOnly)
+      || (runsOf(b) - runsOf(a))
+      || (a.model < b.model ? -1 : a.model > b.model ? 1 : 0));
   if (!candidates.length) { return null; }
   const top = candidates[0];
   return (Array.isArray(top.aliases) && top.aliases.length) ? top.aliases[0] : top.model;

package/src/council/run-debate-revote.js

@@ -0,0 +1,268 @@
+// src/council/run-debate-revote.js
+'use strict';
+
+/**
+ * @module council/run-debate-revote
+ * v4.8 PR3 Task 1: `legOpts`, `legRow`, and `runRevoteWave` extracted verbatim
+ * out of run-debate.js (283/300 — the 300-line-per-file gate) with NO
+ * behaviour change. run-debate.js requires all three back; runDebate still
+ * calls runRevoteWave for the re-vote mini-wave (spec §5.1).
+ *
+ * That "verbatim" claim held for all three only through Task 1. `legOpts` and
+ * `legRow` are still byte-identical to the extraction. `runRevoteWave` is NOT:
+ * PR3 Task 6 gave it real seat-binding behaviour — the padded roster + bind
+ * (`stage1-bind.js :: bindPaddedWave` since v4.8 SI-27; an inline `bindSeats`
+ * call before it), the seat-keyed `byJudge`, the `sanitizeName`'d per-seat
+ * repair id, and the `seat` field on the pushed legs (see the function's own
+ * docblock below). Do not treat `runRevoteWave` as a behaviour-neutral mirror
+ * of the old run-debate.js code — only `legOpts`/`legRow` still are.
+ *
+ * `isAbortExit` comes from ./run-launch, NEVER from ./run-stages: run-stage2.js:12
+ * records that taking it from run-launch.js "is what dissolved the old cycle
+ * (v4.4.1 review F5)". Requiring ./run-stages from this new leaf would drag in
+ * run-retry → run-retry-notes → briefings and re-open that cycle class.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const dbrief = require('./briefings-debate');
+const { parseRevote } = require('./parse-stage2');
+const runState = require('./run-state');
+const { emitStageStarted } = require('../observe/events');
+const { isAbortExit } = require('./run-launch');
+// v4.8 PR3 Task 6: seat binding. ./seats requires NOTHING, so taking
+// sanitizeName straight from it (rather than run-launch's re-export) adds
+// zero cycle risk to this leaf — the same call run-stage2.js:30 makes.
+const { sanitizeName } = require('./seats');
+// v4.8 SI-27: the shared roster-padding core. ./stage1-bind requires only
+// ./seats, so this leaf stays cycle-free (see the module docblock's cycle-class
+// paragraph above — named, not line-numbered, so it cannot rot).
+const { bindPaddedWave } = require('./stage1-bind');
+
+/** Common launch options for every debate leg (judge-isolated `_scratch` cwd). */
+function legOpts(ctx, waveId) {
+  return { project: ctx.scratchDir, waveId, timeout: ctx.o.timeout, gateway: ctx.o.gateway,
+    noValidateModel: ctx.o.noValidateModel, noCostGate: ctx.o.noCostGate,
+    // v4.3 Task 3 (spec §7.2): attribution ids for every defense/re-vote leg.
+    councilRunId: ctx.o.runId, councilName: ctx.o.councilName,
+    tag: ctx.o.tag }; // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
+}
+
+/**
+ * v4.7 D2/E4: normalize a raw (possibly leg-absent) leg into the shape
+ * debateRunStatsRows' superseded/repair lists expect. Same never-invent-a-waveId
+ * discipline as buildRunStatsEntry (run-assemble.js) — only spread `waveId` when
+ * the leg genuinely carries one — but keyed on an explicit `model` (the raiser or
+ * judge identity), since a leg-absent attempt has no `.model` of its own to read.
+ * Threads resolvedModel (the raw leg's .model, the executable id) emit-only-when-set — v4.7 GOA-7 D8.
+ */
+function legRow(model, leg, conformance) {
+  return leg
+    ? { model, status: leg.status, durationMs: typeof leg.durationMs === 'number' ? leg.durationMs : null,
+        usage: leg.usage || null, conformance, summary: leg.summary || '',
+        ...(leg.waveId ? { waveId: leg.waveId } : {}),
+        ...(leg.model ? { resolvedModel: leg.model } : {}) }
+    : { model, status: 'error', durationMs: null, usage: null, conformance, summary: '' };
+}
+
+/** The wave's join key for one leg: the bound seat's id, else the bare alias. */
+function seatKey(seat, alias) { return seat ? seat.id : alias; }
+
+/**
+ * T5.1 (owner ruling R8), narrowed by T5.5: announce a re-vote leg whose key
+ * this wave cannot account for — its key names none of the judges this wave
+ * actually launched. ⚠️ This read "it NEITHER bound to any roster slot (a real
+ * seat or a §3.4 placeholder) NOR names one of the judges…" until T5.5 deleted
+ * the `boundLegs` arm of the guard below. Binding is no longer part of the
+ * condition, and must not be re-added: seats.js :: bindSeats binds on
+ * `leg.legId || leg.taskId` with NO alias check, so a leg bound that way can
+ * still carry a name this wave never asked for — which is exactly the shape
+ * that kept inventing a phantom adjudication row. The
+ * leg itself is unaffected — it still gets its runStats row, its
+ * revote-<name>.md and its conformance — only its parsed votes are
+ * withheld, so `revoteByJudge` never carries this key at all and
+ * applyDebate never has to decide whether it belongs to an existing row or
+ * is new (that fail-open push in debate.js :: applyDebate is untouched for a
+ * key this wave DOES account for).
+ *
+ * Field shape follows stage1-bind.js:53 :: orphanLegNote's
+ * channel/what/why/effect/data — with ONE deliberate divergence: `data`
+ * carries no `seat` field. orphanLegNote's `data.seat` (confusingly named —
+ * it holds the ALIAS, not a seat object) is exactly what
+ * seat-space.js :: orphanExonerations reads to attribute a note to an
+ * alias. This note's `waveId` is always `<runId>-rv`, never `<runId>-s2`, so
+ * if it carried that field too it would enter that function's alias map and
+ * CLEAR — not extend — that alias's already-proven Stage-2 exonerations,
+ * via the non-`-s2` branch of the intersection there: a re-vote-stage
+ * anomaly wrongly invalidating a Stage-2 review-authorship proof. Do not add
+ * `seat` here to "complete" the parity with orphanLegNote; it is withheld
+ * on purpose.
+ */
+function reVoteUnboundNote(waveId, judge, key, leg) {
+  const legId = (leg && (leg.legId || leg.taskId)) || 'unidentified';
+  // `|| 'unknown'` mirrors stage1-bind.js:55's alias fallback, and for the same reason: the
+  // caller derives `judge` as `leg.modelInput || leg.model`, so a leg carrying NEITHER makes the
+  // record read "… 'undefined'" — a bug in the announcer rather than a fact about the leg.
+  // ⚠️ BOTH need it. `key` is `seatKey(seat, judge)`, which RETURNS that same `judge` whenever the
+  // leg bound to no real seat — i.e. in every refusal reachable through runDebate — so an undefined
+  // `judge` takes `key` with it. T5.5 interpolated `key` raw for one commit and measurably rendered
+  // "its join key 'undefined'" AND dropped `data.key` from the JSON. Pinned by
+  // run-debate.test.js's "NEITHER modelInput NOR model" test; named mutant KEYRAW.
+  const alias = judge || 'unknown';
+  const joinKey = key || 'unknown';
+  return {
+    channel: 'seat-unbound',
+    // ⚠️ All three strings below now say the ONE thing the guard tests: the key names no judge
+    // this wave launched. Binding is irrelevant — this function's docblock says why.
+    // ⚠️ `what` said "matches no seat on that wave's roster" for three rounds AFTER that stopped
+    // being the condition: a leg taskId-bound to a §3.4 placeholder DOES match a roster slot and is
+    // exactly the leg now refused, so `what` contradicted the `why` three lines under it. A paid
+    // council caught it (round 2). ⚠️ stage1-bind.js :: orphanLegNote KEEPS that wording and MUST:
+    // a Stage-1 orphan really does match no roster slot. Same sentence, true there, false here.
+    // ⚠️ `effect` said "the JUDGE's provisional verdict stands" until round 2 — the very
+    // presumption a refusal denies, since a refused key names no judge of this wave.
+    // ⚠️ `why` carried "(judge alias '${alias}')" for one commit; dropped, measured — `key ===
+    // judge` in every refusal runDebate can produce, so it printed the same string twice
+    // (BACKLOG.md holds the measurement). `data` keeps orphanLegNote's field names, `judge`
+    // included: it is the leg's own CLAIM, and renaming a machine-readable field is a compat break.
+    what: `re-vote leg ${legId} in wave ${waveId} could not be attributed to a judge on that wave`,
+    why: `its join key '${joinKey}' names none of the judges this wave launched`,
+    effect: 'the re-vote was NOT applied; the provisional verdict stands',
+    data: { waveId, legId, judge: alias, key: joinKey },
+  };
+}
+
+/**
+ * The re-vote mini-wave (spec §5.1).
+ *
+ * v4.8 PR3 Task 6 — the parallel-array discipline this function now runs on:
+ * `judgeKeys` are SEAT ids (disputingJudges' output) and `judgeSeats` the
+ * matching seat objects, both in launch order; `aliasOf` projects a key back to
+ * the routable bench alias. On every iteration of the leg loop the seat key and
+ * the alias are **two different values**: the key is what `byJudge` is keyed on
+ * (so `applyDebate` can join it against `(a.seat || a.judge)`), while the alias
+ * is what every launcher argument and every runStats `model` carries. That is
+ * not an inconsistency — a seat id is not a routable model name.
+ *
+ * @param {object} ctx run.js's {o, launchers, addWave, overBudget, degrade, scratchDir}
+ * @param {Array<string>} judgeKeys seat ids, in launch order
+ * @param {Array<object>} bundleFindings defended/amended findings
+ * @param {Array<?object>} judgeSeats seat objects positionally bound to judgeKeys
+ * @param {function(string): string} aliasOf seat id → bench alias
+ */
+async function runRevoteWave(ctx, judgeKeys, bundleFindings, judgeSeats, aliasOf) {
+  const bundle = dbrief.buildRevoteBundle({ findings: bundleFindings, date: ctx.o.date });
+  // spec §5.1 names `revote-bundle.md` a run-dir artifact: the shared re-vote prompt goes to
+  // disk exactly like Stage 2's bundle-stage2.md, so the round's model-facing input is
+  // auditable alongside briefing-stage1.md and chair-packet.md.
+  fs.writeFileSync(path.join(ctx.o.runDir, 'revote-bundle.md'), bundle, { mode: 0o600 });
+  const waveId = `${ctx.o.runId}-rv`;
+  const expectedIds = bundleFindings.map(f => f.id);
+  // run-debate — not run.js — owns this stage's `running` checkpoint AND its abort-cascade
+  // id: only this function knows whether the wave actually launched (it is skipped when
+  // nothing was defended/amended, or the cost ceiling hit).
+  runState.updateStage(ctx.o.runDir, 'debate-revote',
+    { status: 'running', startedAt: new Date().toISOString(), project: ctx.scratchDir, waveId });
+  emitStageStarted(ctx.o.runDir, ctx.o.runId, 'debate-revote', waveId, ctx.o.follow);
+  runState.appendStageWave(ctx.o.runDir, 'debate-revote', waveId);
+  // ⚠️ The launcher takes ALIASES. A seat id here is a non-routable model name
+  // on a real paid wave, not a test failure.
+  const res = await ctx.launchers.launchWave({
+    ...legOpts(ctx, waveId), models: judgeKeys.map(aliasOf), prompt: bundle });
+  ctx.addWave(res.wave);
+  if (isAbortExit(res.exitCode)) { return { aborted: res.exitCode }; }
+  const byJudge = {}, legs = [];
+  // v4.7 D2/E4: mirrors runDefenseSolo's supersededLeg/repairLeg — one list each,
+  // accumulated across every judge in this wave (most judges contribute neither).
+  const supersededLegs = [], repairLegs = [];
+  const rawLegs = (res.wave && res.wave.legs) || [];
+  // §3.4's roster-padding pattern now lives in `stage1-bind.js ::
+  // bindPaddedWave` (v4.8 SI-27) — why the roster is padded rather than
+  // filtered, and why placeholders are tracked by IDENTITY rather than an
+  // id-name prefix test, are in that function's docblock. This site has NO
+  // tail: no orphan push, no degrade note, so it destructures `seatOf` alone.
+  const { seatOf } = bindPaddedWave(waveId, judgeSeats || [], i => aliasOf(judgeKeys[i]), rawLegs);
+  for (const leg of rawLegs) {
+    // The council ALIAS, not the resolved executable id — runStats rows join
+    // meta.models by exact string (run-assemble.js's buildRunStatsEntry).
+    const judge = leg.modelInput || leg.model;
+    const seat = seatOf.get(leg) || null;
+    const key = seatKey(seat, judge);
+    const alive = leg.status === 'complete' && leg.summary;
+    let outLeg = leg;               // the leg actually recorded (post-repair when there is one)
+    let parsed = alive ? parseRevote(leg.summary, expectedIds)
+      : { ok: false, byId: {}, errors: [{ code: 'DEAD_LEG', detail: 'no summary' }] };
+    let conformance = alive ? 'clean' : 'unstructured';
+    if (alive && !parsed.ok) {
+      // One repair, solo, to that judge. The id is built from the SEAT key so
+      // two twins never share one repair id (and one never overwrites the
+      // other's run-state entry). ⚠️ The trailing `r` is load-bearing: it is what
+      // stops bindSeats' `/^(.*)-(\d+)$/` matching a repair id whose judge alias
+      // is a bare number (`r1-rv-2r` does not match; `r1-rv-2` would). Dropping
+      // it re-arms a collision. sanitizeName also fixes the pre-existing slash
+      // bug (D4) — `r1-rv-openrouter/deepseek/deepseek-chatr` stops nesting
+      // three directory levels — and is a no-op for every plain alias.
+      const repairId = `${waveId}-${sanitizeName(key)}r`;
+      runState.appendStageWave(ctx.o.runDir, 'debate-revote', repairId);
+      const r2 = await ctx.launchers.launchSolo({ ...legOpts(ctx, repairId), model: judge,
+        // ⚠️ LC-12: ditto — the re-vote output being repaired rides with its errors.
+        prompt: dbrief.buildRevoteRepairPrompt({ errors: parsed.errors, revote: leg.summary }) });
+      ctx.addWave(r2.wave);
+      if (isAbortExit(r2.exitCode)) { return { aborted: r2.exitCode }; }
+      const leg2 = r2.leg && r2.leg.status === 'complete' ? r2.leg : null;
+      parsed = leg2 ? parseRevote(leg2.summary, expectedIds) : parsed;
+      conformance = parsed.ok ? 'repaired' : 'unstructured';
+      // Symmetric with runDefenseSolo's `if (leg2) { leg = leg2; }` — otherwise
+      // revote-<model>.md and the runStats row keep the PRE-repair output.
+      if (leg2) { supersededLegs.push(legRow(judge, leg, 'unstructured')); outLeg = leg2; }
+      else { repairLegs.push(legRow(judge, r2.leg, 'unstructured')); }
+    }
+    // ⚠️ Two DIFFERENT values on the same iteration: `byJudge`'s key is the SEAT
+    // (applyDebate joins it against `(a.seat || a.judge)`), while the leg's
+    // `model` is the ALIAS — this literal becomes a debateRunStatsRows row, and
+    // R3-1 promises every runStats `model` is alias-valued on every bench.
+    // `seat` rides along for materializeDebate's filename only; debateRunStatsRows'
+    // `mk` copies an explicit field list and never picks it up.
+    //
+    // T5.1 (owner ruling R8), narrowed by T5.5: publish IFF the key names one of
+    // the judges THIS WAVE actually launched. `judgeSeats` is positionally bound
+    // to `judgeKeys` (this function's own docblock) and run-debate.js builds it
+    // from an id-keyed table — `judgeKeys.map(k => seatById.get(k) || null)` — so
+    // every REAL seat id that can reach `key` here is already a `judgeKeys`
+    // entry. Two further shapes are deliberately admitted: a
+    // unique-alias bench, where `seatKey(null, 'qwen') === 'qwen'` IS that seat's
+    // own judgeKey; and a §3.4 roster hole (a Stage-2-orphaned judge, padded with
+    // a placeholder here) whose -rv leg is ALSO unbindable — its bare-alias key is
+    // still in `judgeKeys`, and the provisional row for that same orphaned judge
+    // is ALSO keyed on the bare alias, so refusing it would discard a re-vote the
+    // join already lands correctly (measured: 2 adjudications in, 2 out, the
+    // seat-less row's verdict replaced, no phantom row). NOT `seat === null`
+    // (§0.5) — a real-seat bind is unaffected either way, but that predicate
+    // wrongly refuses both shapes just described. Only a leg whose key names no
+    // judge this wave launched is the unnameable case R8 asks to refuse.
+    //
+    // ⚠️ T5.5 DELETED a second arm, `boundLegs.has(leg) ||`. Binding is not
+    // enough: seats.js :: bindSeats matches `leg.legId || leg.taskId` to a roster
+    // SLOT with NO alias check, so a leg stamped into a §3.4 placeholder's slot
+    // while carrying a foreign alias BOUND (arm 1 true) and still keyed on that
+    // foreign alias (arm 2 false) — the key was published, no note was emitted,
+    // and applyDebate's fail-open push invented a phantom adjudication row while
+    // the hole's own seat-less row kept its stale dispute. That is the SI-10 shape
+    // this guard exists to close, surviving through that arm. Measured across the
+    // deletion in run-debate.test.js's T5.5 block: 3 A1 rows out of 2 in and zero
+    // notes before, 2 out and one `seat-unbound` note after. Do not re-add the arm
+    // as "defensive redundancy" — named mutant BOUNDREADD in that block is exactly
+    // that re-addition, and it reds.
+    if (judgeKeys.includes(key)) {
+      byJudge[key] = parsed.byId;
+    } else {
+      ctx.degrade.note(reVoteUnboundNote(waveId, judge, key, leg));
+    }
+    legs.push({ model: judge, status: outLeg.status, durationMs: outLeg.durationMs, usage: outLeg.usage,
+      conformance, summary: outLeg.summary || '', waveId: outLeg.waveId, seat,
+      ...(outLeg.model ? { resolvedModel: outLeg.model } : {}) });
+  }
+  return { byJudge, legs, supersededLegs, repairLegs };
+}
+
+module.exports = { legOpts, legRow, runRevoteWave };