amicus 4.7.0 → 4.8.0

package/src/council/run-debate.js

@@ -12,42 +12,41 @@
 const fs = require('fs');
 const path = require('path');
 const dbrief = require('./briefings-debate');
-const { parseDebateDefense, parseRevote } = require('./parse-stage2');
+const { parseDebateDefense } = require('./parse-stage2');
 const { applyDebate, debateRunStatsRows, PAST_TENSE,
   allNoResponse, nothingToDebate, disputingJudges, debateTargets, bundleFor } = require('./debate');
 const { materializeDebate } = require('./run-launch');
+const { buildSeats } = require('./seats');
 const { tally } = require('./tally');
 const { isAbortExit } = require('./run-stages');
 const runState = require('./run-state');
-const { emitStageStarted } = require('../observe/events');
-
-/** Common launch options for every debate leg (judge-isolated `_scratch` cwd). */
-function legOpts(ctx, waveId) {
-  return { project: ctx.scratchDir, waveId, timeout: ctx.o.timeout, gateway: ctx.o.gateway,
-    noValidateModel: ctx.o.noValidateModel, noCostGate: ctx.o.noCostGate,
-    // v4.3 Task 3 (spec §7.2): attribution ids for every defense/re-vote leg.
-    councilRunId: ctx.o.runId, councilName: ctx.o.councilName,
-    tag: ctx.o.tag }; // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
-}
+const { legOpts, legRow, runRevoteWave } = require('./run-debate-revote');
 
 /**
- * v4.7 D2/E4: normalize a raw (possibly leg-absent) leg into the shape
- * debateRunStatsRows' superseded/repair lists expect. Same never-invent-a-waveId
- * discipline as buildRunStatsEntry (run-assemble.js) — only spread `waveId` when
- * the leg genuinely carries one — but keyed on an explicit `model` (the raiser or
- * judge identity), since a leg-absent attempt has no `.model` of its own to read.
- * Threads resolvedModel (the raw leg's .model, the executable id) emit-only-when-set — v4.7 GOA-7 D8.
+ * One raiser's defense solo.
+ *
+ * v4.8 PR3 Task 6 — the raiser boundary. `raiserKey` is a SEAT key (debateTargets
+ * keys byRaiser on `f.raiserSeat || f.raiser`), so it is projected ONCE, here, to
+ * the routable bench alias. ⚠️ `aliasOf` is a `const` local to `runDebate`; this
+ * is a module-scope function, so under 'use strict' a bare `aliasOf(...)` would
+ * be a ReferenceError on the first defense solo of every debate run — it is
+ * threaded explicitly instead.
+ *
+ * `raiserKey` survives in exactly two places here: the returned `{raiser}` (which
+ * becomes defenseByRaiser's key — §3.3: that MUST stay seat-keyed, because
+ * re-keying it to the alias is last-wins and silently drops one twin's entire
+ * debate row plus its amended claim) and the `seat` runDebate derives from it.
+ * Everything else — both launch sites, both legRow calls, the stub and the
+ * returned leg's `model` — is `raiserAlias`.
+ *
+ * @param {object} ctx
+ * @param {string} raiserKey seat key of the raiser
+ * @param {Array<object>} findings that raiser's contested/disputed findings
+ * @param {number} idx defense-wave position (names the waveId)
+ * @param {function(string): string} aliasOf seat key → bench alias
  */
-function legRow(model, leg, conformance) {
-  return leg
-    ? { model, status: leg.status, durationMs: typeof leg.durationMs === 'number' ? leg.durationMs : null,
-        usage: leg.usage || null, conformance, summary: leg.summary || '',
-        ...(leg.waveId ? { waveId: leg.waveId } : {}),
-        ...(leg.model ? { resolvedModel: leg.model } : {}) }
-    : { model, status: 'error', durationMs: null, usage: null, conformance, summary: '' };
-}
-
-async function runDefenseSolo(ctx, raiser, findings, idx) {
+async function runDefenseSolo(ctx, raiserKey, findings, idx, aliasOf) {
+  const raiserAlias = aliasOf(raiserKey);
   const brief = dbrief.buildDefenseBrief({ findings, date: ctx.o.date });
   const waveId = `${ctx.o.runId}-d${idx + 1}`;
   const expectedIds = findings.map(f => f.id);
@@ -56,9 +55,9 @@ async function runDefenseSolo(ctx, raiser, findings, idx) {
   // launch leaves an in-flight leg reachable only by the pid kill. The v4.0.1
   // abort-cascade fix must hold for debate stages too.
   runState.appendStageWave(ctx.o.runDir, 'debate-defense', waveId);
-  const res = await ctx.launchers.launchSolo({ ...legOpts(ctx, waveId), model: raiser, prompt: brief });
+  const res = await ctx.launchers.launchSolo({ ...legOpts(ctx, waveId), model: raiserAlias, prompt: brief });
   ctx.addWave(res.wave);
-  if (isAbortExit(res.exitCode)) { return { raiser, aborted: res.exitCode }; }
+  if (isAbortExit(res.exitCode)) { return { raiser: raiserKey, aborted: res.exitCode }; }
   let leg = res.leg && res.leg.status === 'complete' ? res.leg : null;
   // A dead leg gets the SAME spec §5.7 fallback the parser applies to a block-level
   // failure — every expected id 'no-response', never an empty map, so the
@@ -76,84 +75,28 @@ async function runDefenseSolo(ctx, raiser, findings, idx) {
     const repairId = `${waveId}r`;
     runState.appendStageWave(ctx.o.runDir, 'debate-defense', repairId);
     const res2 = await ctx.launchers.launchSolo({
-      ...legOpts(ctx, repairId), model: raiser,
+      ...legOpts(ctx, repairId), model: raiserAlias,
       // ⚠️ LC-12: a repair solo is a fresh session — the defense that failed rides along.
       prompt: dbrief.buildDefenseRepairPrompt({ errors: parsed.errors, defense: leg.summary }),
     });
     ctx.addWave(res2.wave);
-    if (isAbortExit(res2.exitCode)) { return { raiser, aborted: res2.exitCode }; }
+    if (isAbortExit(res2.exitCode)) { return { raiser: raiserKey, aborted: res2.exitCode }; }
     const leg2 = res2.leg && res2.leg.status === 'complete' ? res2.leg : null;
     parsed = leg2 ? parseDebateDefense(leg2.summary, expectedIds) : parsed;
     conformance = parsed.ok ? 'repaired' : 'unstructured';
-    if (leg2) { supersededLeg = legRow(raiser, leg, 'unstructured'); leg = leg2; }
-    else { repairLeg = legRow(raiser, res2.leg, 'unstructured'); }
+    if (leg2) { supersededLeg = legRow(raiserAlias, leg, 'unstructured'); leg = leg2; }
+    else { repairLeg = legRow(raiserAlias, res2.leg, 'unstructured'); }
   }
   // A dead leg (no complete summary) OR an 'unstructured' conformance after the one
   // repair is a debate degradation (spec §5.7) — surfaced via the returned leg.
-  const stub = { model: raiser, status: 'error', durationMs: null, usage: null, conformance: 'unstructured', summary: '' };
-  return { raiser, byId: parsed.byId,
-    leg: leg ? { model: raiser, status: leg.status, durationMs: leg.durationMs, usage: leg.usage,
+  const stub = { model: raiserAlias, status: 'error', durationMs: null, usage: null, conformance: 'unstructured', summary: '' };
+  return { raiser: raiserKey, byId: parsed.byId,
+    leg: leg ? { model: raiserAlias, status: leg.status, durationMs: leg.durationMs, usage: leg.usage,
       conformance, summary: leg.summary, waveId: leg.waveId,
       ...(leg.model ? { resolvedModel: leg.model } : {}) } : stub,
     supersededLeg, repairLeg };
 }
 
-async function runRevoteWave(ctx, judges, bundleFindings) {
-  const bundle = dbrief.buildRevoteBundle({ findings: bundleFindings, date: ctx.o.date });
-  // spec §5.1 names `revote-bundle.md` a run-dir artifact: the shared re-vote prompt goes to
-  // disk exactly like Stage 2's bundle-stage2.md, so the round's model-facing input is
-  // auditable alongside briefing-stage1.md and chair-packet.md.
-  fs.writeFileSync(path.join(ctx.o.runDir, 'revote-bundle.md'), bundle, { mode: 0o600 });
-  const waveId = `${ctx.o.runId}-rv`;
-  const expectedIds = bundleFindings.map(f => f.id);
-  // run-debate — not run.js — owns this stage's `running` checkpoint AND its abort-cascade
-  // id: only this function knows whether the wave actually launched (it is skipped when
-  // nothing was defended/amended, or the cost ceiling hit).
-  runState.updateStage(ctx.o.runDir, 'debate-revote',
-    { status: 'running', startedAt: new Date().toISOString(), project: ctx.scratchDir, waveId });
-  emitStageStarted(ctx.o.runDir, ctx.o.runId, 'debate-revote', waveId, ctx.o.follow);
-  runState.appendStageWave(ctx.o.runDir, 'debate-revote', waveId);
-  const res = await ctx.launchers.launchWave({ ...legOpts(ctx, waveId), models: judges, prompt: bundle });
-  ctx.addWave(res.wave);
-  if (isAbortExit(res.exitCode)) { return { aborted: res.exitCode }; }
-  const byJudge = {}, legs = [];
-  // v4.7 D2/E4: mirrors runDefenseSolo's supersededLeg/repairLeg — one list each,
-  // accumulated across every judge in this wave (most judges contribute neither).
-  const supersededLegs = [], repairLegs = [];
-  for (const leg of ((res.wave && res.wave.legs) || [])) {
-    // The council ALIAS, not the resolved executable id — runStats rows join
-    // meta.models by exact string (run-assemble.js's buildRunStatsEntry).
-    const judge = leg.modelInput || leg.model;
-    const alive = leg.status === 'complete' && leg.summary;
-    let outLeg = leg;               // the leg actually recorded (post-repair when there is one)
-    let parsed = alive ? parseRevote(leg.summary, expectedIds)
-      : { ok: false, byId: {}, errors: [{ code: 'DEAD_LEG', detail: 'no summary' }] };
-    let conformance = alive ? 'clean' : 'unstructured';
-    if (alive && !parsed.ok) {
-      // One repair, solo, to that judge.
-      const repairId = `${waveId}-${judge}r`;
-      runState.appendStageWave(ctx.o.runDir, 'debate-revote', repairId);
-      const r2 = await ctx.launchers.launchSolo({ ...legOpts(ctx, repairId), model: judge,
-        // ⚠️ LC-12: ditto — the re-vote output being repaired rides with its errors.
-        prompt: dbrief.buildRevoteRepairPrompt({ errors: parsed.errors, revote: leg.summary }) });
-      ctx.addWave(r2.wave);
-      if (isAbortExit(r2.exitCode)) { return { aborted: r2.exitCode }; }
-      const leg2 = r2.leg && r2.leg.status === 'complete' ? r2.leg : null;
-      parsed = leg2 ? parseRevote(leg2.summary, expectedIds) : parsed;
-      conformance = parsed.ok ? 'repaired' : 'unstructured';
-      // Symmetric with runDefenseSolo's `if (leg2) { leg = leg2; }` — otherwise
-      // revote-<model>.md and the runStats row keep the PRE-repair output.
-      if (leg2) { supersededLegs.push(legRow(judge, leg, 'unstructured')); outLeg = leg2; }
-      else { repairLegs.push(legRow(judge, r2.leg, 'unstructured')); }
-    }
-    byJudge[judge] = parsed.byId;
-    legs.push({ model: judge, status: outLeg.status, durationMs: outLeg.durationMs, usage: outLeg.usage,
-      conformance, summary: outLeg.summary || '', waveId: outLeg.waveId,
-      ...(outLeg.model ? { resolvedModel: outLeg.model } : {}) });
-  }
-  return { byJudge, legs, supersededLegs, repairLegs };
-}
-
 /**
  * Full Stage-2.5 sequence (spec §5.1). Returns everything run.js needs. Cost gate: run.js
  * checks overBudget before invoking; this checks again before the re-vote wave (spec §5.7).
@@ -164,6 +107,26 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
   const { byRaiser, previousTier } = debateTargets(provisionalRecord, tallyInput);
   const contested = provisionalRecord.findings.filter(f => f.tier === 'Contested').length;
   const disputed = provisionalRecord.findings.filter(f => f.tier === 'Disputed').length;
+  // v4.8 PR3 Task 6 (spec §4.5): ONE seat→alias projection for the whole round —
+  // both debate waves, both repair solos, applyDebate's fail-open push and every
+  // artifact literal read it, so there is exactly one shape and one name.
+  // ⚠️ The table is RE-DERIVED when `o.seats` is absent, mirroring
+  // run-stage1-launch.js:20-22 verbatim. Falling back to an EMPTY map instead
+  // was the PR2b failure shape, not a safe default: that same Stage-1 fallback
+  // means a direct-require caller's findings/adjudications carry composed seat
+  // ids (`deepseek#1`) while `o.seats` is falsy, so `aliasOf` would be the
+  // identity over them and send a NON-ROUTABLE model name to three launchers
+  // (measured: r-d1 model="deepseek#1", r-d2 "deepseek#2", r-rv models
+  // ["gpt","deepseek#2","deepseek#1"]). buildSeats is pure and total, so the
+  // reconstruction is the same table Stage 1 bound against (spec §4.3).
+  // `aliasOf` is the identity only for a key that is no seat id at all: the
+  // reserved 'claude' key, and — because `s.alias === s.id` there — every bench
+  // without a repeated alias, i.e. every bench that has ever run.
+  const seatTable = Array.isArray(ctx.o.seats) && ctx.o.seats.length > 0
+    ? ctx.o.seats
+    : buildSeats(ctx.o.models, ctx.o.critic, ctx.o.lenses);
+  const seatById = new Map(seatTable.map(s => [s.id, s]));
+  const aliasOf = (key) => { const s = seatById.get(key); return s ? s.alias : key; };
 
   // ---- Defense mini-wave: ONE CONCURRENT solo per raiser (spec §5.1) ----
   // Concurrent, not sequential: every raiser gets its OWN briefing, so this is N independent
@@ -177,12 +140,16 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
   // (the same "originals stand" outcome as a no-response).
   const raisers = Object.keys(byRaiser).filter(m => m !== 'claude');
   const defenseResults = await Promise.all(
-    raisers.map((raiser, i) => runDefenseSolo(ctx, raiser, byRaiser[raiser], i)));
+    raisers.map((raiserKey, i) => runDefenseSolo(ctx, raiserKey, byRaiser[raiserKey], i, aliasOf)));
   // A signal during the defense wave aborts the whole finalization (spec §5.7):
   // return the abort code so run.js finalizes 'aborted' with NO tally-final / NO ledger.
   const abortedDefense = defenseResults.find(d => d.aborted);
   if (abortedDefense) { return { aborted: abortedDefense.aborted, contested, disputed }; }
-  materializeDebate(ctx.o.runDir, defenseResults.map(d => ({ model: d.raiser, summary: d.leg.summary })), 'rebuttal');
+  // ⚠️ This literal lives in runDebate, where `raiserAlias` does not exist — the
+  // projection is `aliasOf(d.raiser)`. `model` must stay ALIAS-valued (R3-1);
+  // `seat` is what gives two twins two files instead of one clobbered one (R3-3).
+  materializeDebate(ctx.o.runDir, defenseResults.map(d => ({ model: aliasOf(d.raiser),
+    summary: d.leg.summary, seat: seatById.get(d.raiser) || null })), 'rebuttal');
 
   const defenseByRaiser = {};
   for (const dr of defenseResults) { defenseByRaiser[dr.raiser] = { ...dr.byId }; }
@@ -200,18 +167,23 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
   // ---- Re-vote mini-wave (disputing judges only) ----
   let revoteByJudge = {}, revoteLegs = [], revoteSuperseded = [], revoteRepairs = [];
   const defendedOrAmended = bundleFor(defenseResults, tallyInput);
-  const judges = disputingJudges(provisionalRecord, defendedOrAmended.map(f => f.id));
+  // Seat ids (D6: one entry per disputing SEAT, so a twin bench launches two legs
+  // where one launched before). runRevoteWave needs the seat OBJECTS too — for the
+  // -rv bind roster and each leg's artifact name — so they are resolved here off
+  // the same table `aliasOf` reads, padded inside runRevoteWave per §3.4.
+  const judgeKeys = disputingJudges(provisionalRecord, defendedOrAmended.map(f => f.id));
+  const judgeSeats = judgeKeys.map(k => seatById.get(k) || null);
   // A re-vote is warranted only when something was defended/amended AND ≥1 judge disputed it.
   // Skipping THAT case because the whole-run budget is spent is the 'skipped-cost-ceiling'
   // degradation branch (spec §5.7); skipping because there is simply nothing to re-vote is NOT.
-  const wouldRevote = defendedOrAmended.length > 0 && judges.length > 0;
+  const wouldRevote = defendedOrAmended.length > 0 && judgeKeys.length > 0;
   const costCeiling = ctx.overBudget() && wouldRevote;
   // run.js needs to know whether the wave actually launched so it can
   // checkpoint debate-revote 'skipped' (not a false 'complete') when nothing
   // was defended/amended, or the cost ceiling skipped it (spec §5.7).
   const revoteLaunched = wouldRevote && !costCeiling;
   if (revoteLaunched) {
-    const rv = await runRevoteWave(ctx, judges, defendedOrAmended);
+    const rv = await runRevoteWave(ctx, judgeKeys, defendedOrAmended, judgeSeats, aliasOf);
     if (rv.aborted) { return { aborted: rv.aborted, contested, disputed }; }
     revoteByJudge = rv.byJudge;
     revoteLegs = rv.legs;
@@ -223,8 +195,13 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
   }
 
   // ---- Pure reassembly ----
+  // ⚠️ `aliasOf` MUST ride along: without it applyDebate's fail-open push writes a
+  // SEAT ID into the alias-space `judge` field, which reaches
+  // peer-split.js :: peersOf's `v.judge !== f.raiser` (measured: basis {a:1,d:0} →
+  // tier Confirmed where the alias spelling gives Singleton) and, as an
+  // out-of-contract `judge`, report.js :: columnFor's vote→column join.
   const { input: debatedInput, debateFindings } = applyDebate({
-    tallyInput: stampedInput, provisionalRecord, defenseByRaiser, revoteByJudge });
+    tallyInput: stampedInput, provisionalRecord, defenseByRaiser, revoteByJudge, aliasOf });
   debatedInput.runStats = [...(debatedInput.runStats || []),
     ...debateRunStatsRows({ defenseLegs: defenseResults.map(d => d.leg), revoteLegs,
       // v4.7 D2/E4: the retained loser legs from every raiser's defense repair
@@ -240,9 +217,19 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
   for (const f of debatedRec.findings) { if (provTierById.get(f.id) !== f.tier) { verdictChanges += 1; } }
 
   // ---- Artifacts + summary ----
+  // `revoteByJudge` is SEAT-keyed, but debate.json's `revotes[]` has a real
+  // consumer that joins on the ALIAS — electron/workspace-ui/workspace-panels.js's
+  // drillIntoJudge matches `r.judge === judgePair.model`, and its comment states
+  // that contract explicitly. So `judge` stays the alias and the seat rides
+  // beside it, emitted only when it differs (a unique bench writes today's
+  // byte-identical debate.json).
   const revotesJson = [];
-  for (const [judge, perId] of Object.entries(revoteByJudge)) {
-    for (const [id, rv] of Object.entries(perId)) { revotesJson.push({ judge, id, verdict: rv.verdict, reason: rv.reason || null, applied: true }); }
+  for (const [key, perId] of Object.entries(revoteByJudge)) {
+    const alias = aliasOf(key);
+    for (const [id, rv] of Object.entries(perId)) {
+      revotesJson.push({ judge: alias, ...(alias !== key ? { seat: key } : {}),
+        id, verdict: rv.verdict, reason: rv.reason || null, applied: true });
+    }
   }
   fs.writeFileSync(path.join(ctx.o.runDir, 'debate.json'),
     JSON.stringify({ findings: debateFindings, revotes: revotesJson }, null, 2), { mode: 0o600 });
@@ -265,14 +252,17 @@ async function runDebate(ctx, { provisionalRecord, tallyInput }) {
 
   // Chair-addendum outcomes (spec §5.3c). `action` is the PAST_TENSE form
   // buildDebateAddendum renders verbatim — only the four valid values ever reach it.
+  // ⚠️ priorVerdicts and revotes MUST share ONE key space: briefings-debate.js's
+  // renderer iterates Object.keys(revotes) and looks up prior[j], so a skew prints
+  // `no prior verdict` on EVERY line. Both are keyed seat-side here.
   const priorById = new Map(provisionalRecord.findings.map(
-    f => [f.id, Object.fromEntries((f.adjudications || []).map(a => [a.judge, a.verdict]))]));
+    f => [f.id, Object.fromEntries((f.adjudications || []).map(a => [a.seat || a.judge, a.verdict]))]));
   const addendumOutcomes = debateFindings.map(df => ({
     id: df.id, originalClaim: (tallyInput.findings.find(f => f.id === df.id) || {}).claim,
     action: PAST_TENSE[df.action] || PAST_TENSE['no-response'],
     amendedClaim: df.action === 'amend' ? df.claim : null,
     priorVerdicts: priorById.get(df.id) || {},
-    revotes: Object.fromEntries(revotesJson.filter(r => r.id === df.id).map(r => [r.judge, r.verdict])),
+    revotes: Object.fromEntries(revotesJson.filter(r => r.id === df.id).map(r => [r.seat || r.judge, r.verdict])),
   }));
 
   return { debatedInput, debateFindings, debateSummary, addendumOutcomes,

package/src/council/run-finish.js

@@ -0,0 +1,70 @@
+// src/council/run-finish.js
+'use strict';
+// Final tally (chair row included) + ledger gate + tally/verdict artifacts.
+// Moved verbatim from run.js@6b0c3b6b:242-288 (v4.8 PR0 size-gate split, zero
+// behavior). NOT run-finalize.js — that sibling owns exit codes and the
+// terminal write; this module builds the final tally, appends the run
+// record to the ledger (skipped for lens runs), and writes the
+// tally/verdict artifact files + their stage events.
+const { tally } = require('./tally');
+const { decorateRecord } = require('./debate');
+const runState = require('./run-state');
+const asm = require('./run-assemble');
+const { emitStageStarted, emitStageTerminal } = require('../observe/events');
+
+/**
+ * Build the final tally, gate the ledger append, write tally+verdict
+ * artifacts and their stage checkpoints. Void — run.js's trailing
+ * `return finalize(...)` reads only degraded.value, which this never
+ * mutates.
+ */
+function finishRun({ o, chairRes, debatedInput, debateFindings, appendRunFn, degrade, deadWaves, now }) {
+  const { chairLeg, actualChair, chairText, chairConformance, overallVerdict, chairRows, chairAttempts } = chairRes;
+  const chairStats = chairLeg ? asm.buildRunStatsEntry({
+    leg: chairLeg, model: actualChair, role: 'chair', wasChair: true,
+    conformance: chairConformance,
+  }) : null;
+  // v4.7 D2: a give-up (no chairLeg) with at least one recorded attempt gets
+  // an explicit error row so the walk's outcome isn't silently absorbed.
+  // Keyed on chairAttempts, NOT chairRows — attempts that die pre-wave (no
+  // money spent) record an outcome but yield no row (errata E3).
+  const giveUpRow = (!chairLeg && chairAttempts && chairAttempts.length)
+    ? asm.buildRunStatsEntry({ leg: null, model: o.chair, role: 'chair', wasChair: false })
+    : null;
+  // Built on the (possibly debated) input so the debate's amended claims, replaced
+  // adjudications and rebuttal/revote runStats rows all reach the final record.
+  const finalInput = { ...debatedInput, meta: { ...debatedInput.meta, chair: actualChair || o.chair } };
+  // Item 8, final-review consolidated wave: was three sequential
+  // reassignments (chairStats, then chairRows, then giveUpRow), each
+  // rebuilding finalInput.runStats from scratch — collapsed into the one
+  // spread that was always the net effect. The `|| []` fallbacks were
+  // dead: `runStats` is a real array on every debatedInput
+  // (asm.buildTallyInput always returns one via .map()), never undefined.
+  finalInput.runStats = [
+    ...finalInput.runStats,
+    ...(chairStats ? [chairStats] : []),
+    ...chairRows,
+    ...(giveUpRow ? [giveUpRow] : []),
+  ];
+  const record = tally(finalInput);
+  if (debateFindings) { decorateRecord(record, debateFindings); }
+  if (!o.lenses) {
+    // Lens runs never feed cross-run reliability stats (spec §4 / skill rule).
+    try { appendRunFn(record); }
+    catch (e) { process.stderr.write(`Notice: council ledger append failed: ${e.message}\n`); }
+  }
+  asm.writeTallyFiles({ runDir: o.runDir, tallyInput: finalInput, record });
+  const tallyStage = o.debate ? 'tally-final' : 'tally';
+  runState.updateStage(o.runDir, tallyStage, { status: 'complete', completedAt: now() });
+  emitStageStarted(o.runDir, o.runId, tallyStage, null, o.follow);
+  emitStageTerminal(o.runDir, o.runId, tallyStage, 'complete', null, o.follow);
+  // Verdict assembly is the degrade cut-off: anything noted after this line
+  // reaches stderr + run.json but not verdict.json (spec §6 rule 1).
+  asm.writeVerdictFiles({ runDir: o.runDir, record, overallVerdict, chairText,
+    critic: o.critic, deadWaves, degrades: degrade.all() });
+  runState.updateStage(o.runDir, 'verdict', { status: 'complete', completedAt: now() });
+  emitStageStarted(o.runDir, o.runId, 'verdict', null, o.follow);
+  emitStageTerminal(o.runDir, o.runId, 'verdict', 'complete', null, o.follow);
+}
+
+module.exports = { finishRun };

package/src/council/run-launch.js

@@ -16,6 +16,10 @@
 
 const fs = require('fs');
 const path = require('path');
+// sanitizeName lives in ./seats (v4.8 PR1) so that module can stay
+// require-free; re-exported below — run-stage2.js and workspace/artifact-guard.js
+// import it from here.
+const { sanitizeName, artifactName } = require('./seats');
 
 /**
  * Did a launch exit because a SIGNAL killed it (130 = SIGINT, 143 = SIGTERM)
@@ -63,15 +67,22 @@ function createLaunchers(deps = {}) {
   /**
    * @param {{models: string[], prompt: string, project: string, waveId: string,
    *   timeout?: number, gateway?: string, noValidateModel?: boolean, agent?: string,
-   *   councilRunId?: string, councilName?: string, tag?: string, fallback?: object,
-   *   catalog?: Array}} opts
+   *   councilRunId?: string, councilName?: string, tag?: string, seats?: Array<object>,
+   *   fallback?: object, catalog?: Array, noOutputBackstopMs?: number}} opts
    *   councilRunId/councilName (v4.3 Task 3, spec §7.2) are additive attribution
    *   ids forwarded verbatim into the runFanout call so it can stamp them onto
    *   every leg. tag (v4.7 F8 D16) rides the same forward — every call site
    *   below that sets councilRunId/councilName sets `tag: o.tag` alongside it.
+   *   seats (v4.8 R5 T4.1) rides the same forward again: the wave's launch
+   *   roster, index-parallel with `models`. stampLegAttribution
+   *   (fanout-wave-io.js, T4.2) consumes it to name each leg's seat; it is
+   *   `undefined` for every caller that does not set it.
    *   fallback/catalog (v4.3 Task 18, spec §6.2) are likewise
    *   additive/opt-in — omitted by callers that must never substitute (the
    *   chair, debate legs); run-stages.js's Stage-1/Stage-2 launches pass them.
+   *   noOutputBackstopMs (Task 5, #129) is opt-in and spread-guarded on
+   *   Number.isFinite (0 is a valid disable value); only run-retry.js sets it,
+   *   to escalate the window on a Stage-1 retry.
    * @returns {Promise<{wave: object|null, exitCode: number}>}
    */
   async function launchWave(opts) {
@@ -118,6 +129,19 @@ function createLaunchers(deps = {}) {
       // undefined when no --tag, so stampLegAttribution's `if (options.tag)`
       // guard (fanout-wave-io.js) simply no-ops, byte-identical to today.
       tag: opts.tag,
+      // v4.8 R5 T4.1: the per-wave roster, index-parallel with `models`.
+      // stampLegAttribution (fanout-wave-io.js, T4.2) consumes this key to
+      // name each leg's seat; `undefined` for every caller that does not set
+      // it (every non-council caller, and the chair/debate/repair launches).
+      seats: opts.seats,
+      // Task 5 (#129): spread-guarded on Number.isFinite, NOT on truthiness —
+      // an explicit 0 is this knob's documented disable hatch
+      // (no-output-backstop.js:13-15) and a truthiness guard would silently
+      // drop it. Guarding at all — rather than a plain
+      // `noOutputBackstopMs: opts.noOutputBackstopMs` — keeps the transport
+      // call key-identical for run-stage1-launch / run-stage2 / run-chair /
+      // run-debate, none of which set it.
+      ...(Number.isFinite(opts.noOutputBackstopMs) ? { noOutputBackstopMs: opts.noOutputBackstopMs } : {}),
       // v4.3 Task 18 (spec §6.2): additive/opt-in. Callers that must never
       // substitute (run-chair.js, run-debate.js) simply omit these — runLeg's
       // fallback path only activates when `fallback.enabled` is true.
@@ -164,38 +188,51 @@ function createLaunchers(deps = {}) {
   return { launchWave, launchSolo };
 }
 
-/** Filesystem-safe model name for review-/judge- artifact filenames. */
-function sanitizeName(model) {
-  return String(model).replace(/[^a-zA-Z0-9._-]/g, '-');
-}
-
 /**
- * Write `review-<modelInput>.md` per surviving Stage-1 leg (skill layout).
- * Dead legs and empty summaries are skipped — the caller applies the
- * wave-degrade rules to what remains.
+ * Write one review file per surviving Stage-1 leg (skill layout). Dead legs and
+ * empty summaries are skipped — the caller applies the wave-degrade rules to
+ * what remains, which is why a BOUND seat can still end up dead here.
+ *
+ * With `seatOf` the filename is the SEAT's (artifactName), byte-identical to the
+ * alias name for every bench that has ever run, and what stops two twins from
+ * clobbering one file. An unbound leg keeps its alias name rather than being
+ * dropped: it is unattributable, not unusable, and dropping it would lose a
+ * review that lands today.
+ *
  * @param {string} runDir
  * @param {Array<object>} legs run documents from the wave/solo docs
- * @returns {Array<{model: string, modelInput: string, file: string, text: string, leg: object}>}
+ * @param {Map<object, object>} [seatOf] leg document -> seat, keyed by object identity
+ * @returns {Array<{model: string, modelInput: string, file: string, text: string,
+ *   leg: object, seat: ?object}>}
  */
-function materializeReviews(runDir, legs) {
+function materializeReviews(runDir, legs, seatOf) {
   const out = [];
   for (const leg of legs) {
     if (!leg || leg.status !== 'complete') { continue; }
     const text = leg.summary;
     if (!text || !String(text).trim()) { continue; }
     const modelInput = leg.modelInput || leg.model;
-    const file = path.join(runDir, `review-${sanitizeName(modelInput)}.md`);
+    const seat = (seatOf && seatOf.get(leg)) || null;
+    const name = seat ? artifactName(seat, 'review') : `review-${sanitizeName(modelInput)}.md`;
+    const file = path.join(runDir, name);
     fs.writeFileSync(file, text, { mode: 0o600 });
-    out.push({ model: leg.model, modelInput, file, text, leg });
+    out.push({ model: leg.model, modelInput, file, text, leg, seat });
   }
   return out;
 }
 
 /**
- * Write per-leg debate artifacts: `<prefix>-<sanitizeName(model)>.md` for each
- * leg with a non-empty summary. Mirrors materializeReviews.
+ * Write per-leg debate artifacts for each leg with a non-empty summary. Mirrors
+ * materializeReviews — but these are plain `{model, summary}` literals built by
+ * the debate callers, never leg documents, so materializeReviews' object-identity
+ * `seatOf` Map does not transfer: the seat rides ON the literal instead.
+ *
+ * With `seat` the filename is the SEAT's (artifactName, v4.8 PR3 Task 6),
+ * byte-identical to `<prefix>-<sanitizeName(model)>.md` for every bench without
+ * a repeated alias, and what stops two twins from clobbering one file. Without
+ * it the alias name is kept — today's exact behaviour.
  * @param {string} runDir
- * @param {Array<{model: string, summary: string}>} legs
+ * @param {Array<{model: string, summary: string, seat?: ?object}>} legs
  * @param {string} prefix 'rebuttal' | 'revote'
  * @returns {Array<{model: string, file: string}>}
  */
@@ -203,7 +240,8 @@ function materializeDebate(runDir, legs, prefix) {
   const out = [];
   for (const leg of legs) {
     if (!leg || !leg.summary || !leg.summary.trim()) { continue; }
-    const file = path.join(runDir, `${prefix}-${sanitizeName(leg.model)}.md`);
+    const name = leg.seat ? artifactName(leg.seat, prefix) : `${prefix}-${sanitizeName(leg.model)}.md`;
+    const file = path.join(runDir, name);
     fs.writeFileSync(file, leg.summary, { mode: 0o600 });
     out.push({ model: leg.model, file });
   }