amicus 4.7.1 → 4.8.0

package/src/council/tally.js

@@ -1,5 +1,11 @@
 // src/council/tally.js
 'use strict';
+const { peersOf, unattributedPeerDrops } = require('./peer-split');
+// The street-cred half (rankPositions / credSeats / computeStreetCred) lives in
+// ./street-cred (v4.8 T3.3 size-gate split; this file stood at 301 of 300 with
+// the seat-keying in it — release Constraint 6 is EXTRACT, never shave).
+// computeStreetCred is re-exported below, so no existing import path moved.
+const { computeStreetCred } = require('./street-cred');
 
 /**
  * Peers-only tier cascade. a/d are agree/dispute counts among PEER judges
@@ -26,49 +32,9 @@ function assignTier(a, d) {
   return { tier, confidence };
 }
 
-function mean(arr) { return arr.reduce((s, x) => s + x, 0) / arr.length; }
-
-/** Map each model to its (possibly fractional) rank position in one judge's order. */
-function rankPositions(order) {
-  const pos = new Map();
-  let p = 1;
-  for (const slot of order) {
-    const group = Array.isArray(slot) ? slot : [slot];
-    const meanPos = p + (group.length - 1) / 2;
-    for (const m of group) { pos.set(m, meanPos); }
-    p += group.length;
-  }
-  return pos;
-}
-
-/**
- * Both-numbers street-cred. Lower mean rank = better.
- * @param {Array<{judge:string, order:Array<string|string[]>}>} rankings
- * @param {string[]} models all reviewed models (incl. claude when in-council)
- */
-function computeStreetCred(rankings, models) {
-  const judgePos = rankings.map(r => ({ judge: r.judge, pos: rankPositions(r.order) }));
-  return models.map(m => {
-    const all = [], peers = [], perJudgeRank = {};
-    for (const { judge, pos } of judgePos) {
-      if (!pos.has(m)) { continue; }       // absent from this judge's ranking → skip
-      const rank = pos.get(m);
-      perJudgeRank[judge] = rank;
-      all.push(rank);
-      if (judge !== m) { peers.push(rank); }
-    }
-    return {
-      model: m,
-      withSelf: all.length ? mean(all) : null,
-      peersOnly: peers.length ? mean(peers) : null,
-      perJudgeRank,
-    };
-  });
-}
-
 // v4.0 §7: council family v2 — every council doc carries {schemaVersion, type}.
 const COUNCIL_SCHEMA_VERSION = 2;
-const VERDICTS = { agree: 'a', dispute: 'd', neutral: 'n' };
+const VERDICTS = { __proto__: null, agree: 'a', dispute: 'd', neutral: 'n' };
 
 function countTiers(findings) {
   const counts = { Confirmed: 0, Contested: 0, Singleton: 0, Disputed: 0 };
@@ -86,31 +52,111 @@ function tally(input) {
   const byFinding = new Map();
   for (const adj of adjudications) {
     if (!byFinding.has(adj.findingId)) { byFinding.set(adj.findingId, []); }
-    byFinding.get(adj.findingId).push({ judge: adj.judge, verdict: adj.verdict });
+    byFinding.get(adj.findingId).push({ judge: adj.judge, verdict: adj.verdict, ...(adj.seat ? { seat: adj.seat } : {}) });
   }
   const outFindings = findings.map(f => {
     const votes = byFinding.get(f.id) || [];
-    // Only exclude the raiser's own vote when a raiser is known; the raiser is
-    // populated by the orchestrator (not the reviewer JSON), so an unset raiser
-    // must not silently drop a real peer vote (L8).
-    const peers = f.raiser ? votes.filter(v => v.judge !== f.raiser) : votes;
+    const peers = peersOf(f, votes);
+    // v4.8 T-B2: how many votes `peersOf` excluded without being able to
+    // attribute them — the one-sided alias fallback, plus (T-B4) the falsy
+    // judges of a falsy raiser. ⚠️ NOT the votes the SEAT ids attributed: when
+    // both sides carry a seat id the engine knows whose vote it is, so that
+    // exclusion is announced by nothing. Same function and same emit rule
+    // (> 0 only) as debate.js :: debateTargets, so this document and the
+    // defense brief can never announce different numbers.
+    // ⚠️ On the SEATED shapes — tally.test.js T1 and T2, the one-sided twin
+    // pair — `basis` deliberately does NOT move: counting the ambiguous vote
+    // reproduces the naive filter's outcome, measured Confirmed on both, which
+    // re-arms #137. Announced, not counted. ⚠️ T-B4 is the deliberate exception
+    // and the scope of that sentence narrowed with it: on a finding whose
+    // raiser is FALSY, `basis` DOES move, because there the ambiguous vote is
+    // the raiser's own inflating its own basis rather than a twin's signal
+    // going uncounted (council C1 — see peer-split.js :: peersOf).
+    const drops = unattributedPeerDrops(f, votes);
     const basis = { a: 0, d: 0, n: 0 };
     // Skip unknown verdict strings so a stray value can't corrupt the basis via
-    // basis[undefined] = NaN (L9).
+    // basis[undefined] = NaN (L9). Guaranteed by VERDICTS's `__proto__: null`,
+    // not `!== undefined` alone — measured, all four Object.prototype keys
+    // (toString/__proto__/constructor/valueOf) read undefined on it. VERDICTS
+    // is module-local, absent from module.exports, so this isn't observable
+    // outside this file.
     for (const v of peers) {
       const key = VERDICTS[v.verdict];
       if (key !== undefined) { basis[key] += 1; }
     }
     const { tier, confidence } = assignTier(basis.a, basis.d);
+    // v4.8 PR4c §3.3 (R8): `peers` has already excluded the raiser BY SEAT, so a
+    // surviving peer whose ALIAS equals the raiser's is a different seat of the
+    // same model — corroboration that is not independent. Emitted only when TRUE
+    // (an unconditional `false` would change every document's shape).
+    // ⚠️ The leading `f.raiser &&` is LOAD-BEARING, not decoration — and the
+    // interesting part is that this sentence was FALSE for one commit inside
+    // v4.8 T-B4, so it is written with its measurement rather than its
+    // adjective. It is load-bearing because `peersOf` can hand back a
+    // seat-carrying vote whose `judge` is falsy, and then `v.judge === f.raiser`
+    // reads `undefined === undefined` on the CLI path (cli-handlers-council.js
+    // is a raw JSON.parse with no schema) and `'' === ''` on the MCP path
+    // (mcp-tools.js's z.string() accepts the empty string) — so without the
+    // guard this stamp fires on documents that name no models at all.
+    // MEASURED at each step over the 768-shape cross-product of (f.raiser,
+    // f.raiserSeat, v.judge, v.seat, verdict): deleting the guard flipped 8
+    // shapes at 64b835b8, ZERO after T-B4 round 1 — which had made `peersOf`
+    // drop every falsy-judge vote of a falsy raiser, briefly disarming the very
+    // pins that guarded this — and 4 after round 2, whose P0 rule counts the
+    // ones the SEAT ids prove are real peers. The 4 are the seat-DIFFER shapes
+    // of the T7b and T7d families, i.e. exactly those two tests. Re-run this
+    // after any edit to peer-split.js :: peersOf; do not infer it.
+    // ⚠️ Alias-only in BOTH directions, and the CHANGELOG says so: it misses
+    // `gpt-5,openai/gpt-5` (one model, two aliases — votes carry no
+    // resolvedModel) and it fires falsely on a SPLIT alias, whose two seats
+    // resolved to different executables. PR4b's ledger treats
+    // (alias, resolvedModel) as identity; this stamp is same-ALIAS only.
+    // SI-23 (R10): `location` is declared on the MCP schema now
+    // (mcp-tools.js :: getTools) so it survives zod validation, but
+    // surviving validation and reaching THIS document are two different
+    // properties — the round-trip pin below only holds if this map also
+    // forwards it, emit-when-present, the same convention as `raiserSeat`
+    // two lines up. Scoped to `location` alone AT R10: `claim` was already
+    // reaching this function on both the CLI and MCP paths (declared on the
+    // MCP schema since before R10) and was ALREADY not forwarded here — R10
+    // named the gap and left it for a separate PR rather than widening its
+    // own mandate to close it. SI-23 fix round 1 (paid council on PR #183,
+    // findings A1/B1, two independent raisers) ruled that indefensible one
+    // line from the fix it sits beside: `claim` is forwarded below too,
+    // same round.
+    // A2 (nit) / C1 (major, contested a0/d1/n2, thin): the truthiness checks
+    // below drop an empty string that zod would accept. Deliberate, not a
+    // bug — `raiserSeat` above uses the identical pattern, and diverging
+    // `location`/`claim` from their own immediate sibling is worse than the
+    // edge case, so "" is treated as absent on all three fields.
     return { id: f.id, raiser: f.raiser, severity: f.severity, tier, basis, confidence,
-             tierOverride: null, adjudications: votes };
+             tierOverride: null, adjudications: votes, ...(f.raiserSeat ? { raiserSeat: f.raiserSeat } : {}),
+             ...(f.location ? { location: f.location } : {}),
+             ...(f.claim ? { claim: f.claim } : {}),
+             ...(f.raiser
+               && peers.some(v => v.seat && f.raiserSeat && VERDICTS[v.verdict] === 'a' && v.judge === f.raiser)
+               ? { sameModelCorroboration: true } : {}),
+             ...(drops > 0 ? { unattributedPeerDrops: drops } : {}) };
   });
   return {
     schemaVersion: COUNCIL_SCHEMA_VERSION,
     type: 'council-tally',
     meta,
     judged: Array.isArray(rankings) && rankings.length >= 2,
-    streetCred: computeStreetCred(rankings || [], meta.models),
+    // v4.8 T3.3: `meta.seats` joins BY VALUE inside computeStreetCred (never
+    // positionally against meta.models — run-assemble.js :: buildTallyInput
+    // forbids that). The ENGINE emits it only when the bench repeats an alias,
+    // so a unique-alias run leaves the rows alias-driven and byte-identical.
+    // ⚠️ DO NOT READ THAT AS "hand-assembled input is always alias-driven" —
+    // this sentence said so until fix round 1 and it was false, in the way that
+    // hides a defect rather than merely misinforming. `meta` is copied verbatim
+    // from user JSON on both hand-assembled appendRun paths, and
+    // mcp-tools.js :: amicus_council_tally DECLARES `meta.seats`, so such a
+    // record produces SEAT-driven street-cred rows here while its `runStats`
+    // rows — declared `z.array(z.record(z.any()))`, so never asked for a seat —
+    // carry none. That asymmetry is a live quadrant, not a hypothetical; it is
+    // what ledger-join.js :: credFor's second lookup exists for.
+    streetCred: computeStreetCred(rankings || [], meta.models, meta.seats),
     findings: outFindings,
     runStats: (runStats || []).map(r => ({
       model: r.model, role: r.role, wasChair: !!r.wasChair, conformance: r.conformance || 'clean',
@@ -128,6 +174,11 @@ function tally(input) {
       ...(r.repairRefused ? { repairRefused: r.repairRefused } : {}),
       ...(r.waveId ? { waveId: r.waveId } : {}),
       ...(r.resolvedModel ? { resolvedModel: r.resolvedModel } : {}),
+      // v4.8 PR4c §3.1: `seat` rides the same slot. It is emitted upstream only
+      // when the bench repeats that alias (run-assemble.js's buildRunStatsEntry),
+      // so a unique-alias run is byte-for-byte unchanged here and in verdict.json,
+      // which copies this array verbatim (verdict.js :: buildVerdict).
+      ...(r.seat ? { seat: r.seat } : {}),
       status: r.status || 'unknown',
       durationMs: typeof r.durationMs === 'number' ? r.durationMs : null,
       usage: r.usage || null,

package/src/council/verdict.js

@@ -108,6 +108,13 @@ function buildVerdict(record, decisions = [], opts = {}) {
     date: record.meta.date,
     chair: record.meta.chair,
     council: record.meta.models,
+    // v4.8 PR4c §3.2: this projection RENAMES meta.models to `council`, so
+    // nothing from meta reaches verdict.json unless it is named here — which is
+    // why the seat table needs its own line rather than riding tally's verbatim
+    // meta copy. Emitted only when the record carries one (a twin bench), so a
+    // unique-alias verdict is byte-for-byte unchanged. The key is `seats`,
+    // matching the `seatLoss` sibling below; PR5 codes against that name.
+    ...(record.meta.seats ? { seats: record.meta.seats } : {}),
     claudeInCouncil: record.meta.claudeInCouncil,
     overallVerdict: opts.overallVerdict === undefined ? null : opts.overallVerdict,
     findings: record.findings.map(f => {
@@ -121,11 +128,52 @@ function buildVerdict(record, decisions = [], opts = {}) {
         adjudications: f.adjudications,
         decision: d.decision || null,
         applied: d.applied === true,
+        // v4.8 PR4c §3.4: this literal is CLOSED — it names every key and copies
+        // nothing else off `f` — so the two fields tally() stamps need their own
+        // lines or verdict.json names seats it cannot resolve (§1.2). Appended as
+        // a pure TAIL, leaving the shipped eleven-key order untouched.
+        // ⚠️ NOT `|| null`, even though `duplicateOf` and `decision` above are:
+        // `JSON.stringify({raiserSeat: null})` still WRITES `"raiserSeat":`, so
+        // that idiom changes the shape of every unique-alias verdict.json and
+        // fails seat-parity-ondisk's needles. `applied` is the sibling to copy —
+        // it computes a value rather than defaulting one. Emit-when-set matches
+        // both producers (tally.js) and keeps a non-twin verdict byte-identical.
+        ...(f.raiserSeat ? { raiserSeat: f.raiserSeat } : {}),
+        ...(f.sameModelCorroboration ? { sameModelCorroboration: true } : {}),
       };
       if (f.debate) { out.debate = f.debate; }   // v4.1: additive debate decoration carry-through (spec §5.6)
       return out;
     }),
-    streetCred: record.streetCred.map(s => ({ model: s.model, withSelf: s.withSelf, peersOnly: s.peersOnly })),
+    // v4.8 fix round 1 (review finding): emit-when-DIFFERENT, adapted to this
+    // row's flat {model, seat} shape — model is the alias, seat is the seat
+    // id, so on a unique-alias bench they are byte-equal and nothing is
+    // emitted (same semantics as `seat.id !== seat.alias` one layer up,
+    // run-stats-entry.js:64). NOT a plain pass-through like `raiserSeat`
+    // above (:141) — that field's upstream producer already holds a real
+    // {id, alias} seat OBJECT at its own decision point (run.js:202:
+    // `r.seat && r.seat.id !== r.seat.alias`), so passing its verdict
+    // through here is safe. The street-cred producer never has such an object
+    // at this point, only a flat row, so a pass-through here would leak `seat`
+    // onto every unique-alias verdict.json the moment that producer's own
+    // guard slipped — silently, since nothing else guards this closed literal.
+    // This check is deliberate defense in depth: buildVerdict is also reachable
+    // on externally-supplied records that never touched computeStreetCred
+    // in-process at all — the MCP `record` param of mcp-tools.js ::
+    // amicus_verdict is `z.record(z.any())`, fully permissive — so this
+    // literal's own byte-identity cannot be contingent on that producer alone;
+    // this file's own tests exercise that exact shape (hand-built rec objects,
+    // never calling tally()). tally.json keeps its own pin regardless — a
+    // genuine producer bug still reds at seat-parity-ondisk.test.js — this
+    // check exists so verdict.json is never the ONE document such a bug (or an
+    // externally-supplied record) masks.
+    // ⚠️ NO LONGER INERT. This comment said "computeStreetCred emits no `seat`
+    // at all yet" until v4.8 T3.3 shipped that producer — street-cred.js ::
+    // computeStreetCred, one row per SEAT with the id emitted when it differs
+    // from the alias. Both guards now fire on the same real documents, and the
+    // pin that proves this literal carries the field through lives at
+    // seat-parity-ondisk.test.js on a real runCouncil twin bench.
+    streetCred: record.streetCred.map(s => ({ model: s.model, withSelf: s.withSelf, peersOnly: s.peersOnly,
+      ...(s.seat && s.seat !== s.model ? { seat: s.seat } : {}) })),
     runStats: record.runStats,
     tierCounts: record.tierCounts,
     // Additive and OPTIONAL (schemaVersion stays 2): present only when a critic

package/src/headless.js

@@ -174,13 +174,13 @@ function withTimeout(promise, ms, label) {
  *     because raising the env var changes exactly this window.
  *   - fromEnv=false: `ms` arrived as a direct, caller-set numeric option.
  *     Task 6 review (Important finding): this is NOT synonymous with "the
- *     env var doesn't apply" — src/council/run-retry.js:154 computes a
- *     Stage-1 retry's escalated window as
+ *     env var doesn't apply" — `run-retry.js :: retryStage1Losses`'s
+ *     `escalatedBackstopMs` computes a Stage-1 retry's window as
  *     `2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs :
- *     resolveNoOutputBackstopMs())` and forwards that as a direct
- *     `noOutputBackstopMs` (line 186) — so a 240s retry-fired backstop is
- *     "caller-set" by this predicate while still being *derived from* the
- *     env default doubled. Only src/sidecar/models-probe.js:79's hardcoded,
+ *     resolveNoOutputBackstopMs())` and forwards it on `common` as a direct
+ *     `noOutputBackstopMs` — so a 600s retry-fired backstop (the 300s env
+ *     default, doubled) is "caller-set" by this predicate while still being
+ *     *derived from* the env default. Only src/sidecar/models-probe.js:79's hardcoded,
  *     non-tunable 30s (PROBE_WINDOW_MS; docs/usage.md:406 promises it's "not
  *     tunable") is truly independent of the env var. Because a real
  *     `fromEnv` flag distinguishing those two cases would have to ride the
@@ -1306,6 +1306,9 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
         ...settleResult,
         ...subtreeFlags,
         ...subtreeResult,
+        // #133 P1: sessionId was assigned at :413/:417, well before this
+        // return — guaranteed set here, same as `taskId` above.
+        opencodeSessionId: sessionId,
         error: sessionError
       };
     }
@@ -1321,6 +1324,8 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       ...settleResult,
       ...subtreeFlags,
       ...subtreeResult,
+      // #133 P1: see the comment on the sibling return above — guaranteed set.
+      opencodeSessionId: sessionId,
       exitCode: 0
     };
 
@@ -1396,6 +1401,15 @@ async function runHeadless(model, systemPrompt, userMessage, taskId, project, ti
       aborted: false,
       taskId,
       usage: emptyUsageTotals(),
+      // #133 P1: measured, not assumed — `sessionId` (:365) is in scope
+      // through this whole catch (it is already read at the `if (sessionId)`
+      // abort-on-error above) but, unlike the two returns in the try body,
+      // is NOT guaranteed assigned here: an exception thrown before session
+      // creation (e.g. during the pre-session server-readiness wait) reaches
+      // this same catch with sessionId still unset. `|| null` makes both
+      // outcomes explicit and already schema-shaped (run.schema.json:23
+      // wants string|null, never undefined).
+      opencodeSessionId: sessionId || null,
       error: error.message
     };
   }

package/src/mcp-tools.js

@@ -390,19 +390,89 @@ function getTools() {
       'returns the tally record immediately. No subprocess, no polling. Claude ' +
       'assembles the input and may override margin tiers afterward.',
     inputSchema: {
+      // v4.8 PR4c R4c-5: the three seat keys are declared here or zod SILENTLY
+      // STRIPS them, and `amicus_council_tally` stays permanently on the #137
+      // behaviour while `amicus council tally` (a raw JSON.parse with no schema)
+      // gets the fix. Deliberately PERMISSIVE — validate the envelope, let
+      // tally() be the single arbiter of shape on both paths, matching
+      // amicus_verdict's own `record: z.record(z.any())`. `z.array(z.record())`
+      // would reject a string seat table the CLI accepts, and a bare
+      // `.optional()` would reject the `|| null` a hand-assembling caller
+      // writes, which serializes byte-identically to omitting the key.
+      // ⚠️ ALL THREE keys carry `.nullable()`, not two of three (council C1).
+      // Bare `.optional()` on `seats` failed the WHOLE call with `seats:
+      // Expected array, received null` where `amicus council tally` — the raw
+      // JSON.parse at cli-handlers-council.js:24 — accepts it and every
+      // seat-space reader treats it as absent (`Array.isArray(null)` is
+      // false). That is the same silent fork in the same schema, one key
+      // later. `amicus_verdict` below already spells its array/record
+      // envelope keys this way (`seatLoss` :461, `degrades` :465).
       meta: z.object({
         runId: z.string(), runType: z.string().optional(), date: z.string().optional(),
         models: z.array(z.string()).min(1), chair: z.string().optional(),
-        claudeInCouncil: z.boolean().optional(),
+        claudeInCouncil: z.boolean().optional(), seats: z.array(z.any()).nullable().optional(),
       }).describe('Run metadata; meta.models lists every reviewed model.'),
       findings: z.array(z.object({
         id: z.string(), raiser: z.string(), severity: z.string(), claim: z.string().optional(),
+        raiserSeat: z.string().nullable().optional(),
+        // SI-23 (R10): `location` was silently stripped by this closed
+        // z.object too — the same #137-shaped fork as the seat keys above,
+        // one key later. R10 (as relayed) also named `evidence`/`file`/`line`
+        // as siblings to fix here; MEASURED against findings.js :: REQUIRED
+        // (Stage-1's required-field list), briefings.js ::
+        // FINDINGS_JSON_SHAPE (the JSON contract every reviewer is briefed
+        // on), and every `f.<key>` read under src/ — none of those three
+        // exist anywhere in this codebase's finding shape. Only `location`
+        // does: anonymize.js :: toGlobalFindings forwards it alongside
+        // `claim` into the exact "run-global findings" shape this tool
+        // already documents below, and briefings-debate.js ::
+        // findingBlockDefense / debate.js :: debateTargets read it on the
+        // engine's native debate stage — unreachable from this MCP tool
+        // today (no MCP debate step exists), so this is a document-shape /
+        // round-trip fix here, not an unlocked renderer. `rationale` is also
+        // Stage-1-required but toGlobalFindings does not forward it past
+        // Stage-1 either; adding it here would invent a shape the engine's
+        // own path never produces, so it stays out.
+        // Plain `.optional()`, matching `claim` immediately above — a
+        // same-shape string sibling, not a seat field, so the `.nullable()`
+        // seat idiom explained above `meta` doesn't apply here.
+        // tally.js :: tally's `outFindings` map was ALSO dropping
+        // `claim`/`location` from every finding regardless of what survived
+        // validation, on the CLI and MCP paths alike — declaring the field
+        // here alone would validate but never reach the document, so that
+        // map forwards both, the same emit-when-present way it already
+        // forwards `raiserSeat`. R10 shipped only `location`'s forward and
+        // left `claim`'s for later (`claim` was already declared above,
+        // pre-R10); SI-23 fix round 1 (PR #183 council, A1/B1) closed that
+        // gap in the same map, same convention.
+        location: z.string().optional(),
       })).describe('Run-global findings (ids already A1/B2/C3-prefixed by Claude).'),
       adjudications: z.array(z.object({
         judge: z.string(), findingId: z.string(), verdict: z.enum(['agree', 'dispute', 'neutral']),
+        seat: z.string().nullable().optional(),
       })).describe('One row per (judge × finding).'),
+      // v4.8 T3.2: `seat` added here to match `adjudications.seat` immediately
+      // above — the channel run-assemble.js's buildTallyInput now puts on
+      // rankings[] (the judge's own seat, emit-when-DIFFERENT) is otherwise
+      // unreachable from a hand-assembled MCP call: zod strips unknown keys
+      // by default. NOT R10's territory — R10 covers SI-23 (findings[]
+      // losing evidence/file/line) as its own document-shape PR; this is a
+      // different field on a different array, and the adjudications.seat
+      // precedent immediately above is this repo's own pattern of adding a
+      // seat field in the PR that introduces it, not deferring to a later
+      // schema PR.
+      // v4.8 T3.3 adds `orderSeats` for the same reason and by the same rule.
+      // It is the seat-valued PARALLEL of `order` (street-cred.js ::
+      // rankPositions keys on it), so without the declaration an MCP caller
+      // that sends it gets the alias collapse SI-20 exists to fix, silently.
+      // `nullable()` inside the arrays is load-bearing, not defensive:
+      // anonymize.js :: rankingToOrder emits `null` for every slot with no
+      // distinguishing seat, so a mixed bench legitimately sends nulls.
       rankings: z.array(z.object({
         judge: z.string(), order: z.array(z.union([z.string(), z.array(z.string())])),
+        seat: z.string().nullable().optional(),
+        orderSeats: z.array(z.union([z.string().nullable(),
+          z.array(z.string().nullable())])).nullable().optional(),
       })).describe("Each judge's preference order over the reviews (ties = nested array)."),
       runStats: z.array(z.record(z.any())).optional().describe('Optional per-model run stats (status/duration/usage).'),
       project: z.string().optional().describe('Optional project directory path.'),

package/src/observe/council-legs.js

@@ -22,7 +22,7 @@
  * em-dash) and blind mode's labelOf(alias) lookup never matches (real model
  * id leaks). The alias IS on disk per-leg, though: every council leg goes
  * through src/sidecar/fanout-leg.js's runSingleAttempt, which calls
- * `writeLegPatch(legDir, { parentWave, modelInput })` synchronously,
+ * `writeLegPatch(legDir, { parentWave, modelInput, seat })` synchronously,
  * immediately after leg creation (fanout-leg.js:101) — well before any
  * status poll could reasonably observe it missing. So this module reads
  * `modelInput` straight off the leg's own metadata.json, no run.json join
@@ -127,6 +127,12 @@ function buildLegRow(project, legId, runCtx) {
   const row = {
     taskId: legId, model: meta.model || null, status: meta.status || 'unknown',
     modelInput, role,
+    // v4.8 R5: the leg's seat id (`alias#N`), written at launch by
+    // fanout-leg.js :: runSingleAttempt. Null on a unique-alias bench, where
+    // buildSeats sets id === alias and the shared emit-when-DIFFERENT predicate
+    // therefore stamps nothing — the same rule run-stats-entry.js ::
+    // buildRunStatsEntry applies on the terminal path.
+    seat: meta.seat || null,
   };
   let stalledMs = null;
   let p = null;

package/src/observe/live-doc.js

@@ -26,9 +26,9 @@ const { resolveUsage, sumWaveUsage } = require('../utils/pricing');
 //                 a timed-out single session never exited (watch-render.js:138 polls until
 //                 TERMINAL.has(doc.status), and amicus_status stamps metadata.status straight onto
 //                 the doc — mcp-server.js:687); a timed-out leg skipped the "prefer metadata.usage
-//                 over the stale progress.json snapshot" branch in council-legs.js:162 and reported
-//                 an under-counted cost; and markLive kept stamping view:'live' on a finished
-//                 single-session doc.
+//                 over the stale progress.json snapshot" branch in council-legs.js :: buildLegRow
+//                 and reported an under-counted cost; and markLive kept stamping view:'live' on a
+//                 finished single-session doc.
 // NOTE this is deliberately NOT the same list as src/utils/result-schema.js:13 TERMINAL_STATUSES
 // (the leg set, no 'partial'). Two mirrors of THIS list exist — src/workspace/run-detail.js:26 and
 // electron/workspace-ui/live-model.js:14 — byte-identical, held by drift pins. Edit all three.

package/src/sidecar/fanout-leg.js

@@ -98,7 +98,7 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     });
     waveDir = getSessionDir(project, waveId);
     emitLegStarted(waveDir, waveId, legId, leg.model, leg.modelInput, follow);
-    writeLegPatch(legDir, { parentWave: waveId, modelInput: leg.modelInput });
+    writeLegPatch(legDir, { parentWave: waveId, modelInput: leg.modelInput, seat: leg.seat });
     saveInitialContext(legDir, systemPrompt, userMessage);
 
     // Per-leg watchdog: a BACKSTOP strictly behind runHeadless's own deadline
@@ -158,6 +158,27 @@ async function runSingleAttempt({ leg, legId, waveId, project, directory, follow
     reason: result.error || undefined,
     completedAt: new Date().toISOString(),
     usage: usage || undefined,
+    // #133 P1: `|| undefined`, matching status/reason/usage above — NOT the
+    // `toolSettleAborted` carve-out below, because a session id has no
+    // meaningful-falsy value the way `false` does there. A clean/failed
+    // attempt (no session ever created) therefore carries neither key on
+    // disk, rather than writing an explicit `null` that could clobber a
+    // PRIOR attempt's real session id: fallback substitution reruns
+    // runSingleAttempt against the SAME legId/legDir (fanout-leg-fallback.js
+    // "SAME leg dir under the SAME legId"), and writeLegPatch's read-merge-
+    // write only drops keys that are `undefined`, not ones explicitly set to
+    // `null`. This does not disagree with result-schema.js:72's
+    // `metadata.opencodeSessionId || null` — that coercion runs downstream,
+    // on the per-request OUTPUT run document, where run.schema.json requires
+    // the field always present as string|null. The two layers do different
+    // jobs (omit-if-absent on disk here vs. always-present in the emitted
+    // doc there) and compose without conflict.
+    //
+    // Raised again in the PR #185 council round (findings A3/D2) as a
+    // possible conflation of "no session" with "empty session id"; kept
+    // as-is per the reasoning above — this is `legPatch`'s existing
+    // convention (matching status/reason/usage), not a gap opened by #133 P1.
+    opencodeSessionId: result.opencodeSessionId || undefined,
     // v4.4 B4 part 1: the leg completed with tool calls still live, so its
     // OpenCode session may have kept working (and billing) afterwards. Travels
     // with the leg so it is readable long after the run's stderr is gone.

package/src/sidecar/fanout-wave-io.js

@@ -75,13 +75,38 @@ async function finishWave({ wave, waveDir, waveId, project, exitCode, completedA
 /**
  * v4.3 §7.2 (moved here v4.7 PR3 Task 1): stamp council attribution onto every
  * leg — fanout-leg's appendSpend reads it; no-op for every non-council caller.
- * v4.7 F8 (Task 7) adds tag stamping in the same pass.
+ * v4.7 F8 (Task 7) adds tag stamping in the same pass. v4.8 R5 (T4.2) adds
+ * seat stamping in the same pass.
  */
 function stampLegAttribution(legs, options) {
   if (options.councilRunId || options.councilName) {
     legs.forEach(l => { l.councilRunId = options.councilRunId; l.councilName = options.councilName; });
   }
   if (options.tag) { legs.forEach(l => { l.tag = options.tag; }); }
+  // v4.8 R5: seat identity for the LIVE path. `options.seats` is the launching
+  // wave's roster, index-parallel with `options.models` by construction
+  // (run-stage1-launch.js builds `roster` and `models` from the same filter, and
+  // fanout-validate.js:66-87 pushes exactly one leg per model on BOTH its ok and
+  // its unroutable branch, so a leg that never routed still holds its slot).
+  //
+  // ⚠️ emit-when-DIFFERENT, against the seat's OWN alias — the shared predicate
+  // stated at run-stats-entry.js :: buildRunStatsEntry, which the three sites in
+  // run-assemble.js also spell. buildSeats mints `alias#N` ONLY when an alias
+  // repeats (seats.js:67), so `id !== alias` IS "the bench repeats this alias",
+  // and on a unique bench `id` IS the alias — a bare `if (s.id)` would stamp an
+  // alias-valued seat onto every leg of every run: the same wrong output shape
+  // run-assemble.js:165-169 records having already fixed once there (a
+  // wrong-comparator bug, `!== j.judge` rather than `!== alias`, with a
+  // narrower trigger — only a leg/seat alias drift, not every leg).
+  // Comparing against the seat's own alias and never against `model` also makes
+  // this immune to the two cases where `model` is NOT the alias (a leg reporting
+  // no modelInput; a padded --council member).
+  if (Array.isArray(options.seats)) {
+    legs.forEach((l, i) => {
+      const s = options.seats[i];
+      if (s && s.id !== s.alias) { l.seat = s.id; }
+    });
+  }
 }
 
 module.exports = { writeWaveMetadata, writeWaveDoc, finishWave, stampLegAttribution };

package/src/sidecar/fanout.js

@@ -20,16 +20,10 @@ const { ERROR_CODES } = require('../utils/error-doc');
 // Task 0.5). writeWaveMetadata is re-exported below — fanout-retry.js and the
 // fanout tests import it from here.
 const { writeWaveMetadata, writeWaveDoc, finishWave, stampLegAttribution } = require('./fanout-wave-io');
-
-/**
- * Derive leg task IDs: <waveId>-1 .. <waveId>-N (matches TASK_ID_PATTERN).
- * @param {string} waveId
- * @param {number} count
- * @returns {string[]}
- */
-function deriveLegIds(waveId, count) {
-  return Array.from({ length: count }, (_, i) => `${waveId}-${i + 1}`);
-}
+// Leg-id derivation lives in ./leg-ids (v4.8 PR0 size-gate split).
+// deriveLegIds is re-exported below — mcp-server.js, fanout-retry.js and
+// the fanout tests import it from here.
+const { deriveLegIds } = require('./leg-ids');
 
 /**
  * Run a fan-out wave. Spec §4.3.

package/src/sidecar/leg-ids.js

@@ -0,0 +1,19 @@
+'use strict';
+// deriveLegIds — the <waveId>-<i+1> leg-id convention. Moved verbatim from
+// fanout.js:24-32 (v4.8 PR0 size-gate split, zero behavior; fanout.js was
+// 300/300). The shape is load-bearing: council stage-1 composes
+// `${runId}-s1` waves onto it, and ~10 suites plus a replay fixture
+// hard-code the composite. Pinned by tests/sidecar/fanout.test.js:84-93
+// through fanout.js's re-export.
+
+/**
+ * Derive leg task IDs: <waveId>-1 .. <waveId>-N (matches TASK_ID_PATTERN).
+ * @param {string} waveId
+ * @param {number} count
+ * @returns {string[]}
+ */
+function deriveLegIds(waveId, count) {
+  return Array.from({ length: count }, (_, i) => `${waveId}-${i + 1}`);
+}
+
+module.exports = { deriveLegIds };

package/src/sidecar/models-probe.js

@@ -17,7 +17,7 @@
  */
 
 /** Probe backstop override (spec D5) — a fixed constant, NOT env-configurable;
- * the env knob (AMICUS_NO_OUTPUT_BACKSTOP_MS) stays the ordinary 120s leg default. */
+ * the env knob (AMICUS_NO_OUTPUT_BACKSTOP_MS) stays the ordinary 300s leg default. */
 const PROBE_WINDOW_MS = 30000;
 
 /** Fixed tiny prompt — a probe leg only needs to prove the model answers at all. */
@@ -28,9 +28,12 @@ const PROBE_PROMPT = 'Reply with exactly: OK';
  * schema.js) per the plan's Global Constraints classification contract.
  * Precedence matters: 'complete' wins outright; otherwise a NO_OUTPUT_
  * BACKSTOP error (PR2's silent-leg detector, armed here at PROBE_WINDOW_MS
- * instead of its 120s default) is the one specific error shape that means
- * "the model accepted the request and never produced a token" rather than an
- * ordinary routing/auth/timeout failure.
+ * instead of its 300s default) is the one specific error shape that means
+ * NOTHING arrived in the window — no output, no reasoning, no tool call —
+ * rather than an ordinary routing/auth/timeout failure. ⚠️ It does NOT prove
+ * the model "accepted the request": a stalled gateway or a dropped connection
+ * fires the same backstop. `accepted-but-silent` names the classification, not
+ * a fact about the endpoint (council B1 on PR #182).
  * @param {{status?:string, error?:string|null}} leg
  * @returns {'served'|'accepted-but-silent'|'error'}
  */

package/src/sidecar/reopen-spend.js

@@ -10,7 +10,7 @@
 /**
  * Resolve a reopened session's usage, write it onto metadata, and append one
  * attributed ledger row. Mirrors start.js's finalize (the only sites that
- * dropped usage - BACKLOG.md:280). Best-effort ledger append; never throws.
+ * dropped usage - BACKLOG.md :: "continue/resume never compute per-run usage" — ⚠️ cited `BACKLOG.md:280` until T-A8 re-opened it 2026-08-17: `:280` is a docs/usage.md line, the entry is `:289`). Best-effort ledger append; never throws.
  * @returns {{usage: object|null}}
  */
 function finalizeSpendForReopen({ taskId, model, mode, op, result, status, project, metadata }, ctx = {}) {

package/src/sidecar/setup.js

@@ -51,7 +51,11 @@ function createDefaultConfig(defaultModel) {
   const cfg = {
     ...existing,
     default: existing.default || defaultModel,
-    aliases: { ...getDefaultAliases(), ...(existing.aliases || {}) },
+    // Same restatement as the readline gate below (fix round 3, G-2): a spread
+    // into `{}` re-materialises Object.prototype. `saveConfig` rebuilds this
+    // into its own literal anyway, so this one is defense in depth rather than
+    // a measured hole — recorded as such rather than claimed as a fix.
+    aliases: { __proto__: null, ...getDefaultAliases(), ...(existing.aliases || {}) },
   };
   saveConfig(cfg);
   logger.info('Default config ensured', {
@@ -128,7 +132,14 @@ function resolveChoice(input, picks, catalog) {
     return { modelId: input };
   }
   const cfg = loadConfig();
-  const aliases = { ...getDefaultAliases(), ...((cfg && cfg.aliases) || {}) };
+  // ⚠️ `__proto__: null` — v4.8 SI-22.4 fix round 3 (council G-2). `input` here
+  // is FREE-FORM readline text, and the gate below is `aliases[input] !==
+  // undefined`, so on a plain literal `toString` / `valueOf` / `constructor` /
+  // `hasOwnProperty` all measured TRUE and returned `{alias: input, noUpgrade:
+  // true}` — setup accepted them as existing aliases. Spreading a
+  // null-prototype object into a bare `{}` produces a PLAIN object again, so the
+  // curated-models fix does not reach this literal; the seed has to be restated.
+  const aliases = { __proto__: null, ...getDefaultAliases(), ...((cfg && cfg.aliases) || {}) };
   if (aliases[input] !== undefined) {
     return { alias: input, noUpgrade: true };
   }