amicus 4.7.1 → 4.8.1

package/CHANGELOG.md

@@ -3,7 +3,994 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
-## [Unreleased]
+## [4.8.1] - 2026-08-25
+
+### Fixed
+
+- **Setup Step 2 offered one card per curated model *family*, with no way to choose which model
+  within it — issue #138.** `pickCurrent` kept exactly one winner per namespace, so a family with
+  several live models collapsed to a single card, and the route pill it wrote stored a **provider**
+  id, never a **model** id, so nothing downstream could tell them apart either. The family regex
+  made this worse for one vendor outright: `/^deepseek-v[\d.]+(-pro)?$/` only matches a
+  version-numbered `-v` name with an optional `-pro` suffix, so `deepseek-r1`, `deepseek-chat`, and
+  `deepseek-flash` never had a route to *any* card — structurally excluded, not just hidden behind
+  the flagship. Both wizard surfaces — the Electron Settings window and the readline setup flow —
+  now offer a vendor-scoped drill-down after the family pick, built on the existing priced picker
+  via a new pure module, `model-shortlist.js`, which splits a vendor's rows into suggested/rest so
+  the UI can show a handful of recommended models plus an "all" escape hatch. Persistence is
+  unchanged: `config.aliases[<family>]` still holds a route-encoded id and `config.default` still
+  holds the alias *name* — only the picker got smarter, not the storage shape. Two review rounds on
+  this branch closed five further blockers before it shipped: a silent setup-fallback path, a
+  misleading model-count label, a false alias-deletion report, a same-run double-ask of the same
+  vendor's drill-down, and an unescaped catalog id.
+
+- **`chooseRowId` fabricated bare `<vendor>/<model>` ids for catalog rows that exist only on
+  OpenRouter — issue #195.** Once the user held that vendor's own API key, the fabricated id routed
+  `direct`-first and `catalogGate` rejected it as `model_not_found`. Measured against the live
+  catalog: 19 of 69 `google` rows and 51 of 175 `openai` rows. The picker unconditionally stripped
+  the `openrouter/` prefix off any non-`DIVERGENT_VENDORS` OR-only row, regardless of whether the
+  direct namespace actually carried that model. It now reuses `classifyModel` — never a
+  reimplementation of its rule — and synthesizes the bare form only when that id would *not*
+  classify `invalid` on `direct`; `deepseek`'s empty-namespace rows (14/14) still synthesize bare,
+  unchanged. The identical unconditional strip existed in two more places that would otherwise have
+  silently undone the fix at write time — `canonicalizeResolved` (preselection matching) and
+  `applyProviderDefault` (the actual persist-to-config path, reached from both the Electron IPC
+  handler and the readline flow) — both now carry the same guard. Persistence was hardened further
+  in review: a failed or empty catalog fetch at persist time used to degrade straight back to the
+  old unconditional strip (confirmed against the real 601-row catalog), so `applyProviderDefault`
+  now requires *positive* catalog evidence (`classifyModel` returning `valid`, not merely
+  non-`invalid`) before it will strip a prefix — an empty catalog is inert, never a silent fallback.
+  ⚠️ **`doctor --fix` can now rewrite your config, not just diagnose it.** A new narrow repair,
+  `findFabricatedAliasRepairs`, finds aliases already persisted by v4.8.0 as a fabricated bare id —
+  one that classifies `invalid` on `direct` and has an unambiguous OpenRouter twin via
+  `pairAcrossGateways` — and rewrites them to the id the fixed picker would offer today. It is
+  gated on a **fresh** catalog fetch (declines with an explanatory hint if the same doctor run's own
+  `catalog` check reports the cache as stale, rather than repairing from data it has already told
+  you not to trust), idempotent, converts only to the one id `pairAcrossGateways` names, and every
+  repair is announced through the existing doctor-fix `heal` degrade channel, naming the alias and
+  both the old and new id. Outside that one class — a typo, a retired model, a user-invented id, or
+  a `DIVERGENT_VENDORS` alias — `doctor --fix` leaves the config alone exactly as before.
+
+### CI
+
+- **Council review on this repo ran with whatever alias each seat's name happened to resolve to on
+  a bare runner, not the intended bench — #193.** A CI runner has no user config, so
+  `getEffectiveAliases()` returned exactly `DEFAULT_ALIASES` and every seat bound to the shipped
+  `curated-models.js` pin: `glm` reviewed at 5.1 while 5.2 and 5.3 had already shipped, and an alias
+  missing from that table was silently dropped by `classifyCouncilMembers` with only a `run.json`
+  note to show for it. It was invisible by construction — `run.json`, `events.jsonl`, and
+  `verdict.json` all record alias *names*, so they read identically whichever model actually
+  answered; `spend-ledger.jsonl`, written to `getConfigDir()`, is the only artifact that carries a
+  resolved id. `council-review.yml` now provisions `.github/amicus-ci-aliases.json` from the
+  **base** ref (a PR can never edit the map used to review it), validates it by shape, pre-flights
+  every seat before any spend, and uploads the ledger as the receipt; every fetch failure but a 404
+  now fails closed instead of silently swapping the bench. A companion job, `alias-pin-drift.yml`,
+  compares each curated pin against its newest same-vendor sibling on the same tier/variant and
+  opens a weekly bump issue — `models --check` alone is structurally blind to this, since it
+  validates a curated *family* against its own `idPattern`, not a flat cardless pin like
+  `glm`/`qwen`/`kimi`.
+- **The council briefing now includes the `env:` blocks a diff can't show — #194.** PR #193 was
+  reviewed twice, and both benches unanimously raised the same blocker: `$GH_REPO`, `$MODELS`, and
+  `$CHAIR` looked undefined in the `run:` step under review. They were defined — in a workflow- or
+  job-level `env:` block the PR never touched, so it never appeared in the diff. Four seats agreeing
+  was one shared blind spot, not four independent findings. The briefing now appends the workflow-
+  and job-level `env:` blocks of every changed workflow (fetched from the base ref, exactly like the
+  alias map above), labelled explicitly as context and not part of the diff; step-level `env:` is
+  excluded because it already travels with its own hunk. A literal value under a
+  `TOKEN`/`SECRET`/`PASSWORD`/`KEY`-shaped name is withheld from the briefing — a pure `${{ }}`
+  reference is kept, since it names a secret rather than exposing one.
+- **The council-review check is no longer hardcoded green — #197.** Its `none`-policy branch set
+  `CONCLUSION="success"` before the chair's verdict was even read, so three distinct outcomes — a
+  clean review, a review with real findings, and a review that never ran at all — rendered as the
+  identical green check. `fail_on` now defaults to `rethink`: the check fails only when the chair
+  returns "Fundamental rethink," and passes on both "Fix these first" and "Ship it" (a null or
+  absent chair verdict still maps to neutral, never failure). A stricter `fail_on: fix` default was
+  tried first and reverted within hours: three live runs against PR #196 each came back "Fix these
+  first," but of the confirmed findings only one was a real, reachable defect — several were
+  accurate statements about states the system cannot produce, and two rested on premises that were
+  factually wrong. Gating on that verdict would have blocked more good work than bad. `fail_on` is
+  spelled twice in `council-review.yml` — the `workflow_call` input default, and the `pull_request`
+  path's `||` fallback, which is the load-bearing one for every label-triggered review on this repo
+  — and both spellings moved together, with a drift test re-verified against the historical
+  one-site-only mutant at the new value. `none` (report-only) and `fix` (the stricter gate) both
+  remain available for a caller that wants them.
+
+### Internal
+
+- **Burned down the citation allowlist and re-anchored the citations the gate cannot see —
+  citation-burndown, #192.** Twelve stale citations corrected, `CONFIG.grandfathered` emptied to
+  zero. Five of the eight previously-allowlisted entries were born stale — wrong in the commit that
+  introduced them, not rotted afterward; the no-output-backstop comment among them was a truth
+  failure rather than a numbering one, since the guard it warned was missing had been added by the
+  very commit that wrote the warning, so it is now reframed as closed history instead of
+  renumbered. Separately, several source comments cited a bare `(:129)`/`(:293)` line number with no
+  `.js` immediately before the colon — a shape `check-citations.js` cannot parse and so silently
+  never checks — and those are now `file.js :: symbol` anchors instead, both correct today and
+  visible to the gate from now on; one of them (`run.js:293`) had already rotted to the wrong line
+  and is corrected to `run.js:279` in the same pass.
+
+## [4.8.0] - 2026-08-23
+
+### Fixed
+
+- **A council member literally named `toString`, `constructor`, `valueOf` or `hasOwnProperty` is
+  no longer accepted as a valid model alias.** The effective alias table
+  (`config.js :: getEffectiveAliases`) was a plain object, so it inherited `Object.prototype`, and
+  every gate that asks *"is this a known alias?"* by indexing the table read those inherited methods
+  as a **truthy** answer. Five gates were affected: `resolveModel`, `classifyCouncilMembers`
+  (`--council` presets), `amicus council save`, pack validation, and launch-time route resolution.
+  The sharpest consequence, measured: `resolveModel('toString')` returned **the function itself**
+  — `typeof 'function'` — where every caller expects a model-id string, instead of throwing
+  *"Unknown model alias"* the way any other unknown name does. The table is now created with
+  `__proto__: null` — the same protection this release already gave its other lookup tables. A member
+  with one of those names is now dropped exactly like any other unresolvable alias, with the same
+  message, and `resolveModel` throws *"Unknown model alias"* instead of returning a function.
+  ⚠️ **One table was not enough.** The curated builders behind `DEFAULT_ALIASES`
+  (`curated-models.js :: toDefaultAliases`, `:: toGatewayRoutes`), the copy handed out by
+  `getDefaultAliases`, and the alias map the interactive `amicus setup` composes from free-form
+  input all needed the same seed — **a spread into a plain `{}` re-creates the inherited
+  prototype**, so fixing one map does not fix a map built from it. All three are now seeded.
+  One surface is deliberately out of scope and filed: the Electron
+  setup wizard re-embeds the alias table into its page through `JSON.stringify`, and the parser
+  always re-materialises `Object.prototype` on the far side. That path is behaviourally inert —
+  `JSON.stringify` drops function values before the write, and `saveConfig` rejects `__proto__`. On the
+  null-alias auto-repair path specifically, an alias named `toString` used to "repair" to
+  `function toString() { [native code] }` and say so on stderr; it now reports the misconfiguration
+  it actually is.
+  ⚠️ **Disclosed rather than buried: the preset-member trim in this same release briefly made
+  this worse, and that is why it is fixed here.** Before the trim, `"toString "` (with the trailing
+  space) missed the inherited property and was correctly dropped; trimming before the lookup landed
+  the padded spelling on it too. Fixing only the half this release introduced would have taken more
+  code *and* knowingly left the other half open.
+
+- **A finding whose `raiser` is empty or missing no longer counts its own vote as peer
+  corroboration.** `""` is not a model id, but the council-tally input schema accepts it, and the
+  tally used to treat an unknown raiser as "exclude nothing" — so a document with `raiser: ""` and
+  a `judge: ""` adjudication scored that adjudication into `findings[].basis`. Measured: a finding
+  with votes `["" agree, "gpt" agree]` read `{a:2}` **Confirmed (solid)**, where the same shape
+  with a named raiser reads `{a:1}` (thin).
+  The rule is now one principle — *attribute when you can, mark only when you cannot* — applied in
+  order. **Seat ids decide first, and no longer need a known raiser:** when the adjudication *and*
+  the finding both carry a seat id, the same seat means the raiser's own vote (excluded) and
+  different seats mean a real peer (counted), whatever `raiser` and `judge` say. Only when the seats
+  cannot decide does the name matter: a named raiser excludes by alias exactly as before, and an
+  **unnamed** one keeps every **named** judge — so no real peer is dropped for want of a raiser —
+  while dropping the votes whose judge is equally unidentifiable. Both fallback arms' unattributable
+  drops — and only those — are **announced** in `findings[].unattributedPeerDrops`: a vote the seats
+  attributed is not ambiguous, so it is never counted there. The key's presence therefore means "a
+  vote could not be placed", not "the raiser was unnamed".
+  Consequences on such a document: `basis` can move and the tier with it — a finding whose only
+  votes are unidentifiable now reads `Singleton` rather than `Confirmed` or `Disputed`. On a
+  document that **names** its raisers, *this* fix changes nothing: the peer split there is
+  byte-identical to the pre-fix behaviour, measured over 300,000 randomized named-raiser findings
+  with zero differences.
+  ⚠️ **That is a claim about this fix, not about v4.7.1.** The `unattributedPeerDrops` mark below
+  landed earlier in the same release and it fires on named-raiser documents too — where the finding
+  and the vote carry a seat id on only **one** side — so a document that names its raisers can still
+  carry a key that a v4.7.1 one did not. Anything claiming such documents are unchanged *by the
+  release* is false; they are unchanged by this fix. On an ordinary bench, where no alias repeats and
+  `raiserSeat` is absent by design, that shape does not arise.
+  The same predicate builds the defense brief,
+  so the brief moved with the tally; a finding that falls off `Contested`/`Disputed` no longer
+  reaches a brief at all.
+  ⚠️ **This does not close the twin-seat case.** Where a *named* raiser's finding and an
+  adjudication carry seat ids on only **one** side, the vote is still excluded and still only
+  announced — deliberately, and unchanged by this release.
+  ⚠️ What those two track is a **possible** undercount, not an established one. Such a vote is
+  either a real twin's signal being discarded or the raiser's own being correctly excluded, and
+  nothing in the document distinguishes them — which is exactly why the drop is announced rather
+  than silently taken. Read the count as "up to N votes of peer signal may be missing here", never
+  as "N are".
+
+- **The Workspace's dead-seat rows no longer collapse, and a live seat no longer erases its dead
+  twin, on a bench that repeats an alias.** Two measured defects. Two dead twins rendered as a
+  single row (`deadSeats` dedup'd on the alias); and with one twin alive and the other genuinely
+  dead, the dead seat produced **no output anywhere in the panel** — silent data loss, which this
+  project's product principle rates as severely as a crash. Dead-seat rows, their retry badges and
+  their DOM keys are now keyed on the seat. The retry badge also lands on the seat that was
+  actually retried instead of on its live twin.
+  The producer carries the identity that makes this possible: still-dead notes now record a seat
+  id on every arm this surface reads, and — deliberately — emit `null` rather than the alias for a
+  seat the run could not identify, because "unidentified" and "the alias" are different statements and
+  collapsing them is what merged two dead seats into one row. Unique-alias benches are unchanged:
+  a seat id there equals its alias byte-for-byte.
+  ⚠️ **Disclosed residuals.** Where a degrade record does not name *which* seat died, no consumer
+  can attribute it, so on a bench that repeats an alias: two such records still collapse to one
+  row; a dead seat beside a live twin is still hidden; and a retry badge still marks every seat
+  sharing the alias. This is **not** limited to runs recorded before this release — a seat the
+  producer could not identify yields the same alias-valued key on a new run. Two further cases are
+  filed and unfixed: the **critic** path is still alias-keyed, and during a **live run** a stale
+  record naming a seat that is alive can show a dead row for it until the terminal refresh. Every
+  one of these is pinned by a test asserting the known-wrong behaviour so it cannot rot silently.
+  A seat the producer emitted `null` for — a **dead wave** it could not identify — is not among
+  them: such a row is never hidden by a live seat sharing its alias, because "unidentified" and
+  "the alias" are different statements and a degrade record means that seat stayed dead after its
+  retry. An unidentifiable **dead leg** is a different case and *is* among them: its key falls back
+  to the alias, so it collapses with another such record and is suppressed by a live twin exactly
+  as a pre-release record is.
+  ⚠️ The trade this makes, stated plainly: still-dead notes are deduplicated only where seat
+  identity is **exact** — the leg was bound to a seat, or its alias holds exactly one seat, where
+  the alias *is* the id. Where identity is unknown the seat is announced rather than assumed to be
+  a repeat, so on a bench that repeats an alias **one dead seat can be announced twice**. Two
+  earlier designs inferred the answer instead (a per-alias budget, then a roster pigeonhole) and
+  both hid a real dead seat when the inference was wrong. A duplicate a reader can see is
+  preferred to a loss they cannot.
+- **`streetCred[]` no longer drops or invents a row when a document's `meta.seats` table disagrees
+  with `meta.models` in count, and a reliability-ledger pair group with partial seat information no
+  longer reads narrower than one with none.** The **row-count** defect is unreachable on the engine
+  path — `seats.js :: buildSeats` derives `meta.seats` from the same bench array that becomes
+  `meta.models`, so the two agree by construction — and reachable only on the two hand-assembled
+  `appendRun` paths: the `amicus_council_tally` MCP tool, whose schema declares `meta.seats`
+  independently of `meta.models`, and `cli-handlers-council.js`'s `runTally`, which parses
+  user-supplied JSON with no schema at all. The **mixed-group** defect is narrower but *is*
+  engine-reachable: a chair-synthesis row carries no seat and still joins the ledger, so on a twin
+  bench where one twin also chairs and the twins resolve to different executables, that pair group
+  is mixed on an ordinary run. All of these write into `council-ledger.jsonl`, a file that is never
+  migrated.
+  `street-cred.js :: credSeats` used to expand the *first* `models` occurrence of an alias the seat
+  table named into every id registered for it at once — inventing a row when the table over-registers
+  a non-repeated alias — while skipping every *later* occurrence of that alias outright — dropping a
+  row when the table under-registers a repeated one. The k-th occurrence of alias `m` now takes the
+  k-th id the table registered for `m`; once that list is exhausted (or the table never named `m` at
+  all), the occurrence gets an alias-keyed row (`seat: null`) instead of vanishing, and a surplus
+  registered id simply goes unused instead of manufacturing an extra row.
+  `streetCred.length === meta.models.length` now holds on every document the tally produces,
+  however far the seat table disagrees with the model list.
+  `ledger-join.js :: credFor` used to resolve a pair group's street cred through the seat table the
+  moment *any* row in the group resolved that way, discarding the numbers of any other row in the
+  *same* group whose seat did not resolve — so a MIXED group (one seated row, one not) read narrower
+  than a group with NO seat information at all, which fell straight to the honest alias-mean
+  fallback. The seat lookup now wins only when *every* row in the group resolves
+  (`ids.length > 0 && ids.every(id => id && sc.has(id))`); anything short of that — one row unseated,
+  one seated to an id the table doesn't hold, or an empty group — falls through to the same
+  alias-mean fallback a fully-unseated group already used. A mixed group now reads identically to a
+  fully-unseated one.
+  ⚠️ Fixing the row-count side of this also moves `streetCred[]` row *order* on an ordinary engine
+  bench that repeats a non-adjacent alias — a real, disclosed, accepted behaviour change, not a
+  malformed-input-only one. See the street-cred entry under **Changed**, below, for the measurement.
+
+- **A debate re-vote the engine cannot attribute to a bench seat is now refused and announced,
+  instead of silently inventing a voter.** On a bench that repeats an alias, a re-vote leg that
+  matched no seat on its wave's roster fell back to keying on the bare alias — which matches none of
+  the seat-attributed adjudications already on record — so the round **appended a brand-new
+  adjudication row** rather than replacing one. Two things went wrong at once: the judge's paid
+  re-vote was discarded and its stale provisional verdict stood, *and* a phantom voter corresponding
+  to no bench position was counted beside it. Measured end to end on a twin bench, on a finding with
+  two eligible judges: **three votes**, basis `{a:2, d:1}`, tier **Confirmed**. Those counts feed
+  the tally and the verdict, so this was a correctness defect in the basis, not a rendering blemish.
+  Now such a leg's votes are **withheld** and the refusal is announced on the **`seat-unbound`**
+  channel — the same channel a Stage-1 leg that matches no seat already uses. The same fixture
+  now yields **two** adjudications, no seat-less row, basis `{a:1, d:1}`, tier **Contested**, and one
+  degrade note naming the leg and the wave.
+  ⚠️ **A refusal degrades the run, so an otherwise-clean run exits 2** — exactly as an
+  unattributable Stage-1 leg already made it. That is the announcement working, not a new failure
+  mode: nothing crashes and every artifact is still written.
+  **The leg itself is untouched.** It ran and it cost money, so it still contributes its `runStats`
+  row, its `revote-<model>.md` and its `conformance`; only the parsed votes are withheld.
+  `debate.json` gains no "refused" row, so on such a run `revoteJudges` and `revoteApplied` will
+  visibly disagree — the degrade note is what explains the difference.
+  **The refusal is surgical, not a blanket revert.** On the same wave a twin whose leg *did* bind
+  still has its re-vote applied. A bench with no repeated alias is unaffected in every case: a seat
+  id there *is* its alias, so the key still joins and the vote still lands, byte-for-byte as before.
+  ⚠️ **The refusal first shipped one case short, and that case is now closed too.** The original
+  guard also published a leg that had *bound* to a roster slot, on the reasoning that a bound leg is
+  an accounted-for leg. It is not: a leg is matched to a slot by its task id alone, with no check
+  that its model name is one the wave asked for. A re-vote leg carrying a **foreign** model name
+  could therefore land in a slot, be published under that foreign name, and invent exactly the
+  phantom voter this entry is about — the defect surviving through the guard meant to close it. On
+  the fixture that reproduces it: the finding went from two votes to **three**, the extra one
+  attributed to a model that never sat on the bench, while the seat it displaced kept its stale
+  verdict. That arm is now **deleted**: a re-vote is published only when its key names a judge the
+  wave actually launched. The one shape the arm existed to protect — a judge left unseated by an
+  earlier stage — is unaffected, because such a judge is still one the wave launched.
+  ⚠️ **The announcement's wording changed with it.** It used to say the leg "matches no seat on
+  that wave's roster" and explain the refusal as "it bound to no roster slot, and its judge alias
+  '…' names no seat there either". Both are false for exactly the case just described, since that
+  leg *did* match a slot. `what` and `why` now state the one condition — the leg's join key names
+  none of the judges that wave launched — and `effect` no longer presumes a judge the refusal
+  denies: it reads *"the re-vote was NOT applied; the provisional verdict stands"*. The channel and
+  the machine-readable field names are unchanged; a leg reporting no model name at all now reads
+  `unknown` in `judge` and `key` rather than dropping the key from the record's JSON.
+  ⚠️ **Not reachable from the production launcher today** — the wave launches only the aliases its
+  own judge list names, so every real leg comes back keyed to a judge that wave launched. This is a
+  latent-correctness fix rather than a live regression, reachable through a resumed or
+  hand-assembled run.
+  The companion change is documentation only: `applyDebate`'s docblock now states what an omitted
+  `aliasOf` projection does — it leaves the raw seat key in the alias-space `judge` field. No caller
+  in this package omits it, the package's `exports` map blocks a deep require from outside, and the
+  parameter was deliberately **not** made required.
+- **Four object-literal lookup tables on the council document path no longer resolve
+  `Object.prototype`'s own keys.** A verdict, action, or vote string of `toString`, `__proto__`,
+  `constructor`, or `valueOf` used to resolve an inherited function instead of `undefined` when read
+  as a lookup key — silently corrupting or discarding data instead of falling through the guard
+  meant to catch an unrecognized value. Fixed at the table itself (`__proto__: null`, or
+  `Object.create(null)` for the one write-site accumulator), not at each consumer, so no future
+  caller can reintroduce the hole by forgetting a guard.
+  Three of the four are reachable today. `tally.js`'s `VERDICTS`: an unknown verdict used to serialize
+  `basis["function toString() { [native code] }"] = NaN` as `null` in both `tally.json` and
+  `verdict.json` — reachable on the CLI path only, since the MCP schema's `adjudications[].verdict`
+  is `z.enum(['agree','dispute','neutral'])` and rejects the value before `tally()` ever runs.
+  `street-cred.js`'s `perJudgeRank`: a judge or seat id of `__proto__` silently lost its rank to the
+  inherited setter instead of being recorded as an own key — reachable on **both** the CLI and MCP
+  paths, since neither `judge` nor `seat` there carries any value constraint. `report.js`'s `SYMBOL` (the vote
+  glyph read by all three matrix renderers) is reachable on **both** paths too — the CLI path
+  (`council report`/`council verdict --render`, raw `JSON.parse`) and a second, independent MCP
+  tool, `amicus_verdict`, whose `record: z.record(z.any())` input is wholly unvalidated because that
+  tool never calls `tally()` and so never meets the `z.enum` guarding `VERDICTS`. With `render: true`,
+  `amicus_verdict` feeds that record straight into `buildReport()`, so an adjudication `verdict` of
+  `toString` used to render the literal `function toString() { [native code] }` into `report.html`.
+  Only one of the four closes a latent hole rather than a live one. `debate.js`'s `PAST_TENSE`
+  guards an `action` key that a separate, pre-existing allowlist (`parse-stage2.js`'s
+  `parseDebateDefense`) already normalizes to the literal `'no-response'` before this table is ever
+  consulted by a real defense response — the two guards are independent and each is individually
+  sufficient, confirmed by two tests that go red only when both guards are removed at once. This
+  closes a hole behind an allowlist that already covers it, not a bug a real run could hit today.
+  ⚠️ **Not a rendering fix.** `report.js`'s three renderers already disagreed on how they display any
+  unrecognized verdict, `Object.prototype` key or not — `report-md.js` and `report-html.js` both
+  print the literal string `undefined`, and the Workspace's `matrix-model.js` prints `?`. That
+  disagreement pre-dates this change and is unchanged by it; reconciling the three is a
+  rendering-contract decision, filed separately.
+- **The second-opinion skill's own documentation defined the wrong tier for a lone corroborating
+  peer, which could make Claude mis-present a finding while running the skill.** `tally.js ::
+  assignTier` returns **Confirmed** (`confidence: thin`) for a finding with one peer agreement and
+  no disputes (`a=1, d=0`) — verified by execution across ten boundary `(a,d)` pairs, not read off
+  the source. `skills/second-opinion/SKILL.md` stated the opposite in two places: its formal
+  Singleton definition (`d = 0` and `a < 2`) and a separate prose paraphrase ("at most one
+  endorsement, no pushback") both classified that same cell as Singleton instead of Confirmed.
+  `skills/second-opinion/COUNCIL-DESIGN.md`'s cascade table carried the same error in its Singleton
+  row and, found while fixing it, its Confirmed row was independently incomplete — it never listed
+  the `a=1, d=0` case at all, so the Singleton row's `else` swept that cell up, which is exactly how
+  it landed in the wrong tier. Both files now put the lone corroborating peer in Confirmed and
+  reserve Singleton for `a = 0` and `d = 0`, matching `assignTier` and `docs/council.md`'s cascade
+  table, which was already correct and is unchanged. ⚠️ **The formal definitions are fixed; the
+  Stage-4 presentation headings are not.** Both files still gloss the consensus tier as "(≥ 2 peer
+  agreements, agrees dominate)" at the heading that drives how Claude presents findings, which omits
+  the lone-peer case — filed separately, not closed here.
+- **A headless leg with no output, reasoning, or tool calls could be killed by the no-output
+  backstop before a normal-speed model finished its first turn.** The default window was 120
+  seconds; CI carried a `300000` override because the default was too low, which is itself evidence
+  the default was wrong rather than merely conservative. `DEFAULT_NO_OUTPUT_BACKSTOP_MS` is now
+  `300000`, and the now-redundant CI override plus its explanatory comment are deleted from
+  `council-review.yml`. The owner's separate `900000` override, held locally, is untouched — no such
+  setting exists anywhere in the tracked tree.
+  ⚠️ **The retry path doubles this window**, so a Stage-1 retry now waits up to 600 s (was 240 s)
+  before its own backstop fires, clamped to the leg timeout. `docs/configuration.md`,
+  `docs/troubleshooting.md`, `docs/usage.md` and `src/sidecar/models-probe.js`'s docblocks were
+  corrected in the same change, as were the tests that asserted the old numbers.
+  ⚠️ **The 600 s worst case is a deliberate trade, not an oversight**, and it is arithmetic:
+  `min(2 × 300000, 900000) = 600000`, so the 15-minute leg-timeout clamp does **not** bind and the
+  failure CLASS stays `NO_OUTPUT_BACKSTOP` rather than degrading into an ordinary timeout.
+  Worst-case silent-leg latency on a retry is therefore 10 minutes. That is the price of
+  accommodating models that legitimately take minutes to first token; the alternative is killing
+  slow-but-healthy legs.
+- **The live-probe docs no longer claim a fired backstop proves the endpoint accepted the
+  request.** A `NO_OUTPUT_BACKSTOP` shows only that no output, reasoning or tool call arrived in
+  the window — a stalled gateway or a dropped connection fires it just as readily.
+  `accepted-but-silent` is the classification's NAME, not a fact about the endpoint. Corrected in
+  `docs/usage.md` **and** in `src/sidecar/models-probe.js`'s docblock, which stated the same thing.
+  ⚠️ Pre-existing wording in both places; this release did not introduce it.
+- **Findings in the reliability ledger are now attributed to the seat that actually raised them,
+  instead of being concentrated onto one row per alias.** On a twin bench whose two seats resolve
+  to different executables, the ledger used to hand *every* finding raised by that alias to the
+  first of its two rows, leaving the second reading zero raised findings and a null confirm rate
+  regardless of what that seat actually did. Each finding is now credited to the pair group whose
+  own reliability data carries the seat that raised it; a finding that cannot be resolved to a
+  specific seat (no seat information at all, or a seat that matches no group's own data) still
+  concentrates on the first row, exactly as before. The row set itself is unchanged — a run that
+  never repeats a model alias is byte-identical.
+- **`findings[].location` and `findings[].claim` submitted through the `amicus_council_tally` MCP
+  tool now survive into `tally.json`.** The tool's findings schema silently stripped a
+  hand-assembled finding's `location` before tally ever ran it; separately, tally's own output
+  step was dropping both `location` and `claim` regardless of what validation let through, on the
+  command-line path too. Both are fixed together. ⚠️ This closes the gap as far as `tally.json` —
+  neither field is forwarded further, into `verdict.json`; that remains a separate, filed,
+  undecided change.
+- **A headless leg's run document now carries its real OpenCode session id instead of always
+  `null`.** The field was already promised by the run schema and already set on the interactive
+  path, but the headless path never assigned it, so every headless leg — the common case — carried
+  a null session id no matter how the leg actually went. It is now set on both normal outcomes and,
+  measured rather than assumed, on the exception path too, including the specific case where no
+  session was ever created. A leg's on-disk record now carries the id the same way it already
+  carries its status and usage figures, so a session-less leg's record is unaffected. Piece 1 of a
+  larger, multi-piece fix — reading and resolving session ids from provider logs is separate,
+  future work.
+
+- **The chair packet now names seats on a bench that repeats a model alias, so the chair can
+  finally tell two same-model reviewers apart.** `chair-packet.md` is the one artifact a paid chair
+  reads as authoritative, and every identity its three review/ranking/adjudication blocks wrote was
+  alias-space — the review header printing the leg's reported model input, which can be a resolved
+  id. On a bench running the same model twice, that made the packet internally unreconcilable: the
+  chair was handed a deterministic tier count of one `Confirmed` — a count that only makes sense if
+  two different reviewers agreed — beside two adjudication lines both reading `deepseek:`, with
+  nothing anywhere in the document able to say which was which. The report's adjudication matrix and
+  the Workspace's had already moved to seat identity, so the human-facing artifact and the
+  model-facing one disagreed.
+  All three identity-bearing blocks now resolve the seat: the **review headers**
+  (`--- Review by deepseek#2 ---`), the **peer-rankings** block — both the judge it is keyed by and
+  the ranked names inside it — and the **adjudication** lines. The ranked names are matched
+  position by position, so a tie stays a tie and any name the run could not resolve to a seat keeps
+  its alias rather than turning into a blank.
+  ⚠️ **On every bench that does not repeat an alias the packet is byte-identical** — by
+  construction, because the seat is absent wherever it would equal the alias, and pinned by a
+  whole-string equality test on a unique-alias bench. The review header needed more care: the
+  name it prints is the model input a leg reported, which can be the fully resolved model id even
+  when nothing about the bench is ambiguous, so the seat is deliberately **withheld** there unless
+  it actually differs — rather than assumed to be identical. A `claude` review block still reads
+  `--- Review by claude ---`: Claude's review carries no seat and is deliberately left alone.
+  This changes what the chair reads, which can change what it concludes, on twin benches only.
+
+### Changed
+
+- **A `--council` preset member with stray whitespace now runs instead of being silently dropped.**
+  `classifyCouncilMembers` (`src/utils/config.js`) trims each preset member **before** it is looked
+  up. The two spellings hit **different** gates: a padded **alias** (`"gpt "`) now reaches the alias
+  table clean, and a padded **full id** (`"openai/gpt-5 "`) now reaches the **model-catalog** lookup
+  clean — a full id short-circuits on `member.includes('/')` and never touches the alias table at
+  all. `--models` already
+  trimmed on both of its spellings (`sidecar/fanout-validate.js :: parseModelsList`,
+  `cli-council-run-bench.js :: parseList`), so the same stray space was benign on one flag and fatal
+  on the other: on `--council` it turned a typo into a dropped member and a **degraded exit (2)** —
+  `run.js`'s `dropped-members` note says so verbatim (*"the bench is smaller than the preset
+  requested; the run will exit degraded (2)"*).
+  ⚠️ **Which presets does this actually affect? Only hand-edited ones — stated plainly rather
+  than left to be discovered.** `amicus council save` already trimmed on the way IN
+  (`council/presets-cli.js:34`), and the only other writer of `councils` in the config (the seeded
+  `free` council) builds its members from alias keys, which cannot carry padding. So a
+  whitespace-padded member reaches `config.json` only if you edited that file by hand — which is
+  exactly the case that used to fail, silently and fatally, while the same typo on `--models` was
+  harmless.
+  ⚠️ **The dominant effect is RESURRECTION, not de-duplication: a member that is dropped today
+  starts RUNNING, which is a new paid leg.** Measured over the six shapes a padded member can take
+  (the configured `members` × whether the model-catalog cache is populated). **All six change:**
+
+  | `members` | catalog | BEFORE | AFTER |
+  |---|---|---|---|
+  | `['openai/gpt-5 ', 'openai/gpt-5']` | present | `["openai/gpt-5"]`, 1 dropped | `["openai/gpt-5","openai/gpt-5"]` |
+  | `['openai/gpt-5 ', 'openai/gpt-5']` | empty | `["openai/gpt-5 ","openai/gpt-5"]` | `["openai/gpt-5","openai/gpt-5"]` |
+  | `['openai/gpt-5 ']` | present | **`[]` — nothing runs** | `["openai/gpt-5"]` |
+  | `['openai/gpt-5 ']` | empty | `["openai/gpt-5 "]` | `["openai/gpt-5"]` |
+  | `['gpt ']` | empty | **`[]` — nothing runs** | `["gpt"]` |
+  | `['gpt ', 'gpt']` | empty | `["gpt"]`, 1 dropped | `["gpt","gpt"]` |
+
+  Counting the LENGTH of the resulting bench: **four of the six gain a leg that was not launched
+  before** (rows 1, 3, 5, 6), and **two of those four go from an empty bench to a running one**
+  (rows 3 and 5). Rows 2 and 4 keep their leg count and change the string that is launched. Only
+  row 2 is the twin-merge this was originally filed as.
+  ⚠️ **Knock-on — a padded preset becomes a REAL twin bench**, so `seats.js :: buildSeats` mints
+  `alias#N` and every seat-keyed behaviour in this release switches on for it. Proved from the
+  artifacts rather than from `buildSeats`: `meta.seats` is `['gemini#1','gemini#2']`, the run writes
+  `review-gemini-1.md`/`review-gemini-2.md` and `judge-gemini-1.md`/`judge-gemini-2.md`, and
+  `review-gemini.md` is **absent** — against a control with the same padding and no collision, which
+  emits no `seats` key at all. **Artifact filenames change**, which matters to anything scripted
+  against them.
+  - `models` carries the **trimmed** value; `dropped` and `droppedMembers` keep the member **raw**,
+    byte-for-byte as configured, so the offending string is still findable in your own config.
+  - An all-whitespace member trims to `''`, which no alias names, so it is dropped exactly as before
+    — measured identical either side of the change.
+  - **Street-cred rows in `council report`'s output are now labelled `seat || model`**, in both
+    renderers (`report-md.js :: renderMd`, `report-html.js :: renderHtml`). On a twin bench the two
+    rows read `gemini#1` / `gemini#2` instead of `gemini` twice with different numbers under one
+    identical name — which is what a padded preset now produces. A bench with no repeated alias is
+    byte-identical. ⚠️ **The Council Workspace's street-cred table still labels
+    from the model alias**, so on a twin bench the report and the Workspace now disagree there —
+    filed, not fixed; recorded in `docs/council.md`.
+
+- **The reliability ledger now records one row per (model, resolved executable) pair, not one per
+  bench slot.** Previously the row-building join was keyed by council alias and last-wins, so any
+  bench where one executable served more than one seat wrote something untrue into an append-only
+  file that is never migrated. Fixed: an alias whose seats resolved to *different* executables now
+  records both, instead of recording the last one twice and erasing the other; a mixed live/dead
+  twin keeps the live leg's `resolvedModel` and `conformance` instead of inheriting the dead seat's;
+  a twin whose seats shared one executable writes **one** row instead of two byte-identical ones;
+  and a run's `findingsRaised` finally sums correctly across its rows. A chair that is also a bench
+  seat writes one row when its chair leg and seat leg resolved to the same executable, and **two**
+  when they resolved to different ones — where previously the chair leg's resolution overwrote the
+  seat leg's. Row for row and in order, the ledger is unchanged only for benches whose aliases are
+  **distinct** *and* where **no alias contributed more than one joinable `runStats` row** — both
+  clauses are load-bearing, and a chair-on-bench run fails the second one even when it passes the
+  first (see the merged-row entry below).
+- **`runs` in `amicus council stats` counts distinct council runs, not ledger rows.** One run on
+  `--models a,a` reported `runs: 2`; so did `--models gpt-5,openai/gpt-5` when both resolved to the
+  same executable. `runs` (and the `low-N` flag that follows it) now counts distinct `meta.runId`
+  values, retroactively for pre-existing history. Two consequences worth knowing: re-running
+  `amicus council tally input.json` without `--no-ledger` no longer double-counts `runs`, because a
+  re-tally of the same input carries the same `meta.runId` (it still appends a duplicate set of
+  rows, which **doubles the conformance histogram** — a tally, not an average. It does *not* move
+  the lifetime averages: a duplicated set of rows has the same mean as the original, measured
+  `avgStreetCredPeersOnly: 1.5` before and after a second append), and a harness that writes a
+  **constant** `runId` across genuinely different runs will pin that group at `runs: 1` forever. An
+  empty-string or numeric `runId` is not treated as an identity — each such row counts individually.
+- **⚠️ The ledger-promoted fallback chair can change on existing history.** When the requested chair
+  fails twice, `amicus council run` promotes the best-street-cred non-bench model from the ledger.
+  Correcting the ledger's model of history re-ranks it, so on a ledger that already contains any
+  bench where one executable served more than one seat, the promoted chair can differ from what the
+  same history would have promoted before. Two independent randomised sweeps put this in the low
+  tens of percent of such ledgers, but neither harness ships here, so treat the shape — not a rate —
+  as the claim. Three causes, each with a deterministic case pinned in `tests/council/ledger.test.js`:
+  the join fix moving which group wins, the emission-order change moving which alias is launched
+  (the `gpt-5, openai/gpt-5, gpt-5` bench flips the launched name from the alias to the raw
+  executable id if the anchor is wrong), and the `runs` change. The old values were derived from
+  erased and double-counted rows; the new ones are not "wrong differently", but they are different. Related: `avgStreetCredPeersOnly`, `lifetimeConfirmRate`
+  and `lifetimeFactErrorRate` move too — each is a mean over a group's rows, and dropping a
+  duplicate row moves a mean whenever the group's remaining rows disagree (on
+  `--models gpt-5,openai/gpt-5,gpt-5` all resolving to one executable, `avgStreetCredPeersOnly`
+  goes 1.333 → 1.5). The conformance histogram moves for the same reason, but it is a **tally**,
+  not an average — nothing divides it; it simply counts one row fewer.
+- **⚠️ The fallback chair can also go from promoted to absent** — rarer than the re-ranking above,
+  and pinned as a shape rather than a rate. Chair promotion excludes any aggregate whose key or
+  aliases appear on the bench; now that an executable legitimately carries every alias that really resolved to it, a bench
+  containing one of those aliases excludes the whole group. That is the exclusion working correctly
+  on newly-accurate data, but the visible outcome is a run that gives up on the chair, writes
+  `overallVerdict: null` and exits 2 where it previously synthesised a verdict.
+- **Merged rows report the worst conformance and any chair flag.** When one executable served
+  several of a bench's seats, the resulting single row records the **worst** `conformance` of them
+  (a seat that came back `unstructured` is no longer recorded as `clean`) and `wasChair: true` if
+  **any** of them chaired. `role` still takes the last contributing row's value, scoped to that same
+  (model, executable) pair. ⚠️ This is reachable
+  from plain `amicus council tally` input, not only the engine: the documented shape puts the chair
+  on the bench, so a hand-assembled record that also carries a `role: 'chair'` row hits it — a chair
+  whose seat row was `unstructured` now reads `unstructured`
+  where it previously read the chair leg's `clean`. Conversely, on an alias whose seats resolved
+  *differently*, `wasChair` no longer propagates to the seat row that did not chair.
+  **Later in the same release, both `role` and `conformance` stopped counting a chair-synthesis leg
+  at all, while the pair also holds a bench leg** — a chair leg is a different contract from a bench
+  review (prose plus a verdict line, not findings JSON), so a seat's recorded role and conformance no
+  longer depend on whether that model also happened to chair. `wasChair` is untouched: still
+  any-wins over the pair's whole row set, chair leg included. Consequence, disclosed rather than
+  repaired: the worked example above still holds in the direction shown (bench `unstructured` + chair
+  `clean` → `unstructured`), but its reverse no longer does — bench `clean` + chair `unstructured`
+  now reads `clean`, so a broken chair synthesis by a model that also sits on the bench can vanish
+  from `amicus council stats`'s lifetime conformance histogram; only `wasChair: true` still shows
+  that it chaired. A pair of chair legs only, with no bench leg to prefer, is unaffected.
+- **A mixed live/dead twin now shows an extra permanent line in `amicus council stats`** — the
+  executable-keyed group plus a `legacy` alias-keyed one for the leg-less seat, where there was
+  previously one line. The legacy line accrues `runs`, clears `low-N` at three runs, and carries
+  zero findings. Its street cred is no longer borrowed from its live twin: street cred is seat-keyed
+  now (see below), and a seat that never ran a leg never appears in any judge's ranking, so its own
+  seat-keyed row resolves both numbers to `null` instead of adopting its live twin's — so the legacy
+  line can no longer outrank the executable it routes to for the fallback chair (that promotion
+  excludes any group whose average street cred is not a number).
+- **Council seats are validated before any paid leg.** `amicus council run` now refuses to start
+  when `--critic` names a model that is not on the bench, when `--critic <alias>` is ambiguous
+  because that alias occupies more than one bench seat (remove the duplicate entry, or use two
+  distinct aliases), or when two bench entries would write the same `review-<name>.md` **because one
+  of them is a disambiguated `alias#N` seat** (e.g. `--models deepseek,deepseek,deepseek-2`). A
+  collision between two distinct aliases that merely sanitize alike (`vendor/a` vs `vendor?a`) still
+  starts, still runs, and is surfaced by the run-integrity banner instead. The off-bench critic was
+  already rejected by the CLI and MCP handlers; the engine now guards it too, closing the gap for
+  in-process `require()` callers of `runCouncil`, where it previously launched a leg the run's own
+  model roster never mentioned. Bench **shape** is unaffected for benches whose aliases are distinct
+  and contain no `#`; the critic guards apply to any bench.
+- **`--critic` together with `--lenses` is now refused before any paid leg.** The same pre-spend
+  seat validation now rejects passing both flags at once, closing the same in-process-caller gap:
+  both the CLI and MCP handlers already rejected this pair, so callers going through either see no
+  change. Only a direct in-process `require()` call passing both flags is newly refused.
+- **`--lenses` now assigns lenses by seat, not by first-matching alias.** Under `--lenses`, a bench
+  that repeats an alias now gives each seat its own lens: `--models a,a --lenses risk,cost`
+  previously gave both seats `lens:risk`, because the role lookup resolved a seat by
+  `o.models.indexOf(alias)`, which always returns the first twin's index. It now resolves by seat
+  position, so the second twin correctly gets `lens:cost`. Benches with no repeated alias are
+  unaffected.
+- **A seat whose leg never came back is no longer silent.** Previously a partial wave return —
+  some legs launched, one seat's result never arrived — dropped that seat with no note, no row,
+  and exit 0. It is now retried once, like any other Stage-1 loss (costing one extra retry leg),
+  and — only if the retry does not recover it — announced on the new `seat-unbound` degrade
+  channel, so the run now exits 2 instead of silently reporting success.
+- **A bench that repeats an alias now retries and files both dead seats, not one.** Where two
+  seats sharing an alias both die, the run now produces two retry legs, two heals, and two review
+  files instead of collapsing to a single retry and a single clobbered file. Reviews are written
+  per seat as `review-<seat>.md` (e.g. `review-deepseek-1.md` / `review-deepseek-2.md`).
+- **Cross-review and the debate round are now bound to seats too — and a bench that repeats an
+  alias pays for more legs because of it.** Stage-2 judging writes `judge-<seat>.md`, and a
+  `--debate` round writes `rebuttal-<seat>.md` and `revote-<seat>.md`, so two seats sharing an
+  alias no longer overwrite each other's file. The extra cost is **up to two** billed legs per
+  duplicated pair per debate round, and the increase has two independent halves: the defense wave
+  now launches one solo per raising **seat** where it previously launched one per raising alias,
+  and the re-vote wave launches one leg per disputing **seat** where it previously launched one
+  per disputing alias. Either extra leg can draw its own bounded repair solo, so the worst case is
+  four. `run.json`'s `debate` summary counts the re-vote half (`revoteJudges` rises accordingly)
+  and has **no counter for the defense half**, so read this entry rather than that object when
+  estimating what a duplicate bench costs. A bench whose aliases are all distinct launches exactly
+  the legs it did before and writes exactly the filenames it did before.
+  ⚠️ **That "up to four" bound is superseded later in this release, and it is now a floor rather
+  than a ceiling.** It was computed against a debate round that *already existed* and merely gained
+  legs. The seat-aware peer filter below moves findings into and out of `Contested`/`Disputed`,
+  which is exactly what `nothingToDebate` counts — so on a bench that repeats an alias the debate
+  round can now **come into existence on a run that previously skipped it entirely**, taking a run
+  from **zero** billed debate legs to two-to-four. See "the seat-aware peer filter changes what is
+  paid for" below for the measured shape and the exit-code consequence. Benches with no repeated
+  alias are still unaffected.
+- **A duplicated seat's re-vote is no longer silently dropped.** Two defects, both live before
+  this release, combined to lose it: the disputing-judge list de-duplicated by alias, so two seats
+  that both disputed a finding got **one** re-vote leg between them; and that re-vote was then
+  matched to an adjudication by alias, so it replaced whichever of the two rows came first and
+  left the other standing. Disputing seats are now de-duplicated by seat, and the replacement
+  joins on the seat, so each seat re-votes for itself and each seat's own verdict is the one
+  replaced.
+- **A judge's Stage-2 conformance no longer overwrites its twin's.** The merge of each judge's
+  conformance back onto its reviewing seat was keyed on the alias, so a bench that repeats one
+  collapsed both seats onto a single entry and the last judge's conformance won for both. The
+  merge is now seat-keyed, falling back to the alias for a judge leg that bound to no seat.
+- **A re-vote repair for a model whose alias contains `/` no longer nests its session directory
+  three levels deep.** The repair leg's wave id embedded the alias verbatim, so
+  `openrouter/deepseek/deepseek-chat` produced
+  `.claude/amicus_sessions/<runId>-rv-openrouter/deepseek/deepseek-chatr` instead of one directory.
+  The id is now filename-sanitized. This one was never about duplicate benches — it fired for any
+  alias containing a path separator whose re-vote needed a repair.
+- **A Stage-2 wave that loses or cannot attribute a judge leg now exits 2 instead of 0.** Stage 2
+  binds its judge legs to seats. A returned leg matching no roster slot is announced on the
+  `seat-unbound` degrade channel; so is each seat that a short-returning wave never accounted for
+  — but only when that wave returned at least one leg *and* produced no unattributable one, because
+  an orphan already names the same failure, and a wave that returned nothing at all is announced
+  on the louder `thin-cross-review` channel instead. Whichever branch fires, the run now exits
+  degraded (2) where it previously exited 0 as long as at least two judges still parsed.
+  Symmetric with the Stage-1 change above.
+- **`debate.json` changes key space on a bench that repeats an alias — and only there.**
+  `findings[].raiser` is now the raising **seat's** id, and each `revotes[]` row keeps its
+  alias-valued `judge` and gains a `seat` field only when the two differ. The chair addendum's
+  `priorVerdicts` and `revotes` maps are keyed seat-side to match, so they still agree line for
+  line. `tally-input.json` and `tally.json` gain `meta.seats` (the run's seat table, `{id, alias,
+  role, lens, position}` per bench seat), `adjudications[].seat`, `findings[].raiserSeat` and
+  `runStats[].seat` — each emitted only when the seat id differs from the alias — plus
+  `findings[].sameModelCorroboration`, emitted only when it is true, which likewise requires a
+  repeated alias. On a `--debate` run `tally-provisional.json` carries `meta.seats` too.
+  `verdict.json` gains the matching set: a top-level `seats` table beside `seatLoss`, plus
+  `findings[].raiserSeat` and `findings[].sameModelCorroboration` (`adjudications[].seat` and
+  `runStats[].seat` arrive without a verdict-side change — both arrays are carried through by
+  reference). A reader holding **just the verdict** can now tell which of two same-alias seats
+  raised a finding, and can resolve every `alias#N` id in the document against its own seat
+  table. On a bench with no repeated alias every seat id **is** its alias, so none of
+  these documents changes shape at all there — with one narrow exception, of *value* rather than
+  shape: the re-vote **repair** leg's wave id is now filename-sanitized (the `/`-nesting fix
+  above), so a unique-alias bench whose alias contains a character sanitization rewrites *and*
+  whose re-vote actually needed a repair records a different id for that one leg in `run.json`'s
+  `stages[].waveIds` and in the matching `runStats` row of `tally-input.json`, `tally.json` **and
+  `verdict.json`** — the verdict carries the tally's `runStats` array through by reference, so it
+  shows the changed id too. No other leg, and no bench whose aliases are already filename-safe, is
+  affected.
+- **Known limitation: a partial-return seat loss is recorded in `run.json` but not yet reflected
+  in `verdict.json`.** The loss lands in `stage.deadWaves` (as a `partial` entry) and in
+  `degrades[]` (on the new `seat-unbound` channel above), and the run exits 2 — but
+  `verdict.json`'s `seatLoss.deadBenchSeats` does not name the seat, because `verdict.js`'s
+  `deriveSeatLoss` filters `degrades[]` down to the `dead-wave`/`dead-leg` channels only, and a
+  `seat-unbound` loss matches neither. The seat is not silently dropped from the run's own
+  record, only from the summary readers usually check first. **Still open at the end of this
+  release.** The seat work later in this stack gave `verdict.json` a seat *table* and seat-stamped
+  findings and `runStats` rows, but it did not touch `deriveSeatLoss`'s channel filter, so
+  `seatLoss.deadBenchSeats` still does not name a `seat-unbound` loss. Closing it is filed, not
+  scheduled here.
+- **The Council Workspace now opens per-seat artifacts on a bench that repeats an alias.** The
+  allowlist is built from `run.seats` rather than a de-duplicated bench, so
+  `--models deepseek,deepseek,gemini` lists `review-deepseek-1.md` / `-2.md`, the matching `judge-`
+  files, and — on a `--debate` run — the `rebuttal-`/`revote-` pair, instead of a
+  `review-deepseek.md` that bench never writes. Previously neither twin file was reachable, in every
+  artifact family the run wrote.
+  ⚠️ **Two distinct aliases that sanitize to the same name are still one physical file.** On
+  `--models "vendor/a,vendor?a,vendor/a"` the allowlist attributes `review-vendor-a.md` to the
+  sorted-first alias while the file may physically hold the other's review — a misattribution rather
+  than a refusal, and the run-integrity banner says so.
+  A file an *orphaned* leg wrote under its alias stays readable but is attributed to no seat:
+  `run.json` cannot say which seat produced it, and guessing is the silent mis-attribution the
+  seat spine exists to prevent. Where such a name collides with another seat's own artifact, the
+  run-integrity banner says so — and only the artifact *kinds* that orphan could actually have
+  written lose their attribution. A leg that orphaned in the cross-review wave costs the colliding
+  seat its `judge-` file and not its `review-`, because that leg's own review landed under a seat
+  name; a leg that orphaned in Stage 1 costs it both, because a Stage-1 orphan is re-admitted to
+  the cross-review under a placeholder and writes an alias-named judge file too. The list of
+  readable names is not narrowed either way: a name is dropped from *attribution*, never from the
+  allowlist. Benches whose aliases are all distinct are byte-for-byte unaffected — every name they
+  write is on the list, and the list is unchanged.
+- **The Council Workspace's seats panel now shows one live row per seat on a bench that repeats
+  an alias, instead of one usable row beside a frozen ghost.** The terminal seat rows were keyed
+  on `alias:role`, so two seats of one alias collided. The panel rendered both rows on its first
+  repaint and then **froze the first one permanently**: every later repaint resolved the shared
+  key to the *last* row, so both seats wrote into it while the first was never matched again and
+  never removed. What you saw was a stale row that stopped at its first-tick values, beside a row
+  flickering between two seats' data — with no error, no banner, and no indication either was
+  wrong. Rows are now keyed on the seat, which the tally already recorded and which the run
+  detail already carried. Benches whose aliases are all distinct render identically: the seat is
+  only recorded when it differs from the alias, so every row resolves to the same seat it did
+  before. (The row's internal DOM key changed encoding in the same change; nothing user-visible
+  reads it.)
+- **The "↻ retried once" badge now marks the seat that was actually retried, not every seat
+  sharing its alias — where the run records enough to tell them apart.** ⚠️ **It cannot always
+  tell.** Every dead arm now records a seat id where the run could bind one: a leg-origin retry
+  carries `firstFailure.seatId`, a retry wave that died wholesale carries its own `seatId`, and a
+  wave-origin loss carries a `seats[]` array index-parallel with `models[]`. What is still
+  alias-only is a slot the producer could not identify at all, plus the two arms that route to the
+  `seat-unbound` channel, which this surface has never read. **When only an alias is recorded,
+  every seat sharing that alias is badged.** That is deliberate: the record does not say which seat failed, so nothing downstream
+  can attribute it, and a badge one seat too wide is visible and self-correcting where a missing
+  badge would be silent. Marking the seat exactly would need the producer to stamp the seat id on
+  every channel — a change with its own blast radius, filed rather than smuggled in here.
+- **⚠️ The peers-only filter now excludes the raiser by SEAT, so findings on a bench that repeats
+  an alias change tier — in BOTH directions.** Before this release the filter compared council
+  aliases, so on `--models deepseek,deepseek,gpt` the *second* deepseek seat's vote was discarded
+  along with the raiser's own: a finding with one genuine corroborating peer reported as the
+  no-signal tier. The filter now compares seat ids when a vote and its finding both carry one, and
+  falls back to comparing aliases when either does not — or, when the finding names no raiser at
+  all, to keeping every **named** judge (see the raiser-less fix under **Fixed**). This is a
+  behaviour change by design, and
+  it is not a one-way improvement — measured on `['deepseek','deepseek','gpt']`, a finding raised
+  by `deepseek#1`:
+
+  | scenario | before | after |
+  |---|---|---|
+  | twin agrees, gpt agrees | `a1/d0` Confirmed (thin) | `a2/d0` Confirmed (**solid**) |
+  | twin agrees, gpt silent | `a0/d0` **Singleton** (thin) | `a1/d0` **Confirmed** (thin) |
+  | twin agrees, gpt disputes | `a0/d1` Contested (thin) | `a1/d1` Contested (**solid**) |
+  | twin votes neutral, gpt silent | `a0/d0/n0` Singleton | `a0/d0/`**`n1`** Singleton (tier unchanged) |
+  | twin **disputes**, gpt agrees | `a1/d0` **Confirmed** (thin) | `a1/d1` **Contested** (solid) |
+  | twin **disputes**, gpt disputes | `a0/d1` **Contested** (thin) | `a0/d2` **Disputed** (solid) |
+
+  The ceiling case is `--models deepseek,deepseek,deepseek`, where every seat shares one alias: the
+  whole cross-review used to be discarded — every finding `Singleton`, `{a:0,d:0,n:0}`, `thin`,
+  ledger `confirmRate` **0** — and now reads `Confirmed`, `solid`, ledger `confirmRate` **1**.
+  ⚠️ **The demotions have a permanent cost.** `Disputed` is the numerator of the ledger's
+  `factErrorRate`, which feeds `lifetimeFactErrorRate` in `amicus council stats`; the ledger is
+  append-only and is never migrated, so a twin's dispute that newly demotes a finding writes a
+  reliability penalty that stays. Benches whose aliases are all distinct are **unaffected** — every
+  seat id there is its own alias, so the seat compare and the alias compare give the same answer.
+  One deliberate non-fix, disclosed rather than hidden: on hand-assembled input where a vote's
+  alias differs from the raiser's but its *seat id* equals the raiser's seat, the vote used to
+  count as a peer and no longer does. The engine cannot produce that shape (a seat's id always
+  belongs to its own alias), so only hand-written tally input can hit it.
+- **⚠️ The seat-aware peer filter changes what is paid for, and can flip a run's exit code with no
+  legs launched.** The debate round runs when there is anything `Contested` or `Disputed`, and the
+  filter moves findings **into and out of** that set. On a bench that repeats an alias a run can
+  therefore now launch a debate round it previously skipped entirely — a defense solo per raising
+  seat, a re-vote leg per disputing seat, and up to two bounded repairs, so **2–4 billed legs on a
+  run that previously paid nothing**. It can also move findings *out* and skip a round the previous
+  release ran. And on a run whose `--max-cost` ceiling is already spent, having something worth
+  debating is itself the trigger for the `debate-degraded` channel: the run writes a `degrades[]`
+  entry into `verdict.json` and a "What was lost" line into the report and **exits 2 where it
+  previously exited 0 silently** — without launching anything. Distinct-alias benches are
+  unaffected.
+- **⚠️ The GitHub Action promotes twin-corroborated findings to inline PR annotations.**
+  `council-review.yml` selects `tier == "Confirmed"` for its check-run annotations and for the
+  top-level `### Confirmed findings` section of the PR comment, while `Singleton` findings stay
+  inside a collapsed `<details>`. A finding corroborated only by its own twin now clears that bar,
+  so it moves from the collapsed list to a top-level section **plus an inline annotation on the
+  diff** — the most externally visible surface amicus has. The job's pass/fail gate is
+  `fail_on`/`overallVerdict` and it already tolerates exit 2, so the degrade above does not by
+  itself fail the check.
+- **New `findings[].sameModelCorroboration` flag on `tally.json` and `verdict.json` — and it is
+  wrong in two directions.** Emitted (`true` only, never `false`) when, after the seat-aware
+  exclusion, at least one *agreeing* peer shares the raiser's alias: the corroboration is real but
+  came from another seat of the same model, so it is not independent. ⚠️ The comparison is on the
+  **alias**, so it **misses** `--models gpt-5,openai/gpt-5` — genuinely one model under two aliases,
+  which votes carry no resolved-executable id to detect — and it **fires falsely on a split
+  alias**, one alias whose two seats happened to resolve to different executables. That second case
+  is exactly the bench the reliability-ledger fix at the top of this section was rewritten for, and
+  it is the more harmful direction: it tells a reader to discount a genuinely independent
+  cross-executable corroboration. The two documents of a single run therefore use **different
+  notions of "the same model"** — the ledger keys on `(alias, resolved executable)`, this stamp on
+  the alias alone. That is stated here rather than papered over; treat the stamp as "worth a second
+  look", never as proof.
+- **The adjudication matrix is keyed by seat — which fixes a silent data loss.** In `council report`
+  (Markdown and HTML) and in the Council Workspace, a bench that repeats an alias now gets one
+  column per **seat**, titled `deepseek#1` / `deepseek#2`, the Raiser cell names the raising seat,
+  and the `*` marks that seat's column only. The old alias key was **last-wins**: the second seat's
+  vote overwrote the first's, so a finding whose `basis` was `a0/d1` could render as two
+  agreements, both starred — a real dispute erased from the artifact. The rendered row and the
+  finding's `basis` now agree. **Unique-alias benches are byte-identical**: without a `seats` table
+  (or with a malformed one) the **matrix** falls back to alias space whole. That is a statement
+  about this change only — the `UNATTRIBUTED` column below moves some alias-space documents on its
+  own terms. ⚠️ **That fence is the matrix's, not the whole document's, and
+  "assembled by hand" is where it stops holding.** The street-cred table labels each row from
+  `streetCred[].seat` when the row carries one — a predicate independent of `seats` — so a verdict
+  carrying seated `streetCred[]` rows beside an absent *or* malformed `seats` renders
+  `deepseek#1`/`deepseek#2` there while the matrix still reads `deepseek` twice. Measured on three
+  shapes (absent, non-array, array-of-strings), not reasoned from the code. In-process the two
+  fields are produced from the same twin bench and travel together; the split is reachable on a
+  hand-assembled or externally-supplied record, which `verdict.js :: buildVerdict`'s own docblock
+  names and which `amicus_verdict`'s `record: z.record(z.any())` accepts. A verdict written before
+  v4.8 carries no `streetCred[].seat` at all and is unaffected. The renderer change that opened this
+  is the street-cred labelling note at the top of this section.
+  **Blind mode still never shows a seat id** — a
+  seat id contains its alias — so both twins collapse to `Review A` there exactly as before.
+- **A vote the matrix cannot attribute now renders in an `UNATTRIBUTED` column instead of vanishing.**
+  In `council report` (Markdown and HTML) and in the Council Workspace, the vote→column join now
+  **refuses** a key that identifies nothing — an empty string, a missing or non-string `judge`, or a
+  seat id or alias naming no column on the bench — and folds every such vote into one extra column,
+  headed `UNATTRIBUTED` and placed last among the judge columns. The case this was written for: a
+  judge whose Stage-2 leg never bound to its seat emits no `adjudications[].seat`, so in seat space
+  its vote keys to a bare alias no column reads. It used to count in `basis` and render nowhere —
+  the artifact and the score disagreed. It now counts in `basis` **and** renders. **`basis` is
+  unchanged either way**: this is a rendering fix, not a scoring one. The column is **conditional**
+  — it appears only on a document that actually has a vote to fold, so a document in which every
+  vote is attributable grows no column and never an empty one. ⚠️ **That last claim is scoped to
+  this change, not to the release**: the seat re-key described above is a separate, earlier change
+  in this same release and moves such documents on its own terms. All folded votes on one finding share the one cell, last-wins — the column records
+  one fact about the document rather than one per voter; a seat id is what tells them apart, and
+  supplying one is a producer-side fix. ⚠️ **Read the header as “no column on this bench”, not
+  “nobody knows who voted”** — the rule is about the column, not the voter. On a `--claude-review`
+  run the report keeps the reserved `claude` seat off its bench while the Workspace matrix keeps it,
+  so a hand-authored `judge: "claude"` vote folds in the report and lands in the `claude` column in
+  the Workspace; no engine run emits one, and reconciling the two rosters is deliberately out of
+  scope for this change. ⚠️ Not to be
+  confused with `findings[].unattributedPeerDrops`, listed earlier in this release, which counts
+  votes the **peer filter** excluded from `basis` on the raiser side and which is deliberately left
+  excluded — the drop is announced rather than counted, because nothing in the document can tell a
+  real twin's signal from the raiser's own. Different mechanism, different document, opposite effect
+  on `basis`.
+- **`amicus_council_tally` (MCP) no longer strips the seat keys.** Its input schema now accepts
+  `meta.seats`, `findings[].raiserSeat` and `adjudications[].seat`; previously zod silently dropped
+  all three, which would have left the MCP tool permanently on the pre-fix peer-filter behaviour
+  while `amicus council tally` — a raw JSON parse with no schema — got the fix. All three are
+  declared permissively (validate the envelope, let the tally engine arbitrate shape), so **for
+  these three keys** anything the CLI accepts the MCP path accepts too, including `null`. That is
+  not true of the path as a whole: `adjudications[].verdict`, for one, is a closed `z.enum` on MCP
+  and unconstrained on the CLI. ⚠️ `location` and `claim` now reach `tally.json` on this path (see
+  **Fixed**, above) but are still not forwarded into `verdict.json` — a separate, filed change.
+- **Two fields shipped earlier in this release stop being emitted on two bench shapes.**
+  `findings[].raiserSeat` and `adjudications[].seat` were compared against the *leg's* model input
+  rather than against the seat's own alias, so they were emitted on two benches with no repeated
+  alias at all: a bench carrying a whitespace-padded member, and a bench whose leg
+  reported no model input (where the comparison saw the resolved executable id instead).
+  ⚠️ **Only one of the two shapes is still reachable.** A `--council` preset can no longer put
+  padding on a bench alias — `config.js :: classifyCouncilMembers` trims each member first (see
+  *"A `--council` preset member with stray whitespace now runs"* at the top of this section).
+  ⚠️ **Nor can anything else, traced to the end.** `src/mcp-council-bench.js :: resolveBenchInput`
+  does return `input.models` untrimmed, but that is one hop, not the route: its single consumer
+  always spawns the CLI child with `--models bench.join(',')`, and the child re-parses through
+  `cli-council-run-bench.js :: parseList`, which trims — and `runCouncil` is not exported from
+  `src/index.js`. **The surviving shape is the OTHER one**: a leg that reports no model input,
+  where the comparison sees the resolved executable id. That half is live, which is why the rule and
+  the fix below are unchanged. In both
+  cases the emitted value was byte-equal to the alias, carried no information, and — until now —
+  had no seat table able to resolve it. All four seat-emitting producers now share one rule: emit
+  when the seat's id differs from **its own alias**. This is a visible change to two fields, and it
+  is a correction.
+- **Street cred is seat-keyed, end to end.** On a bench that repeats an alias, `streetCred[]` now
+  emits **one row per seat** instead of one collapsed row per alias, each carrying the new
+  `streetCred[].seat` field (the seat id, emitted only when it differs from the row's own alias).
+  `rankings[]` gained the matching `seat` and `orderSeats` fields — a judge's own seat id, and a
+  seat-valued parallel of `order` — on the same emit-when-**different** terms, so a bench with no
+  repeated alias carries neither and its documents stay byte-identical to before. `peersOnly`'s
+  self-exclusion is now seat-conditional too: when a row and a judge both carry a seat id the engine
+  compares seats, so a twin's *other* seat now counts as a real peer instead of being excluded as
+  "the same model reviewing itself." See `council.md`'s tally-record schema for the full
+  field-by-field notes. ⚠️ Disclosed side effect, filed not fixed: the same release's ledger-join
+  change means a chair-synthesis leg's own conformance can fall out of the reliability ledger
+  entirely on a mixed bench/chair group — see the merged-rows entry above.
+  ⚠️ **This is a visible change to `streetCred[]` row order, and it is a correction.** Fixing the
+  row-count defect described under Fixed, above, also moves row order on a repeated alias that is
+  **not adjacent** in `meta.models` — `--models a,b,a`, which `seats.js :: buildSeats` assigns
+  `a#1`/`b`/`a#2` without complaint, an ordinary three-seat bench, no rejection. `credSeats` now
+  pushes one row per `models` occurrence at that occurrence's own index, so the order is
+  `["a#1","b","a#2"]` where it previously read `["a#1","a#2","b"]` — the old order grouped a
+  repeated alias's rows at its *first* occurrence, an accident of the pre-fix expand-then-skip loop,
+  never a documented property. The new order already agrees with `meta.seats`, whose own `.position`
+  field is in `meta.models` order by construction (`seats.js :: buildSeats` is `aliases.map(...)`
+  over the bench). This reaches `tally.json`, `verdict.json` (`verdict.js :: buildVerdict`) and both
+  report renderers' street-cred tables (`report-md.js :: renderMd`, `report-html.js :: renderHtml`).
+  Fuzzed over 2178 engine-shaped cases (a repeated alias, adjacent or not, over every bench
+  `buildSeats` accepts without complaint): 1368 divergences from the old order, **all order-only —
+  zero content divergences, zero length-invariant violations**. Every fixture in the tree before this
+  fix kept a repeated alias adjacent, where the two orders coincide, which is why nothing caught it
+  earlier. Content is identical either way; only row order moves, and only on a non-adjacent repeat —
+  a bench with no repeated alias, or one whose repeat is adjacent, is byte-for-byte unaffected.
+- **What seat identity does NOT cover after this release.** Four things, stated so they are not
+  discovered:
+  - **The raw `lens` text is not recoverable from the tally artifacts on a bench that does not
+    repeat an alias**, because `meta.seats` — which carries it — is emitted only when one does.
+    `runStats[].role` keeps the slug (`lens:cost`), not the text you passed. The seat *ordinal* is
+    recoverable on any bench: `meta.models` is the bench in seat order, so an alias's k-th
+    occurrence is its k-th seat.
+  - **Two peer-split seat shapes stay open**: the raiser's own Stage-1 leg orphaning, and a peer
+    twin's leg orphaning. In each, the finding carries a seat id and the vote does not (or the
+    reverse), so the seats cannot decide and the alias compare excludes the vote. It is excluded and
+    **announced** in `findings[].unattributedPeerDrops` rather than counted — read that count as "up
+    to N votes of peer signal may be missing here", never as "N are".
+  - **The Council Workspace's street-cred table is still labelled from the alias**, so on a twin
+    bench it and `council report` disagree there (see the street-cred labelling note at the top of
+    this section).
+  - **The Workspace's dead-seat rows are still alias-keyed on the critic path**, and
+    `verdict.json`'s `seatLoss.deadBenchSeats` still does not name a `seat-unbound` loss (both
+    detailed at their own entries above).
+- Live council-run leg rows now carry the leg's seat id (`alias#N`) when the bench repeats an
+  alias, threaded from the Stage-1 roster through the fanout transport to `metadata.json` and back
+  out via the composed live doc. On a unique-alias bench nothing is written — `metadata.json` is
+  unchanged — and every live leg row reports an explicit `seat: null`. Threaded only from Stage 1's
+  initial launch; chair, **Stage 2**, debate, repair, and the Stage-1 retry wave (a separate launch
+  site, `run-retry.js`) all launch without a roster and are unchanged — a retried twin's and a
+  cross-review judge's live rows still report `seat: null`. Filed, not fixed here.
+
+### Internal
+
+- **The roster pad/bind/drop-placeholder core now lives in one place.** Three call sites
+  — the Stage-1 retry wave, the Stage-2 judge wave and the debate re-vote wave — each carried a
+  near-verbatim copy of the same eleven lines: pad every unidentified roster slot with a
+  position-stable placeholder carrying a unique synthetic id, bind, then drop the placeholder
+  binds so nothing is guessed. That block is now
+  `stage1-bind.js :: bindPaddedWave(waveId, rosterSource, aliasAt, legs)`, and each site keeps
+  only its own orphan/missing tail, which genuinely differs (one returns orphans to its caller,
+  one notes them and walks the unbound seats, one has no tail at all).
+  **Zero behaviour change**: no output, artifact, exit code, degrade note or `runStats` row moves.
+  The safety property this code exists for is unchanged and better pinned: placeholder ids stay
+  unique and placeholder binds never reach a seat map, a CONJUNCTION whose failure silently
+  loses a retried leg’s billed usage. Breaking the drop-filter now fails **19 tests across four
+  suites**, where the same edit reached **14 across three** before the consolidation.
+
+- **Added a regression test asserting that `parseModelsList` preserves duplicate aliases.** One
+  re-vote leg per disputing seat depends on `--models gpt,deepseek,deepseek` producing three legs,
+  not two after deduplication; the invariant already held but nothing named it. `parseModelsList`
+  is now pinned directly and the downstream `validateFanoutModels` step is covered by its own test;
+  leg construction inside `runFanout` remains unpinned, so a dedupe introduced there would still be
+  silent. `parseModelsList` itself is byte-unchanged — this is a test plus an invariant comment, not
+  a behaviour change.
+
+- **Five further module extractions.** `seat-space.js` (out of `artifact-names.js`),
+  `report-md.js :: renderMd` (out of `report.js`), `run-stats-entry.js :: buildRunStatsEntry`, the
+  `run-retry` split, and a set of helper moves each relocated existing code to keep modules under
+  the repo's size gate. The moves themselves change no output, artifact or exit code; where a
+  behaviour change shipped in the same PR as a move, it is listed under **Changed** or **Fixed**
+  above.
+
+### Added
+
+- **`doctor` gains a `sessions-index-prune` check; `--fix` removes stale `sessions-index.json`
+  rows.** `recordSession` records a `taskId -> project` entry on session start and nothing ever
+  removed one, so a deleted, renamed or moved project's rows outlived it forever, and every
+  session start paid to read/parse/mutate/stringify/write the *whole* file regardless. The new
+  check lists entries whose project path no longer resolves to a directory, reports both the stale
+  count and the distinct-project count (many task ids can share one project) when it announces work
+  to be done, and `--fix` prunes them atomically through the same write primitive `recordSession`
+  itself uses — a temp file plus a rename — reusing the announce-then-fix shape its
+  `sessions-index-tmp` sibling already established for that file's orphaned temp siblings.
+  Liveness only, never age: a five-year-old entry for a project that still exists is left alone; a
+  one-day-old entry for a deleted one is not. Among *error* conditions, only a confirmed-gone
+  `ENOENT`/`ENOTDIR` counts as stale — a permissions error or any other unreadable-but-maybe-there
+  condition leaves an entry alone rather than risk deleting a live lookup target. (A path that
+  resolves to a plain file, and an entry with no usable project value at all, are also stale — no
+  error is involved in either.) ⚠️ This closes the structural growth gap,
+  not a specific steady-state size: most of the index size first measured against this defect was
+  test residue from an already-sealed `/tmp` hermeticity leak, not something this check alone was
+  ever going to shrink back to zero.
+  ⚠️ **A failure to determine is reported as a failure, not as a clean bill of health.** A
+  pre-ship review found that the check's catch-alls swallowed every exception — including a
+  programming error — making a crash indistinguishable from *"nothing to prune"*.
+  It now surfaces `status:'error'` through `doctor`'s existing `guard()` vocabulary rather
+  than returning a false all-clear, and still never throws into `doctor`. A correct-but-SILENT
+  degrade fails this project's bar as hard as a crash.
+  ⚠️ **KNOWN, documented at the write site, and deliberately NOT fixed here — a pre-existing
+  read-modify-write race.** `--fix` reads the index, drops the stale ids and rewrites the whole
+  file, so a session started inside that window can lose its entry. `recordSession` performs
+  the *identical* unlocked read-modify-write, so two concurrent session starts already clobber
+  each other: the prune **inherits** the index's existing concurrency model rather than
+  introducing it. The window was narrowed to the in-memory filter loop — the write target is now
+  resolved before the read — and prune deletes only the ids it was handed.
+  ⚠️ **The race is TWO-SIDED, so locking only this side would be theater.** Closing it properly
+  means locking `recordSession` too, and that lock — like the `statSync`-per-entry cost of the
+  "prune on write" alternative — is exactly the per-session-start cost this doctor-check design was
+  chosen to avoid. `--fix` and `recordSession` both perform the identical unlocked
+  read-modify-write on the same file today, independent of this change; nothing here makes that
+  worse. `src/utils/session-lock.js` already provides atomic PID/staleness lock-file primitives
+  (used today for per-session-dir start, resume and continue, not for this file) and is the natural
+  home for a future `sessions-index.json` lock or compare-and-swap — but it is **not** wired in
+  here; that remains its own change.
+
+- **New default model alias: `inkling`** (`openrouter/thinkingmachines/inkling`), bringing the
+  shipped alias table to 21. It resolves for `--models`, `--council` presets, `amicus models` and
+  the setup wizard's alias list like any other default. Pinned to the flagship rather than
+  `inkling-small`, and deliberately not to the `:batch` variant — deferred completion is wrong for
+  an interactive council leg. No existing alias changed.
+
+### CI
+
+- **`actionlint` is now fetched as a SHA256-verified release asset instead of piped through the
+  upstream installer script**, with the version and digest pinned as a single source of truth and a
+  test that fails the build when any other mention of the version contradicts the pin.
+  Supply-chain hardening of a CI-only download; nothing in the published package changes.
+- **The council-review workflow's default bench now names models that actually resolve on a
+  runner.** A CI runner has no user config, so a bench entry that only exists as a local alias
+  resolved to nothing there — which is why `inkling` joins the shipped alias table above.
+- **A cross-file citation gate** (`scripts/check-citations.js`, wired into pre-commit and CI)
+  checks that a `file.js :: symbol` or `file:line` reference in a comment or doc still resolves to
+  what it names, so the citation rot this release repeatedly hit is caught at commit time.
+- **The pre-commit gates read the git index, not the working tree**, so a partially-staged commit
+  is checked as it will land rather than as it looks on disk.
 
 ## [4.7.1] - 2026-08-09