amicus 4.7.0 → 4.8.0

package/src/workspace/matrix-model.js

@@ -2,26 +2,50 @@
  * Council Workspace — adjudication matrix view model (v4.4 §5.2).
  *
  * Pure: tally.json + labelMap (+ verdict.json) → renderable rows/cells.
- * Symbols come from council/report.js SYMBOL (single source — the report and
- * the workspace can never disagree about what the symbols mean). Every
- * name-bearing field carries BOTH spellings ({model, label}) so the
- * renderer's blind toggle is a pure display flip with no re-fetch. Missing
+ * Symbols come from council/report.js SYMBOL, and the seat-space decision from
+ * its isSeatSpace (single source — the report and the workspace can never
+ * disagree about what the symbols mean, nor about which space a document is
+ * in; the latter added by council review A3/B1). Every name-bearing field
+ * carries BOTH spellings ({model, label}) so the renderer's blind toggle is a
+ * pure display flip with no re-fetch. Missing
  * votes (partial waves) are blank cells, never invented neutrals — tier math
  * already excluded them (v4.0).
  *
  * ⚠️ DE-ROT (F07): `tally()` writes `tierOverride: null` on EVERY finding,
- * unconditionally (src/council/tally.js:106) — it is never a real source for
+ * unconditionally (src/council/tally.js :: tally) — it is never a real source for
  * either the override badge or the post-override tier. Only `buildVerdict`
  * materializes `{from,to,reason}` and rewrites `tier` to `tierOverride.to`
- * (src/council/verdict.js:33-37). So both fields are joined in from
+ * (src/council/verdict.js:122-126). So both fields are joined in from
  * verdict.findings[] by `id`; when verdict is absent/unparseable (caller
  * passes null/undefined, or a finding has no verdict-side counterpart) the
  * row falls back to tally's own (pre-override) tier and renders no badge.
  */
 'use strict';
 
-const { SYMBOL } = require('../council/report');
-const { pairFor } = require('./blind-mode');
+const { SYMBOL, isSeatSpace } = require('../council/report');
+const { labelFor, pairFor } = require('./blind-mode');
+
+// v4.8 T-C2 (SI-22.5, ruling R18): the ONE column every vote whose key names no
+// column folds into. A SECOND implementation on purpose — ruling R17 took the
+// narrow option, so this is NOT imported from src/council/report.js and nothing
+// is extracted for it. Two implementations can DRIFT — T-C2 shipped one document
+// rendering two ways for a single commit — so the rule below is pinned as an
+// AGREEMENT with report.js, not merely as this file's own behaviour:
+// tests/council/seat-matrix.test.js drives BOTH consumers over that document.
+const UNATTRIBUTED = 'UNATTRIBUTED';
+
+/**
+ * A finding's adjudications AS AN ARRAY, whatever the document actually carries.
+ *
+ * ⚠️ ONE expression, TWO readers, and that is the whole reason it is a function.
+ * The `folded` pre-pass and the per-finding loop both walk this list, and in
+ * report.js the identical pair drifted apart on type for one commit — `.some`
+ * is Array-only while `for...of` takes any iterable, so `adjudications: "abc"`
+ * rendered on one side and threw on the other. A non-array contributes no
+ * votes: the same answer isSeatSpace gives a malformed seats table, and the
+ * same answer this expression already gave inline before T-C2 hoisted it.
+ */
+function adjOf(f) { return Array.isArray(f.adjudications) ? f.adjudications : []; }
 
 /** Index verdict.findings[] by id, tolerating an absent/malformed verdict doc. */
 function indexVerdictFindings(verdict) {
@@ -44,16 +68,111 @@ function indexVerdictFindings(verdict) {
  */
 function buildMatrixModel(tally, labelMap, verdict) {
   const map = labelMap || {};
-  const judges = tally && tally.meta && Array.isArray(tally.meta.models) ? tally.meta.models : [];
+  const meta = (tally && tally.meta) || {};
+  const aliasJudges = Array.isArray(meta.models) ? meta.models : [];
+  // v4.8 PR4c §3.6 (R4c-8): the IDENTICAL decision report.js applies to
+  // verdict.seats, here over tally.meta.seats — and since council A3/B1, the
+  // identical FUNCTION rather than a second copy of the expression.
+  // run-detail.js already hands this function the parsed tally.json, so the
+  // 3-arg signature is unchanged. One flag for all three readers (roster, vote
+  // key, raiser); see isSeatSpace for why every element must carry a string id
+  // and why `??` is wrong.
+  const seatSpace = isSeatSpace(meta.seats);
+  // report.js filters the reserved claude seat out of ITS roster; this one
+  // never has — tally.meta.models carries `claude` (run-assemble.js appends it)
+  // and HEAD renders a blank column for it. seats[] is bench-only, so a seat
+  // roster would silently DELETE that column; re-append it so the only thing a
+  // claude run's matrix changes is the twin split.
+  const claudeTail = meta.claudeInCouncil === true && aliasJudges.includes('claude') ? ['claude'] : [];
+  // A column is {key, pair}: `key` is what votes and the raiser are matched
+  // against, `pair` is what the renderer shows.
+  // ⚠️ BLIND MODE: resolve the label from the seat's ALIAS and carry the seat's
+  // ID only as identity. `pairFor(seat.id, map)` returns label:null (labelMap's
+  // values are aliases), and workspace-render.js's display() then falls back to
+  // pair.model and prints `deepseek#1` with blind mode ON. A seat id contains
+  // its alias, so rendering one in blind mode defeats blind mode. Both twins
+  // therefore collapse to `Review A` when blind — exactly as at HEAD.
+  const bench = seatSpace
+    ? meta.seats.map(s => ({ key: s.id, pair: { model: s.id, label: labelFor(s.alias, map) } }))
+      .concat(claudeTail.map(j => ({ key: j, pair: pairFor(j, map) })))
+    : aliasJudges.map(j => ({ key: j, pair: pairFor(j, map) }));
   const findings = tally && Array.isArray(tally.findings) ? tally.findings : [];
   const verdictById = indexVerdictFindings(verdict);
+  // v4.8 T-C2 (SI-22.5): CLASSIFY the key instead of trusting it. At 32a63e92 the
+  // domain split in two and BOTH halves lost the vote: `typeof adj.judge !==
+  // 'string'` refused an absent or non-string judge outright — in seat space
+  // testing a field that is not even the key, so a valid seat with a numeric
+  // judge rendered nowhere — while an orphaned seat id and `''` were written to
+  // a `votes` key no column reads. The roster is what makes a key mean a column,
+  // so `keys.has` is the orphan test, and the three conjuncts refuse, in order, a
+  // non-string, the empty string, and a string naming no column.
+  // ⚠️ `key !== ''` IS NOT REDUNDANT WITH `keys.has`, and T-C2 shipped it wrong
+  // for one commit, which is why the reason is written down. `isSeatSpace`
+  // accepts `{id: ''}`, so a roster CAN hold `''` — and matching a `''` roster
+  // key against a `''` judge matches TWO NON-IDENTITIES. That is structurally
+  // the defect v4.8 T-B4 removed from src/council/peer-split.js :: peersOf, where
+  // a falsy raiser matched a falsy judge and corroborated its own finding.
+  // Rulings R18 and R2 both say `''` is not an identity, and a malformed roster
+  // carrying `''` does not make it into a name. Without the conjunct the two
+  // consumers rendered ONE document differently — the desync class PR B exists to
+  // remove — so this is now the SAME classification rule report.js applies, over
+  // this file's own roster. Written again, never shared (R17); a pin drives BOTH
+  // consumers over that document so the agreement is enforced, not re-derived.
+  // Named mutants, with their measured red sets:
+  // tests/council/seat-matrix.test.js :: WSJUNKKEY and
+  // tests/council/seat-matrix.test.js :: WSEMPTYOK.
+  const keys = new Set(bench.map(c => c.key));
+  const columnFor = (adj) => {
+    const key = (seatSpace && adj.seat) || adj.judge;
+    return (typeof key === 'string' && key !== '' && keys.has(key)) ? key : UNATTRIBUTED;
+  };
+  // ⚠️ TWO-PHASE, and here it could not be anything else: `cells` is built by
+  // MAPPING this roster, so a roster decided inside the per-finding map would
+  // give two rows DIFFERENT CELL COUNTS — a body that no longer matches its own
+  // header. The pre-pass therefore walks every finding before the map starts.
+  // ⚠️ CONDITIONAL: added unconditionally it grows a column on every matrix that
+  // has no such vote. Named mutant: tests/council/seat-matrix.test.js :: WSALWAYSCOL.
+  // ⚠️ `!keys.has(UNATTRIBUTED)`: a bench model literally aliased UNATTRIBUTED
+  // already owns that column and R18 says ONE column. It then SHARES its cell
+  // with the folded votes — disclosed, not fixed, because the column key is also
+  // what the fold writes and separating them needs a renderer change.
+  // ⚠️ LAST, after `claudeTail`: the fold column is not a bench member, and
+  // appending keeps every existing column at the index it had at 32a63e92.
+  // `concat` for uniformity with the `claudeTail` append above, NOT for safety:
+  // report.js needs it because its alias roster IS `verdict.council` by
+  // reference, and measured, this file has no such trap — every branch of
+  // `bench` ends in a `.map`, which always allocates.
+  // ⚠️ BLIND MODE — both name slots carry the same literal rather than
+  // `pairFor(UNATTRIBUTED, map)`. UNATTRIBUTED has no alias to protect and no
+  // identity to reveal, so the flip must be a no-op on it BY CONSTRUCTION, not
+  // by `labelFor` happening to return null — which it stops doing the moment a
+  // labelMap value IS `UNATTRIBUTED`, when the blind header would print a review
+  // label over a column of nobody's votes.
+  // Named mutant: tests/council/seat-matrix.test.js :: WSPAIRFOR.
+  const folded = findings.some(f => adjOf(f).some(a => a && columnFor(a) === UNATTRIBUTED));
+  const columns = folded && !keys.has(UNATTRIBUTED)
+    ? bench.concat([{ key: UNATTRIBUTED, pair: { model: UNATTRIBUTED, label: UNATTRIBUTED } }])
+    : bench;
 
   const rows = findings.map((f) => {
     const votes = {};
-    for (const adj of (Array.isArray(f.adjudications) ? f.adjudications : [])) {
-      if (!adj || typeof adj.judge !== 'string') { continue; }
-      votes[adj.judge] = adj.verdict;
+    for (const adj of adjOf(f)) {
+      // ⚠️ HALF of 32a63e92's guard survives, and that half is doing work: `!adj`
+      // skips a falsy element, which carries no verdict to fold and which
+      // `columnFor` would dereference.
+      // ⚠️ THE STRICTNESS DIFFERENCE THIS COMMENT USED TO RECORD IS GONE. It read
+      // "report.js has no such guard and THROWS on that document"; v4.8 T-C4 gave
+      // `report.js :: adjOf` a `.filter(Boolean)`, which is this predicate spelled
+      // a second time — R17, two implementations, never shared. That file no longer
+      // throws on a falsy element and no longer grows a phantom column for one.
+      // The `typeof adj.judge` half is GONE, subsumed by the classification
+      // above: it refused votes where R18 requires them folded.
+      if (!adj) { continue; }
+      votes[columnFor(adj)] = adj.verdict;
     }
+    // The raiser's column key. In alias space this is `f.raiser` and every
+    // expression below is byte-identical to HEAD.
+    const raiserKey = seatSpace ? (f.raiserSeat || f.raiser) : f.raiser;
     const vf = verdictById.get(f.id);
     return {
       id: f.id,
@@ -62,29 +181,32 @@ function buildMatrixModel(tally, labelMap, verdict) {
       thin: f.confidence === 'thin',
       tierOverride: (vf && vf.tierOverride) || null,
       // ⚠️ DE-ROT (F29): v4.1 decorates tally.json findings in place with
-      // `debate: {action, previousTier}` (src/council/debate.js:71-75; action ∈
+      // `debate: {action, previousTier}` (src/council/debate.js :: decorateRecord; action ∈
       // defended|amended|withdrawn|no-response) and verdict.json carries it through
       // (src/council/verdict.js:43). Consumed by electron/workspace-ui/workspace-matrix.js's
       // renderMatrix, which renders a `.debate-badge` in the tier cell (alongside the
       // thin/tierOverride badges) so a withdrawn/amended/defended/no-response finding never
       // renders as an ordinary live row. Absent on non-debate runs, hence `|| null`.
       debate: f.debate || null,
-      raiser: pairFor(f.raiser, map),
+      // The THIRD reader. Its label still resolves from the ALIAS (blind mode
+      // must not leak a seat id here either), while its identity is the seat —
+      // otherwise the starred column and the Raiser cell name different things.
+      raiser: { model: raiserKey, label: labelFor(f.raiser, map) },
       basis: f.basis || { a: 0, d: 0, n: 0 },
-      cells: judges.map((j) => {
-        const vote = Object.prototype.hasOwnProperty.call(votes, j) ? votes[j] : null;
+      cells: columns.map((c) => {
+        const vote = Object.prototype.hasOwnProperty.call(votes, c.key) ? votes[c.key] : null;
         return {
-          judge: pairFor(j, map),
+          judge: c.pair,
           verdict: vote,
           sym: vote ? (SYMBOL[vote] || '?') : ' ',
-          isRaiser: j === f.raiser,
+          isRaiser: c.key === raiserKey,
         };
       }),
     };
   });
 
   return {
-    judges: judges.map((j) => pairFor(j, map)),
+    judges: columns.map((c) => c.pair),
     rows,
     tierCounts: (tally && tally.tierCounts) || null,
     judged: !(tally && tally.judged === false),

package/src/workspace/run-detail.js

@@ -13,7 +13,7 @@ const { formatCost } = require('../utils/pricing');
 const { readPointer } = require('./run-scan');
 const { buildNamePairs } = require('./blind-mode');
 const { buildMatrixModel } = require('./matrix-model');
-const { artifactAllowlist } = require('./artifact-guard');
+const { artifactAllowlist, isSeatTable } = require('./artifact-guard');
 const { isRealpathContained } = require('../utils/path-fence');
 
 /**
@@ -73,6 +73,13 @@ function costPanel(run, tally) {
   const stats = tally && Array.isArray(tally.runStats) ? tally.runStats : [];
   const rows = stats.map((r) => ({
     model: r.model,
+    // v4.8 PR5a T3: carry the seat. The engine computes it, writes it to tally.json and
+    // verdict.json, and this five-key projection was throwing it away one function before
+    // the renderer. ⚠️ Its consumer (renderCost) lands in PR5b, so this is honestly a
+    // payload-shape change here, not a visible one — shipping it now keeps PR5b from
+    // needing a src/ change of its own. Emit-when-set: a unique bench has no seat on any
+    // row, so the payload is byte-identical there.
+    ...(r.seat ? { seat: r.seat } : {}),
     role: r.role || (r.wasChair ? 'chair' : 'seat'),
     status: r.status || 'unknown',
     durationMs: r.durationMs === undefined ? null : r.durationMs,
@@ -215,6 +222,25 @@ function getRunDetail(project, runId) {
       // pre-v4.5 runs, live-doc consumers not yet updated) apart from a real map, and fall back
       // to its legacy sanitizeName(model) computation only in the former case.
       artifactsByModel: artifactNames.artifactsByModel || null,
+      // ⚠️ v4.8 PR5a fix-wave (council A1/B1): WHICH SPACE the payload above is in, decided
+      // by the one predicate artifactAllowlist itself gates on (isSeatTable, re-exported
+      // through artifact-guard). The renderer is a plain browser script and cannot
+      // require() it, and the alternative — re-spelling the predicate in workspace-lazy.js
+      // the way sanitizeName/TERMINAL_STATUSES are hand-copied — is exactly the drift that
+      // caused the finding: roster() gated on `!seats || !seats.length`, which is strictly
+      // weaker, so a malformed seats[] sent this map to ALIAS space while the roster stayed
+      // in SEAT space and every artifactsByModel lookup missed. Shipping the ANSWER instead
+      // of a copy of the question makes that divergence unrepresentable.
+      seatSpace: isSeatTable(run.seats),
+      // ⚠️ Fix-wave 3 (council-3 C2): seats[] is PRESENT but unusable, so the run silently
+      // lost per-seat behaviour — two seats on one model become indistinguishable in every
+      // panel. isSeatTable fails WHOLE (one malformed entry drops the entire table), which
+      // is the fail-safe direction but is exactly the correct-but-silent degrade the product
+      // principle rejects. Emitted here, beside the predicate that decides it, rather than
+      // re-derived renderer-side; workspace-app.js's renderBanners is its only consumer.
+      // NOT the same as `!seatSpace`: a run with no seats[] at all is a legacy run, not a
+      // broken one, and must not be bannered.
+      seatTableRejected: Array.isArray(run.seats) && run.seats.length > 0 && !isSeatTable(run.seats),
     };
   }
 

package/src/workspace/seat-space.js

@@ -0,0 +1,143 @@
+/**
+ * Council Workspace — the seat-space PREDICATES (v4.8 PR5b).
+ *
+ * Extracted from artifact-names.js, which was at 300/300 with zero headroom — and which was
+ * itself split out of artifact-guard.js for the same gate one rev earlier. Comment prose was
+ * shaved three times during PR5a's fix waves to land defect fixes inside the limit; that was
+ * the signal this seam was overdue, not that the comments were too long.
+ *
+ * Split line: this module answers two QUESTIONS ABOUT A RUN — "is this seat table usable?"
+ * and "what has an orphan note proven?" — from run.json fields alone (`seats`, `degrades`,
+ * `runId`). It derives no names and knows nothing about artifacts. artifact-names.js keeps
+ * every NAME decision and imports both answers.
+ *
+ * ⚠️ Pure and total: no I/O, no fs, no throw path. Both functions take a schema-free
+ * `JSON.parse` of run.json and must tolerate any shape, which is why the conjuncts below are
+ * spelled out rather than assumed.
+ *
+ * ⚠️ The workspace -> council import lives here now (isSeatSpace, src/council/report.js).
+ * That direction is deliberate and predates this split: ONE seat-space predicate for the
+ * whole tree, never re-spelled — it is defined and exported at
+ * src/council/report.js :: isSeatSpace, and
+ * src/workspace/matrix-model.js:25 already imports it the same way. Council-4's B3 called the
+ * layering an inversion; it is not fixed here, and moving it OUT of the security-critical
+ * name-derivation file is a side effect of this split, not a response to that finding.
+ */
+'use strict';
+
+const { isSeatSpace } = require('../council/report');
+
+/**
+ * Is `seats` a seat table this guard may trust?
+ *
+ * `isSeatSpace` (shared, src/council/report.js) was written for `verdict.seats`, a
+ * producer-controlled document. This function reads a schema-free `JSON.parse` of
+ * run.json, so it adds three conjuncts `isSeatSpace` has no reason to carry:
+ *   - non-empty ids — `{id:''}` otherwise emits `review-.md` and a `""` map key;
+ *   - unique ids — the alias path's `new Set` used to guarantee this, and without it
+ *     duplicate ids mint a one-element "collision" whose `join(' and ')` renders
+ *     malformed English AND suppresses the real run.error banner (workspace-app.js
+ *     returns after the collision branch);
+ *   - STRING aliases (council-2 C3) — `isSeatSpace` checks only `id`, so `[{id:'a#1'}]` passed
+ *     and put the RENDERER in seat space, where roster() resolves `labelByModel[s.alias]` ->
+ *     undefined and AmicusRender.display() falls through to `pair.model`, printing the seat id
+ *     `a#1` with blind mode ON — which defeats blind mode, a seat id containing its alias. The
+ *     renderer now trusts this predicate wholesale (council-1 B1), so a conjunct the ALIAS
+ *     path depends on belongs in it.
+ * Fails WHOLE: one malformed id sends the run back to the alias branch. Fail-safe but
+ * silent, and only reachable from a hand-edited run.json — parseList trims and filters,
+ * and the MCP path re-joins through the same code.
+ */
+function isSeatTable(seats) {
+  if (!isSeatSpace(seats)) { return false; }
+  const ids = seats.map(s => s.id);
+  return ids.every(id => id !== '') && new Set(ids).size === ids.length
+    && seats.every(s => typeof s.alias === 'string' && s.alias !== '');
+}
+
+/**
+ * The alias names an ORPHANED leg wrote, taken from run.json's own degrade notes.
+ *
+ * The engine names an artifact from the seat when a leg binds and from the leg's
+ * `modelInput || model` when it does not (run-launch.js :: materializeReviews).
+ * Only the second case puts
+ * an alias-named file on disk, and `run-degrade.js` records exactly that case: channel
+ * 'seat-unbound' with `data.legId` set. `data.seat` on such a note IS the string the writer
+ * used, so the name derived here matches the file byte-for-byte — including where the leg
+ * reported no modelInput and the writer fell back to the resolved model id, which no
+ * seat.alias could have reproduced. Gating fallbacks on the NOTE, rather than emitting one
+ * per seat alias, is what keeps a healthy run (twin, --debate, or with a merely-dead seat)
+ * from claiming names nobody wrote and raising a run-integrity banner for it.
+ *
+ * ⚠️ Fix-wave revision 2 (council-1 B2, then council-2 A1/C1 which refuted revision 1).
+ * Contesting DROPS the owning seat's attribution, so the question is never "can the orphan
+ * own this kind?" — absence of evidence is not evidence, and reading it that way handed a
+ * bound seat a `rebuttal-` an orphan may have written, re-arming RN-1 in the debate
+ * namespace (MEASURED; the one regression this fix wave introduced). The question is:
+ * does the note POSITIVELY PROVE the orphan did NOT write this kind? Exactly one such
+ * proof exists. `orphanLegNote` has three call sites — run-stages.js:71 and :140 (Stage-1
+ * and its retry) and run-stage2.js:110 (the -s2 judge wave) — and `data.waveId` separates
+ * them EXACTLY, not heuristically: run-stage2.js:67/69/90 build it as `${runId}-s2` from
+ * the runId this run.json carries. A -s2 note says the leg BOUND in Stage 1, so its review
+ * landed under a SEAT name: `review-<alias>.md` is provably not its. Nothing else is
+ * provable, and the near misses are why:
+ *   - a Stage-1 note exonerates NOTHING, not even judge-: that orphan is re-admitted to
+ *     Stage 2 under a PLACEHOLDER seat (run-stage2.js:92-97) that `judgeSeatOf` filters out
+ *     (:105-107), so its judge leg takes the alias branch too — and emits no -s2 note,
+ *     because it BOUND. Measured: run-stages.test.js :: "M2: the placeholder never becomes…".
+ *   - rebuttal-/revote- are never exonerated: a debate leg whose raiser/judge key names no
+ *     seat takes materializeDebate's alias branch (run-debate.js :: runDebate;
+ *     run-debate-revote.js :: runRevoteWave, `seat = seatOf.get(leg) || null`). A rebuttal
+ *     leg's unbound raiser still has no note recording it. A revote leg's unbound judge
+ *     SOMETIMES gets one, since v4.8 T5.1 (channel `seat-unbound`, run-debate-revote.js's
+ *     reVoteUnboundNote). ⚠️ SOMETIMES, not always — this read "DOES" until the
+ *     whole-branch fix wave, and that was FALSE. The bullet's subject is EVERY debate leg
+ *     with `seat === null`, and that set is STRICTLY LARGER than the set that gets a note.
+ *     Two shapes land here SILENTLY — measured through the real runRevoteWave, not
+ *     reasoned: a leg bound to a §3.4 PLACEHOLDER, and a leg bound to nothing whose
+ *     bare-alias key IS one of the `judgeKeys` this wave launched. runRevoteWave publishes
+ *     BOTH and notes neither, while
+ *     `seatOf` still filters the placeholder back out — so `seat` is null in all three
+ *     shapes and a note exists for exactly one of them.
+ *     ⚠️ The PREDICATE that publishes both is `judgeKeys.includes(key)` ALONE. This read
+ *     `boundLegs.has(leg) || judgeKeys.includes(key)` until v4.8 T5.5 deleted the first
+ *     arm; the §3.4 placeholder shape survives that deletion on the SECOND arm, because a
+ *     roster hole's own bare alias IS one of the judgeKeys — so both shapes above still
+ *     land here, and this bullet is unchanged in substance. What no longer lands silently
+ *     is a placeholder-bound leg carrying a FOREIGN alias: it is now refused and noted
+ *     (run-debate.test.js's "T5.5: a taskId-bound leg carrying a FOREIGN alias is
+ *     REFUSED" block), so the silent set shrank by exactly that shape. Pinned by run-debate.test.js's
+ *     test named "roster hole whose leg is ALSO unbindable: the key IS published and the
+ *     re-vote still applies", whose `ctx.degrade.all()` is `[]`; the placeholder shape is
+ *     pinned for its seat (`['gpt', null]`) by that file's "§3.4 placeholder contract at
+ *     the -rv call site" block, which asserts nothing about notes either way.
+ *     ⚠️ The CONCLUSION is identical in all three shapes, which is why this bullet still
+ *     holds: even when the note IS emitted, its `data` deliberately omits `seat`, carrying
+ *     only `judge`/`key`, so this function's own `const alias = d.data.seat;` read (below)
+ *     still finds nothing and this leg stays un-exonerated, the same net effect as before
+ *     (reVoteUnboundNote's own docblock states why `seat` is withheld on purpose).
+ *   - an unmatchable waveId exonerates nothing.
+ * @returns {Map<string, Set<string>>} orphan alias -> the kinds it provably did NOT write,
+ *   in first-occurrence order (what keeps the emitted name list byte-identical).
+ */
+const S2_EXONERATES = Object.freeze(['review']);
+function orphanExonerations(run) {
+  const degrades = run && Array.isArray(run.degrades) ? run.degrades : [];
+  const s2WaveId = run && typeof run.runId === 'string' ? `${run.runId}-s2` : null;
+  const byAlias = new Map();
+  for (const d of degrades) {
+    if (!d || d.channel !== 'seat-unbound' || !d.data || !d.data.legId) { continue; }
+    const alias = d.data.seat;
+    if (typeof alias !== 'string' || alias === '') { continue; }
+    // ⚠️ `has`, not `||` (council-3 B1): an empty Set is TRUTHY, so `||` worked — a cleared
+    // set stayed cleared — but read as default-when-missing. A `.size` check re-opens the union.
+    const proven = byAlias.has(alias) ? byAlias.get(alias) : new Set(S2_EXONERATES);
+    // INTERSECTION across an alias's notes, never union: two notes for one alias means two
+    // orphaned legs, and a Stage-1 one proves nothing about the review the -s2 one exonerates.
+    if (!(s2WaveId && d.data.waveId === s2WaveId)) { proven.clear(); }
+    byAlias.set(alias, proven);
+  }
+  return byAlias;
+}
+
+module.exports = { isSeatTable, orphanExonerations };