amicus 4.7.1 → 4.8.1

package/electron/workspace-ui/workspace-app.js

@@ -167,47 +167,12 @@
     V.startLiveLoop();
   }
 
-  function renderBanners() {
-    var d = state.detail;
-    var R = window.AmicusRender;
-    if (!d.derived.schemaSupported) {
-      R.renderBanner($('banner'), 'This run was written by a different amicus version (schemaVersion ' +
-        d.run.schemaVersion + ') — artifacts: ' + d.runDir, 'warn');
-      return;
-    }
-    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): two distinct bench
-    // entries that sanitize to the same artifact name (src/workspace/artifact-guard.js's
-    // artifactAllowlist) mean this run directory cannot hold both models' review/judge files
-    // under distinct names — drillIntoJudge's artifact lookup would otherwise silently
-    // misattribute one model's prose to the other. This is a run-integrity defect the user
-    // must see, not a display quirk to smooth over — surfaced ahead of the run.error/reason
-    // banner below since it calls into question every judges-panel section's attribution.
-    if (d.derived.artifactCollisions && d.derived.artifactCollisions.length) {
-      var c = d.derived.artifactCollisions[0];
-      R.renderBanner($('banner'),
-        'Run integrity error: bench entries ' + c.models.join(' and ') + ' both sanitize to "' + c.sanitized +
-        '" — this run directory cannot distinguish their artifacts, so prose below may be misattributed.', '');
-      return;
-    }
-    // ⚠️ PRE-FLIGHT (P3), caught live by the CDP e2e (Task 18): gating on `d.run.error` ALONE
-    // never shows this banner for a `status:'partial'` run — `finalize()` only ever sets
-    // `run.error` on the exit-1 path (src/council/run.js:98-100); the exit-2 "degraded" path
-    // leaves it null (run-detail.js:83-91). `verdictPanel.reason` (degradedReason()) already
-    // covers BOTH cases — exit-1's {code, message} and the partial-run stage-failure/skip
-    // sentence — so check for either signal, not run.error alone.
-    if (d.run.error || d.derived.verdictPanel.reason) {
-      // ⚠️ Code review round 2, finding 2: `d.run.error` is a structured {code, message} object
-      // (never a string) — passing it straight to renderBanner set `textContent = <object>`,
-      // which coerces to the literal string "[object Object]". `d.derived.verdictPanel.reason`
-      // is already the correctly-formatted string (run-detail.js's degradedReason(): "CODE:
-      // message" on the exit-1 path, or a stage-failure/skip sentence otherwise) — reuse it
-      // rather than re-deriving the same formatting a second time here.
-      R.renderBanner($('banner'), d.derived.verdictPanel.reason || 'Run reported an error',
-        d.run.status === 'error' ? '' : 'warn');
-      return;
-    }
-    R.renderBanner($('banner'), null);
-  }
+  // ⚠️ v4.8 PR5a fix-wave 3: the banner ladder moved to workspace-banners.js — this file
+  // hit 310/300 when the orphan-collision and rejected-seat-table banners landed, the same
+  // gate that produced workspace-lazy.js out of workspace-panels.js (v4.7 PR7). Kept as a
+  // named delegate, not deleted: `window.AmicusApp.renderBanners` is a shipped entry point
+  // (workspace-verbs.js:216 calls it after an abort) and boundary tests assert it exists.
+  function renderBanners() { window.AmicusBanners.render(); }
 
   // ---- blind toggle + keyboard ------------------------------------------
   $('blind-toggle').addEventListener('change', function (e) {

package/electron/workspace-ui/workspace-banners.js

@@ -0,0 +1,95 @@
+/**
+ * Council Workspace — the run-detail banner ladder (v4.4 §9, spec's "graceful when present").
+ *
+ * v4.8 PR5a fix-wave 3 extraction of renderBanners out of workspace-app.js, which hit
+ * 310/300 when the orphan-collision and rejected-seat-table banners landed. Exactly the
+ * treatment workspace-panels.js got in v4.7 PR7 (workspace-lazy.js) and v4.6.2 PR4
+ * (workspace-seats.js), on the same gate and the same kind of seam.
+ *
+ * Split line: this file decides WHICH single banner a run shows and what it says.
+ * workspace-app.js keeps `state`, the IPC calls and the render orchestration;
+ * workspace-render.js keeps renderBanner(), the DOM write itself.
+ *
+ * ⚠️ ONE banner, first match wins — every branch returns. That is not incidental: the
+ * element is a single node (workspace-render.js sets `textContent`), so a second call would
+ * overwrite the first. The ORDER is therefore the ranking, most-alarming first, and each
+ * branch below states why it sits where it does. Cross-calls resolve `window.Amicus*` at
+ * CALL time, never at this file's load time — the house discipline for every renderer script.
+ */
+(function () {
+  'use strict';
+
+  function render() {
+    var A = window.AmicusApp;
+    var d = A.state.detail;
+    var R = window.AmicusRender;
+    var el = A.$('banner');
+    if (!d.derived.schemaSupported) {
+      R.renderBanner(el, 'This run was written by a different amicus version (schemaVersion ' +
+        d.run.schemaVersion + ') — artifacts: ' + d.runDir, 'warn');
+      return;
+    }
+    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): two distinct bench
+    // entries that sanitize to the same artifact name (src/workspace/artifact-guard.js's
+    // artifactAllowlist) mean this run directory cannot hold both models' review/judge files
+    // under distinct names — drillIntoJudge's artifact lookup would otherwise silently
+    // misattribute one model's prose to the other. This is a run-integrity defect the user
+    // must see, not a display quirk to smooth over — surfaced ahead of the run.error/reason
+    // banner below since it calls into question every judges-panel section's attribution.
+    // ⚠️ Fix-wave 3 (council-3 A1): TWO DIFFERENT FACTS, two sentences. The orphan case is
+    // not a sanitize collision and must not borrow its wording — `a#1` and `a-1` do NOT
+    // sanitize to the same name; an orphaned leg wrote a file under its own alias whose stem
+    // happens to BE another seat's artifact name. PR5a added the `orphan` flag
+    // (artifact-names.js) and shipped no consumer, so every orphan collision rendered a
+    // sentence that was simply untrue about the run.
+    // ⚠️ And EVERY entry is rendered, not `[0]`. One stem can legitimately produce two
+    // entries — MEASURED on a legacy bench: ['vendor/a','vendor?a'] with a 'vendor?a' orphan
+    // emits a sanitize entry AND an orphan entry for stem 'vendor-a'. Different causes, same
+    // consequence, so both are stated rather than merged: a merge has to drop one cause.
+    if (d.derived.artifactCollisions && d.derived.artifactCollisions.length) {
+      var clauses = d.derived.artifactCollisions.map(function (c) {
+        // `models` on an orphan entry is [owning entity, orphan alias] — both CLAIMANTS of
+        // the stem (artifact-names.js states why the orphan half is not projected into
+        // entity space). On a sanitize entry it is the two raw bench values.
+        return c.orphan
+          ? 'the artifact name "' + c.sanitized + '" is claimed by both ' + c.models.join(' and ') +
+            ' — an orphaned leg wrote a file under its own alias and run.json cannot say which owns it'
+          : 'bench entries ' + c.models.join(' and ') + ' both sanitize to "' + c.sanitized + '"';
+      });
+      R.renderBanner(el, 'Run integrity error: ' + clauses.join('; ') +
+        '. This run directory cannot distinguish those artifacts, so prose below may be misattributed.', '');
+      return;
+    }
+    // ⚠️ Fix-wave 3 (council-3 C2): seats[] was present but malformed, so the whole run fell
+    // back to alias space — two seats running one model are indistinguishable in every panel
+    // below. Fail-safe, but SILENT until now, which the product principle rejects as hard as
+    // a crash. Ranked AFTER the collision banner (that one says prose may be misattributed,
+    // strictly worse) and BEFORE run.error, since it qualifies how to read every panel.
+    if (d.derived.seatTableRejected) {
+      R.renderBanner(el, 'This run\'s seat table could not be read (a malformed entry), so ' +
+        'artifacts are shown by model alias instead of per seat — two seats running the same ' +
+        'model cannot be told apart below. Artifacts: ' + d.runDir, 'warn');
+      return;
+    }
+    // ⚠️ PRE-FLIGHT (P3), caught live by the CDP e2e (Task 18): gating on `d.run.error` ALONE
+    // never shows this banner for a `status:'partial'` run — `finalize()` only ever sets
+    // `run.error` on the exit-1 path (src/council/run.js:98-100); the exit-2 "degraded" path
+    // leaves it null (run-detail.js:83-91). `verdictPanel.reason` (degradedReason()) already
+    // covers BOTH cases — exit-1's {code, message} and the partial-run stage-failure/skip
+    // sentence — so check for either signal, not run.error alone.
+    if (d.run.error || d.derived.verdictPanel.reason) {
+      // ⚠️ Code review round 2, finding 2: `d.run.error` is a structured {code, message} object
+      // (never a string) — passing it straight to renderBanner set `textContent = <object>`,
+      // which coerces to the literal string "[object Object]". `d.derived.verdictPanel.reason`
+      // is already the correctly-formatted string (run-detail.js's degradedReason(): "CODE:
+      // message" on the exit-1 path, or a stage-failure/skip sentence otherwise) — reuse it
+      // rather than re-deriving the same formatting a second time here.
+      R.renderBanner(el, d.derived.verdictPanel.reason || 'Run reported an error',
+        d.run.status === 'error' ? '' : 'warn');
+      return;
+    }
+    R.renderBanner(el, null);
+  }
+
+  window.AmicusBanners = { render: render };
+})();

package/electron/workspace-ui/workspace-lazy.js

@@ -132,8 +132,34 @@
       });
       lastWiredRunId = A.state.detail.runId;
     }
-    var bench = A.state.detail.run.bench || [];
-    var debated = !!A.state.detail.run.debate;
+    // ⚠️ Fix-wave (council A1): CAPTURED here, at wire time, exactly like `bench` and
+    // `debated` have always been — never re-read inside roster(). The `files` closures below
+    // are invoked LATER (on first panel open, and again on every same-run rewire), by which
+    // point `A.state.detail` may be a different payload entirely: an unreadable run, whose
+    // detail carries `error` and no `run` at all. Reading `A.state.detail.run.seats` at that
+    // moment threw — a crash path the bench-iteration code it replaced never had, because
+    // `bench` was already a local. Capturing also stops roster() from returning run B's
+    // seats while `debated` still describes run A.
+    var detail = A.state.detail;
+    var run = detail.run || {};
+    var bench = run.bench || [];
+    var debated = !!run.debate;
+    // ⚠️ Fix-wave (council B1): the seat-space decision is NOT re-derived here. It is
+    // isSeatTable(run.seats) — the same predicate artifactAllowlist gates on — computed in
+    // src/workspace/run-detail.js and shipped as its answer. `!seats || !seats.length`, the
+    // check this replaces, is strictly weaker: it accepts a seats[] with duplicate, empty or
+    // non-string ids that isSeatTable rejects, so a malformed table put derived.artifactsByModel
+    // in ALIAS space while this roster handed resolveArtifactName SEAT ids. Every lookup
+    // missed, resolveArtifactName returned null, present(null) dropped every row, and all
+    // three panels rendered empty with no banner and no error. Absent (a pre-fix detail
+    // payload) reads as alias space, which is the space such a payload's map is keyed in.
+    var seatSpace = !!(detail.derived && detail.derived.seatSpace);
+    // ⚠️ Fix-wave 2 (council-2 A2): captured for the same reason `run` is. renderDetail
+    // REBUILDS state.labelByModel per run (workspace-app.js:147-148), so a closure that
+    // read it live could pair THIS run's keys with the NEXT run's labels — and this map
+    // is what blind mode renders, so the failure is a wrong name shown confidently
+    // rather than a visibly empty panel.
+    var labels = A.state.labelByModel;
     // ⚠️ CODE REVIEW (round 2, finding 2): readRunArtifact's error for a genuinely-missing
     // artifact is NOT translated into a friendly "not written yet" note anywhere in this
     // read path — it lands in the panel verbatim, absolute host path and all. `run.debate` is
@@ -146,15 +172,34 @@
     // files. Applies to review-/judge- too (the same latent gap, just plan-mandated rather
     // than new).
     var artifacts = A.state.detail.artifacts || {};
-    function present(name) { return !!(artifacts[name] && artifacts[name].present); }
+    function present(name) { return !!(name && artifacts[name] && artifacts[name].present); }
+    // ⚠️ v4.8 PR5a T2: iterate SEATS, not the bench. A repeated alias appears twice in
+    // `bench`, so these loops used to build two identical rows that resolved to one
+    // alias-named file and were then both dropped by present() — the whole issue-137
+    // Workspace symptom. run.json carries `seats[]` unconditionally (run.js checkpoints it), and
+    // getRunDetail returns the parsed run wholesale, so it is already on state.
+    //
+    // ⚠️ The label is resolved from the seat's ALIAS while the seat's ID is carried as
+    // identity. `labelByModel` is alias-keyed (workspace-app.js, from run.json's labelMap,
+    // which PR5a does not touch — R5-2), so keying it with a seat id yields undefined and
+    // AmicusRender.display() falls through to `pair.model` — printing `gemini#1` with blind
+    // mode ON. A seat id contains its alias, so rendering one defeats blind mode. This is
+    // the same split matrix-model.js already makes for the adjudication columns.
+    function roster() {
+      if (!seatSpace) {
+        return bench.map(function (m) { return { key: m, label: labels[m] }; });
+      }
+      return run.seats.map(function (s) {
+        return { key: s.id, label: labels[s.alias] };
+      });
+    }
     // ⚠️ v4.4.1 RN-9: these two titles used to hand-roll `A.state.blind && label ? label : m`
     // inline. Both now go through AmicusRender.display() — the single blind-flip definition the
     // re-vote title below already used — so the next blind-mode ruling lands in one place instead
     // of being re-applied by hand in every file that happens to render an identity.
     loaders['reviews-panel'] = { bodyId: 'reviews-body', files: function () {
-      return bench.map(function (m) {
-        var label = A.state.labelByModel[m];
-        return { name: window.AmicusPanels.resolveArtifactName(m, 'review'), title: window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+      return roster().map(function (r) {
+        return { name: window.AmicusPanels.resolveArtifactName(r.key, 'review'), title: window.AmicusRender.display({ model: r.key, label: r.label }, A.state.blind) };
       }).filter(function (f) { return present(f.name); });
     } };
     loaders['bundle-panel'] = { bodyId: 'bundle-body', files: function () {
@@ -168,9 +213,8 @@
         .filter(function (f) { return present(f.name); });
     } };
     loaders['judges-panel'] = { bodyId: 'judges-body', files: function () {
-      var files = bench.map(function (m) {
-        var label = A.state.labelByModel[m];
-        return { name: window.AmicusPanels.resolveArtifactName(m, 'judge'), title: 'Judge ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+      var files = roster().map(function (r) {
+        return { name: window.AmicusPanels.resolveArtifactName(r.key, 'judge'), title: 'Judge ' + window.AmicusRender.display({ model: r.key, label: r.label }, A.state.blind) };
       });
       if (debated) {
         // ⚠️ DE-ROT (F38): on a --debate run, a matrix dispute cell can be a RE-VOTE whose
@@ -187,9 +231,8 @@
         // for re-votes the exact cross-match bug Task 18 fixed for review-/judge-. Routed
         // through resolveArtifactName(m, 'revote') like the other three sites; its built-in
         // legacy fallback keeps older detail payloads (no artifactsByModel map) correct too.
-        files = files.concat(bench.map(function (m) {
-          var label = A.state.labelByModel[m];
-          return { name: window.AmicusPanels.resolveArtifactName(m, 'revote'), title: 'Re-vote ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
+        files = files.concat(roster().map(function (r) {
+          return { name: window.AmicusPanels.resolveArtifactName(r.key, 'revote'), title: 'Re-vote ' + window.AmicusRender.display({ model: r.key, label: r.label }, A.state.blind) };
         }));
       }
       return files.filter(function (f) { return present(f.name); });

package/electron/workspace-ui/workspace-matrix.js

@@ -114,8 +114,8 @@
       ]));
     }
     // ⚠️ DE-ROT (F38): on `--debate` runs the re-vote rationale IS structured — debate.json
-    // `revotes[] {judge, id, verdict, reason}` (run-debate.js:257-262) — so the parenthetical must
-    // not claim "no structured field". Wording below is corrected to cover both cases.
+    // `revotes[] {judge, id, verdict, reason}` (run-debate.js :: runDebate's `revotesJson` push)
+    // — so the parenthetical must not claim "no structured field". Wording below covers both.
     container.appendChild(R.el('p', { className: 'empty-note' }, [
       'Legend: ✓ agree · ✗ dispute · – neutral · * raiser · click a dispute cell for the judge’s prose (rationale lives in prose; on --debate runs a re-voted cell also carries a structured reason from debate.json).',
     ]));

package/electron/workspace-ui/workspace-panels.js

@@ -38,12 +38,23 @@
   // computation only when the map itself is absent: older detail payloads (pre-v4.5 runs,
   // live-doc consumers not yet updated to build the map) never carry it, and re-deriving via
   // sanitizeName is exactly what those payloads always did, so it stays correct for them too.
+  // ⚠️ v4.8 PR5a T2: the map is now keyed by SEAT ID when the run carries a seat table,
+  // and callers pass seat ids to match (RULE OF ONE SPACE — roster, keys and values move
+  // together). The legacy re-derivation below is now REACHABLE in a way it never was: an
+  // alias-keyed caller used to always hit the map, so the fallback only ever served
+  // pre-v4.5 payloads. Under seat keys an alias-keyed caller MISSES — and because a
+  // fallback name can be a real file the guard admits (artifact-names.js), re-deriving
+  // would hand back another seat's prose instead of the honest empty state. So a miss
+  // now returns null and the caller renders "not written yet".
+  // Keep the map absent -> legacy path: pre-v4.5 payloads have no map at all and their
+  // callers still pass aliases, which is exactly what sanitizeName expects.
   function resolveArtifactName(model, kind) {
     var A = window.AmicusApp;
-    var map = A.state.detail.derived && A.state.detail.derived.artifactsByModel;
-    var entry = map && map[model];
-    if (entry && entry[kind]) { return entry[kind]; }
-    return kind + '-' + sanitizeName(model) + '.md';
+    var derived = A.state.detail.derived;
+    var map = derived && derived.artifactsByModel;
+    if (!map) { return kind + '-' + sanitizeName(model) + '.md'; }
+    var entry = map[model];
+    return (entry && entry[kind]) ? entry[kind] : null;
   }
 
   // ⚠️ D8 extraction (Task 1): body moved verbatim to workspace-seats.js
@@ -83,11 +94,23 @@
 
   // ⚠️ DE-ROT (F38): on a --debate run the FINAL tally.json is rebuilt from the debate's
   // replaced adjudications, so a matrix `dispute` cell can be a re-vote — gate per
-  // (judge, findingId), not per run: a judge gets ONE re-vote leg covering only the ids it
-  // actually re-voted; every other dispute cell still belongs to judge-*.md. debate.json's
-  // `revotes[]` is keyed on the bench ALIAS (same key revote-*.md and state.labelByModel use),
-  // so no filename inversion is needed. Returns the settle promise so callers (and tests) can
-  // await the highlight instead of guessing when it lands.
+  // (judge, findingId), not per run: a re-voting seat gets ONE re-vote leg covering only the ids
+  // it actually re-voted; every other dispute cell still belongs to judge-*.md. debate.json's
+  // `revotes[].judge` is still keyed on the bench ALIAS (src/council/run-debate.js :: runDebate keeps it
+  // alias-valued and puts the seat in a sibling `seat` field only when the two differ), which is
+  // the same key state.labelByModel uses, so this join needs no inversion.
+  // ⚠️ v4.8 PR5a T2 CLOSES the PR3 forecast that stood here. The allowlist is seat-space now
+  // (artifact-names.js) and the matrix has been seat-space since PR4c, so `judgePair.model` is
+  // a SEAT ID and the name resolves. That is exactly why the re-vote join below had to move in
+  // the SAME commit: `revotes[].judge` stays alias-valued by design (run-debate.js :: runDebate), so an
+  // alias-vs-seat comparison is permanently false. At HEAD that was harmless — the name missed
+  // too, so nothing rendered — but once the name resolves, a false join silently serves the
+  // ORIGINAL judge's prose highlighted as the re-vote. `revotes[]` carries a sibling `seat`
+  // emit-when-different, so `(r.seat || r.judge)` is ONE term that is correct in both spaces;
+  // an `alias AND seat` conjunction would be unsatisfiable on every unique-alias bench, i.e.
+  // on every bench that has ever run.
+  // Returns the settle promise so callers (and tests) can await the highlight instead of
+  // guessing when it lands.
   function drillIntoJudge(judgePair, findingId) {
     var A = window.AmicusApp;
     var panel = A.$('judges-panel');
@@ -96,13 +119,22 @@
     if (!spec) { return Promise.resolve(); }
     return window.AmicusLazy.loadPanel('judges-panel', spec.bodyId, spec.files).then(function () {
       var rv = ((A.state.debate && A.state.debate.revotes) || []).find(function (r) {
-        return r.judge === judgePair.model && r.id === findingId;
+        return (r.seat || r.judge) === judgePair.model && r.id === findingId;
       });
       // ⚠️ Task 18 fix-wave (RN-1, review finding 1): this branch used to recompute the name via
       // bare sanitizeName(judgePair.model), independently of the (already-fixed) judge branch
       // right below it — for a colliding pair, drilling a re-vote on the SECOND model resolved
       // to the bare name and cross-matched the FIRST model's genuine revote section. Both arms
       // of this ternary now go through the same disambiguation-aware helper.
+      // ⚠️ NO ALIAS FALLBACK — refused on purpose (council-3 B3, owner-ruled). The join above
+      // misses for debate.json written between 2026-08-12 (run.json began carrying seats[])
+      // and 2026-08-13 (revotes[] began carrying seat): those rows have only `judge`, an
+      // ALIAS, while judgePair.model is a seat id. Adding `|| r.judge === <this seat's alias>`
+      // would "fix" it by picking the wrong twin's re-vote roughly half the time — both twins
+      // write judge:'gemini' and nothing in that data distinguishes them, so it is RN-1 again,
+      // silent. Missing means rv stays undefined and the judge- artifact renders: the right
+      // seat, the wrong KIND, which is the fail-safe direction. That vintage never shipped in
+      // a release (`git tag --contains` on the first commit is empty).
       var artifactName = rv
         ? resolveArtifactName(judgePair.model, 'revote')
         : resolveArtifactName(judgePair.model, 'judge');

package/electron/workspace-ui/workspace-render.js

@@ -196,7 +196,7 @@
       seen[key] = true;
       var row = existing[key];
       // ⚠️ DE-ROT (F35): seat.lastActivity is the ISO `leg.lastActivityAt`; format it HERE.
-      // seatCells lives in live-model.js, which loads first and has no access to relTime.
+      // seatCells lives in live-seats.js, which loads first and has no access to relTime.
       var view = Object.assign({}, seat, {
         lastActivity: seat.lastActivity ? relTime(seat.lastActivity) : null,
       });
@@ -217,7 +217,7 @@
     // RN-11 (v4.5): the keyed update added and removed rows but never MOVED
     // them, so table order was frozen at first render — wrong the moment a
     // repair solo or new wave changes the composed doc's leg order mid-run.
-    // The O(n²) `find()` per seat is deliberate: bench is capped at 26 (anonymize.js:21),
+    // The O(n²) `find()` per seat is deliberate: bench is capped at 26 (anonymize.js :: assignLabels),
     // so this is ~100 rows worst case on a debate run, every 1.5s. `existing` above is
     // already the map an O(n) rewrite would need — reach for it only if this table ever
     // renders unbounded rows.

package/electron/workspace-ui/workspace-seats.js

@@ -12,7 +12,7 @@
  * `getRunDetail` returns them wholesale, unfiltered), so `run.degrades` and
  * `verdict.seatLoss` are already on `state.detail` today; no data-layer
  * threading was needed. Only the derivation (window.AmicusLive.deadSeats,
- * live-model.js) and this file's painting are new.
+ * live-seats.js) and this file's painting are new.
  *
  * NOTE (scope, matches the plan's file list): renderSeatsPanel() (below) is reached from
  * renderDetail() — called both from openRun() (a fresh run open) and from the blind toggle
@@ -42,19 +42,35 @@
   'use strict';
 
   /**
-   * Aliases of seats whose degrade record says they were retried. PR1F-4 (v4.7 PR7).
+   * Keys — seat id where a record supplies one, alias otherwise — of seats whose degrade record
+   * says they were retried. PR1F-4 (v4.7 PR7); re-keyed in v4.8 PR5b, renamed from
+   * `retriedAliases` because the keys are no longer uniformly aliases.
    *
-   * ⚠️ Mirrors window.AmicusLive.deadSeats' own predicate (live-model.js:227-241) EXACTLY, and
-   * must keep mirroring it. The kind/channel filter is load-bearing: run.degrades[] also carries
+   * ⚠️ THE MIRROR IS RESTORED (v4.8 PR5c). It went partial in PR5b, when this side was
+   * seat-keyed and deadSeats still dedup'd on the alias; PR5c seat-keyed the other side too,
+   * so both now key on "seat id where the record supplies one, alias otherwise". The
+   * kind/channel FILTER still mirrors window.AmicusLive.deadSeats — now at
+   * live-dead-seats.js, which PR5c split out of live-seats.js for the 300-line gate — and
+   * must keep doing so. Two spellings of one rule is PR5a council finding B1.
+   *
+   * ⚠️ The two sides are NOT identical, and the difference is deliberate: deadSeats decides
+   * whether a seat is RENDERED, so it fails toward showing a row; this decides whether a
+   * badge is PAINTED, so an unidentified record falls back to the alias and marks every seat
+   * sharing it. Over-badging is visible and self-correcting; a missing badge is silent.
+   *
+   * The kind/channel filter is load-bearing: run.degrades[] also carries
    * kind:'heal' / channel:'stage1-retry' records with the SAME retryWaveId/firstFailure fields
    * for seats that RECOVERED, and a field-only scan would tag a recovered seat "retried once".
    *
-   * ⚠️ firstFailure is TRUTHINESS ONLY. It has two shapes — run-retry.js:98 emits
-   * {seat, class:'leg', status, reason}; :86/:90/:93 emit {seat, class:'wave', waveId, reason}
-   * with NO status key — so any read of firstFailure.status is undefined on every wave-origin
-   * seat.
+   * ⚠️ firstFailure is TRUTHINESS ONLY. Two shapes, both built in
+   * run-retry-group.js :: groupStage1Losses — its deadLegs loop emits {seat, class:'leg',
+   * status, reason}; its deadWaves loop emits {seat, class: lossClass(w), waveId, reason}
+   * at THREE sites (lens/critic/bench), none carrying a status key, where
+   * `const lossClass = w => (w.partial ? 'missing' : 'wave')` — so firstFailure.status is
+   * undefined on every wave-origin seat. ⚠️ T-A8 DROPPED five line numbers here: re-opened
+   * 2026-08-17 they had all rotted a uniform +31 (T-A3 +15, T-A6 +16), and "now 235" is 266.
    */
-  function retriedAliases(degrades) {
+  function retriedSeats(degrades) {
     var out = Object.create(null);
     (degrades || []).forEach(function (d) {
       if (!d || d.kind !== 'degrade') { return; }
@@ -62,15 +78,32 @@
       var data = d.data || {};
       if (!(data.retryWaveId || data.firstFailure)) { return; }
       if (d.channel === 'dead-leg') {
-        if (data.seat) { out[data.seat] = true; }
+        // ⚠️ Prefer the SEAT ID when the record names one. TWO mechanisms now supply it, not
+        // one: retryLegStillDeadNote and missingLegStillDeadNote via `firstFailure.seatId`
+        // (pinned by tests/council/run-retry.test.js:628 on a twin bench), and — since
+        // v4.8 PR5c — srcLegStillDeadNote via its own `data.seatId`. Reading only the first
+        // meant a srcLeg record keyed by ALIAS and badged the live twin "retried once" while
+        // the seat that was actually retried showed nothing.
+        // `data.seat` remains the last fallback for pre-PR5c records (residual R6).
+        var key = (data.firstFailure && data.firstFailure.seatId) || data.seatId || data.seat;
+        if (key) { out[key] = true; }
       } else {
-        (data.models || []).forEach(function (m) { if (m) { out[m] = true; } });
+        // v4.8 PR5c: dead-wave now carries `seats[]`, index-parallel with `models[]`, whose
+        // elements are seat ids or `null` for a slot the producer could not identify. A null
+        // slot falls back to the alias and therefore badges every seat sharing it — the loud
+        // direction, disclosed. A pre-PR5c record has no `seats` at all and is alias-only.
+        var ws = data.seats;
+        (data.models || []).forEach(function (m, i) {
+          var k = (Array.isArray(ws) ? ws[i] : null) || m;
+          if (k) { out[k] = true; }
+        });
       }
     });
     return out;
   }
 
-  // Mirrors isReviewing at live-model.js:261-264 — a chair/judge/rebuttal/revote row must not
+  // Mirrors isReviewing at live-dead-seats.js (moved there by PR5c's size-gate split) —
+  // a chair/judge/rebuttal/revote row must not
   // carry a reviewer's retry marker.
   function isReviewingRole(role) {
     return role === 'seat' || role === 'critic' ||
@@ -91,7 +124,7 @@
     // records for the SAME run, and the persisted run.json copy is authoritative when present.
     var deg = (d.run && d.run.degrades && d.run.degrades.length) ? d.run.degrades
       : ((d.verdict && d.verdict.degrades) || []);
-    var retried = retriedAliases(deg);
+    var retried = retriedSeats(deg);
     // ⚠️ Look rows up by data-key, NEVER by position. renderSeats (workspace-render.js:179-216)
     // keys every row on String(seat.id || seat.model) and RN-11 made it REORDER rows to match the
     // composed doc's leg order — so tbody.children[i] is not seats[i]. Build the key exactly the
@@ -105,7 +138,7 @@
       if (!row || !row.children[8]) { return; }
       // Column 8 is the table's unlabeled trailing flag cell (index.html:51's final <th></th>).
       // It carries '⏳ stalled' on the LIVE path; on this terminal path seatsFromRunStats
-      // hardcodes stalled:false (live-model.js:128), so it is always empty here and free to use.
+      // hardcodes stalled:false (live-seats.js, seatsFromRunStats), so it is always empty here and free to use.
       // If that ever changes, this is the collision site.
       // Fix wave (whole-branch review, finding 2): this pass must be SYMMETRIC. renderSeats
       // reuses rows keyed on `model:role` across calls — including across two different
@@ -114,7 +147,47 @@
       // of the SAME run and leaves a stale 'seat-retried' class on a row that belonged to a
       // PREVIOUS run's non-retried seat. classList.add/remove (not string concatenation) so a
       // repeat add never duplicates the token and a seat that is no longer retried gets cleared.
-      var isRetried = isReviewingRole(s.role) && !!retried[s.modelInput || s.model];
+      // ⚠️ v4.8 PR5b: DUAL lookup, and both arms are load-bearing. `s.seat` (PR5b Task 1, null
+      // on a unique bench) matches the one emitter arm that names a seat; `s.model` matches the
+      // four that carry only an alias — srcLegStillDeadNote and every dead-wave record. Pairing
+      // this map's dual key with a seat-id-ONLY lookup badges NOTHING for those four arms: a
+      // silent false negative replacing a visible false positive, which is strictly worse.
+      // On a twin bench an alias-only record still badges BOTH seats. That is not a defect — the
+      // record does not say which seat failed, so no consumer can attribute it. Over-badging is
+      // the deliberate direction: visible beats silent.
+      //
+      // ⚠️ NAMING HAZARD (council A1): `seat` means TWO different things three lines apart.
+      // `s.seat` is a SEAT ID (`alias#N`, from src/council/run-stats-entry.js :: buildRunStatsEntry
+      // via the cost row). The degrade records keyed into `retried` above use `data.seat`,
+      // which is an ALIAS and stays one
+      // deliberately (run-retry-notes.js:39-45 — verdict.js:72 compares it against `o.critic`).
+      // Reading one as the other is precisely how an earlier revision of this fix paired an
+      // alias-keyed map with a seat-id lookup and dropped every badge. When touching either
+      // side, say which space you are in.
+      //
+      // ⚠️ The pre-PR expression was `retried[s.modelInput || s.model]` (council B1). The
+      // `modelInput` arm is dropped on purpose: this loop only ever iterates
+      // `seatsFromRunStats(...)` output (assigned in workspace-seats.js :: renderSeatsPanel), and
+      // that projection emits no `modelInput` at all — live payload seats, which DO carry it,
+      // reach `deadSeats` in workspace-seats.js :: appendDeadRows and never reach here. The
+      // invariant is pinned by test (12) in workspace-seats.test.js;
+      // if that test ever fails, restore the `s.modelInput` arm rather than deleting the test.
+      // ⚠️ `s.seat &&` is LOAD-BEARING (council A1). `s.seat` is null on a unique bench, and a
+      // bare `retried[s.seat]` coerces null to the STRING key 'null' — so a seat with no seat id
+      // would match a degrade record whose alias is literally `null`. Measured: with
+      // `m = Object.create(null); m['null'] = true`, `m[null]` is `true`. Contrived, but this
+      // module already guards the same class elsewhere — live-dead-seats.js, deadSeats' Object.create(null) note, records a model
+      // named `toString` crashing the seats repaint, which is why Object.create(null) is used
+      // throughout. The guard costs nothing and closes it.
+      //
+      // ⚠️ KEYSPACE (council B1): `retried` deliberately mixes seat ids (`alias#N`) and bare
+      // aliases as keys, because only one of five emitter arms supplies a seat id. That is a
+      // real collision surface and a KNOWN one — src/council/seats.js:236 already records that
+      // a literal alias containing '#' collides with a minted #N id, and preflightSeats refuses
+      // exactly that shape. This map inherits that guarantee rather than re-deriving it; if
+      // preflightSeats ever stops refusing it, this lookup becomes ambiguous.
+      var isRetried = isReviewingRole(s.role)
+        && !!((s.seat && retried[s.seat]) || retried[s.model]);
       if (isRetried) {
         row.classList.add('seat-retried');
         row.children[8].textContent = '↻ retried once';
@@ -153,14 +226,25 @@
       // Fix wave 2 (smoke-caught, GUI smoke on real degraded run 12c96b6b): dead seats never
       // produce a review, so state.labelByModel (built from the run's names derivation — models
       // that DID review) never carries them; seatCells' own `blindOn && label ? label : alias`
-      // fallback is LOAD-BEARING for LIVE rows (RN-9/F36, live-model.js) and stays untouched, but
+      // fallback is LOAD-BEARING for LIVE rows (RN-9/F36, live-seats.js) and stays untouched, but
       // for a dead seat that fallback leaks the raw model name under blind — precisely the seat
       // blind mode most needs to hide. Placeholder ONLY when blind is on AND no label resolved;
       // a label that DOES resolve (possible in principle) still wins via seatCells' own cell.
       if (blindOn && !(labelOf && labelOf(seat.model))) { cells[0] = '(masked)'; }
       cells[6] = '';
+      // v4.8 PR5c: key on the SEAT, not the alias — two dead twins are two rows and must
+      // not share a dataset.key. ⚠️ Honest scope: unlike the live path, this collision has
+      // NO measured symptom today. renderSeats removes leavers per ROW
+      // (workspace-render.js:231 tests each child's own key), so colliding rows are both
+      // removed rather than one leaking, and dead rows are always appended fresh so the
+      // reuse path at :197 — where last-wins froze a live row in PR5b — is never reached.
+      // It is fixed because :188 still builds a last-wins `existing` map that any future
+      // reuse would hit, and because rows for different seats having one key is a landmine.
+      // Plain concatenation is injective here (ONE field, and 'dead:' cannot collide with a
+      // live key, which is a JSON array starting '['); the live path needs JSON.stringify
+      // only because it joins TWO fields.
       var row = window.AmicusRender.el('tr',
-        { className: 'seat-dead', dataset: { key: 'dead:' + seat.model } },
+        { className: 'seat-dead', dataset: { key: 'dead:' + (seat.seat || seat.model) } },
         cells.map(function (c, i) {
           return window.AmicusRender.el('td',
             { className: window.AmicusRender.seatCellClass(i) }, [c]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.7.1",
+  "version": "4.8.1",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
@@ -63,6 +63,7 @@
     "models:info": "node bin/amicus.js models",
     "models:check": "node bin/amicus.js models --check",
     "models:check:strict": "node bin/amicus.js models --check --strict",
+    "check:ci-alias-pins": "node scripts/check-ci-alias-pins.js",
     "generate-icon": "node scripts/generate-icon.js",
     "generate-docs": "node scripts/generate-docs.js",
     "generate-docs:check": "node scripts/generate-docs.js --check",
@@ -71,6 +72,7 @@
     "graphify:index": "graphify extract . --backend claude-cli",
     "check:secrets": "node scripts/check-secrets.js --all",
     "check:sizes": "node scripts/check-file-sizes.js --all",
+    "check:citations": "node scripts/check-citations.js --all",
     "check:tarball": "node scripts/check-tarball-lifecycle.js"
   },
   "dependencies": {
@@ -93,6 +95,7 @@
     "eslint": "^8.0.0",
     "espree": "^9.6.1",
     "jest": "^29.0.0",
+    "js-yaml": "^4.3.0",
     "lint-staged": "^16.3.2",
     "puppeteer": "^24.36.0",
     "sharp": "^0.35.3",

package/schemas/council-run-live.schema.json

@@ -39,6 +39,7 @@
           "model": { "type": ["string", "null"], "description": "Resolved executable id (metadata.model)." },
           "modelInput": { "type": ["string", "null"], "description": "Council alias (run.json bench/chair/critic/lenses are keyed on this, not `model`); null when the leg's metadata.json has not been patched with it yet (F36)." },
           "role": { "type": ["string", "null"], "description": "'seat' | 'critic' | 'lens:<slug>' | 'chair', derived via roleFor keyed on modelInput (chair via the owning stage's name instead, F34); null when modelInput is unknown." },
+          "seat": { "type": ["string", "null"], "description": "v4.8 R5, optional. This leg's seat id (`alias#N`) when the bench repeats an alias, else null. Written at launch by src/sidecar/fanout-leg.js :: runSingleAttempt from the per-wave roster and read back by src/observe/council-legs.js :: buildLegRow. Present on every leg row, including a truthful null — unlike metadata.json's own `seat` key, which is absent (not null) on a unique-alias bench: `buildLegRow`'s base row literal is unconditional and already emits nulls the same way for `model`/`modelInput`, so this field matches that literal rather than the absent-when-unset convention `usageError` above uses. The leg-row `items` object declares no `additionalProperties: false`, so an additive field was already accepted here — this documents the shape rather than changing what is accepted." },
           "status": { "type": "string" },
           "messages": { "type": "number" },
           "stage": { "type": "string" },

package/schemas/council-run.schema.json

@@ -43,6 +43,25 @@
       }
     },
     "labelMap": { "type": ["object", "null"], "additionalProperties": { "type": "string" } },
+    "seats": {
+      "description": "v4.8: derived seat table, one entry per bench position. Bench-only — the synthesized 'claude' review is never a seat.",
+      "type": ["array", "null"],
+      "items": {
+        "type": "object",
+        "required": ["id", "alias", "role", "position"],
+        "properties": {
+          "id": { "type": "string" },
+          "alias": { "type": "string" },
+          "role": { "type": "string" },
+          "lens": { "type": ["string", "null"] },
+          "position": { "type": "integer" }
+        }
+      }
+    },
+    "criticSeat": {
+      "description": "v4.8: seat id of the critic, or null.",
+      "type": ["string", "null"]
+    },
     "options": { "type": "object" },
     "pack": { "type": "object" },
     "tag": { "type": "string" },