amicus 4.9.1 → 4.9.3

package/electron/setup-ui-aliases.js

@@ -5,42 +5,46 @@
  * delete, and add functionality for the setup wizard Step 3.
  */
 
-/** Grouping metadata for the 21 default aliases */
-const ALIAS_GROUPS = [
-  { name: 'Gemini', keys: ['gemini', 'gemini-pro'] },
-  { name: 'GPT', keys: ['gpt', 'gpt-pro', 'codex'] },
-  { name: 'Claude', keys: ['claude', 'sonnet', 'opus', 'haiku', 'fable'] },
-  { name: 'DeepSeek', keys: ['deepseek'] },
-  { name: 'Qwen', keys: ['qwen', 'qwen-coder', 'qwen-flash'] },
-  { name: 'Mistral', keys: ['mistral'] },
-  { name: 'Other', keys: ['glm', 'minimax', 'grok', 'kimi', 'seed', 'inkling'] },
-];
+const { groupAliases } = require('./setup-ui-alias-groups');
+
+/** Attribute/text-safe rendering of user-controlled alias names and routes. */
+function esc(value) {
+  return String(value === undefined || value === null ? '' : value)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
 
 /**
  * Build the HTML fragment for the alias editor section
+ *
+ * Issue 213: groups are derived from each alias's ROUTE VENDOR
+ * (setup-ui-alias-groups.js), not from a hardcoded list of alias names, so
+ * EVERY alias in `aliases` renders exactly once -- the old whitelist silently
+ * dropped any name it did not list (12 of 25 in a real config).
+ *
  * @param {Object<string,string>} aliases - Map of alias name to model string
  * @returns {string} HTML fragment with search, groups, rows, and add button
  */
 function buildAliasEditorHTML(aliases) {
   const searchInput = '<input type="text" id="alias-search" class="alias-search" placeholder="Search aliases..." autocomplete="off" spellcheck="false">';
 
-  const groups = ALIAS_GROUPS.map(group => {
+  const groups = groupAliases(aliases).map(group => {
     const rows = group.keys
-      .filter(key => aliases[key] !== undefined)
       .map(key => {
         const model = aliases[key];
-        return `<div class="alias-row" data-alias="${key}">` +
-          `<span class="alias-name">${key}</span>` +
+        return `<div class="alias-row" data-alias="${esc(key)}">` +
+          `<span class="alias-name">${esc(key)}</span>` +
           '<span class="alias-arrow">\u2192</span>' +
-          `<span class="alias-model">${model}</span>` +
-          `<button class="alias-delete" data-alias="${key}">\u00d7</button>` +
+          `<span class="alias-model">${esc(model)}</span>` +
+          `<button class="alias-delete" data-alias="${esc(key)}">\u00d7</button>` +
           '</div>';
       }).join('\n        ');
 
-    const count = group.keys.filter(key => aliases[key] !== undefined).length;
-
-    return `<details class="alias-group">
-        <summary>${group.name} <span class="alias-count">(${count})</span></summary>
+    // data-vendor records WHICH vendor a group holds, for tests and for anyone
+    // inspecting the page. The client does not read it to place rows -- see the
+    // SHARED-WITH-THE-BROWSER note in setup-ui-alias-groups.js.
+    return `<details class="alias-group" data-vendor="${esc(group.vendor)}">
+        <summary>${esc(group.label)} <span class="alias-count">(${group.keys.length})</span></summary>
         ${rows}
       </details>`;
   }).join('\n      ');
@@ -82,4 +86,4 @@ function buildAliasEditorHTML(aliases) {
     </div>`;
 }
 
-module.exports = { ALIAS_GROUPS, buildAliasEditorHTML };
+module.exports = { buildAliasEditorHTML };

package/electron/setup-ui.js

@@ -22,12 +22,22 @@ const { PROVIDER_FAMILY_NAMES } = require('../src/utils/model-fetcher');
  * @param {Object<string,object>} [options.shortlists] - issue 138: per-alias vendor
  *   shortlist from buildModelShortlist(), passed through to buildModelStepHTML
  *   for the model-level <select>. Defaults to {} (no drill-down rendered).
+ * @param {Object<string,string>} [options.aliases] - issue 213: the alias map Step 3
+ *   renders. Callers pass getEffectiveAliases() (defaults MERGED with the user's
+ *   config); the default here stays getDefaultAliases() so an omitted option is
+ *   the old behaviour exactly. This is the second half of issue 213: fixing
+ *   buildAliasEditorHTML's grouping guarantees "every alias passed in renders
+ *   exactly once", but the app was only ever passing the 21 built-in defaults,
+ *   so a user's custom aliases had no row at all. The config that arrives later
+ *   over IPC cannot repair that -- applyAliasEditsToUI only rewrites the model
+ *   text of rows that ALREADY exist (`if (!row) { return; }`).
  */
 function buildSetupHTML(options = {}) {
   const {
     client = 'code-local',
     quickPicks = resolveQuickPicks([]),          // pinned fallbacks when not provided
     shortlists = {},
+    aliases = getDefaultAliases(),               // issue 213
   } = options;
   // Council A1 (PR 215): a pick reaching the page WITHOUT canonicalRoutes makes
   // pickRouteFor fall back to the raw openrouter/... route, which this codebase
@@ -42,7 +52,7 @@ function buildSetupHTML(options = {}) {
   const brandName = getBrandName(client);
   const keysHtml = buildKeysStepHTML(PROVIDERS);
   const modelHtml = buildModelStepHTML(picks, undefined, undefined, shortlists);
-  const aliasHtml = buildAliasEditorHTML(getDefaultAliases());
+  const aliasHtml = buildAliasEditorHTML(aliases);
   const css = buildWizardCSS();
   const providersJson = JSON.stringify(PROVIDERS);
   const modelChoicesJson = JSON.stringify(picks);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.1",
+  "version": "4.9.3",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/schemas/council-verdict.schema.json

@@ -229,6 +229,16 @@
         "criticSeated"
       ]
     },
+    "seatsReviewed": {
+      "type": "object",
+      "description": "#202, optional. How much of the BENCH actually reviewed, derived from runStats: `of` counts every BENCH-role row — `seat`, `critic`, or `lens:<slug>`, exactly the roles seats.js :: buildSeats mints (one per bench seat POST-retry, so a healed seat is counted once and its first attempt is `role:'superseded'`), and `reviewed` counts those whose leg completed. Judges, chair and repair rows are not bench seats and are excluded. EMIT-WHEN-SET: a record with no bench rows carries no key at all, because `0 of 0` would read as a measurement of an empty bench rather than as the absence it is. WHY IT EXISTS: the sibling `seatLoss` above is present only when --critic was requested, and CI runs none — so seat loss was structurally absent from every CI verdict while a two-seat bench published a four-model street-cred table whose dead seats rendered `n/a`, indistinguishable from the legend's neutral (MEASURED, run 4424218c). No `additionalProperties: false` at the top level of this schema means an additive field was always accepted here; this documents the shape rather than changing what is accepted.",
+      "properties": {
+        "reviewed": { "type": "integer", "minimum": 0, "description": "Bench seats whose leg completed." },
+        "of": { "type": "integer", "minimum": 1, "description": "Bench seats benched, post-retry." }
+      },
+      "required": ["reviewed", "of"],
+      "additionalProperties": false
+    },
     "degrades": {
       "description": "v4.6 Plan 2: what this run lost — copied verbatim from the sink at verdict assembly. Additive; absent when the sink recorded nothing. v4.9 widened kind with 'info': an announcement that is neither a loss nor a recovery (e.g. a task run's ledger-skipped note) — carried here without degrading the run.",
       "type": "array",

package/src/cli-handlers-doctor.js

@@ -17,6 +17,8 @@ const baseUrlCheck = require('./utils/doctor-base-url-check');
 // B3 (council review of PR 198, issue 195) — the 'aliases' check body,
 // including its --fix repair of fabricated bare ids. Same split rationale.
 const aliasCheck = require('./utils/doctor-alias-check');
+const creditCheck = require('./utils/doctor-credit-check');
+const keyAuthCheck = require('./utils/doctor-key-auth-check'); // #210 — 'keys' tests presence only; this re-validates.
 
 const { DEFAULT_MAX_AGE_MS: MAX_CATALOG_AGE_MS } = require('./utils/model-catalog'); // 24h — single source
 
@@ -32,7 +34,8 @@ function realDeps() {
     nodeVersion: process.version,
     readApiKeys: () => require('./utils/api-key-store').readApiKeys(),
     readApiKeyValues: () => require('./utils/api-key-store').readApiKeyValues(),
-    checkOpenRouterCredit: (key) => require('./utils/api-key-validation').checkOpenRouterCredit(key),
+    checkOpenRouterCredit: (key) => keyAuthCheck.probeOpenRouterCredit(key), // #210 — same gate as validateApiKey
+    validateApiKey: (p, k) => keyAuthCheck.probeApiKey(p, k), // #210
     getCwd: () => process.cwd(),
     readProjectMarkers: (dir) => {
       const exists = (name) => { try { return fs.existsSync(path.join(dir, name)); } catch (_e) { return false; } };
@@ -141,6 +144,7 @@ async function runDoctorChecks(depsOverride = {}) {
       : { id: 'keys', name: 'API keys', status: 'error', message: 'no provider keys configured', hint: 'amicus key <provider> <key>  (or run: amicus setup)' };
   }));
 
+  checks.push(await guardAsync('key-auth', 'API key auth', () => keyAuthCheck.evaluateKeyAuth(d))); // #210
   checks.push((() => {
     try {
       const model = d.resolveModel();
@@ -211,21 +215,10 @@ async function runDoctorChecks(depsOverride = {}) {
 
   checks.push(guard('session-metadata-tmp', 'Session metadata tmp files', () => metaSweep.evaluateSessionMetadataTmpSweep(d)));
 
-  // #43: OpenRouter credit/free-tier — warns (never errors); skipped when no key.
-  checks.push(await guardAsync('openrouter-credit', 'OpenRouter credit', async () => {
-    const values = d.readApiKeyValues() || {};
-    const key = values.openrouter;
-    if (!key) {
-      return { id: 'openrouter-credit', name: 'OpenRouter credit', status: 'ok', message: 'no OpenRouter key — skipped', hint: null };
-    }
-    // Reuses the #38 non-blocking probe; resolves warning:null on any failure.
-    const res = (await d.checkOpenRouterCredit(key)) || {};
-    if (res.warning) {
-      return { id: 'openrouter-credit', name: 'OpenRouter credit', status: 'warn', message: res.warning, hint: 'Add credit at openrouter.ai/credits, or build a free council (amicus setup → option 2).' };
-    }
-    const remaining = (typeof res.limitRemaining === 'number') ? ` ($${res.limitRemaining} remaining)` : '';
-    return { id: 'openrouter-credit', name: 'OpenRouter credit', status: 'ok', message: `credit ok${remaining}`, hint: null };
-  }));
+  // #43: OpenRouter credit/free-tier — warns (never errors); skipped when no
+  // key. Body in utils/doctor-credit-check.js (same split as the others).
+  checks.push(await guardAsync('openrouter-credit', 'OpenRouter credit',
+    () => creditCheck.evaluateOpenRouterCredit(d)));
 
   // v4.2 §4.7 C8: configured local / OpenAI-compatible providers (Ollama, LM
   // Studio, vLLM, generic) — reachability only; warn, never error (a napping

package/src/cli-handlers.js

@@ -176,7 +176,23 @@ async function handleKey(args) {
 
   console.log(`Validating ${provider} key...`);
   const validation = await validateApiKey(provider, keyArg);
-  if (!validation.valid) {
+  // 401 is the only status that means "this credential is not accepted".
+  // Everything else — 403 (disabled API, quota, region/bot block), 429, any
+  // 5xx, a 404 from a moved endpoint, a Cloudflare 52x during an origin
+  // outage, or no status at all because the machine is offline — says
+  // something about the REQUEST, not the key. Refusing to save on those is
+  // the false ALARM the doctor classifier stopped raising.
+  //
+  // ⚠️ An ALLOWLIST of what blocks, deliberately. This was a blocklist of
+  // what does NOT block, which left every unenumerated status falling through
+  // to process.exit(1) while the comment above it claimed only 401 blocked —
+  // the code and the narrative disagreed, and the narrative was the nicer of
+  // the two. An allowlist cannot rot as new status codes appear.
+  const BLOCKS_SAVE = new Set([401]);
+  if (!validation.valid && !BLOCKS_SAVE.has(validation.status)) {
+    console.warn(`Warning: ${validation.error}`);
+    console.warn('Saving the key anyway — run `amicus doctor` to re-check it later.');
+  } else if (!validation.valid) {
     console.error(`Error: ${validation.error}`);
     process.exit(1);
   }

package/src/council/run-retry-window.js

@@ -0,0 +1,62 @@
+/**
+ * @module council/run-retry-window
+ * The Stage-1 retry's no-output window: how long a RELAUNCHED leg may stay
+ * silent before the backstop kills it.
+ *
+ * ⚠️ EXTRACTED, not shaved (release Constraint 6, and the 300-line gate that put
+ * `verdict-seat-loss.js` in its own leaf): #219's correction took run-retry.js to
+ * 314/300. Its own module also makes the property directly testable.
+ *
+ * SL-2 Task 5 (#129): a retry re-runs the SAME model under the SAME conditions,
+ * so a latency failure is structurally unhealable — double the window rather
+ * than repeat it. ⚠️ #135 C0 took the base 240s -> 600s; deliberate, see
+ * CHANGELOG (council A1, PR #182).
+ *
+ * ⚠️ CLAMPED STRICTLY BELOW the leg timeout, not TO it (#219, council gpt
+ * major). `Math.min(2 * backstop, legTimeoutMs)` made the two deadlines EQUAL
+ * whenever `2 * backstop >= legTimeoutMs` — exactly CI today (2 x 480000 ===
+ * 960000 === `--timeout 16`). The backstop still won, but only by epsilon and
+ * only because the poll loop tests its deadline BEFORE sleeping, so the final
+ * poll lands just past the wall. That is an undocumented accident of loop order;
+ * if it ever lost, the leg would die a generic `timeout` and throw away the
+ * named NO_OUTPUT_BACKSTOP diagnosis this clamp exists to preserve.
+ *
+ * A PROPORTIONAL headroom, not a fixed subtraction: a constant large enough to
+ * beat a poll cycle (seconds) would drive a small leg cap to zero or negative,
+ * and `ms <= 0` is the documented DISABLE hatch — silently disabling the backstop
+ * is far worse than the race it fixes. 5% of any realistic leg cap clears the 2 s
+ * poll interval by a wide margin.
+ *
+ * `2 * 0 === 0` still disables, because `Math.min(0, anything positive) === 0`.
+ */
+
+'use strict';
+
+/**
+ * @param {number} baseBackstopMs the first attempt's resolved no-output window
+ * @param {number} legTimeoutMs the per-leg hard cap ((o.timeout || 15) * 60_000)
+ * @returns {number} the retry's window: doubled, clamped strictly below the cap
+ */
+function retryBackstopMs(baseBackstopMs, legTimeoutMs) {
+  // ⚠️ NOT floored at the first attempt's window, and #219 round 2 (glm) asked
+  // for exactly that — correctly observing that when `legTimeoutMs <= 2 * base`
+  // the retry window comes out slightly SHORTER than the attempt it exists to
+  // give room to (480000/480000 -> 456000). The observation is right; the remedy
+  // is worse than what it fixes, MEASURED across all three regimes:
+  //
+  //   regime            first(effective)   unfloored   floored   unfloored gives
+  //   cap = 2x base           480000        912000     912000    NAMED backstop
+  //   cap = base              480000        456000     480000    NAMED backstop
+  //   cap < base (t=3)        180000        171000     180000    NAMED backstop
+  //
+  // Flooring pins the window ONTO the leg cap in both degenerate regimes, which
+  // is the tie the headroom exists to break — so the leg dies a generic
+  // `timeout` and the named diagnosis is lost. That diagnosis is this module's
+  // entire purpose. The unfloored cost is bounded at 5% of the window (24 s at
+  // CI scale, 9 s at `--timeout 3`), and it is paid only where the leg cap
+  // already dominates the backstop. Trading ≤5% of one retry's patience for a
+  // named cause on every retry death is the right side of that trade.
+  return Math.min(2 * baseBackstopMs, Math.floor(legTimeoutMs * 0.95));
+}
+
+module.exports = { retryBackstopMs };

package/src/council/run-retry.js

@@ -17,6 +17,7 @@
 const { materializeReviews, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
 const { resolveNoOutputBackstopMs } = require('../utils/no-output-backstop');
+const { retryBackstopMs } = require('./run-retry-window');
 const { waveStillDeadNote, srcLegStillDeadNote, retryLegStillDeadNote, missingLegStillDeadNote }
   = require('./run-retry-notes');
 // briefingFor + bindRetryWave live in ./run-retry-launch (v4.8 T-A2 split); the pad/bind core it wraps is stage1-bind.js :: bindPaddedWave (SI-27).
@@ -54,17 +55,13 @@ async function retryStage1Losses(ctx, { deadWaves = [], deadLegs = [],
   const out = { aborted: null, recoveredLegs: [], stillDeadNotes: [], twins,
     stillDeadWaves: [], stillDeadLegs: [], skippedDeadWaves: [], skippedDeadLegs: [],
     stillDeadRetryLegs: [], seatOf: new Map(), orphanLegs: [], attemptedSeats: new Set() };
-  // Task 5 (#129): SL-2 retries the SAME model under the SAME conditions, so a
-  // latency failure is structurally unhealable. Double the window, clamped to
-  // the leg timeout so the failure CLASS stays NO_OUTPUT_BACKSTOP rather than
-  // silently becoming an ordinary timeout at a low --timeout. 2*0 === 0 keeps
-  // the disable hatch. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
-  // ⚠️ #135 C0 took this 240s -> 600s; deliberate, see CHANGELOG (council A1, PR #182).
+  // The retry window: doubled and clamped strictly below the leg timeout.
+  // Reasoning (and #219's correction) lives in ./run-retry-window — extracted
+  // for the 300-line gate. (o.timeout || 15) * 60 * 1000 mirrors fanout.js:254.
   const legTimeoutMs = (o.timeout || 15) * 60 * 1000;
-  const escalatedBackstopMs = Math.min(
-    2 * (Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs()),
-    legTimeoutMs,
-  );
+  const escalatedBackstopMs = retryBackstopMs(
+    Number.isFinite(o.noOutputBackstopMs) ? o.noOutputBackstopMs : resolveNoOutputBackstopMs(),
+    legTimeoutMs);
 
   for (const unit of groupStage1Losses(o, deadWaves, deadLegs, seatOf, twins)) {
     // Task-4 review hardening: a unit this pass cannot even ATTEMPT — an

package/src/council/run-stage2.js

@@ -23,6 +23,9 @@ const stage2 = require('./briefings-stage2');
 const { parseJudgeOutput } = require('./parse-stage2');
 const { sanitizeName, isAbortExit } = require('./run-launch');
 const runState = require('./run-state');
+// #219 (council, glm minor): `leg.error` is UNTRUSTED provider text. The house
+// sanitizer — one sanitizer, one dialect (utils/text-sanitize.js).
+const { collapseExcerpt } = require('../utils/text-sanitize');
 const { buildRunStatsEntry } = require('./run-assemble');
 // v4.8 PR3 Task 4: seat binding. artifactName is NOT re-exported from
 // run-launch.js (its exports stop at sanitizeName/isAbortExit), so it comes
@@ -169,9 +172,16 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
       fs.writeFileSync(path.join(o.runDir, name), leg.summary, { mode: 0o600 });
     }
     let conformance = 'clean';
-    let parsed = (leg.status === 'complete' && leg.summary)
-      ? parseJudgeOutput(leg.summary, parseCtx)
-      : { ok: false, errors: [{ code: 'DEAD_LEG', detail: leg.error || leg.status }] };
+    // #202: ONE predicate for "this judge never answered at all", shared by the
+    // DEAD_LEG classification below and by the degrade it now raises. Spelling it
+    // twice is how the two would drift into disagreeing about which judges died —
+    // and note it is NOT `leg.status !== 'complete'`: a leg that completes with an
+    // EMPTY summary produced nothing either, and the DEAD_LEG arm has always
+    // treated it that way.
+    const legDied = !(leg.status === 'complete' && leg.summary);
+    let parsed = legDied
+      ? { ok: false, errors: [{ code: 'DEAD_LEG', detail: leg.error || leg.status }] }
+      : parseJudgeOutput(leg.summary, parseCtx);
     let attempts = 0;
     // ⚠️ LC-12: the judging text the repair prompt must carry, tracked exactly like
     // Stage-1's `repairing` so `judging` and `parsed.errors` always describe the SAME
@@ -216,6 +226,40 @@ async function runStage2(ctx, { reviews, labels, globalFindings, extraLabeled =
       if (parsed.ok) { conformance = 'repaired'; }
     }
     if (!parsed.ok) {
+      // #202: THE MISSING THIRD CASE. A dead judge leg still comes back as a leg
+      // object, so bindPaddedWave binds it — it is neither `orphan` nor
+      // `unbound`, and stage 2 had no case for it. It fell through into
+      // judgeResults with `ok:false` and vanished: MEASURED on CI run
+      // 32956900910 (wave 9d8029c8-s2), where glm and qwen judges died at +300s
+      // with zero tokens and run.json recorded no degrade at all, while the
+      // verdict shipped a four-column adjudication matrix two of them never
+      // voted in. The one net that might have caught it, `thin-cross-review`,
+      // fires only at `usableJudges < 2`; that run had exactly 2 of 4.
+      //
+      // ⚠️ Emitted with the default kind ('degrade'), so run-degrade.js's sink
+      // sets `degraded.value` and the run exits 2. That is a deliberate
+      // behaviour change (owner's call): before it, a half-adjudicated verdict
+      // could exit 0, and W11 only exited 2 because of an unrelated
+      // cost-accounting degrade. An unparseable-but-ANSWERED judge is a
+      // different fact and is deliberately excluded — it already darkens the
+      // seat's row via `conformance: 'unstructured'`, and it is repairable.
+      if (legDied) {
+        ctx.degrade.note({
+          channel: 'stage2-judge',
+          what: `judge ${judge} did not adjudicate`,
+          // #219: `why` is PROSE — it renders into run.json, the report and the
+          // sticky PR comment — so the provider's text is collapsed to one
+          // bounded line. `data.reason` below stays VERBATIM on purpose: it is
+          // the machine surface, it is JSON (nothing to inject), and truncating
+          // it would cost exactly the fidelity a reader opens run.json for.
+          why: `its Stage-2 leg ended '${leg.status}'`
+            + (leg.error ? `: ${collapseExcerpt(leg.error, 200)}` : ''),
+          effect: `the cross-review was adjudicated by fewer than the ${judges.length} judges the `
+            + 'bench implies; the run continues and will exit degraded (2)',
+          data: { judge, seat: seat ? seat.id : null, waveId: `${o.runId}-s2`,
+            status: leg.status, reason: leg.error || null },
+        });
+      }
       judgeResults.push({ judge, seat, ok: false, order: null, orderSeats: null, adjudications: null,
         conformance: leg.status === 'complete' ? 'unstructured' : 'clean',
         // #83 (v4.6 Plan 2): the judge's ORIGINAL Stage-2 wave leg, mirroring

package/src/council/tally.js

@@ -6,6 +6,11 @@ const { peersOf, unattributedPeerDrops } = require('./peer-split');
 // the seat-keying in it — release Constraint 6 is EXTRACT, never shave).
 // computeStreetCred is re-exported below, so no existing import path moved.
 const { computeStreetCred } = require('./street-cred');
+// #202: the TTFT probe's LAST emit gate — a RE-PROJECTION, so omitting the field
+// here destroyed one already produced rather than failing to produce it. Through
+// v4.9.1 utils/ttft.js's docblock enumerated only the four PRODUCER gates and
+// stopped one short of this one; it now names all five.
+const { isMeasuredTtft } = require('../utils/ttft');
 
 /**
  * Peers-only tier cascade. a/d are agree/dispute counts among PEER judges
@@ -181,6 +186,13 @@ function tally(input) {
       ...(r.seat ? { seat: r.seat } : {}),
       status: r.status || 'unknown',
       durationMs: typeof r.durationMs === 'number' ? r.durationMs : null,
+      // #202: emit-when-VALID, in buildRunStatsEntry's own slot (between
+      // durationMs and usage) so G7b's key-order invariant holds for a row that
+      // carries it. NOT `durationMs`'s null-coercion above: a null here would be
+      // read as a measurement, and absence must keep its one meaning — "no
+      // substantive tick was ever observed". The shared predicate is imported
+      // rather than hand-spelled; this file has no require-free pin.
+      ...(isMeasuredTtft(r.ttftMs) ? { ttftMs: r.ttftMs } : {}),
       usage: r.usage || null,
     })),
     tierCounts: countTiers(outFindings),

package/src/council/verdict-seats-reviewed.js

@@ -0,0 +1,60 @@
+/**
+ * @module council/verdict-seats-reviewed
+ * #202: the bench-seat census for verdict.json, as a spreadable fragment.
+ *
+ * ⚠️ EXTRACTED, not shaved — release Constraint 6, and the same 300-line gate
+ * that put `verdict-seat-loss.js` in its own leaf: adding this to verdict.js
+ * took that file to 313/300. It could not join verdict-seat-loss.js either —
+ * that module is pinned to export EXACTLY its two functions.
+ *
+ * This is the ONE place that decides what "a bench seat" means, so the
+ * emit-when-set rule and the role filter cannot drift apart. `of` is every
+ * `role:'seat'` row — one per bench seat POST-retry, so a healed seat counts
+ * once while its first attempt is `role:'superseded'`; judges, chair and
+ * repairs are not bench seats. `reviewed` is those whose leg completed: a
+ * `timeout` is not a review any more than an `error` is.
+ *
+ * A LEAF: it requires nothing, matching its seat-loss sibling.
+ */
+
+'use strict';
+
+/**
+ * @param {Array<object>|undefined} runStats
+ * @returns {{seatsReviewed?: {reviewed: number, of: number}}}
+ */
+/**
+ * Is this runStats row a BENCH seat — something that was asked to review?
+ *
+ * ⚠️ These are exactly the three roles `seats.js :: buildSeats` mints, and that
+ * is the point: it is the producer, so this mirrors it rather than guessing.
+ * `role === 'seat'` alone (#219) counted ZERO on a `--lenses` run, where every
+ * seat carries `lens:<slug>` — so emit-when-set silently omitted the census from
+ * the runs using the richest bench. A critic counts too: it is an adversarial
+ * seat, but it reviews.
+ *
+ * An ALLOWLIST, not a denylist of judge/chair/repair/superseded: a new
+ * non-bench role added later must not silently inflate the denominator.
+ */
+function isBenchRole(role) {
+  return role === 'seat' || role === 'critic'
+    || (typeof role === 'string' && role.startsWith('lens:'));
+}
+
+function seatsReviewedOf(runStats) {
+  // ⚠️ `Array.isArray`, NOT `runStats || []`. buildVerdict is reachable on
+  // externally-supplied records that never touched tally() in-process — the MCP
+  // `record` param of mcp-tools.js :: amicus_verdict is `z.record(z.any())`,
+  // fully permissive — and this file's own tests hand it `runStats: {}`. A
+  // truthy non-array sails past `||` and throws on `.filter`, turning a missing
+  // census into a crashed verdict build. The closed-literal comment further down
+  // makes the same argument about the same caller.
+  const seats = (Array.isArray(runStats) ? runStats : []).filter(r => r && isBenchRole(r.role));
+  if (seats.length === 0) { return {}; }
+  return { seatsReviewed: {
+    reviewed: seats.filter(r => r.status === 'complete').length,
+    of: seats.length,
+  } };
+}
+
+module.exports = { seatsReviewedOf };

package/src/council/verdict.js

@@ -13,6 +13,10 @@ const { summarizeSeatLoss, deriveSeatLoss } = require('./verdict-seat-loss');
 // opts.overallVerdict, null in every Stage-4 manual path).
 const VERDICT_SCHEMA_VERSION = 2;
 
+// #202: the bench-seat census leaf (the 300-line gate — same reason
+// verdict-seat-loss.js is its own module).
+const { seatsReviewedOf } = require('./verdict-seats-reviewed');
+
 /**
  * Merge a tally record with Claude's Stage-4 decisions into the verdict record.
  * @param {object} record  tally() output
@@ -123,6 +127,25 @@ function buildVerdict(record, decisions = [], opts = {}) {
     // Additive and OPTIONAL (schemaVersion stays 2): present only when a critic
     // was requested, so its absence never has to be interpreted.
     ...(opts.seatLoss ? { seatLoss: opts.seatLoss } : {}),
+    // #202: how much of the bench actually reviewed. DERIVED here rather than
+    // passed in, because every caller that could pass it already has the same
+    // `runStats` this reads — and a parameter is one more thing a rebuild path
+    // can forget (the `intent` key needed a SECOND carrier for exactly that).
+    //
+    // Its sibling `seatLoss` cannot serve: `deriveSeatLoss` returns null when no
+    // `--critic` was requested, and CI runs `CRITIC: ''` — so seat loss is
+    // STRUCTURALLY absent from every CI verdict. MEASURED on run 4424218c, a
+    // two-seat bench that published a four-model street-cred table with the dead
+    // seats rendered `n/a`, indistinguishable from the legend's "neutral".
+    //
+    // Counts the BENCH roles buildSeats mints — `seat`, `critic` and `lens:<slug>`
+    // (#219 r2: this said "`role:'seat'` ONLY" after the filter was widened, and
+    // two seats caught the stale sentence). One row per bench seat POST-retry, so a
+    // healed seat is counted once (its first attempt is `role:'superseded'`), and
+    // judges/chair/repairs are not bench seats. Emit-when-set — a record with no
+    // bench rows carries no key, because `0 of 0` would read as a measurement of
+    // an empty bench rather than as the absence it is.
+    ...seatsReviewedOf(record.runStats),
     // v4.6 Plan 2 (spec §4): the canonical what-was-lost surface. Additive and
     // OPTIONAL — present only when the run actually degraded, so a clean run's
     // verdict is byte-for-byte unchanged. schemaVersion stays 2 (the v4.5.2