amicus 4.7.0 → 4.8.0

package/src/council/run-retry.js

@@ -14,142 +14,64 @@
  * only.
  */
 
-const briefings = require('./briefings');
 const { materializeReviews, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
+const { resolveNoOutputBackstopMs } = require('../utils/no-output-backstop');
 const { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote }
   = require('./run-retry-notes');
-
-/** 1-based lens index for a loss, from the waveId convention or the model. */
-function lensIndexOf(o, waveId, model) {
-  const m = /-l(\d+)$/.exec(waveId || '');
-  if (m) { return Number(m[1]); }
-  const i = (o.models || []).indexOf(model);
-  return i === -1 ? null : i + 1;
-}
-
-/**
- * Dedup helper (Task-4 review hardening): the same seat can arrive twice in
- * one grouping pass — two dead legs naming it, or a dead wave and a dead leg
- * both naming it. One seat must still mean ONE `firstFailures` entry — first
- * occurrence wins — while every SOURCE record is kept regardless (srcWaves/
- * srcLegs are the audit trail and are never deduped). The critic unit's
- * `.models` is fixed at creation (there is only ever one critic seat), so
- * only bench/lens units grow `.models` here — the critic call sites pass
- * `trackModel: false`.
- */
-function recordFailure(unit, seat, ff, trackModel = true) {
-  if (unit.firstFailures.some(f => f.seat === seat)) { return; }
-  unit.firstFailures.push(ff);
-  if (trackModel) { unit.models.push(seat); }
-}
-
-/**
- * Group Stage-1 losses into retry units. Pure — no I/O.
- * Bench losses (a dead bench wave's models + dead bench legs) collapse into
- * ONE retry wave; the critic and each lens retry as solos (their briefings
- * differ). Stable order: bench, critic, lenses ascending. The critic matches
- * on EITHER carrier — waveId convention or model — mirroring
- * verdict.js summarizeSeatLoss.
- */
-function groupStage1Losses(o, deadWaves = [], deadLegs = []) {
-  const isCriticWave = (w) =>
-    w.waveId === `${o.runId}-c1` || (!!o.critic && (w.models || []).includes(o.critic));
-  const bench = { unit: 'bench', waveId: `${o.runId}-s1r1`, retryOfWaveId: `${o.runId}-s1`,
-    models: [], firstFailures: [], srcWaves: [], srcLegs: [] };
-  const lensUnits = new Map(); // lensIndex (number, or null for unmappable) -> unit
-  const criticUnit = { unit: 'critic', waveId: `${o.runId}-c1r1`, retryOfWaveId: `${o.runId}-c1`,
-    models: o.critic ? [o.critic] : [], firstFailures: [], srcWaves: [], srcLegs: [] };
-
-  const lensUnitFor = (i) => {
-    if (!lensUnits.has(i)) {
-      // Task-4 review hardening: an unmappable loss (lensIndexOf resolved
-      // neither the waveId convention nor a model-roster membership) must
-      // still be GROUPABLE — dropping it here would let it vanish before the
-      // orchestrator ever sees it — but must not manufacture a fake
-      // `-lnullr1` waveId. The orchestrator refuses to launch any unit with
-      // `lensIndex === null` and routes its sources to skipped instead.
-      lensUnits.set(i, i === null
-        ? { unit: 'lens', lensIndex: null, waveId: null, retryOfWaveId: null,
-          models: [], firstFailures: [], srcWaves: [], srcLegs: [] }
-        : { unit: 'lens', lensIndex: i, waveId: `${o.runId}-l${i}r1`,
-          retryOfWaveId: `${o.runId}-l${i}`, models: [], firstFailures: [], srcWaves: [], srcLegs: [] });
-    }
-    return lensUnits.get(i);
-  };
-
-  for (const w of deadWaves) {
-    const models = w.models || [];
-    if (o.lenses) {
-      const u = lensUnitFor(lensIndexOf(o, w.waveId, models[0]));
-      u.srcWaves.push(w);
-      models.forEach(seat => recordFailure(u, seat, { seat, class: 'wave', waveId: w.waveId, reason: w.reason }));
-    } else if (isCriticWave(w)) {
-      criticUnit.srcWaves.push(w);
-      recordFailure(criticUnit, o.critic,
-        { seat: o.critic, class: 'wave', waveId: w.waveId, reason: w.reason }, false);
-    } else {
-      bench.srcWaves.push(w);
-      models.forEach(seat => recordFailure(bench, seat, { seat, class: 'wave', waveId: w.waveId, reason: w.reason }));
-    }
-  }
-  for (const leg of deadLegs) {
-    const seat = leg.modelInput || leg.model;
-    const ff = { seat, class: 'leg', status: leg.status, reason: leg.error || null };
-    if (o.lenses) {
-      const u = lensUnitFor(lensIndexOf(o, null, seat));
-      u.srcLegs.push(leg);
-      recordFailure(u, seat, ff);
-    } else if (o.critic && seat === o.critic) {
-      criticUnit.srcLegs.push(leg);
-      recordFailure(criticUnit, seat, ff, false);
-    } else {
-      bench.srcLegs.push(leg);
-      recordFailure(bench, seat, ff);
-    }
-  }
-
-  const out = [];
-  // Task-4 review hardening: gate on whether the unit received any SOURCE
-  // record, not on firstFailures.length — a zero-model dead wave contributes
-  // a srcWaves entry but nothing to firstFailures/models (nothing for the
-  // `.forEach` above to iterate), and must still surface here so the
-  // orchestrator can route it to skipped instead of it vanishing silently.
-  if (bench.srcWaves.length > 0 || bench.srcLegs.length > 0) { out.push(bench); }
-  if (criticUnit.srcWaves.length > 0 || criticUnit.srcLegs.length > 0) { out.push(criticUnit); }
-  // Coordinator-review MINOR-7a: null sorts LAST (Infinity), not first (0) —
-  // an unmappable loss is not "lens index 0"; it should not perturb the
-  // ascending order of the real, well-indexed lens retries.
-  out.push(...[...lensUnits.values()].sort((a, b) => (a.lensIndex ?? Infinity) - (b.lensIndex ?? Infinity)));
-  return out;
-}
-
-/** The briefing a retry unit re-issues — same builders Stage 1 used. */
-function briefingFor(o, unit) {
-  if (unit.unit === 'critic') { return briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }); }
-  if (unit.unit === 'lens') {
-    return briefings.buildLensBriefing({ lens: o.lenses[unit.lensIndex - 1], briefing: o.briefing, date: o.date });
-  }
-  return briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date });
-}
+// briefingFor + bindRetryWave live in ./run-retry-launch (v4.8 T-A2 split); the pad/bind core it wraps is stage1-bind.js :: bindPaddedWave (SI-27).
+const { briefingFor, bindRetryWave } = require('./run-retry-launch');
+// Loss grouping lives in ./run-retry-group (v4.8 PR0 size-gate split).
+// groupStage1Losses is re-exported below — run-retry.test.js imports it
+// from here.
+const { groupStage1Losses, planStillDeadSources, seatKey, twinAliases, legLossKey,
+  srcLegClaimer } = require('./run-retry-group');
 
 /**
  * The retry pass. Serial by design (spec D-order: bench, critic, lenses) —
  * the per-wave-fallback path, where waves actually die, is exactly where
  * concurrent relaunches would race the same server start again.
  */
-async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts = { reviewed: 0, total: 0 } } = {}) {
+async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [],
+  counts = { reviewed: 0, total: 0 }, seatOf = new Map() } = {}) {
   const { o, launchers } = ctx;
-  const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [],
+  // v4.8 T-A6 (SI-TWINS): THE run's one `twinAliases`. It was derived independently at four
+  // sites across three files; now it is made here and threaded to all of them — the two
+  // run-retry-group.js consumers below by argument, and run-stage1-rows.js through `out.twins`,
+  // which run-stages.js hands straight to `pushDeadSeatRows`. Two collections that disagree is
+  // the desync mutants DESYNCLEG and DESYNCPLAN pin: a retried twin re-acquires its own FIRST
+  // leg, which already carries a `superseded` row, so that leg is billed twice.
+  const twins = twinAliases(o.seats);   // the roster's repeated aliases (v4.8 T2.2)
+  // `seatOf`/`orphanLegs` are part of the CONTRACT, not a debugging aid: a
+  // recovered leg is a RETRY-wave object Stage-1's seatOf has never seen, so
+  // without publishing these bindings every healed seat re-materializes
+  // unattributed downstream (spec §4.4).
+  // `attemptedSeats` (v4.8 PR2b Task 8): the seat-keyed "was this seat actually
+  // retried?" gate. Structured data, never a scan of stillDeadNotes — the full
+  // rationale sits at run-stage1-rows.js's fallback, its only consumer.
+  // `twins` rides on the return for the same reason `seatOf` does: the consumer must ask with
+  // the collection this pass minted with, not one it re-derives (v4.8 T-A6).
+  const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [], twins,
     stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [],
-    stillDeadRetryLegs: [] };
+    stillDeadRetryLegs: [], seatOf: new Map(), orphanLegs: [], attemptedSeats: new Set() };
+  // Task 5 (#129): SL-2 retries the SAME model under the SAME conditions, so a
+  // latency failure is structurally unhealable. Double the window, clamped to
+  // the leg timeout so the failure CLASS stays NO_OUTPUT_BACKSTOP rather than
+  // silently becoming an ordinary timeout at a low --timeout. 2*0 === 0 keeps
+  // the disable hatch. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
+  // ⚠️ #135 C0 took this 240s -> 600s; deliberate, see CHANGELOG (council A1, PR #182).
+  const legTimeoutMs = (o.timeout || 15) * 60 * 1000;
+  const escalatedBackstopMs = Math.min(
+    2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs()),
+    legTimeoutMs,
+  );
 
-  for (const unit of groupStage1Losses(o, deadWaves, deadLegs)) {
+  for (const unit of groupStage1Losses(o, deadWaves, deadLegs, seatOf, twins)) {
     // Task-4 review hardening: a unit this pass cannot even ATTEMPT — an
     // unmappable lens loss (no carrier resolved an index), a lens index
     // outside the run's actual lens roster (coordinator-review MINOR-7b: a
     // malformed waveId like "...-l99" must not become an out-of-range
-    // `o.lenses[98]` access inside briefingFor), or a unit whose sources
+    // `o.lenses[98]` access inside run-retry-launch.js's briefingFor), or a unit whose sources
     // named zero models — is never launched. Its sources fall back to the
     // ordinary skipped-loss path so the caller's normal degrade notes still
     // fire; being unmappable is not an exemption from the record.
@@ -171,7 +93,8 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts =
       councilRunId: o.runId, councilName: o.councilName,
       tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
       fallback: o.fallback, catalog: o.catalog,
-      waveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, prompt: briefingFor(o, unit) };
+      waveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, prompt: briefingFor(o, unit),
+      noOutputBackstopMs: escalatedBackstopMs };
     // Dispatch by UNIT TYPE, not model count (spec §4: bench is always a wave —
     // even down to its last surviving seat — critic/lens are always solos).
     // A model-count proxy (`models.length === 1`) is wrong for a bench unit
@@ -184,6 +107,56 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts =
     if (isAbortExit(res.exitCode)) { out.aborted = res.exitCode; return out; }
 
     const legs = (res.wave && Array.isArray(res.wave.legs)) ? res.wave.legs : [];
+    const { retrySeatOf, orphanLegs } = bindRetryWave(unit, legs);
+    for (const [l, s] of retrySeatOf) { out.seatOf.set(l, s); }
+    // A retry leg that matches no roster slot is the same attribution failure
+    // Stage-1 announces — but this module emits heals ONLY and never notes a
+    // degrade (see the @module docblock), so it is REPORTED here and emitted by
+    // the caller, exactly as stillDeadNotes already are.
+    for (const leg of orphanLegs) { out.orphanLegs.push({ waveId: unit.waveId, leg }); }
+    // Every seat this unit LAUNCHED for, keyed exactly the way recordFailure
+    // keyed it: the identified seat's id, else the alias.
+    // ⚠️ v4.8 T-A4: a key is NOT one slot. Since T2.2 two UNATTRIBUTABLE twins on one alias
+    // mint two slots that both key by that alias, and a first-wins entry collapsed them —
+    // announcing ONE dead seat where two died (B1) while every note built from it read slot
+    // 0's firstFailure (B2). So an entry carries a slot COUNT and its OWN per-slot
+    // firstFailures. Only `unit.models` — the launch PLAN — mints: srcWaves/srcLegs are the
+    // union safety net the reconcile below rests on, and must leave a key at >=1 without
+    // inflating one that arrives through both. Inflating it manufactures a phantom dead seat.
+    // ⚠️ v4.8 H4: an alias is no longer a seat identity. A `new Map(unit.models
+    // .map(...))` lookup overwrites the duplicate key, so a twin bench resolves
+    // BOTH still-lost seats to the LAST twin — an affirmative mis-attribution,
+    // strictly worse than the `null` that says "unidentified". Every feeder
+    // below must be seat-keyed for the same reason: a MIX (['x#1','x#2','x'])
+    // can never match `seenSeats`, so a run where both twins healed would emit
+    // a phantom dead-leg degrade and exit 2.
+    const launched = new Map(); // key -> {alias, seat, slots, ffs}; alias is what notes render
+    const addLaunched = (s, alias, ff, mint = false) => {
+      const k = seatKey(s, alias);
+      if (!launched.has(k)) { launched.set(k, { alias, seat: s || null, slots: 0, ffs: [] }); }
+      if (mint) { const rec = launched.get(k); rec.slots += 1; rec.ffs.push(ff || null); }
+    };
+    // NOT lockstep by construction — recordFailure pushes `firstFailures` always but models/seats
+    // only `if (trackModel)`. Slot i is one seat's whole record EMERGENTLY, on two measured facts:
+    // no unit MIXES the flag (bench/lens sites pass true, both critic sites false), so a tracking
+    // unit grows all three together; and the critic unit's `firstFailures` caps at 1 — its INEXACT
+    // arm needs `twins.has(o.critic)` with a null `criticSeatObj`, and `twins` IS `twinAliases(o.seats)`,
+    // so the first implies the second non-null. The one MEASURED break (a `-c1` wave, no `o.critic`:
+    // ff 1 / models 0) the `models.length === 0` skip above ate. Pinned: run-retry-lockstep.test.js.
+    unit.models.forEach((m, i) => addLaunched(unit.seats[i] || null, m, unit.firstFailures[i], true));
+    for (const w of unit.srcWaves) {
+      (w.models || []).forEach((m, i) => addLaunched((w.seats || [])[i] || null, m));
+    }
+    for (const l of unit.srcLegs) { addLaunched(seatOf.get(l) || null, l.modelInput || l.model); }
+    // A Stage-1 source leg's key, from the binding Stage 1 published for it.
+    const srcLegKey = l => seatKey(seatOf.get(l) || null, l.modelInput || l.model);
+    // v4.8 T2.2: ONE source per still-dead outcome (srcLegs.find handed the first one
+    // out twice, so the second orphaned twin left no record), and the ROW key that seat
+    // will be looked up by downstream. Both move with recordFailure's dedup or a retried
+    // twin re-acquires its own first leg — which already has a `superseded` row, so that
+    // leg's cost lands in runStats twice while its retry leg lands nowhere.
+    const claimSrc = srcLegClaimer(unit.srcLegs, srcLegKey);
+    const srcRowKey = l => legLossKey(seatOf.get(l) || null, l.modelInput || l.model, l, twins);
     if (legs.length === 0) {
       // The retry wave itself died wholesale — final failure keeps each
       // source's granularity (D5): wave-origin stays a dead-wave, leg-origin
@@ -195,32 +168,46 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts =
       // the "wave wins" precedent from the grouping-level dedup); a seat
       // already covered by its wave's note is skipped when its srcLeg is
       // reached.
-      const notedSeats = new Set();
+      // v4.8 PR5c: the srcWave/srcLeg dedup lives in run-retry-group.planStillDeadSources —
+      // an unidentified wave slot and a bound leg for the same seat key in DIFFERENT
+      // spaces, so a naive test announces one seat twice. See that helper for the budget.
+      const plan = planStillDeadSources(unit, seatOf, o.seats, twins);
       for (const w of unit.srcWaves) {
         out.stillDeadNotes.push(waveStillDeadNote(w, unit));
         out.stillDeadWaves.push(w);
-        for (const m of (w.models || [])) { notedSeats.add(m); }
       }
-      for (const l of unit.srcLegs) {
-        const seat = l.modelInput || l.model;
-        if (notedSeats.has(seat)) { continue; }
-        notedSeats.add(seat);
-        out.stillDeadNotes.push(srcLegStillDeadNote(l, unit, counts));
-        out.stillDeadLegs.push(l);
+      for (const k of plan.attempted) { out.attemptedSeats.add(k); }
+      for (const { leg, seatId } of plan.legs) {
+        out.stillDeadNotes.push(srcLegStillDeadNote(leg, unit, counts, seatId));
+        out.stillDeadLegs.push(leg);
       }
       continue;
     }
-    const usable = new Set(materializeReviews(o.runDir, legs).map(m => m.leg));
-    const seenSeats = new Set(legs.map(leg => leg.modelInput || leg.model));
-    const lostWaveSeats = new Map(); // waveId -> seats still lost from a wave-origin
+    const usable = new Set(materializeReviews(o.runDir, legs, retrySeatOf).map(m => m.leg));
+    // Seat-keyed off THIS wave's own bindings (an unbound leg keys by alias,
+    // matching how its unidentified roster slot was keyed above).
+    // v4.8 T-A4: a COUNT, not a presence Set — two unattributable twins share one key, so
+    // "was it seen at all?" cannot tell one returned leg from two. Filled by the loop below,
+    // which visits every leg (including one skipped for having no slot, as `legs.map` did).
+    const seenSeats = new Map(); // key -> legs this wave returned for it
+    const lostWaveSeats = new Map(); // waveId -> [{alias, seat}] still lost from a wave-origin
     for (const leg of legs) {
-      const seat = leg.modelInput || leg.model;
-      const ff = unit.firstFailures.find(f => f.seat === seat) || null;
+      const seat = leg.modelInput || leg.model; // ALIAS — what every note renders
+      const bound = retrySeatOf.get(leg) || null;
+      const key = seatKey(bound, seat);
+      // This leg answers the key's NEXT unanswered slot, and reads THAT slot's own
+      // firstFailure (T-A4 B2). Counted BEFORE the `!ff` skip below, so the tally the
+      // reconcile reads still means "legs this wave returned for the key".
+      const slot = seenSeats.get(key) || 0;
+      seenSeats.set(key, slot + 1);
+      const ff = (launched.get(key) || { ffs: [] }).ffs[slot] || null;
       // SL-2 fix-wave: a retry response should only ever name seats THIS unit
-      // launched for (unit.models is built in lockstep with firstFailures via
-      // groupStage1Losses's recordFailure) — but if a leg turns up for a seat
-      // with no firstFailures entry, that seat never lost its seat in the
-      // first place. Skip it entirely: no heal (it would fabricate an "ended
+      // launched for (`unit.models` is index-parallel to `firstFailures` EMERGENTLY,
+      // for the two reasons the mint above states) — but if a leg turns up for a seat
+      // with no firstFailures entry, or (v4.8 T-A4) beyond the LAST slot its key
+      // minted, that seat never lost its seat in the first place. `slots` is an
+      // upper bound as well as a lower one, and this is where the upper half is
+      // spent. Skip it entirely: no heal (it would fabricate an "ended
       // 'unknown'" why for a seat that never failed) and no still-dead note —
       // the seat's first-attempt review stands untouched, rather than this
       // stray leg doubling it into a duplicate bench entry alongside the real one.
@@ -229,20 +216,32 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts =
         out.recoveredLegs.push(leg);
         ctx.degrade.note({ channel: 'stage1-retry', kind: 'heal',
           what: `seat ${seat} reviewed on retry`,
-          why: ff && ff.class === 'wave'
+          // A 'missing' ff (a seat whose leg never came back) has a reason and a
+          // waveId but NEVER a status — the leg arm would render "ended
+          // 'undefined'" for a seat that never had a leg at all.
+          why: ff.class === 'wave'
             ? `its first wave ${ff.waveId} produced no legs (${ff.reason}) and was relaunched once`
-            : `its first leg ended '${ff ? ff.status : 'unknown'}' with no usable output and was relaunched once`,
+            : ff.class === 'missing'
+              ? `${ff.reason} in wave ${ff.waveId}, and it was relaunched once`
+              : `its first leg ended '${ff ? ff.status : 'unknown'}' with no usable output and was relaunched once`,
           effect: 'The seat is in this council; nothing was lost',
           data: { seat, retryWaveId: unit.waveId, retryOfWaveId: unit.retryOfWaveId, firstFailure: ff } });
       } else {
         out.stillDeadNotes.push(retryLegStillDeadNote(seat, ff, leg, unit, counts));
+        out.attemptedSeats.add(key);
         out.stillDeadRetryLegs.push(leg);
-        if (ff && ff.class === 'wave') {
+        // Both WAVE-origin classes route here: a 'missing' loss carries a
+        // waveId and no srcLeg, so the else branch would drop it from every
+        // array. Task-6 carry: an UNBINDABLE retry leg leaves `bound` null
+        // where the roster slot was known — fall back to the launched record
+        // rather than publishing seats:[null]. Never a guess: this line is
+        // reachable only when `key` is already in `launched`.
+        if (ff.class !== 'leg') {
           if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
-          lostWaveSeats.get(ff.waveId).push(seat);
+          lostWaveSeats.get(ff.waveId).push({ alias: seat, seat: bound || (launched.get(key) || {}).seat || null });
         } else {
-          const src = unit.srcLegs.find(l => (l.modelInput || l.model) === seat);
-          if (src) { out.stillDeadLegs.push(src); }
+          const src = claimSrc(key);
+          if (src) { out.stillDeadLegs.push(src); out.attemptedSeats.add(srcRowKey(src)); }
         }
       }
     }
@@ -250,31 +249,49 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [], counts =
     // that came back WITH a leg record. A partial wave return (unit models
     // [a,b], the wave comes back with only a's leg) leaves 'b' invisible to
     // that loop entirely — no heal, no still-dead note, no skip: it would
-    // vanish from every array. Reconcile against the full launched-seat set
-    // (the union of unit.models, every srcWave's models, and every srcLeg's
-    // seat — not just unit.models alone, so this holds even if some future
-    // change to the grouping made unit.models an incomplete union) so every
-    // launched seat lands in exactly one of recovered / still-dead / skipped.
-    const launchedSeats = new Set(unit.models);
-    for (const w of unit.srcWaves) { for (const m of (w.models || [])) { launchedSeats.add(m); } }
-    for (const l of unit.srcLegs) { launchedSeats.add(l.modelInput || l.model); }
-    for (const seat of launchedSeats) {
-      if (seenSeats.has(seat)) { continue; } // already handled above (healed or still-dead)
-      const ff = unit.firstFailures.find(f => f.seat === seat) || null;
-      out.stillDeadNotes.push(missingLegStillDeadNote(seat, ff, unit, counts));
-      if (ff && ff.class === 'wave') {
-        if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
-        lostWaveSeats.get(ff.waveId).push(seat);
-      } else {
-        const src = unit.srcLegs.find(l => (l.modelInput || l.model) === seat);
-        if (src) { out.stillDeadLegs.push(src); }
+    // vanish from every array. Reconcile against `launched` — the union of
+    // unit.models, every srcWave's models and every srcLeg's seat, not
+    // unit.models alone, so this holds even if some future change to the
+    // grouping made unit.models an incomplete union — so every launched SLOT
+    // lands in exactly one of recovered / still-dead / skipped. Slot-indexed:
+    // there is no leg here to read a binding off, so the seat comes from the
+    // roster slot itself, never from an alias lookup.
+    for (const [key, rec] of launched) {
+      // v4.8 T-A4: `max(slots, 1) - seen` notes, not a presence test. `max(…, 1)` is what
+      // keeps the union net a net: feeders 2 and 3 mint no slot, so a key only THEY know
+      // still reconciles exactly ONCE, and a seat that arrives through both the launch plan
+      // and a srcLeg is counted by the plan alone. `rec.seat` is shared across a key's slots
+      // and that is sound: two slots can only share a key when NEITHER was identified (an
+      // identified slot keys by its own seat id), so every slot of such a key has seat null.
+      for (let i = seenSeats.get(key) || 0; i < Math.max(rec.slots, 1); i++) {
+        const ff = rec.ffs[i] || null;
+        out.stillDeadNotes.push(missingLegStillDeadNote(rec.alias, ff, unit, counts));
+        out.attemptedSeats.add(key);
+        if (ff && ff.class !== 'leg') {   // wave-origin, incl. a 'missing' seat
+          if (!lostWaveSeats.has(ff.waveId)) { lostWaveSeats.set(ff.waveId, []); }
+          lostWaveSeats.get(ff.waveId).push({ alias: rec.alias, seat: rec.seat });
+        } else {
+          const src = claimSrc(key);
+          if (src) { out.stillDeadLegs.push(src); out.attemptedSeats.add(srcRowKey(src)); }
+        }
       }
     }
     // Wave-origin seats still lost: the return-contract wave entry carries only
     // the still-lost subset (a partially healed wave is not wholly dead).
+    // `seats` is narrowed in LOCKSTEP with `models`, or run-stage1-rows.js's
+    // dead-seat loop index-zips a healed seat against a lost seat's alias.
+    // Since v4.8 a wave can contribute SEVERAL srcWave records sharing one
+    // waveId (one per missing seat, stage1-bind.js's missingSeatDeadWave), so
+    // the lookup fires once per waveId — not once per record, which would push
+    // every still-lost seat of that wave N times.
+    const reconciled = new Set();
     for (const w of unit.srcWaves) {
+      if (reconciled.has(w.waveId)) { continue; }
+      reconciled.add(w.waveId);
       const lost = lostWaveSeats.get(w.waveId) || [];
-      if (lost.length > 0) { out.stillDeadWaves.push({ ...w, models: lost }); }
+      if (lost.length > 0) {
+        out.stillDeadWaves.push({ ...w, models: lost.map(x => x.alias), seats: lost.map(x => x.seat) });
+      }
     }
   }
   return out;

package/src/council/run-stage1-launch.js

@@ -9,10 +9,17 @@
 const briefings = require('./briefings');
 const runState = require('./run-state');
 const { isAbortExit } = require('./run-launch');
+const { buildSeats } = require('./seats');
 
 /** Launch all Stage-1 legs (wave + critic/lens solos), collect run docs. */
 async function launchStage1(ctx) {
   const { o, launchers } = ctx;
+  // Seat identity for THIS launch. run.js:133 sets o.seats from asm.preflightSeats;
+  // buildSeats is pure and total, so a direct require() caller or a legacy run dir
+  // reconstructs the same table rather than binding nothing (spec §4.3).
+  const seats = Array.isArray(o.seats) && o.seats.length > 0
+    ? o.seats
+    : buildSeats(o.models, o.critic, o.lenses);
   // `noCostGate` rides EVERY launch object in this file (here, the findings
   // repair, the judge wave, the judge repair) — see run-launch.js's fanout call.
   const common = {
@@ -37,27 +44,32 @@ async function launchStage1(ctx) {
     o.models.forEach((m, i) => {
       const waveId = `${o.runId}-l${i + 1}`;
       record(waveId);
-      seated.push({ waveId, models: [m] });
+      seated.push({ waveId, models: [m], roster: seats.slice(i, i + 1) });
       launches.push(launchers.launchSolo({
-        ...common, model: m, waveId,
+        ...common, model: m, waveId, seats: seated[seated.length - 1].roster,
         prompt: briefings.buildLensBriefing({ lens: o.lenses[i], briefing: o.briefing, date: o.date }),
       }));
     });
   } else {
-    const seats = o.models.filter(m => m !== o.critic);
-    if (seats.length > 0) {
+    const seats1 = o.models.filter(m => m !== o.critic);
+    if (seats1.length > 0) {
       record(`${o.runId}-s1`);
-      seated.push({ waveId: `${o.runId}-s1`, models: seats.slice() });
+      // MUST mirror :54's `m !== o.critic` exactly. Filtering on `s.id !== o.criticSeat`
+      // instead would drop ONE twin where the alias filter drops BOTH, shifting every
+      // legId slot by one on a bench preflightSeats never saw.
+      seated.push({ waveId: `${o.runId}-s1`, models: seats1.slice(),
+        roster: seats.filter(s => s.alias !== o.critic) });
       launches.push(launchers.launchWave({
-        ...common, models: seats, waveId: `${o.runId}-s1`,
+        ...common, models: seats1, waveId: `${o.runId}-s1`, seats: seated[seated.length - 1].roster,
         prompt: briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date }),
       }));
     }
     if (o.critic) {
       record(`${o.runId}-c1`);
-      seated.push({ waveId: `${o.runId}-c1`, models: [o.critic] });
+      seated.push({ waveId: `${o.runId}-c1`, models: [o.critic],
+        roster: seats.filter(s => s.alias === o.critic).slice(0, 1) });
       launches.push(launchers.launchSolo({
-        ...common, model: o.critic, waveId: `${o.runId}-c1`,
+        ...common, model: o.critic, waveId: `${o.runId}-c1`, seats: seated[seated.length - 1].roster,
         prompt: briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }),
       }));
     }
@@ -66,12 +78,17 @@ async function launchStage1(ctx) {
   let aborted = null;
   const legs = [];
   const deadWaves = [];
+  const waves = [];
   results.forEach((r, i) => {
     ctx.addWave(r.wave);
     const abort = isAbortExit(r.exitCode);
     if (abort) { aborted = r.exitCode; }
     const got = (r.wave && Array.isArray(r.wave.legs)) ? r.wave.legs : [];
     legs.push(...got);
+    // Per-wave partition, captured BEFORE the flatten above erases attribution.
+    // bindSeats is called once per entry by the consumer; a wave that produced
+    // nothing still gets an entry so its roster is never lost.
+    waves.push({ waveId: seated[i].waveId, roster: seated[i].roster, legs: got });
     // ⚠️ Step 10's uncovered half. A wave that died BEFORE its legs (the server
     // never started; `database is locked`) contributes NOTHING to `legs`, so
     // deadLegs cannot see it either — which is how run v441plan01 recorded
@@ -83,12 +100,12 @@ async function launchStage1(ctx) {
     if (got.length > 0 || abort) { return; }
     if (r.errorDoc && r.errorDoc.code === 'BUDGET_EXCEEDED') { return; }
     deadWaves.push({
-      waveId: seated[i].waveId, models: seated[i].models,
+      waveId: seated[i].waveId, models: seated[i].models, seats: seated[i].roster,
       reason: (r.wave && (r.wave.reason || r.wave.error))
         || (r.errorDoc && r.errorDoc.message) || 'the wave produced no legs',
     });
   });
-  return { aborted, legs, deadWaves };
+  return { aborted, legs, deadWaves, waves };
 }
 
 module.exports = { launchStage1 };