amicus 4.7.0 → 4.8.0

package/src/council/tally.js

@@ -1,5 +1,11 @@
 // src/council/tally.js
 'use strict';
+const { peersOf, unattributedPeerDrops } = require('./peer-split');
+// The street-cred half (rankPositions / credSeats / computeStreetCred) lives in
+// ./street-cred (v4.8 T3.3 size-gate split; this file stood at 301 of 300 with
+// the seat-keying in it — release Constraint 6 is EXTRACT, never shave).
+// computeStreetCred is re-exported below, so no existing import path moved.
+const { computeStreetCred } = require('./street-cred');
 
 /**
  * Peers-only tier cascade. a/d are agree/dispute counts among PEER judges
@@ -26,49 +32,9 @@ function assignTier(a, d) {
   return { tier, confidence };
 }
 
-function mean(arr) { return arr.reduce((s, x) => s + x, 0) / arr.length; }
-
-/** Map each model to its (possibly fractional) rank position in one judge's order. */
-function rankPositions(order) {
-  const pos = new Map();
-  let p = 1;
-  for (const slot of order) {
-    const group = Array.isArray(slot) ? slot : [slot];
-    const meanPos = p + (group.length - 1) / 2;
-    for (const m of group) { pos.set(m, meanPos); }
-    p += group.length;
-  }
-  return pos;
-}
-
-/**
- * Both-numbers street-cred. Lower mean rank = better.
- * @param {Array<{judge:string, order:Array<string|string[]>}>} rankings
- * @param {string[]} models all reviewed models (incl. claude when in-council)
- */
-function computeStreetCred(rankings, models) {
-  const judgePos = rankings.map(r => ({ judge: r.judge, pos: rankPositions(r.order) }));
-  return models.map(m => {
-    const all = [], peers = [], perJudgeRank = {};
-    for (const { judge, pos } of judgePos) {
-      if (!pos.has(m)) { continue; }       // absent from this judge's ranking → skip
-      const rank = pos.get(m);
-      perJudgeRank[judge] = rank;
-      all.push(rank);
-      if (judge !== m) { peers.push(rank); }
-    }
-    return {
-      model: m,
-      withSelf: all.length ? mean(all) : null,
-      peersOnly: peers.length ? mean(peers) : null,
-      perJudgeRank,
-    };
-  });
-}
-
 // v4.0 §7: council family v2 — every council doc carries {schemaVersion, type}.
 const COUNCIL_SCHEMA_VERSION = 2;
-const VERDICTS = { agree: 'a', dispute: 'd', neutral: 'n' };
+const VERDICTS = { __proto__: null, agree: 'a', dispute: 'd', neutral: 'n' };
 
 function countTiers(findings) {
   const counts = { Confirmed: 0, Contested: 0, Singleton: 0, Disputed: 0 };
@@ -86,31 +52,111 @@ function tally(input) {
   const byFinding = new Map();
   for (const adj of adjudications) {
     if (!byFinding.has(adj.findingId)) { byFinding.set(adj.findingId, []); }
-    byFinding.get(adj.findingId).push({ judge: adj.judge, verdict: adj.verdict });
+    byFinding.get(adj.findingId).push({ judge: adj.judge, verdict: adj.verdict, ...(adj.seat ? { seat: adj.seat } : {}) });
   }
   const outFindings = findings.map(f => {
     const votes = byFinding.get(f.id) || [];
-    // Only exclude the raiser's own vote when a raiser is known; the raiser is
-    // populated by the orchestrator (not the reviewer JSON), so an unset raiser
-    // must not silently drop a real peer vote (L8).
-    const peers = f.raiser ? votes.filter(v => v.judge !== f.raiser) : votes;
+    const peers = peersOf(f, votes);
+    // v4.8 T-B2: how many votes `peersOf` excluded without being able to
+    // attribute them — the one-sided alias fallback, plus (T-B4) the falsy
+    // judges of a falsy raiser. ⚠️ NOT the votes the SEAT ids attributed: when
+    // both sides carry a seat id the engine knows whose vote it is, so that
+    // exclusion is announced by nothing. Same function and same emit rule
+    // (> 0 only) as debate.js :: debateTargets, so this document and the
+    // defense brief can never announce different numbers.
+    // ⚠️ On the SEATED shapes — tally.test.js T1 and T2, the one-sided twin
+    // pair — `basis` deliberately does NOT move: counting the ambiguous vote
+    // reproduces the naive filter's outcome, measured Confirmed on both, which
+    // re-arms #137. Announced, not counted. ⚠️ T-B4 is the deliberate exception
+    // and the scope of that sentence narrowed with it: on a finding whose
+    // raiser is FALSY, `basis` DOES move, because there the ambiguous vote is
+    // the raiser's own inflating its own basis rather than a twin's signal
+    // going uncounted (council C1 — see peer-split.js :: peersOf).
+    const drops = unattributedPeerDrops(f, votes);
     const basis = { a: 0, d: 0, n: 0 };
     // Skip unknown verdict strings so a stray value can't corrupt the basis via
-    // basis[undefined] = NaN (L9).
+    // basis[undefined] = NaN (L9). Guaranteed by VERDICTS's `__proto__: null`,
+    // not `!== undefined` alone — measured, all four Object.prototype keys
+    // (toString/__proto__/constructor/valueOf) read undefined on it. VERDICTS
+    // is module-local, absent from module.exports, so this isn't observable
+    // outside this file.
     for (const v of peers) {
       const key = VERDICTS[v.verdict];
       if (key !== undefined) { basis[key] += 1; }
     }
     const { tier, confidence } = assignTier(basis.a, basis.d);
+    // v4.8 PR4c §3.3 (R8): `peers` has already excluded the raiser BY SEAT, so a
+    // surviving peer whose ALIAS equals the raiser's is a different seat of the
+    // same model — corroboration that is not independent. Emitted only when TRUE
+    // (an unconditional `false` would change every document's shape).
+    // ⚠️ The leading `f.raiser &&` is LOAD-BEARING, not decoration — and the
+    // interesting part is that this sentence was FALSE for one commit inside
+    // v4.8 T-B4, so it is written with its measurement rather than its
+    // adjective. It is load-bearing because `peersOf` can hand back a
+    // seat-carrying vote whose `judge` is falsy, and then `v.judge === f.raiser`
+    // reads `undefined === undefined` on the CLI path (cli-handlers-council.js
+    // is a raw JSON.parse with no schema) and `'' === ''` on the MCP path
+    // (mcp-tools.js's z.string() accepts the empty string) — so without the
+    // guard this stamp fires on documents that name no models at all.
+    // MEASURED at each step over the 768-shape cross-product of (f.raiser,
+    // f.raiserSeat, v.judge, v.seat, verdict): deleting the guard flipped 8
+    // shapes at 64b835b8, ZERO after T-B4 round 1 — which had made `peersOf`
+    // drop every falsy-judge vote of a falsy raiser, briefly disarming the very
+    // pins that guarded this — and 4 after round 2, whose P0 rule counts the
+    // ones the SEAT ids prove are real peers. The 4 are the seat-DIFFER shapes
+    // of the T7b and T7d families, i.e. exactly those two tests. Re-run this
+    // after any edit to peer-split.js :: peersOf; do not infer it.
+    // ⚠️ Alias-only in BOTH directions, and the CHANGELOG says so: it misses
+    // `gpt-5,openai/gpt-5` (one model, two aliases — votes carry no
+    // resolvedModel) and it fires falsely on a SPLIT alias, whose two seats
+    // resolved to different executables. PR4b's ledger treats
+    // (alias, resolvedModel) as identity; this stamp is same-ALIAS only.
+    // SI-23 (R10): `location` is declared on the MCP schema now
+    // (mcp-tools.js :: getTools) so it survives zod validation, but
+    // surviving validation and reaching THIS document are two different
+    // properties — the round-trip pin below only holds if this map also
+    // forwards it, emit-when-present, the same convention as `raiserSeat`
+    // two lines up. Scoped to `location` alone AT R10: `claim` was already
+    // reaching this function on both the CLI and MCP paths (declared on the
+    // MCP schema since before R10) and was ALREADY not forwarded here — R10
+    // named the gap and left it for a separate PR rather than widening its
+    // own mandate to close it. SI-23 fix round 1 (paid council on PR #183,
+    // findings A1/B1, two independent raisers) ruled that indefensible one
+    // line from the fix it sits beside: `claim` is forwarded below too,
+    // same round.
+    // A2 (nit) / C1 (major, contested a0/d1/n2, thin): the truthiness checks
+    // below drop an empty string that zod would accept. Deliberate, not a
+    // bug — `raiserSeat` above uses the identical pattern, and diverging
+    // `location`/`claim` from their own immediate sibling is worse than the
+    // edge case, so "" is treated as absent on all three fields.
     return { id: f.id, raiser: f.raiser, severity: f.severity, tier, basis, confidence,
-             tierOverride: null, adjudications: votes };
+             tierOverride: null, adjudications: votes, ...(f.raiserSeat ? { raiserSeat: f.raiserSeat } : {}),
+             ...(f.location ? { location: f.location } : {}),
+             ...(f.claim ? { claim: f.claim } : {}),
+             ...(f.raiser
+               && peers.some(v => v.seat && f.raiserSeat && VERDICTS[v.verdict] === 'a' && v.judge === f.raiser)
+               ? { sameModelCorroboration: true } : {}),
+             ...(drops > 0 ? { unattributedPeerDrops: drops } : {}) };
   });
   return {
     schemaVersion: COUNCIL_SCHEMA_VERSION,
     type: 'council-tally',
     meta,
     judged: Array.isArray(rankings) && rankings.length >= 2,
-    streetCred: computeStreetCred(rankings || [], meta.models),
+    // v4.8 T3.3: `meta.seats` joins BY VALUE inside computeStreetCred (never
+    // positionally against meta.models — run-assemble.js :: buildTallyInput
+    // forbids that). The ENGINE emits it only when the bench repeats an alias,
+    // so a unique-alias run leaves the rows alias-driven and byte-identical.
+    // ⚠️ DO NOT READ THAT AS "hand-assembled input is always alias-driven" —
+    // this sentence said so until fix round 1 and it was false, in the way that
+    // hides a defect rather than merely misinforming. `meta` is copied verbatim
+    // from user JSON on both hand-assembled appendRun paths, and
+    // mcp-tools.js :: amicus_council_tally DECLARES `meta.seats`, so such a
+    // record produces SEAT-driven street-cred rows here while its `runStats`
+    // rows — declared `z.array(z.record(z.any()))`, so never asked for a seat —
+    // carry none. That asymmetry is a live quadrant, not a hypothetical; it is
+    // what ledger-join.js :: credFor's second lookup exists for.
+    streetCred: computeStreetCred(rankings || [], meta.models, meta.seats),
     findings: outFindings,
     runStats: (runStats || []).map(r => ({
       model: r.model, role: r.role, wasChair: !!r.wasChair, conformance: r.conformance || 'clean',
@@ -128,6 +174,11 @@ function tally(input) {
       ...(r.repairRefused ? { repairRefused: r.repairRefused } : {}),
       ...(r.waveId ? { waveId: r.waveId } : {}),
       ...(r.resolvedModel ? { resolvedModel: r.resolvedModel } : {}),
+      // v4.8 PR4c §3.1: `seat` rides the same slot. It is emitted upstream only
+      // when the bench repeats that alias (run-assemble.js's buildRunStatsEntry),
+      // so a unique-alias run is byte-for-byte unchanged here and in verdict.json,
+      // which copies this array verbatim (verdict.js :: buildVerdict).
+      ...(r.seat ? { seat: r.seat } : {}),
       status: r.status || 'unknown',
       durationMs: typeof r.durationMs === 'number' ? r.durationMs : null,
       usage: r.usage || null,

package/src/council/verdict.js

@@ -108,6 +108,13 @@ function buildVerdict(record, decisions = [], opts = {}) {
     date: record.meta.date,
     chair: record.meta.chair,
     council: record.meta.models,
+    // v4.8 PR4c §3.2: this projection RENAMES meta.models to `council`, so
+    // nothing from meta reaches verdict.json unless it is named here — which is
+    // why the seat table needs its own line rather than riding tally's verbatim
+    // meta copy. Emitted only when the record carries one (a twin bench), so a
+    // unique-alias verdict is byte-for-byte unchanged. The key is `seats`,
+    // matching the `seatLoss` sibling below; PR5 codes against that name.
+    ...(record.meta.seats ? { seats: record.meta.seats } : {}),
     claudeInCouncil: record.meta.claudeInCouncil,
     overallVerdict: opts.overallVerdict === undefined ? null : opts.overallVerdict,
     findings: record.findings.map(f => {
@@ -121,11 +128,52 @@ function buildVerdict(record, decisions = [], opts = {}) {
         adjudications: f.adjudications,
         decision: d.decision || null,
         applied: d.applied === true,
+        // v4.8 PR4c §3.4: this literal is CLOSED — it names every key and copies
+        // nothing else off `f` — so the two fields tally() stamps need their own
+        // lines or verdict.json names seats it cannot resolve (§1.2). Appended as
+        // a pure TAIL, leaving the shipped eleven-key order untouched.
+        // ⚠️ NOT `|| null`, even though `duplicateOf` and `decision` above are:
+        // `JSON.stringify({raiserSeat: null})` still WRITES `"raiserSeat":`, so
+        // that idiom changes the shape of every unique-alias verdict.json and
+        // fails seat-parity-ondisk's needles. `applied` is the sibling to copy —
+        // it computes a value rather than defaulting one. Emit-when-set matches
+        // both producers (tally.js) and keeps a non-twin verdict byte-identical.
+        ...(f.raiserSeat ? { raiserSeat: f.raiserSeat } : {}),
+        ...(f.sameModelCorroboration ? { sameModelCorroboration: true } : {}),
       };
       if (f.debate) { out.debate = f.debate; }   // v4.1: additive debate decoration carry-through (spec §5.6)
       return out;
     }),
-    streetCred: record.streetCred.map(s => ({ model: s.model, withSelf: s.withSelf, peersOnly: s.peersOnly })),
+    // v4.8 fix round 1 (review finding): emit-when-DIFFERENT, adapted to this
+    // row's flat {model, seat} shape — model is the alias, seat is the seat
+    // id, so on a unique-alias bench they are byte-equal and nothing is
+    // emitted (same semantics as `seat.id !== seat.alias` one layer up,
+    // run-stats-entry.js:64). NOT a plain pass-through like `raiserSeat`
+    // above (:141) — that field's upstream producer already holds a real
+    // {id, alias} seat OBJECT at its own decision point (run.js:202:
+    // `r.seat && r.seat.id !== r.seat.alias`), so passing its verdict
+    // through here is safe. The street-cred producer never has such an object
+    // at this point, only a flat row, so a pass-through here would leak `seat`
+    // onto every unique-alias verdict.json the moment that producer's own
+    // guard slipped — silently, since nothing else guards this closed literal.
+    // This check is deliberate defense in depth: buildVerdict is also reachable
+    // on externally-supplied records that never touched computeStreetCred
+    // in-process at all — the MCP `record` param of mcp-tools.js ::
+    // amicus_verdict is `z.record(z.any())`, fully permissive — so this
+    // literal's own byte-identity cannot be contingent on that producer alone;
+    // this file's own tests exercise that exact shape (hand-built rec objects,
+    // never calling tally()). tally.json keeps its own pin regardless — a
+    // genuine producer bug still reds at seat-parity-ondisk.test.js — this
+    // check exists so verdict.json is never the ONE document such a bug (or an
+    // externally-supplied record) masks.
+    // ⚠️ NO LONGER INERT. This comment said "computeStreetCred emits no `seat`
+    // at all yet" until v4.8 T3.3 shipped that producer — street-cred.js ::
+    // computeStreetCred, one row per SEAT with the id emitted when it differs
+    // from the alias. Both guards now fire on the same real documents, and the
+    // pin that proves this literal carries the field through lives at
+    // seat-parity-ondisk.test.js on a real runCouncil twin bench.
+    streetCred: record.streetCred.map(s => ({ model: s.model, withSelf: s.withSelf, peersOnly: s.peersOnly,
+      ...(s.seat && s.seat !== s.model ? { seat: s.seat } : {}) })),
     runStats: record.runStats,
     tierCounts: record.tierCounts,
     // Additive and OPTIONAL (schemaVersion stays 2): present only when a critic

package/src/headless.js

@@ -154,6 +154,58 @@ function withTimeout(promise, ms, label) {
   ]);
 }
 
+/**
+ * Task 6 (#129, #133): build the NO_OUTPUT_BACKSTOP reason string. Report
+ * ONLY what the mechanism observed — a deadline passed with no substantive
+ * activity (output/reasoning/tool calls) — never a cause. At the pre-send
+ * firing site (runHeadless, ~:506-518) the backstop can win the race against
+ * sendPromptAsync before the send ever resolves, so "the endpoint accepted
+ * the request" is not even something that site observed. The previous text
+ * asserted "likely a listed-but-not-serving model or a dead endpoint" — a
+ * canned guess with no evidence gate — which sent 30 minutes of #133's
+ * debugging at model ids and API keys while the real cause (an opencode
+ * engine version skew) sat in ~/.local/share/opencode/log/opencode.log the
+ * whole time.
+ *
+ * `fromEnv` distinguishes two ways `ms` was decided, NOT whether
+ * AMICUS_NO_OUTPUT_BACKSTOP_MS is relevant — it is relevant on both branches:
+ *   - fromEnv=true: `ms` IS the live env-resolved value (or its documented
+ *     default) — the message says so directly, "(0 disables)" included,
+ *     because raising the env var changes exactly this window.
+ *   - fromEnv=false: `ms` arrived as a direct, caller-set numeric option.
+ *     Task 6 review (Important finding): this is NOT synonymous with "the
+ *     env var doesn't apply" — `run-retry.js :: retryStage1Losses`'s
+ *     `escalatedBackstopMs` computes a Stage-1 retry's window as
+ *     `2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs :
+ *     resolveNoOutputBackstopMs())` and forwards it on `common` as a direct
+ *     `noOutputBackstopMs` — so a 600s retry-fired backstop (the 300s env
+ *     default, doubled) is "caller-set" by this predicate while still being
+ *     *derived from* the env default. Only src/sidecar/models-probe.js:79's hardcoded,
+ *     non-tunable 30s (PROBE_WINDOW_MS; docs/usage.md:406 promises it's "not
+ *     tunable") is truly independent of the env var. Because a real
+ *     `fromEnv` flag distinguishing those two cases would have to ride the
+ *     same value through src/sidecar/fanout.js, which is line-locked at
+ *     EXACTLY 300/300 this release, the caller-set branch instead names the
+ *     var as something this window *overrides* rather than either claiming
+ *     it governs (false on the probe) or omitting it (false/unhelpful on the
+ *     retry) — true on both, and still points a user at the remedy.
+ *
+ * Kept module-scope and pure (not a closure over runHeadless locals) so it
+ * can be asserted on directly in tests without driving the poll loop; the
+ * `noOutputBackstopReason` closure inside runHeadless just forwards to this
+ * with the per-run `noOutputBackstopMs`/`backstopFromEnv` values, so the two
+ * firing sites there stay identical to what's tested here.
+ * @param {{ms: number, fromEnv: boolean}} args
+ * @returns {string}
+ */
+function formatNoOutputBackstopReason({ ms, fromEnv }) {
+  return 'NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in '
+    + `${Math.round(ms / 1000)}s — `
+    + (fromEnv
+      ? 'the AMICUS_NO_OUTPUT_BACKSTOP_MS window (0 disables)'
+      : 'a caller-set window overriding the AMICUS_NO_OUTPUT_BACKSTOP_MS default');
+}
+
 /**
  * Wait for the OpenCode server to be ready using SDK health check
  */
@@ -473,16 +525,26 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
     // deadline `nowMs >= deadline` can never satisfy — the backstop would
     // silently never fire. Finite zero (the documented explicit-disable
     // value) still takes the direct branch: Number.isFinite(0) === true.
-    const noOutputBackstopMs = Number.isFinite(options.noOutputBackstopMs)
-      ? options.noOutputBackstopMs : resolveNoOutputBackstopMs(options._env);
+    // Capture the source-of-truth predicate ONCE and reuse it (do not call
+    // Number.isFinite a second time below) — `backstopFromEnv` is just its
+    // complement: options.noOutputBackstopMs is a direct, caller-set value
+    // exactly when Number.isFinite is true, so the window came from
+    // resolveNoOutputBackstopMs's env-resolution seam exactly when it's false.
+    // Reused both to pick noOutputBackstopMs and to decide whether the reason
+    // string below may name the env var, so the two can never drift apart.
+    const backstopFromEnv = !Number.isFinite(options.noOutputBackstopMs);
+    const noOutputBackstopMs = backstopFromEnv
+      ? resolveNoOutputBackstopMs(options._env) : options.noOutputBackstopMs;
     const noOutputBackstop = createNoOutputBackstop({ ms: noOutputBackstopMs, startedAt: Date.now() });
     let backstopFired = false;
     // Single source for the reason string so the pre-send firing site below and
     // the per-poll firing site further down (still ticking the SAME instance)
-    // can never drift apart.
-    const noOutputBackstopReason = () => 'NO_OUTPUT_BACKSTOP: model produced no '
-      + `output, reasoning, or tool calls in ${Math.round(noOutputBackstopMs / 1000)}s `
-      + '— likely a listed-but-not-serving model or a dead endpoint';
+    // can never drift apart. Forwards to the module-scope, pure
+    // formatNoOutputBackstopReason (below/exported) so tests can assert on the
+    // string shape directly without driving the whole poll loop.
+    const noOutputBackstopReason = () => formatNoOutputBackstopReason({
+      ms: noOutputBackstopMs, fromEnv: backstopFromEnv,
+    });
 
     // Send prompt asynchronously (returns immediately, we poll for results) —
     // bounded by the backstop: an endpoint that accepts but never answers must
@@ -1244,6 +1306,9 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
         ...settleResult,
         ...subtreeFlags,
         ...subtreeResult,
+        // #133 P1: sessionId was assigned at :413/:417, well before this
+        // return — guaranteed set here, same as `taskId` above.
+        opencodeSessionId: sessionId,
         error: sessionError
       };
     }
@@ -1259,6 +1324,8 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       ...settleResult,
       ...subtreeFlags,
       ...subtreeResult,
+      // #133 P1: see the comment on the sibling return above — guaranteed set.
+      opencodeSessionId: sessionId,
       exitCode: 0
     };
 
@@ -1334,6 +1401,15 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       aborted: false,
       taskId,
       usage: emptyUsageTotals(),
+      // #133 P1: measured, not assumed — `sessionId` (:365) is in scope
+      // through this whole catch (it is already read at the `if (sessionId)`
+      // abort-on-error above) but, unlike the two returns in the try body,
+      // is NOT guaranteed assigned here: an exception thrown before session
+      // creation (e.g. during the pre-session server-readiness wait) reaches
+      // this same catch with sessionId still unset. `|| null` makes both
+      // outcomes explicit and already schema-shaped (run.schema.json:23
+      // wants string|null, never undefined).
+      opencodeSessionId: sessionId || null,
       error: error.message
     };
   }
@@ -1413,6 +1489,7 @@ module.exports = {
   extractSummary,
   findTrailingFoldMarker,
   formatFoldOutput,
+  formatNoOutputBackstopReason,
   DEFAULT_TIMEOUT,
   FOLD_MARKER,
   COMPLETE_MARKER,

package/src/mcp-tools.js

@@ -390,19 +390,89 @@ function getTools() {
       'returns the tally record immediately. No subprocess, no polling. Claude ' +
       'assembles the input and may override margin tiers afterward.',
     inputSchema: {
+      // v4.8 PR4c R4c-5: the three seat keys are declared here or zod SILENTLY
+      // STRIPS them, and `amicus_council_tally` stays permanently on the #137
+      // behaviour while `amicus council tally` (a raw JSON.parse with no schema)
+      // gets the fix. Deliberately PERMISSIVE — validate the envelope, let
+      // tally() be the single arbiter of shape on both paths, matching
+      // amicus_verdict's own `record: z.record(z.any())`. `z.array(z.record())`
+      // would reject a string seat table the CLI accepts, and a bare
+      // `.optional()` would reject the `|| null` a hand-assembling caller
+      // writes, which serializes byte-identically to omitting the key.
+      // ⚠️ ALL THREE keys carry `.nullable()`, not two of three (council C1).
+      // Bare `.optional()` on `seats` failed the WHOLE call with `seats:
+      // Expected array, received null` where `amicus council tally` — the raw
+      // JSON.parse at cli-handlers-council.js:24 — accepts it and every
+      // seat-space reader treats it as absent (`Array.isArray(null)` is
+      // false). That is the same silent fork in the same schema, one key
+      // later. `amicus_verdict` below already spells its array/record
+      // envelope keys this way (`seatLoss` :461, `degrades` :465).
       meta: z.object({
         runId: z.string(), runType: z.string().optional(), date: z.string().optional(),
         models: z.array(z.string()).min(1), chair: z.string().optional(),
-        claudeInCouncil: z.boolean().optional(),
+        claudeInCouncil: z.boolean().optional(), seats: z.array(z.any()).nullable().optional(),
       }).describe('Run metadata; meta.models lists every reviewed model.'),
       findings: z.array(z.object({
         id: z.string(), raiser: z.string(), severity: z.string(), claim: z.string().optional(),
+        raiserSeat: z.string().nullable().optional(),
+        // SI-23 (R10): `location` was silently stripped by this closed
+        // z.object too — the same #137-shaped fork as the seat keys above,
+        // one key later. R10 (as relayed) also named `evidence`/`file`/`line`
+        // as siblings to fix here; MEASURED against findings.js :: REQUIRED
+        // (Stage-1's required-field list), briefings.js ::
+        // FINDINGS_JSON_SHAPE (the JSON contract every reviewer is briefed
+        // on), and every `f.<key>` read under src/ — none of those three
+        // exist anywhere in this codebase's finding shape. Only `location`
+        // does: anonymize.js :: toGlobalFindings forwards it alongside
+        // `claim` into the exact "run-global findings" shape this tool
+        // already documents below, and briefings-debate.js ::
+        // findingBlockDefense / debate.js :: debateTargets read it on the
+        // engine's native debate stage — unreachable from this MCP tool
+        // today (no MCP debate step exists), so this is a document-shape /
+        // round-trip fix here, not an unlocked renderer. `rationale` is also
+        // Stage-1-required but toGlobalFindings does not forward it past
+        // Stage-1 either; adding it here would invent a shape the engine's
+        // own path never produces, so it stays out.
+        // Plain `.optional()`, matching `claim` immediately above — a
+        // same-shape string sibling, not a seat field, so the `.nullable()`
+        // seat idiom explained above `meta` doesn't apply here.
+        // tally.js :: tally's `outFindings` map was ALSO dropping
+        // `claim`/`location` from every finding regardless of what survived
+        // validation, on the CLI and MCP paths alike — declaring the field
+        // here alone would validate but never reach the document, so that
+        // map forwards both, the same emit-when-present way it already
+        // forwards `raiserSeat`. R10 shipped only `location`'s forward and
+        // left `claim`'s for later (`claim` was already declared above,
+        // pre-R10); SI-23 fix round 1 (PR #183 council, A1/B1) closed that
+        // gap in the same map, same convention.
+        location: z.string().optional(),
       })).describe('Run-global findings (ids already A1/B2/C3-prefixed by Claude).'),
       adjudications: z.array(z.object({
         judge: z.string(), findingId: z.string(), verdict: z.enum(['agree', 'dispute', 'neutral']),
+        seat: z.string().nullable().optional(),
       })).describe('One row per (judge × finding).'),
+      // v4.8 T3.2: `seat` added here to match `adjudications.seat` immediately
+      // above — the channel run-assemble.js's buildTallyInput now puts on
+      // rankings[] (the judge's own seat, emit-when-DIFFERENT) is otherwise
+      // unreachable from a hand-assembled MCP call: zod strips unknown keys
+      // by default. NOT R10's territory — R10 covers SI-23 (findings[]
+      // losing evidence/file/line) as its own document-shape PR; this is a
+      // different field on a different array, and the adjudications.seat
+      // precedent immediately above is this repo's own pattern of adding a
+      // seat field in the PR that introduces it, not deferring to a later
+      // schema PR.
+      // v4.8 T3.3 adds `orderSeats` for the same reason and by the same rule.
+      // It is the seat-valued PARALLEL of `order` (street-cred.js ::
+      // rankPositions keys on it), so without the declaration an MCP caller
+      // that sends it gets the alias collapse SI-20 exists to fix, silently.
+      // `nullable()` inside the arrays is load-bearing, not defensive:
+      // anonymize.js :: rankingToOrder emits `null` for every slot with no
+      // distinguishing seat, so a mixed bench legitimately sends nulls.
       rankings: z.array(z.object({
         judge: z.string(), order: z.array(z.union([z.string(), z.array(z.string())])),
+        seat: z.string().nullable().optional(),
+        orderSeats: z.array(z.union([z.string().nullable(),
+          z.array(z.string().nullable())])).nullable().optional(),
       })).describe("Each judge's preference order over the reviews (ties = nested array)."),
       runStats: z.array(z.record(z.any())).optional().describe('Optional per-model run stats (status/duration/usage).'),
       project: z.string().optional().describe('Optional project directory path.'),

package/src/observe/council-legs.js

@@ -22,7 +22,7 @@
  * em-dash) and blind mode's labelOf(alias) lookup never matches (real model
  * id leaks). The alias IS on disk per-leg, though: every council leg goes
  * through src/sidecar/fanout-leg.js's runSingleAttempt, which calls
- * `writeLegPatch(legDir, { parentWave, modelInput })` synchronously,
+ * `writeLegPatch(legDir, { parentWave, modelInput, seat })` synchronously,
  * immediately after leg creation (fanout-leg.js:101) — well before any
  * status poll could reasonably observe it missing. So this module reads
  * `modelInput` straight off the leg's own metadata.json, no run.json join
@@ -127,6 +127,12 @@ function buildLegRow(project, legId, runCtx) {
   const row = {
     taskId: legId, model: meta.model || null, status: meta.status || 'unknown',
     modelInput, role,
+    // v4.8 R5: the leg's seat id (`alias#N`), written at launch by
+    // fanout-leg.js :: runSingleAttempt. Null on a unique-alias bench, where
+    // buildSeats sets id === alias and the shared emit-when-DIFFERENT predicate
+    // therefore stamps nothing — the same rule run-stats-entry.js ::
+    // buildRunStatsEntry applies on the terminal path.
+    seat: meta.seat || null,
   };
   let stalledMs = null;
   let p = null;

package/src/observe/live-doc.js

@@ -26,9 +26,9 @@ const { resolveUsage, sumWaveUsage } = require('../utils/pricing');
 //                 a timed-out single session never exited (watch-render.js:138 polls until
 //                 TERMINAL.has(doc.status), and amicus_status stamps metadata.status straight onto
 //                 the doc — mcp-server.js:687); a timed-out leg skipped the "prefer metadata.usage
-//                 over the stale progress.json snapshot" branch in council-legs.js:162 and reported
-//                 an under-counted cost; and markLive kept stamping view:'live' on a finished
-//                 single-session doc.
+//                 over the stale progress.json snapshot" branch in council-legs.js :: buildLegRow
+//                 and reported an under-counted cost; and markLive kept stamping view:'live' on a
+//                 finished single-session doc.
 // NOTE this is deliberately NOT the same list as src/utils/result-schema.js:13 TERMINAL_STATUSES
 // (the leg set, no 'partial'). Two mirrors of THIS list exist — src/workspace/run-detail.js:26 and
 // electron/workspace-ui/live-model.js:14 — byte-identical, held by drift pins. Edit all three.

package/src/sidecar/continue.js

@@ -88,7 +88,7 @@ Build on the previous sidecar's findings. The user wants to continue or extend t
 
 /** Create session metadata for continuation */
 function createContinueSessionMetadata(taskId, project, options, oldTaskId) {
-  const { model, briefing, headless, agent, gateway, resolutionVersion } = options;
+  const { model, briefing, headless, agent, gateway, resolutionVersion, tag } = options;
 
   const sessionDir = SessionPaths.sessionDir(project, taskId);
   fs.mkdirSync(sessionDir, { recursive: true });
@@ -102,7 +102,11 @@ function createContinueSessionMetadata(taskId, project, options, oldTaskId) {
     agent: agent || (headless ? 'build' : 'chat'),
     status: 'running',
     createdAt: new Date().toISOString(),
-    continuesFrom: oldTaskId
+    continuesFrom: oldTaskId,
+    // v4.7.1 Task 7 (D13): absent-not-null, same idiom as start-metadata.js:50
+    // — a continuation inherits the parent's tag so a continue chain never
+    // scatters into `(unattributed)`.
+    ...(tag ? { tag } : {}),
   };
   // #61 Task 5.2 (best-effort provenance): only present when THIS continue
   // call freshly routed an explicit --model through the gateway router — the
@@ -116,26 +120,6 @@ function createContinueSessionMetadata(taskId, project, options, oldTaskId) {
   return sessionDir;
 }
 
-/**
- * Resolve a reopened session's usage, write it onto metadata, and append one
- * attributed ledger row. Mirrors start.js's finalize (the only sites that
- * dropped usage - BACKLOG.md:280). Best-effort ledger append; never throws.
- * @returns {{usage: object|null}}
- */
-function finalizeSpendForReopen({ taskId, model, mode, op, result, status, project, metadata }, ctx = {}) {
-  const { resolveUsage } = require('../utils/pricing');
-  const usage = result && result.usage ? resolveUsage({ model, usageTotals: result.usage }) : null;
-  if (usage) {
-    metadata.usage = usage; // buildRunResult surfaces metadata.usage into the --json doc for free
-    try {
-      const { appendSpend } = require('../utils/spend-ledger');
-      const gateway = metadata.gateway || (String(model).startsWith('openrouter/') ? 'openrouter' : 'direct');
-      appendSpend({ taskId, model, mode, usage, op, status, project, gateway }, ctx);
-    } catch { /* best-effort */ }
-  }
-  return { usage };
-}
-
 /**
  * Continue from a previous sidecar session - Spec Reference: §4.4, §8.5
  * @returns {Promise<number>} process exit code
@@ -196,6 +180,7 @@ async function continueSidecar(options) {
 
   const sessionDir = createContinueSessionMetadata(newTaskId, project, {
     model, briefing, headless, agent: effectiveAgent, gateway, resolutionVersion,
+    tag: oldMetadata.tag, // v4.7.1 Task 7: inherit the parent's tag (absent if the parent had none).
   }, oldTaskId);
 
   // Lock the NEW continuation session dir too — not just the previous one — so a
@@ -270,6 +255,7 @@ async function continueSidecar(options) {
   // ledger row (status: statusFromResult, matching start.js — not terminal.status).
   {
     const { statusFromResult } = require('../utils/result-schema');
+    const { finalizeSpendForReopen } = require('./reopen-spend');
     const reloaded = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
     const { usage } = finalizeSpendForReopen({
       taskId: newTaskId, model, mode: headless ? 'headless' : 'interactive',
@@ -292,6 +278,5 @@ module.exports = {
   loadPreviousSession,
   buildContinuationContext,
   createContinueSessionMetadata,
-  finalizeSpendForReopen,
   continueSidecar
 };

package/src/sidecar/fanout-leg.js

@@ -98,7 +98,7 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     });
     waveDir = getSessionDir(project, waveId);
     emitLegStarted(waveDir, waveId, legId, leg.model, leg.modelInput, follow);
-    writeLegPatch(legDir, { parentWave: waveId, modelInput: leg.modelInput });
+    writeLegPatch(legDir, { parentWave: waveId, modelInput: leg.modelInput, seat: leg.seat });
     saveInitialContext(legDir, systemPrompt, userMessage);
 
     // Per-leg watchdog: a BACKSTOP strictly behind runHeadless's own deadline
@@ -158,6 +158,27 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     reason: result.error || undefined,
     completedAt: new Date().toISOString(),
     usage: usage || undefined,
+    // #133 P1: `|| undefined`, matching status/reason/usage above — NOT the
+    // `toolSettleAborted` carve-out below, because a session id has no
+    // meaningful-falsy value the way `false` does there. A clean/failed
+    // attempt (no session ever created) therefore carries neither key on
+    // disk, rather than writing an explicit `null` that could clobber a
+    // PRIOR attempt's real session id: fallback substitution reruns
+    // runSingleAttempt against the SAME legId/legDir (fanout-leg-fallback.js
+    // "SAME leg dir under the SAME legId"), and writeLegPatch's read-merge-
+    // write only drops keys that are `undefined`, not ones explicitly set to
+    // `null`. This does not disagree with result-schema.js:72's
+    // `metadata.opencodeSessionId || null` — that coercion runs downstream,
+    // on the per-request OUTPUT run document, where run.schema.json requires
+    // the field always present as string|null. The two layers do different
+    // jobs (omit-if-absent on disk here vs. always-present in the emitted
+    // doc there) and compose without conflict.
+    //
+    // Raised again in the PR #185 council round (findings A3/D2) as a
+    // possible conflation of "no session" with "empty session id"; kept
+    // as-is per the reasoning above — this is `legPatch`'s existing
+    // convention (matching status/reason/usage), not a gap opened by #133 P1.
+    opencodeSessionId: result.opencodeSessionId || undefined,
     // v4.4 B4 part 1: the leg completed with tool calls still live, so its
     // OpenCode session may have kept working (and billing) afterwards. Travels
     // with the leg so it is readable long after the run's stderr is gone.