amicus 4.7.0 → 4.8.0

package/src/council/run-retry-group.js

@@ -0,0 +1,266 @@
+// src/council/run-retry-group.js
+'use strict';
+// Stage-1 loss grouping: lensIndexOf + recordFailure + groupStage1Losses.
+// Moved verbatim from run-retry.js:24-126 (v4.8 PR0 size-gate split, zero
+// behavior). Pure but for ONE leaf require: ./run-retry-keys, itself require-free.
+// run-retry.js re-exports groupStage1Losses so existing import paths
+// (tests/council/run-retry.test.js) stay stable.
+const { seatKey, twinAliases, legLossKey, srcLegClaimer } = require('./run-retry-keys');
+
+/** 1-based lens index for a loss: the waveId convention, else the seat's own
+ *  bench position, else the alias's first bench index. v4.8 PR2b H4: the old
+ *  `o.models.indexOf(model)` was first-match, so twin aliases both resolved to
+ *  the FIRST twin's lens and shared one retry unit — and the deadLegs loop
+ *  passes waveId=null, so that branch was the only one those losses could
+ *  take. The alias fallback survives for a loss with no identified seat. */
+function lensIndexOf(o, waveId, model, seatObj = null) {
+  const m = /-l(\d+)$/.exec(waveId || '');
+  if (m) { return Number(m[1]); }
+  if (seatObj && Number.isInteger(seatObj.position)) { return seatObj.position; }
+  const i = (o.models || []).indexOf(model);
+  return i === -1 ? null : i + 1;
+}
+
+/**
+ * Which of a unit's srcLegs still need their own still-dead note once its srcWaves have
+ * emitted theirs, plus every seat key those announcements cover.
+ *
+ * v4.8 PR5c: an UNIDENTIFIED wave slot keys by ALIAS (seatKey's fallback) while a leg that
+ * WAS bound keys by its seat id, so a plain `noted.has(key)` test misses and the same seat
+ * is announced TWICE, once per keyspace. HISTORY, not the present: at pre-PR5c HEAD the
+ * Workspace's alias-keyed dead-row dedup hid this by collapsing both into one row; PR5c Task 2
+ * seat-keyed that consumer, and T2.2 abolished the producer-side collapse — nothing masks it now.
+ *
+ * ⛔ TWO earlier attempts inferred identity here and both were rated blockers. A per-alias
+ * BUDGET assumed the next leg on an alias was the wave's unnamed slot. A roster PIGEONHOLE
+ * (`I + U + 1 > K`) replaced the assumption with arithmetic — but silently assumed `I` and `U`
+ * were disjoint, so when an unnamed slot and an identified leg were the same seat it overcounted
+ * and dropped a genuinely distinct one. Both failures were SILENT, which is the direction this
+ * module exists to reject.
+ *
+ * Owner ruling: stop inferring. Dedup ONLY where identity is exact, and announce otherwise.
+ * Exact means: the leg was bound to a seat (a real id), OR its alias holds exactly one seat in
+ * the roster, where the alias IS the seat id (`seats.js` mints `alias#N` only for repeats).
+ * Everything else is announced, because nothing proves it is a repeat.
+ *
+ * ⚠️ The accepted cost, disclosed: on a bench that repeats an alias, an unnamed wave slot and a
+ * leg for the same seat can each produce a note, so one dead seat may be announced twice. That
+ * is a VISIBLE duplicate. The alternative — the two inferences above — hid a dead seat instead,
+ * and a duplicate that a reader can see beats a loss they cannot.
+ *
+ * ⚠️ v4.8 T-A6 (SI-TWINS): `twins` is THREADED IN — one derivation per run, made by
+ * `run-retry.js :: retryStage1Losses` and handed to every producer and consumer of a
+ * `legLossKey`. It is NOT the same thing as `seatsPerAlias` below, and merging them would be a
+ * silent behaviour change: `twins` is `> 1` (an alias the roster PROVES repeated) while
+ * `seatsPerAlias.get(alias) === 1` is `=== 1` (an alias the roster proves UNIQUE). They differ
+ * on the alias the roster does not mention at all — count 0 — where `!twins.has(alias)` is true
+ * but `=== 1` is false. That gap is the whole point of this function's rule: with no proof of
+ * identity it ANNOUNCES, because a duplicate note a reader can see beats a dead seat they
+ * cannot. `twinAliases`' own docblock states the opposite default for the same reason.
+ * The parameter default exists for direct callers only; the production path always passes.
+ *
+ * @param {Array<{id: string, alias: string}>} roster  the run's seat table (`o.seats`)
+ * @param {Map<string, number>} [twins]  the run's ONE `twinAliases(roster)` (see above)
+ * @returns {{attempted: Set<string>, legs: Array<{leg: object, seatId: ?string}>}}
+ */
+function planStillDeadSources(unit, seatOf, roster, twins = twinAliases(roster)) {
+  const seatsPerAlias = new Map();
+  for (const seat of roster || []) {
+    if (seat && seat.alias) { seatsPerAlias.set(seat.alias, (seatsPerAlias.get(seat.alias) || 0) + 1); }
+  }
+  const noted = new Set();
+  const attempted = new Set();
+  for (const w of unit.srcWaves) {
+    (w.models || []).forEach((m, i) => {
+      const k = seatKey((w.seats || [])[i] || null, m);
+      noted.add(k); attempted.add(k);
+    });
+  }
+  const legs = [];
+  for (const l of unit.srcLegs) {
+    const bound = seatOf.get(l) || null;
+    const alias = l.modelInput || l.model;
+    const key = seatKey(bound, alias);
+    // BOTH spellings: `key` is what an exact dead-seat row asks with, `legLossKey` is
+    // what an unattributable twin's row asks with (run-stage1-rows.js's finalLeg
+    // fallback). They are the same string whenever identity is exact, so the Set is
+    // unchanged on every bench but a twin one. Missing the second spelling re-attaches
+    // a first-attempt leg to a seat that WAS retried — and that leg already has its
+    // own `superseded` row, so its cost would be counted twice.
+    attempted.add(key);
+    attempted.add(legLossKey(bound, alias, l, twins));
+    // `key` names a specific seat only when the leg was bound, or when the alias holds exactly
+    // one seat (then the alias IS the id). Otherwise it is an alias standing in for "some seat",
+    // and matching it against a wave's unnamed slot would be a guess, not a repeat.
+    const identityIsExact = !!bound || seatsPerAlias.get(alias) === 1;
+    if (identityIsExact && noted.has(key)) { continue; }
+    noted.add(key);
+    legs.push({ leg: l, seatId: bound ? bound.id : null });
+  }
+  return { attempted, legs };
+}
+
+/**
+ * Dedup helper (Task-4 review hardening): the same seat can arrive twice in one
+ * grouping pass — two dead legs naming it, or a dead wave and a dead leg both naming
+ * it. One seat must still mean ONE `firstFailures` entry — first occurrence wins —
+ * while every SOURCE record is kept regardless (srcWaves/srcLegs are the audit trail
+ * and are never deduped). The critic unit's `.models` is fixed at creation (there is
+ * only ever one critic seat), so only bench/lens units grow `.models` here — the
+ * critic call sites pass `trackModel: false`.
+ *
+ * v4.8 PR2b: `seatObj` rides in lockstep, so `unit.seats` stays INDEX-PARALLEL to
+ * `unit.models` — same order, same length. `null` means "we could not identify this
+ * seat"; it is never back-filled from an alias lookup, which is exactly the guess
+ * seat identity exists to forbid.
+ *
+ * v4.8 T2.2: dedup ONLY where identity is EXACT — the leg was bound, or the roster
+ * does not repeat its alias. On a twin alias with no binding `key` names BOTH twins,
+ * and this early return then DISCARDED the second one BEFORE `models`/`seats` were
+ * ever pushed: one retry slot for two seats the run had already paid for. (PR2b H4
+ * claimed that collapse was correct "because nothing distinguishes them". The ROW does
+ * have a distinguisher — see `run-retry-keys.js :: legLossKey` — and the SLOT does not need one.)
+ *
+ * v4.8 T-A3: …and, ON THE INEXACT ARM AND PER UNIT, no further than the roster proves. There
+ * the alias's roster COUNT is the only upper bound there is, so mint up to it and stop: without it, N
+ * unattributable losses on a 2-seat alias minted N slots, each buying a real, billed retry
+ * leg for a seat that may not exist. (Not reachable end-to-end today — a first-pass dead
+ * wave carries real seats, and a wave cannot return more legs than it launched — but the
+ * safety rested entirely on those two facts, which nothing here stated or checked.)
+ * ⚠️ Scope, stated because the code cannot: this bounds SLOTS, i.e. `unit.models`, so a
+ * `trackModel: false` unit is unaffected — the critic's `.models` is fixed at creation
+ * (first paragraph above) and never grows here.
+ *
+ * ⚠️ The key is ADDED as `seatId`, and on the inexact branch it stays ALIAS-valued
+ * for BOTH entries. `ff.seat`/`ff.seatId` become `data.seat` /
+ * `data.firstFailure.seatId` on every emitted note, which verdict.js compares against
+ * `o.critic` (an alias) and the Workspace renders as a seat id: seat-keying `ff.seat`
+ * silently breaks critic-loss detection, and minting one here would put a fabricated
+ * seat identity on screen.
+ */
+function recordFailure(unit, seat, ff, trackModel = true, seatObj = null, twins = null) {
+  const key = seatKey(seatObj, seat);
+  const identityIsExact = !!seatObj || !(twins && twins.has(seat));
+  // Exact identity: one seat is one entry. Inexact: `twins.get(seat)` is defined and >1
+  // exactly when this arm is taken, and it is the roster's whole claim about the alias.
+  const alreadyCovered = identityIsExact
+    ? unit.firstFailures.some(f => f.seatId === key)
+    : unit.models.filter(m => m === seat).length >= twins.get(seat);
+  if (alreadyCovered) { return; }
+  unit.firstFailures.push({ ...ff, seatId: key });
+  if (trackModel) { unit.models.push(seat); unit.seats.push(seatObj); }
+}
+
+/**
+ * Group Stage-1 losses into retry units. Pure — no I/O.
+ * Bench losses (a dead bench wave's models + dead bench legs) collapse into
+ * ONE retry wave; the critic and each lens retry as solos (their briefings
+ * differ). Stable order: bench, critic, lenses ascending. The critic matches
+ * on EITHER carrier — waveId convention or model — mirroring
+ * verdict.js summarizeSeatLoss.
+ *
+ * `seatOf` (v4.8 PR2b) is Stage-1's leg->seat binding, keyed by leg OBJECT
+ * identity: it is how a dead LEG contributes the seat it was actually bound to
+ * rather than one guessed from its alias. A wave-origin loss carries its own
+ * roster on `w.seats`, positionally parallel to `w.models`.
+ *
+ * `twins` (v4.8 T-A6, SI-TWINS) is THREADED IN rather than derived here — one
+ * `twinAliases` per run, shared by every site that mints or asks a `legLossKey`. The
+ * default is for direct callers (this function is exported and several suites drive it
+ * with four arguments); the production path always passes.
+ */
+function groupStage1Losses(o, deadWaves = [], deadLegs = [], seatOf = new Map(),
+  twins = twinAliases(o.seats)) {
+  const isCriticWave = (w) =>
+    w.waveId === `${o.runId}-c1` || (!!o.critic && (w.models || []).includes(o.critic));
+  const bench = { unit: 'bench', waveId: `${o.runId}-s1r1`, retryOfWaveId: `${o.runId}-s1`,
+    models: [], seats: [], firstFailures: [], srcWaves: [], srcLegs: [] };
+  const lensUnits = new Map(); // lensIndex (number, or null for unmappable) -> unit
+  // Seeded exactly like `models`, and gated on the same `o.critic` so the two
+  // arrays cannot diverge in LENGTH when the critic's seat cannot be resolved
+  // (a caller with no o.seats): `[null]` says "unidentified", `[]` would say
+  // "no slot at all" and shift the retry roster.
+  const criticSeatObj = (o.seats || []).find(s => s.alias === o.critic) || null;
+  const criticUnit = { unit: 'critic', waveId: `${o.runId}-c1r1`, retryOfWaveId: `${o.runId}-c1`,
+    models: o.critic ? [o.critic] : [], seats: o.critic ? [criticSeatObj] : [],
+    firstFailures: [], srcWaves: [], srcLegs: [] };
+
+  const lensUnitFor = (i) => {
+    if (!lensUnits.has(i)) {
+      // Task-4 review hardening: an unmappable loss (lensIndexOf resolved
+      // neither the waveId convention nor a model-roster membership) must
+      // still be GROUPABLE — dropping it here would let it vanish before the
+      // orchestrator ever sees it — but must not manufacture a fake
+      // `-lnullr1` waveId. The orchestrator refuses to launch any unit with
+      // `lensIndex === null` and routes its sources to skipped instead.
+      lensUnits.set(i, i === null
+        ? { unit: 'lens', lensIndex: null, waveId: null, retryOfWaveId: null,
+          models: [], seats: [], firstFailures: [], srcWaves: [], srcLegs: [] }
+        : { unit: 'lens', lensIndex: i, waveId: `${o.runId}-l${i}r1`,
+          retryOfWaveId: `${o.runId}-l${i}`, models: [], seats: [],
+          firstFailures: [], srcWaves: [], srcLegs: [] });
+    }
+    return lensUnits.get(i);
+  };
+
+  // v4.8 PR2b Task 7 (R-B): a `partial` record is stage1-bind.js's
+  // missingSeatDeadWave — ONE seat of a wave that DID return legs, just not
+  // this seat's. It retries exactly like a dead wave, but its loss CLASS is
+  // 'missing': every still-dead/heal builder reads ff.class, and a 'wave'
+  // record makes them claim the wave "produced no legs", which is false.
+  // A partial critic record is stamped `-c1`, so it matches isCriticWave and
+  // would otherwise be recorded 'wave' on that branch alone.
+  const lossClass = w => (w.partial ? 'missing' : 'wave');
+  for (const w of deadWaves) {
+    const models = w.models || [];
+    if (o.lenses) {
+      const u = lensUnitFor(lensIndexOf(o, w.waveId, models[0], (w.seats || [])[0] || null));
+      u.srcWaves.push(w);
+      models.forEach((seat, idx) => recordFailure(u, seat,
+        { seat, class: lossClass(w), waveId: w.waveId, reason: w.reason }, true, (w.seats || [])[idx] || null, twins));
+    } else if (isCriticWave(w)) {
+      criticUnit.srcWaves.push(w);
+      // criticSeatObj rides even though trackModel is false: it is already
+      // criticUnit.seats[0], so keying the firstFailure off it is what keeps
+      // the dedup key and the roster slot's key the SAME string.
+      recordFailure(criticUnit, o.critic,
+        { seat: o.critic, class: lossClass(w), waveId: w.waveId, reason: w.reason }, false, criticSeatObj, twins);
+    } else {
+      bench.srcWaves.push(w);
+      models.forEach((seat, idx) => recordFailure(bench, seat,
+        { seat, class: lossClass(w), waveId: w.waveId, reason: w.reason }, true, (w.seats || [])[idx] || null, twins));
+    }
+  }
+  for (const leg of deadLegs) {
+    const seat = leg.modelInput || leg.model;
+    const ff = { seat, class: 'leg', status: leg.status, reason: leg.error || null };
+    if (o.lenses) {
+      const u = lensUnitFor(lensIndexOf(o, null, seat, seatOf.get(leg) || null));
+      u.srcLegs.push(leg);
+      recordFailure(u, seat, ff, true, seatOf.get(leg) || null, twins);
+    } else if (o.critic && seat === o.critic) {
+      criticUnit.srcLegs.push(leg);
+      recordFailure(criticUnit, seat, ff, false, criticSeatObj, twins);
+    } else {
+      bench.srcLegs.push(leg);
+      recordFailure(bench, seat, ff, true, seatOf.get(leg) || null, twins);
+    }
+  }
+
+  const out = [];
+  // Task-4 review hardening: gate on whether the unit received any SOURCE
+  // record, not on firstFailures.length — a zero-model dead wave contributes
+  // a srcWaves entry but nothing to firstFailures/models (nothing for the
+  // `.forEach` above to iterate), and must still surface here so the
+  // orchestrator can route it to skipped instead of it vanishing silently.
+  if (bench.srcWaves.length > 0 || bench.srcLegs.length > 0) { out.push(bench); }
+  if (criticUnit.srcWaves.length > 0 || criticUnit.srcLegs.length > 0) { out.push(criticUnit); }
+  // Coordinator-review MINOR-7a: null sorts LAST (Infinity), not first (0) —
+  // an unmappable loss is not "lens index 0"; it should not perturb the
+  // ascending order of the real, well-indexed lens retries.
+  out.push(...[...lensUnits.values()].sort((a, b) => (a.lensIndex ?? Infinity) - (b.lensIndex ?? Infinity)));
+  return out;
+}
+
+module.exports = { lensIndexOf, recordFailure, groupStage1Losses, planStillDeadSources, seatKey,
+  twinAliases, legLossKey, srcLegClaimer };

package/src/council/run-retry-keys.js

@@ -0,0 +1,74 @@
+// src/council/run-retry-keys.js
+'use strict';
+// The Stage-1 loss KEYSPACE: seatKey + twinAliases + legLossKey + srcLegClaimer.
+// Moved verbatim from run-retry-group.js:23-86 AT 3d8f9d38 (v4.8 Phase 2 T-A1 size-gate
+// split, zero behavior). REQUIRE-FREE by design, like ./seats and ./run-stats-entry — it is
+// the leaf the loss keyspace hangs from, so no consumer can land on an import cycle.
+// run-retry-group.js re-exports all four, so no import path in the tree moved.
+
+/**
+ * The one seat-key rule: a seat's id when it was identified, its alias otherwise.
+ * Exported so `run-retry-group.js :: recordFailure` and run-retry.js both consume it
+ * rather than re-spelling it — two readers of one rule that drift apart is how the
+ * alias/seat-id keyspace splits in the first place.
+ */
+const seatKey = (s, alias) => (s ? s.id : alias);
+
+/**
+ * The aliases this run's roster proves are REPEATED, mapped to the COUNT of seats holding
+ * each — the only evidence that two losses on one alias are two seats and not one seat
+ * losing twice, and the BOUND on the slots they mint. No roster means no proof: empty Map.
+ *
+ * ⚠️ Deliberately NOT `run-retry-group.js :: planStillDeadSources`' own
+ * `seatsPerAlias.get(alias) === 1`, and the difference is load-bearing. That rule gates an
+ * ANNOUNCEMENT — being wrong costs a duplicate note a reader can see — so with no roster it
+ * errs toward announcing. This one gates a RETRY SLOT and a runStats row — being wrong buys
+ * a leg for a seat that may not exist — so with no roster it errs toward collapsing, as HEAD
+ * always did. ⚠️ That default is the CONSUMER's, not this filter's — with NO roster BOTH spellings
+ * give an empty Map. Pinned: run-retry-roster-bound.test.js :: "control: NO roster at all…".
+ */
+function twinAliases(roster) {
+  const n = new Map();
+  for (const s of roster || []) { if (s && s.alias) { n.set(s.alias, (n.get(s.alias) || 0) + 1); } }
+  return new Map([...n].filter(([, c]) => c > 1));
+}
+
+/**
+ * A dead LEG's key where `seatKey` alone names N seats at once: an alias the roster
+ * repeats, on a leg no binding could identify. v4.8 T2.2 ruling R2 — MINT a
+ * distinguisher where one exists, and the leg arms have one: the leg's own `taskId`
+ * (`${waveId}-${n}`, src/sidecar/leg-ids.js:15), stamped even on a leg that never
+ * routed (`fanout-leg.js:61`), surviving the disk round-trip, distinct through three
+ * of the four ways a leg is orphaned. The fourth — NO `taskId` at all — has genuinely
+ * nothing and keeps the collapsing key: that is the honest floor, and inventing one
+ * would be the guess this keyspace exists to reject.
+ *
+ * ⚠️ INTERNAL, never rendered: it joins the dead-seat rows, `attemptedSeats` and
+ * `deadLegs0`, nothing else. `ff.seat`/`ff.seatId` stay ALIAS-valued — they become
+ * `data.seat` / `data.firstFailure.seatId`, which verdict.js compares to `o.critic`
+ * and the Workspace renders as a seat id.
+ */
+function legLossKey(seatObj, alias, leg, twins) {
+  const key = seatKey(seatObj, alias);
+  if (seatObj || !twins || !twins.has(alias) || !leg || !leg.taskId) { return key; }
+  return `${key}\u0000${leg.taskId}`;   // NUL: impossible in an alias, id or taskId
+}
+
+/**
+ * A STATEFUL claimer over `srcLegs` — build ONE per unit, never reuse it: each call CONSUMES
+ * and returns one leg whose key matches, never hands the same leg out twice, and returns null
+ * once that key is exhausted (`(key) => leg | null`). It replaces `srcLegs.find(...)`, which
+ * returned the FIRST match every time, so two unattributable twins on one alias both recorded
+ * the SAME source and the second seat — a leg the run paid for — vanished from stillDeadLegs.
+ * Which dead source pairs with which dead outcome is unknowable AND immaterial: every candidate
+ * is still dead after its retry, so one apiece yields the exact SET (their rows carry no seat).
+ */
+function srcLegClaimer(srcLegs, keyOfSrc) {
+  const pool = new Set(srcLegs);
+  return (key) => {
+    for (const l of pool) { if (keyOfSrc(l) === key) { pool.delete(l); return l; } }  // exits on the delete
+    return null;
+  };
+}
+
+module.exports = { seatKey, twinAliases, legLossKey, srcLegClaimer };

package/src/council/run-retry-launch.js

@@ -0,0 +1,55 @@
+// src/council/run-retry-launch.js
+'use strict';
+// The retry pass's LAUNCH side: briefingFor + bindRetryWave. Lifted out of
+// run-retry.js (v4.8 Phase 2 T-A2 size-gate split, zero behavior) — briefingFor
+// byte-for-byte, the roster pad/bind block as a PURE function that returns its
+// bindings rather than mutating the orchestrator's accumulator.
+// run-retry.js requires both back, so no existing import path moved.
+// v4.8 SI-27 (ruling R14) landed: the pad/bind/drop CORE now lives in
+// `stage1-bind.js :: bindPaddedWave`, shared with run-stage2.js and
+// run-debate-revote.js. What stays here is retry-specific — WHICH array is the
+// roster, and the orphan tail. ⚠️ `bindStage1Waves` in that same file is still a
+// different contract (one call per Stage-1 wave, a real roster, no padding, no
+// placeholders); `bindPaddedWave` is the one this file calls.
+
+const briefings = require('./briefings');
+const { bindPaddedWave } = require('./stage1-bind');
+
+/** The briefing a retry unit re-issues — same builders Stage 1 used. */
+function briefingFor(o, unit) {
+  if (unit.unit === 'critic') { return briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }); }
+  if (unit.unit === 'lens') {
+    return briefings.buildLensBriefing({ lens: o.lenses[unit.lensIndex - 1], briefing: o.briefing, date: o.date });
+  }
+  return briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date });
+}
+
+/**
+ * Bind a retry wave's returned legs to the unit that launched them.
+ *
+ * PURE by design: the caller owns the accumulator. `retrySeatOf` is published into
+ * `out.seatOf` and the orphan legs are re-emitted with their waveId by
+ * `run-retry.js :: retryStage1Losses`, which also carries the rationale for why an
+ * orphan is REPORTED rather than noted as a degrade.
+ *
+ * @param {{seats: Array<?object>, models: Array<string>, waveId: string}} unit
+ * @param {Array<object>} legs the retry wave's returned legs
+ * @returns {{retrySeatOf: Map<object, object>, orphanLegs: Array<object>}}
+ */
+function bindRetryWave(unit, legs) {
+  // The retry wave's roster IS unit.seats — run-retry-group.js :: recordFailure
+  // pushes models and seats in lockstep (it pushes NEITHER for the critic unit,
+  // whose pair is seeded off one `o.critic` gate at creation and never grows), and
+  // the legId `-N` suffix slot-indexes that same launch plan. `firstFailures` is a
+  // WEAKER case and is not read here — see run-retry.js's mint.
+  // A null entry means "we could not identify this seat". Why that hole is
+  // PADDED rather than filtered, and why the placeholders are tracked by
+  // identity rather than an id-name prefix test, are in the docblock of
+  // `stage1-bind.js :: bindPaddedWave` — which owns all three steps.
+  const { seatOf, bindRes } = bindPaddedWave(unit.waveId, unit.seats, i => unit.models[i], legs);
+  // The tail: this site hands its orphans back to the caller (run-retry.js ::
+  // retryStage1Losses re-emits them with their waveId).
+  return { retrySeatOf: seatOf, orphanLegs: bindRes.orphanLegs };
+}
+
+module.exports = { briefingFor, bindRetryWave };

package/src/council/run-retry-notes.js

@@ -17,36 +17,85 @@ const legEffect = (counts) =>
   `${counts.reviewed} of ${counts.total} seats reviewed; `
   + 'the run continues with the bench that did and will exit degraded (2)';
 
-/** Wave-origin, retry wave died wholesale (D5 wave granularity). */
+/**
+ * Wave-origin, retry wave died wholesale (D5 wave granularity).
+ *
+ * v4.8 PR2b Task 7: a `partial` record (stage1-bind.js's missingSeatDeadWave) is
+ * ONE seat of a wave that DID return legs, so the dead-wave sentence would be a
+ * false statement in a user-facing degrade — it names the seat instead, on the
+ * `seat-unbound` channel the other half of that join failure already uses.
+ */
 function waveStillDeadNote(w, unit) {
-  return { channel: 'dead-wave',
-    what: `Stage-1 wave ${w.waveId} (${(w.models || []).join(', ') || 'no models'}) produced NO legs`,
+  const partial = !!w.partial;
+  return { channel: partial ? 'seat-unbound' : 'dead-wave',
+    what: partial
+      ? `seat ${(w.models || [])[0]} did not review`
+      : `Stage-1 wave ${w.waveId} (${(w.models || []).join(', ') || 'no models'}) produced NO legs`,
     // Coordinator-review MINOR-7c: a falsy w.reason must not render as the
     // literal string "undefined" in the why text.
     why: `${w.reason || 'no reason recorded'}; the once-only retry wave also produced no legs`,
     effect: 'Those seats are NOT in this council. The run continues with the bench that did '
       + 'launch and will exit degraded (2)',
-    data: { waveId: w.waveId, models: w.models, reason: w.reason, retryWaveId: unit.waveId } };
+    // `seat` rides ONLY on the partial shape: adding it unconditionally breaks
+    // degrade-channels.test.js's exact toEqual on a real dead wave. It stays the
+    // ALIAS because verdict.js:72 compares data.seat against o.critic, an alias,
+    // and because it is the same key the dead-leg shape uses — one vocabulary
+    // for one field. ⚠️ It is NOT read by the Workspace today: the kind/channel filters in
+    // live-dead-seats.js (deadSeats) and workspace-seats.js (retriedSeats), and verdict.js's
+    // own two, all admit only dead-leg/dead-wave — so nothing consumes `seat-unbound` yet.
+    // Cited by SYMBOL, not line: these three references rotted twice during v4.8 PR5c alone.
+    data: { waveId: w.waveId, models: w.models, reason: w.reason, retryWaveId: unit.waveId,
+      // v4.8 PR5c: seat identity, index-parallel with `models`, on the dead-wave arm only
+      // (the partial arm names ONE seat and rides `seat` above; `seat-unbound` has no
+      // consumer, so an array there would be unpinned surface for no gain).
+      // ⚠️ An unidentified slot emits `null`, NEVER the alias. Collapsing it onto the alias
+      // makes it indistinguishable from a second reference to that alias, and no consumer
+      // can recover the difference — deadSeats has no per-alias seat count. That collapse
+      // is what made two distinct dead twins render as a single row.
+      ...(partial ? { seat: (w.models || [])[0] } : {
+        seats: (w.models || []).map((m, i) => {
+          const so = (w.seats || [])[i];
+          return so ? so.id : null;
+        }),
+      }) } };
 }
 
-/** Leg-origin, retry wave died wholesale (bench-batch case). */
-function srcLegStillDeadNote(leg, unit, counts) {
+/**
+ * Leg-origin, retry wave died wholesale (bench-batch case).
+ *
+ * v4.8 PR5c: `seatId` is the caller's Stage-1 leg->seat binding, or null when the leg was
+ * never bound. It is a SEPARATE key from `seat`, which stays the ALIAS — verdict.js:72
+ * compares `data.seat` against `o.critic`, an alias, so re-pointing it breaks critic-loss
+ * detection. Add a key; never repurpose that one.
+ */
+function srcLegStillDeadNote(leg, unit, counts, seatId = null) {
   const seat = leg.modelInput || leg.model;
   return { channel: 'dead-leg', what: `seat ${seat} did not review`,
     why: `the leg ended '${leg.status}'${leg.error ? `: ${leg.error}` : ''} with no usable output; `
       + 'its once-only retry wave produced no legs',
     effect: legEffect(counts),
-    data: { seat, status: leg.status, reason: leg.error || null, retryWaveId: unit.waveId } };
+    data: { seat, seatId: seatId || null, status: leg.status, reason: leg.error || null,
+      retryWaveId: unit.waveId } };
 }
 
-/** Either origin, the retry produced legs but THIS seat's retry leg died. */
+/**
+ * Either origin, the retry produced legs but THIS seat's retry leg died.
+ *
+ * A 'missing' first failure has a `reason` and a `waveId` but NEVER a `status` —
+ * the leg arm would report that its first leg "ended 'undefined'" for a seat
+ * that never had a first leg at all.
+ */
 function retryLegStillDeadNote(seat, ff, retryLeg, unit, counts) {
+  const missing = !!(ff && ff.class === 'missing');
   const why = ff && ff.class === 'wave'
     ? `its first wave ${ff.waveId} produced no legs (${ff.reason}); `
       + `its once-only retry leg ended '${retryLeg.status}' with no usable output`
-    : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} `
-      + `with no usable output; its once-only retry also ended '${retryLeg.status}'`;
-  return { channel: 'dead-leg', what: `seat ${seat} did not review`, why,
+    : missing
+      ? `${ff.reason} in wave ${ff.waveId}; its once-only retry leg ended `
+        + `'${retryLeg.status}' with no usable output`
+      : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} `
+        + `with no usable output; its once-only retry also ended '${retryLeg.status}'`;
+  return { channel: missing ? 'seat-unbound' : 'dead-leg', what: `seat ${seat} did not review`, why,
     effect: legEffect(counts),
     data: { seat, status: retryLeg.status, reason: retryLeg.error || null,
       firstFailure: ff, retryWaveId: unit.waveId } };
@@ -62,10 +111,13 @@ function retryLegStillDeadNote(seat, ff, retryLeg, unit, counts) {
  * this time.
  */
 function missingLegStillDeadNote(seat, ff, unit, counts) {
+  const missing = !!(ff && ff.class === 'missing');
   const fact = ff && ff.class === 'wave'
     ? `its first wave ${ff.waveId} produced no legs (${ff.reason})`
-    : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} with no usable output`;
-  return { channel: 'dead-leg', what: `seat ${seat} did not review`,
+    : missing
+      ? `${ff.reason} in wave ${ff.waveId}`
+      : `the leg ended '${ff ? ff.status : 'unknown'}'${ff && ff.reason ? `: ${ff.reason}` : ''} with no usable output`;
+  return { channel: missing ? 'seat-unbound' : 'dead-leg', what: `seat ${seat} did not review`,
     why: `${fact}; its once-only retry produced no leg for this seat`,
     effect: legEffect(counts),
     data: { seat, status: null, reason: null, firstFailure: ff, retryWaveId: unit.waveId } };