amicus 4.7.0 → 4.8.0

package/src/council/run-stage1-rows.js

@@ -0,0 +1,220 @@
+// src/council/run-stage1-rows.js
+'use strict';
+// Superseded-seat rows + primary-error dead-seat rows (v4.7 D2/E4), moved
+// verbatim from run-stages.js:230-279 (v4.8 PR0 size-gate split, zero
+// behavior). The code ran inline in runStage1; it is now a function.
+// roleFor and seatOf are PARAMETERS, not requires — requiring them back from
+// run-stages would recreate the parent-child cycle that file's tail comment
+// documents eliminating (v4.4.1 F5).
+const { buildRunStatsEntry } = require('./run-assemble');
+// The one keyspace. It lives in ./run-retry-keys (v4.8 Phase 2 T-A1), which IS require-free;
+// run-retry-group.js re-exports it and requires nothing else, so this import's closure
+// terminates at a leaf and cannot re-create the parent-child cycle the header above
+// documents eliminating.
+const { twinAliases, legLossKey } = require('./run-retry-group');
+// v4.8 T-A6 size-gate split: the SUPERSEDED half of these rows moved to
+// ./run-stage1-superseded, taking `../utils/degrade` and the default stderr sink with it.
+// `degrade` is still a parameter HERE, forwarded unchanged, so a caller that omits it still
+// gets that stderr sink — and since council C1 so does one that passes `null` or a `.note`-less
+// object, because that module now resolves the sink by testing the method rather than by a
+// destructuring default. That module requires exactly the two modules the moved block already
+// required from this file — ./run-assemble and ../utils/degrade — so the split adds no import
+// edge the tree did not already carry, and the parent-child cycle the header above documents
+// eliminating stays eliminated. Re-exported at the foot of this file, which is what gives the
+// extraction a second import path to pin function identity across.
+const { supersededRows } = require('./run-stage1-superseded');
+
+/**
+ * Push superseded-seat and primary-error dead-seat rows onto extraRows.
+ *
+ * v4.8 PR2b Task 8: every alias->leg join below is SEAT-keyed. An alias is not
+ * a seat identity: two dead twins used to collapse into ONE dead-seat row, and
+ * one twin's first leg could be handed to the other twin as its "final" leg.
+ *
+ * ⚠️ `seatOf` MUST be the Stage-1 ∪ retry union (run-stages.js's `allSeatOf`).
+ * `retry.recoveredLegs` and `retry.stillDeadRetryLegs` are RETRY-wave leg
+ * objects that Stage-1's own object-keyed map has never seen, so a Stage-1-only
+ * map makes every lookup here return undefined and the whole re-key inert.
+ *
+ * ⚠️ The row's `model` stays the ALIAS (spec §4.7): a seat id must never appear
+ * in a ledger row, because pickFallbackChair launches `top.aliases[0]` and
+ * 'deepseek#2' is not routable. Two RUNSTATS rows both reading
+ * `model: 'deepseek'` remains the CORRECT outcome for two dead twins — runStats
+ * is row-per-launch and both seats were paid for. What changed in v4.8 PR4b is
+ * downstream: the ledger now groups by (model, resolvedModel), so the LEDGER row
+ * count for two dead twins depends on whether their seats produced a leg at all.
+ * Two dead twins whose seats produced NO leg (`finalLeg` null — the srcLegStillDead
+ * and missingLegStillDead classes below) share the empty resolved key and collapse
+ * into ONE ledger row. Two whose still-dead RETRY legs came back resolved
+ * DIFFERENTLY still produce TWO, keyed by executable: retryLegBySeat (below)
+ * surfaces a real leg, and buildRunStatsEntry stamps `resolvedModel` from
+ * `leg.model` whether that leg succeeded or not. Either way runStats keeps two rows.
+ * ⚠️ v4.8 council A1 NARROWED that second sentence: it holds for a twin whose retry leg
+ * was IDENTIFIED (the retryLegBySeat path). An UNATTRIBUTED twin's row now takes only a
+ * borrowed leg's `usage` and NO `resolvedModel`, so two of those share the empty resolved
+ * key and collapse into ONE ledger row — the same outcome as the no-leg classes above.
+ * MEASURED against buildLedgerRows, not reasoned: two such rows whose borrowed legs
+ * resolved DIFFERENTLY gave 2 ledger rows before and give 1 now; two that resolved the
+ * SAME gave 1 either way. Nothing about spend moves — a ledger row carries no cost field
+ * at all (`buildLedgerRows`' keys are stats, not usage), and runStats, which IS what the
+ * run total is summed from, still keeps two rows carrying both legs' `usage`. What the
+ * ledger loses is an executable split that `shift()` assigned by arrival order.
+ */
+function pushDeadSeatRows({ o, retry, deadLegs0, stillDeadLegs, stillDeadWaves, extraRows,
+  roleFor, seatOf, degrade, twins = twinAliases(o.seats) }) {
+  // A leg's join key: its bound seat's id, else its alias — the same fallback
+  // `run-retry-keys.js :: seatKey` (imported by run-retry.js since v4.8 T-A1) uses
+  // for a roster slot it could not identify, so both sides of every lookup agree.
+  const keyOf = (leg) => { const s = seatOf.get(leg); return s ? s.id : (leg.modelInput || leg.model); };
+  // v4.8 T2.2 ruling R2, the LEG arms' MINT branch: on an alias the roster repeats, an
+  // unbound leg's `keyOf` names BOTH twins, so N dead legs collapsed into ONE row.
+  // `legLossKey` falls back to the leg's own taskId there — a real per-leg id, not an
+  // inferred seat. It is identical to `keyOf` everywhere else, so only the twin case
+  // moves. Deliberately NOT used for `supersededKeys` — which since v4.8 T-A6 lives in
+  // `run-stage1-superseded.js :: supersededRows` — nor for `retryLegBySeat` below:
+  // those join FIRST-attempt legs against RETRY legs, two different leg populations
+  // whose taskIds can never match, and minting there would silently drop the
+  // superseded row of every twin whose retry healed.
+  // v4.8 T-A6 (SI-TWINS): `twins` is the run's ONE `twinAliases`, threaded in — run-stages.js
+  // passes `retry.twins`, the very collection `run-retry.js :: retryStage1Losses` minted every
+  // `attemptedSeats` key with. The default is for direct callers (several suites hand this
+  // function a fixture `retry` with no `twins` at all), and it re-derives from the SAME roster,
+  // so it agrees by construction — but only the threaded value agrees by IDENTITY.
+  const rowKeyOf = (l) => legLossKey(seatOf.get(l) || null, l.modelInput || l.model, l, twins);
+
+  // v4.7 D2/E4 superseded rows + the T-A5 invariant guard: ./run-stage1-superseded (T-A6 split).
+  // Appended HERE, before the dead-seat loop, exactly where the moved loop stood — and handed the
+  // SAME `keyOf`/`rowKeyOf` this function built, never a second derivation of either.
+  extraRows.push(...supersededRows({ retry, deadLegs0, keyOf, rowKeyOf, degrade }));
+
+  // v4.7 D2/E4 — primary error rows: one per SEAT with NO surviving review
+  // (every seat still in stillDeadLegs/stillDeadWaves after retry). E5 amended
+  // (Task-4 review, owner-ruled): run-retry.js surfaces the real retry leg
+  // (stillDeadRetryLegs), from the ONE branch it exists in —
+  // retryLegStillDeadNote, a retry leg that came back unusable. Prefer that
+  // REAL leg: status/waveId/usage/duration all real, all from the SAME attempt
+  // (no more pairing a retry's waveId with a different attempt's status). The
+  // other two dead classes — the retry wave died wholesale (srcLegStillDead),
+  // and a partial return that never named this seat (missingLegStillDead) —
+  // never get a real leg, so `leg: null` (no phantom waveId: one must never
+  // appear without a real billed leg).
+  // v4.8 T2.2: a still-dead RETRY leg that named no seat on a twin alias cannot be
+  // MATCHED to a row — but it was billed, and dropping it hides the spend that this
+  // whole change exists to record. Every unattributed row on that alias is equally
+  // dead, so they are handed out one apiece below: the SET of billed legs on the
+  // record is exact, and no row claims a seat identity (all carry seat: null).
+  // ⚠️ Which row gets which spare is arbitrary in BOTH directions, and stays arbitrary:
+  // `shift()` takes the next spare in arrival order, and the rows it feeds are the `!exact`
+  // rows of BOTH arms — so a LEG-origin retry leg can be claimed by a WAVE-origin row (a
+  // `Symbol('unattributed-seat')` slot below) whose seat produced no leg at all, and two
+  // leg-origin rows can swap. v4.8 council A1 bounds what that arbitrariness can SAY: a
+  // claimed spare is BILLING ONLY. Its `usage` rides the row, because the run paid for it
+  // and dropping it re-opens the spend hole this change exists to close; its `waveId`,
+  // `resolvedModel`, `status` and `durationMs` do NOT, because those are one seat's
+  // execution and the row is another's — a row that produced no leg would otherwise be
+  // emitted with a real attempt's duration and outcome. What remains, disclosed: the SPLIT
+  // of a known alias total across its anonymous rows is still arbitrary (row order, not
+  // identity). The SET, COUNT and SUM of billed legs are exact, and no row now asserts an
+  // execution it cannot own. Pinned by BORROWALL (a row must never differ from the leg-less
+  // row by anything but `usage`) — deleting the `usage` line reds the spend half instead.
+  const retryLegBySeat = new Map();
+  const spareRetryLegs = new Map();   // alias -> still-dead retry legs naming no seat
+  for (const leg of retry.stillDeadRetryLegs) {
+    const alias = leg.modelInput || leg.model;
+    if (seatOf.get(leg) || !twins.has(alias)) { retryLegBySeat.set(keyOf(leg), leg); continue; }
+    if (!spareRetryLegs.has(alias)) { spareRetryLegs.set(alias, []); }
+    spareRetryLegs.get(alias).push(leg);
+  }
+
+  // `exact` says the key names ONE seat; `join` is what the lookups below ask with.
+  const deadSeats = new Map();   // row key -> { seat, alias, exact, join }
+  for (const l of stillDeadLegs) {
+    const seat = seatOf.get(l) || null;
+    const alias = l.modelInput || l.model;
+    const key = rowKeyOf(l);
+    deadSeats.set(key, { seat, alias, exact: !!seat || !twins.has(alias), join: key });
+  }
+  for (const w of stillDeadWaves) {
+    // `models` and `seats` are narrowed in LOCKSTEP by run-retry.js's
+    // reconcile, so index-zipping them is safe here and nowhere else.
+    (w.models || []).forEach((alias, i) => {
+      const s = (w.seats || [])[i] || null;
+      const join = s ? s.id : alias;
+      // R2's MARK branch. This arm has no leg to mint from, and `(waveId, i)` is
+      // measurably NOT unique — missingSeatDeadWave emits several records under one
+      // waveId each with i === 0, and run-retry.js re-indexes when it narrows a
+      // partially healed wave — so inventing an id here would silently merge two
+      // distinct seats. A Symbol marks the slot instead: it cannot be joined,
+      // compared to a seat id, or mistaken for one, and the row it makes attributes
+      // nothing. The ANNOUNCEMENT is the wave's own dead-wave note, whose
+      // `data.models`/`data.seats` already carry one entry per slot (PR5c), null for
+      // the unnamed ones — which is what a reader sees instead of an id.
+      const exact = !!s || !twins.has(alias);
+      deadSeats.set(exact ? join : Symbol('unattributed-seat'), { seat: s, alias, exact, join });
+    });
+  }
+
+  for (const [, { seat, alias, exact, join }] of deadSeats) {
+    // ⚠️ Safe only because `stage1-bind.js :: bindPaddedWave` — which
+    // `run-retry-launch.js :: bindRetryWave` calls — DROPS every placeholder bind and keeps
+    // placeholder ids unique. Together they guarantee a BOUND still-dead retry leg always
+    // resolves `exact` here, never the branch below. Break that conjunction and a bound retry
+    // leg's usage is lost silently. Measured unreachable today — see BACKLOG.md's PR #170
+    // T2.2 section (the retry-leg-drop finding).
+    // ⚠️ Symbol anchors, never bare line numbers. This comment used to name those two
+    // guarantees as `(:59)`/`(:53)` into run-retry-launch.js; v4.8 SI-27 moved the block and
+    // both went out of range, and `check:citations` stayed GREEN — its CITATION regex
+    // requires a `.js` path immediately before `:NNN`, so a bare-paren line ref is invisible
+    // to the gate. A green citation gate proves nothing about that form.
+    let finalLeg = exact ? retryLegBySeat.get(join) : undefined;
+    // v4.8 council A1: claim the spare HERE, and never as `finalLeg`. It is consumed exactly
+    // as before — same pool, same `shift()`, same one-apiece hand-out, so the SET of billed
+    // legs on the record is unchanged — but it reaches the row through `usage` alone below.
+    // Mutually exclusive with the `deadLegs0` fallback: that branch runs only when
+    // `attemptedSeats` does NOT hold `join`, which is the condition this one requires.
+    const borrowed = !finalLeg && !exact && retry.attemptedSeats.has(join)
+      ? (spareRetryLegs.get(alias) || []).shift() || null
+      : null;
+    if (!finalLeg) {
+      // `retry.attemptedSeats` — never a scan of stillDeadNotes. Those notes'
+      // `data.seat` is ALIAS-valued by contract, so no twin's seat id could
+      // ever match one, and this fallback would re-attach a first-attempt leg
+      // to a seat that WAS retried. It is also channel-blind on purpose: a
+      // still-dead seat rides `dead-leg`, `dead-wave` OR `seat-unbound`
+      // depending on how it was lost, and all three mean "we retried it".
+      // ⚠️ v4.8 T2.2: `join` and `attemptedSeats` MUST move in lockstep. run-retry.js
+      // adds BOTH spellings (the seat key AND legLossKey's), so a minted row asks a
+      // question this Set can answer. Mint here alone and the predicate flips: every
+      // retried twin re-acquires its own first-attempt leg — which already has its
+      // own `superseded` row above, so that leg's cost lands in runStats twice.
+      finalLeg = retry.attemptedSeats.has(join)
+        ? null
+        : (deadLegs0.find(l => rowKeyOf(l) === join) || null);    // never retried
+    }
+    // Seat-space role (spec §4.5), matching the review push in run-stages.js:
+    // the SEAT's own role, NOT roleAt(o.seats, seat.id) — o.seats is absent on
+    // the buildSeats fallback path while the seat is not, so roleAt's unknown-id
+    // 'seat' collapses every critic/lens role. Unidentified seats keep the shim.
+    // v4.8 PR4c §3.1: `seat` is the seat OBJECT (buildRunStatsEntry compares
+    // its id to its own alias) — never `seat.id`, which would make both sides
+    // of that comparison undefined and the stamp silently inert. Null here is an
+    // orphaned seat: since v4.8 T2.2 two orphaned twins that BOTH reach this loop get
+    // TWO rows (they are two seats the run paid for), each carrying no seat at all.
+    // ⚠️ Scoped on purpose — this function emits one row per still-dead input it is GIVEN, and
+    // cannot emit a row for a seat that never arrives. When a retry wave returned FEWER legs than
+    // it launched, `run-retry.js`'s alias-granular `launched` reconcile passed only ONE of two
+    // unattributable twins, so the run showed one row. v4.8 T-A4 closed that half in the PRODUCER:
+    // it emits `max(slots, 1) - seen` notes now, so both twins arrive here. Nothing here changed.
+    const row = buildRunStatsEntry({ leg: finalLeg, model: alias, seat,
+      role: seat ? seat.role : roleFor(o, alias), wasChair: false });
+    // Overwrite rather than synthesize a leg: `buildRunStatsEntry({leg: null})` is the ONE
+    // definition of "a dead seat with nothing to report", so a borrowed row is that row plus
+    // one field, and it stays that way if the leg-less defaults ever change. A synthetic
+    // `{usage, status}` stub would fork them silently — and a bare `{usage}` stub is worse,
+    // because `leg ? leg.status : 'error'` would then stamp `status: undefined`.
+    if (borrowed) { row.usage = borrowed.usage || null; }
+    extraRows.push(row);
+  }
+}
+
+module.exports = { pushDeadSeatRows, supersededRows };

package/src/council/run-stage1-superseded.js

@@ -0,0 +1,156 @@
+// src/council/run-stage1-superseded.js
+'use strict';
+// The SUPERSEDED half of the Stage-1 extra rows, lifted out of
+// `run-stage1-rows.js :: pushDeadSeatRows` (v4.8 T-A6 size-gate split, zero behaviour): which
+// FIRST-attempt legs stop being primary, and the one invariant that join can check for itself.
+// A CLOSURE LIFT, not a byte-for-byte move — `keyOf` and `rowKeyOf` stay with the caller,
+// because the dead-seat half left behind needs both, so they ride in as parameters. And it
+// RETURNS its rows rather than pushing onto the caller's `extraRows`: an extracted helper that
+// mutates its caller's accumulator is the shape this release ruled out.
+// Its two requires are the two the moved block already had — ./run-assemble and
+// ../utils/degrade — so the split added no import edge the tree did not already carry.
+// MEASURED, not argued: their eager require closure is 13 first-party modules and contains
+// neither run-stages.js nor run-stage1-rows.js nor this file, so the parent-child cycle
+// run-stage1-rows.js's own header documents eliminating stays eliminated on this path too.
+const { buildRunStatsEntry } = require('./run-assemble');
+// v4.8 T-A5: the ONE voice, for the one thing this file can now detect and refuse (below).
+// ../utils/degrade requires nothing at all, so this is a leaf import and the cycle the
+// header above documents eliminating stays eliminated.
+const { formatDegrade } = require('../utils/degrade');
+// The announcement must not be defeatable by the caller's sink, so anything that cannot carry it
+// falls back to the same sentence on stderr — resolved inside `supersededRows` (see `sink` there),
+// never by a parameter default, which substitutes only for `undefined`.
+// Nothing on this path may throw — it runs after a whole council has
+// already been paid for — so BOTH halves are covered: `formatDegrade` is pure interpolation, and
+// the sink's validating `makeDegrade` is deliberately not called; and the write itself is wrapped,
+// because a stream can fail even when the string cannot. Same guard, same reason, as the real sink
+// (`run-degrade.js :: createDegradeSink`'s `safeEmit` — anchored by symbol; it is the only one).
+const STDERR_NOTICE = { note: (r) => {
+  try { process.stderr.write(formatDegrade({ ...r, kind: 'degrade' })); } catch { /* EPIPE etc */ }
+} };
+
+/**
+ * The `superseded` rows for one Stage-1 pass, in `deadLegs0` order.
+ *
+ * `keyOf` and `rowKeyOf` are the CALLER's — passed in, never re-derived here, and that is the
+ * point: this join and the dead-seat rows must ask the SAME keyspace the SAME question. A second
+ * spelling of either, or a second `twinAliases` behind `rowKeyOf`, is the desync the mutants
+ * DESYNCLEG and DESYNCPLAN pin (see `run-retry-keys.js :: legLossKey` for what the mint buys).
+ *
+ * @param {object} a.retry      the `retryStage1Losses` return value
+ * @param {Array} a.deadLegs0   Stage-1's first-attempt dead legs, in their original order
+ * @param {Function} a.keyOf    leg -> its bound seat's id, else its alias (the caller's)
+ * @param {Function} a.rowKeyOf leg -> its ROW key, `legLossKey`-minted (the caller's)
+ * @param {object} [a.degrade]  the one voice; anything without a callable `.note` — omitted,
+ *   null, or malformed — falls back to the stderr notice above
+ * @returns {Array<object>} rows for the caller to append — this function appends nothing.
+ */
+function supersededRows({ retry, deadLegs0, keyOf, rowKeyOf, degrade }) {
+  // ⚠️ v4.8 council C1 — resolved HERE, by testing the METHOD, not by a destructuring default.
+  // A parameter default substitutes only for `undefined`, so `degrade: null` and `degrade: {}`
+  // both reached `degrade.note(...)` and threw a TypeError. MEASURED through this function in
+  // the refusal shape below before this line existed: omitted and a real sink returned 1 row,
+  // null and a `.note`-less object threw. That was the SECOND throw path in this one guard
+  // (round 1 closed the first, an EPIPE from the sink's own write) and it is the one the
+  // `Channel internal` paragraph below already rules out in words: a throw here aborts a council
+  // that has already been paid for, over a row miscount. Not reachable in production —
+  // run-stages.js hands `ctx.degrade` to `pushDeadSeatRows`, which forwards it here, and `run.js`
+  // builds that sink with `createDegradeSink`, PROBED to return a `{note, all}` object whose
+  // `note` is callable — but reachable from any fixture or future caller, which is the
+  // population a fallback sink exists for at all.
+  const sink = degrade && typeof degrade.note === 'function' ? degrade : STDERR_NOTICE;
+  const rows = [];
+  // v4.7 D2/E4 — superseded rows: a leg-origin seat's FIRST leg stops being
+  // primary the moment a retry was actually attempted for it, healed or not
+  // (deadLegs0 × recovered-or-still-dead seats — mirrors the healed-set idiom
+  // above, extended to the still-dead half E4 also requires). A skipped seat
+  // (cost ceiling / unmappable — never got a second leg) keeps NO superseded
+  // row: nothing replaced it. Wave-origin seats never had a first leg at all,
+  // so they can never appear here regardless of healed/dead outcome (E4).
+  // ⚠️ v4.8 T2.2 — this is the ONE join in this function still in the ALIAS-granular
+  // keyspace, and it stays safe only while a twin alias cannot produce one RETRIED and one
+  // SKIPPED leg. Both sides of the join are LEG-origin (`deadLegs0` below, and retry's
+  // recovered/still-dead LEG arrays above — a wave-origin seat has no first leg at all and
+  // reaches neither), so the shape to rule out is two UNBOUND LEG-origin twins in different
+  // retry units. Two facts, read off run-retry.js and run-retry-group.js rather than
+  // inferred: (1) skipping is all-or-nothing per UNIT — every skip branch pushes
+  // `...unit.srcWaves`/`...unit.srcLegs` wholesale and `continue`s; (2) such twins always
+  // share a unit — bench and critic are one unit each, and the deadLegs loop calls
+  // `lensIndexOf(o, null, alias, seatObj)` with `seatObj` null when unbound, falling through
+  // to `o.models.indexOf(alias)`, first-match, so both resolve to the SAME lens index.
+  // (BOUND twins never needed this: their `keyOf` values already differ. And a wave-origin
+  // twin CAN land in a different lens unit than its leg-origin sibling — that split is real,
+  // it just cannot reach this join.) Break either fact and the skipped twin takes its own
+  // first leg as a primary row AND gets a superseded row for it: one billed leg counted
+  // twice.
+  // ⚠️ v4.8 T-A5 — and the paragraph above is now the DERIVATION, not the safety. Both facts
+  // exist to make ONE statement true: no first leg is SKIPPED while its alias key is superseded.
+  // `retry.skippedDeadLegs` states that directly, in leg OBJECTS — the very members of
+  // `deadLegs0` the retry declined to attempt — so the test below asks IDENTITY, which no
+  // keyspace can blur, at the one place the alias key is relied on. Unreachable while either fact
+  // holds (measured over 4000 fuzzed retry runs, 993 of them with skips: 0 hits on the whole
+  // shipped condition, all three conjuncts, and 0 on the SKIPPED-and-superseded test alone), so
+  // every correct input is byte-identical — and the double count the paragraph above ends on no
+  // longer FOLLOWS from breaking a fact: it is refused and announced. Under mutant GUESSPOS the
+  // same fuzz hits 85 on both counts; its legs carry taskIds, so row keys are distinct there.
+  const skippedLegs = new Set(retry.skippedDeadLegs || []);
+  const supersededKeys = new Set([
+    ...retry.recoveredLegs.map(keyOf),
+    ...retry.stillDeadLegs.map(keyOf),
+  ]);
+  // Refusing the row is the repair — but ONLY for a leg the dead-seat loop would hand back as its
+  // own primary row, which is what `willTakeItsOwnLeg` decides. Since v4.8 T-A6 that loop is the
+  // CALLER's (`run-stage1-rows.js :: pushDeadSeatRows`), not this file's — so any "below" naming
+  // THAT LOOP points across the boundary (the other two still point inside). run-stages.js merges `skippedDeadLegs`
+  // into the `stillDeadLegs` it hands that caller, so a skipped leg IS a still-dead seat there,
+  // and that loop's `deadLegs0.find` fallback runs for exactly the keys `attemptedSeats` does NOT
+  // hold — and returns ONE leg per key.
+  // ⚠️ BOTH conjuncts are load-bearing and BOTH were learned by MEASUREMENT, not argument. The
+  // first version of this comment argued the second was unreachable; it was wrong, and the guard
+  // built on it lost billed spend (T-A5 rounds 1-3).
+  //   `attemptedSeats` half: where the key IS held, R2's taskId-less floor has collapsed the twins
+  //   onto one LEG-LESS row, so the superseded row is the only place that leg's `usage` survives.
+  //   `=== dead` half: where the key is free but `find` would hand the row a DIFFERENT leg, this
+  //   leg gets no row of its own and refusing drops its `usage` entirely. Reachable by breaking
+  //   invariant 2 ALONE — `supersededKeys` also draws from `retry.recoveredLegs` just above, and NO
+  //   writer of `attemptedSeats` sits on run-retry.js's HEAL branch (they are all on still-dead
+  //   paths), so a healed twin supersedes the alias while `attemptedSeats` stays empty.
+  // Measured end to end, 3 unbound twins in one lens with invariant 2 broken: row keys COLLIDING —
+  // billed 0.60, recorded 0.70 both with this guard and without any guard, nothing lost; row keys
+  // DISTINCT — 1.10 without the guard against 0.60 with it, the whole 0.50 double count removed
+  // and nothing lost. Dropping either conjunct is a named mutant: WIDEGUARD and KEYNOTLEG.
+  // ⚠️ The 0.10 surviving on the COLLIDING shape is the R2 collapse floor, NOT a borrow —
+  // INSTRUMENTED, because two earlier versions of this sentence named a path that cannot execute
+  // here. The twins share ONE `deadSeats` entry and `attemptedSeats` is empty, so `deadLegs0.find`
+  // hands that row the HEALED twin's first leg, which already carries a superseded row: one leg,
+  // two rows. Probed at the push site — `finalLeg` is that leg (not null), `borrowed` null, spare
+  // pool empty. A borrow needs `attemptedSeats.has(join)` TRUE: the negation of this shape.
+  // It is announced either way, because a silently corrected number is the failure mode this join
+  // is watched for; a THROW would be wrong here, aborting a paid-for council over a row miscount.
+  // Channel `internal` — the runtime disagreed with itself, which is not a seat loss. All FOUR
+  // readers of a note's `data.seat` (verdict.js, workspace-seats.js, live-dead-seats.js,
+  // workspace/seat-space.js) gate on dead-leg/dead-wave/seat-unbound first, so it reaches none, and it cannot
+  // move the exit code either: run-stages.js notes a `dead-leg` degrade for every skipped leg
+  // before this function is called, so the run is already degraded whenever this can fire.
+  const willTakeItsOwnLeg = (dead) => !retry.attemptedSeats.has(rowKeyOf(dead))
+    && deadLegs0.find(l => rowKeyOf(l) === rowKeyOf(dead)) === dead;
+  const refuseSupersede = (dead) => {
+    const alias = dead.modelInput || dead.model;
+    sink.note({ channel: 'internal',
+      what: `a superseded row for seat ${alias} was refused`,
+      why: 'the retry both SKIPPED this first-attempt leg and superseded its alias key, which the '
+        + 'two invariants above forbid — so that key no longer names one outcome',
+      effect: 'the leg keeps its primary row and is counted once; the run continues, but the '
+        + `superseded/primary split for '${alias}' is no longer trustworthy`,
+      data: { seat: alias, taskId: dead.taskId || null } });
+  };
+  for (const dead of deadLegs0) {
+    if (!supersededKeys.has(keyOf(dead))) { continue; }
+    if (skippedLegs.has(dead) && willTakeItsOwnLeg(dead)) { refuseSupersede(dead); continue; }
+    rows.push(buildRunStatsEntry({ leg: dead, model: dead.modelInput || dead.model,
+      role: 'superseded', wasChair: false }));
+  }
+  return rows;
+}
+
+module.exports = { supersededRows };

package/src/council/run-stage2.js

@@ -24,6 +24,11 @@ const { parseJudgeOutput } = require('./parse-stage2');
 const { sanitizeName, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
 const { buildRunStatsEntry } = require('./run-assemble');
+// v4.8 PR3 Task 4: seat binding. artifactName is NOT re-exported from
+// run-launch.js (its exports stop at sanitizeName/isAbortExit), so it comes
+// straight from ./seats — that module requires nothing, zero cycle risk.
+const { artifactName } = require('./seats');
+const { orphanLegNote, bindPaddedWave } = require('./stage1-bind');
 
 /**
  * Stage 2: shared anonymized bundle → judge wave in _scratch → parse + repair.
@@ -71,6 +76,53 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
   ctx.addWave(wave);
   if (isAbortExit(exitCode)) { return { aborted: exitCode, judgeResults: [], extraRows: [] }; }
 
+  // v4.8 PR3 Task 4: bind the -s2 wave's legs to the SAME seats reviews[] holds,
+  // in `reviews` order — judges is built from that same array by the same
+  // `.map`, and real fanout stamps `${waveId}-${i+1}` off that same index
+  // (sidecar/leg-ids.js), so this holds even after an SL-2 heal (recovered legs
+  // are appended, run-stages.js:153, so `reviews` order is no longer seat order
+  // — both arrays still derive from the same `reviews`).
+  // §3.4's padding pattern now lives in `stage1-bind.js :: bindPaddedWave`
+  // (v4.8 SI-27) — why the roster is padded rather than filtered, and why
+  // placeholders are tracked by IDENTITY rather than an id-name prefix test,
+  // are in that function's docblock. Only this site's TAIL stays here.
+  const s2WaveId = `${o.runId}-s2`;
+  // review F(critical): `wave` is legitimately null — a budget/args refusal
+  // (run-budget.js failPre) returns `{wave: null, exitCode: 1}`, which
+  // isAbortExit does NOT catch (only 130/143), so execution reaches here.
+  // Guarded exactly like the leg loop below (`(wave && wave.legs) || []`) —
+  // this is the only OTHER dereference of wave.legs in the file.
+  const s2Legs = (wave && wave.legs) || [];
+  const { seatOf: judgeSeatOf, bindRes, placeholders } =
+    bindPaddedWave(s2WaveId, reviews.map(r => r.seat), i => judges[i], s2Legs);
+  // An orphan leg (a judge DID land, but no roster slot claims it) gets the
+  // same shape as Stage 1's orphanLegNote — `data.legId` present.
+  for (const leg of bindRes.orphanLegs) { ctx.degrade.note(orphanLegNote(s2WaveId, leg)); }
+  // review F(important): mirrors stage1-bind.js:40's suppression rule
+  // verbatim. A wave that returned ZERO legs is already announced on a louder
+  // channel (thin-cross-review, or this refusal itself) — there is no
+  // "missing seat" fact this adds. An orphan leg means a judge DID land for
+  // SOME seat we could not name — reporting the roster's other unbound seats
+  // as "missing" would double-count that one failure as two, on a channel
+  // whose whole contract is "nothing was guessed": the stray leg might BE the
+  // seat this loop would otherwise call missing.
+  if (s2Legs.length > 0 && bindRes.orphanLegs.length === 0) {
+    for (const seat of bindRes.unbound) {
+      if (placeholders.has(seat)) { continue; }
+      ctx.degrade.note({
+        channel: 'seat-unbound',
+        what: `leg for seat ${seat.alias} in wave ${s2WaveId} never returned`,
+        // R27-5: `reviews.length` IS the padded roster's length — bindPaddedWave
+        // maps 1:1 over the source array, and `Array.prototype.map` preserves
+        // length. Pinned (`ROSTERLEN`) in run-stages.test.js, because a
+        // substitution into unpinned prose is how a true sentence goes quietly false.
+        why: `the wave returned fewer judge legs than its roster of ${reviews.length}`,
+        effect: 'That seat did not judge; nothing was guessed and nothing was dropped',
+        data: { waveId: s2WaveId, seat: seat.alias },
+      });
+    }
+  }
+
   const judgeResults = [];
   // v4.7 D2: every judge-repair launch is a billed leg of its own, distinct from
   // the judge's original Stage-2 wave leg it is trying to fix — it gets its own
@@ -80,8 +132,12 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
   let repairSeq = 0;
   for (const leg of (wave && wave.legs) || []) {
     const judge = leg.modelInput || leg.model;
+    const seat = judgeSeatOf.get(leg) || null;
     if (leg.status === 'complete' && leg.summary) {
-      fs.writeFileSync(path.join(o.runDir, `judge-${sanitizeName(judge)}.md`), leg.summary, { mode: 0o600 });
+      // Mirrors the shape run-launch.js :: materializeReviews ships exactly:
+      // seat filename when bound, alias filename (today's behaviour) otherwise.
+      const name = seat ? artifactName(seat, 'judge') : `judge-${sanitizeName(judge)}.md`;
+      fs.writeFileSync(path.join(o.runDir, name), leg.summary, { mode: 0o600 });
     }
     let conformance = 'clean';
     let parsed = (leg.status === 'complete' && leg.summary)
@@ -126,7 +182,7 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
       if (parsed.ok) { conformance = 'repaired'; }
     }
     if (!parsed.ok) {
-      judgeResults.push({ judge, ok: false, order: null, adjudications: null,
+      judgeResults.push({ judge, seat, ok: false, order: null, orderSeats: null, adjudications: null,
         conformance: leg.status === 'complete' ? 'unstructured' : 'clean',
         // #83 (v4.6 Plan 2): the judge's ORIGINAL Stage-2 wave leg, mirroring
         // Stage-1's convention (reviews carry the original wave leg even when a
@@ -137,9 +193,13 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
         leg: leg || null });
       continue;
     }
-    const { order } = rankingToOrder(parsed.ranking, labels.labelMap);
-    judgeResults.push({ judge, ok: true, order, adjudications: parsed.adjudications, conformance,
-      leg: leg || null });
+    // v4.8 T3.2: labels.seatMap (anonymize.js :: assignLabels) threads through
+    // so orderSeats can disambiguate a twin bench's `order`, which stays
+    // alias-only. T3.3 wired it into street-cred.js :: rankPositions, via
+    // rankings[] in run-assemble.js :: buildTallyInput; `order` never moved.
+    const { order, orderSeats } = rankingToOrder(parsed.ranking, labels.labelMap, labels.seatMap);
+    judgeResults.push({ judge, seat, ok: true, order, orderSeats, adjudications: parsed.adjudications,
+      conformance, leg: leg || null });
   }
   return { aborted: null, judgeResults, extraRows };
 }