dsh-vibe-math 2.3.0 → 2.3.2

package/vibe-math-v3//345/256/236/347/216/260/346/226/271/346/241/210.md

@@ -498,7 +498,7 @@ VibeMath/                                   # 工作区级
 | `vibe_math_decide` | 扩展支持 `node: 'plan'`（计划审批）与 `node: 'method-promote'` |
 | `vibe_math_lean_run` | `{file, target?, timeout_ms?}`：在一个 `.lean` 文件上执行 Lean 工具链并**如实**回报 `{ok, exitCode, signal, ms, command, stdout, stderr, file}`；给了 `target` 就把这次运行记到该对象上。**绝不抛异常到调度循环**：宿主没有 subprocess 服务 → `NO_SUBPROCESS`，工具链解析失败 → `LEAN_NOT_FOUND`，超时 → `LEAN_TIMEOUT`（并调用 `handle.terminate()`） |
 | `vibe_math_lean_archive` | `{kind, ...}` 一个工具覆盖四种归档：`kind='def'`/`'lemma'` → 全局 `<VibeMath 根>/Formal/{Lib,Proved}/<name>.lean` 并重建对应索引（`content` 或 `from` 二选一；`run:false` 跳过执行）；`kind='proof'` → 写 `Formal/<target>.lean`，该文件最近一次运行 ok 时**同时**写 `Verified/Lean/<target>.lean` 并把对象标为 `passed`；`kind='blocked'` → 记录显式难度判断/阻塞原因（`note` 必填，空则拒绝） |
-| `vibe_math_lean_lib` | `{refresh?}`：扫描并重建三处索引（项目 `Formal/Index.md`、全局 `Lib/Index.md`、`Proved/Index.md`），返回可复用库清单（供写新定义前查重、直接复用）；`refresh:false` 只读不重建 |
+| `vibe_math_lean_lib` | `{refresh?}`：扫描并重建三处索引（项目 `Formal/Index.md`、全局 `Lib/Index.md`、`Proved/Index.md`），返回可复用库清单（供写新定义前查重、直接复用）；`refresh:false` 只读不重建。另有 `objects`（每个对象的形式化状态）与 `verify`（当前在飞验证任务的标识，无则 `null`）两个字段，与 v5 的同名输出一致 |
 
 ### 11.1 Lean 形式化验证（v3 实现要点）
 
@@ -534,8 +534,8 @@ VibeMath/                                   # 工作区级
 
 **门禁落点**（契约 §8 要求唯一收口点，不散落）：
 - 判定入口：`settleVerdict`（辩论/评审裁定，在**改对象之前**拦下）与 `processStatusUpdates`（自报概率 1 的第二条"宣告定论"入口）；
-- 写卡收口点：`writeVerifiedPropositionCardIfNeeded` / `writeVerifiedProblemCardIfNeeded` → `writeVerifiedCardIfChanged`（require 模式下没有 `passed`/`blocked` 就**不写** Verified 卡片，作为防御性双保险）；
-- 不通过时统一走 `deferForFormal`：记未定论（`formal-required`）+ 写 `Formal/TODO.md` + 公告（活动日志 + `Logs/形式化.md`），**不改变对象的既有权重/概率字段**，绝不卡死调度——对象留在原库，完成形式化或记录阻塞后重新提议验证即可；达到 `passed`/`blocked` 时自动把该对象从待办中移除（待办的含义就是"还不满足门禁"）。
+- 写卡收口点：`writeVerifiedPropositionCardIfNeeded` / `writeVerifiedProblemCardIfNeeded` → `writeVerifiedCardIfChanged`。门禁**只在这唯一的收口点**判定：卡片**不存在**时 require 模式下没有 `passed`/`blocked` 就**不写**（并记待办）；卡片**已存在**时只做刷新——包括把被 `defect` 撤回的形式化状态如实改成 `已尝试未通过`（否则一张定论卡片会永久宣称「形式化: Lean 通过（Verified/Lean/<id>.lean）」而那份证明已被撤回。门禁管的是"能不能宣告新结论"，不是"能不能说实话"）。
+- 不通过时统一走 `deferForFormal`：记未定论（`formal-required`）+ 写 `Formal/TODO.md` + 公告（活动日志 + `Logs/形式化.md`），**不改变对象的既有权重/概率字段**，绝不卡死调度——对象留在原库，完成形式化或记录阻塞后重新提议验证即可；达到 `passed`/`blocked` 时自动把该对象从待办中移除（待办的含义就是"还不满足门禁"）。`Formal/TODO.md` 与 `Formal/Index.md` 的待办段按**当前档位**措辞：`require` 说"定论被搁置"，`encourage` 说明本档没有门禁、框架不会搁置裁定（靠表决者弃权），不承诺它无法强制的行为（契约 §4.1 第 3 条）。
 - **防空转**：已经被记为「形式化待办」而形式化又没补齐的对象，`createVerifyTask` 不再为它建验证任务（否则同一个 `rId` 每个 tick 都会被重建、每轮再派一批验证器，而结果每轮都被同一道门拦下——纯烧验证预算）。一旦 `passed`/`blocked` 落库，门禁条件满足，候选自然重新出现并继续验证，无需人工干预。回退启发式在跳过这类候选时**不占用本轮名额**（`created` 才 `return`），否则排在待办对象后面的候选会被永久饿死。
 
 **错误码**（一律作为结果返回，不抛进调度循环）：
@@ -553,6 +553,24 @@ VibeMath/                                   # 工作区级
 
 **执行与守卫**：`subprocess.resolveExecutable(leanCommand)` → `spawn({argv:[exe, ...leanArgs, abs], cwd:<项目根>, stdio:{stdin:'ignore',stdout/stderr:{maxBytes:64KB}}, graceMs:leanTimeoutMs})` → `await handle.done` → 收集 stdout/stderr（`readFrom(0).text`，截断到 4KB）。路径守卫 = `normalizeAbsPath`（纯词法折叠 `.`/`..`/重复斜杠）+ 边界为 **VibeMath 根**（不是项目根）；`lean_run` 的 `file` 先按项目根解析、再按 VibeMath 根解析，两条路径都过同一道守卫。
 
+### 11.2 忠实性缺陷（`defect`）、工具名全称与归档纪律
+
+**`defect` 是独立的一档，不是"命题为假"**（契约 §4.1）。`passed` 只保证"这段 Lean 代码通过了内核检查"，**不保证它说的就是命题想说的**。表决者逐条核对后发现写窄了 / 写宽了 / 换了对象 / 漏了条件时，那是**形式化不合格**：若把它记成 0，框架记下的会是"该命题为假"——用来求真更严格的机制，反而伪造出一个错误的否定结论；若只记成 `blocked`，门禁又会**放行**（`blocked` 本就允许定论），等于带着一个坏形式化去定论。
+
+- **回执**：`formal:{target, decision:'defect', note:'<具体偏差>'}`。`note` **必填**，为空则整条记录被**拒绝**（返回 `V3_INVALID_ARGUMENT`），形式化记录与归档证明**保持不变**。顶层 `formal` 与 `meta.formal` 两种写法都接受：验证回执走 `handleVerifier`，solver / explorer / 重派生等工作轮回执走 `absorbFormalFromReply`。
+- **落库**（`formalRecordDefect`，契约 §4.1）：无论此前是 `passed` 还是 `blocked`，一律**降级**为 `attempted`（都让位于"形式化不合格，需重做"）；清空 `proof`；**撤下**归档证明 `Verified/Lean/<id>.lean`（工作文件 `Formal/<id>.lean` 保留，代码不丢）；`note` 写入形式化记录与 `Formal/TODO.md`（按 id 去重、就地刷新）；对象卡锚点刷新为 `已尝试未通过`；公告到活动日志与 `Logs/形式化.md`。
+- **撤回归档证明不是"尽力删除"**（`withdrawArchivedProof`）：`fs` 服务没有 unlink，`subprocess` 又是可选服务，删除命令也可能静默失败（桩宿主 / 权限 / 宿主不提供 shell），而 `Verified/Lean/<id>.lean` 正是所有人找"这条结论的证明"的路径。因此删除后**必须回读确认**；确认不了就用撤回声明**就地覆盖**该文件（`-- 已撤回（<时间>）：该形式化被认定与命题原文不一致。` + 指向保留的工作文件），使它不可能再被读成一份通过的证明；两种兜底都失败时公告里明确写出"**未能撤回**，请手动删除"。公告如实说明发生的是**哪一种**（删除 / 就地覆盖 / 失败）。
+- **`require` 档**：降级后 `formalGateOk` 为假，本次裁定**不定论**——不改对象的既有权重/概率字段、不写 `Verified/` 卡片，对象进入「形式化待办」；修正形式化并重新跑通（`vibe_math_lean_archive kind='proof'`）后再投票。**`encourage` 档没有门禁**：框架仍然撤回证明并写入待办，但注入文本与公告都**不得**声称框架搁置了裁定（那是它无法强制的行为，契约 §4.1 第 3 条）——只有表决者自己的弃权值能阻止一致性结论。
+- **唯一可以投 0 的情形**：表决者**独立于这份 Lean 代码**也能确定命题为假，且 `Reason` 写清独立理由。
+
+**提示词硬要求**（契约 §6 顶部的五条，v3 全部落地，并由套件对**每条捕获的提示词**做正则扫描，而不是只看一两处）：
+
+1. **工具名一律全称**：注入文本（含工具自己返回的 `hint` 字段）里只允许 `vibe_math_lean_run` / `vibe_math_lean_archive` / `vibe_math_lean_lib`。`lean_run` / `lean_archive` / `lean_lib` 这类缩写**不是注册名**，代理照抄会去调用一个不存在的工具；套件用 `/(^|[^a-z_])lean_(run|archive|lib)/` 扫描全部语料，命中即红。
+2. **回执字段名必须与真实契约一致**：v3 的表决值字段是 **`Result`**（v4/v5 才是 `verdict`）。写错字段名 = 那一票被静默丢弃（退回默认 0.5）。忠实性分支因此写的是 `一致 → Result = 1`；套件断言每条表决提示词含 `Result` 且不含 `verdict`。
+3. **归档可复用定义/引理前必须先跑通**：`vibe_math_lean_archive` 支持 `run:true`，或先 `vibe_math_lean_run`；**跑不通的代码不得进入 `Formal/Lib` / `Formal/Proved`**，否则"可复用库"会被不编译的定义污染。验证提示词与「顺手形式化」一行都写明了这条纪律（`归档前先跑通（vibe_math_lean_run 或 run=true）；跑不通的定义不要进可复用库。`）。
+4. **工具链缺失时的出路必须写出来**：`LEAN_NOT_FOUND` 时把代码写下来归档，并在回执的 `note` 里写明"宿主无 Lean 工具链"——这算**显式阻塞原因**，`require` 档可以据此放行，代理不会因为装不了 Lean 而卡死。v3 的注入文本**同时点名 `NO_SUBPROCESS`**（宿主不提供 subprocess 服务、因此根本无法执行 Lean 的另一种失败形态），否则代理不认识这个码，会把它当成未知故障反复重试而不是记录阻塞。`vibe_math_lean_run` 返回的失败 `hint` 也按错误码区分：工具链缺失 / 无 subprocess / spawn 失败时给出"没有编译器输出可修，写下代码并归档 + 记录阻塞原因"，只有真正的编译失败才说"按上面的编译器输出修复后重跑"。
+5. **忠实性缺陷不得用 0 表达**：只有独立于 Lean 代码也能确定命题为假时才投 0（§4.1 第 4 条）。套件断言注入文本**不含** `偏离 → 0` 这类"偏差即假"的指令，且含"不要投 0 / 记为形式化不合格 / 走待办"的要求。
+
 ---
 
 ## 12. 提示词与知识上下文（关键）

package/vibe-math-v4/vibe-math-v4.js

@@ -65,7 +65,7 @@ export function apply(ctx) {
     // is persisted through v4's OWN durable State/*.json mechanism (State/formal.json) and must
     // survive `resume` — otherwise a require-mode object would lose the very record that decides
     // whether its verdict may take effect.
-    let formal = {}, formalTodos = []
+    let formal = {}, formalTodos = [], formalPersisted = false
     let meetingState = null, verifyState = null, pendingVerify = [], pendingMeeting = null   // pendingVerify: FIFO queue (several residents may independently propose different objects before any verify runs — a single slot silently DROPPED all but the last proposal)
     let busy = new Set(), wakeKind = new Map(), currentResident = ''
     let finalizeLock = null   // 'meeting'|'verify' while a consensus finalize is running (reentry guard)
@@ -146,6 +146,17 @@ export function apply(ctx) {
       if(isWindows()) return 'New-Item -Force -ItemType Directory -Path '+paths.map(psQuote).join(',')+' | Out-Null'
       return 'mkdir -p '+paths.map(shQuote).join(' ')
     }
+    /**
+     * Delete command for the same two interpreters. DSH's `fs` service has no unlink/remove at all
+     * (dsh-fs FileSystem: resolve/stat/readText/writeText/editText/listDir), so the ONE place this
+     * preset must remove a file — withdrawing a retracted proof on `defect` (spec §4.1) — goes
+     * through the platform shell helper the preset already uses for mkdir. `-ErrorAction
+     * SilentlyContinue` / `-f` keep it idempotent: deleting an already-absent file is a success.
+     */
+    function rmCmd(paths){
+      if(isWindows()) return 'Remove-Item -Force -ErrorAction SilentlyContinue -LiteralPath '+paths.map(psQuote).join(',')
+      return 'rm -f '+paths.map(shQuote).join(' ')
+    }
     async function runShell(script,cwd){
       const subprocess=subprocessOf(); if(subprocess===undefined) return {ok:false,error:'no-subprocess'}
       try {
@@ -283,7 +294,13 @@ export function apply(ctx) {
       await saveFormal()
       return true
     }
-    function saveFormal(){ return writeJson('State/formal.json',{records:formal,todo:formalTodos}) }
+    // Once formal state has been persisted (or restored from disk) the file must KEEP being
+    // written even after the mode is switched back to `off` — otherwise `start()`'s clean slate
+    // would never reach disk and a later `resume` would restore a stale `passed` record for a
+    // reused object id (the exact hazard that reset exists to prevent). A session that never
+    // touched the feature writes NO State/formal.json at all: `off` is a TRUE no-op (v3 guards
+    // its own State/formal.json the same way).
+    function saveFormal(){ formalPersisted=true; return writeJson('State/formal.json',{records:formal,todo:formalTodos}) }
     // `passed` requires a GREEN RUN, not merely an archived file: a proof file that has never
     // been executed proves nothing, so a hand-written file cannot buy its way past the gate.
     const formalGateOk=(rec)=>!!rec&&(rec.status==='passed'||rec.status==='blocked')
@@ -293,6 +310,9 @@ export function apply(ctx) {
       const r=formalOf(target)
       if(r.status==='passed') return 'Lean 通过（'+(r.proof||r.file||'')+'）'
       if(r.status==='blocked') return '阻塞（'+(r.note||'未说明')+'）'
+      // A retracted proof must not read as a plain "tried and failed": the card has to say WHY the
+      // archived proof disappeared (spec §4.1 — a fidelity defect is not a refutation).
+      if(r.status==='attempted'&&r.decision==='defect') return '忠实性缺陷（'+(r.note||'未说明')+'，待重做）'
       if(r.status==='attempted') return '已尝试未通过'
       return '未尝试'
     }
@@ -360,16 +380,44 @@ export function apply(ctx) {
       try {
         handle=sub.spawn({ argv, cwd:frameworkRoot(), stdio:{stdin:'ignore',stdout:{maxBytes:64*1024},stderr:{maxBytes:64*1024}}, graceMs:cap })
       } catch(e){ return {ok:false,code:'LEAN_SPAWN_FAILED',message:String((e&&e.message)||e),file:rel,ms:now()-started} }
+      // A timeout must be ACTIVELY enforced. `graceMs` is only the host's own grace window; the
+      // contract (§7) additionally requires `handle.terminate()` on timeout, and a host that
+      // ignores/exceeds graceMs would otherwise leave the Lean process running while the framework
+      // reports LEAN_TIMEOUT. Race `done` against a cap-ms timer that terminates the handle and
+      // resolves a synthetic outcome. Note: the plugin runtime has no global setTimeout — the
+      // `timer` service (ctx.timeout) is the only timer, and it returns the disposer we clear
+      // below when `done` wins the race.
+      let killedByUs=false, timerDispose=null
       let outcome
-      try { outcome=await handle.done }
-      catch(e){ return {ok:false,code:'LEAN_RUN_FAILED',message:String((e&&e.message)||e),file:rel,ms:now()-started} }
+      try {
+        outcome=await Promise.race([
+          handle.done,
+          new Promise(function(resolve){
+            if(typeof ctx.timeout!=='function') return   // no timer service: the host's graceMs is all we have
+            timerDispose=ctx.timeout(function(){
+              killedByUs=true
+              try { if(typeof handle.terminate==='function') handle.terminate() } catch(e){ /* best effort */ }
+              resolve({exitCode:null,signal:'SIGTERM'})
+            }, cap)
+          }),
+        ])
+      } catch(e){
+        if(timerDispose){ try { timerDispose() } catch(_e){} }
+        return {ok:false,code:'LEAN_RUN_FAILED',message:String((e&&e.message)||e),file:rel,ms:now()-started}
+      }
+      if(timerDispose){ try { timerDispose() } catch(e){ /* already fired */ } }
       let out='',err=''
       try { if(handle.collected&&handle.collected.stdout) out=handle.collected.stdout.readFrom(0).text } catch(e){ /* best effort */ }
       try { if(handle.collected&&handle.collected.stderr) err=handle.collected.stderr.readFrom(0).text } catch(e){ /* best effort */ }
       const exitCode=outcome?outcome.exitCode:null
       const ms=now()-started
       const ok=exitCode===0
-      const timedOut=!ok&&ms>=cap
+      // Two ways a timeout is observed: OUR timer won (we terminated the handle), or the HOST's own
+      // grace window killed the process first and its `done` beat our timer to the race — the latter
+      // is recognised by "non-zero exit after at least cap ms", which is what the spec's
+      // LEAN_TIMEOUT row describes. Keeping both means a real hang is never reported as a plain
+      // compile failure just because the host's kill resolved first.
+      const timedOut=killedByUs||(!ok&&ms>=cap)
       return {
         ok, exitCode, signal:(outcome&&outcome.signal)||null, ms,
         command:argv.join(' '), file:rel,
@@ -379,11 +427,17 @@ export function apply(ctx) {
     }
     // Record one run against an object. `passed`/`blocked` are NEVER downgraded by a later red
     // run (only an explicit re-archive decides those); everything else becomes `attempted`.
+    // The comment used to describe a transition the body did not implement: `status:'attempted'`
+    // was hardcoded, so ANY `lean_run {target}` on a passed object silently stripped `passed`
+    // (and kept the now-stale `proof` pointer). That is not a cosmetic slip: it removes the
+    // fidelity branch from the next voting prompt AND, in `require` mode, re-closes the gate on an
+    // object that already has a green archived proof. docs/formal-verification.md §4 only maps
+    // `none`/`attempted` → `attempted`, and v2/v5 preserve passed/blocked here.
     async function formalSetRun(target,run){
       const key=formalKey(target); if(!key) return
       const prev=formalOf(key)
       await putFormal(key,Object.assign({},prev,{
-        status:'attempted',
+        status:prev.status==='passed'?'passed':(prev.status==='blocked'?'blocked':'attempted'),
         file:run.file||prev.file||'',
         decision:prev.decision||'used',
         run:{at:now(),ok:!!run.ok,exitCode:run.exitCode===undefined?null:run.exitCode,ms:run.ms||0,stdoutTail:tail(run.stdout,800),stderrTail:tail(run.stderr,800)},
@@ -405,9 +459,21 @@ export function apply(ctx) {
       if(rec.status==='passed'){
         L.push('  · 该对象已有**通过的 Lean 形式化证明**（'+(rec.proof||rec.file||'')+'，最近运行 exit 0）。')
         L.push('    **你不需要重新检查推导**。你的任务是**忠实性审查**：逐条核对 Lean 代码里的')
-        L.push('    定义 / 对象 / 条件 / 假设 / 结论是否与命题原文**完全一致**（有偏差就指出偏差），')
-        L.push('    并据此给出 verdict。')
-        L.push('  ▸ 因此请把 verdict 用在**忠实性**上：一致 → 1；发现任何偏离 → 0（或按不确定度给中间值并说明）。')
+        L.push('    定义 / 对象 / 条件 / 假设 / 结论是否与命题原文**完全一致**。')
+        L.push('  ▸ 一致 → verdict = 1。')
+        L.push('  ▸ **发现任何偏差，不要投 0**：偏差只说明**形式化不合格**，不代表命题为假。此时请：')
+        L.push("      ① verdict 给一个严格介于 0 与 1 之间的值（记为弃权），并在 reason 里写清偏差；")
+        L.push("      ② 用回执 formal:{decision:'defect', note:'<具体偏差>'} 记录它。框架会撤回这条证明的")
+        // Only `require` actually GATES the conclusion. In `encourage` the framework still
+        // withdraws the proof (and records the defect + TODO), but it CANNOT hold the ballot —
+        // promising "本次裁定不定论" there would promise behaviour the framework does not have
+        // (docs §4.1-3/§6.1); the voter's own abstention is what keeps the ballot from concluding.
+        L.push('         「已通过」状态（降级为 attempted、删除归档证明、写入形式化待办）'
+          +(formalMode()==='require'
+            ?'，本次裁定**不定论**；'
+            :'；本档没有门禁：请务必给弃权值，以保证本轮无法得出一致结论；'))
+        L.push('         修正形式化并重新跑通后再投票。')
+        L.push('  ▸ 只有当你**独立于这份 Lean 代码**也能确定命题为假时，才投 0，并在 reason 里写清独立理由。')
       } else if(rec.status==='blocked'){
         L.push('  · 该对象已被记录为**形式化阻塞**：'+(rec.note||'未说明')+'。')
         L.push('    请复核这个判断是否成立；若你认为其实可以形式化，请指出来并动手做。')
@@ -415,18 +481,15 @@ export function apply(ctx) {
       } else {
         L.push('  · 请先判断该对象的**实现难度**：若能在可接受的工作量内形式化，优先写 Lean 代码并执行。')
         L.push('  · 工具：vibe_v4_lean_run（执行）· vibe_v4_lean_archive（归档）· vibe_v4_lean_lib（查已有可复用库）')
-        L.push('  · 工作目录：Formal/（相对项目根 '+frameworkRoot().replace(/\\/g,'/')+'/）；')
-        L.push('    可复用定义放 '+formalLibRoot().replace(/\\/g,'/')+'/，已证引理放 '+formalProvedRoot().replace(/\\/g,'/')+'/；')
-        L.push('    写之前先 vibe_v4_lean_lib 查重。')
-        L.push('  · **一旦 Lean 通过，你唯一需要确认的就是忠实性**：定义/对象/条件/假设/结论是否与')
-        L.push('    命题原文逐条一致。请把注意力放在这种核对上，而不是重新做一遍推导。')
+        L.push('  · 工作目录：Formal/（相对项目根）；可复用定义放 '+formalLibRoot().replace(/\\/g,'/')+'/，已证引理放 '+formalProvedRoot().replace(/\\/g,'/')+'/；写之前先 vibe_v4_lean_lib 查重。')
+        L.push('  · **一旦 Lean 通过，你唯一需要确认的就是忠实性**：定义/对象/条件/假设/结论是否与命题原文逐条一致。请把注意力放在这种核对上，而不是重新做一遍推导。')
         if(formalMode()==='require'){
-          L.push('  · **本模式要求**：**必须产出 Lean 形式化**，或**必须**给出显式的阻塞原因')
-          L.push("    （vibe_v4_lean_archive kind='blocked' note=… 或回执 formal.note）。若两者都没有，")
-          L.push('    本次裁定不会生效，会被记为未定论（原因 formal-required）并进入「形式化待办」。')
+          L.push("  · **本模式要求**：必须产出 Lean 形式化，或**必须**给出显式的阻塞原因（vibe_v4_lean_archive kind='blocked' note=… 或回执 formal.note）。若两者都没有，本次裁定不会生效，会被记为未定论（原因 formal-required）并进入「形式化待办」。")
         } else {
-          L.push('  · 若判断不值得或无法形式化，可以不做，但请在回执的 formal 字段写明难度判断。')
+          L.push("  · 若你判断不值得或无法形式化，可以不做，但请在回执的 formal 字段写明难度判断（decision='blocked' 时必须写明 note）。")
         }
+        L.push('  · 归档可复用定义/引理前先跑通（vibe_v4_lean_archive run=true 或先 vibe_v4_lean_run）；跑不通不要入库。')
+        L.push('  · 宿主没有 Lean 工具链（LEAN_NOT_FOUND）或根本没有 subprocess 服务（NO_SUBPROCESS）时：把代码写下来归档，并在回执的 note 里写明"宿主无 Lean 工具链"——这两种都算显式阻塞原因，定论门禁可以据此放行。')
         if(rec.status==='attempted'){
           L.push('  ▸ 该对象已有形式化尝试但尚未通过（最近一次 '+(rec.run?(rec.run.ok?'通过':'未通过'):'无运行记录')+'）。')
           L.push("    请修复后重跑（vibe_v4_lean_run），跑通后用 kind='proof' 归档。")
@@ -446,10 +509,11 @@ export function apply(ctx) {
         +(formalMode()==='require'
           ? '本模式下，任何要定论为真/假的对象都必须先有 Lean 通过或显式阻塞记录。'
           : '这会让后续的验证与证明省掉大量重复工作。')
+        +'归档前先跑通（vibe_v4_lean_run 或 run=true）；跑不通的定义不要进可复用库。'
     }
     /** The `formal` object every non-off prompt documents in its JSON reply contract. */
     function formalReplyField(target){
-      return '{"formal":{"target":"'+String(target||'p-x')+'","decision":"used|blocked","file":"Formal/'+String(target||'p-x')+'.lean","note":"难度判断/阻塞原因"}}'
+      return '{"formal":{"target":"'+String(target||'p-x')+'","decision":"used|blocked|defect","file":"Formal/'+String(target||'p-x')+'.lean","note":"难度判断/阻塞原因/具体偏差"}}'
     }
 
     // ---- the three indexes (framework-maintained) ---------------------------
@@ -536,11 +600,14 @@ export function apply(ctx) {
           await writeFormalIndex()
         }
       } catch(e){ /* the index is best-effort; a run result must always come back */ }
-      logActivity('formal',(memberId||'host')+' lean_run '+(run.file||String(args.file||''))+' → '+(run.ok?'通过':(run.code||'未通过')))
+      // The activity log is part of the injected-text surface (a host reads it out of
+      // vibe_v4_report, and residents may be quoted it): use the REGISTERED tool name, never the
+      // bare `lean_run` abbreviation (docs §6 hard requirement 1).
+      logActivity('formal',(memberId||'host')+' vibe_v4_lean_run '+(run.file||String(args.file||''))+' → '+(run.ok?'通过':(run.code||'未通过')))
       return Object.assign({ok:!!run.ok},run,{
         mode:formalMode(),
         hint: run.ok
-          ? "通过。若是某个对象的证明，请用 vibe_v4_lean_archive kind='proof' 归档（会写入 Verified/Lean/ 并把审查对象变成忠实性）；若是可复用定义/引理，用 kind='def'/'lemma' 归档到全局库。"
+          ? "通过。若是某个对象的证明，请用 vibe_v4_lean_archive kind='proof' 归档（会写入 Verified/Lean/ 并把审查对象变成忠实性）；若是可复用定义/引理，用 kind='def'/'lemma' 归档到全局库——归档前先跑通（run=true 或先 vibe_v4_lean_run）：跑不通的定义不要进可复用库。"
           : '未通过。请按上面的编译器输出修复后重跑；若判断无法完成，用 vibe_v4_lean_archive kind=\'blocked\' 记录原因。',
       })
     }
@@ -623,23 +690,118 @@ export function apply(ctx) {
       }
       return {ok:false,code:'V4_INVALID_ARGUMENT',message:"kind must be 'def' | 'lemma' | 'proof' | 'blocked'"}
     }
+    /**
+     * Withdraw an archived proof (spec §4.1). The RECORD is authoritative, but the FILE must not
+     * survive at the exact path everyone looks for "this object's proof": a host whose shell
+     * cannot delete (no `subprocess`, a stub shell that exits 0 without removing anything, a
+     * permission quirk) would otherwise leave the retracted proof readable as the object's proof
+     * while the record already says `attempted`. So the withdrawal is: delete → CONFIRM through
+     * the fs service that it is really gone → if it still exists, OVERWRITE it with an explicit
+     * withdrawal notice. Returns WHICH path it took ({ok,how:'deleted'|'overwritten'|'failed'})
+     * so the caller/activity log can say so out loud instead of reporting a best-effort delete as
+     * done. Every path goes through `leanAbsPath`, so this can only ever touch a `.lean` file
+     * inside the VibeMath root (a hand-edited State/formal.json must not become an arbitrary-file
+     * delete).
+     */
+    async function withdrawProof(rel){
+      const raw=String(rel==null?'':rel)
+      if(!raw) return {ok:false,how:'failed',skipped:true}
+      const abs=leanAbsPath(raw)
+      if(abs===null||!/\.lean$/.test(abs)){
+        logActivity('formal','拒绝删除越界的归档证明路径：'+raw)
+        return {ok:false,how:'failed',skipped:true}
+      }
+      const sub=subprocessOf()
+      if(sub!==undefined&&typeof sub.spawn==='function'){
+        const r=await runShell(rmCmd([abs]),vibeRoot())
+        // Exit 0 is NOT proof of deletion: confirm through the fs service before believing it.
+        if(r&&r.ok&&await readTextAbs(abs)===undefined) return {ok:true,how:'deleted',abs}
+      }
+      // Fallback: make the file impossible to read as this object's proof any more. The withdrawn
+      // code itself is NOT lost — it stays in the working file Formal/<id>.lean.
+      const notice='-- 已撤回（'+fmtTime()+'）：该形式化被认定与命题原文不一致。\n'
+        +'-- 原代码保留在工作文件 Formal/'+String(raw).split('/').pop()+'；修正并重新跑通后重新归档。\n'
+      if(await writeTextAbs(abs,notice)) return {ok:true,how:'overwritten',abs}
+      return {ok:false,how:'failed',abs}
+    }
+    /**
+     * §4.1 `defect`: a voter checked the Lean code against the proposition and found a FIDELITY
+     * defect (written too narrow/wide, wrong object, missing hypothesis). That is a statement about
+     * the FORMALIZATION, not about the proposition, so it must never be absorbed as "the
+     * proposition is false". The record is therefore ALWAYS downgraded to `attempted` (even from
+     * `blocked`), `proof` is cleared, `Verified/Lean/<id>.lean` is withdrawn, the deviation goes
+     * into the record + Formal/Index.md + Formal/TODO.md, and the group is told in the activity
+     * log. The working file `Formal/<id>.lean` is deliberately KEPT — the code is not lost, only
+     * its "passed" claim. In `require` mode the downgrade also makes `formalGateOk` false, so the
+     * verdict defers through the existing `deferForFormal` path (no Verified card, TODO entry).
+     */
+    async function recordFormalDefect(rId,key,note){
+      const prev=formalOf(key)
+      const proofRel=String(prev.proof||'')||('Verified/Lean/'+key+'.lean')
+      const rec=Object.assign({},prev,{status:'attempted',proof:'',decision:'defect',note,updatedAt:now()})
+      const why='formal-defect：形式化与命题原文不一致——'+String(note).slice(0,160)
+      const todo=formalTodo().slice()
+      const i=todo.findIndex(t=>t&&t.id===key)
+      // The defect reason must survive the later `deferForFormal`, which keeps an EXISTING entry
+      // rather than overwriting it — so the TODO file explains "formalization不合格", not merely
+      // "formal-required". An already-deferred object keeps its original 真/假 tally here.
+      if(i>=0) todo[i]=Object.assign({},todo[i],{why,at:now()})
+      else todo.push({id:key,at:now(),why,verdict:null})
+      // Durable write FIRST (record + todo together), then withdraw the file: a crash in between
+      // leaves an orphaned file with a truthful record, never a record still claiming `passed`.
+      await putFormal(key,rec,todo)
+      const del=await withdrawProof(proofRel)
+      const how=del&&del.how==='deleted'?'删除归档证明 '+proofRel
+        :del&&del.how==='overwritten'?'覆盖归档证明 '+proofRel+'（宿主无法删除，已写入撤回说明，原证明内容不再可读）'
+        :'⚠ 归档证明 '+proofRel+' 未能撤回（删除与覆盖均失败）——它仍停留在"该对象的证明"的位置，请不要把它当作该对象的证明'
+      try { await writeFormalTodo(); await writeFormalIndex() } catch(e){ /* best-effort */ }
+      // The activity log is agent/host-readable, so the same §4.1-3 rule applies here as in the
+      // prompt: only `require` actually GATES the verdict, so only there may this say 不定论.
+      logActivity('formal',(rId||'host')+' 报告 '+key+' 存在**忠实性缺陷**（formal.decision=defect）：'+note
+        +' ——已撤回「已通过」状态（→ attempted）、'+how
+        +'、写入 Formal/TODO.md；'+(formalMode()==='require'
+          ?'require 门禁使本次裁定**不定论**，修正形式化并重新跑通后再投票'
+          :'本档没有门禁：本轮能否定论取决于表决者是否给出弃权值，修正形式化并重新跑通后再投票'))
+      return {ok:true,target:key,status:'attempted',proof:'',decision:'defect',removedProof:!!(del&&del.ok),withdrawal:del?del.how:'failed'}
+    }
     /**
      * The per-round `formal` reply channel. This is the path that fires IN PRACTICE: a resident
      * that never calls a Lean tool still has to state its difficulty judgement. Every failure is
-     * swallowed into the activity log — an end handler must never throw into the scheduler.
+     * swallowed into the activity log — an end handler must never throw into the scheduler — but
+     * each rejection still returns the preset's typed error so the caller/audit can see WHY a
+     * judgement was dropped instead of silently losing it.
      */
     async function applyFormalReply(rId,formalReply){
       try {
+        // `off` is a TRUE no-op: the reply contract only offers the `formal` field in non-off modes,
+        // so a stray / stale / hallucinated one must NOT create Lean state (v2/v3 guard here too;
+        // without this, off mode could still be made to write Formal/ records, TODO entries and
+        // announcements). The TOOLS stay usable in off mode on purpose — a tool call is deliberate.
+        if(!formalOn()) return {ok:false,ignored:true}
         const key=formalKey(String(formalReply.target||''))
-        if(!key) return
+        if(!key){
+          logActivity('formal',(rId||'host')+' 的 formal 回执缺少 target（对象 id）——本次未记录（V4_INVALID_ARGUMENT）')
+          return {ok:false,code:'V4_INVALID_ARGUMENT',message:'formal.target（对象 id）是必填的'}
+        }
         const decision=String(formalReply.decision||'').trim()
         if(decision==='blocked'){
           const note=String(formalReply.note||'').trim()
           if(!note){
-            logActivity('formal',(rId||'host')+" 的 formal.decision='blocked' 缺少 note（难度判断/阻塞原因）——本次未记录")
-            return
+            logActivity('formal',(rId||'host')+" 的 formal.decision='blocked' 缺少 note（难度判断/阻塞原因）——本次未记录（V4_INVALID_ARGUMENT）")
+            return {ok:false,code:'V4_INVALID_ARGUMENT',message:"formal.decision='blocked' 必须写明 note（难度判断/阻塞原因）"}
           }
           await leanArchive(rId,{kind:'blocked',target:key,note})
+          return {ok:true,target:key,decision:'blocked',status:'blocked'}
+        } else if(decision==='defect'){
+          // §4.1: a fidelity defect is NOT a refutation. Accepting it as "0 / false" would make the
+          // framework fabricate a negative conclusion out of a broken formalization, so the ONLY
+          // thing this branch may do is RETRACT the passing proof and defer the verdict.
+          const note=String(formalReply.note||'').trim()
+          if(!note){
+            logActivity('formal',(rId||'host')+" 的 formal.decision='defect' 缺少 note（具体偏差）——本次未记录（V4_INVALID_ARGUMENT）")
+            return {ok:false,code:'V4_INVALID_ARGUMENT',message:"formal.decision='defect' 必须写明 note（具体偏差：写窄了/写宽了/换了对象/漏了条件…）"}
+          }
+          return await recordFormalDefect(rId,key,note)
         } else if(decision==='used'){
           const file=String(formalReply.file||('Formal/'+key+'.lean'))
           const prev=formalOf(key)
@@ -648,10 +810,16 @@ export function apply(ctx) {
             file,decision:'used',note:String(formalReply.note||prev.note||''),updatedAt:now(),
           }))
           try { await writeFormalIndex() } catch(e){ /* best-effort */ }
+          return {ok:true,target:key,decision:'used'}
         } else if(decision){
-          logActivity('formal',(rId||'host')+" 的 formal.decision 只能是 'used' 或 'blocked'（收到 "+decision+"）")
+          logActivity('formal',(rId||'host')+" 的 formal.decision 只能是 'used'、'blocked' 或 'defect'（收到 "+decision+"）——本次未记录（V4_INVALID_ARGUMENT）")
+          return {ok:false,code:'V4_INVALID_ARGUMENT',message:"formal.decision 只能是 'used' | 'blocked' | 'defect'（收到 "+decision+"）"}
         }
-      } catch(e){ logActivity('formal','formal 回执处理失败：'+String((e&&e.message)||e)) }
+        return {ok:false,code:'V4_INVALID_ARGUMENT',message:'formal.decision 是必填的'}
+      } catch(e){
+        logActivity('formal','formal 回执处理失败：'+String((e&&e.message)||e))
+        return {ok:false,code:'V4_INVALID_ARGUMENT',message:String((e&&e.message)||e)}
+      }
     }
     /** The {mode, on, objects, todo} view the host tools report (state-storage transparency). */
     function formalView(){
@@ -672,7 +840,9 @@ export function apply(ctx) {
       await writeJson('State/mailboxes.json', Object.fromEntries(mailboxes))
       await writeJson('State/taskboard.json', taskboard)
       await writeJson('State/decisions.json', decisions)
-      await writeJson('State/formal.json', {records:formal,todo:formalTodos})
+      // `off` mode must not CREATE Lean state: a run that never used the feature leaves no
+      // State/formal.json behind. Seeded/live records (or a mode that is on) still persist.
+      if(formalOn()||formalPersisted||Object.keys(formal).length||formalTodos.length) await writeJson('State/formal.json', {records:formal,todo:formalTodos})
       await writeJson('State/session.json', {running,autoDone,phase,problemId,problemText,runId,meetings,reports,lastActivityAt,lastProgressAt,activityLog,processEpoch,artifactCount})
     }
     async function loadAll(){
@@ -687,6 +857,7 @@ export function apply(ctx) {
       if(fm&&typeof fm==='object'){
         formal=(fm.records&&typeof fm.records==='object')?fm.records:{}
         formalTodos=Array.isArray(fm.todo)?fm.todo:[]
+        if(Object.keys(formal).length||formalTodos.length) formalPersisted=true
       }
     }
 
@@ -782,7 +953,7 @@ export function apply(ctx) {
         +(formalOn()?('\n'+formalWorkLine()+'\n'):'')
         +'Reply with ONLY a JSON object:\n'
         +'{"summary":"<what you did / decided this round, 1-3 sentences>","input":"<optional: a message to the whole team, or \\"\\">","solved":false,"propose_verify":"<id|null>","propose_meeting":"<agenda|null>","propose_task":"<task title|null>","task_desc":"<optional: why this task matters / what it covers|null>","claim_task":"<task id|null>","task_done":"<task id|null>","contextPct":40'
-        +(formalOn()?(',"formal":{"target":"<对象 id>","decision":"used|blocked","file":"Formal/<对象 id>.lean","note":"难度判断/阻塞原因"}'):'')
+        +(formalOn()?(',"formal":{"target":"<对象 id>","decision":"used|blocked|defect","file":"Formal/<对象 id>.lean","note":"难度判断/阻塞原因/具体偏差"}'):'')
         +'}'
     }
     function meetingPrompt(r, st){
@@ -1290,7 +1461,7 @@ export function apply(ctx) {
         +(formalOn()?(formalWorkLine()+'\n'):'')
         +'Reply with ONLY a JSON object:\n'
         +'{"summary":"<what you will do / what you advanced this round>","input":"<optional: a message to the whole team, or \\"\\">","solved":false,"propose_verify":"<id|null>","propose_meeting":"<agenda|null>","propose_task":"<task title|null>","task_desc":"<optional: why this task matters / what it covers|null>","claim_task":"<id|null>","contextPct":40'
-        +(formalOn()?(',"formal":{"target":"<对象 id>","decision":"used|blocked","file":"Formal/<对象 id>.lean","note":"难度判断/阻塞原因"}'):'')
+        +(formalOn()?(',"formal":{"target":"<对象 id>","decision":"used|blocked|defect","file":"Formal/<对象 id>.lean","note":"难度判断/阻塞原因/具体偏差"}'):'')
         +'}'
     }
     function clearHeartbeat(){ if(heartbeatDisposer!==null){ try{ heartbeatDisposer() }catch(e){} heartbeatDisposer=null } }

package/vibe-math-v4//345/256/236/347/216/260/346/226/271/346/241/210.md

@@ -121,7 +121,7 @@ VibeMath/Projects/<project>/
 | **会议** | `vibe_v4_meeting(agenda)` → 向全体发会议 prompt → 收齐发言 → 写 `Shared/meetings/<id>.md` → 广播结论 | 会议用于分工/方向/任务分配/提出验证/表决"是否已解决" |
 | **任务板** | 常驻在会议/留言提议任务 → 框架记 `Shared/taskboard.md`；认领后被唤醒 | 框架只搬运，不决定谁做什么 |
 | **产物沉淀** | `vibe_v4_publish_progress` / `record_proposition` / `record_method` / `record_subproblem` | **必填**：价值程度 / 动机用途计划 / 自身概率估计（框架校验，缺则提示） |
-| **共识验证** | `vibe_v4_propose_verify(targetId)` → 常驻们同意后开辩论 | 独立初评→公开辩论→**全票真/假才入 Verified/**；否则留库附概率 |
+| **共识验证** | 回执字段 `propose_verify: "<id>"`（常规/心跳轮与会议发言都会读取；v4 **没有** `vibe_v4_propose_verify` 这个工具）→ 框架按 FIFO 排队 → 全体独立初评→公开辩论 | 独立初评→公开辩论→**全票真/假才入 Verified/**；否则留库附概率 |
 | **Lean 形式化验证** | `vibe_v4_lean_run` / `vibe_v4_lean_archive` / `vibe_v4_lean_lib` + `formalVerify` 三档开关 | 见 §31；`passed` 后表决对象从"推导是否正确"变成**忠实性**；`require` 档在收口点加门禁 |
 | **停止条件** | 会议中全体常驻对"原问题已解决"投票，**全部同意** → 停止唤醒 | 人工 `abort` 始终可用 |
 | **上下文/compact** | 监测每常驻上下文占比 ≥ 阈值 → 触发 DSH `/compact` | `compactThreshold` 默认 66，可调 |
@@ -793,12 +793,17 @@ else await closeVerify(vs,allTrue)
 | `LEAN_NOT_FOUND` | `resolveExecutable(leanCommand)` 失败（工具链未安装 → 优雅降级） |
 | `LEAN_SPAWN_FAILED` | `spawn` 本身抛错 |
 | `LEAN_RUN_FAILED` | `await handle.done` 抛错 |
-| `LEAN_TIMEOUT` | 非零退出且耗时达到 `graceMs`（超时上限） |
+| `LEAN_TIMEOUT` | 到 `graceMs` 还没跑完：框架自己起一个 `cap` 计时器，到点**主动调用 `handle.terminate()`** 并返回合成结果（契约 §7；不再只依赖宿主的 `graceMs`）。宿主先于本计时器杀进程时，用"非零退出且耗时达到 `cap`"兜底 |
 | `LEAN_FAILED` | 其它非零退出（编译器输出原样返回 ~4KB 尾巴） |
 | `V4_INVALID_ARGUMENT` | 缺 `file`/`kind`/`name`/`target`/`note`；非 `.lean`；越界路径；未知 `kind` |
 | `V4_NOT_FOUND` | `.lean` 文件不存在（越界被拒 ≠ 不存在：两者码不同） |
 | `V4_WRITE_FAILED` | 目标路径写不进去 |
 
+**超时是主动的**：`leanRunFile` 用 `Promise.race([handle.done, ctx.timeout(cap)])`，计时器一响就
+`terminate()`；`done` 先赢则清掉该计时器（插件 runtime 没有全局 `setTimeout`，只能用 `timer` 服务）。
+**唯一可删文件的路径**（§4.1 撤回归档证明）：删除 → **用 `fs` 复核文件真的没了** → 还在就**覆盖为
+撤回说明**（`-- 已撤回（…）`），并把实际走的那条路（`deleted`/`overwritten`/`failed`）写进活动日志。
+
 **绝不抛异常到调度循环**：`leanRunFile` 把每一种失败都变成可读结果；`onResidentEnd` 里的
 `applyFormalReply` 整体包在 try/catch 内（回执处理失败只记 `activityLog`，不影响本轮结算）。
 
@@ -867,6 +872,53 @@ Lean 这一批改动同时做了一次**静态提示词面**审计（`audit-pers
 三处已补入 persona 的 `prefix` 与 `text` **两个块**，并由 `audit-persona-surface.test.mjs`
 （双向一致性 + 未文档化工具显式快照 + `prefix`/`text` 逐行一致）长期守护。
 
+### 31.13 忠实性缺陷 `defect`：形式化写错了 ≠ 命题为假（2.3.1）
+
+首版提示词写的是"一致 → 1；发现任何偏离 → 0"。这条指令有一个致命后果：Lean 代码写的不是命题
+想说的（写窄了/写宽了/换了对象/漏了条件）时，投票 0 的含义是"**该命题为假**"——框架会把
+"形式化不合格"记成"命题被证伪"，甚至在 v4 的**全组一致**规则下把命题写进 `Verified/` 标注**假**。
+用来求真的机制反而**伪造出一个错误的否定结论**。
+
+按契约 §4.1 改为独立的 `defect` 档：
+
+- **表决者**：不得投 1 或 0；给一个严格介于 0 与 1 之间的值（记为弃权）并在 `reason` 里写清偏差，
+  同时用回执 `formal:{decision:'defect', note:'<具体偏差>'}` 记录（`note` 必填，缺则 `V4_INVALID_ARGUMENT`）。
+- **框架**：把该对象**降级为 `attempted`**（无论此前是 `passed` 还是 `blocked`）、清空 `proof`、
+  撤回归档证明 `Verified/Lean/<id>.lean`（**删除 → 用 `fs` 复核真的没了 → 还在就覆盖为"已撤回"说明**，
+  见 §31.14）、`note` 记入记录与 `Formal/TODO.md`、活动日志公告。
+- **`require` 档**：降级后 `formalGateOk` 为假 → 本次裁定**不定论**（`deferForFormal`），
+  对象进「形式化待办」，修正形式化并重新跑通后再投票。**`encourage` 档不得声称这一点**（没有门禁，
+  框架撤不回表决）：注入文本与活动日志都按档位分岔，说明"本档没有门禁：请务必给弃权值"。
+- **只有独立于这份 Lean 代码也能确定命题为假**时才投 0，并在 `reason` 里写清独立理由。
+
+同批补齐的提示词硬要求（契约 §6）：注入文本里的工具名**一律全称**（`vibe_v4_lean_*`；缩写
+`lean_archive` 不是注册名，连活动日志行也不例外）；归档可复用定义/引理**前先跑通**（`run=true` 或先 `vibe_v4_lean_run`），
+跑不通不许进 `Formal/Lib`/`Proved`；**工具链不可用**时把代码归档并在 `note`
+写明"宿主无 Lean 工具链"——**两个错误码都写出来**（`LEAN_NOT_FOUND`：没有 Lean 可执行文件；
+`NO_SUBPROCESS`：宿主根本不提供 `subprocess` 服务），两者都算显式阻塞原因，门禁据此放行，
+不会因为装不了 Lean 而卡死。
+
+**测试**：`formal-verify-v4.test.mjs` 增至 **262 条断言**（含 `defect` 端到端：降级 + 撤回归档证明 +
+进待办 + `require` 档不定论 + 缺 `note` 被拒；注入文本不得出现缩写工具名、不得出现"偏离 → 0"），
+并新增随包发布的人工复核语料 `prompt-corpus-v4/formal-verify-v4.{json,md}`
+（覆盖 off 无 Lean 文字、encourage、**require**、passed 忠实性分支（require/encourage 两种措辞各一份）、
+平时工作轮、回执契约；工作区路径归一化为 `<WS>`、VibeMath 根为 `<VIBEMATH>`，可 diff、无本机路径）。
+
+### 31.14 深审计轮修复（本轮）
+
+逐条对着共同契约复审后修掉的问题（每条都有断言，见 §31.10 的测试表）：
+
+| 问题 | 症状 | 修复 |
+|---|---|---|
+| **`lean_run` 把 `passed` 降级** | `formalSetRun` 硬编码 `status:'attempted'`（注释却写着"`passed`/`blocked` 不被红运行降级"，v2/v5 也是保留语义）：运行中任何一次 `vibe_v4_lean_run {target}` 都会把已通过的记录打回 `attempted` 而 `proof` 指针留着——下一轮表决提示词因此丢掉**忠实性分支**，`require` 档还会对一份已跑绿的归档证明**重新关门禁** | `status: prev.status==='passed'?'passed':(prev.status==='blocked'?'blocked':'attempted')`；断言"红重跑不降级" |
+| **`off` 模式仍写 `State/formal.json`** | `saveAll()` 无条件落这份状态文件：一个从未用过该功能的 run 也会留下 Lean 状态文件（v3 的守卫是 `formalOn()||有记录`） | 仅当 `formalOn()||formalPersisted||有记录/待办` 才写；`formalPersisted` 保证 `start()` 的清零**真的落盘**（否则 resume 会恢复陈旧 `passed`），纯 `off` 会话不产生该文件 |
+| **超时不主动终止** | 只靠宿主的 `graceMs`，从不调 `handle.terminate()`（契约 §7 明写要求），宿主的宽限失效时 Lean 进程会残留 | `Promise.race([handle.done, ctx.timeout(cap)])`，到点 `terminate()` 并返回 `LEAN_TIMEOUT`；`done` 先赢则清掉计时器（插件 runtime 无全局 `setTimeout`，只能用 `timer` 服务） |
+| **撤回归档证明只是"尽力删除"** | 删除失败（无 `subprocess`／shell 假成功／权限）时，被撤回的证明仍停在 `Verified/Lean/<id>.lean`——所有人找"这条结论的证明"的地方；记录却已降级 | 删除 → **用 `fs` 复核文件真的没了** → 还在就**覆盖为 `-- 已撤回（…）` 说明**；返回并播报实际走的那条路（`deleted`/`overwritten`/`failed`） |
+| **`encourage` 档承诺"不定论"** | 忠实性分支与活动日志都无条件写"本次裁定**不定论**"，但只有 `require` 有门禁——这是在承诺框架没有的行为（契约 §4.1-3/§6.1；v5 已分岔） | 按档位分岔：`require` 保留"不定论"；`encourage` 改为"本档没有门禁：请务必给弃权值，以保证本轮无法得出一致结论" |
+| **注入文本只写 `LEAN_NOT_FOUND`** | `NO_SUBPROCESS`（宿主没有 `subprocess` 服务）这条出路没写进提示词，代理会反复重试而不是记阻塞（契约 §6 硬要求 4；v3/v5 都写了两个码） | 同一句话里补上两个码，并断言该句在插件里只出现一份（不按档位复制） |
+| **活动日志里用缩写工具名** | `'… lean_run …'`（不是注册名；host 会把活动日志念给团队） | 改为 `vibe_v4_lean_run`；注入文本扫描面扩到 `State/session.json` 的 `activityLog` |
+| **`实现方案.md` 写了不存在的工具** | §5 表格里的 `vibe_v4_propose_verify(targetId)` 从未注册（验证对象靠回执字段 `propose_verify`），照着文档找工具会扑空 | 表格改回真实机制（回执字段 → FIFO 排队） |
+
 
 
 

package/vibe-math-v5/agent.cordis.yml

@@ -109,7 +109,9 @@
           reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.
         - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well
           (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is
-          reported as LEAN_NOT_FOUND and still lets the code be written and archived.
+          reported as LEAN_NOT_FOUND, a host with no subprocess service as NO_SUBPROCESS
+          (on a timeout the process is terminated first), and in every one of those cases the
+          code can still be written down and archived.
         - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the
           formalization TODO. The framework never installs Lean and never judges fidelity.
 
@@ -201,7 +203,9 @@
           reusable definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.
         - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs are tunable as well
           (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is
-          reported as LEAN_NOT_FOUND and still lets the code be written and archived.
+          reported as LEAN_NOT_FOUND, a host with no subprocess service as NO_SUBPROCESS
+          (on a timeout the process is terminated first), and in every one of those cases the
+          code can still be written down and archived.
         - vibe_v5_status / vibe_v5_report show the mode, per-object formal status and the
           formalization TODO. The framework never installs Lean and never judges fidelity.