amicus 4.7.1 → 4.8.1

package/docs/council.md

@@ -39,7 +39,7 @@ orchestration recipe. This page is the reference for the artifacts that recipe p
 
 ```
 Stage 1 reviews (models, via `amicus fanout`)
-        │  each leg saved as review-<model>.md (prose + trailing ```json findings block)
+        │  each leg saved as review-<seat>.md (prose + trailing ```json findings block)
         ▼
 amicus council validate <leg-file>          ← per-leg findings-block check (tri-state exit)
         │  ok:true → findings[] usable
@@ -211,9 +211,9 @@ Key semantics:
 ```
 council-<runId>/
   briefing-stage1.md          # composed seat briefing (user briefing + templates)
-  review-<model>.md x N       # Stage-1 outputs
+  review-<seat>.md x N        # Stage-1 outputs (one per bench seat)
   bundle-stage2.md            # anonymized judge bundle (identical for all judges)
-  judge-<model>.md x N        # Stage-2 raw outputs
+  judge-<seat>.md x N         # Stage-2 raw outputs (one per judging seat)
   chair-packet.md             # de-anonymized chair packet (+ verdict-scale addendum)
   chair-output.md             # chair raw output
   tally-input.json            # the assembled five-keys object (auditability)
@@ -224,6 +224,22 @@ council-<runId>/
   _scratch/                   # cwd for judge legs (isolation)
 ```
 
+**`<seat>` in those filenames is the seat id, not the model alias.** A seat id *is* its alias
+whenever that alias occupies exactly one bench position — which is every bench with no repeated
+`--models` entry, so these filenames are unchanged there. When the same alias occupies more than
+one seat, the seats are `<alias>#1`, `<alias>#2`, … and the files they write are
+`review-<alias>-1.md`, `review-<alias>-2.md`, and so on. The same rule names the `judge-`,
+`rebuttal-` and `revote-` files below. The Council Workspace reads these names directly: its
+allowlist is built from `run.seats`, so each seat's own file opens under that seat.
+
+One case is deliberately left unattributed. When a leg cannot be bound to a seat, the engine still
+writes its output — under the **alias**, because that is all it knows (`review-<alias>.md`). That
+file stays readable, but it is attributed to **no seat**: `run.json` records that *an* orphan
+happened, not *which* seat produced it, and guessing would be exactly the silent mis-attribution
+seat identity exists to prevent. If such a name collides with another seat's own artifact — possible
+when one alias sanitizes onto another seat's filename — neither is attributed and the run-integrity
+banner names both claimants.
+
 Two more files appear when the run was started through **`amicus_council_run`** rather than the
 CLI, both written by the MCP handler before it spawns the engine:
 
@@ -276,14 +292,14 @@ one round.
    `--no-ledger` and writes `tally-provisional.json`. If nothing landed Contested or Disputed,
    there is nothing to debate — the engine skips straight to the final tally
    (`debate.outcome: "nothing-to-debate"`).
-2. **Defense.** Every Contested/Disputed finding goes back to its raiser as one concurrent solo
-   run — `rebuttal-<model>.md` per raiser — asking for exactly one of `DEFEND` / `AMEND` /
-   `WITHDRAW` per finding. A dead or unparseable defense leg means the original claim stands
-   undefended.
-3. **Re-vote.** Defended/amended findings go back to the judges who disputed them, as ONE
+2. **Defense.** Every Contested/Disputed finding goes back to the **seat** that raised it as one
+   concurrent solo run — `rebuttal-<seat>.md` per raising seat — asking for exactly one of
+   `DEFEND` / `AMEND` / `WITHDRAW` per finding. A dead or unparseable defense leg means the
+   original claim stands undefended.
+3. **Re-vote.** Defended/amended findings go back to the **seats** that disputed them, as ONE
    shared fanout wave — `revote-bundle.md` (the shared prompt, written to the run dir like
-   Stage 2's `bundle-stage2.md`) + `revote-<model>.md` per judge. A missing/unparseable re-vote
-   line leaves that judge's original verdict standing.
+   Stage 2's `bundle-stage2.md`) + `revote-<seat>.md` per re-voting seat. A missing/unparseable
+   re-vote line leaves that seat's original verdict standing.
 4. **Final tally.** The engine reassembles the tally input with the defense/re-vote outcomes
    folded in and re-tallies — this final, post-rebuttal tally is the one that appends to the
    reliability ledger (a lens run is the only thing that suppresses the append — `council run` has no `--no-ledger` escape hatch; that flag is parsed only by `council tally`). Withdrawn findings stay
@@ -303,7 +319,13 @@ after the re-vote keeps its final tier.
   finding with what happened in the round and the tier it held before the re-vote.
 - Extra run-dir artifacts, written only when a defense/re-vote actually ran:
   `tally-provisional.json`, `revote-bundle.md`, `debate.json` (the round's structured record),
-  `rebuttal-<model>.md` × (raisers), `revote-<model>.md` × (disputing judges).
+  `rebuttal-<seat>.md` × (raising seats), `revote-<seat>.md` × (disputing seats).
+- **Both waves are sized in seats, so a bench that repeats an alias costs more here.** Two seats
+  sharing an alias that both raise a contested finding get two defense solos, and two that both
+  dispute get two re-vote legs — up to two extra billed legs per duplicated pair per round, plus a
+  bounded repair solo for either of them if its output does not parse. `revoteJudges` above counts
+  the re-vote legs; nothing in `run.json`'s `debate` object counts the defense solos, though every
+  one of them appends its own wave id to `stages[]` under `debate-defense`.
 - `--claude-review <file>` enters Claude's own review (from a file, no leg launched) as a judged
   entry; per the reserved-seat rule, it is never asked to defend in the debate round — its
   Contested/Disputed findings simply stand, the same "originals stand" outcome as a dead defense
@@ -534,8 +556,10 @@ amicus council tally <input.json> [--json] [--no-ledger]
 ```
 
 Reads a **tally-input** JSON file, computes the deterministic tally **record**, prints it (human
-summary, or the full record with `--json`), and — unless `--no-ledger` — appends one row per
-model to the reliability ledger. Thin CLI wrapper over `tally()` (`src/council/tally.js`).
+summary, or the full record with `--json`), and — unless `--no-ledger` — appends one row per distinct
+(`model`, `resolvedModel`) pair to the reliability ledger (v4.8 — see **Ledger append** below;
+that is one row per model on an ordinary bench). Thin CLI wrapper over `tally()`
+(`src/council/tally.js`).
 
 ### Tally-input schema
 
@@ -547,14 +571,15 @@ under "Stage-2 → tally assembly recipe"). It needs **all five top-level keys**
 | Field | Type | Meaning |
 |---|---|---|
 | `meta.runId` | string | Run identifier (conventionally the run-folder stem). |
-| `meta.models` | string[] | Every reviewed model id, including `"claude"` when "Claude in the council" is on — this is the street-cred universe. |
+| `meta.models` | string[] | Every reviewed model id, including `"claude"` when "Claude in the council" is on — this is the street-cred universe: `streetCred[]` has exactly one row per `meta.models` entry, always (`streetCred.length === meta.models.length`, holds on any input — **v4.8 follow-up**, closing a case where a `meta.seats` table that disagreed with `meta.models` in count used to drop or invent a row), in `meta.models` order — the k-th occurrence of a repeated alias takes the k-th row, so a non-adjacent repeat (e.g. `["a","b","a"]`) is never grouped by alias. |
 | `meta.chair` | string | The confirmed chair model id. |
 | `meta.claudeInCouncil` | boolean | The Stage-0 toggle. |
 | `meta.runType`, `meta.date` | string (optional) | Free-form labels carried through to `verdict.json`. |
-| `findings[]` | array | One entry per finding across all reviews: `{id, raiser, severity}` (`claim` may ride along but isn't required by the tally engine). `id` is the run-global label (e.g. `A1`, `B2`) assigned during Stage-2 assembly, not the reviewer's local integer id. |
-| `adjudications[]` | array | One entry per (judge × finding): `{findingId, judge, verdict}`, `verdict ∈ {agree, dispute, neutral}`. Include every judge's verdict on every finding, **including the raiser's own adjudication of its own finding** — the engine excludes it automatically when scoring (don't pre-filter it). |
-| `rankings[]` | array | One entry per judge: `{judge, order}`. `order` is that judge's `FINAL RANKING:` block translated to model ids, e.g. `["gpt", "deepseek"]` (ties may use a nested array, e.g. `[["gpt","deepseek"], "mistral"]`). |
-| `runStats[]` | array | One row per paid launch (v4.7 spec §5 D1/D2 — no longer capped at one row per model; see the role roster below): `{model, role, wasChair, conformance, status, durationMs, usage, waveId?, resolvedModel?}`. May be `[]`. Any leg with no run document gets `durationMs: null, usage: null` — never invent a value. `waveId` is emit-only-when-set. `resolvedModel?` (v4.7) — the executable id that actually served the row's leg, emit-only-when-set; leg-less rows (the give-up chair row, dead seats with no leg, the claude row) never carry it. `model` stays the council alias. |
+| `meta.seats` | array (optional) | **v4.8** — the run's seat table, one `{id, alias, role, lens, position}` entry per **bench** seat in bench order. The engine emits it **only when the bench repeats an alias**: that is the one case where the `alias#N` ids on `findings[].raiserSeat`, `adjudications[].seat` and `runStats[].seat` resolve to nothing else in the document, since `meta.models` is the *alias* list. Bench-only — `claude` is never a seat, so never assume `meta.models.length === meta.seats.length`, and never join the two positionally. ⚠️ **Absence never means "the bench had no repeated alias."** Hand-assembled and MCP-assembled tally input reaches `tally()` with no seat machinery behind it at all; absence means only "no seat table available". |
+| `findings[]` | array | One entry per finding across all reviews: `{id, raiser, severity}` (`claim` may ride along but isn't required by the tally engine). `id` is the run-global label (e.g. `A1`, `B2`) assigned during Stage-2 assembly, not the reviewer's local integer id. `raiserSeat?` (**v4.8**) — the raising **seat's** id (`deepseek#1`), emit-only-when-it-differs-from-the-alias, so a bench with no repeated alias never carries it. `raiser` stays the alias in every case. |
+| `adjudications[]` | array | One entry per (judge × finding): `{findingId, judge, verdict}`, `verdict ∈ {agree, dispute, neutral}`. `seat?` (**v4.8**) — the judging **seat's** id, on the same emit-when-different terms as `findings[].raiserSeat`; `judge` stays the alias. Include every judge's verdict on every finding, **including the raiser's own adjudication of its own finding** — the engine excludes it automatically when scoring (don't pre-filter it). ⚠️ **v4.8: that exclusion is seat-conditional.** When a vote *and* its finding both carry a seat id, the engine compares **seats** (`v.seat !== f.raiserSeat`), so on a bench that repeats an alias a twin's genuine vote on its twin's finding is now counted instead of discarded. When either side carries no seat id — a legacy document, a hand-assembled one, or a real run whose leg failed to bind to its seat — it falls back to comparing **aliases**, which is the pre-v4.8 behaviour and still drops that twin's vote. Never fill in a seat id you did not observe just to unlock the seat compare. ⚠️ **`""` is not a model id.** The schema accepts an empty string for `raiser` and for `judge`, but the engine cannot identify a vote it has no name for: when a finding's `raiser` is empty or missing, every vote whose `judge` is also empty or missing is excluded from `basis` and counted in `findings[].unattributedPeerDrops`. A **seat id on both sides overrides this** — it is a stronger identity than either name, so a seated vote is scored (or excluded as the raiser's own) regardless of what `raiser` and `judge` say. Send the real alias, or expect the vote not to be scored. |
+| `rankings[]` | array | One entry per judge: `{judge, order}`. `order` is that judge's `FINAL RANKING:` block translated to model ids, e.g. `["gpt", "deepseek"]` (ties may use a nested array, e.g. `[["gpt","deepseek"], "mistral"]`). `seat?` (**v4.8**) — the judge's own seat id, on the same emit-when-different terms as `adjudications[].seat`; `judge` stays the alias. `orderSeats?` (**v4.8**) — the seat-valued parallel of `order`, slot for slot (a tied slot is a nested array there too): each slot is a seat id where the ranked model's seat is known, `null` where it is not, and the whole key is emitted only when at least one slot is non-null. **Two consumers read it.** Street cred keys on `orderSeats` when present and falls back to the alias otherwise — the mechanism that lets a twin bench's two street-cred rows diverge instead of collapsing into one. **v4.8** — the **chair packet** is the second: its peer-rankings block zips `orderSeats` onto `order` slot for slot, so the chair reads seat ids where the run knows them and the ranked alias where it does not. A tied slot is zipped element by element, and a `null` slot renders the alias rather than the word `null`. |
+| `runStats[]` | array | One row per paid launch (v4.7 spec §5 D1/D2 — no longer capped at one row per model; see the role roster below): `{model, role, wasChair, conformance, status, durationMs, usage, waveId?, resolvedModel?, seat?}`. `seat?` (**v4.8**) is the row's seat **id**, emit-only-when-it-differs-from-that-seat's-own-alias — so only a bench that repeats an alias carries it. Only the two producers that *have* a seat pass one: the primary reviewing-seat rows and the dead-seat rows. A `judge`, `chair-attempt`, `repair` or `superseded` row never carries it (all four are excluded from the ledger join, so a seat stamp there could never win it), and neither do the off-bench chair rows or the synthetic `claude` row, which have no seat at all. Two seats of one alias that **both** died usually get **two** rows: each carries its own `seat` id where the run bound that seat's leg, and **no** `seat` where it could not — an unidentified dead seat is counted but never named. They still collapse into a **single** row in two cases, both of them seats the run genuinely cannot tell apart: both legs missing a task id, and a run with no seat table behind it — the deliberate floor, since inventing an identity there would be a guess. A retry wave that came back with **fewer legs than it launched** was a third such case and is **no longer**: v4.8 T-A4 made the retry reconcile count a key's SLOTS rather than test its presence, so both twins get a row (measured end to end through `runStage1`: 1 primary dead-seat row before, 2 after, with the superseded rows unchanged at 2 — one of the two rows carries `usage: null`, and **which one is arbitrary**: neither row names a seat, so the alias's billed total is split across its anonymous rows by row ORDER, never by identity). ⚠️ **Corrected in v4.8** — this cell previously claimed the two *always* collapse into one row carrying no `seat`. That was already wrong for **bound** twins the day it was written (the two-row behaviour landed 2026-08-13, this sentence 2026-08-14), and v4.8 closed the unbound half for every retry outcome, the partial return included (that last one in T-A4). May be `[]`. Any leg with no run document gets `durationMs: null, usage: null` — never invent a value. `waveId` is emit-only-when-set. `resolvedModel?` (v4.7) — the executable id that actually served the row's leg, emit-only-when-set; leg-less rows (the give-up chair row, dead seats with no leg, the claude row) never carry it. `model` stays the council alias. ⚠️ **One row shape carries `usage` with NO `waveId`, `resolvedModel` or `durationMs` (v4.8)**: an unidentified dead seat on an alias the bench repeats, where the run holds a billed retry leg it cannot attribute to either twin. The cost is real and is counted in the run total, but every per-seat execution fact is withheld rather than guessed — so do **not** assume `usage` implies `waveId`, and do not treat a null `durationMs` as "this seat cost nothing". |
 
 **`runStats[].role` roster (v4.7 row-per-launch).** Every leg the run budget counts gets exactly
 one row, so a seat that needed a repair or lost a leg to a retry can now show up more than once.
@@ -577,10 +602,15 @@ suffixed label (`rebuttal`/`revote` render unsuffixed); `council tally` has no p
 at all, only an aggregate. And only `chair-attempt`/`repair`/`superseded` are filtered out of the
 Workspace seats panel — `rebuttal`/`revote` rows still render there.
 
-`runStats[].waveId` names the exact wave/leg a row was built from, present **iff a real billed
-leg backs the row** — e.g. the synthetic `claude` row, a give-up chair's error row, and a
+`runStats[].waveId` names the exact wave/leg a row was built from, present **iff the row can
+name a billed leg as its OWN** — e.g. the synthetic `claude` row, a give-up chair's error row, and a
 leg-less dead-seat/critic/lens primary error row (the two SL-2 retry note-classes that never
-produced a real leg for the seat at all) carry none. It's the join key the leg–row bijection
+produced a real leg for the seat at all) carry none. ⚠️ **Corrected in v4.8** — this read *"iff a
+real billed leg backs the row"*, which stopped being true when unidentified dead twins gained the
+row shape described in the `runStats[]` cell above: a real billed leg backs those rows (their
+`usage` is on the record and in the run total) and they still carry no `waveId`, because the leg
+belongs to a seat the row cannot claim to be. **So `waveId` is not a safe filter for "rows carrying
+billed usage" — read `usage` for that.** It's the join key the leg–row bijection
 invariant suite (`tests/council/run-cost-bijection.test.js`) uses to prove every budget-counted
 leg lands on exactly one row. `resolvedModel` follows the same emit-only-when-set discipline and
 the same never-invent rule — it is never derived from the alias.
@@ -601,7 +631,7 @@ groups by `resolvedModel || model` — see the stats section below.
   "type": "council-tally",
   "meta": { "...": "echoed from input" },
   "judged": true,
-  "streetCred": [ { "model": "gpt", "withSelf": 1, "peersOnly": 1, "perJudgeRank": { "...": "..." } } ],
+  "streetCred": [ { "model": "gpt", "withSelf": 1, "peersOnly": 1, "perJudgeRank": { "...": "..." }, "seat": "gpt#1" } ],
   "findings": [
     { "id": "A1", "raiser": "deepseek", "severity": "major", "tier": "Confirmed",
       "basis": { "a": 1, "d": 0, "n": 0 }, "confidence": "thin",
@@ -617,12 +647,16 @@ groups by `resolvedModel || model` — see the stats section below.
 | `schemaVersion` | Tally-record schema version (currently `2`, council family v2 — see `type` below). This is a *separate* version line from the `--json` **error-envelope** schema version used by `BAD_ARGS` failures (also currently `2`) — the two happen to share a value right now but evolve independently; don't conflate them when scripting against output. |
 | `type` | Document-type discriminator; always `"council-tally"` (council family v2 envelope). |
 | `judged` | `true` only when `rankings.length >= 2`. `false` (1 or 0 rankings) means street-cred numbers exist but rest on thin cross-review. |
-| `streetCred[].withSelf` | Mean rank position across **all** judges' rankings (lower = better). |
-| `streetCred[].peersOnly` | Mean rank position **excluding** the model's own ranking of itself. This is the number used everywhere else (ledger, `stats`, bench recommendations). |
+| `streetCred[].withSelf` | Mean rank position across **all** judges' rankings (lower = better). **v4.8: `streetCred[]` is now one row per SEAT, not one row per alias** — a bench that repeats an alias used to emit two byte-identical rows under that shared alias; each seat now gets its own row, with its own numbers. A unique-alias bench is unaffected: one alias is one seat there, so the row set and every number stay byte-identical to before. |
+| `streetCred[].peersOnly` | Mean rank position excluding this row's own ranking of itself (lower = better). **v4.8: the exclusion is seat-conditional.** When this row and a judge both carry a seat id, the engine compares **seats** — so on a bench that repeats an alias, a twin's OTHER seat is a real peer and its ranking of this seat counts, even though it shares this row's alias. Only when either side lacks a seat id (a unique-alias bench, or a document with no seat channel) does it fall back to comparing **aliases**, which is the pre-v4.8 behaviour and the only case a document without seats can produce. This is the number used everywhere else (ledger, `stats`, bench recommendations). |
+| `streetCred[].seat` | **v4.8**, optional. This row's own seat id, on the same emit-when-**different**-from-the-alias terms as the tally-input schema's `rankings[].seat` above. Absent unless the bench repeated an alias. |
 | `findings[].tier` | One of `Confirmed \| Contested \| Singleton \| Disputed` — see the cascade below. |
-| `findings[].basis` | `{a, d, n}` = peer agree/dispute/neutral counts (raiser's own vote excluded when a raiser is known). |
+| `findings[].basis` | `{a, d, n}` = peer agree/dispute/neutral counts (the raiser's own vote is excluded when a raiser is known). **v4.8: the exclusion is seat-conditional.** When the vote *and* the finding both carry a seat id the engine excludes by **seat**, so a twin's real vote on its twin's finding now counts; otherwise it falls back to excluding by **alias**, exactly as before. Consequence on a bench that repeats an alias: findings move tier in **both** directions — a lone twin corroboration promotes `Singleton → Confirmed` and `thin → solid`, and a twin *dispute* can demote `Confirmed → Contested` or `Contested → Disputed`. ⚠️ **v4.8: the seat comparison decides first, and it no longer needs a known raiser.** When the vote *and* the finding both carry a seat id, that pair settles it however `raiser` reads: same seat means the raiser's own vote (excluded), different seats mean a real peer (counted). Only when the seats cannot decide does the raiser's name matter. ⚠️ **And when the raiser is *not* known, every vote whose `judge` is equally unidentifiable is excluded too.** An empty-string or missing `raiser` is not an identity, so a vote with an empty-string or missing `judge` cannot be told apart from the raiser's own and does not count as peer signal; every **named** judge still counts. Together these close the case where a finding's own raiser voted its finding up — a document with `raiser: ""` and a `judge: ""` vote used to score that vote into `basis`, and so did one whose vote carried the raiser's own seat id. Votes excluded because nobody could attribute them are announced in `unattributedPeerDrops` below; votes the seats attributed are not, because nothing about them is ambiguous. The tier can fall as a result — a finding whose only votes are unidentifiable is `Singleton`, not `Confirmed` or `Disputed`. |
 | `findings[].confidence` | `"thin"` when `a + d <= 1` (only one peer engaged), else `"solid"`. Thin-confidence findings are the ones Claude may override before Stage 4. |
 | `findings[].tierOverride` | `null` unless Claude recorded an override; shape `{from, to, reason}`. |
+| `findings[].raiserSeat` | **v4.8**, optional — echoed verbatim from the input finding (see the tally-input schema above). Absent unless the bench repeats an alias. |
+| `findings[].sameModelCorroboration` | **v4.8**, optional, `true` only — a warning stamp: after the seat-aware exclusion above, at least one *agreeing* peer of this finding shares the raiser's **alias**, i.e. the corroboration came from another seat of the same model and is not independent. Emitted only when true (never `false`), so a document without it is byte-identical to a pre-v4.8 one. ⚠️ **Alias-only, and it errs in both directions:** it *misses* `--models gpt-5,openai/gpt-5` (genuinely one model under two aliases — votes carry no `resolvedModel` to compare) and it *fires falsely* on a **split alias**, one alias whose two seats happened to resolve to different executables. The reliability ledger uses a different notion of identity for the same run — it treats `(alias, resolvedModel)` as the key — so the two documents can disagree about what "the same model" means. Treat the stamp as "worth a second look", never as proof. |
+| `findings[].unattributedPeerDrops` | **v4.8**, optional, integer `> 0` only — a count of the votes excluded from `basis` that the engine could not attribute to anyone. **Two shapes produce it.** (1) *Raiser named:* the alias fallback excluded a vote while exactly one side of the pair (the finding's `raiserSeat` or the vote's `seat`) carried a seat id and the other did not — a seat-less vote sharing the raiser's alias cannot be told apart from the raiser's own, so excluding it is the safe call **and** may be discarding a real twin's signal. (2) *Raiser not named:* the finding's `raiser` is empty or missing and so is the vote's `judge`, so the vote may be the unnamed raiser's own. ⚠️ **Neither shape includes a vote the seat ids settled.** When the vote and the finding both carry a seat id the engine knows whose vote it is, so excluding it *attributes* it rather than losing it and nothing is announced — this count is for genuine ambiguity only. Emitted only when `> 0`, so a document with no unattributable drop is byte-identical to a pre-v4.8 one. ⚠️ **On shape (1) this field announces the drop; it does not change it.** That vote was already excluded from `basis` before v4.8 and still is — deliberately, by owner ruling R2. ⚠️ **And shape (1) records a POSSIBLE loss, not an established one.** A seat-less vote sharing the raiser's alias is *either* a real twin's signal being discarded *or* the raiser's own vote being correctly excluded — the shape is defined by the engine not being able to tell, so it cannot also be read as knowing. Not being able to tell is precisely why the drop is **announced** rather than silently taken. SI-22.1 / SI-22.2 track that possibility, which this release does not close; they do not record a loss anyone has established. ⚠️ **On shape (2) the exclusion *is* the change**, and `basis` moves: those votes used to be counted, which let an unnamed raiser corroborate its own finding. It is not yet rendered anywhere. As of v4.8 T2.3 the only **artifacts** it reaches are the tally documents — `tally.json`, and `tally-provisional.json` on a debate run, which is the same `tally()` record written as an audit artifact before any debate leg launches. `verdict.js`'s findings literal is closed and does not copy it, so it never reaches `verdict.json`; `debate.json`'s findings rows are built from a separate closed literal, so it never reaches those either; and no renderer (`council report`, the Workspace matrix, the defense brief) displays it. ⚠️ It **is** present in memory, on the `byRaiser` rows `debate.js`'s `debateTargets` hands to the defense brief — the brief simply never prints it. |
 | `tierCounts` | Convenience totals across all findings — this is what `renderRecord`'s human-readable summary prints. |
 
 **The peers-only tier cascade** (`assignTier(a, d)` — exhaustive over all `(a, d)`):
@@ -638,9 +672,29 @@ A lone corroborating peer (`a=1, d=0`) ranks as **Confirmed (thin)** — it must
 a lone disputing peer (`a=0, d=1`, which is **Contested (thin)**). A 2-vs-2 split is **Contested**
 (large-bench tie), not Disputed — `d > a` is required for Disputed, not just `d >= 2`.
 
-**Ledger append.** Unless `--no-ledger`, `tally` writes one row per `meta.models` entry to
-`council-ledger.jsonl` (append-only, JSON Lines). Use `--no-ledger` for a re-tally that shouldn't
-double-count (e.g. re-running after fixing a malformed input). Two standing uses from the skill's
+**Ledger append.** Unless `--no-ledger`, `tally` writes one row per distinct
+(`model`, `resolvedModel`) pair on the bench to `council-ledger.jsonl` (append-only, JSON Lines).
+That is one row per `meta.models` entry on an ordinary bench, where every alias is unique and
+contributed exactly one joinable `runStats` row — but **not** when one alias was served by one
+executable across more than one seat (v4.8): `--models a,a` whose two seats resolved to the same
+executable writes **one** row, not two, and a chair that is also a bench seat writes one row when
+its chair leg and seat leg resolved to the **same** executable and **two** when they resolved to
+different ones. An alias whose seats resolved *differently* writes one row per executable, so no leg
+is erased. Two *distinct* aliases that share one resolution still write one row **each** — the
+collapse is per alias; it is `council stats` that aggregates them into one executable-keyed group.
+Use `--no-ledger` for a re-tally that shouldn't
+double-count (e.g. re-running after fixing a malformed input): a re-tally appends a second full set
+of rows, which **doubles the conformance histogram** in `council stats` (a tally — nothing divides
+it). It does **not** move the lifetime averages: a duplicated set of rows has the same mean as the
+original. Since v4.8 it no longer doubles `runs`/`low-N` either — those count distinct `meta.runId`
+values, and a re-tally of the same input carries the same one — so a harness that writes a
+**constant** `runId` across genuinely different runs will pin that group at `runs: 1` forever.
+⚠️ That holds only when `meta.runId` is a **non-empty string**. `council-tally.schema.json` declares
+it as a bare `string`, so `"runId": ""` is valid input, and an empty string is not an identity —
+each such row counts individually, so re-tallying *that* file still inflates `runs` and `low-N`.
+Measured on a one-model bench, three tallies of the same input: `runs` 1 → 2 → 3, with `low-N`
+clearing on the third. A numeric `runId` behaves identically; a real string stays pinned at 1.
+Two standing uses from the skill's
 optional elements (v2.2.0): **debate mode** tallies provisionally with `--no-ledger` after Stage 2
 and records only the final post-rebuttal tally, and **expert-lens runs** always pass `--no-ledger`
 (lens reviews aren't comparable to standard reviews, so they must not feed `stats`). This is
@@ -668,8 +722,14 @@ For each finding, `buildVerdict` looks up the matching decision by `id` and fold
 `applied` (default `false`), `duplicateOf` (default `null`), and `tierOverride` (decision's
 override wins over the tally record's, if both are present — the effective `tier` becomes
 `tierOverride.to` when an override exists). Everything else (`basis`, `confidence`,
-`adjudications`, `streetCred`, `runStats`, `tierCounts`) passes through from the tally record
-unchanged.
+`adjudications`, `raiserSeat`, `sameModelCorroboration`, `streetCred`, `runStats`, `tierCounts`)
+passes through from the tally record unchanged, and `meta.seats` is carried across as the
+top-level `seats`.
+
+⚠️ **`buildVerdict` is a closed projection, not a copy.** Both of its literals name every key they
+emit — the top level renames `meta.models` to `council`, and each finding is rebuilt from a fixed
+field list — so a key added to the tally record does **not** reach `verdict.json` until it is
+named here. That is why the v4.8 keys below each needed their own line.
 
 **Output schema** (`verdict.json`, schema v2 — independent of the tally record's own
 `schemaVersion`):
@@ -688,7 +748,7 @@ unchanged.
       "duplicateOf": null, "adjudications": [ "..." ],
       "decision": "accepted", "applied": true }
   ],
-  "streetCred": [ { "model": "gpt", "withSelf": 1, "peersOnly": 1 } ],
+  "streetCred": [ { "model": "gpt", "withSelf": 1, "peersOnly": 1, "seat": "gpt#1" } ],
   "runStats": [ "..." ],
   "tierCounts": { "Confirmed": 1, "Contested": 1, "Singleton": 1, "Disputed": 0 }
 }
@@ -698,6 +758,9 @@ unchanged.
 - `schemaVersion` — verdict-document schema version (currently `2`).
 - `type` — document-type discriminator; always `"council-verdict"` (council family v2 envelope).
 - `overallVerdict` — the chair's verdict-scale outcome: one of `"Ship it"`, `"Fix these first"`, `"Fundamental rethink"`, or `null` when no chair verdict was produced (populated by the headless engine during Stage 3; `null` for a plain `council verdict` merge without engine integration).
+- `seats` — **v4.8**, optional. The tally record's `meta.seats` (same `{id, alias, role, lens, position}` shape), promoted to the top level next to `seatLoss`. Present only when the tally record carried one, i.e. only when the bench repeated an alias. It is what makes the `alias#N` ids on `findings[].raiserSeat`, `adjudications[].seat` and `runStats[].seat` resolvable from the verdict **alone** — before v4.8 the verdict named seats it could not resolve. `council report` reads it to give each seat its own adjudication-matrix column; when it is absent, or is not an array of objects each carrying a string `id`, the **adjudication matrix** falls back to alias space whole and renders exactly as it did before v4.8. ⚠️ **That fallback is the matrix's alone — it is not a whole-document guarantee.** The street-cred table beside it labels each row from `streetCred[].seat` whenever the row carries one, a predicate independent of this key, so a verdict with seated `streetCred[]` rows and no usable `seats` renders seat ids in the street-cred table and aliases in the matrix (measured on an absent `seats`, a non-array `seats`, and an array-of-strings `seats`). In-process both fields come from the same twin bench and travel together; the split is reachable on a hand-assembled or externally-supplied record, which `buildVerdict`'s own docblock names. A verdict written before v4.8 carries no `streetCred[].seat` at all and is unaffected.
+- `findings[].raiserSeat` — **v4.8**, optional. The raising seat's id, carried through from the tally record; absent unless the bench repeated an alias. `findings[].raiser` stays the alias.
+- `findings[].sameModelCorroboration` — **v4.8**, optional, `true` only. Carried through from the tally record; see the tally-record notes above for the stamp's meaning **and for the two directions in which it is wrong** (it misses one model behind two aliases, and it fires falsely on one alias behind two executables).
 - All other keys (`runId`, `council`, `findings`, `streetCred`, `runStats`, `tierCounts`) are passed through unchanged from the tally record.
 
 **Write path:** always atomic — a `<out>.tmp-<pid>` file is written first, then renamed over the
@@ -735,7 +798,8 @@ amicus council report <verdict.json> [--wave <wave.json>] [--md|--html]
 Pure renderer — reads `verdict.json` (+ optional `wave.json`, used only to source the wave's total
 cost) and produces **one self-contained string**: Markdown (default) or a self-contained HTML page
 (`--html`). No scoring, no anonymization, no synthesis — those already happened upstream. Thin CLI
-wrapper over `buildReport()` (`src/council/report.js` / `report-html.js`).
+wrapper over `buildReport()` (`src/council/report.js`, which builds the neutral model and
+dispatches to `report-md.js` / `report-html.js` — the two renderers that own the string formats).
 
 **What it renders**, in this order: a header (run type, id, date, chair, council members), a
 verdict-summary tier-count table, the **adjudication matrix** (finding × judge, `✓`/`✗`/`–` with
@@ -743,6 +807,84 @@ verdict-summary tier-count table, the **adjudication matrix** (finding × judge,
 tier** (Disputed first), and a **cost table** (per-model status/duration/cost + wave total,
 sourced from `runStats[].usage`).
 
+⚠️ **v4.8 — on a bench that repeats an alias, the matrix is keyed by SEAT.** When `verdict.json`
+carries a `seats` table the columns are titled `deepseek#1` / `deepseek#2` rather than two
+identical `deepseek` headers, the Raiser cell names the raising **seat**, and the `*` marks that
+seat's column only — so exactly one of two same-alias columns carries it. This is a bug fix as
+much as a rename: the old alias key was **last-wins**, so the second seat's vote overwrote the
+first's and a finding whose `basis` was `a0/d1` could render as two agreements, both starred. Now
+the rendered row and the finding's `basis` agree. **Benches with no repeated alias are
+byte-identical to v4.7** — every seat id there *is* its alias, so nothing in the document differs
+and nothing in the render does either. A verdict with no `seats` table renders its **matrix** in
+alias space exactly as it always has — including anything written before v4.8, which carries no
+seat fields at all. ⚠️ **The street-cred table below the matrix is not covered by that sentence.** Its row labels
+come from `streetCred[].seat`, never from `seats`, so a hand-assembled verdict carrying seated
+street-cred rows without a usable `seats` table shows `deepseek#1`/`deepseek#2` there while the
+matrix stays in alias space. See the `seats` key note in the verdict-document schema above.
+
+⚠️ **v4.8 — the `UNATTRIBUTED` column.** A vote the matrix cannot attribute to a column is no
+longer dropped from the render. The vote→column join **refuses** a key that identifies nothing — an
+empty string, a missing or non-string `judge`, or a seat id or alias that names no column on the
+bench — and folds every such vote into one extra column, headed `UNATTRIBUTED` and placed last
+among the judge columns. This closes the gap this section used to disclose: a judge whose Stage-2
+leg never bound to its seat emits no `adjudications[].seat`, so in seat space its vote keys to a
+bare alias no column reads. Before v4.8 that vote counted in `basis` and rendered nowhere; now it
+counts in `basis` **and** renders.
+
+- **`basis` does not move.** This is a rendering change only — such a vote was always counted and
+  still is. It is the same property the seat re-key above exists for: what the row shows and what
+  `basis` says now agree.
+- **The column appears only when a vote actually folds.** A document in which every vote is
+  attributable renders exactly as it did before — no extra column, and never an empty one.
+- ⚠️ **Read the header as “no column on this bench”, not “nobody knows who voted”.** The rule the
+  renderer applies is about the **column**, not the voter: a vote lands here when its key names no
+  column on *this document's* bench. Usually that also means the voter is unidentifiable — but not
+  always. A vote whose `judge` names a model the report deliberately keeps off the bench folds here
+  too, with its `judge` field intact in the document. The column says *this vote had nowhere to go*.
+- **Every folded vote on one finding shares one cell, last-wins.** One column is the deliberate
+  design — it records a fact about the document, not one per voter — so two folded votes on the same
+  finding collapse to the later one's verdict. What tells them apart is a seat id, and supplying one
+  is a producer-side fix, not a rendering one.
+- **The Council Workspace matrix applies the same refusal**, over the `tally.json` roster described
+  in the paragraph below. The two are deliberately separate implementations rather than a shared
+  module, and they are held in agreement by an exhaustive cross-product test rather than by
+  construction. ⚠️ **One known exception, disclosed rather than fixed:** on a
+  `--claude-review` run the report filters the reserved `claude` seat off its bench while the
+  Workspace keeps it, so a hand-authored `judge: "claude"` vote folds to `UNATTRIBUTED` in the
+  report and lands in the `claude` column in the Workspace. No engine run emits such a vote. The
+  two rosters are built from different sources, and reconciling them is deliberately out of scope
+  here.
+- ⚠️ **One residual, disclosed rather than fixed:** if a bench seat is *literally* named
+  `UNATTRIBUTED`, no extra column is added and folded votes land in that seat's own column. Nothing
+  reserves the name, so this is reachable only by naming a seat that way on purpose.
+- This is **not** the same thing as `findings[].unattributedPeerDrops` in the tally-record schema
+  above. That field counts votes the *peer filter* excluded from `basis` on the raiser side, and
+  ruling R2 deliberately leaves those excluded; this column renders a vote that
+  **is** in `basis` but had no column to land in. Different mechanism, different document, opposite
+  effect on `basis`.
+
+In the Council Workspace the same matrix is built from `tally.json` (via `tally.meta.seats`) and
+behaves identically, with one deliberate difference: it keeps rendering the blank `claude` column
+that the report filters out. **Blind mode never renders a seat id** — a seat id contains its
+alias, so both twins collapse to `Review A` there, exactly as before v4.8. Its legend is worded
+`* raiser` where the report's reads `` `*` raiser's own vote ``; the two say the same thing, and
+both now refer to the raiser's seat. The report's legend gains a **second** line the Workspace
+matrix does not carry — `` `†` `` marks a finding corroborated only by another seat running the
+same model — so from v4.8.0 the two legends are no longer interchangeable. That line, and the `†`
+itself, appear only on a run that actually raised such a finding, which is a twin bench only.
+
+⚠️ **v4.8 — a SECOND report/Workspace divergence, in the street-cred table, filed not fixed.** The
+sentence above is scoped to the **matrix**, and stays true. The street-cred table is a different
+story: both renderers (`report-md.js`, `report-html.js`) label each row `seat || model`, so a twin
+bench reads `gemini#1` / `gemini#2`, while the Workspace's street-cred table still labels from the
+model alias
+and reads `gemini` twice with different numbers under one identical name. **On a bench that repeats
+an alias the two street-cred tables now disagree**; on any bench with no repeated alias they are
+identical, because every seat id there *is* its alias. The report side is the corrected one. The
+Workspace side is not a one-liner — its blind mode resolves the label through `opts.labelOf(...)`,
+which would have to accept a seat id first — and is filed in `BACKLOG.md` for v4.9 with that
+signature change as its gate.
+
 This is the same renderer the `second-opinion` skill calls in Stage 5 to produce `report.html`.
 **`report.md` and this renderer's output are two different files** — `report.md` is Claude-authored
 prose that includes a copy of this renderer's Markdown as one section, not this renderer's own
@@ -955,6 +1097,11 @@ _Legend: ✓ agree · ✗ dispute · – neutral · `*` raiser's own vote_
 | **Wave total** | | | $0.0900 |
 ```
 
+This bench's two aliases are distinct, so its matrix and legend are byte-for-byte what every
+pre-v4.8 run produced. On a bench that **repeats** an alias the columns split by seat
+(`deepseek#1` / `deepseek#2`) and the legend's `*` marks the raiser's **seat** — see "What it
+renders" above.
+
 **6. Stats** — after this run's `tally` call appended to the ledger:
 
 ```bash

package/docs/doc-system.md

@@ -62,7 +62,7 @@ No plans index is generated **today**. `buildPlansIndex()` in `scripts/generate-
 never fires. Note that guard is a runtime `fs.existsSync` check, not a disabled feature: creating
 `docs/plans/` would silently reactivate it, emitting a bare list of `- [name](path)` links without
 the per-plan first heading or date the old text here promised. Plans actually live in
-`docs/superpowers/plans/`, uncataloged.
+`docs/superpowers/plans/`, which are working documents pruned at each release cut — specs in `docs/superpowers/specs/` are the permanent record.
 
 ## Commands
 

package/docs/publishing.md

@@ -58,3 +58,5 @@ Run top-to-bottom before `npm version`:
 5. Bump `.claude-plugin/plugin.json` `version` to match `package.json` (no script syncs it). Also bump `server.json` — both `.version` and `.packages[0].version` — to the same value (no script syncs this either). Also bump the `status --json` **example blocks** in `README.md` and `docs/usage.md` (`"version": "x.y.z"`) — they are drift-test-pinned to `package.json` by `tests/docs-quick-sync.test.js` and have now missed the cut twice (v2.1.0 and v2.2.0).
 6. Update `CHANGELOG.md` (move Unreleased → the new version).
 7. `npm version <x.y.z> --no-git-tag-version` + plugin.json lockstep + server.json lockstep (`.version` and `.packages[0].version`), single `chore(release): vX.Y.Z` commit, then push main + tag (publish.yml does the rest — see the canonical ritual in Phase 2 of the 2026-07-01 review-execution plan). If you forget the server.json bump, `tests/scripts/package-manifest.test.js` fails the suite (`server.json versions stay in lockstep with package.json`) — that's your safety net, but don't rely on it; do the bump.
+
+- [ ] **Prune the rev's plan docs.** Delete `docs/superpowers/plans/*` belonging to this release in the release-cut commit. Specs in `docs/superpowers/specs/` are permanent and stay. Plans are working documents — they are committed on-branch so they cannot be silently rewritten mid-build, and removed at the cut so `main` never accumulates prescriptions that are false the moment they ship. Git history remains the audit trail. `npx jest tests/docs-plan-refs.test.js` fails if anything still cites a specific plan.

package/docs/troubleshooting.md

@@ -233,15 +233,15 @@ For full headless configuration, see [docs/configuration.md](./configuration.md)
 
 ## Headless Leg Fails with `NO_OUTPUT_BACKSTOP`
 
-**Symptom:** A headless leg (`amicus start --no-ui`, or one leg of a `fanout`/council run) fails with an error starting `NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in Ns — the AMICUS_NO_OUTPUT_BACKSTOP_MS window (0 disables)`. You may instead see `...in Ns — a caller-set window overriding the AMICUS_NO_OUTPUT_BACKSTOP_MS default` — this covers two different cases with the same wording: a Stage-1 retry (its window is the resolved `AMICUS_NO_OUTPUT_BACKSTOP_MS` value **doubled**, so a 120 s default reads `240s` on the retry) and the `amicus models --check --live` probe (a fixed, non-tunable `30s` — see below). Both are "caller-set" in the sense that the specific window wasn't read live from the env var at that call, but only the retry case is actually governed by it.
+**Symptom:** A headless leg (`amicus start --no-ui`, or one leg of a `fanout`/council run) fails with an error starting `NO_OUTPUT_BACKSTOP: no output, reasoning, or tool calls in Ns — the AMICUS_NO_OUTPUT_BACKSTOP_MS window (0 disables)`. You may instead see `...in Ns — a caller-set window overriding the AMICUS_NO_OUTPUT_BACKSTOP_MS default` — this covers two different cases with the same wording: a Stage-1 retry (its window is the resolved `AMICUS_NO_OUTPUT_BACKSTOP_MS` value **doubled**, so a 300 s default reads `600s` on the retry) and the `amicus models --check --live` probe (a fixed, non-tunable `30s` — see below). Both are "caller-set" in the sense that the specific window wasn't read live from the env var at that call, but only the retry case is actually governed by it.
 
-**Cause:** The mechanism only knows that the deadline passed with no substantive activity — no output, reasoning, or tool calls — for the backstop window (120 s by default for an ordinary leg). It does **not** know *why*. Do not read this as "the endpoint is dead" or "the model isn't being served" — the message deliberately stops short of that claim, because at one of its two firing sites the backstop can win the race before the prompt send even resolves, so acceptance itself was never observed. Treat `NO_OUTPUT_BACKSTOP` as "silence past the deadline," not a diagnosis.
+**Cause:** The mechanism only knows that the deadline passed with no substantive activity — no output, reasoning, or tool calls — for the backstop window (300 s by default for an ordinary leg). It does **not** know *why*. Do not read this as "the endpoint is dead" or "the model isn't being served" — the message deliberately stops short of that claim, because at one of its two firing sites the backstop can win the race before the prompt send even resolves, so acceptance itself was never observed. Treat `NO_OUTPUT_BACKSTOP` as "silence past the deadline," not a diagnosis.
 
 **Lesson from #133:** an earlier version of this message *did* guess a cause ("likely a listed-but-not-serving model or a dead endpoint"), and that guess sent 30 minutes of debugging at model ids and API keys on a real incident. The actual cause was an OpenCode engine version skew between the npx-cached copy and the global install — sitting the whole time in `~/.local/share/opencode/log/opencode.log`. **Before chasing model/endpoint theories, check that log for the session's real error.**
 
 **Confirm:** `amicus models --check` — audits your configured aliases against the live catalog and flags drift/staleness. A model that still resolves locally but has quietly been retired upstream is one possible explanation, but a static audit only compares against the catalog's *listing* — it can't tell you whether a still-listed model actually answers. For that, run `amicus models --check --live` on demand: it sends one tiny real request to every stored alias and reports `SERVED` / `SILENT` / `ERROR` per alias, where `SILENT` (`accepted-but-silent`) is this exact `NO_OUTPUT_BACKSTOP` failure, caught deliberately instead of by accident. It spends real money (one tiny leg per stored alias) — see [docs/usage.md § `amicus models`](./usage.md#amicus-models--the-model-catalog) for cost, scope, and exit-code details.
 
-**Fix:** Check the `~/.local/share/opencode/log/opencode.log` for the session's real error first (see #133 above). Then check the alias's target (`amicus models --search <term>` to find the current id, then re-point the alias) — a stale alias is a common case, but not the only one. If the failing leg was a Stage-1 retry (the window read `240s`, or generally double your configured/default value), `AMICUS_NO_OUTPUT_BACKSTOP_MS` **is** the lever — raising it raises both the first attempt's window and the retry's doubled one, unless your `--timeout` is low enough that the doubled window is clamped to the leg timeout. On an ordinary (non-retry) leg, raise it only if a model legitimately needs more than 120 s to produce its first token. The live probe's fixed 30 s window is the one case the env var genuinely cannot touch. See [docs/configuration.md § Headless Poller Tuning](./configuration.md#headless-poller-tuning).
+**Fix:** Check the `~/.local/share/opencode/log/opencode.log` for the session's real error first (see #133 above). Then check the alias's target (`amicus models --search <term>` to find the current id, then re-point the alias) — a stale alias is a common case, but not the only one. If the failing leg was a Stage-1 retry (the window read `600s`, or generally double your configured/default value), `AMICUS_NO_OUTPUT_BACKSTOP_MS` **is** the lever — raising it raises both the first attempt's window and the retry's doubled one, unless your `--timeout` is low enough that the doubled window is clamped to the leg timeout. On an ordinary (non-retry) leg, raise it only if a model legitimately needs more than 300 s to produce its first token. The live probe's fixed 30 s window is the one case the env var genuinely cannot touch. See [docs/configuration.md § Headless Poller Tuning](./configuration.md#headless-poller-tuning).
 
 ---
 

package/docs/usage.md

@@ -403,7 +403,7 @@ Each stored alias resolves to one of three outcomes:
 | Outcome | Example line | Meaning |
 |---------|--------------|---------|
 | `SERVED` | `SERVED: gemini -> openrouter/google/gemini-3.6-flash ($0.0004)` | The model answered; cost shown in parens. |
-| `SILENT` (`accepted-but-silent`) | `SILENT: probetest -> anthropic/claude-opus-4-8 — NO_OUTPUT_BACKSTOP: … (accepted but not serving)` | The endpoint accepted the request but produced nothing for the probe's 30 s backstop window (shorter than the ordinary 120 s default, and not tunable) — the exact "listed but not actually serving" failure this check exists to catch. |
+| `SILENT` (`accepted-but-silent`) | `SILENT: probetest -> anthropic/claude-opus-4-8 — NO_OUTPUT_BACKSTOP: … (accepted but not serving)` | Nothing arrived at all within the probe's 30 s backstop window — shorter than the ordinary 300 s leg default, and not tunable. ⚠️ `accepted-but-silent` is the CLASSIFICATION's name, not a proven fact about the endpoint: a fired backstop shows only that no output, reasoning or tool call arrived in the window, which a stalled gateway or a dropped connection produces just as readily as a model that accepted and then said nothing. Either way it is the "listed but not actually serving" failure this check exists to catch. |
 | `ERROR` | `ERROR:  gpt -> openai/gpt-5.6-terra — 402 Payment Required` | Routing, auth, or provider failure; the raw error is printed. |
 
 **Exit code.** The probe's non-served count folds into the same exit code as the static audit — `max(existing exit, min(nonServedCount, 100))` — so a single `SILENT` or `ERROR` fails the check even when every alias is otherwise catalog-fresh. No stored aliases prints `Live probe: no stored aliases to probe` and never affects the exit code. `--json` adds `probe` (the per-alias array) and `probeCount` (its length) to the `alias-audit` document — both additive, `[]`/`0` when `--live` wasn't passed.
@@ -518,7 +518,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.7.1",
+  "version": "4.8.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/electron/ipc-setup.js

@@ -80,10 +80,26 @@ function registerSetupHandlers(getMainWindow, { ipcMain = require('electron').ip
   // Task 8: apply a per-provider default picker choice. Read-modify-write,
   // no-clobber -- applyProviderDefault only ever writes aliases[vendor] and
   // seeds config.default when absent (see provider-default-picker.js).
-  ipcMain.handle('sidecar:set-provider-default', (_event, provider, chosenId) => {
+  // Fetches the catalog before applying (issue 195): applyProviderDefault
+  // uses directFormIfProven (model-canonicalization.js) to decide whether to
+  // strip an OpenRouter prefix off chosenId, and needs the catalog to do it.
+  ipcMain.handle('sidecar:set-provider-default', async (_event, provider, chosenId) => {
+    let catalog = [];
+    try {
+      const { getCatalog } = require('../src/utils/model-catalog');
+      catalog = await getCatalog();
+    } catch (err) {
+      // Best-effort only -- a fetch failure leaves `catalog` empty, which
+      // directFormIfProven (F1, council review of PR 198) reads as NO
+      // evidence, never as license to strip: chosenId is persisted exactly
+      // as given, not re-derived. Applying an already-made picker choice
+      // must never abort on a catalog hiccup, and must never fabricate an
+      // id on one either -- that was the exact bug issue 195 fixed.
+      logger.error('set-provider-default catalog fetch error', { error: err.message });
+    }
     try {
       const { applyProviderDefault } = require('../src/utils/provider-default-picker');
-      return applyProviderDefault(provider, chosenId, { seedDefaultIfAbsent: true });
+      return applyProviderDefault(provider, chosenId, { seedDefaultIfAbsent: true, catalog });
     } catch (err) {
       logger.error('set-provider-default handler error', { error: err.message });
       return { success: false, error: err.message };

package/electron/main.js

@@ -327,11 +327,24 @@ function createAmicusWindow() {
 async function createSetupWindow() {
   // Lazy-load setup UI to avoid loading it for sidecar mode
   const { buildSetupHTML } = require('./setup-ui');
-  const { resolveQuickPicks } = require('../src/utils/quick-picks');
+  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
   let quickPicks;
+  const shortlists = {};
   try {
     const catalog = await require('../src/utils/model-catalog').getCatalog();
     quickPicks = resolveQuickPicks(catalog);
+
+    // issue 138: one vendor shortlist per family card, resolved server-side from
+    // the same catalog the quick picks came from (no extra IPC round-trip).
+    const { buildModelShortlist } = require('../src/utils/model-shortlist');
+    for (const p of quickPicks) {
+      try {
+        shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
+          catalog,
+          recommendedId: toStorableRoute(p),
+        });
+      } catch (_e) { /* a shortlist failure must never block the wizard */ }
+    }
   } catch (_err) {
     quickPicks = undefined;  // buildSetupHTML falls back to pinned
   }
@@ -348,7 +361,7 @@ async function createSetupWindow() {
     }
   });
 
-  const html = buildSetupHTML({ client: CLIENT, quickPicks });
+  const html = buildSetupHTML({ client: CLIENT, quickPicks, shortlists });
   mainWindow.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(html)}`);
   mainWindow.webContents.on('page-title-updated', (e) => e.preventDefault());
 
@@ -499,6 +512,36 @@ registerSetupHandlers(() => mainWindow);
 function createSettingsChildWindow() {
   const { buildSetupHTML } = require('./setup-ui');
 
+  // issue 138: mirror createSetupWindow's catalog resolution so Step 2 shows
+  // live per-model options here too, instead of falling back to the pinned
+  // `[offline list]` badge. This window must stay synchronous (opening
+  // Settings must never trigger a network fetch), so read the on-disk cache
+  // directly with readCache() rather than the async fetch-and-refresh helper
+  // createSetupWindow awaits. A missing or corrupt cache reads back as null
+  // and degrades to the same pinned fallback buildSetupHTML already applies
+  // when no quickPicks are given.
+  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
+  const { readCache } = require('../src/utils/model-catalog');
+  let quickPicks;
+  const shortlists = {};
+  try {
+    const cacheDoc = readCache();
+    const catalog = cacheDoc ? cacheDoc.models : [];
+    quickPicks = resolveQuickPicks(catalog);
+
+    const { buildModelShortlist } = require('../src/utils/model-shortlist');
+    for (const p of quickPicks) {
+      try {
+        shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
+          catalog,
+          recommendedId: toStorableRoute(p),
+        });
+      } catch (_e) { /* a shortlist failure must never block the wizard */ }
+    }
+  } catch (_err) {
+    quickPicks = undefined;  // buildSetupHTML falls back to pinned
+  }
+
   const settingsWin = new BrowserWindow({
     width: 560, height: 680,
     parent: mainWindow, modal: false,
@@ -512,7 +555,7 @@ function createSettingsChildWindow() {
     }
   });
 
-  const html = buildSetupHTML({ client: CLIENT });
+  const html = buildSetupHTML({ client: CLIENT, quickPicks, shortlists });
   settingsWin.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(html)}`);
   settingsWin.webContents.on('page-title-updated', (e) => e.preventDefault());
 }

package/electron/setup-ui-aliases.js

@@ -5,7 +5,7 @@
  * delete, and add functionality for the setup wizard Step 3.
  */
 
-/** Grouping metadata for the 19 default aliases */
+/** Grouping metadata for the 21 default aliases */
 const ALIAS_GROUPS = [
   { name: 'Gemini', keys: ['gemini', 'gemini-pro'] },
   { name: 'GPT', keys: ['gpt', 'gpt-pro', 'codex'] },
@@ -13,7 +13,7 @@ const ALIAS_GROUPS = [
   { name: 'DeepSeek', keys: ['deepseek'] },
   { name: 'Qwen', keys: ['qwen', 'qwen-coder', 'qwen-flash'] },
   { name: 'Mistral', keys: ['mistral'] },
-  { name: 'Other', keys: ['glm', 'minimax', 'grok', 'kimi', 'seed'] },
+  { name: 'Other', keys: ['glm', 'minimax', 'grok', 'kimi', 'seed', 'inkling'] },
 ];
 
 /**