amicus 4.7.1 → 4.8.1

package/src/workspace/artifact-names.js

@@ -0,0 +1,222 @@
+/**
+ * Council Workspace — artifact NAME derivation (v4.8 PR5a).
+ *
+ * Split out of artifact-guard.js on the natural seam: this module decides WHICH names a
+ * run dir may legitimately hold and who owns each one; artifact-guard.js keeps the two
+ * read fences (allowlist membership, realpath containment). The guard grew past the
+ * 300-line gate when the seat-space rebuild landed, and the two halves have no shared
+ * state beyond the constants re-exported below.
+ */
+'use strict';
+
+const { sanitizeName } = require('../council/run-launch');
+// ⚠️ v4.8 PR5b: the seat-space PREDICATES moved to ./seat-space (this file was at 300/300,
+// having itself been split out of artifact-guard.js for that same gate). Imported back, and
+// isSeatTable is re-exported below, so every caller and test keeps its existing import path.
+const { isSeatTable, orphanExonerations } = require('./seat-space');
+
+// ⚠️ v4.8 PR5a T1b: `review-claude.md` is NOT an engine artifact — the second-opinion skill
+// authors it as an INPUT and --out-dir places it in the run dir (v4.1 design §:156). It sat
+// unreadable in five real run dirs on the author's machine, so "How Claude's review fared" was
+// permanently unopenable in the Workspace. It is a FIXED name rather than a gated one because
+// run.json carries no claude marker at all: `claudeInCouncil` is set only on tally/verdict meta
+// (run-assemble.js:178) and `claudeReviewFile` never leaves the in-memory options object —
+// run-state.js:129 writes a fixed four-key `options` projection. An unconditional entry is
+// honest here: the presence manifest already reports four fixed names as absent on a normal run.
+const FIXED_ARTIFACTS = Object.freeze(['briefing-stage1.md', 'bundle-stage2.md', 'chair-packet.md', 'chair-output.md', 'tally-input.json', 'review-claude.md']);
+// ⚠️ DE-ROT (F28): v4.1's debate stage writes five MORE run-dir artifact kinds the original
+// allowlist never named, so the Workspace hard-refused every `--debate` output with
+// `artifact not allowed: <name>`. Writers (re-derived v4.8 PR3 — Task 1 moved runRevoteWave):
+// tally-provisional.json = run-debate-stage.js :: runDebateStage; revote-bundle.md =
+// run-debate-revote.js :: runRevoteWave; debate.json = run-debate.js :: runDebate; the
+// rebuttal-/revote- pair = run-launch.js :: materializeDebate.
+// ⚠️ FIVE KINDS, THREE ENTRIES — that is not a miscount (v4.4.1 DOC-7, re-verified). This const
+// holds only the three RUN-LEVEL names; the last two of the five, the rebuttal-/revote- pair, are
+// appended inside artifactAllowlist below, next to review-/judge-.
+const DEBATE_ARTIFACTS = Object.freeze(['tally-provisional.json', 'revote-bundle.md', 'debate.json']);
+
+/**
+ * @param {object} run parsed run.json (may be partial)
+ * @returns {string[]} the allowlist. When two or more DISTINCT bench entries sanitize to the
+ *   same artifact name, a non-enumerable-in-spirit (but plain, test-visible) `collisions`
+ *   array is attached: `[{sanitized, models: [rawA, rawB, ...]}, ...]`. See the R4
+ *   council-review note below for why this is surfaced rather than silently deduped.
+ */
+function artifactAllowlist(run) {
+  const names = [...FIXED_ARTIFACTS];
+  const bench = run && Array.isArray(run.bench) ? run.bench : [];
+  // ⚠️ DE-ROT (F28): run.json carries a `debate` key ONLY on --debate runs, and it is seeded
+  // on the FIRST write (initCouncilRun, src/council/run-state.js:100-103), so this gate is safe
+  // and keeps the allowlist tight for the common case.
+  const debated = !!(run && run.debate);
+  if (debated) { names.push(...DEBATE_ARTIFACTS); }
+
+  // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): sanitizeName is NOT
+  // injective — it maps every character outside [a-zA-Z0-9._-] to '-', so two DISTINCT bench
+  // entries ('vendor/a', 'vendor?a') both produce 'vendor-a'. Both models would then request
+  // the SAME artifact file, and the renderer's `[data-artifact="..."]` lookup (drillIntoJudge)
+  // hands back whichever section matches first — prose silently misattributed to the wrong
+  // model. That is a run-integrity defect (this run directory genuinely cannot hold both
+  // models' review/judge files under distinct names), not a display quirk, so it must be
+  // DETECTED and surfaced, never smoothed away by deduping the resulting name list.
+  //
+  // ⚠️ v4.8 PR5a (R5-13) INVERTS THE INTENT STATED HERE THROUGH v4.7. A bench with repeated
+  // identical entries no longer "collapses to one set of rows": since PR3 each such entry is a
+  // distinct SEAT and the engine writes a distinct file per seat (seats.js artifactName), so
+  // collapsing them is exactly what made both twins' reviews unreadable. What survives from the
+  // old intent is the RN-1 machinery below — two DISTINCT raw entries that coincide after
+  // sanitizeName is still a genuine run-integrity defect and is still surfaced, never deduped.
+  //
+  // The entity list is therefore the SEAT ids when run.json carries a usable seat table, and the
+  // unique raw bench values otherwise. On a bench with no repeated alias the two are the same
+  // list in the same order (seat id === alias, spec §4.2), so the output is byte-identical.
+  const entities = isSeatTable(run && run.seats)
+    ? [...new Set(run.seats.map(s => s.id))]
+    : [...new Set(bench)];
+  const rawBySanitized = new Map(); // sanitized name -> first raw model seen for it
+  const collisionModels = new Map(); // sanitized name -> Set(raw models) once >1 raw maps to it
+  for (const m of entities) {
+    const s = sanitizeName(m);
+    if (rawBySanitized.has(s)) {
+      if (!collisionModels.has(s)) { collisionModels.set(s, new Set([rawBySanitized.get(s)])); }
+      collisionModels.get(s).add(m);
+    } else {
+      rawBySanitized.set(s, m);
+    }
+  }
+
+  // ⚠️ Task 18 (RN-1): the collision above is a real run-integrity defect — the run directory
+  // physically holds ONE file where two models' artifacts should be, and no renderer trick can
+  // recover both. What the renderer CAN stop doing is showing model A's prose under model B's
+  // name. Deterministic disambiguation: per colliding sanitized name, sort the RAW models
+  // (sorting, not insertion order, is what keeps this reproducible across processes/runs); the
+  // first (sorted) keeps the bare sanitized name, the rest get `~2`, `~3`, ... The suffixed
+  // names deliberately do not exist on disk — the presence manifest (run-detail.js, via
+  // fs.statSync over this same allowlist) marks them absent, so the renderer shows the honest
+  // "not written yet" empty state for every model but the first, instead of cross-matching.
+  const nameFor = new Map(); // raw model -> its (possibly suffixed) sanitized name
+  for (const m of entities) {
+    let s = sanitizeName(m);
+    const collision = collisionModels.get(s);
+    if (collision) {
+      const sortedRaw = [...collision].sort();
+      const index = sortedRaw.indexOf(m);
+      if (index > 0) { s = `${s}~${index + 1}`; }
+    }
+    nameFor.set(m, s);
+  }
+
+  // primary name -> the ALIAS of the entity that owns it (its own alias in the legacy
+  // branch). Used below to tell "an orphan's file IS this seat's own primary" (harmless,
+  // same alias) from "an orphan's file collides with ANOTHER seat's primary" (ambiguous).
+  const aliasOfEntity = new Map(
+    isSeatTable(run && run.seats) ? run.seats.map(s => [s.id, s.alias]) : bench.map(m => [m, m]),
+  );
+  const ownerOf = new Map();
+  for (const m of entities) {
+    const s = nameFor.get(m);
+    for (const k of ['review', 'judge', 'rebuttal', 'revote']) {
+      ownerOf.set(`${k}-${s}.md`, { entity: m, alias: aliasOfEntity.get(m), stem: s });
+    }
+    names.push(`review-${s}.md`);
+    names.push(`judge-${s}.md`);
+    // rebuttal-/revote- ride the SAME entity stem as review-/judge-, so DISTINCT aliases
+    // colliding after sanitizeName are disambiguated identically. (The PR3 warning that sat
+    // here — "no longer matches what the engine WRITES on a bench that repeats an alias" —
+    // described the alias-space loop this rebuild replaced. `s` now derives from the seat id,
+    // exactly what materializeDebate's artifactName(seat, prefix) uses, seats.js:165.)
+    if (debated) {
+      names.push(`rebuttal-${s}.md`);
+      names.push(`revote-${s}.md`);
+    }
+  }
+  // v4.8 PR5a (R5-13): names an ORPHANED leg wrote under its alias. Emitted AFTER every
+  // primary so the Set below keeps first-occurrence order, which is what preserves
+  // byte-identity on every bench that orphaned nothing (the overwhelming majority).
+  // Listed so a review that LANDED stays readable (stage1-bind.js:35); never attributed,
+  // because bindSeats could not name that leg and guessing is the mis-attribution §4.4 forbids.
+  const orphanContested = new Set();   // artifact names attributed to NOBODY (council-3 B4)
+  const orphanByStem = new Map();      // sanitized stem -> Set(claimants), deduped for the banner
+  // Both loops below default to NOT ASSERTING, in the direction that fails safe for each:
+  // LISTING a name nobody wrote costs nothing (the presence manifest marks it absent) while
+  // omitting one that exists makes it permanently unreadable, so `orphanKinds` stays wide.
+  // CONTESTING is likewise the safe default — an unattributed file is still listed and still
+  // bannered, while a wrong attribution serves one seat's prose under another's name. So a
+  // kind is contested unless the note PROVES the orphan did not write it (orphanExonerations).
+  const orphanKinds = debated ? ['review', 'judge', 'rebuttal', 'revote'] : ['review', 'judge'];
+  for (const [alias, exonerated] of orphanExonerations(run)) {
+    const stem = sanitizeName(alias);
+    for (const kind of orphanKinds) {
+      const n = `${kind}-${stem}.md`;
+      const owner = ownerOf.get(n);
+      // Its own seat's primary — same alias, so nothing is ambiguous.
+      if (owner && owner.alias === alias) { continue; }
+      if (owner) {
+        // ANOTHER entity's primary. Attribution survives ONLY on a positive proof of
+        // non-authorship; otherwise the file may be either seat's and is contested.
+        if (exonerated.has(kind)) { continue; }
+        // The file is one or the other and run.json cannot say which, so it stays listed
+        // (the owner's push did that), is attributed to NOBODY, and is surfaced ONCE per
+        // stem — the kinds share a stem, and emitting per kind double-counts.
+        orphanContested.add(n);
+        if (!orphanByStem.has(stem)) { orphanByStem.set(stem, new Set()); }
+        orphanByStem.get(stem).add(owner.entity).add(alias);
+      } else {
+        names.push(n);
+      }
+    }
+  }
+  const list = [...new Set(names)];
+  if (collisionModels.size || orphanByStem.size) {
+    list.collisions = [
+      ...[...collisionModels.entries()].map(([sanitized, models]) => ({
+        sanitized, models: [...models],
+      })),
+      // `models` names BOTH claimants of the stem, which is what the banner has to say:
+      // the owning ENTITY (a seat id in seat space — `a#1`, since `a`'s alias never wrote
+      // `review-a-1.md`) AND the orphan's own ALIAS (`a-1`), the string its writer used.
+      // The orphan half is deliberately not projected into entity space: no seat id names
+      // it — being unattributable to a seat is what made it an orphan.
+      ...[...orphanByStem.entries()].map(([sanitized, who]) => ({
+        sanitized, models: [...who], orphan: true,
+      })),
+    ];
+  }
+  // Consumed by workspace-panels.js (wireLazyPanels' file lists + drillIntoJudge's artifact
+  // lookup), which prefers this map over re-deriving names via sanitizeName(model) directly —
+  // that re-derivation is exactly what would ignore the suffixing above and misattribute prose.
+  // ⚠️ Fix-wave (review finding 1) residual limit this map cannot close: the BARE (unsuffixed)
+  // name is still exactly ONE physical file on disk, and its actual bytes belong to whichever
+  // colliding model's writer ran LAST — no map can recover which one that was. The guarantee
+  // delivered here is narrower than "attribution is fully sound": at most the sorted-first
+  // model can still be misattributed under the bare name; artifactCollisions (the run-integrity
+  // banner rendered by workspace-app.js's renderBanners) is what covers that residual case.
+  // v4.8 PR5a: keyed by SEAT ID when the run is in seat space (the map and its consumers
+  // move together — RULE OF ONE SPACE). A kind whose name an orphan also claims is
+  // dropped from the map rather than attributed: the entry would name a file that may
+  // hold the other seat's prose, which is the RN-1 defect this whole block exists to kill.
+  list.artifactsByModel = Object.fromEntries(
+    [...nameFor].map(([m, s]) => {
+      const row = {};
+      for (const k of ['review', 'judge', 'rebuttal', 'revote']) {
+        const n = `${k}-${s}.md`;
+        if (!orphanContested.has(n)) { row[k] = n; }
+      }
+      return [m, row];
+    }),
+  );
+  return list;
+}
+
+// `orphanNames` is deliberately gone (council-2 B1): revision 1 left it as a thin wrapper
+// with zero callers once artifactAllowlist moved to orphanExonerations. An export nothing
+// imports is a second spelling waiting to drift from the one that runs.
+// ⚠️ v4.8 PR5b: `isSeatTable` and `orphanExonerations` are RE-EXPORTS of ./seat-space, not
+// definitions — the same courtesy artifact-guard.js does for this file. Kept so the split is
+// invisible to every caller (run-detail.js reaches them through artifact-guard; four test
+// files import from one layer or the other), and pinned by an identity assertion in
+// tests/workspace/seat-space.test.js so no layer can ever grow its own copy.
+module.exports = {
+  artifactAllowlist, isSeatTable, orphanExonerations, FIXED_ARTIFACTS, DEBATE_ARTIFACTS,
+};
+

package/src/workspace/fold-format.js

@@ -17,7 +17,8 @@
  * src/workspace/ must stay free of.
  * ⚠️ DE-ROT (F58): the header used to claim it "reuses the v4.0 marker/nonce
  * contract exactly" while silently dropping formatFoldOutput's nonce-required
- * throw (src/headless.js:776-778). The guard is restored in buildFoldText below.
+ * throw (src/headless.js :: formatFoldOutput). The guard is restored in
+ * buildFoldText below.
  * No model call — the chair result already exists on disk, so a workspace fold
  * is a local read+format.
  * The chair body is UNTRUSTED model text: it passes through stripFoldMarkers
@@ -49,17 +50,19 @@ function stageSummary(run) {
  * @returns {string} the fold block (marker first line; no trailing newline)
  */
 function buildFoldText(o) {
-  // ⚠️ DE-ROT (F58): mirror formatFoldOutput's v4.0 §9 guard (src/headless.js:776).
-  // Without it a missing nonce emits `[SIDECAR_FOLD:]`, which the hex-only marker
-  // regex (src/utils/fold-marker.js:68) never parses — a silently unfoldable block.
+  // ⚠️ DE-ROT (F58): mirror formatFoldOutput's v4.0 §9 guard
+  // (src/headless.js :: formatFoldOutput). Without it a missing nonce emits
+  // `[SIDECAR_FOLD:]`, which the hex-only marker regex
+  // (src/utils/fold-marker.js :: extractNonceFromText) never parses — a
+  // silently unfoldable block.
   if (!o || !o.nonce) { throw new TypeError('buildFoldText requires a per-run nonce (v4.0 §9)'); }
   const run = o.run || {};
   const verdict = ok(o.verdict);
   const tally = ok(o.tally);
   // Review follow-up #2: verdict.json is NOT re-validated here (the
   // amicus_verdict MCP path types overallVerdict as a bare z.string().nullable()
-  // — mcp-tools.js:428), so a multi-line or marker-bearing value must never
-  // reach the head verbatim: an embedded '\n' would shift every line below
+  // — mcp-tools.js :: amicus_verdict), so a multi-line or marker-bearing value
+  // must never reach the head verbatim: an embedded '\n' would shift every line below
   // VERDICT: (a raw string containing '\n' becomes several elements once the
   // head array is '\n'-joined), and an embedded marker could spoof the fold.
   // Safe on the shipped engine path (parseChairVerdict returns a canonical

package/src/workspace/live-normalize.js

@@ -10,7 +10,7 @@
  * awareness.js) is UNVERSIONED (F63) and carries: {taskId, type, runId,
  * runDir, status, currentStage, stages:[{name,status,waveId}], legsTotal,
  * legsComplete, elapsed, exitCode, version, view:'live', usage?, reason?,
- * legs:[{taskId, model, modelInput, role, status, messages, stage,
+ * legs:[{taskId, model, modelInput, role, seat, status, messages, stage,
  * latestPreview, lastActivityAt, stalled, usage?}], stalled?,
  * stalledForSeconds?}. Do NOT copy the WAVE doc's shape (src/mcp-server.js:
  * 592-662) — that is a different document, gated on metadata.type === 'wave'.
@@ -42,7 +42,7 @@ function seatOf(leg) {
     // ⚠️ DE-ROT (F34/F36): `model` and `modelInput` are TWO SEPARATE fields, never collapsed.
     // A live leg's `model` is the resolved executable id (e.g. `google/gemini-2.5`); `modelInput`
     // is the council ALIAS (e.g. `gemini`) that run.json's labelMap and blind mode's labelFor()
-    // key on (src/council/anonymize.js:30 stamps labelMap values from the alias, never the
+    // key on (src/council/anonymize.js :: assignLabels stamps labelMap values from the alias, never the
     // resolved id). The already-shipped electron/workspace-ui/live-model.js:55 reads
     // `seat.modelInput || seat.model` to pick the alias for its label lookup — collapsing the two
     // into one field here would silently break blind mode (a resolved-id lookup never matches
@@ -50,6 +50,10 @@ function seatOf(leg) {
     model: leg.model || null,
     modelInput: leg.modelInput || null,
     role: leg.role || null,
+    // ⚠️ v4.8 R5: the leg's seat id, and the reason live-dead-seats.js:209's
+    // `if (s.seat)` arm is reachable at all. Null on a unique-alias bench, so the
+    // guard there stays load-bearing — see the comment at that line.
+    seat: leg.seat || null,
     status: leg.status || 'unknown',
     // ⚠️ PRE-FLIGHT (P5): `leg.phase` is dead weight — Task 0.5 does not emit it. `leg.stage` IS
     // emitted (src/observe/council-legs.js:88), so it is the only source; no fallback to invent.

package/src/workspace/matrix-model.js

@@ -2,26 +2,50 @@
  * Council Workspace — adjudication matrix view model (v4.4 §5.2).
  *
  * Pure: tally.json + labelMap (+ verdict.json) → renderable rows/cells.
- * Symbols come from council/report.js SYMBOL (single source — the report and
- * the workspace can never disagree about what the symbols mean). Every
- * name-bearing field carries BOTH spellings ({model, label}) so the
- * renderer's blind toggle is a pure display flip with no re-fetch. Missing
+ * Symbols come from council/report.js SYMBOL, and the seat-space decision from
+ * its isSeatSpace (single source — the report and the workspace can never
+ * disagree about what the symbols mean, nor about which space a document is
+ * in; the latter added by council review A3/B1). Every name-bearing field
+ * carries BOTH spellings ({model, label}) so the renderer's blind toggle is a
+ * pure display flip with no re-fetch. Missing
  * votes (partial waves) are blank cells, never invented neutrals — tier math
  * already excluded them (v4.0).
  *
  * ⚠️ DE-ROT (F07): `tally()` writes `tierOverride: null` on EVERY finding,
- * unconditionally (src/council/tally.js:106) — it is never a real source for
+ * unconditionally (src/council/tally.js :: tally) — it is never a real source for
  * either the override badge or the post-override tier. Only `buildVerdict`
  * materializes `{from,to,reason}` and rewrites `tier` to `tierOverride.to`
- * (src/council/verdict.js:33-37). So both fields are joined in from
+ * (src/council/verdict.js:122-126). So both fields are joined in from
  * verdict.findings[] by `id`; when verdict is absent/unparseable (caller
  * passes null/undefined, or a finding has no verdict-side counterpart) the
  * row falls back to tally's own (pre-override) tier and renders no badge.
  */
 'use strict';
 
-const { SYMBOL } = require('../council/report');
-const { pairFor } = require('./blind-mode');
+const { SYMBOL, isSeatSpace } = require('../council/report');
+const { labelFor, pairFor } = require('./blind-mode');
+
+// v4.8 T-C2 (SI-22.5, ruling R18): the ONE column every vote whose key names no
+// column folds into. A SECOND implementation on purpose — ruling R17 took the
+// narrow option, so this is NOT imported from src/council/report.js and nothing
+// is extracted for it. Two implementations can DRIFT — T-C2 shipped one document
+// rendering two ways for a single commit — so the rule below is pinned as an
+// AGREEMENT with report.js, not merely as this file's own behaviour:
+// tests/council/seat-matrix.test.js drives BOTH consumers over that document.
+const UNATTRIBUTED = 'UNATTRIBUTED';
+
+/**
+ * A finding's adjudications AS AN ARRAY, whatever the document actually carries.
+ *
+ * ⚠️ ONE expression, TWO readers, and that is the whole reason it is a function.
+ * The `folded` pre-pass and the per-finding loop both walk this list, and in
+ * report.js the identical pair drifted apart on type for one commit — `.some`
+ * is Array-only while `for...of` takes any iterable, so `adjudications: "abc"`
+ * rendered on one side and threw on the other. A non-array contributes no
+ * votes: the same answer isSeatSpace gives a malformed seats table, and the
+ * same answer this expression already gave inline before T-C2 hoisted it.
+ */
+function adjOf(f) { return Array.isArray(f.adjudications) ? f.adjudications : []; }
 
 /** Index verdict.findings[] by id, tolerating an absent/malformed verdict doc. */
 function indexVerdictFindings(verdict) {
@@ -44,16 +68,111 @@ function indexVerdictFindings(verdict) {
  */
 function buildMatrixModel(tally, labelMap, verdict) {
   const map = labelMap || {};
-  const judges = tally && tally.meta && Array.isArray(tally.meta.models) ? tally.meta.models : [];
+  const meta = (tally && tally.meta) || {};
+  const aliasJudges = Array.isArray(meta.models) ? meta.models : [];
+  // v4.8 PR4c §3.6 (R4c-8): the IDENTICAL decision report.js applies to
+  // verdict.seats, here over tally.meta.seats — and since council A3/B1, the
+  // identical FUNCTION rather than a second copy of the expression.
+  // run-detail.js already hands this function the parsed tally.json, so the
+  // 3-arg signature is unchanged. One flag for all three readers (roster, vote
+  // key, raiser); see isSeatSpace for why every element must carry a string id
+  // and why `??` is wrong.
+  const seatSpace = isSeatSpace(meta.seats);
+  // report.js filters the reserved claude seat out of ITS roster; this one
+  // never has — tally.meta.models carries `claude` (run-assemble.js appends it)
+  // and HEAD renders a blank column for it. seats[] is bench-only, so a seat
+  // roster would silently DELETE that column; re-append it so the only thing a
+  // claude run's matrix changes is the twin split.
+  const claudeTail = meta.claudeInCouncil === true && aliasJudges.includes('claude') ? ['claude'] : [];
+  // A column is {key, pair}: `key` is what votes and the raiser are matched
+  // against, `pair` is what the renderer shows.
+  // ⚠️ BLIND MODE: resolve the label from the seat's ALIAS and carry the seat's
+  // ID only as identity. `pairFor(seat.id, map)` returns label:null (labelMap's
+  // values are aliases), and workspace-render.js's display() then falls back to
+  // pair.model and prints `deepseek#1` with blind mode ON. A seat id contains
+  // its alias, so rendering one in blind mode defeats blind mode. Both twins
+  // therefore collapse to `Review A` when blind — exactly as at HEAD.
+  const bench = seatSpace
+    ? meta.seats.map(s => ({ key: s.id, pair: { model: s.id, label: labelFor(s.alias, map) } }))
+      .concat(claudeTail.map(j => ({ key: j, pair: pairFor(j, map) })))
+    : aliasJudges.map(j => ({ key: j, pair: pairFor(j, map) }));
   const findings = tally && Array.isArray(tally.findings) ? tally.findings : [];
   const verdictById = indexVerdictFindings(verdict);
+  // v4.8 T-C2 (SI-22.5): CLASSIFY the key instead of trusting it. At 32a63e92 the
+  // domain split in two and BOTH halves lost the vote: `typeof adj.judge !==
+  // 'string'` refused an absent or non-string judge outright — in seat space
+  // testing a field that is not even the key, so a valid seat with a numeric
+  // judge rendered nowhere — while an orphaned seat id and `''` were written to
+  // a `votes` key no column reads. The roster is what makes a key mean a column,
+  // so `keys.has` is the orphan test, and the three conjuncts refuse, in order, a
+  // non-string, the empty string, and a string naming no column.
+  // ⚠️ `key !== ''` IS NOT REDUNDANT WITH `keys.has`, and T-C2 shipped it wrong
+  // for one commit, which is why the reason is written down. `isSeatSpace`
+  // accepts `{id: ''}`, so a roster CAN hold `''` — and matching a `''` roster
+  // key against a `''` judge matches TWO NON-IDENTITIES. That is structurally
+  // the defect v4.8 T-B4 removed from src/council/peer-split.js :: peersOf, where
+  // a falsy raiser matched a falsy judge and corroborated its own finding.
+  // Rulings R18 and R2 both say `''` is not an identity, and a malformed roster
+  // carrying `''` does not make it into a name. Without the conjunct the two
+  // consumers rendered ONE document differently — the desync class PR B exists to
+  // remove — so this is now the SAME classification rule report.js applies, over
+  // this file's own roster. Written again, never shared (R17); a pin drives BOTH
+  // consumers over that document so the agreement is enforced, not re-derived.
+  // Named mutants, with their measured red sets:
+  // tests/council/seat-matrix.test.js :: WSJUNKKEY and
+  // tests/council/seat-matrix.test.js :: WSEMPTYOK.
+  const keys = new Set(bench.map(c => c.key));
+  const columnFor = (adj) => {
+    const key = (seatSpace && adj.seat) || adj.judge;
+    return (typeof key === 'string' && key !== '' && keys.has(key)) ? key : UNATTRIBUTED;
+  };
+  // ⚠️ TWO-PHASE, and here it could not be anything else: `cells` is built by
+  // MAPPING this roster, so a roster decided inside the per-finding map would
+  // give two rows DIFFERENT CELL COUNTS — a body that no longer matches its own
+  // header. The pre-pass therefore walks every finding before the map starts.
+  // ⚠️ CONDITIONAL: added unconditionally it grows a column on every matrix that
+  // has no such vote. Named mutant: tests/council/seat-matrix.test.js :: WSALWAYSCOL.
+  // ⚠️ `!keys.has(UNATTRIBUTED)`: a bench model literally aliased UNATTRIBUTED
+  // already owns that column and R18 says ONE column. It then SHARES its cell
+  // with the folded votes — disclosed, not fixed, because the column key is also
+  // what the fold writes and separating them needs a renderer change.
+  // ⚠️ LAST, after `claudeTail`: the fold column is not a bench member, and
+  // appending keeps every existing column at the index it had at 32a63e92.
+  // `concat` for uniformity with the `claudeTail` append above, NOT for safety:
+  // report.js needs it because its alias roster IS `verdict.council` by
+  // reference, and measured, this file has no such trap — every branch of
+  // `bench` ends in a `.map`, which always allocates.
+  // ⚠️ BLIND MODE — both name slots carry the same literal rather than
+  // `pairFor(UNATTRIBUTED, map)`. UNATTRIBUTED has no alias to protect and no
+  // identity to reveal, so the flip must be a no-op on it BY CONSTRUCTION, not
+  // by `labelFor` happening to return null — which it stops doing the moment a
+  // labelMap value IS `UNATTRIBUTED`, when the blind header would print a review
+  // label over a column of nobody's votes.
+  // Named mutant: tests/council/seat-matrix.test.js :: WSPAIRFOR.
+  const folded = findings.some(f => adjOf(f).some(a => a && columnFor(a) === UNATTRIBUTED));
+  const columns = folded && !keys.has(UNATTRIBUTED)
+    ? bench.concat([{ key: UNATTRIBUTED, pair: { model: UNATTRIBUTED, label: UNATTRIBUTED } }])
+    : bench;
 
   const rows = findings.map((f) => {
     const votes = {};
-    for (const adj of (Array.isArray(f.adjudications) ? f.adjudications : [])) {
-      if (!adj || typeof adj.judge !== 'string') { continue; }
-      votes[adj.judge] = adj.verdict;
+    for (const adj of adjOf(f)) {
+      // ⚠️ HALF of 32a63e92's guard survives, and that half is doing work: `!adj`
+      // skips a falsy element, which carries no verdict to fold and which
+      // `columnFor` would dereference.
+      // ⚠️ THE STRICTNESS DIFFERENCE THIS COMMENT USED TO RECORD IS GONE. It read
+      // "report.js has no such guard and THROWS on that document"; v4.8 T-C4 gave
+      // `report.js :: adjOf` a `.filter(Boolean)`, which is this predicate spelled
+      // a second time — R17, two implementations, never shared. That file no longer
+      // throws on a falsy element and no longer grows a phantom column for one.
+      // The `typeof adj.judge` half is GONE, subsumed by the classification
+      // above: it refused votes where R18 requires them folded.
+      if (!adj) { continue; }
+      votes[columnFor(adj)] = adj.verdict;
     }
+    // The raiser's column key. In alias space this is `f.raiser` and every
+    // expression below is byte-identical to HEAD.
+    const raiserKey = seatSpace ? (f.raiserSeat || f.raiser) : f.raiser;
     const vf = verdictById.get(f.id);
     return {
       id: f.id,
@@ -62,29 +181,32 @@ function buildMatrixModel(tally, labelMap, verdict) {
       thin: f.confidence === 'thin',
       tierOverride: (vf && vf.tierOverride) || null,
       // ⚠️ DE-ROT (F29): v4.1 decorates tally.json findings in place with
-      // `debate: {action, previousTier}` (src/council/debate.js:71-75; action ∈
+      // `debate: {action, previousTier}` (src/council/debate.js :: decorateRecord; action ∈
       // defended|amended|withdrawn|no-response) and verdict.json carries it through
       // (src/council/verdict.js:43). Consumed by electron/workspace-ui/workspace-matrix.js's
       // renderMatrix, which renders a `.debate-badge` in the tier cell (alongside the
       // thin/tierOverride badges) so a withdrawn/amended/defended/no-response finding never
       // renders as an ordinary live row. Absent on non-debate runs, hence `|| null`.
       debate: f.debate || null,
-      raiser: pairFor(f.raiser, map),
+      // The THIRD reader. Its label still resolves from the ALIAS (blind mode
+      // must not leak a seat id here either), while its identity is the seat —
+      // otherwise the starred column and the Raiser cell name different things.
+      raiser: { model: raiserKey, label: labelFor(f.raiser, map) },
       basis: f.basis || { a: 0, d: 0, n: 0 },
-      cells: judges.map((j) => {
-        const vote = Object.prototype.hasOwnProperty.call(votes, j) ? votes[j] : null;
+      cells: columns.map((c) => {
+        const vote = Object.prototype.hasOwnProperty.call(votes, c.key) ? votes[c.key] : null;
         return {
-          judge: pairFor(j, map),
+          judge: c.pair,
           verdict: vote,
           sym: vote ? (SYMBOL[vote] || '?') : ' ',
-          isRaiser: j === f.raiser,
+          isRaiser: c.key === raiserKey,
         };
       }),
     };
   });
 
   return {
-    judges: judges.map((j) => pairFor(j, map)),
+    judges: columns.map((c) => c.pair),
     rows,
     tierCounts: (tally && tally.tierCounts) || null,
     judged: !(tally && tally.judged === false),

package/src/workspace/run-detail.js

@@ -13,7 +13,7 @@ const { formatCost } = require('../utils/pricing');
 const { readPointer } = require('./run-scan');
 const { buildNamePairs } = require('./blind-mode');
 const { buildMatrixModel } = require('./matrix-model');
-const { artifactAllowlist } = require('./artifact-guard');
+const { artifactAllowlist, isSeatTable } = require('./artifact-guard');
 const { isRealpathContained } = require('../utils/path-fence');
 
 /**
@@ -73,6 +73,13 @@ function costPanel(run, tally) {
   const stats = tally && Array.isArray(tally.runStats) ? tally.runStats : [];
   const rows = stats.map((r) => ({
     model: r.model,
+    // v4.8 PR5a T3: carry the seat. The engine computes it, writes it to tally.json and
+    // verdict.json, and this five-key projection was throwing it away one function before
+    // the renderer. ⚠️ Its consumer (renderCost) lands in PR5b, so this is honestly a
+    // payload-shape change here, not a visible one — shipping it now keeps PR5b from
+    // needing a src/ change of its own. Emit-when-set: a unique bench has no seat on any
+    // row, so the payload is byte-identical there.
+    ...(r.seat ? { seat: r.seat } : {}),
     role: r.role || (r.wasChair ? 'chair' : 'seat'),
     status: r.status || 'unknown',
     durationMs: r.durationMs === undefined ? null : r.durationMs,
@@ -117,13 +124,13 @@ function costPanel(run, tally) {
 
 // ⚠️ PRE-FLIGHT (P3): F04's correction is implemented here rather than left as prose.
 // VERIFIED on shipped main (Task 0): `finalize(exitCode, error)` writes `error: error || null`
-// (src/council/run.js:98-100), and `return finalize(degraded.value ? 2 : 0)` (:293) is the ONLY
+// (run-finalize.js :: writeRunTerminal), and `return finalize(degraded.value ? 2 : 0)` (run.js:279) is the ONLY
 // exit-2 path — it passes NO error. Every error-bearing call is `finalize(1, …)`. So on a
 // `status:'partial'` run — precisely the run this panel exists to explain — `run.error` is
 // GUARANTEED null, and the old one-line formula rendered "undefined: undefined".
 // Name the stage instead. Stage status is a closed set (DE-ROT F19): running / complete /
-// skipped / error, and `run-chair.js:114` writes 'error' for a chair that failed after retry +
-// fallback promotion, 'skipped' (:89) for one the cost ceiling skipped.
+// skipped / error, and `run-chair.js :: chairStatus` writes 'error' for a chair that failed after retry +
+// fallback promotion, 'skipped' (run-chair.js :: skippedForCost) for one the cost ceiling skipped.
 function degradedReason(run) {
   // exit-1 path: the engine wrote a structured {code, message}.
   if (run.error && run.error.code) { return `${run.error.code}: ${run.error.message}`; }
@@ -215,6 +222,25 @@ function getRunDetail(project, runId) {
       // pre-v4.5 runs, live-doc consumers not yet updated) apart from a real map, and fall back
       // to its legacy sanitizeName(model) computation only in the former case.
       artifactsByModel: artifactNames.artifactsByModel || null,
+      // ⚠️ v4.8 PR5a fix-wave (council A1/B1): WHICH SPACE the payload above is in, decided
+      // by the one predicate artifactAllowlist itself gates on (isSeatTable, re-exported
+      // through artifact-guard). The renderer is a plain browser script and cannot
+      // require() it, and the alternative — re-spelling the predicate in workspace-lazy.js
+      // the way sanitizeName/TERMINAL_STATUSES are hand-copied — is exactly the drift that
+      // caused the finding: roster() gated on `!seats || !seats.length`, which is strictly
+      // weaker, so a malformed seats[] sent this map to ALIAS space while the roster stayed
+      // in SEAT space and every artifactsByModel lookup missed. Shipping the ANSWER instead
+      // of a copy of the question makes that divergence unrepresentable.
+      seatSpace: isSeatTable(run.seats),
+      // ⚠️ Fix-wave 3 (council-3 C2): seats[] is PRESENT but unusable, so the run silently
+      // lost per-seat behaviour — two seats on one model become indistinguishable in every
+      // panel. isSeatTable fails WHOLE (one malformed entry drops the entire table), which
+      // is the fail-safe direction but is exactly the correct-but-silent degrade the product
+      // principle rejects. Emitted here, beside the predicate that decides it, rather than
+      // re-derived renderer-side; workspace-app.js's renderBanners is its only consumer.
+      // NOT the same as `!seatSpace`: a run with no seats[] at all is a legacy run, not a
+      // broken one, and must not be bannered.
+      seatTableRejected: Array.isArray(run.seats) && run.seats.length > 0 && !isSeatTable(run.seats),
     };
   }