amicus 4.7.1 → 4.8.1

package/schemas/council-tally.schema.json

@@ -17,7 +17,11 @@
         "date": { "type": "string" },
         "models": { "type": "array", "items": { "type": "string" } },
         "chair": { "type": ["string", "null"] },
-        "claudeInCouncil": { "type": "boolean" }
+        "claudeInCouncil": { "type": "boolean" },
+        "seats": {
+          "type": "array",
+          "description": "v4.8, optional. The run's seat table, one {id, alias, role, lens, position} entry per BENCH seat in bench order, echoed verbatim from the tally input. The engine emits it only when the bench repeats an alias — the one case where the `alias#N` ids on findings[].raiserSeat, adjudications[].seat and runStats[].seat resolve to nothing else in the document, since meta.models is the ALIAS list. Bench-only: 'claude' is never a seat, so meta.models.length need not equal seats.length and the two must never be joined positionally. ABSENCE DOES NOT MEAN the bench had no repeated alias — hand-assembled and MCP-assembled input reaches tally() with no seat machinery behind it; it means only that no seat table is available. `items` is deliberately unconstrained: consumers must tolerate a table that is not an array of seat objects (the report and Workspace renderers fall back to alias space whole rather than failing), and the MCP input schema accepts the same latitude."
+        }
       }
     },
     "judged": { "type": "boolean" },
@@ -30,7 +34,14 @@
           "model": { "type": "string" },
           "withSelf": { "type": ["number", "null"] },
           "peersOnly": { "type": ["number", "null"] },
-          "perJudgeRank": { "type": "object" }
+          "perJudgeRank": {
+            "type": "object",
+            "description": "This row's rank position under each judge that ranked it. KEYED BY THE JUDGE'S SEAT ID where the judge has one that differs from its alias, and by the judge's alias otherwise (v4.8 T3.3) — the same emit-when-DIFFERENT rule as every other seat field in this document, so a bench with no repeated alias is keyed exactly as before. Before T3.3 the key was always the alias, which last-wins-collapsed two twin judges into one entry while withSelf/peersOnly averaged over both, so the map and the averages could disagree about the same row. ⚠️ They can still disagree on hand-assembled input that repeats a judge alias and carries no seat, because nothing in such a document can tell those judges apart."
+          },
+          "seat": {
+            "type": "string",
+            "description": "v4.8, optional. One row per SEAT rather than per alias, and this row's seat id, when it differs from `model` (its alias). SHIPPED at v4.8 T3.3 — street-cred.js :: computeStreetCred is the producer; this property was DECLARED one task earlier, at T3.2, and read 'documentation-only ahead of its producer' until T3.3 landed. The engine emits it only when the bench repeats an alias, so a unique-alias run carries no seat on any row and its document is byte-identical to a pre-v4.8 one. verdict.js :: buildVerdict carries it through its own closed streetCred projection, so the field is never silently stripped. No `additionalProperties: false` above means an additive field was always validated here even before this declaration; this documents the shape rather than changing what is accepted."
+          }
         }
       }
     },
@@ -52,6 +63,27 @@
           "confidence": { "enum": ["thin", "solid"] },
           "tierOverride": { "type": ["object", "null"] },
           "adjudications": { "type": "array", "items": { "type": "object" } },
+          "raiserSeat": {
+            "type": ["string", "null"],
+            "description": "v4.8, optional. The raising SEAT's id (e.g. 'deepseek#1'), echoed from the input finding. Emitted only when it differs from the raiser's alias, so a bench with no repeated alias never carries it; `raiser` stays the alias in every case. Resolve it against meta.seats."
+          },
+          "location": {
+            "type": "string",
+            "description": "v4.8, optional (SI-23). Echoed verbatim from the input finding when present; absent when the input finding carried none, so a pre-SI-23 document is byte-identical. tally() does not read it for tiering — it exists here only because the input schema (mcp-tools.js's amicus_council_tally) now preserves it instead of silently dropping it, matching what anonymize.js :: toGlobalFindings already carries on the engine's own path."
+          },
+          "claim": {
+            "type": "string",
+            "description": "v4.8, optional (SI-23 fix round 1, PR #183 council A1/B1). Echoed verbatim from the input finding when present, the same emit-when-present rule as `location` immediately above; absent when the input finding carried none. `claim` was already declared on the amicus_council_tally input schema before SI-23 R10 — R10 fixed `location`'s identical drop in this same outFindings map and left this sibling gap for a later round, closed here."
+          },
+          "sameModelCorroboration": {
+            "const": true,
+            "description": "v4.8, optional, TRUE ONLY (never emitted as false, so a document without it is byte-identical to a pre-v4.8 one). Set when, after the seat-aware raiser exclusion, at least one AGREEING peer of this finding shares the raiser's alias — corroboration that is real but came from another seat of the same model, so it is not independent. WRONG IN BOTH DIRECTIONS, by construction: the comparison is on the ALIAS only. It MISSES one model reached under two aliases (e.g. --models gpt-5,openai/gpt-5), because votes carry no resolved-executable id. And it FIRES FALSELY on a SPLIT alias — one alias whose two seats resolved to different executables — telling a reader to discount a genuinely independent cross-executable corroboration. The reliability ledger keys identity on (alias, resolvedModel) for the same run, so the two documents can disagree about what 'the same model' means. Treat this as 'worth a second look', never as proof."
+          },
+          "unattributedPeerDrops": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "v4.8, optional, EMITTED ONLY WHEN NON-ZERO (never emitted as 0, so a run that does not orphan exactly one side of a twin pair produces a document byte-identical to a pre-T-B2 one; the minimum states that emit rule rather than merely describing it). How many of this finding adjudications the peer split excluded WITHOUT being able to attribute them. TWO SHAPES produce it. (1) RAISER NAMED: excluded on the ALIAS branch while exactly ONE side of the pair carried a seat id - the finding has a raiserSeat and the vote has none, or the reverse; a seat-less vote bearing the raiser own alias cannot be told apart from the raiser own vote, so it is dropped. (2) RAISER NOT NAMED (v4.8 T-B4): the finding raiser is empty or missing and so is the vote judge, so the vote may be the unnamed raiser own and is not counted as peer signal. NEITHER SHAPE includes a vote the SEAT IDS settled: when the vote and the finding both carry a seat id the engine knows whose vote it is, so that exclusion is attributed rather than ambiguous and is never counted here. WARNING - on shape (1) this is an ANNOUNCEMENT, not a repair: that vote stays excluded, basis does not count it, and tier/confidence are computed without it, by owner ruling (mark explicitly, attribute nothing). On shape (2) the exclusion IS the change - those votes used to be counted, which let an unnamed raiser corroborate its own finding, so basis and tier can both move. Read it as: N votes on this finding were excluded without anyone being able to attribute them - each is EITHER a real peer signal being discarded OR the raiser own vote being correctly excluded, and the document does not say which, because nothing in it can. Treat it as a POSSIBLE undercount of up to N, never as an established one; not being able to tell is why the drop is announced at all. The defense brief computes the same number from the same function, so the two documents cannot disagree."
+          },
           "debate": {
             "type": "object",
             "properties": {

package/schemas/council-verdict.schema.json

@@ -49,6 +49,10 @@
         "type": "string"
       }
     },
+    "seats": {
+      "type": "array",
+      "description": "v4.8, optional. The tally record's meta.seats promoted to the top level beside seatLoss — one {id, alias, role, lens, position} entry per BENCH seat in bench order. Present only when the tally record carried one, i.e. only when the bench repeated an alias. It is what makes the `alias#N` ids on findings[].raiserSeat, adjudications[].seat and runStats[].seat resolvable from the verdict ALONE. Bench-only: 'claude' is never a seat, so this must never be joined positionally to `council`. ABSENCE DOES NOT MEAN the bench had no repeated alias — it means no seat table is available; a verdict written before v4.8, or assembled by hand, has none. `items` is deliberately unconstrained: `council report` accepts any array here and falls back to alias space WHOLE unless every element is an object carrying a string `id`, rather than failing to render."
+    },
     "claudeInCouncil": {
       "type": "boolean"
     },
@@ -124,6 +128,17 @@
           "adjudications": {
             "type": "array"
           },
+          "raiserSeat": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "v4.8, optional. The raising SEAT's id (e.g. 'deepseek#1'), carried through from the tally record. Emitted only when it differs from the raiser's alias, so a bench with no repeated alias never carries it; `raiser` stays the alias in every case. Resolve it against the top-level `seats` table. Before v4.8 the verdict named seats it could not resolve — a reader holding only the verdict could not tell which of two same-alias seats raised a finding."
+          },
+          "sameModelCorroboration": {
+            "const": true,
+            "description": "v4.8, optional, TRUE ONLY (never emitted as false, so a document without it is byte-identical to a pre-v4.8 one). Carried through from the tally record: after the seat-aware raiser exclusion, at least one AGREEING peer of this finding shares the raiser's alias — corroboration that is real but came from another seat of the same model, so it is not independent. WRONG IN BOTH DIRECTIONS, by construction: the comparison is on the ALIAS only. It MISSES one model reached under two aliases (e.g. --models gpt-5,openai/gpt-5), because votes carry no resolved-executable id. And it FIRES FALSELY on a SPLIT alias — one alias whose two seats resolved to different executables — telling a reader to discount a genuinely independent cross-executable corroboration. The reliability ledger keys identity on (alias, resolvedModel) for the same run, so the two documents can disagree about what 'the same model' means. Treat this as 'worth a second look', never as proof."
+          },
           "decision": {
             "type": [
               "string",

package/skills/second-opinion/COUNCIL-DESIGN.md

@@ -121,7 +121,7 @@ Run as ordered phases; track as todos. **Three sequential waves of model calls**
 
 ### Stage 6 — Capture lessons (compounding)
 - Reflect on failures/mitigations and briefing wording, as today.
-- **Ledger auto-appends** — `ledger.appendRun(record)` writes one row per (run × model) to `council-ledger.jsonl` automatically at finalize (shown in the run summary). No manual reliability-table update needed.
+- **Ledger auto-appends** — `ledger.appendRun(record)` writes one row per (run × model × resolved executable) to `council-ledger.jsonl` automatically at finalize (shown in the run summary) — one row per model on an ordinary bench, and since v4.8 one row per executable when an alias's seats resolved differently. No manual reliability-table update needed.
 - **Qualitative MODEL-NOTES update (approval-gated):** draft per-model quirk/conformance notes; write the proposed diff to `_tmp-proposed-model-notes-update.md`; present its path in the approval prompt; do not write until approved.
   The approval prompt carries the diff file's path; chat text alone is not sufficient (an approval
   dialog can hide the chat transcript). Keep it tight.
@@ -142,7 +142,10 @@ Run as ordered phases; track as todos. **Three sequential waves of model calls**
 
 **Street cred** — computed two ways by `amicus council tally`:
 - **withSelf** = each model's mean rank position across **all** judges' `FINAL RANKING:` blocks (lower = better).
-- **peersOnly** = mean rank across judges **other than** that model (self-vote excluded).
+- **peersOnly** = mean rank across judges **other than** that row's own vote on itself — **by seat,
+  not by model, whenever seat ids are present** (v4.8, see the ⚠️ note below): a twin's OTHER seat
+  is a real peer and counts, so only that row's own seat is excluded. Falls back to excluding by
+  alias when seat ids are unavailable.
 The cross-review matrix shows both; the ledger and Stage-0 bench recommendations consume **peersOnly** only.
 
 **Per-finding peer-confidence tier** — determined by a **peers-only** cascade: for a finding raised by model R, peers are all judges except R (the raiser's own adjudication is excluded — consistent with the peers-only street-cred rule). Let `a` = peer agrees, `d` = peer disputes. The cascade is exhaustive and mutually exclusive:
@@ -150,12 +153,14 @@ The cross-review matrix shows both; the ledger and Stage-0 bench recommendations
 | Priority | Tier | Rule | Meaning |
 |---|---|---|---|
 | 1 | **Disputed** | `d ≥ 2` and `d > a` | Strong peer pushback — the finding itself is likely wrong |
-| 2 | **Confirmed** | `a ≥ 2` and `a > d` | ≥ 2 independent corroborations, agrees dominate |
+| 2 | **Confirmed** | `a ≥ 2` and `a > d`, or `a = 1` and `d = 0` | ≥ 2 independent corroborations, agrees dominate — or a lone corroborating peer (thin) |
 | 3 | **Contested** | `d ≥ 1` (whatever remains) | At least one live dispute — in question |
-| 4 | **Singleton** | else (`d = 0` and `a < 2`) | At most one endorsement, no pushback — thin |
+| 4 | **Singleton** | else (`a = 0` and `d = 0`) | No peer engaged at all — thin |
 
 `confidence` is `thin` when total engaged peers `a + d ≤ 1` — cells `(0,0)`, `(1,0)`, and `(0,1)`. **Claude may override the tier at `thin` margins** (recorded as `tierOverride: {from, to, reason}` and surfaced in the matrix and `verdict.json`). These four tiers drive Stage 4. `amicus council tally` assigns them deterministically; judgment at the margins remains Claude's.
 
+⚠️ **v4.8 — "except R" is a SEAT rule, not a model rule, whenever seat ids are available.** A bench may seat the same model twice (`--models deepseek,deepseek,gpt`), and those two seats are genuinely independent reviewers: each gets its own review, its own anonymized label, and its own vote. Excluding by *model* threw away the twin's real vote along with the raiser's own, which is why a finding with one true corroborating peer could report as `Singleton {a:0,d:0}` — and why a bench of three identical aliases discarded its entire cross-review. The engine now excludes by **seat** (`adjudications[].seat` vs `findings[].raiserSeat`) whenever the vote *and* the finding both carry one, and falls back to excluding by **alias** when either does not — a pre-v4.8 document, a hand-assembled one, or a real run whose leg never bound to its seat. Two consequences to expect on a repeated-alias bench: tiers move in **both** directions (a twin's corroboration promotes, a twin's dispute demotes), and a finding whose only agreeing peer shares the raiser's alias is stamped `sameModelCorroboration: true` — corroboration that exists, but is not independent.
+
 ### 5.3 Chair selection & fallback
 - Default: Claude **recommends a non-Claude chair** from the council each run (often the
   strongest reasoner / best reviewer-reliability) and the user confirms at launch.

package/skills/second-opinion/MANUAL-ORCHESTRATION.md

@@ -142,7 +142,7 @@ As each judge's ranking + adjudication response returns, collect it (the raw per
    - `meta` = `{ "runId": "<run-folder stem>", "models": [<every reviewed model id, including "claude" when the toggle is on — this is the street-cred universe>], "chair": "<confirmed chair model id>", "claudeInCouncil": <Stage-0 toggle> }`. Optional extras: `runType`, `date`.
    - `findings[]` = one entry per finding across ALL reviews: `{ "id": "<run-global label id from step 1, e.g. A1>", "raiser": "<de-anonymized model that raised it>", "severity": "<from the review JSON>" }` (`claim` may be carried along but is not required).
 1. **Rewrite finding ids to run-global label ids.** Each Stage-1 review's local integer ids (`1`, `2`, `3`…) become `A1`, `A2`, `A3`… (where `A` is that review's anonymized label). The label↔model map (`Review A → deepseek`, etc.) is the key.
-2. **Build `adjudications`** — for every judge across all findings: `findingId` = run-global label id; `judge` = the model id (de-anonymized via the map); `verdict ∈ {agree, dispute, neutral}`. Include every judge's verdict on every finding. The raiser's own adjudication of its own finding is **included in the input** (the tally engine excludes it when computing peers-only tiers — do not pre-filter it).
+2. **Build `adjudications`** — for every judge across all findings: `findingId` = run-global label id; `judge` = the model id (de-anonymized via the map); `verdict ∈ {agree, dispute, neutral}`. Include every judge's verdict on every finding. The raiser's own adjudication of its own finding is **included in the input** (the tally engine excludes it when computing peers-only tiers — do not pre-filter it). ⚠️ **v4.8 — that exclusion is by SEAT when seat ids are present.** If your bench seats one model twice, add `seat` to each adjudication and `raiserSeat` to each finding (both optional, both string seat ids like `deepseek#1`), and the engine will drop only the raising *seat's* own vote instead of both twins'. Set them from what you actually observed — never invent a seat id to unlock the seat compare, and never set only one side: with a seat on the vote but not the finding (or vice versa) the engine deliberately falls back to the alias compare rather than guessing.
 3. **Translate each judge's `FINAL RANKING:` block** — convert the label order (`1. Review C / 2. Review A / 3. Review B`) into a model `order` array via the same map (e.g. `{C→mistral, A→deepseek, B→gpt}` ⇒ `order: ["mistral","deepseek","gpt"]`). This is each entry in `rankings[]`.
 4. **Populate `runStats`** from the per-leg run documents emitted by `fanout --json` (and any solo red-team/chair `start --json` docs): copy `model`, `status`, `durationMs`, `usage` verbatim. Any leg with no run doc gets `durationMs: null` and `usage: null` — never invent a value. Attach `role` (`council` | `redteam` | `claude`), `wasChair`, and `conformance` (`clean` | `repaired` | `unstructured`) as council-domain labels.
 

package/skills/second-opinion/SKILL.md

@@ -268,8 +268,9 @@ below needs both sides of the join.
 Every finding already carries the **peer-confidence tier** the
 engine's tally computed (see *Key mechanics → §5.2 Scoring*, and COUNCIL-DESIGN.md for the full
 cascade): **Disputed** (strong peer pushback — `d ≥ 2` and `d > a`), **Confirmed** (≥ 2 peer
-agreements, agrees dominate), **Contested** (at least one live dispute), **Singleton** (at most one
-endorsement, no pushback). `confidence: thin` cells `(0,0)/(1,0)/(0,1)` are override-eligible —
+agreements, agrees dominate — or a lone corroborating peer with zero disputes), **Contested** (at
+least one live dispute), **Singleton** (no peer engagement at all — zero agreements, zero
+disputes). `confidence: thin` cells `(0,0)/(1,0)/(0,1)` are override-eligible —
 record any override in `tierOverride: {from, to, reason}` on that finding's decision entry. Present
 the tiers in this order: Confirmed first (bulk decision), then Disputed and Contested and Singleton
 individually in the judgment tier.
@@ -296,7 +297,7 @@ This is one tier with three sub-types presented separately. Present each finding
 
 - **Disputed** (`d ≥ 2` and `d > a` — strong peer pushback, the finding itself may be wrong): For each finding show the claim, severity, which model raised it, which peers dispute it and why. Ask for a decision before proceeding to the next: **accept / deny / modify**.
 - **Contested** (`d ≥ 1` with a meaningful split): For each finding show the claim and severity, which model raised it, who agreed, who disputed, and the one-line reasons from the adjudications. Ask for a decision before proceeding to the next: **accept / deny / modify**.
-- **Singleton** (only the original raiser; all other judges were neutral or silent — `d = 0` and `a < 2`): For each finding show the claim and severity and that no other judge engaged with it. Name the sole raiser. Ask for a decision before proceeding to the next: **accept / deny / modify**.
+- **Singleton** (only the original raiser; all other judges were neutral or silent — `a === 0` and `d === 0`): For each finding show the claim and severity and that no other judge engaged with it. Name the sole raiser. Ask for a decision before proceeding to the next: **accept / deny / modify**.
 
 **Recording decisions.** Keep a running decision log throughout this stage — every finding's
 outcome (accepted / denied / modified, with any modification noted) — and write it to
@@ -402,10 +403,17 @@ The `MODEL-NOTES.md` **next to this file** is your machine-local run ledger: npm
 Draft new or updated entries for the per-model sections of `MODEL-NOTES.md` that capture what was learned.
 
 **Ledger — already appended; do not touch it.** The engine's finalize tally appended one row per
-(run × model) to the append-only `council-ledger.jsonl` under `getConfigDir()` as part of the run
-(expert-lens runs are deliberately excluded). **In the fast path, never run `council tally`
-yourself.** The ledger is append-only, so a second tally over the same run double-appends and
-permanently skews every model's lifetime reliability averages — a double-append cannot be undone.
+(run × model × resolved executable) to the append-only `council-ledger.jsonl` under `getConfigDir()`
+as part of the run — one row per model on an ordinary bench, and since v4.8 one row per executable
+when an alias's seats resolved differently (expert-lens runs are deliberately excluded). **In the
+fast path, never run `council tally` yourself.** The ledger is append-only, so a second tally over
+the same run double-appends: that permanently doubles every affected model's `conformance` histogram
+in `amicus council stats` and cannot be undone. (It does *not* skew the lifetime averages — a
+duplicated set of rows has the same mean — and since v4.8 it no longer inflates `runs`/`low-N`
+either, because a re-tally of the same input carries the same `meta.runId`. That last part needs
+`meta.runId` to be a non-empty string: an empty or numeric one is not an identity, so each row
+counts individually and a re-tally of that input still doubles `runs`. Engine-produced runs always
+mint a real id; hand-assembled tally input may not.)
 Everything you would have wanted from it (tiers, both street-cred numbers, `runStats`,
 `tierCounts`) is already in `<run-folder>/tally.json`. The quantitative reviewer-reliability data
 in `MODEL-NOTES.md` is sourced entirely from `amicus council stats` (which aggregates the ledger) —
@@ -451,11 +459,14 @@ The engine's tally stage computes the two scoring signals and writes them to
 
 **Street-cred** — computed two ways:
 - **withSelf** = each model's mean rank position across **all** judges' `FINAL RANKING:` blocks (lower is better).
-- **peersOnly** = mean rank excluding the model's own ranking of itself.
+- **peersOnly** = mean rank excluding this row's own ranking of itself — **by seat, not by model,
+  whenever seat ids are present** (v4.8): on a bench that seats one model twice, the twin's OTHER
+  seat is a real peer and its ranking counts, so only the row's own seat is excluded. Without seat
+  ids the engine falls back to excluding by alias, the pre-v4.8 behaviour.
 
 Both are surfaced in `report.html` and `report.md`. The ledger and Stage-0 bench recommendations use **peersOnly** only.
 
-**Per-finding peer-confidence tier** — assigned by the peers-only cascade (see COUNCIL-DESIGN.md §5.2 for the full table): **Disputed** → **Confirmed** → **Contested** → **Singleton**. The raiser's own adjudication is excluded from the cascade. `confidence: thin` when total engaged peers `a + d ≤ 1` — cells `(0,0)`, `(1,0)`, `(0,1)`. **Claude may override a `thin` tier at the margins** before presenting Stage 4 — the override is recorded in `tierOverride: {from, to, reason}` and surfaced in `verdict.json`.
+**Per-finding peer-confidence tier** — assigned by the peers-only cascade (see COUNCIL-DESIGN.md §5.2 for the full table): **Disputed** → **Confirmed** → **Contested** → **Singleton**. The raiser's own adjudication is excluded from the cascade — **by seat, not by model, whenever seat ids are present** (v4.8): on a bench that seats one model twice, the twin's vote is a real peer vote and is now counted, and only the raising *seat's* own vote is dropped. Without seat ids on both the vote and the finding the engine falls back to excluding by alias, which is the pre-v4.8 behaviour. `confidence: thin` when total engaged peers `a + d ≤ 1` — cells `(0,0)`, `(1,0)`, `(0,1)`. **Claude may override a `thin` tier at the margins** before presenting Stage 4 — the override is recorded in `tierOverride: {from, to, reason}` and surfaced in `verdict.json`.
 
 ---
 
@@ -528,10 +539,13 @@ Always **rank recommendations by fit**, state the trade-off for each option, and
   - `briefing.md` — the Stage-0 review request Claude authored (run provenance, not a temp file)
   - `review-claude.md` — Claude's own fresh review, only when "Claude in the council" is on
   - `run.json` — the engine's run manifest: stage log, wave ids, degradation, `runStats`, cost
-  - `review-<model>.md` ×N and `judge-<model>.md` ×N — the raw engine legs
+  - `review-<seat>.md` ×N and `judge-<seat>.md` ×N — the raw engine legs. `<seat>` is the bench
+    seat's id, which **is** the model alias for any bench that names each alias once; seat one and
+    seat two of a repeated alias write `…-<alias>-1.md` and `…-<alias>-2.md` instead of sharing
+    one file
   - `briefing-stage1.md`, `bundle-stage2.md`, `chair-packet.md` — the model-facing briefings the engine composed
   - `tally-input.json` and `tally.json` — the assembled input and the tiered record (plus `tally-provisional.json` and `debate.json` when `--debate` was on)
-  - `rebuttal-<model>.md` ×(raisers) and `revote-bundle.md` + `revote-<model>.md` ×(disputing judges) — the debate round's raw defense and re-vote leg outputs plus the shared re-vote prompt, only when `--debate` was on
+  - `rebuttal-<seat>.md` ×(raising seats) and `revote-bundle.md` + `revote-<seat>.md` ×(disputing seats) — the debate round's raw defense and re-vote leg outputs plus the shared re-vote prompt, only when `--debate` was on. Both waves are sized in seats, so a bench that repeats an alias buys up to two extra billed legs per duplicated pair per round (one defense solo, one re-vote leg), each of which may draw its own bounded repair solo
   - `chair-output.md` — the chair's synthesis prose, verbatim from the chair model
   - `decisions.json` — the Stage-4 decision array Claude writes
   - `verdict.json` — schema-stamped machine-readable record: tally output + Stage-4 decisions, written via `amicus council verdict` at Stage 5 (replacing the engine's undecided version)

package/src/cli-handlers-doctor.js

@@ -14,6 +14,9 @@ const electronMcpCheck = require('./utils/doctor-electron-mcp-check');
 const localProvidersCheck = require('./utils/doctor-local-providers-check');
 // v4.6.2 PR1 (spec §4) — the 'anthropic-base-url' check body.
 const baseUrlCheck = require('./utils/doctor-base-url-check');
+// B3 (council review of PR 198, issue 195) — the 'aliases' check body,
+// including its --fix repair of fabricated bare ids. Same split rationale.
+const aliasCheck = require('./utils/doctor-alias-check');
 
 const MAX_CATALOG_AGE_MS = 24 * 60 * 60 * 1000; // 24h (mirrors model-catalog DEFAULT_MAX_AGE_MS)
 
@@ -41,6 +44,10 @@ function realDeps() {
     collectAliasSources: () => require('./utils/alias-audit').collectAliasSources(),
     findStaleAliases: (s, c) => require('./utils/alias-audit').findStaleAliases(s, c),
     findDriftedStoredAliases: (s, c) => require('./utils/alias-audit').findDriftedStoredAliases(s, c),
+    // B3: the narrow fabricated-bare-id repair class (pure detection) + the
+    // impure rewrite primitive `doctor --fix` calls when repairing one.
+    findFabricatedAliasRepairs: (s, c) => require('./utils/alias-audit').findFabricatedAliasRepairs(s, c),
+    repairAlias: (alias, newId) => aliasCheck.repairAlias(alias, newId),
     hasOpencodeBinary: () => {
       // Single source of truth shared with the runtime server-start guard.
       const { ensureNodeModulesBinInPath, hasOpencodeBinary } = require('./utils/path-setup');
@@ -82,12 +89,16 @@ function realDeps() {
     unlinkSessionIndexTmp: (n) => tmpSweep.unlinkSessionIndexTmp(n),
     listSessionMetadataTmpFiles: () => metaSweep.listSessionMetadataTmpFiles(), // D8
     unlinkSessionMetadataTmp: (n) => metaSweep.unlinkSessionMetadataTmp(n),
+    listStaleSessionIndexEntries: () => indexPrune.listStaleSessionIndexEntries(), // R16
+    pruneStaleSessionIndexEntries: (ids) => indexPrune.pruneStaleSessionIndexEntries(ids),
   };
 }
 // B15: sweep logic in utils/session-index-tmp-sweep.js (mirrors mcp-legacy's split).
 const tmpSweep = require('./utils/session-index-tmp-sweep');
 // D8: per-session metadata.json sibling sweep — utils/session-metadata-tmp-sweep.js.
 const metaSweep = require('./utils/session-metadata-tmp-sweep');
+// R16: stale sessions-index.json entry prune — utils/session-index-prune.js (mirrors B15 above).
+const indexPrune = require('./utils/session-index-prune');
 
 /** Run one guarded check; a thrown fn becomes an error line. */
 function guard(id, name, fn) {
@@ -152,20 +163,10 @@ async function runDoctorChecks(depsOverride = {}) {
       : { id: 'catalog', name: 'Model catalog', status: 'warn', message: `stale (${hrs}h old)`, hint: 'amicus models --refresh' };
   }));
 
-  checks.push(guard('aliases', 'Model aliases', () => {
-    const cache = d.readCache();
-    const catalog = (cache && cache.models) || [];
-    const sources = d.collectAliasSources();
-    const stale = d.findStaleAliases(sources, catalog);
-    const drifted = d.findDriftedStoredAliases(sources, catalog);
-    if (stale.length === 0 && drifted.length === 0) {
-      return { id: 'aliases', name: 'Model aliases', status: 'ok', message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null };
-    }
-    const parts = [];
-    if (stale.length) { parts.push(`${stale.length} stale: ${stale.map(s => s.alias).join(', ')}`); }
-    if (drifted.length) { parts.push(`${drifted.length} drifted: ${drifted.map(s => s.alias).join(', ')}`); }
-    return { id: 'aliases', name: 'Model aliases', status: 'warn', message: parts.join('; '), hint: 'amicus models --check' };
-  }));
+  // B3: self-heals in place under --fix (fabricated bare ids only) — see
+  // utils/doctor-alias-check.js for the check body and utils/alias-audit.js's
+  // findFabricatedAliasRepairs for the detection rule.
+  checks.push(guard('aliases', 'Model aliases', () => aliasCheck.evaluateAliasesCheck(d)));
 
   checks.push(guard('anthropic-base-url', 'ANTHROPIC_BASE_URL',
     () => baseUrlCheck.evaluateAnthropicBaseUrl(d)));
@@ -205,6 +206,9 @@ async function runDoctorChecks(depsOverride = {}) {
 
   checks.push(guard('sessions-index-tmp', 'Session index tmp files', () => tmpSweep.evaluateSessionIndexTmpSweep(d)));
 
+  // R16: beside its sibling above — same file, a different growth gap.
+  checks.push(guard('sessions-index-prune', 'Session index stale entries', () => indexPrune.evaluateSessionIndexPrune(d)));
+
   checks.push(guard('session-metadata-tmp', 'Session metadata tmp files', () => metaSweep.evaluateSessionMetadataTmpSweep(d)));
 
   // #43: OpenRouter credit/free-tier — warns (never errors); skipped when no key.

package/src/council/anonymize.js

@@ -14,10 +14,36 @@ const LETTERS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
 /**
  * Assign stable labels in the given model order.
  * @param {string[]} models reviewed model ids (bench order)
+ * @param {?Array<?{id: string, alias: string}>} [seats] (v4.8 T3.2) the bound
+ *   seat (or null/undefined) for each entry, SAME length/order as `models`.
+ *   Optional — every pre-T3.2 caller omits it. This is NOT the positional join
+ *   run-assemble.js's buildTallyInput docblock forbids for meta.seats (that one
+ *   joins meta.seats to the INDEPENDENTLY-sourced/filtered meta.models or
+ *   streetCred[]): here both arrays are built by the ONE caller from the SAME
+ *   source list in the SAME pass (run.js's `s1.reviews.map(...)`, twice), the
+ *   same positional pairing run.js already relies on one block below
+ *   (`labels.entries[i]` against `s1.reviews[i]`).
  * @returns {{entries: Array<{label: string, letter: string, model: string}>,
- *   labelMap: Object<string, string>, letterByModel: Object<string, string>}}
+ *   labelMap: Object<string, string>, seatMap: Object<string, string>}}
+ *   `labelMap` is UNCHANGED by this task — label -> alias, byte-identical.
+ *   This is a controller ruling (P-3): `labelMap` is persisted to run.json and
+ *   schemas/council-run.schema.json:45 declares its shape, and
+ *   src/workspace/blind-mode.js :: labelFor does an EXACT-STRING match against
+ *   its VALUE — measured 2026-08-20, `labelFor("gemini", {'Review A':'gemini#1'})`
+ *   -> `null`, the label silently lost. Seat identity rides the separate,
+ *   additive `seatMap` below instead.
+ *   `seatMap` (label -> seat id) is sparse by construction: a label lands in
+ *   it only when `seats[i]` is a real bound seat that differs from its own
+ *   alias — the shared emit-when-DIFFERENT predicate every other seat-emit
+ *   producer uses (run-stats-entry.js:64: `seat.id !== seat.alias`). On a
+ *   unique-alias bench, or when `seats` is omitted entirely, `seatMap` is
+ *   `{}` — so no pre-T3.2 caller (or consumer of just `{entries, labelMap}`)
+ *   can observe a change. T3.2 wired `seatMap` only as far as
+ *   `rankingToOrder`'s `orderSeats` below; consuming it into street cred was
+ *   T3.3's, and T3.3 SHIPPED — street-cred.js :: computeStreetCred now keys on
+ *   it, so this channel has a live consumer rather than a forecast one.
  */
-function assignLabels(models) {
+function assignLabels(models, seats) {
   if (!Array.isArray(models) || models.length === 0 || models.length > LETTERS.length) {
     throw new Error(`assignLabels needs 1-${LETTERS.length} models`);
   }
@@ -25,12 +51,17 @@ function assignLabels(models) {
     label: `Review ${LETTERS[i]}`, letter: LETTERS[i], model,
   }));
   const labelMap = {};
-  const letterByModel = {};
   for (const e of entries) {
     labelMap[e.label] = e.model;
-    letterByModel[e.model] = e.letter;
   }
-  return { entries, labelMap, letterByModel };
+  const seatMap = {};
+  if (Array.isArray(seats)) {
+    entries.forEach((e, i) => {
+      const seat = seats[i];
+      if (seat && seat.id !== seat.alias) { seatMap[e.label] = seat.id; }
+    });
+  }
+  return { entries, labelMap, seatMap };
 }
 
 /** Rewrite a review's local integer finding id to its run-global label id. */
@@ -43,14 +74,29 @@ function toGlobalId(letter, localId) {
  * @param {string} letter review letter (e.g. 'A')
  * @param {string} raiser de-anonymized model id
  * @param {Array<{id: number, severity: string, claim: string, location: string}>} findings
+ * @param {?string} raiserSeat (v4.8 PR3 Task 5) the raiser's bound seat id —
+ *   emitted ONLY when truthy AND different from `raiser` (emit-when-DIFFERENT,
+ *   not emit-when-set). On a unique-alias bench seat.id === alias, so the
+ *   field stays absent and tally-input.json/tally.json/verdict.json stay
+ *   byte-identical artifacts. Absent entirely on the Claude review call site
+ *   (3 args) — Claude is never a seat.
+ *   ⚠️ v4.8 PR4c R4c-9: the `raiserSeat !== raiser` half is now provably DEAD on
+ *   the engine path. run.js's call site gates on `seat.id !== seat.alias`, and
+ *   for every bench preflightSeats admits that implies `seat.id !== r.model`.
+ *   It is KEPT as defense in depth for the hand-assembled callers (this module
+ *   is pure and has no seat table to consult), and tests/council/
+ *   run-raiserseat-call.test.js exists so that removing EITHER guard fails a
+ *   test — but do not read it as a second, independent decision about an
+ *   engine-produced run.
  * @returns {Array<{id: string, raiser: string, severity: string, claim: string, location: string}>}
  */
-function toGlobalFindings(letter, raiser, findings) {
+function toGlobalFindings(letter, raiser, findings, raiserSeat) {
   // claim + location must reach tally-input.json — Action v2 (Plan C) joins on
   // them for file:line annotations; tally() reads only id/raiser/severity.
   return findings.map(f => ({
     id: toGlobalId(letter, f.id), raiser, severity: f.severity, claim: f.claim,
     location: f.location,
+    ...(raiserSeat && raiserSeat !== raiser ? { raiserSeat } : {}),
   }));
 }
 
@@ -59,18 +105,41 @@ function toGlobalFindings(letter, raiser, findings) {
  * a tally rankings[].order array of model ids via the private label map.
  * @param {Array<string|string[]>} ranking
  * @param {Object<string, string>} labelMap
- * @returns {{order: Array<string|string[]>, errors: string[]}}
+ * @param {Object<string, string>} [seatMap] (v4.8 T3.2) assignLabels' additive
+ *   label -> seat-id channel. Optional; every pre-T3.2 caller omits it.
+ * @returns {{order: Array<string|string[]>,
+ *   orderSeats: Array<?string|Array<?string>>, errors: string[]}}
+ *   `order` and `errors` are UNCHANGED — same expression, same call to
+ *   `mapOne`, so briefings-chair.js and the tally schema stay unmoved
+ *   (SI-25 site (3) becomes *possible*, not *done*: T3.2 does not touch that
+ *   call site). ⚠️ THAT PARENTHESIS IS T3.2's OWN HISTORY, NOT THE PRESENT
+ *   STATE — kept because it says what T3.2 did and did not do. SI-25 has since
+ *   DONE site (3): `briefings-chair.js :: seatKeyedOrder` consumes `orderSeats`
+ *   to render the chair packet's rankings block. Only the tally schema still
+ *   stays unmoved. `orderSeats` is the NEW, separate, parallel channel: the SAME
+ *   slots resolved through `seatMap` instead of `labelMap` — a by-VALUE
+ *   (label) lookup mirroring `order`'s own resolution, never a positional
+ *   join across two independently-sourced arrays. `null` marks a slot whose
+ *   label has no distinguishing seat (unique-alias bench, or no `seatMap`
+ *   given at all — every pre-T3.2 call site). T3.2 wired `orderSeats` no
+ *   further than its `judgeResults[]` call site in run-stage2.js. T3.3 carried
+ *   it one hop on, to `rankings[]` in run-assemble.js :: buildTallyInput, and
+ *   seat-keyed street-cred.js :: rankPositions with it — emitting the field
+ *   only when it holds a non-null, because THIS function returns an all-null
+ *   parity shape rather than an absence.
  */
-function rankingToOrder(ranking, labelMap) {
+function rankingToOrder(ranking, labelMap, seatMap) {
   const errors = [];
   const mapOne = (label) => {
     const model = labelMap[label];
     if (!model) { errors.push(`unknown label '${label}'`); }
     return model;
   };
-  const order = (Array.isArray(ranking) ? ranking : [])
-    .map(slot => (Array.isArray(slot) ? slot.map(mapOne) : mapOne(slot)));
-  return { order, errors };
+  const seatOne = (label) => (seatMap && seatMap[label]) || null;
+  const slots = Array.isArray(ranking) ? ranking : [];
+  const order = slots.map(slot => (Array.isArray(slot) ? slot.map(mapOne) : mapOne(slot)));
+  const orderSeats = slots.map(slot => (Array.isArray(slot) ? slot.map(seatOne) : seatOne(slot)));
+  return { order, orderSeats, errors };
 }
 
 module.exports = { assignLabels, toGlobalId, toGlobalFindings, rankingToOrder, LETTERS };