amicus 4.7.0 → 4.8.0

package/src/council/seats.js

@@ -0,0 +1,262 @@
+// src/council/seats.js
+'use strict';
+// Seat identity (v4.8 workstream A, spec §4). A SEAT is one bench position:
+// derived, never minted, stable for the life of a run. For every bench that
+// has ever run — no alias repeated — a seat id equals its alias byte-for-byte,
+// which is what keeps run.json, tally.json, verdict.json, report.html,
+// artifact filenames and ledger rows unchanged.
+//
+// This module requires NOTHING, deliberately: its consumers (run-stages,
+// run-launch, run-retry, run-stage2, run-assemble, run.js) all require IT, so
+// any back-require would be a cycle. That is why slug and sanitizeName live
+// here and are re-exported from their previous homes.
+
+/** URL/role-safe token from free text (moved from run-stages.js, v4.8 PR1). */
+function slug(text) {
+  return String(text).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+
+/** Filesystem-safe model name for review-/judge- artifact filenames. */
+function sanitizeName(model) {
+  return String(model).replace(/[^a-zA-Z0-9._-]/g, '-');
+}
+
+/**
+ * Derive the seat table from data run.json already persists (run-state.js
+ * seeds bench/critic/lenses). Pure and TOTAL: critic and lenses are
+ * schema-optional and a legacy dir may carry a mismatched pair, so this never
+ * throws and never guesses.
+ *
+ * Seat id (spec §4.2): the alias when it occupies exactly one bench seat, else
+ * `alias#N` with N 1-based among the seats sharing that alias.
+ *
+ * Roles follow run-stages.js roleFor's PRECEDENCE — under lenses every seat is
+ * a lens seat and 'critic' is unreachable — and match it for every bench the
+ * CLI can produce (no repeated alias; lenses.length === bench.length, enforced
+ * at cli-handlers-council-run.js:161). They DELIBERATELY diverge where roleFor
+ * is wrong: roles here are POSITIONAL, so twins under lenses get their own
+ * lens instead of both getting the first twin's (roleFor uses
+ * o.models.indexOf). An empty lenses array counts as no lenses (roleFor treats
+ * [] as truthy and yields 'lens:undefined'), and a lenses array shorter than
+ * the bench leaves the trailing seats plain for the same reason. Do not
+ * "restore parity" — the divergence IS the feature, and it is pinned by tests.
+ *
+ * The `claude` seat is deliberately absent: 'claude' is rejected from --models
+ * (run-assemble.js:104-132) and synthesized onto meta.models downstream (:226).
+ * seats[] is bench-only — never assume meta.models.length === seats.length.
+ *
+ * @param {?Array<string>} bench run.json's bench (o.models)
+ * @param {?string} critic run.json's critic
+ * @param {?Array<string>} lenses positionally bound to bench
+ * @returns {Array<{id: string, alias: string, role: string, lens: ?string, position: number}>}
+ */
+function buildSeats(bench, critic, lenses) {
+  const aliases = Array.isArray(bench) ? bench : [];
+  const lensed = Array.isArray(lenses) && lenses.length > 0;
+  const counts = new Map();
+  for (const a of aliases) { counts.set(a, (counts.get(a) || 0) + 1); }
+  const seen = new Map();
+  return aliases.map((alias, i) => {
+    const n = (seen.get(alias) || 0) + 1;
+    seen.set(alias, n);
+    const lens = lensed && lenses[i] !== undefined ? lenses[i] : null;
+    const role = lensed
+      ? (lens === null ? 'seat' : `lens:${slug(lens)}`)
+      : (alias === critic ? 'critic' : 'seat');
+    return {
+      id: counts.get(alias) > 1 ? `${alias}#${n}` : alias,
+      alias, role, lens, position: i + 1,
+    };
+  });
+}
+
+/**
+ * Role of a seat by its id. Returns 'seat' for an unknown id, matching
+ * roleFor's fallthrough for any alias that is not the critic. (roleFor returns
+ * 'critic' for an OFF-BENCH critic because run-stages.js:40 is not gated on
+ * bench membership; buildSeats never mints a seat for one and preflightSeats
+ * rejects that state pre-spend, so 'seat' is right for every run v4.8 creates.)
+ * @param {?Array<object>} seats
+ * @param {string} seatId
+ * @returns {string}
+ */
+function roleAt(seats, seatId) {
+  const hit = (Array.isArray(seats) ? seats : []).find(s => s && s.id === seatId);
+  return hit ? hit.role : 'seat';
+}
+
+/**
+ * Resolve a wave's legs to its seats. Pure: it reports, it never emits a
+ * degrade and never guesses — silent mis-attribution is the failure this whole
+ * mechanism exists to kill (spec §4.4).
+ *
+ * `seats` is THE WAVE'S LAUNCH ROSTER, in launch order — not necessarily the
+ * full seat table. The -s1 wave is critic-filtered (run-stage1-launch.js:54) and
+ * a retry wave is the loss subset (`run-retry.js :: retryStage1Losses` launches
+ * `unit.models`), so a legId's `-N` suffix indexes this roster, never bench position.
+ *
+ * Callers legitimately hold legs from several waves at once, so a leg stamped
+ * with a DIFFERENT waveId is ignored rather than reported — call once per wave
+ * over the same array. A leg with NO waveId (result-schema.js:61 falls back to
+ * `metadata.parentWave || null`, and the council fixtures omit it) may bind
+ * ONLY by an exact roster-slot id: adopting it by alias would silently claim a
+ * foreign wave's leg.
+ *
+ * Resolution order per leg:
+ *   1. `leg.legId || leg.taskId` matching `${waveId}-${n}` → roster slot n.
+ *      Both are read because legId is never persisted, so every disk-rebuilt
+ *      wave is taskId-only.
+ *   2. alias (`leg.modelInput || leg.model`), only for a wave-stamped leg and
+ *      only when that alias holds exactly one seat in this roster — for every
+ *      bench that has ever run, this is today's exact behaviour.
+ *   3. neither → the leg is an orphan and the seat stays unbound.
+ *
+ * The greedy `.*` needs no invariant about waveId shapes: it takes the
+ * LONGEST prefix before a trailing `-<digits>`, and the `m[1] === waveId`
+ * equality then rejects anything that is not precisely this wave. A waveId
+ * that itself ends in digits (`r-2`) parses correctly — verified by brute
+ * force over adversarial (waveId, legId) pairs. Two CI reviewers read the
+ * old wording as a live hazard; it was a defensive note, not a dependency.
+ *
+ * `bound` says nothing about USABILITY: a leg that ran and died still binds
+ * (run-launch.js :: materializeReviews drops non-complete legs later).
+ * PR2's dead-seat set is `unbound ∪ deadWave.seats ∪ {bound seats
+ * materializeReviews rejected}`.
+ *
+ * @param {string} waveId
+ * @param {?Array<object>} seats the wave's launch roster, in launch order
+ * @param {?Array<object>} legs
+ * @returns {{bound: Array<{seat: object, leg: object}>, unbound: Array<object>, orphanLegs: Array<object>}}
+ */
+function bindSeats(waveId, seats, legs) {
+  const roster = Array.isArray(seats) ? seats.filter(Boolean) : [];
+  const all = Array.isArray(legs) ? legs.filter(Boolean) : [];
+  const mine = all.filter(l => !l.waveId || l.waveId === waveId);
+  const takenBy = new Map();
+  const bound = [];
+  const orphanLegs = [];
+  for (const leg of mine) {
+    const id = leg.legId || leg.taskId;
+    const m = typeof id === 'string' ? id.match(/^(.*)-(\d+)$/) : null;
+    let seat = (m && m[1] === waveId) ? roster[Number(m[2]) - 1] : undefined;
+    if (!seat && leg.waveId === waveId) {
+      const alias = leg.modelInput || leg.model;
+      const hits = roster.filter(s => s.alias === alias);
+      seat = hits.length === 1 ? hits[0] : undefined;
+    }
+    if (!seat || takenBy.has(seat.id)) { orphanLegs.push(leg); continue; }
+    takenBy.set(seat.id, leg);
+    bound.push({ seat, leg });
+  }
+  return { bound, unbound: roster.filter(s => !takenBy.has(s.id)), orphanLegs };
+}
+
+/**
+ * The artifact filename for one seat. Reproduces the four shapes shipping
+ * today — review-/judge-/rebuttal-/revote-<name>.md, the exact key set
+ * workspace/artifact-guard.js enumerates — with the seat id in place of the
+ * alias. Identical output for every bench that has ever run; a twin sanitizes
+ * to `review-deepseek-2.md`, which is the collision surface preflightSeats
+ * rejects pre-spend.
+ * @param {{id: string}} seat
+ * @param {'review'|'judge'|'rebuttal'|'revote'} kind
+ * @returns {string}
+ */
+function artifactName(seat, kind) {
+  return `${kind}-${sanitizeName(seat && seat.id)}.md`;
+}
+
+/**
+ * How a seat is named to a human — chair packet review headers today.
+ * Deliberately the seat id and nothing more: spec §4.2's byte-identical
+ * promise means a unique-alias seat MUST render as its bare alias, so lens
+ * text, position and role can never be appended unconditionally. It exists as
+ * a named seam so a later rev changes presentation in one place instead of at
+ * every call site.
+ * @param {{id: string}} seat
+ * @returns {string}
+ */
+function displayName(seat) {
+  return seat && seat.id;
+}
+
+const SEATS_ERROR = 'COUNCIL_SEATS_INVALID';
+
+/**
+ * Mint the seat table and validate it, pre-spend. Runs AFTER initRun (so the
+ * error doc lands in a run dir that exists) and BEFORE any launch, exactly like
+ * its sibling preflightClaudeReview.
+ *
+ * Rejects five ways, all zero-spend:
+ *   - two bench entries resolving to the SAME seat id (a bench alias spelling
+ *     another alias's disambiguated id, e.g. 'deepseek#2' beside twin
+ *     'deepseek' entries) — that table would be incoherent as a join key,
+ *   - a collision in which a DISAMBIGUATED (#N) id participates, i.e. two seats
+ *     whose review files would be the same name. Deliberately narrow: a
+ *     pure-alias collision ('vendor/a' vs 'vendor?a') runs today and
+ *     workspace/artifact-guard.js exists to detect and surface it, so v4.8
+ *     refuses only the collisions its own id scheme creates
+ *     (any '#' in a seat id counts — a literal alias containing '#' is the
+ *     same collision surface as a minted #N id),
+ *   - a --critic alias occupying more than one seat,
+ *   - a critic that is not on the bench at all. runCouncil never checked this
+ *     (only the CLI/MCP handlers did), so a direct require() caller silently
+ *     launched an N+1th leg meta.models never mentioned,
+ *   - --critic together with a non-empty --lenses. Under lenses every seat
+ *     already carries its own lens role, so criticSeat would name a seat
+ *     buildSeats gave a `lens:*` role — both handlers already enforce this
+ *     XOR; the engine now does too. An empty lenses array is not lenses
+ *     anywhere else in this module (buildSeats' `lensed` check above), so it
+ *     does not trip this guard.
+ *
+ * Remedies ride INSIDE message: the engine error is {code, message} and both
+ * render paths discard anything else. The message never suggests naming a seat
+ * id — every entry point requires bench.includes(critic), so that spelling
+ * cannot work until PR2 teaches the handlers.
+ *
+ * @param {{models: ?Array<string>, critic: ?string, lenses: ?Array<string>}} o
+ * @returns {{seats: ?Array<object>, criticSeat: ?string, error: ?{code: string, message: string}}}
+ */
+function preflightSeats(o) {
+  const bad = (detail) => ({ seats: null, criticSeat: null,
+    error: { code: SEATS_ERROR, message: `council_seats_invalid: ${detail}` } });
+  const seats = buildSeats(o.models, o.critic, o.lenses);
+
+  const byId = new Set();
+  const byFile = new Map();
+  for (const s of seats) {
+    if (byId.has(s.id)) {
+      return bad(`two bench entries both resolve to seat id '${s.id}' — a bench alias may not `
+        + "spell another alias's disambiguated seat id; rename one entry");
+    }
+    byId.add(s.id);
+    const file = artifactName(s, 'review');
+    const prev = byFile.get(file);
+    // Only reject collisions this id scheme created: at least one side must be
+    // a disambiguated id. Pure-alias collisions are artifact-guard's to surface.
+    if (prev && (prev.includes('#') || s.id.includes('#'))) {
+      return bad(`seats '${prev}' and '${s.id}' would both write ${file} — rename one bench entry`);
+    }
+    if (!prev) { byFile.set(file, s.id); }
+  }
+
+  if (o.critic && Array.isArray(o.lenses) && o.lenses.length > 0) {
+    return bad('--critic and --lenses are mutually exclusive: under lenses every seat carries its '
+      + 'own lens role and no seat can be the critic — drop one of the two');
+  }
+
+  if (o.critic) {
+    const hits = seats.filter(s => s.alias === o.critic);
+    if (hits.length === 0) {
+      return bad(`--critic '${o.critic}' is not on the bench (${seats.map(s => s.id).join(', ') || 'empty'})`);
+    }
+    if (hits.length > 1) {
+      return bad(`--critic '${o.critic}' is ambiguous: that alias occupies ${hits.length} bench seats `
+        + '— remove the duplicate bench entry, or use two distinct aliases');
+    }
+    return { seats, criticSeat: hits[0].id, error: null };
+  }
+  return { seats, criticSeat: null, error: null };
+}
+
+module.exports = { buildSeats, roleAt, bindSeats, artifactName, displayName, preflightSeats, slug, sanitizeName };

package/src/council/stage1-bind.js

@@ -0,0 +1,142 @@
+// src/council/stage1-bind.js
+'use strict';
+// Stage-1 seat binding (v4.8 workstream A, spec §4.4). Lives here rather than in
+// run-stages.js because that file is at 292/300 and this is where the leg<->seat
+// join and its two failure shapes belong together.
+
+const { bindSeats } = require('./seats');
+
+/**
+ * Bind every Stage-1 wave to its own roster, ONE CALL PER WAVE.
+ *
+ * Never call bindSeats once over the flattened leg array: seats.js:133 admits a
+ * leg with no waveId, so a concatenated array makes wave B's legs candidates for
+ * wave A's slots. The waves[] entries from launchStage1 are already partitioned
+ * by construction (run-stage1-launch.js captures each wave's own `got`).
+ *
+ * @param {Array<{waveId: string, roster: Array<object>, legs: Array<object>}>} waves
+ * @returns {{seatOf: Map<object, object>,
+ *   missingSeats: Array<{waveId: string, seat: object, returned: number, expected: number}>,
+ *   orphanLegs: Array<{waveId: string, leg: object}>}}
+ */
+function bindStage1Waves(waves) {
+  const seatOf = new Map();
+  const missingSeats = [];
+  const orphanLegs = [];
+  for (const w of (Array.isArray(waves) ? waves : [])) {
+    const legs = Array.isArray(w.legs) ? w.legs : [];
+    const roster = Array.isArray(w.roster) ? w.roster : [];
+    const { bound, unbound, orphanLegs: strays } = bindSeats(w.waveId, roster, legs);
+    for (const b of bound) { seatOf.set(b.leg, b.seat); }
+    for (const leg of strays) { orphanLegs.push({ waveId: w.waveId, leg }); }
+    // A wave that returned ZERO legs contributes no missing seats: it is already a
+    // dead wave (or a budget refusal, or an abort), each with its own louder
+    // channel. A wave that returned legs we could NOT attribute contributes none
+    // either: an orphan leg is a review that LANDED — materializeReviews writes it
+    // under its alias name — for a seat we cannot name. Retrying that seat would
+    // buy a SECOND paid leg and put two reviews on one seat, breaking the
+    // invariant run-stages.js:142-151 states. The orphan is already announced on
+    // `seat-unbound` at bind time (R-B: orphans are not a loss and not retryable).
+    if (legs.length === 0 || strays.length > 0) { continue; }
+    for (const seat of unbound) {
+      missingSeats.push({ waveId: w.waveId, seat, returned: legs.length, expected: roster.length });
+    }
+  }
+  return { seatOf, missingSeats, orphanLegs };
+}
+
+/**
+ * A returned leg that matches no roster slot. Announced immediately — unlike a
+ * missing seat it is not a loss and there is nothing to retry, and unlike a
+ * mis-binding it is exactly the case where guessing would be wrong.
+ */
+function orphanLegNote(waveId, leg) {
+  const legId = (leg && (leg.legId || leg.taskId)) || 'unidentified';
+  const alias = (leg && (leg.modelInput || leg.model)) || 'unknown';
+  return {
+    channel: 'seat-unbound',
+    what: `leg ${legId} in wave ${waveId} matches no seat on that wave's roster`,
+    why: `its id names no roster slot of ${waveId}, and its model '${alias}' does not identify `
+      + 'exactly one seat there',
+    effect: 'Its review is kept under its model name and is NOT attributed to a seat; nothing was '
+      + 'guessed and nothing was dropped',
+    data: { waveId, legId, seat: alias },
+  };
+}
+
+/**
+ * Turn a missing seat into a single-seat dead-wave record so the ordinary SL-2
+ * retry machinery relaunches it (owner ruling R-B). `partial: true` is what keeps
+ * the prose honest downstream: the wave DID produce legs, so the plain dead-wave
+ * sentence would be false.
+ */
+function missingSeatDeadWave(m) {
+  return {
+    waveId: m.waveId,
+    models: [m.seat.alias],
+    seats: [m.seat],
+    // ASCII apostrophe deliberately: this string reaches a terminal through
+    // formatDegrade, and a Windows console can mangle U+2019. It was the only
+    // curly quote in src/ — and had no caller until v4.8 PR2b Task 7 shipped it.
+    reason: `the wave returned ${m.returned} of ${m.expected} legs and none of them was this seat's`,
+    partial: true,
+  };
+}
+
+/**
+ * Bind ONE wave whose roster may have HOLES: pad the holes, bind, then drop
+ * every placeholder bind. Appended (never inserted) by v4.8 SI-27 / R14, which
+ * consolidated the block that stood byte-identical at three call sites ONCE `waveId`
+ * and the alias lookup are parameterised — site 2's callback was literally
+ * `(r, i) => { if (r.seat) … }`, reading the seat off a review, not off a roster
+ * slot. The three sites: `run-retry-launch.js :: bindRetryWave`,
+ * `run-stage2.js :: runStage2` and `run-debate-revote.js :: runRevoteWave`.
+ *
+ * How this differs from `bindStage1Waves` above: that one takes MANY waves, each
+ * with a REAL roster — no padding, no placeholders, and it owns its own missing/
+ * orphan bookkeeping. This one takes ONE wave and a roster source that may carry
+ * falsy slots, and owns nothing past the bind.
+ *
+ * A falsy entry means "we could not identify this seat"; pad it with a
+ * position-stable placeholder carrying a UNIQUE id so no slot shifts, then drop
+ * the placeholder binds so nothing is guessed. ⚠️ Never pass `rosterSource` raw
+ * and never use a null-id sentinel: `seats.js :: bindSeats` filters falsy roster
+ * entries internally (so raw === filtered, and both slide every later slot into
+ * a hole), and two `{id: null}` sentinels collide on the id-keyed dedup.
+ *
+ * Placeholders are tracked by IDENTITY, never by an id-name prefix test: a bench
+ * alias that literally began `__unbound-` would make a name test drop a REAL
+ * seat's binding — a name-collision channel inside the one mechanism whose whole
+ * contract is "never guess".
+ *
+ * `bindRes` and `placeholders` come back raw because the ORPHAN/MISSING tail
+ * differs at every call site and STAYS there: site 1 returns `orphanLegs` to its
+ * caller, site 2 notes orphans and walks `bindRes.unbound` (skipping
+ * `placeholders`) for missing seats, site 3 has no tail at all.
+ *
+ * No argument guards by design (R27-3): each call site keeps the guard it has.
+ *
+ * @param {string} waveId
+ * @param {Array<?object>} rosterSource one entry per launched slot; falsy where the seat is unknown
+ * @param {(i: number) => string} aliasAt the alias that launched in slot i
+ * @param {Array<object>} legs the wave's returned legs
+ * @returns {{seatOf: Map<object, object>,
+ *   bindRes: {bound: Array<object>, unbound: Array<object>, orphanLegs: Array<object>},
+ *   placeholders: Set<object>}}
+ */
+function bindPaddedWave(waveId, rosterSource, aliasAt, legs) {
+  const placeholders = new Set();
+  const roster = rosterSource.map((s, i) => {
+    if (s) { return s; }
+    const p = { id: `__unbound-${waveId}-${i + 1}`, alias: aliasAt(i), role: 'seat', lens: null, position: i + 1 };
+    placeholders.add(p);
+    return p;
+  });
+  const bindRes = bindSeats(waveId, roster, legs);
+  const seatOf = new Map(bindRes.bound
+    .filter(b => !placeholders.has(b.seat))
+    .map(b => [b.leg, b.seat]));
+  return { seatOf, bindRes, placeholders };
+}
+
+module.exports = { bindStage1Waves, orphanLegNote, missingSeatDeadWave, bindPaddedWave };

package/src/council/street-cred.js

@@ -0,0 +1,258 @@
+// src/council/street-cred.js
+'use strict';
+
+/**
+ * @module council/street-cred
+ * The street-cred half of the tally: rank positions, the seat universe, and
+ * `computeStreetCred` itself. Split out of ./tally at v4.8 T3.3 because the
+ * seat-keying work took that file to 301 of 300 lines — release Constraint 6
+ * is EXTRACT, never shave a comment to fit. ./tally re-exports
+ * `computeStreetCred`, so no import path in the tree moved.
+ *
+ * ⚠️ REQUIRE-FREE by design, the ./seats · ./run-stats-entry · ./peer-split
+ * precedent: this is a leaf, so the dependency runs one way (tally.js ->
+ * street-cred.js) and cannot cycle.
+ *
+ * ⚠️ EIGHT named mutants guard the expressions below — RANKALIAS, ALIASSELF,
+ * JUDGEALIAS, SEATALWAYS, ALIASDRIVER, NOFALLBACK, EXPANDONCE (v4.8
+ * follow-up) and PROTORANK (SI-24). Each mutation and its MEASURED red set is
+ * recorded beside the others, in tests/council/street-cred-mutants.js ::
+ * RANKALIAS and its seven siblings there, following the
+ * tests/council/peer-split-mutants.js :: SPLITDROP precedent. RE-RUN them,
+ * never renumber them, whenever anything here or any of its consumers
+ * changes.
+ */
+
+function mean(arr) { return arr.reduce((s, x) => s + x, 0) / arr.length; }
+
+/**
+ * Map each ranked IDENTITY to its (possibly fractional) rank position in one
+ * judge's order — its SEAT id where the parallel `orderSeats` channel names
+ * one, its alias otherwise.
+ *
+ * v4.8 T3.3, the first of SI-20's three collapse sites. `pos.set(m, …)` was
+ * last-wins BY ALIAS, so a twin bench's `order ['a','a','b']` overwrote the
+ * first twin's position 1 with the second's 2 instead of giving each its own
+ * entry. MEASURED at BASE `b341b273` on that bench: both `a` street-cred rows
+ * came back `withSelf 2.667 / peersOnly 3` off the SAME collapsed map, and
+ * `JSON.stringify(row0) === JSON.stringify(row1)` was `true`. Seat keys are
+ * what make those two rows diverge — which is why the ledger's join had to be
+ * seat-aware in the same commit; the hazard is written out in full at
+ * ledger-join.js :: credFor.
+ *
+ * `order` itself is UNTOUCHED: still alias-valued, still the array the tally
+ * schema reads, and still what `briefings-chair.js :: buildChairPacket` falls
+ * back to per slot.
+ * ⚠️ DO NOT READ THAT AS "orderSeats cannot affect what the chair reads" — it
+ * could not when this was written, and v4.8 SI-25 changed it.
+ * `briefings-chair.js :: seatKeyedOrder` now zips `orderSeats` OVER `order` to
+ * render the chair packet's rankings block, so this channel has a live PROSE
+ * consumer besides this function, and a shape change here reaches the one
+ * artifact a paid chair reads as authoritative. Check that renderer and its
+ * pins (tests/council/chair-packet-seats.test.js) before altering the shape.
+ * `orderSeats` mirrors `order` slot for slot — anonymize.js :: rankingToOrder
+ * builds both from the same `slots` array in the same pass, so a tie group is
+ * an array in both. Where it is absent, shorter, or holds `null` (every
+ * pre-T3.2 caller, every unique-alias bench, and any hand-assembled input the
+ * seat machinery never touched) `|| group[k]` falls back to the alias and this
+ * function returns byte-for-byte what it returned before.
+ * @param {Array<string|string[]>} order alias-valued rank slots
+ * @param {?Array<?string|Array<?string>>} orderSeats parallel seat ids, null per unseated slot
+ */
+function rankPositions(order, orderSeats) {
+  const pos = new Map();
+  let p = 1;
+  for (let i = 0; i < order.length; i += 1) {
+    const group = Array.isArray(order[i]) ? order[i] : [order[i]];
+    const seatSlot = orderSeats ? orderSeats[i] : null;
+    const seatGroup = Array.isArray(seatSlot) ? seatSlot : [seatSlot];
+    const meanPos = p + (group.length - 1) / 2;
+    for (let k = 0; k < group.length; k += 1) { pos.set(seatGroup[k] || group[k], meanPos); }
+    p += group.length;
+  }
+  return pos;
+}
+
+/**
+ * The street-cred universe: exactly one entry per `models` OCCURRENCE, never
+ * fewer and never more. `seats` NAMES rows; it never changes how many exist.
+ *
+ * v4.8 follow-up (2026-08-21) — council findings 1+2 on PR #176, reproduced at
+ * BASE `13cd0a2d`. The row count used to follow `seats` wherever it disagreed
+ * with `models`'s repeat count for an alias: the FIRST occurrence the table
+ * named expanded into ALL of that alias's registered ids at once, and every
+ * LATER occurrence of the same alias was skipped outright. So an alias the
+ * table OVER-registers (more ids than `models` repeats it) INVENTED an extra
+ * row on its first occurrence, and an alias it UNDER-registers (fewer ids than
+ * `models` repeats it) DROPPED a row on its later occurrence(s) once the
+ * table's ids for it ran out. Both are reachable only on the two
+ * hand-assembled `appendRun` paths — `mcp-tools.js :: amicus_council_tally`
+ * declares `meta.seats` independently of `meta.models` and
+ * `cli-handlers-council.js` passes user JSON through verbatim — never on the
+ * engine's own output. ⚠️ NOT because `seats[]` and `models` always agree —
+ * they do not: `meta.models` carries a `claude` tail on a `claudeInCouncil`
+ * run (synthesized downstream of `buildSeats`, seats.js:44-45) that `seats[]`
+ * never names, so the two can differ in LENGTH. What DOES hold, for every
+ * alias `seats[]` was built FROM: `seats.js :: buildSeats` is
+ * `aliases.map(...)` over the bench array `models` is built from, so it is
+ * structurally one-to-one with that bench and cannot itself over- or
+ * under-register any bench alias, independent of anything `preflightSeats`
+ * separately rejects (id collisions, critic placement). The `claude` tail
+ * falls to the `!ids` branch below exactly like an alien alias does — a
+ * shortfall this function already handles by design, not a counterexample to
+ * it (pinned as the "claude tail" case, both here and in the invariant table
+ * at street-cred.test.js).
+ *
+ * FIX: the k-th occurrence of alias `m` in `models` takes the k-th id
+ * `byAlias.get(m)` registered for it, in table order. Once that list is
+ * exhausted (or the table never named `m` at all) the occurrence gets an
+ * ALIAS-KEYED row (`key: m, seat: null`) instead of being dropped, and a
+ * surplus registered id simply goes unused instead of being invented into an
+ * extra row — so `credSeats(models, seats).length === models.length` always.
+ *
+ * ⚠️ ROW ORDER, SEPARATELY — review round 1 of this task, Important 1. This
+ * function's row order is now `models` order, always: each occurrence pushes
+ * exactly where its own index puts it. The pre-fix loop ALSO happened to
+ * group an alias's rows at its first occurrence (`expanded.has(m) ->
+ * continue` skipped every later one), so on a NON-ADJACENT repeat — an
+ * ordinary engine bench, e.g. `['a','b','a']`, `buildSeats` handles it fine —
+ * this function's order now differs from BASE's even though every ADJACENT
+ * case in this file's own tests (and the ones street-cred.test.js pins) never
+ * showed it. Content is identical either way, only order moves; RULING
+ * (owner): the new `models`-order form is correct — BASE's grouping was an
+ * accident of the buggy loop, never a stated doctrine, and this order already
+ * agrees with `meta.seats`/`position`, which are in `models` order too. Full
+ * measurement, the mutant that pins it (EXPANDONCE), and the ruling's
+ * reasoning are at street-cred.test.js's "non-adjacent repeat" tests and
+ * tests/council/street-cred-mutants.js :: EXPANDONCE.
+ *
+ * ⚠️ JOINED BY VALUE — never positionally. run-assemble.js :: buildTallyInput
+ * forbids the positional join in-code and the reasons are all live here:
+ * `seats[]` is BENCH-ONLY, `meta.models` carries a `claude` tail it never has,
+ * and two of appendRun's three call sites feed hand-assembled input no seat
+ * machinery touches — exactly the input shape where `models` and `seats` can
+ * disagree in COUNT, not merely in content.
+ * @param {string[]} models meta.models (the ALIAS list)
+ * @param {?Array<{id: string, alias: string}>} seats meta.seats, absent on most runs
+ * @returns {Array<{model: string, key: string, seat: ?string}>} always
+ *   `models.length` entries. `key` is what rankPositions keyed by; `seat` is
+ *   the id, null unless it DIFFERS from the alias — the emit-when-DIFFERENT
+ *   predicate every seat producer shares (run-stats-entry.js ::
+ *   buildRunStatsEntry), so a unique-alias bench emits no seat field anywhere
+ *   and its documents stay byte-identical.
+ */
+function credSeats(models, seats) {
+  const byAlias = new Map();
+  for (const s of (Array.isArray(seats) ? seats : [])) {
+    if (!s || typeof s.alias !== 'string' || typeof s.id !== 'string') { continue; }
+    if (!byAlias.has(s.alias)) { byAlias.set(s.alias, []); }
+    byAlias.get(s.alias).push(s.id);
+  }
+  // Named mutant "EXPANDONCE": revert this whole loop to the pre-fix form —
+  // the first occurrence of a named alias expands into EVERY id it has
+  // registered, and `expanded.has(m) -> continue` skips every later
+  // occurrence outright. That is a wholesale swap rather than a token flip
+  // because the two algorithms track different state (a Set of aliases
+  // already expanded vs. a per-alias occurrence count) — there is no smaller
+  // edit that reproduces the drop/invent pair. tests/council/street-cred-mutants.js :: EXPANDONCE.
+  const seen = new Map(), rows = [];
+  for (const m of models) {
+    const k = seen.get(m) || 0;
+    seen.set(m, k + 1);
+    // Named mutant "ALIASDRIVER": force `id` to always be falsy, so the table
+    // built above is never consulted and every row is alias-keyed —
+    // tests/council/street-cred-mutants.js :: ALIASDRIVER.
+    const id = (byAlias.get(m) || [])[k];
+    rows.push(id ? { model: m, key: id, seat: id === m ? null : id }
+                 : { model: m, key: m, seat: null });
+  }
+  return rows;
+}
+
+/**
+ * Both-numbers street-cred, ONE ROW PER SEAT. Lower mean rank = better.
+ *
+ * v4.8 T3.3 closes SI-06 and the rest of SI-20 here. Three things move, and
+ * all three are no-ops on a bench with no repeated alias:
+ *
+ * 1. THE DRIVER is `credSeats` above, not `models.map`. A twin bench used to
+ *    emit two BYTE-IDENTICAL rows for the one alias (measured at BASE); it now
+ *    emits one row per seat, each carrying its own numbers and its own `seat`.
+ * 2. THE PEER SPLIT was `judge !== m`, the THIRD alias comparison in the engine
+ *    (SI-06). It now compares SEATS when both sides carry one and aliases
+ *    otherwise — the same two-branch shape as peer-split.js :: peersOf (P0 then
+ *    P3), reused rather than re-derived. ⚠️ CONTROLLER RULING (ledger C-2):
+ *    self-exclusion drops only the judge that IS this seat; the twin's OTHER
+ *    seat COUNTS AS A PEER. That matches peersOf's P0 branch, where a vote
+ *    whose seat differs from the raiser's is a real peer, and the
+ *    `sameModelCorroboration` stamp in tally.js :: tally already exists to mark
+ *    such support as concurrence rather than independence. Counting-and-marking
+ *    is this release's settled shape (owner ruling R2). The alias arm is what a
+ *    bench with no seat channel keeps, so today's numbers do not move there.
+ * 3. `perJudgeRank` was `[judge] = rank` — last-wins by judge alias while
+ *    `all`/`peers` accumulate into ARRAYS, so on a twin-JUDGE bench the map and
+ *    the averages disagreed about the SAME row (the phasing doc's row `| 24 |`
+ *    data-loss site). MEASURED at BASE on judges `['a','a','b']` all ranking
+ *    `a`: `perJudgeRank {"a":3,"b":3}` — 2 entries for 3 judges, implying mean
+ *    3, while `withSelf` reported 2.667. Keying on the judge's SEAT closes it
+ *    wherever a seat channel exists, which is every engine-produced twin bench
+ *    (run-assemble.js emits `rankings[].seat` for both twins).
+ *    ⚠️ RESIDUAL, stated rather than left to be discovered: hand-assembled or
+ *    MCP input that repeats a judge alias and carries NO seat still collapses,
+ *    because nothing in that document can tell the two judges apart. Ruling R2
+ *    governs — attribute nothing where there is nothing to attribute.
+ * 4. `perJudgeRank` is ALSO `Object.create(null)` now, not a bare `{}` — a
+ *    WRITE-site defect, separate from item 3's alias-collapse one and unlike
+ *    a READ-site one (this release's other prototype fix, tally.js ::
+ *    VERDICTS). `perJudgeRank[j.seat || j.judge] = rank` assigning through
+ *    the string key `__proto__` invokes the INHERITED `Object.prototype`
+ *    `__proto__` setter instead of creating an own property; the setter
+ *    silently ignores a non-object value, so the rank is discarded — no
+ *    throw, no own key to read back. `toString`/`constructor`/`valueOf` are
+ *    unaffected — they shadow harmlessly and DO create own keys — so only
+ *    `__proto__` was ever lost here. MEASURED at BASE, judge `__proto__`:
+ *    `perJudgeRank` came back `{}` (`Object.keys` empty) while `all`/
+ *    `withSelf` still counted the vote (`withSelf` 1) — map and average
+ *    disagreeing about the SAME row, exactly as item 3 describes for the
+ *    alias-collapse half. A `__proto__` SEAT id is lost the same way: both
+ *    channels feed the one assignment.
+ *
+ * @param {Array<{judge:string, order:Array<string|string[]>, seat?:string,
+ *   orderSeats?:Array<?string|Array<?string>>}>} rankings
+ * @param {string[]} models all reviewed models (incl. claude when in-council)
+ * @param {?Array<{id: string, alias: string}>} seats meta.seats, when the document has one
+ */
+function computeStreetCred(rankings, models, seats) {
+  const judgePos = rankings.map(r => ({
+    judge: r.judge, seat: r.seat || null, pos: rankPositions(r.order, r.orderSeats),
+  }));
+  return credSeats(models, seats).map(({ model, key, seat }) => {
+    const all = [], peers = [], perJudgeRank = Object.create(null);
+    for (const j of judgePos) {
+      // Seat key first, ALIAS SECOND. `meta.seats` and `rankings[].orderSeats`
+      // are independent channels: a document can carry the seat table while its
+      // rankings are alias-only (both hand-assembled `appendRun` paths, and an
+      // MCP caller that omits orderSeats). Without the fallback both seat rows
+      // would find nothing in an alias-keyed map and report null street cred —
+      // strictly worse than the collapse this task exists to fix. With it they
+      // read the same collapsed position today's code gives, and only the new
+      // `seat` field distinguishes them.
+      const rank = j.pos.has(key) ? j.pos.get(key) : j.pos.get(model);
+      if (rank === undefined) { continue; }   // absent from this judge's ranking → skip
+      perJudgeRank[j.seat || j.judge] = rank;
+      all.push(rank);
+      if ((j.seat && seat) ? j.seat !== seat : j.judge !== model) { peers.push(rank); }
+    }
+    return {
+      model,
+      withSelf: all.length ? mean(all) : null,
+      peersOnly: peers.length ? mean(peers) : null,
+      perJudgeRank,
+      // Last, matching verdict.js :: buildVerdict's streetCred literal, which
+      // already carries this field through under the same predicate (T3.2).
+      ...(seat ? { seat } : {}),
+    };
+  });
+}
+
+module.exports = { computeStreetCred, rankPositions, credSeats };