dsh-vibe-math 2.3.1 → 2.3.3

package/formal-verify-v4.test.mjs

@@ -60,7 +60,16 @@ const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '')
 // MOCK HOST — the shape selfdrive-v4 / e2e-v4-fixes use, plus a fake Lean
 // ===============================================================
 let toolchainAvailable = true
+// A host that exposes NO `subprocess` service at all (docs §7 → NO_SUBPROCESS, and §6 hard rule 4
+// requires the injected guidance to name that code so the resident records a blocker instead of
+// retrying forever).
+let subprocessAvailable = true
+// A stub host whose shell EXITS 0 WITHOUT deleting anything (a permissions quirk / a stub host).
+// Used by §13 to prove the withdrawal is not a best-effort delete: the framework must confirm the
+// file is gone through the fs service and fall back to overwriting it with a withdrawal notice.
+let shellDeletesFiles = true
 const leanRuns = []          // every spawn the framework made, for cwd/argv assertions
+const terminated = []        // files whose handle the framework actively terminate()d (docs §7)
 const shellCalls = []        // every platform-shell script (mkdir at mount, Remove-Item on defect)
 
 function makeSubprocess() {
@@ -81,8 +90,8 @@ function makeSubprocess() {
         const script = String(spec.argv[spec.argv.length - 1] || '')
         shellCalls.push(script)
         const m = script.match(/-LiteralPath\s+'((?:[^']|'')*)'/)
-        if (/Remove-Item/.test(script) && m) rmSync(m[1].replace(/''/g, "'"), { force: true })
-        if (/^rm -f /.test(script)) for (const q of script.slice(6).match(/'[^']*'/g) || []) rmSync(q.slice(1, -1), { force: true })
+        if (shellDeletesFiles && /Remove-Item/.test(script) && m) rmSync(m[1].replace(/''/g, "'"), { force: true })
+        if (shellDeletesFiles && /^rm -f /.test(script)) for (const q of script.slice(6).match(/'[^']*'/g) || []) rmSync(q.slice(1, -1), { force: true })
         return {
           done: Promise.resolve({ exitCode: 0, signal: null }),
           collected: { stdout: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) }, stderr: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) } },
@@ -96,6 +105,16 @@ function makeSubprocess() {
       const text = existsSync(file) ? readFileSync(file, 'utf8') : ''
       const bad = /sorry|-- FAIL/.test(text)
       leanRuns.push({ argv: spec.argv.slice(), file, cwd: spec.cwd, graceMs: spec.graceMs, stdio: spec.stdio })
+      // A HANG file never settles and never exits: the ONLY thing that can end it is the framework's
+      // own timeout calling handle.terminate() (docs §7). Records each terminate so the suite can
+      // assert the timeout path is ACTIVE, not merely reported.
+      if (/-- HANG/.test(text)) {
+        return {
+          done: new Promise(() => {}),
+          collected: { stdout: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) }, stderr: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) } },
+          terminate() { terminated.push(file) },
+        }
+      }
       const stdout = bad ? '' : 'ok\n'
       const stderr = bad ? 'error: declaration uses sorry\n' : ''
       return {
@@ -116,7 +135,7 @@ function makeHost() {
   const subprocess = makeSubprocess()
   let ROOT
   const ctx = {
-    get(name) { return name === 'subprocess' ? subprocess : undefined },
+    get(name) { return name === 'subprocess' && subprocessAvailable ? subprocess : undefined },
     on(e, fn) { (listeners[e] = listeners[e] || []).push(fn) },
     effect(fn) { const d = fn(); return () => { if (typeof d === 'function') d() } },
     logger: { info() {}, warn() {}, error() {} },
@@ -273,6 +292,9 @@ const A = await establish()
   assert(!/Lean/.test(all), 'no founding/round prompt mentions Lean in off mode')
   assert(!/顺手形式化|Lean 通过|忠实性审查|vibe_v4_lean/.test(all), 'no founding/round prompt carries any Lean-formalization text in off mode')
   assert(all.length > 0, 'sanity: the scan actually saw the founding prompts')
+  // `off` must not CREATE Lean state at all: the feature's durable record file must not appear
+  // for a session that never used the feature (v3's suite pins the same invariant).
+  assert(!existsSync(join(A.projectRoot, 'State', 'formal.json')), '★ off mode creates NO State/formal.json (a TRUE no-op, not just an empty record store)')
 }
 // an off-mode verification must behave exactly as before: unanimous 真 → Verified/, no formal record
 const offSettled = await proposeAndVote(A, 'p-off', {
@@ -289,6 +311,39 @@ assert(!/顺手形式化/.test(await A.prompts('normal', 'r-1')), 'the work prom
 assert(['vibe_v4_lean_run', 'vibe_v4_lean_archive', 'vibe_v4_lean_lib'].every(n => !!A.toolRegs.find(t => t.name === n)),
   'the three Lean tools are registered in every mode (registration is static)')
 
+// ★ The mode switch must be REACHABLE THROUGH THE TOOL SCHEMA (2.3.2 defect D1) ──────────────
+// Every tool schema here is closed (`additionalProperties:false`), so a key the schema does not
+// advertise is REJECTED by any schema-validating provider. v3 shipped 2.3.0/2.3.1 with all four Lean
+// parameters missing from the set-params schema while every assertion in this file stayed green —
+// because the suite calls the handler DIRECTLY and never inspects the registered schema. The feature
+// could not be switched on at all through the tool interface.
+{
+  const setSpec = A.toolRegs.find((t) => t.name === 'vibe_v4_set')
+  assert(!!setSpec, "vibe_v4_set is registered")
+  assert(setSpec.parameters && setSpec.parameters.type === 'object' && setSpec.parameters.additionalProperties === false,
+    '★ vibe_v4_set publishes a CLOSED object schema (an unlisted key is rejected, so the schema IS the contract)')
+  for (const k of ['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs']) {
+    assert(Object.prototype.hasOwnProperty.call(setSpec.parameters.properties, k),
+      '★ the registered schema advertises ' + k + ' (every other surface documents it; a schema that omits it makes the switch unreachable)')
+  }
+  assert(JSON.stringify(setSpec.parameters.properties.formalVerify.enum) === JSON.stringify(['off', 'encourage', 'require']),
+    'the schema narrows formalVerify to the three real modes (a typo must not be a fourth)')
+}
+
+// A stray `formal` reply in OFF mode must be INERT (finding #1): the reply contract does not offer
+// the field there, so honouring it would contradict "off is a TRUE no-op". The TOOLS stay usable.
+{
+  await A.callTool('vibe_v4_record_proposition', { id: 'p-offreply', title: 'off', statement: '关模式下注入回执', prob: 0.8, value: 0.6, motivation: 'm' }, A.resAgent(A.childOf('r-1')))
+  const wOffR = await workWake(A, 'r-1')
+  A.fireEnd(wOffR.childId, { summary: '继续。', solved: false, contextPct: 20, formal: { target: 'p-offreply', decision: 'defect', note: '不应被记录' } })
+  await sleep(80)
+  const stOffReply = await A.callTool('vibe_v4_status', {})
+  assert(stOffReply.formal.objects.length === 0, '★ a stray `formal` reply in off mode records NO formal object')
+  assert(!existsSync(join(A.projectRoot, 'Formal', 'p-offreply.lean')), '★ and writes no formal working file')
+  assert(!existsSync(join(A.projectRoot, 'Formal', 'TODO.md')) || !/p-offreply/.test(readIf(join(A.projectRoot, 'Formal', 'TODO.md'))), '★ and creates no TODO entry')
+  assert(!existsSync(join(A.projectRoot, 'State', 'formal.json')), '★ and still no State/formal.json after the stray reply (the off-mode guard is a true no-op)')
+}
+
 // ---------- 2. parameter validation + runtime switching ----------
 section('2 parameter validation and runtime switching')
 const B = await establish()
@@ -401,6 +456,31 @@ assert(noTc.ok === false && noTc.code === 'LEAN_NOT_FOUND', '★ a missing toolc
 assert(/仍可把形式化代码写下来归档/.test(noTc.message || ''), 'the failure explains the graceful degradation')
 assert((await D.callTool('vibe_v4_status', {})).ok === true, 'the group did NOT crash on the missing toolchain (status still answers)')
 toolchainAvailable = true
+// No `subprocess` service at all (docs §7): the run must degrade to a typed NO_SUBPROCESS result —
+// never a thrown error into the scheduler — and an object it was asked to record must stay
+// `attempted` (an un-runnable host must not mint a `passed` record).
+{
+  subprocessAvailable = false
+  const noSub = await D.callTool('vibe_v4_lean_run', { file: 'Formal/good.lean', target: 'p-nosub' }, r1)
+  assert(noSub.ok === false && noSub.code === 'NO_SUBPROCESS', '★ a host with no subprocess service returns NO_SUBPROCESS instead of crashing (got ' + noSub.code + ')')
+  assert(/no subprocess service/.test(String(noSub.message || '')), 'the failure is readable (it explains that Lean cannot be executed here)')
+  const stNoSub = await D.callTool('vibe_v4_status', {})
+  assert(stNoSub.ok === true, 'the group did NOT crash on the missing service (status still answers)')
+  const recNoSub = stNoSub.formal.objects.find((o) => o.target === 'p-nosub')
+  assert(recNoSub && recNoSub.status === 'attempted' && !recNoSub.proof, '★ the object record stays honest: attempted (never passed) when nothing could be executed')
+  subprocessAvailable = true
+}
+// A run that never finishes: the framework must ACTIVELY terminate it (docs §7) and still report a
+// readable LEAN_TIMEOUT — relying on the host's own graceMs alone leaves the Lean process running.
+{
+  writeFileSync(join(D.projectRoot, 'Formal', 'hang.lean'), '-- HANG\ntheorem t : 1 = 1 := rfl\n', 'utf8')
+  const t0 = Date.now()
+  const runHang = await D.callTool('vibe_v4_lean_run', { file: 'Formal/hang.lean', timeout_ms: 1000 }, r1)
+  const waited = Date.now() - t0
+  assert(runHang.ok === false && runHang.code === 'LEAN_TIMEOUT' && runHang.timedOut === true, '★ a run that never finishes is reported as LEAN_TIMEOUT (got ' + runHang.code + ')')
+  assert(terminated.some(f => /hang\.lean$/.test(String(f))), '★ the timeout path really calls handle.terminate() (docs §7) instead of leaving the Lean process running')
+  assert(waited >= 900 && waited < 15000, 'the timeout waited for the cap before terminating (' + waited + 'ms)')
+}
 
 // ---------- 5. a passing proof flips the review subject to fidelity ----------
 section('5 a passing proof flips the review subject to fidelity')
@@ -414,6 +494,18 @@ const stD = await D.callTool('vibe_v4_status', {})
 assert(stD.formal.passed.indexOf('p-proof') !== -1, 'status reports the object as Lean-passed')
 const idxD = readIf(join(D.projectRoot, 'Formal', 'Index.md'))
 assert(/p-proof/.test(idxD) && /passed/.test(idxD) && /Verified\/Lean\/p-proof\.lean/.test(idxD), 'Formal/Index.md indexes the object, its status and its archived proof')
+// A later run recorded against an ALREADY-passed object records the run but must never strip
+// `passed`/`proof`: doing so would silently remove the fidelity branch from the next voting prompt
+// AND (in `require`) re-close the gate on an object that already has a green archived proof.
+{
+  writeFileSync(join(D.projectRoot, 'Formal', 'p-proof.lean'), 'theorem p_proof : 1 = 2 := by sorry\n', 'utf8')
+  const rerun = await D.callTool('vibe_v4_lean_run', { file: 'Formal/p-proof.lean', target: 'p-proof' }, r1)
+  assert(rerun.ok === false, 'precondition: the recorded re-run is red')
+  const rec = (await D.callTool('vibe_v4_status', {})).formal.objects.find(o => o.target === 'p-proof')
+  assert(rec && rec.status === 'passed' && rec.proof === 'Verified/Lean/p-proof.lean',
+    '★ a RED re-run never downgrades a `passed` record (docs §31.6: only an explicit re-archive decides) — the object keeps its fidelity prompt and its require-mode gate')
+  writeFileSync(join(D.projectRoot, 'Formal', 'p-proof.lean'), 'theorem p_proof : 3 * 1 ^ 2 - 2 = (1:Nat) ^ 2 := by decide\n', 'utf8')
+}
 // a RED proof must NOT mint a Verified/Lean/ copy or mark the object passed
 const arcRed = await D.callTool('vibe_v4_lean_archive', { kind: 'proof', target: 'p-red', content: 'theorem p_red : 1 = 2 := by sorry\n' }, r1)
 assert(arcRed.ok === true && arcRed.passed === false && arcRed.status === 'attempted', 'a red proof is archived as attempted, not passed')
@@ -639,7 +731,7 @@ await G.callTool('vibe_v4_set', { formalVerify: 'encourage' })
   assert(/实现难度/.test(enc), 'it still asks for the implementation-difficulty judgement')
   assert(/工具：vibe_v4_lean_run（执行）· vibe_v4_lean_archive（归档）· vibe_v4_lean_lib（查已有可复用库）/.test(enc), 'it names all three tools in FULL')
   assert(/归档可复用定义\/引理前先跑通（vibe_v4_lean_archive run=true 或先 vibe_v4_lean_run）；跑不通不要入库。/.test(enc), '★ a reusable definition/lemma must be RUN GREEN before it is archived')
-  assert(/宿主没有 Lean 工具链（LEAN_NOT_FOUND）时：把代码写下来归档，并在回执的 note 里写明"宿主无 Lean 工具链"/.test(enc), '★ the missing-toolchain path is written out (archive the code, record it as an explicit blocker)')
+  assert(/宿主没有 Lean 工具链（LEAN_NOT_FOUND）或根本没有 subprocess 服务（NO_SUBPROCESS）时：把代码写下来归档，并在回执的 note 里写明"宿主无 Lean 工具链"/.test(enc), '★ both unavailable-toolchain paths are written out (missing Lean OR no subprocess service) as explicit blocker reasons')
   assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(enc), 'a green Lean run still shrinks the open question to fidelity')
   assert(/decision='blocked' 时必须写明 note/.test(enc), 'the encourage opt-out documents the mandatory note')
   assert(!/偏离 → 0/.test(enc) && !/发现任何偏离/.test(enc), '★ no "deviation ⇒ 0" instruction anywhere in the encourage block')
@@ -650,6 +742,15 @@ await G.callTool('vibe_v4_set', { formalVerify: 'encourage' })
   assert(/本次裁定不会生效/.test(req) && /进入「形式化待办」/.test(req), 'it warns the verdict is withheld as 未定论 (formal-required)')
   assert(!/可以不做/.test(req), "'require' does NOT offer the encourage-mode opt-out")
   assert(/归档可复用定义\/引理前先跑通/.test(req) && /宿主没有 Lean 工具链/.test(req), 'the run-before-archive and toolchain rules are in the require text as well')
+  assert(/LEAN_NOT_FOUND/.test(req) && /NO_SUBPROCESS/.test(req), '★ the require text names BOTH unavailable-toolchain codes (the escape route must be documented in every mode)')
+  // The sentence is written ONCE and reused by both modes: a second copy would drift (one branch
+  // kept up to date, the other stale). The anchor `（LEAN_NOT_FOUND）` therefore occurs exactly once
+  // in the plugin, which is also what the sensitivity probe table assumes.
+  {
+    const src = readFileSync(fileURLToPath(PLUGIN), 'utf8')
+    assert(src.split('（LEAN_NOT_FOUND）').length - 1 === 1, '★ the unavailable-toolchain guidance is written once (not duplicated per mode/branch)')
+    assert(src.split('（NO_SUBPROCESS）').length - 1 === 1, 'the same single sentence names NO_SUBPROCESS (no per-branch copy)')
+  }
   assert(/\*\*本模式要求\*\*/.test(req), 'the require bullet replaces the encourage opt-out in place')
   // normal / heartbeat / post-compact recap all carry the standing work line; the two that ARE a
   // reply contract also document the `defect` decision (coreRules is a recap prefix, not a contract)
@@ -680,12 +781,36 @@ await G.callTool('vibe_v4_set', { formalVerify: 'encourage' })
   addText('LEAN_NOT_FOUND message', (await G.callTool('vibe_v4_lean_run', { file: 'Formal/p-hint.lean' }, r1G)).message)
   toolchainAvailable = true
   for (const t of G.toolRegs.filter((x) => /lean/.test(x.name))) addText('tool description ' + t.name, t.description)
+  // The activity log is agent/host-readable text too (vibe_v4_report exposes `recentActivity`, and
+  // a host reads it out to the group): a bare abbreviation there names a tool that does not exist,
+  // for exactly the same reason as in a prompt.
+  try {
+    const log = JSON.parse(readIf(join(G.projectRoot, 'State', 'session.json')) || '{}').activityLog || []
+    for (const e of log) addText('activity log: ' + e.event, String((e && e.detail) || ''))
+  } catch (e) { /* the log is best-effort */ }
   const bare = [/(^|[^a-z_])lean_run/, /(^|[^a-z_])lean_archive/, /(^|[^a-z_])lean_lib/]
   const offenders = []
   for (const s of scanned) for (const re of bare) if (re.test(s.text)) offenders.push(s.label + ' :: ' + re.source)
   assert(offenders.length === 0, '★ no injected text (prompt, tool hint or tool description) uses a bare tool abbreviation (' + offenders.slice(0, 3).join(' | ') + ')')
   assert(scanned.length >= 15, 'the sweep really covered the injected-text surface (' + scanned.length + ' texts)')
 }
+{
+  // docs §4.1-3 / §6.1: the fidelity branch's "the framework withholds the verdict" clause may only
+  // appear in `require` (the only mode with a gate). In `encourage` the framework still withdraws
+  // the proof and records the TODO, but it CANNOT hold the ballot — so the text must not promise
+  // that, and must instead point at the voter's own abstention.
+  await G.callTool('vibe_v4_set', { formalVerify: 'require' })
+  const reqFid = await G.prompts('verify', 'r-1', { target: 'p-hint', stage: 'independent' })
+  assert(/该对象已有\*\*通过的 Lean 形式化证明\*\*/.test(reqFid), 'precondition: p-hint is the passed/fidelity case in this prompt')
+  assert(/本次裁定\*\*不定论\*\*/.test(reqFid), "'require' fidelity text states the verdict will be withheld (it has a gate)")
+  await G.callTool('vibe_v4_set', { formalVerify: 'encourage' })
+  const encFid = await G.prompts('verify', 'r-1', { target: 'p-hint', stage: 'independent' })
+  assert(!/本次裁定\*\*不定论\*\*/.test(encFid), "★ 'encourage' does NOT promise a hold it cannot enforce (docs §4.1-3)")
+  assert(/本档没有门禁/.test(encFid) && /弃权值/.test(encFid), "★ instead it says the voter's own abstention is what keeps the ballot from concluding")
+  assert(/降级为 attempted、删除归档证明、写入形式化待办/.test(encFid), 'the withdrawal the framework CAN enforce is still stated in both modes')
+  assert(/发现任何偏差，不要投 0/.test(encFid), 'the fidelity rule itself is mode-independent')
+  await G.callTool('vibe_v4_set', { formalVerify: 'require' })
+}
 
 // ===============================================================
 // 13. the `defect` reply channel (docs §4.1 / §10 item 8) — BEHAVIOURAL, not wording
@@ -716,6 +841,31 @@ const g1 = G.resAgent(G.childOf('r-1'))
   assert(/\| p-defect \| attempted \|/.test(idx), 'Formal/Index.md downgrades the object to attempted')
   assert(/只证了 n ≥ 1 的情形/.test(idx), 'the deviation is the record note in the index')
   assert(activityOf(G).some((e) => /忠实性缺陷/.test(e.detail) && /p-defect/.test(e.detail)), '★ the retraction is announced in the activity log')
+  // the log line is agent/host-readable text, so it is bound by the same §4.1-3 rule as the prompt:
+  // in `encourage` it may not claim a hold the mode does not have.
+  {
+    const line = activityOf(G).filter((e) => /忠实性缺陷/.test(e.detail) && /p-defect[^-]/.test(e.detail)).pop() || { detail: '' }
+    assert(/本档没有门禁/.test(line.detail) && !/本次裁定\*\*不定论\*\*/.test(line.detail), "★ the encourage-mode activity line does not promise the 不定论 hold that only `require` enforces")
+  }
+}
+{
+  // §4.1 degraded withdrawal: the record must never be the ONLY thing withdrawn. A host whose shell
+  // "succeeds" without deleting (a stub host / a permissions quirk) must be caught by re-reading the
+  // file through the fs service, and the archive must then be OVERWRITTEN with a withdrawal notice —
+  // otherwise the retracted proof keeps sitting at the exact path everyone looks for the proof.
+  const arcD = await G.callTool('vibe_v4_lean_archive', { kind: 'proof', target: 'p-defect-degraded', content: 'theorem p_defect_degraded : 5 = 5 := rfl\n' }, g1)
+  assert(arcD.passed === true && existsSync(join(G.projectRoot, 'Verified', 'Lean', 'p-defect-degraded.lean')), 'precondition: the degraded-path object has a green archived proof')
+  shellDeletesFiles = false
+  const wD = await workWake(G, 'r-1')
+  G.fireEnd(wD.childId, { summary: '核对后发现偏差。', formal: { target: 'p-defect-degraded', decision: 'defect', note: '结论方向相反' }, contextPct: 20 })
+  await sleep(90)
+  shellDeletesFiles = true
+  const body = readIf(join(G.projectRoot, 'Verified', 'Lean', 'p-defect-degraded.lean'))
+  assert(!/p_defect_degraded/.test(body), '★ a shell that exits 0 without deleting does NOT leave the retracted proof readable — its original text is gone')
+  assert(/已撤回/.test(body) && /原代码保留在工作文件/.test(body), '★ the archived file was OVERWRITTEN with an explicit withdrawal notice instead (delete → confirm → overwrite)')
+  const recD = (await G.callTool('vibe_v4_status', {})).formal.objects.find((o) => o.target === 'p-defect-degraded')
+  assert(recD && recD.status === 'attempted' && recD.proof === '', 'the record is downgraded on the degraded path too')
+  assert(activityOf(G).some((e) => /覆盖归档证明/.test(e.detail) && /p-defect-degraded/.test(e.detail)), '★ the activity log says WHICH withdrawal path was taken (overwritten, not silently reported as deleted)')
 }
 {
   const arc2 = await G.callTool('vibe_v4_lean_archive', { kind: 'proof', target: 'p-defect2', content: 'theorem p_defect2 : 3 + 3 = 6 := by decide\n' }, g1)
@@ -745,6 +895,27 @@ const g1 = G.resAgent(G.childOf('r-1'))
 // ===============================================================
 // 14. `require` after a defect: the retraction closes the gate (docs §4.1-3 / §10 item 9)
 // ===============================================================
+// 13b. a plain `used` judgement must NOT withdraw an ESTABLISHED proof (contract §4): only a
+// fidelity defect retracts one. v2 shipped the unconditional downgrade and silently re-closed the gate.
+section('13b a \`used\` reply must NOT downgrade an already-passed object')
+{
+  const arcU = await G.callTool('vibe_v4_lean_archive', { kind: 'proof', target: 'p-usedkeep', content: 'theorem p_usedkeep : 2 + 2 = 4 := by decide\n' }, g1)
+  assert(arcU.passed === true && existsSync(join(G.projectRoot, 'Verified', 'Lean', 'p-usedkeep.lean')), 'used-keep: the object starts with a green archived proof')
+  const wU = await workWake(G, 'r-1')
+  G.fireEnd(wU.childId, { summary: '这一轮只是又写了一遍草稿。', formal: { target: 'p-usedkeep', decision: 'used', file: 'Formal/p-usedkeep.lean' }, contextPct: 20 })
+  await sleep(90)
+  const stU = await G.callTool('vibe_v4_status', {})
+  const recU = stU.formal.objects.find((o) => o.target === 'p-usedkeep')
+  assert(!!recU && recU.status === 'passed', '★ a `used` reply does NOT downgrade an already-passed object (got ' + JSON.stringify(recU) + ')')
+  assert(!!recU && recU.proof === 'Verified/Lean/p-usedkeep.lean', '★ and the proof pointer survives the reply')
+  assert(existsSync(join(G.projectRoot, 'Verified', 'Lean', 'p-usedkeep.lean')), '★ and the archived proof is still on disk')
+  assert(stU.formal.passed.indexOf('p-usedkeep') !== -1, '★ status still reports it as Lean-passed')
+  const rerunU = await G.callTool('vibe_v4_lean_run', { file: 'Formal/p-usedkeep.lean', target: 'p-usedkeep' }, g1)
+  assert(rerunU.ok === true, 'used-keep: the work file runs green')
+  const recU2 = (await G.callTool('vibe_v4_status', {})).formal.objects.find((o) => o.target === 'p-usedkeep')
+  assert(!!recU2 && recU2.status === 'passed', '★ a plain re-run does not downgrade a passed record (contract §4)')
+}
+
 section("14 'require' withholds the verdict after a defect, even on a unanimous 1")
 const H = await establish()
 await H.callTool('vibe_v4_set', { formalVerify: 'require' })
@@ -816,6 +987,12 @@ const K = await establish()
   await K.callTool('vibe_v4_lean_archive', { kind: 'proof', target: 'p-corpus-passed', content: 'theorem p_corpus_passed : 1 + 1 = 2 := by decide\n' }, k1)
   const fid = await K.prompts('verify', 'r-1', { target: 'p-corpus-passed', stage: 'independent' })
   add('verify', 'passed/fidelity', fid)
+  // (d2) the SAME passed object in `encourage`: the promise must shrink to what that mode enforces
+  // (docs §4.1-3: no gate there, so no claim that the framework withholds the verdict).
+  await K.callTool('vibe_v4_set', { formalVerify: 'encourage' })
+  const fidEnc = await K.prompts('verify', 'r-1', { target: 'p-corpus-passed', stage: 'independent' })
+  add('verify', 'passed/fidelity (encourage)', fidEnc)
+  await K.callTool('vibe_v4_set', { formalVerify: 'require' })
   // (e) a BLOCKED object
   await K.callTool('vibe_v4_lean_archive', { kind: 'blocked', target: 'p-corpus-blocked', note: '需要未形式化的解析数论框架' }, k1)
   add('verify', 'blocked/verify', await K.prompts('verify', 'r-1', { target: 'p-corpus-blocked', stage: 'independent' }))
@@ -845,7 +1022,8 @@ const K = await establish()
       '> 由 `formal-verify-v4.test.mjs` 落盘：非 `off` 模式下常驻**真正会读到**的 Lean 提示词原文',
       '> （`vibe_v4_prompts` 的只读回显 + 一条真实投递的工作轮 + 工具 `hint`）。',
       '> 工作区路径归一化为 `<WS>`，VibeMath 根归一化为 `<VIBEMATH>`：确定、可 diff、不含任何本机路径。', '',
-      '> 覆盖：`off`（无 Lean 文本）、`encourage`、**`require`**、对象 `passed` 后的**忠实性分支**、',
+      '> 覆盖：`off`（无 Lean 文本）、`encourage`、**`require`**、对象 `passed` 后的**忠实性分支**',
+      '> （`encourage` / `require` 两种措辞各一份：只有 `require` 会声称"不定论"）、',
       '> `blocked` 分支、平时工作轮的「顺手形式化」，以及回执契约里的 `formal` 字段。', '']
     for (let i = 0; i < corpus.length; i++) {
       const c = corpus[i]
@@ -865,6 +1043,9 @@ const K = await establish()
   assert(/【Lean 形式化验证（鼓励模式）】/.test(byLabel('encourage/verify').prompt), 'the corpus carries the encourage voting prompt')
   assert(/【Lean 形式化验证（强制模式）】/.test(byLabel('require/verify').prompt), '★ the corpus carries the REQUIRE voting prompt')
   assert(/不要投 0/.test(byLabel('passed/fidelity').prompt), '★ the corpus carries the passed/fidelity branch')
+  assert(/本次裁定\*\*不定论\*\*/.test(byLabel('passed/fidelity').prompt), 'the require fidelity entry keeps the hold it really enforces')
+  assert(!!byLabel('passed/fidelity (encourage)') && !/本次裁定\*\*不定论\*\*/.test(byLabel('passed/fidelity (encourage)').prompt)
+    && /本档没有门禁/.test(byLabel('passed/fidelity (encourage)').prompt), '★ the encourage fidelity entry does NOT promise the hold only require has (docs §4.1-3)')
   assert(/【顺手形式化（强制）】/.test(byLabel('require/normal').prompt), 'the corpus carries the ordinary work-round line')
   assert(/"decision":"used\|blocked\|defect"/.test(byLabel('formal reply contract (voting prompt)').prompt), '★ the corpus carries the `formal` reply contract line with decision=defect')
   assert(/【顺手形式化/.test(byLabel('require/real work wake').prompt), 'the corpus also keeps a prompt the framework REALLY delivered')
@@ -874,6 +1055,25 @@ const K = await establish()
   assert(corpus.every((c) => c.prompt && c.prompt.length > 20), 'every corpus entry carries real prompt text')
 }
 
+// ===============================================================
+// 16. a FRESH run must not inherit the previous run's formal records (docs §31.6): object ids are
+//     reused (p-*, r-1..), so the in-memory reset in `start()` has to REACH DISK even when the mode
+//     has been switched back to `off` — otherwise a later `resume` restores a stale `passed` and
+//     re-opens the require gate for an object of the new run. This is the exact hazard that makes
+//     the `off`-mode persistence guard ("do not create State/formal.json" ) non-trivial.
+// ===============================================================
+section('16 a fresh run clears the persisted formal records (even in off mode)')
+{
+  const stale = readIf(join(D.projectRoot, 'State', 'formal.json'))
+  assert(/"p-proof"/.test(stale), 'precondition: the previous run left formal records on disk')
+  await D.callTool('vibe_v4_set', { formalVerify: 'off' })
+  const beforeSpawns = D.spawns.length
+  const st = await D.callTool('vibe_v4_start', { problem: '新一轮：形式化清白起点', residentCount: 1 })
+  assert(st.ok === true && D.spawns.length > beforeSpawns, 'the fresh run actually started (so the clean-slate assertion is falsifiable)')
+  const now = readIf(join(D.projectRoot, 'State', 'formal.json'))
+  assert(!/"p-proof"/.test(now) && !/"passed"/.test(now), '★ a fresh run clears the persisted formal records on disk, even in off mode (no stale `passed` can open the new run’s gate)')
+}
+
 // ===============================================================
 console.log('')
 console.log('passed=' + passed + ' failed=' + failed)

package/formal-verify-v5.test.mjs

@@ -70,7 +70,17 @@ const leanRuns = []
 // This mirrors the one property that matters for the feature — an exit code that says
 // "the kernel accepted this".
 let toolchainAvailable = true
-const subprocess = {
+// A host with NO `subprocess` service at all: `ctx.get('subprocess')` returns undefined, which
+// must become a readable NO_SUBPROCESS result (and must NOT stop the code from being archived).
+let noSubprocess = false
+// A run that HANGS: `hangLean` makes the fake toolchain return a `done` that only settles
+// after `hangMs` (far beyond any cap the tests use), so the run can only be reported as a
+// timeout by actually racing `done` against a timer. `terminations` records every
+// `handle.terminate()` call, which is the observable proof that the guard fired.
+let hangLean = false
+let hangMs = 60000
+const terminations = []
+let subprocess = {
   async resolveExecutable(cmd) {
     if (!toolchainAvailable) throw new Error('spawn lean ENOENT')
     if (String(cmd) !== 'lean') throw new Error('unknown executable ' + cmd)
@@ -83,13 +93,16 @@ const subprocess = {
     leanRuns.push({ argv: spec.argv.slice(0, -1), file, cwd: spec.cwd })
     const stdout = bad ? '' : 'ok\n'
     const stderr = bad ? 'error: declaration uses sorry\n' : ''
+    const done = hangLean
+      ? new Promise(r => setTimeout(() => r({ exitCode: 0, signal: null }), hangMs))
+      : Promise.resolve({ exitCode: bad ? 1 : 0, signal: null })
     return {
-      done: Promise.resolve({ exitCode: bad ? 1 : 0, signal: null }),
+      done,
       collected: {
         stdout: { readFrom: () => ({ text: stdout, nextOffset: stdout.length, lossy: false }) },
         stderr: { readFrom: () => ({ text: stderr, nextOffset: stderr.length, lossy: false }) },
       },
-      terminate() {},
+      terminate() { terminations.push(file) },
     }
   },
 }
@@ -125,7 +138,7 @@ const ctx = {
     if (name === 'sessionProjections') return projections
     if (name === 'sandboxPolicy') return undefined
     if (name === 'compaction') return undefined
-    if (name === 'subprocess') return subprocess
+    if (name === 'subprocess') return noSubprocess ? undefined : subprocess
     return undefined
   },
   on(e, fn) { (listeners[e] = listeners[e] || []).push(fn) },
@@ -291,6 +304,41 @@ assert(!/形式化/.test(readIf(join(instRootOf(RA), 'Verified', '命题', 'p-of
 assert(!!toolRegs.find(t => t.name === 'vibe_v5_lean_run') && !!toolRegs.find(t => t.name === 'vibe_v5_lean_archive') && !!toolRegs.find(t => t.name === 'vibe_v5_lean_lib'),
   'the three Lean tools are registered in every mode (registration is static)')
 
+// ★ The mode switch must be REACHABLE THROUGH THE TOOL SCHEMA (2.3.2 defect D1) ──────────────
+// Every tool schema here is closed (`additionalProperties:false`), so a key the schema does not
+// advertise is REJECTED by any schema-validating provider. v3 shipped 2.3.0/2.3.1 with all four Lean
+// parameters missing from the set-params schema while every assertion in this file stayed green —
+// because the suite calls the handler DIRECTLY and never inspects the registered schema. The feature
+// could not be switched on at all through the tool interface.
+{
+  const setSpec = toolRegs.find((t) => t.name === 'vibe_v5_set')
+  assert(!!setSpec, "vibe_v5_set is registered")
+  assert(setSpec.parameters && setSpec.parameters.type === 'object' && setSpec.parameters.additionalProperties === false,
+    '★ vibe_v5_set publishes a CLOSED object schema (an unlisted key is rejected, so the schema IS the contract)')
+  for (const k of ['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs']) {
+    assert(Object.prototype.hasOwnProperty.call(setSpec.parameters.properties, k),
+      '★ the registered schema advertises ' + k + ' (every other surface documents it; a schema that omits it makes the switch unreachable)')
+  }
+  assert(JSON.stringify(setSpec.parameters.properties.formalVerify.enum) === JSON.stringify(['off', 'encourage', 'require']),
+    'the schema narrows formalVerify to the three real modes (a typo must not be a fourth)')
+}
+
+// A stray `formal` reply in OFF mode must be INERT: the field is not offered in the reply contract
+// there, and honouring it would create Formal/ state in a mode documented as a "TRUE no-op" (the
+// TOOLS stay usable on purpose — a tool call is deliberate, a stray reply field is not).
+{
+  const wOff = await wakeAndReply(RA, 'r-1', {
+    progress: '关模式下的普通回轮。',
+    formal: { target: 'p-off-stray', decision: 'blocked', note: '不应被记录' },
+    contextPct: 20,
+  })
+  assert(!!wOff, 'off mode: a wake carrying a stray formal reply was fed to the framework')
+  const stOff2 = await callTool('vibe_v5_status', {}, RA)
+  assert((stOff2.formal.objects || []).length === 0, '★ a stray `formal` reply in off mode records NO formal object')
+  assert((stOff2.formal.todo || []).length === 0, '★ and adds nothing to the formalization TODO')
+  assert(!/p-off-stray/.test(readIf(join(instRootOf(RA), 'Formal', 'TODO.md'))), '★ and writes no TODO entry for it')
+}
+
 // ---------- 2. parameter validation ----------
 section('2 parameter validation and runtime switching')
 const RB = makeRoot()
@@ -333,6 +381,7 @@ await settle(); delivered.length = 0; await drainWakes(3, RC)
   assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(vp), 'the voting prompt states that a passing Lean run shrinks the question to fidelity')
   assert(/归档可复用定义\/引理前先跑通/.test(vp), 'the voting prompt requires a GREEN RUN before archiving a reusable definition')
   assert(/LEAN_NOT_FOUND/.test(vp) && /宿主无 Lean 工具链/.test(vp), 'the voting prompt says what to do when the host has no Lean toolchain')
+  assert(/NO_SUBPROCESS/.test(vp), '§6 rule 4: the no-toolchain route names NO_SUBPROCESS too (an agent that only knows LEAN_NOT_FOUND treats a service-less host as an unknown failure and retries)')
   assert(noBareLeanTool(vp), 'no abbreviated tool name appears in the injected voting prompt')
   assert(/实现难度/.test(vp), 'the voting prompt asks for the implementation-difficulty judgement')
   assert(/可以不做，但请在回执的 formal 字段写明难度判断/.test(vp), "'encourage' explicitly allows skipping (with a recorded judgement)")
@@ -376,6 +425,42 @@ const runNoTc = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean' },
 assert(runNoTc.ok === false && runNoTc.code === 'LEAN_NOT_FOUND', 'a missing toolchain returns LEAN_NOT_FOUND instead of crashing')
 assert(/仍可把形式化代码写下来归档/.test(runNoTc.message), 'the failure explains the graceful degradation')
 toolchainAvailable = true
+// docs/formal-verification.md §7: a TIMEOUT must TERMINATE the process. `graceMs` is only a
+// request to the host, so a run whose `done` never settles within the cap must be ended by
+// `handle.terminate()` — otherwise a runaway toolchain lingers while we report LEAN_TIMEOUT.
+{
+  const before = terminations.length
+  hangLean = true
+  hangMs = 60000
+  const runHang = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean', timeout_ms: 1000 }, childAgent(childOf(RD, 'r-1')))
+  hangLean = false
+  assert(runHang.ok === false && runHang.code === 'LEAN_TIMEOUT', '★ a run that outlives the cap is reported as LEAN_TIMEOUT (got ' + runHang.code + ')')
+  assert(runHang.timedOut === true, 'the result is flagged timedOut')
+  assert(terminations.slice(before).some(f => /good\.lean$/.test(String(f))), '★ the timeout path really called handle.terminate() (the toolchain is not left running)')
+  assert(runHang.signal === 'SIGTERM', 'the synthetic outcome names the signal that ended it')
+}
+// A host that exposes NO `subprocess` service must produce the readable NO_SUBPROCESS result
+// (never a throw into the scheduler), must leave the object record honest (`attempted`, and NOT
+// passed), and must still let the code be written down through the archive route.
+{
+  noSubprocess = true
+  const runNoSvc = await callTool('vibe_v5_lean_run', { file: 'Formal/good.lean', target: 'p-nosub' }, childAgent(childOf(RD, 'r-1')))
+  assert(runNoSvc.ok === false && runNoSvc.code === 'NO_SUBPROCESS', '★ a host with no subprocess service returns NO_SUBPROCESS instead of throwing (got ' + runNoSvc.code + ')')
+  assert(typeof runNoSvc.message === 'string' && /no subprocess service/.test(runNoSvc.message), 'the result explains why Lean cannot run here')
+  const stNoSvc = await callTool('vibe_v5_status', {}, RD)
+  assert(stNoSvc.ok === true, 'the institute still answers status after that (nothing was thrown into the scheduling loop)')
+  const recNoSvc = (stNoSvc.formal.objects || []).find(o => o.target === 'p-nosub') || {}
+  assert(recNoSvc.status === 'attempted', 'the run is recorded as attempted (no toolchain = no proof), got ' + recNoSvc.status)
+  assert(!recNoSvc.proof, 'and it is NOT recorded as passed')
+  // The way out (contract §6 rule 4): the code can still be written down. The archive route
+  // itself needs no toolchain at all.
+  const arcNoSvc = await callTool('vibe_v5_lean_archive', { kind: 'proof', target: 'p-nosub', content: 'theorem p_nosub : 1 + 1 = 2 := by decide\n' }, childAgent(childOf(RD, 'r-1')))
+  assert(arcNoSvc.ok === true && arcNoSvc.passed === false && arcNoSvc.run && arcNoSvc.run.code === 'NO_SUBPROCESS',
+    'the code is still written down and archived with no toolchain, and the record stays honest (' + JSON.stringify({ ok: arcNoSvc.ok, status: arcNoSvc.status, code: arcNoSvc.run && arcNoSvc.run.code }) + ')')
+  assert(existsSync(join(instD, 'Formal', 'p-nosub.lean')), 'the working file exists on disk even though nothing could execute it')
+  assert(!existsSync(join(instD, 'Verified', 'Lean', 'p-nosub.lean')), '★ nothing is promoted to Verified/Lean/ without a green run')
+  noSubprocess = false
+}
 
 // ---------- 5. archive a proof → the vote becomes a FIDELITY review ----------
 section('5 a passing proof flips the review subject to fidelity')
@@ -405,6 +490,8 @@ await settle(); delivered.length = 0; await drainWakes(3, RD)
   assert(/形式化不合格/.test(vp), 'it names the failure a formalisation defect, not a refutation')
   assert(/decision:'defect'/.test(vp), 'it names the defect reply channel')
   assert(!/偏离 → 0/.test(vp), '★ the old "any deviation → 0" instruction is GONE')
+  assert(/本档没有门禁：请务必给一个严格介于 0 与 1 之间的弃权值，以保证本轮无法得出一致结论/.test(vp),
+    '★ encourage mode is explicit that there is NO gate and the voter\'s abstention is what prevents a conclusion (wording shared with v2/v3/v4)')
   assert(noBareLeanTool(vp), 'no abbreviated tool name appears in the fidelity prompt')
 }
 await drainWakes(10, RD)
@@ -516,6 +603,29 @@ assert(!!w2, 'r-2 was woken and answered')
 const stF2 = await callTool('vibe_v5_status', {}, RF)
 assert(stF2.formal.objects.some(o => o.target === 'p-reply2' && o.status === 'attempted'),
   'a `formal.decision=used` reply records the object as attempted with its file')
+// a plain `used` judgement must NOT withdraw an ESTABLISHED proof (contract §4): only a fidelity
+// defect retracts one. v2 shipped the unconditional downgrade here; all four are asserted behaviourally.
+await callTool('vibe_v5_record_proposition', { id: 'p-usedkeep', statement: '已有通过证明后再写一次 used 回执', value: 0.6, motive: 'm', p: 0.8 }, childAgent(childOf(RF, 'r-1')))
+{
+  const arcU = await callTool('vibe_v5_lean_archive', { kind: 'proof', target: 'p-usedkeep', content: 'theorem p_usedkeep : 2 + 2 = 4 := by decide\n' }, RF)
+  assert(arcU.ok === true && arcU.passed === true, 'used-keep: the object starts Lean-passed')
+  const wU = await wakeAndReply(RF, 'r-2', {
+    progress: '这一轮只是又写了一遍草稿。',
+    formal: { target: 'p-usedkeep', decision: 'used', file: 'Formal/p-usedkeep.lean' },
+    contextPct: 20,
+  })
+  assert(!!wU, 'r-2 was woken for the used judgement')
+  const stU = await callTool('vibe_v5_status', {}, RF)
+  const recU = stU.formal.objects.find((o) => o.target === 'p-usedkeep')
+  assert(!!recU && recU.status === 'passed', '★ a `used` reply does NOT downgrade an already-passed object (got ' + JSON.stringify(recU) + ')')
+  assert(!!recU && recU.proof === 'Verified/Lean/p-usedkeep.lean', '★ and the proof pointer survives the reply')
+  assert(existsSync(join(instF, 'Verified', 'Lean', 'p-usedkeep.lean')), '★ and the archived proof is still on disk')
+  assert(stU.formal.passed.indexOf('p-usedkeep') !== -1, '★ status still reports it as Lean-passed')
+  const rerunU = await callTool('vibe_v5_lean_run', { file: 'Formal/p-usedkeep.lean', target: 'p-usedkeep' }, RF)
+  assert(rerunU.ok === true, 'used-keep: the work file runs green')
+  const recU2 = (await callTool('vibe_v5_status', {}, RF)).formal.objects.find((o) => o.target === 'p-usedkeep')
+  assert(!!recU2 && recU2.status === 'passed', '★ a plain re-run does not downgrade a passed record (contract §4)')
+}
 // a blocker with no note must be refused AND reported back to the member
 delivered.length = 0
 const w3 = await wakeAndReply(RF, 'r-1', { formal: { target: 'p-reply3', decision: 'blocked' }, contextPct: 20 })

package/installer.js

@@ -52,7 +52,9 @@ const PRESETS = [
   {
     src: 'vibe-math-v5',
     dst: 'vibe-math-v5',
-    files: ['agent.cordis.yml', 'preset.yml', 'vibe-math-v5.js', '实现方案.md'],
+    // 架构图.md belongs here for the same reason 实现方案.md does: the installer's policy is to put
+    // the preset's documentation next to the preset, and the shipped v5 directory carries both.
+    files: ['agent.cordis.yml', 'preset.yml', 'vibe-math-v5.js', '实现方案.md', '架构图.md'],
   },
 ]
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-vibe-math",
   "description": "Multi-agent mathematical problem-solving & verification frameworks for DeepSeek Harness — FOUR agent presets in one install: vibe-math-v2 (probability-driven: qs.json + Propos knowledge base + explorer→solver→review/debate verdict), vibe-math-v3 (THIRD-generation, recommended: paper-style Markdown knowledge base with Problems/Progress/Propos/Methods/Verified + planner-agent scheduling that decides the next N actions + universal theory/method invention library + agents write their own Markdown directly via a per-file write lock), and vibe-math-v4 (FOURTH-generation: persistent self-organizing resident subagents that message & meet to decide all tasks, verify only by unanimous consensus, /compact at a context threshold, and stop only when all agree the problem is solved), and vibe-math-v5 (FIFTH-generation research institute: an academician as the organizational centre who decomposes and ASSIGNS work and chairs meetings; permanent researchers who hold the vote and may hire/fire their own temp workers; temp workers with no vote; a group chat and meetings; a durable per-recipient mailbox; a compare-and-set task DAG; and a boolean m-vote consensus rule where an object enters Verified/ only when at least m voting members agree AND every one of them returns exactly 1 or exactly 0). Installing this bundle auto-installs all four presets (v1 was removed at v2.0.0).",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -17,6 +17,8 @@
     "audit-formal-sensitivity.mjs",
     "audit-persona-sensitivity.mjs",
     "audit-persona-surface.test.mjs",
+    "audit-prompt-invariants.mjs",
+    "audit-spec-traceability.mjs",
     "audit-v5-integrity.mjs",
     "audit-v5-sensitivity.mjs",
     "cordis.patch.yml",
@@ -35,6 +37,8 @@
     "RELEASE-NOTES-2.2.2.md",
     "RELEASE-NOTES-2.3.0.md",
     "RELEASE-NOTES-2.3.1.md",
+    "RELEASE-NOTES-2.3.2.md",
+    "RELEASE-NOTES-2.3.3.md",
     "selfdrive-v5.mjs",
     "示例图/框架图-v5.svg",
     "docs/架构图.md",
@@ -98,7 +102,7 @@
     },
     "minVersion": "0.1.2-rc.1",
     "testedVersion": "0.1.5-rc.2",
-    "compatNote": "依赖宿主提供的 subagents/agents/tools/commands/fs 服务与 @deepseek-ai/dsh-* 插件行；可选 subprocess/sandboxPolicy/compaction。persona 行同时携带 prefix 与 text 两个键，以兼容 0.1.3-alpha.2 的 schema 更名（prefix 必填）与 0.1.2 及更早的 text 键。已在 dsh-v0.1.5-rc.2（@deepseek-ai/dsh-persona 0.1.5-rc.2）上逐行校验全部预设行并通过（v2/v3/v4；v1 已于 v2.0.0 移除）。注意：DSH 0.1.2 起 subagents.startContinuable 的 agentOptions/toolFilter 需要宿主 provider 声明对应 capability（spawn/fork 进程内 provider 均支持），安装器启动时会做能力自检并在旧版宿主上告警。2026 兼容性修复：v2/v3 工具权限名表原先硬编码 web/fetch/bash（未注册名会使 tools.restrict() 抛错、子代理无法建立），现按真实注册名并加带守卫的重试；v4 真实 /compact 原先在 subagent/end 里查 agents.get()（该事件触发时子代理已移出注册表，属死代码），现改为在 subagent/start 捕获 Agent 引用；三套预设的可选服务改为惰性读取，不再在 apply() 快照；v4 的 tools/commands 注册补入 ctx.effect；安装器自检新增 subprocess/sandboxPolicy/compaction。v2.1.0 新增 v5 研究所体系：状态存于宿主 host-only 会话投影单元（键 vibeMathV5），因此自检新增 sessionProjections/sessions（均为可选；缺失时 v5 回退到加固 JSON 状态文件）。v5 不依赖任何 npm 实验包，纯 preset 内单文件实现。v2.3.1 是审计驱动的提示词/交互修复版（无破坏性变更，默认仍为 off）：① 忠实性缺陷不再被记成「命题为假」——新增回执取值 decision='defect'（表决者发现 Lean 代码与命题原文不一致时不得投 0，给中间值并记录具体偏差；框架随即把该对象降级为 attempted、清空 proof、撤回归档证明 Verified/Lean/<id>.lean、写入 Formal/TODO.md，require 档下本次裁定不定论），encourage 档不承诺它无法强制的搁置；② 修复 v2 的 formal 回执通道是死代码（提示词要求写进回执、契约里却没有该字段、框架也从不解析）——补齐 formalJsonField/formalReplyNote/absorbFormalFromReply 并接进初评与辩论两条路径，套件改为行为断言而非措辞断言；③ 修复 v2/v3 忠实性分支的字段名错误（写成 verdict，真实字段是 Result，会导致该票被静默丢弃）；④ 注入文本里的工具名一律改为注册名全称（v2/v3/v5 原先出现 lean_lib/lean_archive 缩写，含工具自身返回的 hint）；⑤ 新增「归档可复用定义/引理前先跑通」与「宿主无 Lean 工具链（LEAN_NOT_FOUND）时把代码归档并在 note 写明，算显式阻塞原因」两条硬要求；⑥ 四套各自新增随包发布的人工复核语料 prompt-corpus-vN/（覆盖 off/encourage/require/忠实性/工作轮/回执契约），并修复 v5 语料路径归一化在 Windows 大小写差异下漏掉 VibeMath 根绝对路径、导致语料不确定且泄露本机路径的问题；⑦ 新增 16 条提示词灵敏度探针（删掉「不要投 0」、工具名换缩写、删掉 require 门禁措辞、回执契约去掉 defect，各四套），全套件断言 v2 261 / v3 247 / v4 226 / v5 120 / prompt-v5-integrity 588。v2.3.0 为四个架构新增可调控的 Lean 形式化验证（参数 formalVerify = off/encourage/require，默认 off）：验证时按实现难度决定是否用 Lean 形式化（写代码+执行），一旦通过则审查对象从「推导是否正确」变成「Lean 的定义/对象/条件/假设/结论是否忠实于命题原文」；形式化代码归档为命题的证明（Verified/Lean/<id>.lean），可复用定义与已证引理归档到跨项目的 VibeMath/Formal/{Lib,Proved}/。require 档带门禁：真/假结论必须先有 Lean 通过或显式阻塞记录，否则记为未定论并进入形式化待办。共用契约 docs/formal-verification.md，四套各带 formal-verify-vN 套件（v2 177 / v3 189 / v4 144 / v5 88 断言）与 audit-formal-sensitivity.mjs 探针。同一次审计还发现并修复了一整类**静态提示词面**缺陷（persona ↔ 工具注册表，既有套件全部盲）：v2/v3/v4 的 persona 从未列出无条件注册的三个 *_lean_* 工具，v4 的 vibe_v4_set 参数表漏了 formalVerify/leanCommand/leanArgs/leanTimeoutMs，v3 漏了 setup/save_settings/template，v4 漏了 vibe_v4_prompts，v5 漏了增删常驻研究员的工具、且 prefix 与 text 两个块存在文字漂移；现由 audit-persona-surface.test.mjs（197 断言：双向一致性 + 未文档化工具显式快照 + prefix/text 逐行一致 + 斜杠命令 hint/usage/实际分支三处一致 + Lean 参数/档位/路径，并生成随包发布的 prompt-corpus-persona/ 人读语料）与 audit-persona-sensitivity.mjs（11 条探针，含「未变异副本必须为绿」的对照）守护，AUDIT-CHECKLIST.md 新增 §1.6。v2.2.2 新增 v5 架构图（示例图/框架图-v5.svg + docs/generate_framework_diagram_v5.mjs 零依赖 Node 生成器 + vibe-math-v5/架构图.md 全套 Mermaid 细节图），并修复在绘制架构图时暴露的真实缺陷：会议进行中提出的验证会并发启动（会议与验证的互斥此前只做了单向），现改为排队。v2.2.1 把「全面检查必查清单」(AUDIT-CHECKLIST.md) 作为随包强制流程发布，提示词/交互正确性列为第一优先审计维度。v2.2.0 修复实测发现的提示词身份错乱：状态块改为显式接收它所描述的成员，创建成员时先落盘进编制再构造入职提示词，章程快照冻结在入职时，重建会话不再自称“刚入职”，所办调用不再被误判成某位研究员，框架反馈改为独立发送者投递，一次提示词不再重复投递同一条消息，并新增 prompt-v5-integrity 提示词完整性套件 + 可人工复核的提示词语料（随包发布）。",
+    "compatNote": "依赖宿主提供的 subagents/agents/tools/commands/fs 服务与 @deepseek-ai/dsh-* 插件行；可选 subprocess/sandboxPolicy/compaction。persona 行同时携带 prefix 与 text 两个键，以兼容 0.1.3-alpha.2 的 schema 更名（prefix 必填）与 0.1.2 及更早的 text 键。已在 dsh-v0.1.5-rc.2（@deepseek-ai/dsh-persona 0.1.5-rc.2）上逐行校验全部预设行并通过（v2/v3/v4；v1 已于 v2.0.0 移除）。注意：DSH 0.1.2 起 subagents.startContinuable 的 agentOptions/toolFilter 需要宿主 provider 声明对应 capability（spawn/fork 进程内 provider 均支持），安装器启动时会做能力自检并在旧版宿主上告警。2026 兼容性修复：v2/v3 工具权限名表原先硬编码 web/fetch/bash（未注册名会使 tools.restrict() 抛错、子代理无法建立），现按真实注册名并加带守卫的重试；v4 真实 /compact 原先在 subagent/end 里查 agents.get()（该事件触发时子代理已移出注册表，属死代码），现改为在 subagent/start 捕获 Agent 引用；三套预设的可选服务改为惰性读取，不再在 apply() 快照；v4 的 tools/commands 注册补入 ctx.effect；安装器自检新增 subprocess/sandboxPolicy/compaction。v2.1.0 新增 v5 研究所体系：状态存于宿主 host-only 会话投影单元（键 vibeMathV5），因此自检新增 sessionProjections/sessions（均为可选；缺失时 v5 回退到加固 JSON 状态文件）。v5 不依赖任何 npm 实验包，纯 preset 内单文件实现。v2.3.3 是 2.3.2 之后的确认轮（重新审计改动过的每一处：四套插件、四套套件、共享契约，以及审计脚本自身），修掉一处真实缺陷与两处同类/字面问题：① v2 的 formal.decision=used 回执**无条件**把记录写成 attempted —— 一句「这一轮碰了形式化」会把已经 passed 的对象在两个 id 空间上一起降级，而 proof 指针仍留着（记录自相矛盾），后果是后续审查提示词丢掉忠实性分支、require 档对一份已跑通的归档证明重新关门并把对象丢进形式化待办；现改为先取合并后的记录状态（formalGateRecord，两套 id 都认），passed/blocked 一律保留，只有从未尝试起步才写 attempted（与 v4 的 formalSetRun 缺陷同类，只是长在回执通道上且只长在一套里）。② v3 的 used 分支只保留 passed（prev.status === passed ? passed : attempted），会把 blocked 打回 attempted —— blocked 本身就是「门禁已放行」的记录，一句 used 就把门禁重新关上；现两者都保留，四套同构。③ 共享契约 docs/formal-verification.md §4 迁移表有两行与实现相反（used 行与两行 lean_run 都写成「→ attempted」），而规范文档写反最危险之处是下一次修改会照它写（2.3.2 修好 v2 后若只读契约就会把修复改回去）；现已改正为「已是 passed/blocked 则保持原状」，并补上「lean_archive kind=proof 但运行失败 → attempted + 清空 proof + 撤回旧归档证明」这一行，四套实现方案与 v5 规格同步，audit-spec-traceability 增加 3 条字面校验（91 → 94）。④ 审计脚本自身的守卫加固：audit-prompt-invariants.mjs 的注释扫描器此前不认正则字面量，而四套源码都含一个「字符类里带双引号」的 sanitize 正则字面量，旧扫描器把那个引号当成字符串开头、此后整个文件词法状态都是错的（实测新旧逐行比对：v2 190 行 / v3 159 行 / v4 14 行 / v5 121 行不同，典型后果是真实代码行被当注释抹掉 → 真缺陷可能被 I1/I13/I14 漏看）；现在扫描器支持正则字面量（字符类/转义/flags）并新增 X5–X7 三条自检（正则里的引号不得吞掉注释、字符串里的 // 必须保留、转义斜杠不得提前结束正则，且都保持行结构），修复前 X5 会变红。⑤ 行为断言补齐四套同构（此前只有 v4 断言「普通 run 不降级 passed」）：四套各新增 used 回执不得降级已 passed 对象、不得把 blocked 打回 attempted、普通 lean_run 不得降级 passed，v2 还断言「used 之后 require 门禁仍放行（把该轮驱动到一致为真不会产生 formal-required 待办）」；本轮是先用断言复现（v2 修复前实测三条变红：got attempted），再修复。套件断言 v2 334 / v3 294 / v4 277 / v5 153 / prompt-v5-integrity 506，audit-prompt-invariants 151/0（--self-probe 5/5），audit-spec-traceability 94/0。v2.3.2 是对四个架构各做一轮深度审计 + 横向同构对照后的修复版（无破坏性变更，默认仍为 off），修掉三处会让「严格验证」失效或不可用的高危缺陷：① v3 的四个 Lean 参数从未写进 vibe_math_set_params 的参数 schema（该 schema 是 additionalProperties:false，遵守 schema 的 provider 会拒绝这个调用）→ 用户永远无法开启该功能，而套件全绿（它直接调 handler、绕过 schema）；② v2 的 require 门禁只读验证侧自己的 id，而代理用对象 id 归档、别名同步只更新已存在的键 → 「归档了 passed、验证侧还没有记录」时门禁永远搁置，搁置本身又写下 rId=none，于是每轮重开一次辩论、对象永远无法定论并饿死其它对象；③ v4 的 formalSetRun 硬编码 status=attempted，把已验证对象的 passed 抹掉（与注释、规格、v2/v5 都矛盾）→ 一次随手 lean_run 就让对象丢掉「已形式化」，忠实性分支消失、require 档对已有绿色证明的对象重新关门。另修 v2 的一处门禁旁路（settleVerdict 的「判断命题」转移在 v=0 时直接写 布尔估计=0/已验证/优先级 never 并压入 正确概率:1 条目，完全不看门禁）。撤回语义按 v5 的正确做法统一四套：撤回归档证明时先删、再用 fs 复核文件真的没了、仍在则就地覆盖为撤回说明，并如实公告是哪一种（含两者都失败的告警）；lean_archive kind=proof 跑红时不再保留 prev.proof（proof 只属于 passed）并撤回旧的归档证明。提示词/交互修复：忠实性分支改为按档位承诺（只有 require 有门禁，encourage 明确写「本档没有门禁：请务必给弃权值」）；无 Lean 工具链的出路同时点名 LEAN_NOT_FOUND 与 NO_SUBPROCESS；v3 的失败提示不再让人去看并不存在的编译器输出；v4 活动日志里的缩写工具名改为注册名（并纳入注入文本扫描）；v2 的工作轮不再把可复用引理指向项目内不存在的 Formal/Proved/；v2 的 kind=def/lemma 跑红不再声称可复用；v3 setup 的重复 plannerPersona 去重；v4 规格里的幽灵工具 vibe_v4_propose_verify 修正为回执字段。语料确定性：v5 语料此前的非确定有三层根因（心跳/会议依赖真实时钟与异步顺序、最闲成员抖动、写入端只按 kind 排序），现由套件虚拟时钟 + 单成员研究所内捕捉心跳 + 写入端全序排序（kind→owner→prompt）修复，连跑 6 次字节一致且套件 7–9 s → 1.7 s；v3 的 20 条 planner:* 随机 plan id 与 epoch 时间戳一并 scrub。新增两个随包发布的常驻守卫：audit-prompt-invariants.mjs（四套 × 26 条静态不变式 + 3 条跨套检查，把历次真实发生过的提示词缺陷类别编码住，当前 121/0）与 audit-spec-traceability.mjs（规格/README 承诺的工具必须真的注册，能识别「文档里说它不存在」的否定语境；四个 Lean 参数必须同时被文档与代码接受；契约 §7 的 terminate()；契约 §8 的门禁收口点无旁路，当前 91/0），以及 run-tests.mjs（并行跑全部套件并打印耗时/加速比/最慢项，修掉 --only x 空格形式被静默忽略与 --json 混入人类输出两个 bug）。AUDIT-CHECKLIST.md 新增 §1.8「四套同构：任何语义修正必须四套同步」——本轮三处高危里有两处正是改一套或四套同写法却无人横向对照造成的。本轮最贵的一处缺陷还暴露出一整类既有测试全都盲的漏洞：四个预设的工具 schema 都由 objParams 以 additionalProperties:false 关闭，schema 没列出的键会被遵守 schema 的 provider 直接拒绝，而提示词/规格/状态行可以全都在说这个参数、套件也可以全绿（套件直接调 handler、绕过 schema）——因此新增三重守卫：① 四套各自的 formal-verify-vN 套件现在直接检查**真实注册的** schema 对象（封闭性 + 四个 Lean 参数 + formalVerify 的 enum 恰好三档，已用探针证明：去掉 v3 真实注册那份的 leanArgs 立刻变红）；② audit-prompt-invariants.mjs 新增 I13（每一处 set 工具定义都必须声明这四个参数，且每一份 objParams 都必须关闭 schema）；③ 新增 I14（schema 声明的每个键都必须被参数层真正接收：v2/v3 的闸门是 DEFAULT_PARAMS 键集、v4 是 k in params、v5 是 normalizeParams 的类型列表——声明而不接收 = 调用返回 ok:true 却什么都不发生）。该脚本同时新增 --self-probe：在内存里注入这些缺陷形状，要求对应不变式变红、未变异的对照跑仍为绿（5/5），现为 145 条不变式。套件断言 v2 319 / v3 283 / v4 269 / v5 145 / prompt-v5-integrity 506，e2e-v4-fixes 修掉并行下的抖动（T21 会议看门狗 80 ms 在 CPU 争用下提前放弃会议）；全量并行回归连续 3 次 23/23 全绿（最新实测 wall 111.5 s / sum 221.5 s / x1.99）。v2.3.1 是审计驱动的提示词/交互修复版（无破坏性变更，默认仍为 off）：① 忠实性缺陷不再被记成「命题为假」——新增回执取值 decision='defect'（表决者发现 Lean 代码与命题原文不一致时不得投 0，给中间值并记录具体偏差；框架随即把该对象降级为 attempted、清空 proof、撤回归档证明 Verified/Lean/<id>.lean、写入 Formal/TODO.md，require 档下本次裁定不定论），encourage 档不承诺它无法强制的搁置；② 修复 v2 的 formal 回执通道是死代码（提示词要求写进回执、契约里却没有该字段、框架也从不解析）——补齐 formalJsonField/formalReplyNote/absorbFormalFromReply 并接进初评与辩论两条路径，套件改为行为断言而非措辞断言；③ 修复 v2/v3 忠实性分支的字段名错误（写成 verdict，真实字段是 Result，会导致该票被静默丢弃）；④ 注入文本里的工具名一律改为注册名全称（v2/v3/v5 原先出现 lean_lib/lean_archive 缩写，含工具自身返回的 hint）；⑤ 新增「归档可复用定义/引理前先跑通」与「宿主无 Lean 工具链（LEAN_NOT_FOUND）时把代码归档并在 note 写明，算显式阻塞原因」两条硬要求；⑥ 四套各自新增随包发布的人工复核语料 prompt-corpus-vN/（覆盖 off/encourage/require/忠实性/工作轮/回执契约），并修复 v5 语料路径归一化在 Windows 大小写差异下漏掉 VibeMath 根绝对路径、导致语料不确定且泄露本机路径的问题；⑦ 新增 16 条提示词灵敏度探针（删掉「不要投 0」、工具名换缩写、删掉 require 门禁措辞、回执契约去掉 defect，各四套），全套件断言 v2 261 / v3 247 / v4 226 / v5 120 / prompt-v5-integrity 588。v2.3.0 为四个架构新增可调控的 Lean 形式化验证（参数 formalVerify = off/encourage/require，默认 off）：验证时按实现难度决定是否用 Lean 形式化（写代码+执行），一旦通过则审查对象从「推导是否正确」变成「Lean 的定义/对象/条件/假设/结论是否忠实于命题原文」；形式化代码归档为命题的证明（Verified/Lean/<id>.lean），可复用定义与已证引理归档到跨项目的 VibeMath/Formal/{Lib,Proved}/。require 档带门禁：真/假结论必须先有 Lean 通过或显式阻塞记录，否则记为未定论并进入形式化待办。共用契约 docs/formal-verification.md，四套各带 formal-verify-vN 套件（v2 177 / v3 189 / v4 144 / v5 88 断言）与 audit-formal-sensitivity.mjs 探针。同一次审计还发现并修复了一整类**静态提示词面**缺陷（persona ↔ 工具注册表，既有套件全部盲）：v2/v3/v4 的 persona 从未列出无条件注册的三个 *_lean_* 工具，v4 的 vibe_v4_set 参数表漏了 formalVerify/leanCommand/leanArgs/leanTimeoutMs，v3 漏了 setup/save_settings/template，v4 漏了 vibe_v4_prompts，v5 漏了增删常驻研究员的工具、且 prefix 与 text 两个块存在文字漂移；现由 audit-persona-surface.test.mjs（197 断言：双向一致性 + 未文档化工具显式快照 + prefix/text 逐行一致 + 斜杠命令 hint/usage/实际分支三处一致 + Lean 参数/档位/路径，并生成随包发布的 prompt-corpus-persona/ 人读语料）与 audit-persona-sensitivity.mjs（11 条探针，含「未变异副本必须为绿」的对照）守护，AUDIT-CHECKLIST.md 新增 §1.6。v2.2.2 新增 v5 架构图（示例图/框架图-v5.svg + docs/generate_framework_diagram_v5.mjs 零依赖 Node 生成器 + vibe-math-v5/架构图.md 全套 Mermaid 细节图），并修复在绘制架构图时暴露的真实缺陷：会议进行中提出的验证会并发启动（会议与验证的互斥此前只做了单向），现改为排队。v2.2.1 把「全面检查必查清单」(AUDIT-CHECKLIST.md) 作为随包强制流程发布，提示词/交互正确性列为第一优先审计维度。v2.2.0 修复实测发现的提示词身份错乱：状态块改为显式接收它所描述的成员，创建成员时先落盘进编制再构造入职提示词，章程快照冻结在入职时，重建会话不再自称“刚入职”，所办调用不再被误判成某位研究员，框架反馈改为独立发送者投递，一次提示词不再重复投递同一条消息，并新增 prompt-v5-integrity 提示词完整性套件 + 可人工复核的提示词语料（随包发布）。",
     "compatibility": {
       "dshReleases": {
         "0.1.2-alpha.4": "compatible",