npm - amicus - Versions diffs - 4.8.1 → 4.9.1 - Mend

amicus 4.8.1 → 4.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (117) hide show

package/.claude-plugin/plugin.json +1 -1
package/CHANGELOG.md +316 -0
package/README.md +8 -3
package/docs/ROADMAP.md +101 -10
package/docs/configuration.md +54 -4
package/docs/council.md +102 -14
package/docs/troubleshooting.md +9 -2
package/docs/usage.md +128 -12
package/electron/ipc-setup.js +41 -18
package/electron/main.js +19 -5
package/electron/offer-session.js +51 -0
package/electron/setup-ui.js +46 -39
package/electron/workspace-ui/live-dead-seats.js +163 -91
package/electron/workspace-ui/workspace-banners.js +30 -7
package/electron/workspace-ui/workspace-matrix.js +23 -3
package/electron/workspace-ui/workspace-seats.js +95 -79
package/package.json +1 -1
package/schemas/council-run.schema.json +2 -2
package/schemas/council-tally.schema.json +17 -1
package/schemas/council-verdict.schema.json +12 -4
package/schemas/run.schema.json +6 -1
package/skills/second-opinion/COUNCIL-DESIGN.md +1 -1
package/skills/second-opinion/MANUAL-ORCHESTRATION.md +1 -1
package/skills/second-opinion/MODEL-NOTES.md +88 -9
package/skills/second-opinion/SEAT-BRIEFS.md +36 -4
package/skills/second-opinion/SKILL.md +151 -36
package/src/cli-council-run-bench.js +98 -6
package/src/cli-handlers-council-run.js +18 -6
package/src/cli-handlers-council.js +57 -7
package/src/cli-handlers-doctor.js +1 -1
package/src/cli.js +3 -1
package/src/council/anonymize.js +2 -1
package/src/council/briefings-chair-task.js +161 -0
package/src/council/briefings-chair.js +33 -8
package/src/council/briefings-debate.js +79 -13
package/src/council/briefings-stage2-task.js +236 -0
package/src/council/briefings-stage2.js +103 -26
package/src/council/briefings-task.js +167 -0
package/src/council/briefings.js +41 -4
package/src/council/chair-fallback.js +95 -0
package/src/council/debate.js +38 -21
package/src/council/findings.js +3 -2
package/src/council/ledger.js +2 -2
package/src/council/parse-stage2.js +63 -15
package/src/council/report-cost.js +61 -0
package/src/council/report-html.js +26 -4
package/src/council/report-md.js +30 -2
package/src/council/report.js +40 -37
package/src/council/run-assemble.js +21 -6
package/src/council/run-chair.js +44 -95
package/src/council/run-debate-revote.js +81 -49
package/src/council/run-debate.js +51 -34
package/src/council/run-finish.js +5 -3
package/src/council/run-retry-keys.js +4 -4
package/src/council/run-retry-launch.js +4 -4
package/src/council/run-retry-notes.js +72 -15
package/src/council/run-stage1-launch.js +4 -4
package/src/council/run-stage1-rows.js +9 -6
package/src/council/run-stage2.js +81 -47
package/src/council/run-stages.js +9 -21
package/src/council/run-stats-entry.js +46 -1
package/src/council/run.js +28 -13
package/src/council/seats.js +2 -2
package/src/council/stage1-bind.js +3 -2
package/src/council/verdict-seat-loss.js +124 -0
package/src/council/verdict.js +108 -99
package/src/headless.js +256 -49
package/src/mcp-council-bench.js +64 -3
package/src/mcp-council-run.js +10 -3
package/src/mcp-server.js +52 -12
package/src/mcp-tools.js +41 -5
package/src/observe/council-legs.js +2 -2
package/src/opencode-client.js +19 -1
package/src/pack/pack-forward.js +15 -12
package/src/pack/pack-resolve.js +1 -1
package/src/prompt-builder.js +17 -1
package/src/sidecar/fanout-leg-fallback.js +2 -1
package/src/sidecar/fanout-leg.js +26 -0
package/src/sidecar/fanout.js +1 -1
package/src/sidecar/list-council.js +178 -0
package/src/sidecar/list-limit.js +3 -1
package/src/sidecar/list-search.js +2 -1
package/src/sidecar/models-render.js +71 -0
package/src/sidecar/models.js +19 -45
package/src/sidecar/read.js +34 -10
package/src/sidecar/reopen-spend.js +2 -1
package/src/sidecar/setup.js +13 -4
package/src/sidecar/start.js +2 -1
package/src/template/render.js +16 -7
package/src/utils/alias-audit.js +10 -3
package/src/utils/alias-shadow-writer.js +220 -0
package/src/utils/alias-shadow.js +294 -0
package/src/utils/config.js +1 -1
package/src/utils/curated-models.js +19 -9
package/src/utils/degrade.js +12 -5
package/src/utils/doctor-alias-check.js +2 -5
package/src/utils/engine-log-parse.js +289 -0
package/src/utils/engine-log-tail.js +114 -0
package/src/utils/engine-log.js +250 -0
package/src/utils/engine-skew-records.js +146 -0
package/src/utils/engine-skew.js +300 -0
package/src/utils/gateway-router.js +21 -3
package/src/utils/model-canonicalization.js +55 -6
package/src/utils/model-catalog.js +27 -9
package/src/utils/model-fetcher.js +69 -16
package/src/utils/model-shortlist.js +5 -2
package/src/utils/provider-default-picker.js +6 -3
package/src/utils/quick-picks.js +45 -7
package/src/utils/result-schema.js +17 -1
package/src/utils/text-sanitize.js +81 -0
package/src/utils/ttft.js +57 -0
package/src/utils/untrusted-fence.js +111 -1
package/src/workspace/fold-format.js +28 -7
package/src/workspace/live-normalize.js +2 -1
package/src/workspace/matrix-model.js +6 -2
package/src/workspace/run-detail.js +33 -7
package/src/workspace/seat-space.js +10 -6

package/electron/setup-ui.js CHANGED Viewed

@@ -11,9 +11,8 @@ const { buildLocalSectionHTML } = require('./setup-ui-local');
 const { buildLocalScript } = require('./setup-ui-local-script');
 const { getDefaultAliases } = require('../src/utils/config');
 const { getBrandName } = require('./toolbar');
-const { resolveQuickPicks } = require('../src/utils/quick-picks');
+const { resolveQuickPicks, canonicalRoutesFor } = require('../src/utils/quick-picks');
 const { PROVIDER_FAMILY_NAMES } = require('../src/utils/model-fetcher');
-const { listDirectProviders } = require('../src/utils/provider-registry');
 /**
  * @param {object} [options={}]
@@ -30,17 +29,26 @@ function buildSetupHTML(options = {}) {
     quickPicks = resolveQuickPicks([]),          // pinned fallbacks when not provided
     shortlists = {},
   } = options;
+  // Council A1 (PR 215): a pick reaching the page WITHOUT canonicalRoutes makes
+  // pickRouteFor fall back to the raw openrouter/... route, which this codebase
+  // treats as an EXPLICIT force-OpenRouter literal that never reconsiders
+  // direct-first -- so an offline setup (pinned fallback above, catalog
+  // unavailable) would pin the user to the gateway permanently. Backfill from an
+  // EMPTY catalog: directFormIfSafe is optimistic when nothing disproves the bare
+  // form (restoring direct-first) while still refusing for DIVERGENT_VENDORS,
+  // which the deleted toBareIfDirect did not.
+  const picks = quickPicks.map(p =>
+    (p && p.canonicalRoutes) ? p : { ...p, canonicalRoutes: canonicalRoutesFor(p, { models: [] }) });
   const brandName = getBrandName(client);
   const keysHtml = buildKeysStepHTML(PROVIDERS);
-  const modelHtml = buildModelStepHTML(quickPicks, undefined, undefined, shortlists);
+  const modelHtml = buildModelStepHTML(picks, undefined, undefined, shortlists);
   const aliasHtml = buildAliasEditorHTML(getDefaultAliases());
   const css = buildWizardCSS();
   const providersJson = JSON.stringify(PROVIDERS);
-  const modelChoicesJson = JSON.stringify(quickPicks);
+  const modelChoicesJson = JSON.stringify(picks);
   const providerNamesJson = JSON.stringify(PROVIDER_NAMES);
   const defaultAliasesJson = JSON.stringify(getDefaultAliases());
   const familyNamesJson = JSON.stringify(PROVIDER_FAMILY_NAMES);
-  const directProvidersJson = JSON.stringify(listDirectProviders());
   return `<!DOCTYPE html>
 <html><head><meta charset="utf-8"><title>Amicus Setup</title>
 <style>${css}</style></head><body>
@@ -62,11 +70,11 @@ function buildSetupHTML(options = {}) {
     </div>
   </div>
   <div class="footer"><div class="footer-brand"><svg width="15" height="15" viewBox="0 0 32 32" fill="none"><path d="M4 8H19"/><path d="M4 11H14L19 8"/><path d="M4 14H13L19 8"/><path d="M4 17H12L19 8"/><path d="M4 20H11L19 8"/><path d="M4 23H10L19 8"/><path class="brand-main" d="M19 8H28"/></svg> ${brandName}</div><div class="footer-nav"><button class="nav-btn" id="back-btn" style="display:none">Back</button><button class="nav-btn primary" id="next-btn" disabled>Next</button><button class="nav-btn primary" id="finish-btn" style="display:none">Finish</button></div></div>
-${buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson, directProvidersJson)}
+${buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson)}
 </body></html>`;
 }
-function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson, directProvidersJson) {
+function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson) {
   const keysJs = buildKeysScript();
   const aliasJs = buildAliasScript();
   const councilJs = buildCouncilScript();
@@ -81,22 +89,26 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
   var selectedProvider = null;
   var modelChoicesData = ${modelChoicesJson};
   var providerNamesData = ${providerNamesJson};
-  var defaultAliases = ${defaultAliasesJson};
+  var defaultAliases = Object.assign(Object.create(null), ${defaultAliasesJson});
   var PROVIDER_FAMILY_NAMES = ${familyNamesJson};
-  var directProviders = ${directProvidersJson};
   var routingChoices = {};
   var explicitRouteChoices = {};
   // issue 138: alias -> a SPECIFIC model id the user drilled down to. Empty
   // means "use the family flagship", i.e. today's behavior.
   var modelChoiceIds = {};
   var modelOpenrouterIds = {};
-  var aliasEdits = {};
-  var aliasDisplay = {};
+  // T3 (PR 199): every table keyed by USER-controlled alias names is seeded
+  // null-prototype, same as defaultAliases above -- an alias literally named
+  // __proto__ on a plain {} hits the Object.prototype setter (silent no-op
+  // write) and reads back Object.prototype, which then throws on .split('/')
+  // in updateAliasesForConfiguredKeys.
+  var aliasEdits = Object.create(null);
+  var aliasDisplay = Object.create(null);
   // N1: the alias map as loaded from disk (init below), so buildReview can
-  // tell an actual change from a value-identical re-write. Stays {} until
+  // tell an actual change from a value-identical re-write. Stays empty until
   // init resolves (a fresh/offline config has nothing saved yet, so every
   // computed write IS new).
-  var savedAliases = {};
+  var savedAliases = Object.create(null);
   window.availableModels = null;
   var keyValid = false, validatedKey = '';
   var $ = function(id) { return document.getElementById(id); };
@@ -160,7 +172,10 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
         // buildReview's N1 diff is not measured to be wrong today -- but the
         // copy is one line and removes a fragile "never mutate this" invariant
         // future edits would otherwise have to remember.
-        savedAliases = Object.assign({}, cfg.aliases); // N1: buildReview diffs against this
+        // T3: null-prototype target -- Object.assign onto a plain {} would
+        // route a literal __proto__ alias key through the prototype setter
+        // instead of landing it as an own key.
+        savedAliases = Object.assign(Object.create(null), cfg.aliases); // N1: buildReview diffs against this
         modelChoicesData.forEach(function(mc) {
           var currentModel = cfg.aliases[mc.alias];
           if (currentModel) {
@@ -280,20 +295,6 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
     } else { nextBtn.disabled = false; }
   }
-  // #61: an auto-selected (non-explicit) openrouter/<vendor>/<model> route
-  // whose vendor also has a direct integration must be stored bare
-  // (<vendor>/<model>) so the gateway router can policy-route it direct-first;
-  // a stored openrouter/... string is treated as an explicit force-OpenRouter
-  // literal and never reconsiders direct-first. Mirrors
-  // src/utils/curated-models.js's toCanonicalDefault exactly. Gateway-only
-  // vendors (not in directProviders, e.g. qwen/grok/glm/...) pass through
-  // unchanged since OpenRouter is their only route anyway.
-  function toBareIfDirect(route) {
-    if (typeof route !== 'string' || route.indexOf('openrouter/') !== 0) { return route; }
-    var rest = route.slice('openrouter/'.length);
-    var vendor = rest.split('/')[0];
-    return directProviders.indexOf(vendor) !== -1 ? rest : route;
-  }
   // Single source of the route choice for a quick-pick row: explicit pill
   // choice if its key still exists, else first provider with a key, else
@@ -303,12 +304,12 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
     // issue 138: an explicit per-model choice overrides the family flagship.
     var picked = modelChoiceIds[mc.alias];
     if (picked) {
-      // Deliberately NEVER toBareIfDirect(picked) here (unlike the auto-pick
-      // canonicalization below): picked/modelOpenrouterIds come straight
-      // from the shortlist's own id/data-or, and for a DIVERGENT_VENDOR
-      // (e.g. anthropic) that id can already BE its only-callable
-      // openrouter/<vendor>/... form -- stripping the prefix would
-      // fabricate a direct id nothing serves.
+      // A drilled-down pick is returned VERBATIM -- never canonicalised (unlike
+      // the auto-pick below): picked/modelOpenrouterIds come straight from the
+      // shortlist's own id/data-or, which the picker already built through
+      // directFormIfSafe. For a DIVERGENT_VENDOR (e.g. anthropic) that id can
+      // already BE its only-callable openrouter/<vendor>/... form, so touching
+      // the prefix here would fabricate a direct id nothing serves.
       if (routingChoices[mc.alias] === 'openrouter' && explicitRouteChoices[mc.alias]) {
         return modelOpenrouterIds[mc.alias] || picked;
       }
@@ -324,9 +325,13 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
       if (!prov) { prov = provs[0]; }
     }
     var route = mc.routes[prov] || null;
-    // Only canonicalize auto-picks; an explicit "via OpenRouter" pill click
-    // is a deliberate choice and is returned unchanged.
-    if (route && !explicitRouteChoices[mc.alias]) { route = toBareIfDirect(route); }
+    // issue 214: the SAFE storable form is decided server-side (quick-picks.js
+    // canonicalRoutesFor) and shipped with the pick. The page must not re-derive
+    // it: its old hand-copy of stripGatewayPrefix dropped both of that
+    // primitive's guards. An explicit "via OpenRouter" pill stays unchanged.
+    if (route && !explicitRouteChoices[mc.alias]) {
+      route = (mc.canonicalRoutes && mc.canonicalRoutes[prov]) || route;
+    }
     return route;
   }
@@ -485,7 +490,8 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
     // undefined) when the key is absent makes "delete of an absent alias"
     // compare equal to "still absent" without changing any other case --
     // every other savedAliases value here is a non-empty string.
-    var changedWrites = {};
+    // T3: keyed by user alias names -- null-prototype (see aliasEdits above)
+    var changedWrites = Object.create(null);
     Object.keys(aliasWritesPreview).forEach(function(alias) {
       var oldVal = Object.prototype.hasOwnProperty.call(savedAliases, alias) ? savedAliases[alias] : null;
       if (aliasWritesPreview[alias] !== oldVal) {
@@ -570,7 +576,8 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
   // layer responsible for not SHOWING those value-identical entries as
   // changes (see its own N1 comment).
   function collectAliasWrites(selectedAlias, isCustomDefault) {
-    var aliasWrites = {};
+    // T3: keyed by user alias names -- null-prototype (see aliasEdits above)
+    var aliasWrites = Object.create(null);
     Object.keys(aliasEdits).forEach(function(k) {
       aliasWrites[k] = aliasEdits[k];
     });

package/electron/workspace-ui/live-dead-seats.js CHANGED Viewed

@@ -5,66 +5,105 @@
 // Self-contained: it reads only its four arguments and owns its own isReviewing.
 (function () {
   /**
-   * D6 (v4.6.2 PR4 Task 2, "dead-seat rows"): announced-dead seats, unioned
-   * from the run's own `degrades[]` (dead-leg/dead-wave channels — the live
-   * announcement; shapes verified against src/council/run-retry-notes.js and
-   * the skipped-path notes at src/council/run-stages.js:155-174) and the
-   * verdict's derived `seatLoss` (verdict.js summarizeSeatLoss/deriveSeatLoss
-   * — the critic-loss backstop, kept for verdicts written before `degrades[]`
-   * existed, v4.5.2 precedent). De-duped by seat model: `degrades` is scanned
-   * FIRST, so a real record's retry marker always beats the backstop's
-   * no-data guess for the same seat.
+   * The kind/channel admission rule, v4.9 W9 (SI-02). ⚠️ MIRROR — this rule is spelled a
+   * second time at `workspace-seats.js :: retriedSeats`, and the two MUST move together
+   * (two spellings of one rule is PR5a council finding B1; the mirror is declared in that
+   * function's docblock). A renderer module cannot `require` src/ and this file cannot
+   * `require` its sibling, so the mirror is enforced behaviourally instead: the drift pin
+   * in `tests/workspace/workspace-seats.test.js` drives BOTH consumers with one fixture set.
    *
-   * `retried` reads `data.retryWaveId` / `data.firstFailure`: every
-   * still-dead-after-retry note (run-retry-notes.js's four builders) carries
-   * `retryWaveId`; the two run-stages.js skipped-path notes (fired when the
-   * once-only retry pass never even attempted the seat — an unmappable lens
-   * loss, an out-of-range index, or a zero-model unit) carry neither, so they
-   * correctly fall back to the plain phrasing.
+   * ⚠️ A kind-LESS record IS a degrade (W9 fix round, council C4). Both renderers read
+   * `run.json`/`verdict.json` off DISK — `workspace-seats.js :: renderSeatsPanel` even falls back
+   * to `verdict.degrades` — i.e. exactly the documents `report.js`'s LEGACYDROP note is about:
+   * they can PREDATE kinds, and `utils/degrade.js :: formatDegrade` still serves such a record as
+   * 'Notice'. A positive `kind === 'degrade'` silently dropped every one of them.
    *
-   * D6 filter (zero usable legs ONLY, "no ghost when a live row already
-   * exists"): a candidate already present in `liveSeats` is dropped. Two
-   * different things can put it there, and both are reasons to suppress:
-   * an SL-2 retry actually healed it (a real recovered review), OR
-   * (owner-ruled, v4.7 CA-4 dead-seat convergence) the seat never recovered
-   * at all but the row-per-launch machinery still gives its dead leg an
-   * honest primary ERROR row (every billed leg gets a row now, including
-   * failures — run-stages.js/run-assemble.js) — so "it has a cost row" no
-   * longer implies "it healed". Either way that live row IS the seat's
-   * record; rendering a second "did not review" ghost row beside it would
-   * be a duplicate, not new information, so suppressing it here is the
-   * ACCEPTED terminal-path behavior: exactly one row per seat, whatever its
-   * status. This is the one thing standing between a recovered (or
-   * honestly-erred) seat and a duplicate/ghost row — same failure family as
-   * the F37 debate-role collision and the RN-11 keyed-row lessons just above
-   * (seatsFromRunStats, seatCells): an identity that is not carefully
-   * matched silently duplicates or overwrites instead of failing loud.
+   * `dead-leg`/`dead-wave` are admitted unconditionally — the skipped-LEG note (`run-stages.js`,
+   * fired when the once-only retry never attempted the seat) carries no retry-family field and
+   * must still render, with the plain phrasing.
    *
-   * Role-aware D6 (v4.6.3 PR2, spec D3): a bare model match used to suppress
-   * regardless of what the LIVE row's role was — so a model that died as
-   * critic but whose chair-fallback walk happened to land on that same alias
-   * (and succeeded, producing a live `role: 'chair'` cost row) silently
-   * erased the dead-critic row it was never a replacement for (spec §5, the
-   * PR 102 rider). Candidates now carry a `role` (`'critic'` via alias equality
-   * with `runMeta.critic` — mirroring `deriveSeatLoss`, verdict.js:72 — or
-   * `null`), and only REVIEWING-role live legs (`seat`/`critic`/`lens:*`)
-   * suppress at all; a `'critic'` candidate is cleared only by a live
-   * CRITIC-role leg for that alias, never by a chair/judge/rebuttal/revote
-   * row landing on the same model. Hidden dependency: the recovered-critic
-   * suppression below (`byRole[alias + '|critic']`) relies on `roleFor`'s
-   * critic branch (src/council/run-stages.js), which only fires when lenses
-   * are absent — safe today only because --critic and --lenses are mutually
-   * exclusive (src/cli-handlers-council-run.js's `critic && lenses` check); if
-   * that exclusion ever loosens, a healed critic on a lens run would carry
-   * role 'seat' and this suppression would render a ghost dead row for it.
+   * `seat-unbound` is admitted GATED, never raw: it is a SHARED channel with SEVEN emit sites
+   * (re-counted 2026-08-26 — FOUR arms of `run-retry-notes.js`, one in each of `stage1-bind.js`,
+   * `run-debate-revote.js` and `run-stage2.js`) that do NOT mean the same thing. `orphanLegNote`
+   * and `reVoteUnboundNote` mean "a leg LANDED but names no seat/judge" — a review that was paid
+   * for and rendered, not a lost seat; `run-stage2.js`'s judge-side note names a seat that DID
+   * review and merely failed to judge. None of the three carries `retryWaveId` or `firstFailure`
+   * (measured), so the retry-family test excludes all three and the BACKLOG's proposed
+   * `data.legId` discriminator is subsumed rather than duplicated.
    *
-   * Old-run resilience (v4.6.3 PR2, spec D4): pre-`degrades[]` runs (v4.5.2)
-   * carry the BENCH half of a seat loss only in `seatLoss.deadBenchSeats`
-   * (string[] of aliases, verdict.js deriveSeatLoss) — `degrades[]` never
-   * existed on either doc for these runs. Consumed after the critic backstop,
-   * candidates get `role: null` (deadBenchSeats carries no critic/bench
-   * distinction beyond what `criticRequested` already covers above) and flow
-   * through the same dedup and role-aware suppression as every other candidate.
+   * ⚠️ The seat conjunct is HONESTLY belt-and-braces HERE and load-bearing in the third twin.
+   * Measured: dropping it from this function reds nothing, because `add()` already refuses a
+   * candidate with no alias; dropping it from `verdict-seat-loss.js :: deriveSeatLoss` puts an
+   * `undefined` into `deadBenchSeats`, which every reader of that list treats as a seat. It is
+   * kept in all three so one rule has one spelling — pinned on the verdict side.
+   *
+   * ⚠️ R-W9a is CLOSED at the PRODUCER (W9 fix round, council A1/C1): `run-retry-notes.js ::
+   * skippedWaveNote` emits the `firstFailure` fact its record already carried, so this gate
+   * admits that real loss UNCHANGED and the three controls above still fail it.
+   */
+  function isSeatLoss(d) {
+    if (!d || (d.kind !== undefined && d.kind !== 'degrade')) { return false; }
+    if (d.channel === 'dead-leg' || d.channel === 'dead-wave') { return true; }
+    if (d.channel !== 'seat-unbound') { return false; }
+    var data = d.data || {};
+    return !!((data.retryWaveId || data.firstFailure) && (data.seatId || data.seat));
+  }
+  /**
+   * D6 (v4.6.2 PR4 Task 2, "dead-seat rows"): announced-dead seats, unioned from the run's own
+   * `degrades[]` (the loss channels `isSeatLoss` above admits — the live announcement; shapes
+   * verified against src/council/run-retry-notes.js, which since the W9 fix round owns the
+   * skipped-path WAVE note too, plus the `retry.skippedDeadLegs` loop still in run-stages.js —
+   * anchored BY SYMBOL at v4.9 W9, the old `:155-174` having rotted onto the materialize/repair
+   * block) and the verdict's derived `seatLoss` (verdict-seat-loss.js's summarizeSeatLoss /
+   * deriveSeatLoss — the critic-loss backstop, kept for verdicts written before `degrades[]`
+   * existed, v4.5.2 precedent). De-duped by seat model: `degrades` is scanned FIRST, so a real
+   * record's retry marker always beats the backstop's no-data guess for the same seat.
+   *
+   * `retried` reads `data.retryWaveId` ALONE — narrowed in the W9 fix round, named mutant
+   * SKIPRETRIED. That field exists if and only if a retry wave was actually LAUNCHED for the
+   * seat: every still-dead-after-retry builder emits it, and both skipped-path notes (the retry
+   * never attempted the seat — an unmappable lens loss, an out-of-range index, a zero-model
+   * unit, or `overBudget()`) emit none, so they keep the plain phrasing. ⚠️ `firstFailure` is
+   * NOT a retry marker: `skippedWaveNote` (the sole `firstFailure`-without-`retryWaveId`
+   * producer) describes a seat never retried; every RETRIED seat's builder emits the former.
+   *
+   * D6 filter (zero usable legs ONLY, "no ghost when a live row already exists"): a candidate
+   * already present in `liveSeats` is dropped. Two different things can put it there and both
+   * are reasons to suppress: an SL-2 retry actually healed it (a real recovered review), OR
+   * (owner-ruled, v4.7 CA-4 dead-seat convergence) the seat never recovered at all but the
+   * row-per-launch machinery still gives its dead leg an honest primary ERROR row (every billed
+   * leg gets a row now, including failures — run-stages.js/run-assemble.js), so "it has a cost
+   * row" no longer implies "it healed". Either way that live row IS the seat's record, and a
+   * second "did not review" ghost beside it is a duplicate, not new information — so suppressing
+   * here is the ACCEPTED terminal-path behavior: exactly one row per seat, whatever its status.
+   * It is the one thing standing between a recovered (or honestly-erred) seat and a duplicate
+   * row — the F37 debate-role and RN-11 keyed-row family (seatsFromRunStats, seatCells): an
+   * identity that is not carefully matched silently duplicates or overwrites instead of failing.
+   *
+   * Role-aware D6 (v4.6.3 PR2, spec D3): a bare model match used to suppress regardless of what
+   * the LIVE row's role was — so a model that died as critic but whose chair-fallback walk
+   * happened to land on that same alias (and succeeded, producing a live `role: 'chair'` cost
+   * row) silently erased the dead-critic row it was never a replacement for (spec §5, the PR 102
+   * rider). Candidates now carry a `role` — `'critic'` or `null`, decided by `roleOf` below,
+   * which since v4.9 W9 (R4) keys on SEAT identity whenever the record and the run can both
+   * spell it and falls back to alias equality otherwise (so it no longer mirrors
+   * verdict-seat-loss.js :: deriveSeatLoss, which stays alias-keyed on purpose) — and only
+   * REVIEWING-role live legs (`seat`/`critic`/`lens:*`) suppress at all; a `'critic'` candidate
+   * is cleared only by a live CRITIC-role leg for that seat (alias where no seat id exists),
+   * never by a chair/judge/rebuttal/revote row landing on the same model. Hidden dependency: the
+   * recovered-critic suppression below (`byRole[key + '|critic']`) relies on `roleFor`'s critic
+   * branch (src/council/run-stages.js), which only fires when lenses are absent — safe today
+   * only because --critic and --lenses are mutually exclusive (src/cli-handlers-council-run.js's
+   * `critic && lenses` check); if that exclusion ever loosens, a healed critic on a lens run
+   * would carry role 'seat' and this suppression would render a ghost dead row for it.
+   *
+   * Old-run resilience (v4.6.3 PR2, spec D4): pre-`degrades[]` runs (v4.5.2) carry the BENCH
+   * half of a seat loss only in `seatLoss.deadBenchSeats` (string[] of aliases, deriveSeatLoss)
+   * — `degrades[]` never existed on either doc for these runs. Consumed after the critic
+   * backstop, candidates get `role: null` (deadBenchSeats carries no critic/bench distinction
+   * beyond what `criticRequested` already covers above) and flow through the same dedup and
+   * role-aware suppression as every other candidate.
    *
    * ⚠️ v4.8 PR5c corrected HOW that dedup works, and the old description here was
    * wrong once seats were keyed. Candidates arrive in FOUR identity flavours, and the
@@ -75,7 +114,9 @@
    *                it on the alias is what collapsed two dead twins into one row.
    *   'legacy'     a pre-PR5c record with no seat id anywhere -> dedup on the alias,
    *                which still collapses twins. Disclosed residual R2.
-   *   'derivative' seatLoss-sourced. verdict.js:86 builds deadBenchSeats FROM the same
+   *   'derivative' seatLoss-sourced. `verdict-seat-loss.js :: deriveSeatLoss` (by SYMBOL — the
+   *                old `verdict.js:86` rotted in v4.9 W9, and the function has since left
+   *                verdict.js entirely) builds deadBenchSeats FROM the same
    *                dead legs that emit degrades[], so it is always a duplicate and is
    *                the ONLY flavour that may be absorbed by an alias already covered.
    *                Absorbing a real degrade instead would erase an unidentified twin.
@@ -86,8 +127,9 @@
    *   `deadBenchSeats` (string[] of aliases) feeds the bench candidates below
    * @param {Array<{model: string}>} liveSeats  seatsFromRunStats(...)'s output
    *   (or any seat list keyed the same way — the live seat map)
-   * @param {?{critic: ?string}} runMeta  run.critic (alias, or null/absent
-   *   when no critic was requested) — degrade records carry no role field, so
+   * @param {?{critic: ?string, criticSeat: ?string}} runMeta  run.critic (alias) and
+   *   run.criticSeat (the seat id `seats.js :: preflightSeats` resolved for it), each
+   *   null/absent when no critic was requested — degrade records carry no role field, so
    *   this is the ONLY way a degrade-sourced candidate is identified as critic
    * @returns {Array<{model: string, seat: ?string, statusText: string, role: ?string}>}
    *   `model` is the ALIAS (what the row displays, what labelOf keys on); `seat` is
@@ -95,11 +137,28 @@
    */
   function deadSeats(degrades, seatLoss, liveSeats, runMeta) {
     var critic = runMeta && runMeta.critic ? runMeta.critic : null;
-    // ⚠️ Object.create(null) throughout this family (also workspace-render.js's
-    // `existing`/`seen` and workspace-app.js's `labelByModel`): a model literally
-    // named `toString` is truthy off a bare object, so it was dropped here and —
-    // worse — crashed workspace-render.js:212 reading `.children` off an inherited
-    // function, killing the seats repaint and every tick after it.
+    var criticSeat = runMeta && runMeta.criticSeat ? runMeta.criticSeat : null;
+    // R4 (v4.9 W9). The old rule was `alias === critic`, which on a bench where one alias holds
+    // a critic seat AND a bench seat tagged the WRONG candidate 'critic' — and critic candidates
+    // suppress through `byRole`, a map PR5c's seat-keying never reached, so a dead bench twin
+    // beside a live critic twin rendered NOTHING. Seat identity decides whenever BOTH sides can
+    // spell it; a record with no seat id, or a run with no resolved critic seat (pre-`criticSeat`
+    // run.json), keeps the legacy alias rule rather than guessing.
+    // ⚠️ W9 fix round (council C3): a truthy key is NOT necessarily seat-space. On the INEXACT
+    // twin branch `run-retry-group.js :: recordFailure` keys `firstFailure.seatId` by the ALIAS
+    // (residual R3), so the critic's OWN record can arrive keyed 'gpt' against a criticSeat of
+    // 'gpt#1' and came back role null — while `verdict-seat-loss.js :: deriveSeatLoss`, comparing
+    // `data.seat` to the alias, called that same record a critic loss. The alias arm of the
+    // disjunct IS that legacy rule, so the two surfaces agree; it cannot re-open R4, since a real
+    // bench-twin id ('gpt#2') equals neither operand.
+    function roleOf(key, alias) {
+      if (key && criticSeat) { return (key === criticSeat || key === critic) ? 'critic' : null; }
+      return critic && alias === critic ? 'critic' : null;
+    }
+    // ⚠️ Object.create(null) throughout this family (also workspace-render.js's `existing`/`seen`
+    // and workspace-app.js's `labelByModel`): a model literally named `toString` is truthy off a
+    // bare object, so it was dropped here and — worse — crashed workspace-render.js:212 reading
+    // `.children` off an inherited function, killing the seats repaint and every tick after it.
     var seen = Object.create(null);
     var covered = Object.create(null);
     var seenUnid = Object.create(null);
@@ -108,12 +167,12 @@
     // docblock above, which is what decides the key and the absorb rule.
     function add(key, alias, retried, role, src, slotOf) {
       if (!alias) { return; }
-      // ⛔ An 'unid' candidate was originally given NO dedup at all, on the grounds that it is
-      // one wave slot and distinct by construction. That holds WITHIN a record's seats[]; it
-      // does NOT hold across records, and the same dead-wave record appearing twice rendered
-      // four rows for two seats. Deduped on (waveId, slot) instead — its own namespace, never
-      // `seen`, so an invented key can never collide with a real alias. (The seat literally
-      // named `toString` is why this family refuses keys that share the alias keyspace.)
+      // ⛔ An 'unid' candidate was originally given NO dedup at all, on the grounds that it is one
+      // wave slot and distinct by construction. That holds WITHIN a record's seats[]; it does NOT
+      // hold across records, and the same dead-wave record appearing twice rendered four rows for
+      // two seats. Deduped on (waveId, slot) instead — its own namespace, never `seen`, so an
+      // invented key can never collide with a real alias. (The seat literally named `toString` is
+      // why this family refuses keys that share the alias keyspace.)
       if (src === 'unid') {
         var uk = ((slotOf && slotOf.waveId) || '') + '#' + (slotOf ? slotOf.i : 0);
         if (seenUnid[uk]) { return; }
@@ -140,23 +199,23 @@
       order.push(row);
     }
     (degrades || []).forEach(function (d) {
-      if (!d || d.kind !== 'degrade') { return; }
-      if (d.channel !== 'dead-leg' && d.channel !== 'dead-wave') { return; }
+      if (!isSeatLoss(d)) { return; }
       var data = d.data || {};
-      var retried = !!(data.retryWaveId || data.firstFailure);
-      // Critic identification mirrors deriveSeatLoss (verdict.js): alias
-      // equality with run.critic — degrade records carry no role field.
-      if (d.channel === 'dead-leg') {
+      var retried = !!data.retryWaveId;   // NOT firstFailure — docblock above, mutant SKIPRETRIED
+      // ONE shape, TWO channels: `dead-leg` and every admitted `seat-unbound` arm name a
+      // single seat through `data.seat` (alias) plus an optional seat id — the partial arm's
+      // `data.seatId` (v4.9 W9 P1) or the two missing-leg arms' `firstFailure.seatId`. Only
+      // `dead-wave` is a LIST, which is why the branch tests for it rather than for dead-leg.
+      if (d.channel !== 'dead-wave') {
         var lk = (data.firstFailure && data.firstFailure.seatId) || data.seatId || null;
-        add(lk, data.seat, retried, critic && data.seat === critic ? 'critic' : null,
-          lk ? 'keyed' : 'legacy');
+        add(lk, data.seat, retried, roleOf(lk, data.seat), lk ? 'keyed' : 'legacy');
       } else {
         // `seats[]` is index-parallel with `models[]` (PR5c Task 1). Its ABSENCE means a
         // legacy record; a null ELEMENT means an unidentified seat. Different statements.
         var hasSeats = Array.isArray(data.seats);
         (data.models || []).forEach(function (m, i) {
           var wk = hasSeats ? data.seats[i] : null;
-          add(wk, m, retried, critic && m === critic ? 'critic' : null,
+          add(wk, m, retried, roleOf(wk, m),
             wk ? 'keyed' : (hasSeats ? 'unid' : 'legacy'), { waveId: data.waveId, i: i });
         });
       }
@@ -165,18 +224,15 @@
       add(null, seatLoss.criticRequested, false, 'critic', 'derivative');
     }
     if (seatLoss) {
-      // Pre-degrades[] era (v4.5.2): the bench half of a seat loss lives
-      // only here. Alias strings; deriveSeatLoss does not dedup — `seen`
-      // absorbs repeats and degrade-sourced duplicates.
-      (seatLoss.deadBenchSeats || []).forEach(function (m) {
-        add(null, m, false, null, 'derivative');
-      });
+      // Pre-degrades[] era (v4.5.2): the bench half of a seat loss lives only here. Alias
+      // strings; deriveSeatLoss does not dedup — `seen` absorbs repeats and degrade-sourced
+      // duplicates.
+      (seatLoss.deadBenchSeats || []).forEach(function (m) { add(null, m, false, null, 'derivative'); });
     }
-    // Role-aware D6 (v4.6.3 PR2): only REVIEWING-role live legs suppress —
-    // a chair/judge/rebuttal/revote row must not hide a dead reviewer, and
-    // a dead-critic candidate is cleared only by a live CRITIC leg. A null
-    // role is NOT reviewing: counting it would suppress silently, the exact
-    // class the announcement invariant forbids.
+    // Role-aware D6 (v4.6.3 PR2): only REVIEWING-role live legs suppress — a chair/judge/
+    // rebuttal/revote row must not hide a dead reviewer, and a dead-critic candidate is cleared
+    // only by a live CRITIC leg. A null role is NOT reviewing: counting it would suppress
+    // silently, the exact class the announcement invariant forbids.
     // Role 'claude' is deliberately absent: it is emitted only by claudeRunStatsRow
     // (src/council/run-assemble.js:129-132) for a seat that never launches a leg, and
     // preflightClaudeReview (run-assemble.js:86-102) rejects 'claude' as chair/critic/
@@ -188,6 +244,7 @@
     }
     var reviewing = Object.create(null);
     var byRole = Object.create(null);
+    var byRoleUnseated = Object.create(null);   // alias|role, live legs that named NO seat id
     // ⚠️ Fable review (PR4b fix wave): same F34/F36 alias-selection seatCells already uses
     // (`seat.modelInput || seat.model`, above) — a LIVE payload seat's `model` is the RESOLVED
     // executable id, not the alias a degrade record names; `modelInput` carries the alias.
@@ -208,9 +265,24 @@
       // producers cannot disagree. A bare insert would write a STRING key for every such seat.
       if (s.seat) { reviewing[s.seat] = true; }
       byRole[alias + '|' + s.role] = true;
+      // R4 (v4.9 W9): the seat arm, exactly mirroring `reviewing` two lines up. Without it a
+      // critic candidate carrying a seat id has no seat-keyed entry to match and the lookup
+      // below would fall through to a ghost row on every twin bench.
+      // ⚠️ The ELSE arm is the W9 fix round's (council C2): a live leg that named NO seat id can
+      // only write the alias key, so a seat-KEYED candidate had nothing to match and the read
+      // below rendered a ghost 'critic did not review' row the pre-W9 alias read suppressed.
+      // Kept OUT of `byRole` on purpose — an alias entry written by a SEATED leg must not clear
+      // a different seat's candidate, which is the erasure R4 exists to have fixed.
+      if (s.seat) { byRole[s.seat + '|' + s.role] = true; } else { byRoleUnseated[alias + '|' + s.role] = true; }
     });
     return order.filter(function (s) {
-      if (s.role === 'critic') { return !byRole[s.model + '|critic']; }
+      // Seat where the candidate has one, alias otherwise — the same key `reviewing` uses
+      // below, so the two suppression maps cannot disagree about what a candidate IS. The
+      // second disjunct reads the alias keyspace the WRITE also lands in (C2, above): it is
+      // consulted only for live legs that named no seat, so it cannot re-open R4's erasure.
+      if (s.role === 'critic') {
+        return !(byRole[(s.seat || s.model) + '|critic'] || byRoleUnseated[s.model + '|critic']);
+      }
       // An UNNAMED dead seat is never suppressed by alias evidence. The producer emitted
       // `null` rather than the alias precisely because "unidentified" and "the alias" are
       // different statements; falling back to the alias here would re-assert the equivalence

package/electron/workspace-ui/workspace-banners.js CHANGED Viewed

@@ -60,15 +60,38 @@
         '. This run directory cannot distinguish those artifacts, so prose below may be misattributed.', '');
       return;
     }
-    // ⚠️ Fix-wave 3 (council-3 C2): seats[] was present but malformed, so the whole run fell
-    // back to alias space — two seats running one model are indistinguishable in every panel
-    // below. Fail-safe, but SILENT until now, which the product principle rejects as hard as
-    // a crash. Ranked AFTER the collision banner (that one says prose may be misattributed,
-    // strictly worse) and BEFORE run.error, since it qualifies how to read every panel.
+    // ⚠️ Fix-wave 3 (council-3 C2): seats[] was present but malformed, so the run's ARTIFACT
+    // NAMING fell back to alias space — two seats running one model are indistinguishable in
+    // the prose panels. Fail-safe, but SILENT until now, which the product principle rejects
+    // as hard as a crash. Ranked AFTER the collision banner (that one says prose may be
+    // misattributed, strictly worse) and BEFORE run.error, since it qualifies how to read
+    // those panels.
+    // ⚠️ This comment used to say "the WHOLE run fell back to alias space … in every panel
+    // BELOW", and W9 measured that as FALSE (it was already false when written, not falsified
+    // by this change — the same reading the banner string itself shipped). The correction and
+    // its evidence are below, where the sentence the user actually reads is built.
+    // ⚠️ v4.9 W9 PR5b-1 (ruling V15, disclosure over uniformity): this used to end "cannot be
+    // told apart BELOW" — a blanket claim over the whole detail view, and measurably too wide.
+    // `seatTableRejected` reaches exactly one surface: derived.seatSpace goes false, so
+    // workspace-lazy.js :: roster falls back to `bench` and the reviews/judges/re-vote panels
+    // name their artifacts by alias. Everything sourced from tally.json is untouched — the
+    // seats panel's rows are live-seats.js :: seatsFromRunStats over run-detail.js ::
+    // costPanel's `tally.runStats` projection, keyed on `r.seat || r.model`, and `r.seat` is
+    // stamped by run-stats-entry.js :: buildRunStatsEntry from the IN-MEMORY seat at assembly
+    // (run-assemble.js :: buildTallyInput), not from the run.json table that failed to parse.
+    // A twin bench therefore still gets two seat rows carrying their own numbers.
+    // V15's ruling is to DISCLOSE that split rather than force the seats panel down to
+    // derived.seatSpace for uniformity, which would throw away data that is truthful.
+    // ⚠️ The ROWS are per-seat; the NAMES are not. live-seats.js :: seatCells prints
+    // `seat.modelInput || seat.model` — the alias — so the sentence claims separate NUMBERS,
+    // never distinguishable names. Wording pinned full-string in workspace-app-boundary.test.js.
     if (d.derived.seatTableRejected) {
       R.renderBanner(el, 'This run\'s seat table could not be read (a malformed entry), so ' +
-        'artifacts are shown by model alias instead of per seat — two seats running the same ' +
-        'model cannot be told apart below. Artifacts: ' + d.runDir, 'warn');
+        'the reviews, judges and re-vote panels name their artifacts by model alias instead ' +
+        'of per seat — two seats running the same model cannot be told apart there. The seats ' +
+        'panel is NOT affected: its rows come from tally.json\'s runStats, one per seat, so ' +
+        'both seats\' numbers are still shown separately, sharing the alias as a name. ' +
+        'Artifacts: ' + d.runDir, 'warn');
       return;
     }
     // ⚠️ PRE-FLIGHT (P3), caught live by the CDP e2e (Task 18): gating on `d.run.error` ALONE

package/electron/workspace-ui/workspace-matrix.js CHANGED Viewed

@@ -126,9 +126,15 @@
     container.textContent = '';
     var head = R.el('div', { className: 'chips' }, []);
     if (vp.overallVerdict) {
-      head.appendChild(R.el('span', { className: 'chip complete' }, ['VERDICT: ' + vp.overallVerdict]));
+      // v4.9 W8: the chip names the SCALE the phrase belongs to — a task chair's
+      // phrase comes from CHAIR_ANSWERS and is never a verdict. Payload-driven:
+      // this file cannot require() src/, so run-detail.js :: verdictPanel mints
+      // `intent`. `=== 'task'` (not `!== 'review'`) so a pre-v4.9 payload with no
+      // intent key reads as review instead of relabelling every legacy run.
+      head.appendChild(R.el('span', { className: 'chip complete' },
+        [(vp.intent === 'task' ? 'ANSWER: ' : 'VERDICT: ') + vp.overallVerdict]));
     } else {
-      head.appendChild(R.el('span', { className: 'chip error' }, ['no chair verdict']));
+      head.appendChild(R.el('span', { className: 'chip error' }, [vp.intent === 'task' ? 'no chair answer' : 'no chair verdict']));
       if (vp.reason) { head.appendChild(R.el('span', { className: 'empty-note' }, [vp.reason])); }
     }
     container.appendChild(head);
@@ -145,8 +151,22 @@
     if (vp.streetCred && vp.streetCred.length) {
       var rows = vp.streetCred.map(function (s) {
+        // v4.9 W9 — SI-22.4 rider (2): the THIRD street-cred renderer, joining
+        // report-md.js :: renderMd and report-html.js :: renderHtml (v4.8 R22.4-6), which
+        // both label the row `s.seat || s.model`. Until now a twin bench read `gemini#1`/
+        // `gemini#2` in the report and `gemini` TWICE here, different numbers under one
+        // identical name. `seat` is emit-when-DIFFERENT (street-cred.js :: computeStreetCred),
+        // so a unique-alias bench has no seat key and this renders exactly what it did before.
+        // ⚠️ BLIND KEEPS THE ALIAS SPACE, both branches. `opts.labelOf` is ALIAS-keyed
+        // (workspace-app.js's state.labelByModel, from run.json's labelMap — label -> alias,
+        // which the seat work deliberately left alone: anonymize.js :: assignLabels puts seat
+        // identity in the separate seatMap), so the lookup key stays `s.model` and the
+        // signature is unchanged. The fallback stays `s.model` too: a seat id CONTAINS its
+        // alias, so printing one with blind mode on defeats blind mode — the same rule
+        // seat-space.js :: isSeatTable and workspace-lazy.js :: roster were both fixed to.
+        // Named mutant RIDERALIAS (workspace-matrix.test.js).
         var label = opts.labelOf(s.model);
-        var name = opts.isBlind() && label ? label : s.model;
+        var name = opts.isBlind() ? (label || s.model) : (s.seat || s.model);
         var fmt = function (v) { return (v === null || v === undefined) ? '—' : Number(v).toFixed(2); };
         return R.el('tr', {}, [
           R.el('td', {}, [name]),