amicus 4.8.0 → 4.9.0

package/electron/workspace-ui/live-dead-seats.js

@@ -5,66 +5,105 @@
 // Self-contained: it reads only its four arguments and owns its own isReviewing.
 (function () {
   /**
-   * D6 (v4.6.2 PR4 Task 2, "dead-seat rows"): announced-dead seats, unioned
-   * from the run's own `degrades[]` (dead-leg/dead-wave channels — the live
-   * announcement; shapes verified against src/council/run-retry-notes.js and
-   * the skipped-path notes at src/council/run-stages.js:155-174) and the
-   * verdict's derived `seatLoss` (verdict.js summarizeSeatLoss/deriveSeatLoss
-   * — the critic-loss backstop, kept for verdicts written before `degrades[]`
-   * existed, v4.5.2 precedent). De-duped by seat model: `degrades` is scanned
-   * FIRST, so a real record's retry marker always beats the backstop's
-   * no-data guess for the same seat.
+   * The kind/channel admission rule, v4.9 W9 (SI-02). ⚠️ MIRROR — this rule is spelled a
+   * second time at `workspace-seats.js :: retriedSeats`, and the two MUST move together
+   * (two spellings of one rule is PR5a council finding B1; the mirror is declared in that
+   * function's docblock). A renderer module cannot `require` src/ and this file cannot
+   * `require` its sibling, so the mirror is enforced behaviourally instead: the drift pin
+   * in `tests/workspace/workspace-seats.test.js` drives BOTH consumers with one fixture set.
    *
-   * `retried` reads `data.retryWaveId` / `data.firstFailure`: every
-   * still-dead-after-retry note (run-retry-notes.js's four builders) carries
-   * `retryWaveId`; the two run-stages.js skipped-path notes (fired when the
-   * once-only retry pass never even attempted the seat — an unmappable lens
-   * loss, an out-of-range index, or a zero-model unit) carry neither, so they
-   * correctly fall back to the plain phrasing.
+   * ⚠️ A kind-LESS record IS a degrade (W9 fix round, council C4). Both renderers read
+   * `run.json`/`verdict.json` off DISK — `workspace-seats.js :: renderSeatsPanel` even falls back
+   * to `verdict.degrades` — i.e. exactly the documents `report.js`'s LEGACYDROP note is about:
+   * they can PREDATE kinds, and `utils/degrade.js :: formatDegrade` still serves such a record as
+   * 'Notice'. A positive `kind === 'degrade'` silently dropped every one of them.
    *
-   * D6 filter (zero usable legs ONLY, "no ghost when a live row already
-   * exists"): a candidate already present in `liveSeats` is dropped. Two
-   * different things can put it there, and both are reasons to suppress:
-   * an SL-2 retry actually healed it (a real recovered review), OR
-   * (owner-ruled, v4.7 CA-4 dead-seat convergence) the seat never recovered
-   * at all but the row-per-launch machinery still gives its dead leg an
-   * honest primary ERROR row (every billed leg gets a row now, including
-   * failures — run-stages.js/run-assemble.js) — so "it has a cost row" no
-   * longer implies "it healed". Either way that live row IS the seat's
-   * record; rendering a second "did not review" ghost row beside it would
-   * be a duplicate, not new information, so suppressing it here is the
-   * ACCEPTED terminal-path behavior: exactly one row per seat, whatever its
-   * status. This is the one thing standing between a recovered (or
-   * honestly-erred) seat and a duplicate/ghost row — same failure family as
-   * the F37 debate-role collision and the RN-11 keyed-row lessons just above
-   * (seatsFromRunStats, seatCells): an identity that is not carefully
-   * matched silently duplicates or overwrites instead of failing loud.
+   * `dead-leg`/`dead-wave` are admitted unconditionally — the skipped-LEG note (`run-stages.js`,
+   * fired when the once-only retry never attempted the seat) carries no retry-family field and
+   * must still render, with the plain phrasing.
    *
-   * Role-aware D6 (v4.6.3 PR2, spec D3): a bare model match used to suppress
-   * regardless of what the LIVE row's role was — so a model that died as
-   * critic but whose chair-fallback walk happened to land on that same alias
-   * (and succeeded, producing a live `role: 'chair'` cost row) silently
-   * erased the dead-critic row it was never a replacement for (spec §5, the
-   * PR 102 rider). Candidates now carry a `role` (`'critic'` via alias equality
-   * with `runMeta.critic` — mirroring `deriveSeatLoss`, verdict.js:72 — or
-   * `null`), and only REVIEWING-role live legs (`seat`/`critic`/`lens:*`)
-   * suppress at all; a `'critic'` candidate is cleared only by a live
-   * CRITIC-role leg for that alias, never by a chair/judge/rebuttal/revote
-   * row landing on the same model. Hidden dependency: the recovered-critic
-   * suppression below (`byRole[alias + '|critic']`) relies on `roleFor`'s
-   * critic branch (src/council/run-stages.js), which only fires when lenses
-   * are absent — safe today only because --critic and --lenses are mutually
-   * exclusive (src/cli-handlers-council-run.js's `critic && lenses` check); if
-   * that exclusion ever loosens, a healed critic on a lens run would carry
-   * role 'seat' and this suppression would render a ghost dead row for it.
+   * `seat-unbound` is admitted GATED, never raw: it is a SHARED channel with SEVEN emit sites
+   * (re-counted 2026-08-26 — FOUR arms of `run-retry-notes.js`, one in each of `stage1-bind.js`,
+   * `run-debate-revote.js` and `run-stage2.js`) that do NOT mean the same thing. `orphanLegNote`
+   * and `reVoteUnboundNote` mean "a leg LANDED but names no seat/judge" — a review that was paid
+   * for and rendered, not a lost seat; `run-stage2.js`'s judge-side note names a seat that DID
+   * review and merely failed to judge. None of the three carries `retryWaveId` or `firstFailure`
+   * (measured), so the retry-family test excludes all three and the BACKLOG's proposed
+   * `data.legId` discriminator is subsumed rather than duplicated.
    *
-   * Old-run resilience (v4.6.3 PR2, spec D4): pre-`degrades[]` runs (v4.5.2)
-   * carry the BENCH half of a seat loss only in `seatLoss.deadBenchSeats`
-   * (string[] of aliases, verdict.js deriveSeatLoss) — `degrades[]` never
-   * existed on either doc for these runs. Consumed after the critic backstop,
-   * candidates get `role: null` (deadBenchSeats carries no critic/bench
-   * distinction beyond what `criticRequested` already covers above) and flow
-   * through the same dedup and role-aware suppression as every other candidate.
+   * ⚠️ The seat conjunct is HONESTLY belt-and-braces HERE and load-bearing in the third twin.
+   * Measured: dropping it from this function reds nothing, because `add()` already refuses a
+   * candidate with no alias; dropping it from `verdict-seat-loss.js :: deriveSeatLoss` puts an
+   * `undefined` into `deadBenchSeats`, which every reader of that list treats as a seat. It is
+   * kept in all three so one rule has one spelling — pinned on the verdict side.
+   *
+   * ⚠️ R-W9a is CLOSED at the PRODUCER (W9 fix round, council A1/C1): `run-retry-notes.js ::
+   * skippedWaveNote` emits the `firstFailure` fact its record already carried, so this gate
+   * admits that real loss UNCHANGED and the three controls above still fail it.
+   */
+  function isSeatLoss(d) {
+    if (!d || (d.kind !== undefined && d.kind !== 'degrade')) { return false; }
+    if (d.channel === 'dead-leg' || d.channel === 'dead-wave') { return true; }
+    if (d.channel !== 'seat-unbound') { return false; }
+    var data = d.data || {};
+    return !!((data.retryWaveId || data.firstFailure) && (data.seatId || data.seat));
+  }
+
+  /**
+   * D6 (v4.6.2 PR4 Task 2, "dead-seat rows"): announced-dead seats, unioned from the run's own
+   * `degrades[]` (the loss channels `isSeatLoss` above admits — the live announcement; shapes
+   * verified against src/council/run-retry-notes.js, which since the W9 fix round owns the
+   * skipped-path WAVE note too, plus the `retry.skippedDeadLegs` loop still in run-stages.js —
+   * anchored BY SYMBOL at v4.9 W9, the old `:155-174` having rotted onto the materialize/repair
+   * block) and the verdict's derived `seatLoss` (verdict-seat-loss.js's summarizeSeatLoss /
+   * deriveSeatLoss — the critic-loss backstop, kept for verdicts written before `degrades[]`
+   * existed, v4.5.2 precedent). De-duped by seat model: `degrades` is scanned FIRST, so a real
+   * record's retry marker always beats the backstop's no-data guess for the same seat.
+   *
+   * `retried` reads `data.retryWaveId` ALONE — narrowed in the W9 fix round, named mutant
+   * SKIPRETRIED. That field exists if and only if a retry wave was actually LAUNCHED for the
+   * seat: every still-dead-after-retry builder emits it, and both skipped-path notes (the retry
+   * never attempted the seat — an unmappable lens loss, an out-of-range index, a zero-model
+   * unit, or `overBudget()`) emit none, so they keep the plain phrasing. ⚠️ `firstFailure` is
+   * NOT a retry marker: `skippedWaveNote` (the sole `firstFailure`-without-`retryWaveId`
+   * producer) describes a seat never retried; every RETRIED seat's builder emits the former.
+   *
+   * D6 filter (zero usable legs ONLY, "no ghost when a live row already exists"): a candidate
+   * already present in `liveSeats` is dropped. Two different things can put it there and both
+   * are reasons to suppress: an SL-2 retry actually healed it (a real recovered review), OR
+   * (owner-ruled, v4.7 CA-4 dead-seat convergence) the seat never recovered at all but the
+   * row-per-launch machinery still gives its dead leg an honest primary ERROR row (every billed
+   * leg gets a row now, including failures — run-stages.js/run-assemble.js), so "it has a cost
+   * row" no longer implies "it healed". Either way that live row IS the seat's record, and a
+   * second "did not review" ghost beside it is a duplicate, not new information — so suppressing
+   * here is the ACCEPTED terminal-path behavior: exactly one row per seat, whatever its status.
+   * It is the one thing standing between a recovered (or honestly-erred) seat and a duplicate
+   * row — the F37 debate-role and RN-11 keyed-row family (seatsFromRunStats, seatCells): an
+   * identity that is not carefully matched silently duplicates or overwrites instead of failing.
+   *
+   * Role-aware D6 (v4.6.3 PR2, spec D3): a bare model match used to suppress regardless of what
+   * the LIVE row's role was — so a model that died as critic but whose chair-fallback walk
+   * happened to land on that same alias (and succeeded, producing a live `role: 'chair'` cost
+   * row) silently erased the dead-critic row it was never a replacement for (spec §5, the PR 102
+   * rider). Candidates now carry a `role` — `'critic'` or `null`, decided by `roleOf` below,
+   * which since v4.9 W9 (R4) keys on SEAT identity whenever the record and the run can both
+   * spell it and falls back to alias equality otherwise (so it no longer mirrors
+   * verdict-seat-loss.js :: deriveSeatLoss, which stays alias-keyed on purpose) — and only
+   * REVIEWING-role live legs (`seat`/`critic`/`lens:*`) suppress at all; a `'critic'` candidate
+   * is cleared only by a live CRITIC-role leg for that seat (alias where no seat id exists),
+   * never by a chair/judge/rebuttal/revote row landing on the same model. Hidden dependency: the
+   * recovered-critic suppression below (`byRole[key + '|critic']`) relies on `roleFor`'s critic
+   * branch (src/council/run-stages.js), which only fires when lenses are absent — safe today
+   * only because --critic and --lenses are mutually exclusive (src/cli-handlers-council-run.js's
+   * `critic && lenses` check); if that exclusion ever loosens, a healed critic on a lens run
+   * would carry role 'seat' and this suppression would render a ghost dead row for it.
+   *
+   * Old-run resilience (v4.6.3 PR2, spec D4): pre-`degrades[]` runs (v4.5.2) carry the BENCH
+   * half of a seat loss only in `seatLoss.deadBenchSeats` (string[] of aliases, deriveSeatLoss)
+   * — `degrades[]` never existed on either doc for these runs. Consumed after the critic
+   * backstop, candidates get `role: null` (deadBenchSeats carries no critic/bench distinction
+   * beyond what `criticRequested` already covers above) and flow through the same dedup and
+   * role-aware suppression as every other candidate.
    *
    * ⚠️ v4.8 PR5c corrected HOW that dedup works, and the old description here was
    * wrong once seats were keyed. Candidates arrive in FOUR identity flavours, and the
@@ -75,7 +114,9 @@
    *                it on the alias is what collapsed two dead twins into one row.
    *   'legacy'     a pre-PR5c record with no seat id anywhere -> dedup on the alias,
    *                which still collapses twins. Disclosed residual R2.
-   *   'derivative' seatLoss-sourced. verdict.js:86 builds deadBenchSeats FROM the same
+   *   'derivative' seatLoss-sourced. `verdict-seat-loss.js :: deriveSeatLoss` (by SYMBOL — the
+   *                old `verdict.js:86` rotted in v4.9 W9, and the function has since left
+   *                verdict.js entirely) builds deadBenchSeats FROM the same
    *                dead legs that emit degrades[], so it is always a duplicate and is
    *                the ONLY flavour that may be absorbed by an alias already covered.
    *                Absorbing a real degrade instead would erase an unidentified twin.
@@ -86,8 +127,9 @@
    *   `deadBenchSeats` (string[] of aliases) feeds the bench candidates below
    * @param {Array<{model: string}>} liveSeats  seatsFromRunStats(...)'s output
    *   (or any seat list keyed the same way — the live seat map)
-   * @param {?{critic: ?string}} runMeta  run.critic (alias, or null/absent
-   *   when no critic was requested) — degrade records carry no role field, so
+   * @param {?{critic: ?string, criticSeat: ?string}} runMeta  run.critic (alias) and
+   *   run.criticSeat (the seat id `seats.js :: preflightSeats` resolved for it), each
+   *   null/absent when no critic was requested — degrade records carry no role field, so
    *   this is the ONLY way a degrade-sourced candidate is identified as critic
    * @returns {Array<{model: string, seat: ?string, statusText: string, role: ?string}>}
    *   `model` is the ALIAS (what the row displays, what labelOf keys on); `seat` is
@@ -95,11 +137,28 @@
    */
   function deadSeats(degrades, seatLoss, liveSeats, runMeta) {
     var critic = runMeta && runMeta.critic ? runMeta.critic : null;
-    // ⚠️ Object.create(null) throughout this family (also workspace-render.js's
-    // `existing`/`seen` and workspace-app.js's `labelByModel`): a model literally
-    // named `toString` is truthy off a bare object, so it was dropped here and —
-    // worse — crashed workspace-render.js:212 reading `.children` off an inherited
-    // function, killing the seats repaint and every tick after it.
+    var criticSeat = runMeta && runMeta.criticSeat ? runMeta.criticSeat : null;
+    // R4 (v4.9 W9). The old rule was `alias === critic`, which on a bench where one alias holds
+    // a critic seat AND a bench seat tagged the WRONG candidate 'critic' — and critic candidates
+    // suppress through `byRole`, a map PR5c's seat-keying never reached, so a dead bench twin
+    // beside a live critic twin rendered NOTHING. Seat identity decides whenever BOTH sides can
+    // spell it; a record with no seat id, or a run with no resolved critic seat (pre-`criticSeat`
+    // run.json), keeps the legacy alias rule rather than guessing.
+    // ⚠️ W9 fix round (council C3): a truthy key is NOT necessarily seat-space. On the INEXACT
+    // twin branch `run-retry-group.js :: recordFailure` keys `firstFailure.seatId` by the ALIAS
+    // (residual R3), so the critic's OWN record can arrive keyed 'gpt' against a criticSeat of
+    // 'gpt#1' and came back role null — while `verdict-seat-loss.js :: deriveSeatLoss`, comparing
+    // `data.seat` to the alias, called that same record a critic loss. The alias arm of the
+    // disjunct IS that legacy rule, so the two surfaces agree; it cannot re-open R4, since a real
+    // bench-twin id ('gpt#2') equals neither operand.
+    function roleOf(key, alias) {
+      if (key && criticSeat) { return (key === criticSeat || key === critic) ? 'critic' : null; }
+      return critic && alias === critic ? 'critic' : null;
+    }
+    // ⚠️ Object.create(null) throughout this family (also workspace-render.js's `existing`/`seen`
+    // and workspace-app.js's `labelByModel`): a model literally named `toString` is truthy off a
+    // bare object, so it was dropped here and — worse — crashed workspace-render.js:212 reading
+    // `.children` off an inherited function, killing the seats repaint and every tick after it.
     var seen = Object.create(null);
     var covered = Object.create(null);
     var seenUnid = Object.create(null);
@@ -108,12 +167,12 @@
     // docblock above, which is what decides the key and the absorb rule.
     function add(key, alias, retried, role, src, slotOf) {
       if (!alias) { return; }
-      // ⛔ An 'unid' candidate was originally given NO dedup at all, on the grounds that it is
-      // one wave slot and distinct by construction. That holds WITHIN a record's seats[]; it
-      // does NOT hold across records, and the same dead-wave record appearing twice rendered
-      // four rows for two seats. Deduped on (waveId, slot) instead — its own namespace, never
-      // `seen`, so an invented key can never collide with a real alias. (The seat literally
-      // named `toString` is why this family refuses keys that share the alias keyspace.)
+      // ⛔ An 'unid' candidate was originally given NO dedup at all, on the grounds that it is one
+      // wave slot and distinct by construction. That holds WITHIN a record's seats[]; it does NOT
+      // hold across records, and the same dead-wave record appearing twice rendered four rows for
+      // two seats. Deduped on (waveId, slot) instead — its own namespace, never `seen`, so an
+      // invented key can never collide with a real alias. (The seat literally named `toString` is
+      // why this family refuses keys that share the alias keyspace.)
       if (src === 'unid') {
         var uk = ((slotOf && slotOf.waveId) || '') + '#' + (slotOf ? slotOf.i : 0);
         if (seenUnid[uk]) { return; }
@@ -140,23 +199,23 @@
       order.push(row);
     }
     (degrades || []).forEach(function (d) {
-      if (!d || d.kind !== 'degrade') { return; }
-      if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave') { return; }
+      if (!isSeatLoss(d)) { return; }
       var data = d.data || {};
-      var retried = !!(data.retryWaveId || data.firstFailure);
-      // Critic identification mirrors deriveSeatLoss (verdict.js): alias
-      // equality with run.critic — degrade records carry no role field.
-      if (d.channel === 'dead-leg') {
+      var retried = !!data.retryWaveId;   // NOT firstFailure — docblock above, mutant SKIPRETRIED
+      // ONE shape, TWO channels: `dead-leg` and every admitted `seat-unbound` arm name a
+      // single seat through `data.seat` (alias) plus an optional seat id — the partial arm's
+      // `data.seatId` (v4.9 W9 P1) or the two missing-leg arms' `firstFailure.seatId`. Only
+      // `dead-wave` is a LIST, which is why the branch tests for it rather than for dead-leg.
+      if (d.channel !== 'dead-wave') {
         var lk = (data.firstFailure && data.firstFailure.seatId) || data.seatId || null;
-        add(lk, data.seat, retried, critic && data.seat === critic ? 'critic' : null,
-          lk ? 'keyed' : 'legacy');
+        add(lk, data.seat, retried, roleOf(lk, data.seat), lk ? 'keyed' : 'legacy');
       } else {
         // `seats[]` is index-parallel with `models[]` (PR5c Task 1). Its ABSENCE means a
         // legacy record; a null ELEMENT means an unidentified seat. Different statements.
         var hasSeats = Array.isArray(data.seats);
         (data.models || []).forEach(function (m, i) {
           var wk = hasSeats ? data.seats[i] : null;
-          add(wk, m, retried, critic && m === critic ? 'critic' : null,
+          add(wk, m, retried, roleOf(wk, m),
             wk ? 'keyed' : (hasSeats ? 'unid' : 'legacy'), { waveId: data.waveId, i: i });
         });
       }
@@ -165,18 +224,15 @@
       add(null, seatLoss.criticRequested, false, 'critic', 'derivative');
     }
     if (seatLoss) {
-      // Pre-degrades[] era (v4.5.2): the bench half of a seat loss lives
-      // only here. Alias strings; deriveSeatLoss does not dedup — `seen`
-      // absorbs repeats and degrade-sourced duplicates.
-      (seatLoss.deadBenchSeats || []).forEach(function (m) {
-        add(null, m, false, null, 'derivative');
-      });
+      // Pre-degrades[] era (v4.5.2): the bench half of a seat loss lives only here. Alias
+      // strings; deriveSeatLoss does not dedup — `seen` absorbs repeats and degrade-sourced
+      // duplicates.
+      (seatLoss.deadBenchSeats || []).forEach(function (m) { add(null, m, false, null, 'derivative'); });
     }
-    // Role-aware D6 (v4.6.3 PR2): only REVIEWING-role live legs suppress —
-    // a chair/judge/rebuttal/revote row must not hide a dead reviewer, and
-    // a dead-critic candidate is cleared only by a live CRITIC leg. A null
-    // role is NOT reviewing: counting it would suppress silently, the exact
-    // class the announcement invariant forbids.
+    // Role-aware D6 (v4.6.3 PR2): only REVIEWING-role live legs suppress — a chair/judge/
+    // rebuttal/revote row must not hide a dead reviewer, and a dead-critic candidate is cleared
+    // only by a live CRITIC leg. A null role is NOT reviewing: counting it would suppress
+    // silently, the exact class the announcement invariant forbids.
     // Role 'claude' is deliberately absent: it is emitted only by claudeRunStatsRow
     // (src/council/run-assemble.js:129-132) for a seat that never launches a leg, and
     // preflightClaudeReview (run-assemble.js:86-102) rejects 'claude' as chair/critic/
@@ -188,6 +244,7 @@
     }
     var reviewing = Object.create(null);
     var byRole = Object.create(null);
+    var byRoleUnseated = Object.create(null);   // alias|role, live legs that named NO seat id
     // ⚠️ Fable review (PR4b fix wave): same F34/F36 alias-selection seatCells already uses
     // (`seat.modelInput || seat.model`, above) — a LIVE payload seat's `model` is the RESOLVED
     // executable id, not the alias a degrade record names; `modelInput` carries the alias.
@@ -208,9 +265,24 @@
       // producers cannot disagree. A bare insert would write a STRING key for every such seat.
       if (s.seat) { reviewing[s.seat] = true; }
       byRole[alias + '|' + s.role] = true;
+      // R4 (v4.9 W9): the seat arm, exactly mirroring `reviewing` two lines up. Without it a
+      // critic candidate carrying a seat id has no seat-keyed entry to match and the lookup
+      // below would fall through to a ghost row on every twin bench.
+      // ⚠️ The ELSE arm is the W9 fix round's (council C2): a live leg that named NO seat id can
+      // only write the alias key, so a seat-KEYED candidate had nothing to match and the read
+      // below rendered a ghost 'critic did not review' row the pre-W9 alias read suppressed.
+      // Kept OUT of `byRole` on purpose — an alias entry written by a SEATED leg must not clear
+      // a different seat's candidate, which is the erasure R4 exists to have fixed.
+      if (s.seat) { byRole[s.seat + '|' + s.role] = true; } else { byRoleUnseated[alias + '|' + s.role] = true; }
     });
     return order.filter(function (s) {
-      if (s.role === 'critic') { return !byRole[s.model + '|critic']; }
+      // Seat where the candidate has one, alias otherwise — the same key `reviewing` uses
+      // below, so the two suppression maps cannot disagree about what a candidate IS. The
+      // second disjunct reads the alias keyspace the WRITE also lands in (C2, above): it is
+      // consulted only for live legs that named no seat, so it cannot re-open R4's erasure.
+      if (s.role === 'critic') {
+        return !(byRole[(s.seat || s.model) + '|critic'] || byRoleUnseated[s.model + '|critic']);
+      }
       // An UNNAMED dead seat is never suppressed by alias evidence. The producer emitted
       // `null` rather than the alias precisely because "unidentified" and "the alias" are
       // different statements; falling back to the alias here would re-assert the equivalence

package/electron/workspace-ui/live-seats.js

@@ -1,8 +1,8 @@
 // electron/workspace-ui/live-seats.js
-// Seats surface: dash, seatCells, SEATS_PANEL_EXCLUDED_ROLES,
-// seatsFromRunStats, deadSeats. Moved verbatim from live-model.js@ac7e7e12:53-285
-// (v4.8 PR0 size-gate split, zero behavior). Loads BEFORE live-model.js,
-// which re-exports these on window.AmicusLive so no consumer changes.
+// Seats surface: dash, seatCells, SEATS_PANEL_EXCLUDED_ROLES, seatsFromRunStats. Moved
+// verbatim from live-model.js@ac7e7e12:53-285 (v4.8 PR0 size-gate split, zero behavior).
+// `deadSeats` moved too, then PR5c split it to live-dead-seats.js :: deadSeats; it is
+// only re-exported here. Loads BEFORE live-model.js, which re-exports on window.AmicusLive.
 // ES5 IIFE, dual export, strict-CSP <script> loading — same shape as
 // every renderer module. Comments write "PR 102", never the hash-number
 // form (electron-token-drift HEX_RE trips on it — this file is scanned).

package/electron/workspace-ui/workspace-banners.js

@@ -60,15 +60,38 @@
         '. This run directory cannot distinguish those artifacts, so prose below may be misattributed.', '');
       return;
     }
-    // ⚠️ Fix-wave 3 (council-3 C2): seats[] was present but malformed, so the whole run fell
-    // back to alias space — two seats running one model are indistinguishable in every panel
-    // below. Fail-safe, but SILENT until now, which the product principle rejects as hard as
-    // a crash. Ranked AFTER the collision banner (that one says prose may be misattributed,
-    // strictly worse) and BEFORE run.error, since it qualifies how to read every panel.
+    // ⚠️ Fix-wave 3 (council-3 C2): seats[] was present but malformed, so the run's ARTIFACT
+    // NAMING fell back to alias space — two seats running one model are indistinguishable in
+    // the prose panels. Fail-safe, but SILENT until now, which the product principle rejects
+    // as hard as a crash. Ranked AFTER the collision banner (that one says prose may be
+    // misattributed, strictly worse) and BEFORE run.error, since it qualifies how to read
+    // those panels.
+    // ⚠️ This comment used to say "the WHOLE run fell back to alias space … in every panel
+    // BELOW", and W9 measured that as FALSE (it was already false when written, not falsified
+    // by this change — the same reading the banner string itself shipped). The correction and
+    // its evidence are below, where the sentence the user actually reads is built.
+    // ⚠️ v4.9 W9 PR5b-1 (ruling V15, disclosure over uniformity): this used to end "cannot be
+    // told apart BELOW" — a blanket claim over the whole detail view, and measurably too wide.
+    // `seatTableRejected` reaches exactly one surface: derived.seatSpace goes false, so
+    // workspace-lazy.js :: roster falls back to `bench` and the reviews/judges/re-vote panels
+    // name their artifacts by alias. Everything sourced from tally.json is untouched — the
+    // seats panel's rows are live-seats.js :: seatsFromRunStats over run-detail.js ::
+    // costPanel's `tally.runStats` projection, keyed on `r.seat || r.model`, and `r.seat` is
+    // stamped by run-stats-entry.js :: buildRunStatsEntry from the IN-MEMORY seat at assembly
+    // (run-assemble.js :: buildTallyInput), not from the run.json table that failed to parse.
+    // A twin bench therefore still gets two seat rows carrying their own numbers.
+    // V15's ruling is to DISCLOSE that split rather than force the seats panel down to
+    // derived.seatSpace for uniformity, which would throw away data that is truthful.
+    // ⚠️ The ROWS are per-seat; the NAMES are not. live-seats.js :: seatCells prints
+    // `seat.modelInput || seat.model` — the alias — so the sentence claims separate NUMBERS,
+    // never distinguishable names. Wording pinned full-string in workspace-app-boundary.test.js.
     if (d.derived.seatTableRejected) {
       R.renderBanner(el, 'This run\'s seat table could not be read (a malformed entry), so ' +
-        'artifacts are shown by model alias instead of per seat — two seats running the same ' +
-        'model cannot be told apart below. Artifacts: ' + d.runDir, 'warn');
+        'the reviews, judges and re-vote panels name their artifacts by model alias instead ' +
+        'of per seat — two seats running the same model cannot be told apart there. The seats ' +
+        'panel is NOT affected: its rows come from tally.json\'s runStats, one per seat, so ' +
+        'both seats\' numbers are still shown separately, sharing the alias as a name. ' +
+        'Artifacts: ' + d.runDir, 'warn');
       return;
     }
     // ⚠️ PRE-FLIGHT (P3), caught live by the CDP e2e (Task 18): gating on `d.run.error` ALONE

package/electron/workspace-ui/workspace-matrix.js

@@ -126,9 +126,15 @@
     container.textContent = '';
     var head = R.el('div', { className: 'chips' }, []);
     if (vp.overallVerdict) {
-      head.appendChild(R.el('span', { className: 'chip complete' }, ['VERDICT: ' + vp.overallVerdict]));
+      // v4.9 W8: the chip names the SCALE the phrase belongs to — a task chair's
+      // phrase comes from CHAIR_ANSWERS and is never a verdict. Payload-driven:
+      // this file cannot require() src/, so run-detail.js :: verdictPanel mints
+      // `intent`. `=== 'task'` (not `!== 'review'`) so a pre-v4.9 payload with no
+      // intent key reads as review instead of relabelling every legacy run.
+      head.appendChild(R.el('span', { className: 'chip complete' },
+        [(vp.intent === 'task' ? 'ANSWER: ' : 'VERDICT: ') + vp.overallVerdict]));
     } else {
-      head.appendChild(R.el('span', { className: 'chip error' }, ['no chair verdict']));
+      head.appendChild(R.el('span', { className: 'chip error' }, [vp.intent === 'task' ? 'no chair answer' : 'no chair verdict']));
       if (vp.reason) { head.appendChild(R.el('span', { className: 'empty-note' }, [vp.reason])); }
     }
     container.appendChild(head);
@@ -145,8 +151,22 @@
 
     if (vp.streetCred && vp.streetCred.length) {
       var rows = vp.streetCred.map(function (s) {
+        // v4.9 W9 — SI-22.4 rider (2): the THIRD street-cred renderer, joining
+        // report-md.js :: renderMd and report-html.js :: renderHtml (v4.8 R22.4-6), which
+        // both label the row `s.seat || s.model`. Until now a twin bench read `gemini#1`/
+        // `gemini#2` in the report and `gemini` TWICE here, different numbers under one
+        // identical name. `seat` is emit-when-DIFFERENT (street-cred.js :: computeStreetCred),
+        // so a unique-alias bench has no seat key and this renders exactly what it did before.
+        // ⚠️ BLIND KEEPS THE ALIAS SPACE, both branches. `opts.labelOf` is ALIAS-keyed
+        // (workspace-app.js's state.labelByModel, from run.json's labelMap — label -> alias,
+        // which the seat work deliberately left alone: anonymize.js :: assignLabels puts seat
+        // identity in the separate seatMap), so the lookup key stays `s.model` and the
+        // signature is unchanged. The fallback stays `s.model` too: a seat id CONTAINS its
+        // alias, so printing one with blind mode on defeats blind mode — the same rule
+        // seat-space.js :: isSeatTable and workspace-lazy.js :: roster were both fixed to.
+        // Named mutant RIDERALIAS (workspace-matrix.test.js).
         var label = opts.labelOf(s.model);
-        var name = opts.isBlind() && label ? label : s.model;
+        var name = opts.isBlind() ? (label || s.model) : (s.seat || s.model);
         var fmt = function (v) { return (v === null || v === undefined) ? '—' : Number(v).toFixed(2); };
         return R.el('tr', {}, [
           R.el('td', {}, [name]),