amicus 4.7.0 → 4.8.0

package/src/council/run-stages.js

@@ -25,10 +25,11 @@ const runState = require('./run-state');
 const { runStage2 } = require('./run-stage2');
 const { launchStage1 } = require('./run-stage1-launch');
 const { buildRunStatsEntry } = require('./run-assemble');
-
-function slug(text) {
-  return String(text).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
-}
+const { pushDeadSeatRows } = require('./run-stage1-rows');
+const { bindStage1Waves, orphanLegNote, missingSeatDeadWave } = require('./stage1-bind');
+// slug lives in ./seats (v4.8 PR1) so that module can stay require-free;
+// re-exported below — run-stages.test.js imports it from here.
+const { slug } = require('./seats');
 
 /** Role of a seat by its input alias. */
 function roleFor(o, alias) {
@@ -60,35 +61,67 @@ function roleFor(o, alias) {
  */
 async function runStage1(ctx) {
   const { o } = ctx;
-  const { aborted, legs, deadWaves } = await launchStage1(ctx);
+  const { aborted, legs, deadWaves, waves } = await launchStage1(ctx);
   if (aborted) { return { aborted, reviews: [], deadLegs: [], deadWaves: [], degraded: false, extraRows: [] }; }
 
-  const firstPass = materializeReviews(o.runDir, legs);
+  // Per-wave binding, before anything reads a leg. Orphans are announced now —
+  // they are not a loss, so the "never degrade for a seat the retry saves" rule
+  // below does not apply to them.
+  const { seatOf, missingSeats, orphanLegs } = bindStage1Waves(waves);
+  for (const { waveId, leg } of orphanLegs) { ctx.degrade.note(orphanLegNote(waveId, leg)); }
+  // R-B: a launched seat whose leg never came back is a LOSS — it lands in
+  // neither deadLegs (no leg object) nor deadWaves (the wave DID produce legs).
+  // It reaches the retry as a single-seat dead wave flagged `partial` so its
+  // prose stays true, and is announced only if the retry cannot save it.
+  const allDeadWaves = [...deadWaves, ...missingSeats.map(missingSeatDeadWave)];
+
+  const firstPass = materializeReviews(o.runDir, legs, seatOf);
   const alive0 = new Set(firstPass.map(m => m.leg));
   const deadLegs0 = legs.filter(l => !alive0.has(l));
 
   // SL-2: one retry BEFORE anything is recorded lost — the sink never
   // un-flips, so a degrade for a seat the retry saves must never fire at all.
-  const retry = await retryStage1Losses(ctx, { deadWaves, deadLegs: deadLegs0,
-    counts: { reviewed: firstPass.length, total: legs.length } });
+  // `total` counts SEATS: legs.length alone renders "1 of 1 seats reviewed"
+  // beside a degrade when a seat's leg never returned.
+  const retry = await retryStage1Losses(ctx, { deadWaves: allDeadWaves, deadLegs: deadLegs0, seatOf,
+    counts: { reviewed: firstPass.length, total: legs.length + missingSeats.length } });
   if (retry.aborted) {
     // Final whole-branch review: same bug class as the post-retry-repair
     // abort fixed ~87 lines below ("Must be the post-retry set") — subtract
     // whatever retry.recoveredLegs already healed before this abort landed.
-    const healed = new Set(retry.recoveredLegs.map(l => l.modelInput || l.model));
+    // SEAT-keyed since v4.8 H4: twin seats now retry INDEPENDENTLY, so an alias
+    // Set marks BOTH healed the moment one of them is — the still-dead twin
+    // silently disappears from deadLegs AND deadWaves[].models, and run.js
+    // persists that return into stage-1 state as if it had reviewed.
+    const keyOf = (l, bind) => { const s = bind.get(l); return s ? s.id : (l.modelInput || l.model); };
+    const healed = new Set(retry.recoveredLegs.map(l => keyOf(l, retry.seatOf)));
+    // `seats` must be narrowed in LOCKSTEP with `models`: a bare `...w` carries
+    // the FULL roster past a narrowed models list, and run.js persists this
+    // record before the abort short-circuit — so index i of each would name a
+    // different seat in run.json. Omitted entirely when the source had none.
     return { aborted: retry.aborted, reviews: [], degraded: false, extraRows: [],
-      deadLegs: deadLegs0.filter(l => !healed.has(l.modelInput || l.model)),
-      deadWaves: deadWaves.map(w => ({ ...w, models: (w.models || []).filter(m => !healed.has(m)) })).filter(w => w.models.length > 0) };
+      deadLegs: deadLegs0.filter(l => !healed.has(keyOf(l, seatOf))),
+      deadWaves: allDeadWaves.map((w) => {
+        const keep = (w.models || []).map((m, i) => [m, (w.seats || [])[i] || null])
+          .filter(([m, s]) => !healed.has(s ? s.id : m));
+        return { ...w, models: keep.map(x => x[0]), ...(w.seats ? { seats: keep.map(x => x[1]) } : {}) };
+      }).filter(w => w.models.length > 0) };
   }
 
   for (const d of retry.skippedDeadWaves) {
+    // A `partial` record is one seat of a wave that DID produce legs, so the
+    // plain dead-wave sentence would be false. `seat` rides only on that shape:
+    // adding it unconditionally breaks an exact toEqual on a real dead wave.
     ctx.degrade.note({
-      channel: 'dead-wave',
-      what: `Stage-1 wave ${d.waveId} (${d.models.join(', ') || 'no models'}) produced NO legs`,
+      channel: d.partial ? 'seat-unbound' : 'dead-wave',
+      what: d.partial
+        ? `seat ${(d.models || [])[0]} did not review`
+        : `Stage-1 wave ${d.waveId} (${d.models.join(', ') || 'no models'}) produced NO legs`,
       why: d.reason,
       effect: 'Those seats are NOT in this council. The run continues with the bench that did '
         + 'launch and will exit degraded (2)',
-      data: { waveId: d.waveId, models: d.models, reason: d.reason },
+      data: { waveId: d.waveId, models: d.models, reason: d.reason,
+        ...(d.partial ? { seat: (d.models || [])[0] } : {}) },
     });
   }
   for (const leg of retry.skippedDeadLegs) {
@@ -96,20 +129,28 @@ async function runStage1(ctx) {
       channel: 'dead-leg',
       what: `seat ${leg.modelInput || leg.model} did not review`,
       why: `the leg ended '${leg.status}'${leg.error ? `: ${leg.error}` : ''} with no usable output`,
-      effect: `${firstPass.length} of ${legs.length} seats reviewed; `
+      effect: `${firstPass.length} of ${legs.length + missingSeats.length} seats reviewed; `
         + 'the run continues with the bench that did and will exit degraded (2)',
       data: { seat: leg.modelInput || leg.model, status: leg.status, reason: leg.error || null },
     });
   }
   for (const rec of retry.stillDeadNotes) { ctx.degrade.note(rec); }
+  // Same shape: the retry pass BUILDS its orphan records, the caller EMITS them
+  // (that module emits heals only and never notes a degrade, by construction).
+  for (const { waveId, leg } of retry.orphanLegs) { ctx.degrade.note(orphanLegNote(waveId, leg)); }
 
   // Invariant this merge relies on: retry.recoveredLegs only ever names seats
   // that actually lost their seat on the first pass (run-retry.js's recovery
   // loop drops any leg for a seat with no firstFailures entry) — so `legs`
   // and `recoveredLegs` can never both carry a leg for the same seat here.
-  // materializeReviews re-writing an already-materialized recovered leg's
-  // review-*.md a second time is accepted as an idempotent no-op, not a bug.
-  const materialized = materializeReviews(o.runDir, [...legs, ...retry.recoveredLegs]);
+  // A recovered leg is a RETRY-wave object, absent from Stage-1's object-keyed
+  // seatOf, so this union is mandatory rather than tidiness: without it every
+  // healed seat re-materializes with seat:null and its role falls back to
+  // roleFor's alias shim. Re-writing an already-materialized recovered leg's review file
+  // is only an idempotent no-op while the name is the seat's — under the alias
+  // it is the twin clobber this PR removes (two healed twins, one file).
+  const allSeatOf = new Map([...seatOf, ...retry.seatOf]);
+  const materialized = materializeReviews(o.runDir, [...legs, ...retry.recoveredLegs], allSeatOf);
   const stillDeadLegs = [...retry.skippedDeadLegs, ...retry.stillDeadLegs];
   const stillDeadWaves = [...retry.skippedDeadWaves, ...retry.stillDeadWaves];
 
@@ -220,63 +261,25 @@ async function runStage1(ctx) {
       }
     }
     reviews.push({
-      model: m.modelInput, modelInput: m.modelInput, role: roleFor(o, m.modelInput),
+      model: m.modelInput, modelInput: m.modelInput, seat: m.seat || null,
+      // Seat-space role (spec §4.5), read off the SEAT — NOT roleAt(o.seats):
+      // run-stage1-launch.js re-derives the table when o.seats is absent, so
+      // m.seat is truthy while o.seats is not, and roleAt's unknown-id 'seat'
+      // collapses every critic/lens role. Unbound legs keep the roleFor shim.
+      role: m.seat ? m.seat.role : roleFor(o, m.modelInput),
       text: m.text, findings: res.ok ? res.findings : [], conformance, leg: m.leg,
       ...(unverified ? { findingsUnverified: true } : {}),
       ...(repairRefused ? { repairRefused } : {}),
     });
   }
 
-  // v4.7 D2/E4 — superseded rows: a leg-origin seat's FIRST leg stops being
-  // primary the moment a retry was actually attempted for it, healed or not
-  // (deadLegs0 × recovered-or-still-dead seats — mirrors the healed-set idiom
-  // above, extended to the still-dead half E4 also requires). A skipped seat
-  // (cost ceiling / unmappable — never got a second leg) keeps NO superseded
-  // row: nothing replaced it. Wave-origin seats never had a first leg at all,
-  // so they can never appear here regardless of healed/dead outcome (E4).
-  const supersededAliases = new Set([
-    ...retry.recoveredLegs.map(l => l.modelInput || l.model),
-    ...retry.stillDeadLegs.map(l => l.modelInput || l.model),
-  ]);
-  for (const dead of deadLegs0) {
-    const alias = dead.modelInput || dead.model;
-    if (supersededAliases.has(alias)) {
-      extraRows.push(buildRunStatsEntry({ leg: dead, model: alias, role: 'superseded', wasChair: false }));
-    }
-  }
-
-  // v4.7 D2/E4 — primary error rows: one per seat with NO surviving review
-  // (every alias still in stillDeadLegs/stillDeadWaves after retry). E5
-  // amended (Task-4 review, owner-ruled): run-retry.js now surfaces the real
-  // retry leg (stillDeadRetryLegs), from the ONE branch it exists in —
-  // retryLegStillDeadNote, a retry leg that came back unusable. Prefer that
-  // REAL leg: status/waveId/usage/duration all real, all from the SAME
-  // attempt (no more pairing a retry's waveId with a different attempt's
-  // status). The other two dead-leg note classes — srcLegStillDeadNote (retry
-  // wave died wholesale, zero legs) and missingLegStillDeadNote (partial
-  // return never named this seat) — never get a real leg, so `leg: null`
-  // (no phantom waveId: one must never appear without a real billed leg).
-  // No 'dead-leg' note at all ⇒ never retried (skipped) ⇒ the original dead
-  // leg is this seat's only, and therefore final, leg.
-  const retryLegByAlias = new Map();
-  for (const leg of retry.stillDeadRetryLegs) { retryLegByAlias.set(leg.modelInput || leg.model, leg); }
-  const attemptedAliases = new Set();
-  for (const n of retry.stillDeadNotes) {
-    if (n.channel === 'dead-leg' && n.data && n.data.seat) { attemptedAliases.add(n.data.seat); }
-  }
-  const deadAliases = new Set([
-    ...stillDeadLegs.map(l => l.modelInput || l.model),
-    ...stillDeadWaves.flatMap(w => w.models || []),
-  ]);
-  for (const alias of deadAliases) {
-    let finalLeg = retryLegByAlias.get(alias);
-    if (!finalLeg) {
-      finalLeg = attemptedAliases.has(alias)
-        ? null                                                              // retried; no leg at all for this seat
-        : (deadLegs0.find(l => (l.modelInput || l.model) === alias) || null); // never retried
-    }
-    extraRows.push(buildRunStatsEntry({ leg: finalLeg, model: alias, role: roleFor(o, alias), wasChair: false }));
-  }
+  // Superseded + dead-seat rows live in ./run-stage1-rows (v4.8 PR0 size-gate split).
+  // ⚠️ allSeatOf, never the Stage-1 `seatOf`: retry.recoveredLegs and
+  // retry.stillDeadRetryLegs are retry-wave objects that map has never seen.
+  // ⚠️ `retry.twins`, never a fresh `twinAliases(o.seats)`: the row keys asked for here must be
+  // minted from the SAME collection the retry pass filled `attemptedSeats` with (v4.8 T-A6).
+  pushDeadSeatRows({ o, retry, deadLegs0, stillDeadLegs, stillDeadWaves, extraRows,
+    roleFor, seatOf: allSeatOf, degrade: ctx.degrade, twins: retry.twins });
 
   return { aborted: null, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves,
     degraded: stillDeadLegs.length > 0 || stillDeadWaves.length > 0, extraRows };

package/src/council/run-state.js

@@ -96,7 +96,7 @@ function initCouncilRun(o) {
   initRun(o.runDir, {
     schemaVersion: 2, type: 'council-run', runId: o.runId, status: 'running', stages: [],
     bench: o.models.slice(), chair: o.chair, critic: o.critic, lenses: o.lenses,
-    labelMap: null,
+    labelMap: null, seats: null, criticSeat: null,
     // Seeded ONLY under --debate (a `debate:null` seed would both break the v4.0
     // "no debate key" contract and fail the object-typed schema), and with a VALID
     // outcome from the first write so a run killed mid-debate stays schema-valid.

package/src/council/run-stats-entry.js

@@ -0,0 +1,71 @@
+// src/council/run-stats-entry.js
+'use strict';
+
+/**
+ * @module council/run-stats-entry
+ * One runStats row from a leg run document. Extracted verbatim from
+ * ./run-assemble (v4.8 Phase 1 T1.1) to give that file headroom under the
+ * 300-line gate, and re-exported there so every existing call spelling —
+ * `asm.buildRunStatsEntry(...)` and pulling `buildRunStatsEntry` off
+ * `./run-assemble`'s own exports — survives the move untouched.
+ *
+ * ⚠️ This module is REQUIRE-FREE by design, like ./seats. Consumers that cannot
+ * take run-assemble's graph (./debate.js is dependency-injection-free) must be
+ * able to import it. Do not add a `require` call here — the pin (P3,
+ * tests/council/run-stats-entry.test.js) scans this file's raw text for the
+ * word `require` immediately followed by an opening parenthesis, so it fires
+ * on that sequence ANYWHERE, including inside a comment, not only inside a
+ * real statement.
+ */
+
+/**
+ * One runStats row from a leg run document. Verbatim copies only — a missing
+ * leg doc yields durationMs/usage null (never invent a value). `model` (the
+ * council alias) overrides leg.model (the resolved executable id) so ledger
+ * rows join meta.models by exact string (ledger.js:20-24).
+ * `resolvedModel` (v4.7 GOA-7) preserves leg.model — the executable id that
+ * actually served, post-fallback-substitution — emit-only-when-set and never
+ * sourced from modelInput (an alias must never masquerade as a resolved id).
+ *
+ * ⚠️ LC-11 / review F1: `findingsUnverified` and `repairRefused` are the same
+ * class of fact as `conformance` and ride the same row. They are the two halves
+ * of the repair contract's outcome: `findingsUnverified` marks a 'repaired' seat
+ * whose contract could NOT be checked (the original block was absent or
+ * unparseable, so there was no finding count to compare), and `repairRefused`
+ * ({code, detail}) marks the stronger case — the contract WAS checked and broken,
+ * which is otherwise indistinguishable from a seat that never emitted JSON at
+ * all. Both are additive and present only when set, so a run without either is
+ * byte-for-byte unchanged.
+ *
+ * `seat` (v4.8 PR4c §3.1) is the seat OBJECT — {id, alias, role, lens, position}
+ * or null — never an id string. Callers pass `r.seat` / the dead-seat loop's own
+ * `seat` verbatim, so the object IS the contract instead of a prose one.
+ */
+function buildRunStatsEntry({ leg, model, role, wasChair, conformance, findingsUnverified,
+  repairRefused, seat }) {
+  return {
+    model: model !== undefined ? model : (leg ? leg.model : null),
+    role,
+    wasChair: !!wasChair,
+    conformance: conformance || 'clean',
+    ...(findingsUnverified ? { findingsUnverified: true } : {}),
+    ...(repairRefused ? { repairRefused } : {}),
+    ...(leg && leg.waveId ? { waveId: leg.waveId } : {}),
+    ...(leg && leg.model ? { resolvedModel: leg.model } : {}),
+    // v4.8 PR4c §3.1 / R4c-9: emit-when-DIFFERENT, compared against the seat's
+    // OWN alias — never against `model`. buildSeats mints `alias#N` only when
+    // an alias repeats (seats.js:67), so `id !== alias` IS "the bench repeats
+    // this alias": the single predicate all four seat-emit producers now share,
+    // which is what stops them disagreeing. `model` is the LEG's modelInput,
+    // which is NOT the alias when a leg reports none (it falls back to the
+    // RESOLVED id, the same fallback run-launch.js :: materializeReviews uses)
+    // or when a --council preset carries a padded member — either would ship a
+    // seat id with no seat table behind it, on a bench with no twin at all.
+    ...(seat && seat.id !== seat.alias ? { seat: seat.id } : {}),
+    status: leg ? leg.status : 'error',
+    durationMs: leg && typeof leg.durationMs === 'number' ? leg.durationMs : null,
+    usage: (leg && leg.usage) || null,
+  };
+}
+
+module.exports = { buildRunStatsEntry };

package/src/council/run-verdict-files.js

@@ -0,0 +1,52 @@
+// src/council/run-verdict-files.js
+'use strict';
+
+/**
+ * @module council/run-verdict-files
+ * The verdict half of the run-dir artifact set: verdict.json (with the nullable
+ * overallVerdict and the derived seatLoss), report.html and chair-output.md.
+ *
+ * Lifted VERBATIM out of run-assemble.js for the 300-line gate (v4.8 PR4c
+ * Task 2), on the same precedent as seats.js/preflightSeats: the body lives
+ * here and run-assemble re-exports it, so `asm.writeVerdictFiles(...)` — the
+ * only production call spelling (run-finish.js:63) — is untouched and no test
+ * moved. This was the only consumer of run-assemble's `./verdict` and
+ * `./report` requires, so the two came with it.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { buildVerdict, summarizeSeatLoss, deriveSeatLoss, writeVerdictAtomic } = require('./verdict');
+const { buildReport } = require('./report');
+
+/**
+ * Undecided verdict + deterministic report. Sets the nullable overallVerdict
+ * (council family v2, Plan A) on buildVerdict's output — independent of
+ * buildVerdict's own signature.
+ * @param {{runDir: string, record: object, overallVerdict?: (string|null),
+ *   chairText?: string, critic?: string, deadWaves?: Array<object>,
+ *   degrades?: Array<object>}} o `degrades` (v4.6 Plan 2), when present, is
+ *   both carried onto the verdict and used to DERIVE `seatLoss` (deriveSeatLoss)
+ *   in preference to summarizing it from `deadWaves` (summarizeSeatLoss).
+ * @returns {object} the verdict written to disk
+ */
+function writeVerdictFiles({ runDir, record, overallVerdict, chairText, critic, deadWaves, degrades }) {
+  // v4.6 Plan 2 (spec D3): when the sink's records are available they are the
+  // single source of truth — seatLoss derives from them so it can never
+  // disagree with degrades[]. deadWaves remains the fallback for direct
+  // callers that predate the sink (their tests pass unedited).
+  const seatLoss = degrades
+    ? deriveSeatLoss({ runId: record.meta.runId, critic, degrades })
+    : summarizeSeatLoss({ runId: record.meta.runId, critic, deadWaves });
+  const verdict = buildVerdict(record, [], { seatLoss, degrades });
+  verdict.overallVerdict = (overallVerdict === undefined) ? null : overallVerdict;
+  writeVerdictAtomic(path.join(runDir, 'verdict.json'), verdict);
+  const html = buildReport({ verdict }, { format: 'html' });
+  fs.writeFileSync(path.join(runDir, 'report.html'), html, { mode: 0o600 });
+  if (chairText) {
+    fs.writeFileSync(path.join(runDir, 'chair-output.md'), chairText, { mode: 0o600 });
+  }
+  return verdict;
+}
+
+module.exports = { writeVerdictFiles };

package/src/council/run.js

@@ -27,13 +27,13 @@ const { createLaunchers } = require('./run-launch');
 const { runStage1, runStage2 } = require('./run-stages');   // stage 2 lives in ./run-stage2 (300-line gate), re-exported there
 const { runChair, pickFallbackChair } = require('./run-chair');
 const { runDebateStage } = require('./run-debate-stage');   // debate orchestration lives there (300-line gate), extracted from here (v4.6 Plan 1 Task 1)
-const { decorateRecord } = require('./debate');
 const asm = require('./run-assemble');
 const { createBudget } = require('./run-budget');
 const { emitRunStarted, emitStageStarted, emitStageTerminal } = require('../observe/events');
 // v4.4.1 CA-6: the whole exit-code vocabulary (SIGNAL_EXIT, statusForExit and the
 // degradation in resolveTerminalExit) lives in ./run-finalize — see its docblock.
 const { writeRunTerminal, resolveTerminalExit, SIGNAL_EXIT } = require('./run-finalize');
+const { finishRun } = require('./run-finish');
 
 /**
  * @param {object} options {briefing, models, chair, critic?, lenses?, project, runId,
@@ -125,6 +125,15 @@ async function runCouncil(options, deps = {}) {
     if (pre.error) { return finalize(1, pre.error); }
     const claudeReview = pre.claudeReview;
 
+    // v4.8 §4.3: seats are derived pre-spend from data run.json already holds,
+    // then checkpointed — initCouncilRun ran ~50 lines earlier, so they cannot
+    // ride the seed.
+    const seatPre = asm.preflightSeats(o);
+    if (seatPre.error) { return finalize(1, seatPre.error); }
+    o.seats = seatPre.seats;
+    o.criticSeat = seatPre.criticSeat;
+    runState.checkpoint(o.runDir, { seats: o.seats, criticSeat: o.criticSeat });
+
     // Composed Stage-1 seat briefing persisted for auditability (spec §4 layout).
     fs.writeFileSync(path.join(o.runDir, 'briefing-stage1.md'),
       briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date }), { mode: 0o600 });
@@ -172,12 +181,25 @@ async function runCouncil(options, deps = {}) {
 
     // ---- Stage 2: anonymized cross-review ----
     // A file-sourced Claude review is ALWAYS the last label — review N+1 (§4.4).
-    const labels = assignLabels(s1.reviews.map(r => r.model).concat(claudeReview ? ['claude'] : []));
+    // v4.8 T3.2: seats travel in lockstep with models — both are s1.reviews in
+    // the same pass, not the positional join anonymize.js :: assignLabels's
+    // own docblock explains is forbidden elsewhere.
+    const labels = assignLabels(s1.reviews.map(r => r.model).concat(claudeReview ? ['claude'] : []),
+      s1.reviews.map(r => r.seat).concat(claudeReview ? [null] : []));
     runState.checkpoint(o.runDir, { labelMap: labels.labelMap });
     // Attach each review's run-global findings (buildTallyInput reads
     // r.globalFindings per review, not a bare parallel array).
     s1.reviews.forEach((r, i) => {
-      r.globalFindings = toGlobalFindings(labels.entries[i].letter, r.model, r.findings);
+      // v4.8 PR3 Task 5, re-based by PR4c R4c-9: pass the seat id ONLY when it
+      // differs from the seat's OWN alias — the naive `r.seat ? r.seat.id :
+      // null` form would emit raiserSeat on every finding of every run, a
+      // universal artifact-shape change. The operand was `r.model`, the leg's
+      // modelInput — not the alias when a leg reports none (it falls back to
+      // the RESOLVED id) or when a --council preset carries a padded member.
+      // There it emitted a seat id byte-equal to its own alias, on a bench with
+      // no twin, with no seat table able to resolve it.
+      r.globalFindings = toGlobalFindings(labels.entries[i].letter, r.model, r.findings,
+        r.seat && r.seat.id !== r.seat.alias ? r.seat.id : null);
     });
     const globalFindings = s1.reviews.flatMap(r => r.globalFindings)
       .concat(claudeReview ? asm.labelClaudeReview(claudeReview, labels) : []);
@@ -200,9 +222,17 @@ async function runCouncil(options, deps = {}) {
     }
 
     // Merge Stage-2 judging conformance into each seat's row (worst wins).
-    const byJudge = new Map(s2.judgeResults.map(j => [j.judge, j]));
+    // Seat-keyed (v4.8 PR3 Task 4): an alias-only key collapses a twin bench
+    // onto ONE Map entry, so the last-wins judge silently overwrote every
+    // twin's row (D7). j.seat can still be null (an orphaned -s2 leg,
+    // seats.js:130-146) even when r.seat is a real bound seat, so the lookup
+    // falls back to r.model on a miss rather than assuming the two arrays stay
+    // symmetric — a naive seatKey on both sides would make that orphan's
+    // conformance unreachable instead of merged, a silent total loss.
+    const seatKey = (s, alias) => (s ? s.id : alias);
+    const byJudge = new Map(s2.judgeResults.map(j => [seatKey(j.seat, j.judge), j]));
     for (const r of s1.reviews) {
-      const j = byJudge.get(r.model);
+      const j = byJudge.get(r.seat ? r.seat.id : r.model) || byJudge.get(r.model);
       if (j) { r.conformance = asm.worseConformance(r.conformance, j.conformance); }
     }
 
@@ -216,6 +246,11 @@ async function runCouncil(options, deps = {}) {
       runId: o.runId, date: o.date, bench: o.models.slice(), chair: chairModel,
       reviews: s1.reviews, judgeResults: s2.judgeResults, chairStats, claudeReview,
       extraRows: [...s1.extraRows, ...s2.extraRows],
+      // v4.8 PR4c §3.2: the ONLY production caller of buildTallyInput, so this is
+      // the single seam meta.seats enters through. The final input is derived by
+      // SPREAD (run-finish.js:36), not rebuilt, so both the provisional and the
+      // debated input inherit it from here.
+      seats: o.seats,
     });
     const provisionalInput = mkInput(null, o.chair);
     const provisional = tally(provisionalInput);
@@ -237,54 +272,9 @@ async function runCouncil(options, deps = {}) {
       packet, degrade, statsFn, isSignalled: () => signalled,
     });
     if (chairRes.aborted !== null) { return finalize(chairRes.aborted); }
-    const { chairLeg, actualChair, chairText, chairConformance, overallVerdict, chairRows, chairAttempts } = chairRes;
 
-    // ---- Final tally (chair row included) + ledger + artifacts ----
-    const chairStats = chairLeg ? asm.buildRunStatsEntry({
-      leg: chairLeg, model: actualChair, role: 'chair', wasChair: true,
-      conformance: chairConformance,
-    }) : null;
-    // v4.7 D2: a give-up (no chairLeg) with at least one recorded attempt gets
-    // an explicit error row so the walk's outcome isn't silently absorbed.
-    // Keyed on chairAttempts, NOT chairRows — attempts that die pre-wave (no
-    // money spent) record an outcome but yield no row (errata E3).
-    const giveUpRow = (!chairLeg && chairAttempts && chairAttempts.length)
-      ? asm.buildRunStatsEntry({ leg: null, model: o.chair, role: 'chair', wasChair: false })
-      : null;
-    // Built on the (possibly debated) input so the debate's amended claims, replaced
-    // adjudications and rebuttal/revote runStats rows all reach the final record.
-    const finalInput = { ...debatedInput, meta: { ...debatedInput.meta, chair: actualChair || o.chair } };
-    // Item 8, final-review consolidated wave: was three sequential
-    // reassignments (chairStats, then chairRows, then giveUpRow), each
-    // rebuilding finalInput.runStats from scratch — collapsed into the one
-    // spread that was always the net effect. The `|| []` fallbacks were
-    // dead: `runStats` is a real array on every debatedInput
-    // (asm.buildTallyInput always returns one via .map()), never undefined.
-    finalInput.runStats = [
-      ...finalInput.runStats,
-      ...(chairStats ? [chairStats] : []),
-      ...chairRows,
-      ...(giveUpRow ? [giveUpRow] : []),
-    ];
-    const record = tally(finalInput);
-    if (debateFindings) { decorateRecord(record, debateFindings); }
-    if (!o.lenses) {
-      // Lens runs never feed cross-run reliability stats (spec §4 / skill rule).
-      try { appendRunFn(record); }
-      catch (e) { process.stderr.write(`Notice: council ledger append failed: ${e.message}\n`); }
-    }
-    asm.writeTallyFiles({ runDir: o.runDir, tallyInput: finalInput, record });
-    const tallyStage = o.debate ? 'tally-final' : 'tally';
-    runState.updateStage(o.runDir, tallyStage, { status: 'complete', completedAt: now() });
-    emitStageStarted(o.runDir, o.runId, tallyStage, null, o.follow);
-    emitStageTerminal(o.runDir, o.runId, tallyStage, 'complete', null, o.follow);
-    // Verdict assembly is the degrade cut-off: anything noted after this line
-    // reaches stderr + run.json but not verdict.json (spec §6 rule 1).
-    asm.writeVerdictFiles({ runDir: o.runDir, record, overallVerdict, chairText,
-      critic: o.critic, deadWaves, degrades: degrade.all() });
-    runState.updateStage(o.runDir, 'verdict', { status: 'complete', completedAt: now() });
-    emitStageStarted(o.runDir, o.runId, 'verdict', null, o.follow);
-    emitStageTerminal(o.runDir, o.runId, 'verdict', 'complete', null, o.follow);
+    // Final tally + ledger + artifacts live in ./run-finish (v4.8 PR0 size-gate split).
+    finishRun({ o, chairRes, debatedInput, debateFindings, appendRunFn, degrade, deadWaves, now });
 
     return finalize(degraded.value ? 2 : 0);
   } catch (err) {