dsh-vibe-math 2.3.15 → 2.4.0

package/tests/formal-verify-v5.test.mjs

@@ -35,29 +35,12 @@ const section = (t) => console.log('\n[' + t + ']')
 // ---------------------------------------------------------------
 // mock host
 // ---------------------------------------------------------------
-function makeProjectionRegistry() {
-  const units = new Map(); const cells = new Map()
-  const cellMap = (s) => { const id = String(s.id); let m = cells.get(id); if (!m) { m = new Map(); cells.set(id, m) } return m }
-  return {
-    register(def) { units.set(def.key, def); return () => { units.delete(def.key) } },
-    stateOf(session, key) {
-      const def = units.get(key); if (!def) return undefined
-      const m = cellMap(session)
-      if (!m.has(key)) m.set(key, def.init(session.header, session.inheritedEventCount || 0))
-      return m.get(key)
-    },
-    _drive(session, event) {
-      const m = cellMap(session)
-      for (const [k, def] of units) {
-        const cur = m.has(k) ? m.get(k) : def.init(session.header, session.inheritedEventCount || 0)
-        let next; try { next = def.apply(cur, event) } catch (e) { next = cur }
-        m.set(k, next)
-      }
-    },
-  }
-}
-
-const projections = makeProjectionRegistry()
+// The host offers NO session services: v5 injects only
+// ['subagents','agents','fs','tools','commands','timer'] and keeps its durable state in the
+// hardened JSON file State/<institute>.v5state.json. Sessions still RECORD anything appended to
+// them, so the suite can assert that the plugin appended nothing (an institute event in the log
+// would make the user session unresumable — DSH refuses to load an unknown event type unless it
+// is marked `ignorable`, which `Session.append` cannot set).
 const listeners = {}
 const toolRegs = []
 const liveAgents = new Map()
@@ -107,14 +90,14 @@ let subprocess = {
   },
 }
 
-function makeMockSession(id, parentSession) {
+function makeMockSession(id, parentSession, cwd) {
   const events = []
   const s = {
     id,
-    header: { version: 1, id, createdAt: Date.now(), cwd: WS, parentSession, isSeeded: false },
+    header: { version: 1, id, createdAt: Date.now(), cwd: cwd || WS, parentSession, isSeeded: false },
     inheritedEventCount: 0,
     get seq() { return events.length },
-    append(type, data) { const ev = { type, data, seq: events.length, time: Date.now() }; events.push(ev); projections._drive(s, ev); return ev },
+    append(type, data) { const ev = { type, data, seq: events.length, time: Date.now() }; events.push(ev); return ev },
     deriveMessages() { return [] },
     snapshotEvents(from) { return events.slice(from || 0) },
     ownEvents() { return events.slice() },
@@ -125,9 +108,14 @@ function makeMockSession(id, parentSession) {
 
 const roots = new Map()
 let rootSeq = 0
-function makeRoot() {
+// Every case gets its OWN workspace. The institute's durable state is a file under the
+// workspace (State/<institute>.v5state.json), so roots sharing one workspace would share one
+// institute and let one case's state leak into the next. `ws` lets a case open a SECOND root
+// over the same workspace, which is exactly what a reload looks like.
+function makeRoot(ws) {
   const id = 'sess-' + String.fromCharCode(65 + rootSeq++)
-  const session = makeMockSession(id, undefined)
+  const cwd = ws || mkdtempSync(join(tmpdir(), 'vibe-v5-lean-'))
+  const session = makeMockSession(id, undefined, cwd)
   const root = { id, options: { provider: 'mock', model: 'm' }, session, ctx: undefined }
   roots.set(id, root)
   return root
@@ -135,7 +123,6 @@ function makeRoot() {
 
 const ctx = {
   get(name) {
-    if (name === 'sessionProjections') return projections
     if (name === 'sandboxPolicy') return undefined
     if (name === 'compaction') return undefined
     if (name === 'subprocess') return noSubprocess ? undefined : subprocess
@@ -147,13 +134,12 @@ const ctx = {
   timeout(cb, ms) { const h = setTimeout(cb, ms); return () => clearTimeout(h) },
   tools: { register(spec) { toolRegs.push(spec); return () => {} } },
   commands: { register() { return () => {} } },
-  sessions: { async flush() { return true } },
   subagents: {
     list() { return ['spawn'] },
     async startContinuable({ label, request }) {
       const rootId = (request && request.parent && request.parent.id) || 'sess-A'
       const id = 'c' + (spawns.length + 1)
-      liveAgents.set(id, { id, session: makeMockSession(id, rootId), options: request && request.agentOptions })
+      liveAgents.set(id, { id, session: makeMockSession(id, rootId, (request && request.parent && request.parent.session && request.parent.session.header.cwd) || WS), options: request && request.agentOptions })
       spawns.push({ label, childId: id, rootId, persona: request && request.persona, prompt: request && request.prompt && request.prompt[0] && request.prompt[0].text })
       return { childId: id, messageId: 'm' + spawns.length }
     },
@@ -272,8 +258,10 @@ async function wakeAndReply(root, memberId, reply, fromMember) {
   return w
 }
 
-const instRootOf = (root) => join(WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute')
-const vibeRoot = join(WS, 'VibeMath')
+// Paths are per ROOT: each case's workspace holds its own institute.
+const wsOf = (root) => root.session.header.cwd
+const instRootOf = (root) => join(wsOf(root), 'VibeMath', 'Projects', 'default', 'Institutes', 'institute')
+const vibeRootOf = (root) => join(wsOf(root), 'VibeMath')
 const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '')
 // Every Lean tool mention in AGENT-FACING text must be the registered name (vibe_v5_lean_*).
 // An abbreviated `lean_archive` is not a tool: an agent that copies it calls nothing.
@@ -287,6 +275,26 @@ section("1 'off' (default) is a true no-op")
 const RA = makeRoot()
 const st0 = await foundInstitute(RA, '形式化开关默认关闭测试')
 assert(st0.params.formalVerify === 'off', "the default is 'off' (got " + st0.params.formalVerify + ')')
+
+// ★ The persistence contract (the DSH 0.2.0 audit fix). v5 used to keep the institute in a
+// host-only session projection: it appended `vibe5/*` events to the user's OWN session log, and
+// DSH's session persistence then REFUSED to load that session (unknown event type without
+// `ignorable: true`, which `Session.append` cannot set) — the user's session became unresumable.
+// The hardened JSON file is now the only authority, so the log must stay empty AND the state must
+// come back from the file in a brand-new root.
+{
+  assert(RA.session._events.length === 0,
+    '★ the plugin appends NOTHING to the host session log (' + RA.session._events.length + ' events after founding): an institute event would make the session unresumable')
+  const stateFile = join(instRootOf(RA), 'State', 'institute.v5state.json')
+  for (let i = 0; i < 40 && !existsSync(stateFile); i++) await settle()
+  assert(existsSync(stateFile), 'the institute state is on disk in State/institute.v5state.json')
+  const before = await callTool('vibe_v5_status', {}, RA)
+  const RA2 = makeRoot(wsOf(RA))   // fresh root, fresh backend, same workspace = a reload
+  const after = await callTool('vibe_v5_status', {}, RA2)
+  assert(after.members.length === before.members.length && after.params.formalVerify === before.params.formalVerify,
+    '★ a reload reads the roster and the parameters back out of the JSON file (' + after.members.length + ' members, formalVerify=' + after.params.formalVerify + ')')
+  assert(RA2.session._events.length === 0, '★ the reloading root appends nothing to its session log either')
+}
 {
   const allPrompts = spawnsFor(RA).map(s => s.prompt || '').join('\n') + '\n' + delivered.filter(d => d.rootId === RA.id).map(d => d.prompt).join('\n')
   assert(!/Lean/.test(allPrompts), 'no founding/round prompt mentions Lean in off mode')
@@ -498,8 +506,8 @@ await drainWakes(10, RD)
 
 // ---------- 6. the reusable cross-project library ----------
 section('6 reusable definitions and lemmas go to the GLOBAL library')
-const libPath = join(vibeRoot, 'Formal', 'Lib')
-const provedPath = join(vibeRoot, 'Formal', 'Proved')
+const libPath = join(vibeRootOf(RD), 'Formal', 'Lib')
+const provedPath = join(vibeRootOf(RD), 'Formal', 'Proved')
 const defRes = await callTool('vibe_v5_lean_archive', { kind: 'def', name: 'ZMod5', content: 'def ZMod5 := Fin 5\n' }, childAgent(childOf(RD, 'r-1')))
 assert(defRes.ok === true && defRes.file === 'Formal/Lib/ZMod5.lean', 'a reusable definition is archived to the global lib (' + defRes.file + ')')
 assert(existsSync(join(libPath, 'ZMod5.lean')), '★ the definition exists under VibeMath/Formal/Lib/ (cross-project, NOT inside the institute)')

package/tests/prompt-v5-integrity.test.mjs

@@ -83,37 +83,11 @@ const sleep = async (ms) => { advanceClock(ms); for (let i = 0; i < 3; i++) awai
 // ---------------------------------------------------------------
 // mock host
 // ---------------------------------------------------------------
-function makeProjectionRegistry() {
-  const units = new Map()
-  const cells = new Map()
-  const cellMap = (sess) => {
-    const id = String(sess.id)
-    let m = cells.get(id)
-    if (!m) { m = new Map(); cells.set(id, m) }
-    return m
-  }
-  return {
-    register(def) { units.set(def.key, def); return () => { units.delete(def.key) } },
-    stateOf(session, key) {
-      const def = units.get(key)
-      if (!def) return undefined
-      const m = cellMap(session)
-      if (!m.has(key)) m.set(key, def.init(session.header, session.inheritedEventCount || 0))
-      return m.get(key)
-    },
-    _drive(session, event) {
-      const m = cellMap(session)
-      for (const [k, def] of units) {
-        const cur = m.has(k) ? m.get(k) : def.init(session.header, session.inheritedEventCount || 0)
-        let next
-        try { next = def.apply(cur, event) } catch (e) { next = cur }
-        m.set(k, next)
-      }
-    },
-  }
-}
-
-const projections = makeProjectionRegistry()
+// NO session services: v5 injects only ['subagents','agents','fs','tools','commands','timer'] and
+// keeps its durable state in the hardened JSON file State/<institute>.v5state.json. Sessions still
+// record anything appended to them so the suite can assert that the plugin appended NOTHING — an
+// institute event in the user's session log makes that session unresumable (DSH refuses to load an
+// unknown event type unless it is marked `ignorable`, which `Session.append` cannot set).
 const listeners = {}
 const toolRegs = []
 const liveAgents = new Map()
@@ -123,17 +97,25 @@ const wakes = []      // queued sends not yet handled
 const delivered = []  // sends that drainWakes actually handled
 let failNextStarts = 0
 
-function makeMockSession(id, parentSession) {
+// One workspace PER CASE. The institute's durable state is a file under the workspace, so a shared
+// workspace would let case 1's institute (and its running state) leak into every later case.
+const WORKSPACES = [WS]
+function newWorkspace() {
+  const ws = mkdtempSync(join(tmpdir(), 'vibe-v5-prompt-'))
+  WORKSPACES.push(ws)
+  return ws
+}
+
+function makeMockSession(id, parentSession, cwd) {
   const events = []
   const s = {
     id,
-    header: { version: 1, id, createdAt: Date.now(), cwd: WS, parentSession, isSeeded: false },
+    header: { version: 1, id, createdAt: Date.now(), cwd: cwd || WS, parentSession, isSeeded: false },
     inheritedEventCount: 0,
     get seq() { return events.length },
     append(type, data) {
       const ev = { type, data, seq: events.length, time: Date.now() }
       events.push(ev)
-      projections._drive(s, ev)
       return ev
     },
     deriveMessages() { return [] },
@@ -146,17 +128,19 @@ function makeMockSession(id, parentSession) {
 
 const roots = new Map()
 let rootSeq = 0
-function makeRoot() {
+// `ws` opens a SECOND root over an existing workspace, which is what a reload looks like.
+function makeRoot(ws) {
   const id = 'sess-' + String.fromCharCode(65 + rootSeq++)
-  const session = makeMockSession(id, undefined)
+  const cwd = ws || newWorkspace()
+  const session = makeMockSession(id, undefined, cwd)
   const root = { id, options: { provider: 'mock', model: 'm' }, session, ctx: undefined }
   roots.set(id, root)
   return root
 }
+const wsOf = (root) => root.session.header.cwd
 
 const ctx = {
   get(name) {
-    if (name === 'sessionProjections') return projections
     if (name === 'sandboxPolicy') return undefined
     if (name === 'compaction') return undefined
     if (name === 'subprocess') {
@@ -201,14 +185,14 @@ const ctx = {
   },
   tools: { register(spec) { toolRegs.push(spec); return () => {} } },
   commands: { register() { return () => {} } },
-  sessions: { async flush() { return true } },
   subagents: {
     list() { return ['spawn'] },
     async startContinuable({ label, request }) {
       if (failNextStarts > 0) { failNextStarts -= 1; throw new Error('mock provisioning failure') }
       const rootId = (request && request.parent && request.parent.id) || 'sess-A'
       const id = 'c' + (spawns.length + 1)
-      liveAgents.set(id, { id, session: makeMockSession(id, rootId), options: request && request.agentOptions })
+      const cwd = (request && request.parent && request.parent.session && request.parent.session.header.cwd) || WS
+      liveAgents.set(id, { id, session: makeMockSession(id, rootId, cwd), options: request && request.agentOptions })
       spawns.push({
         label, childId: id, rootId,
         persona: request && request.persona,
@@ -428,24 +412,26 @@ function checkPromptSweep(prompt, owner, where) {
 // corpus recorder
 // ---------------------------------------------------------------
 const corpus = []
-// Normalise the workspace OUT of the corpus. A plain `split(WS)` is not enough on Windows:
+// Normalise every workspace OUT of the corpus. A plain `split(WS)` is not enough on Windows:
 // the plugin renders paths with forward slashes while os.tmpdir() may hand back a different
 // CASE ("...\ADMIN\..." vs ".../admin/..."), so the absolute workspace path used to survive
 // into the SHIPPED corpus — non-deterministic (the temp dir changes every run) and a machine
-// path leak. Match case-insensitively, on either separator.
+// path leak. Match case-insensitively, on either separator, for EVERY per-case workspace.
 const scrub = (s) => {
-  const t = String(s == null ? '' : s).replace(/\\/g, '/')
-  const ws = WS.replace(/\\/g, '/')
-  const re = new RegExp(ws.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi')
+  let t = String(s == null ? '' : s).replace(/\\/g, '/')
   // Timestamps are part of the prompt a member reads, but not part of what a reviewer needs:
   // normalise them too. Otherwise the shipped corpus changes on EVERY run — its headings carry
   // `### YYYY-MM-DD hh:mm:ss｜<member>` — and its diffs stop being meaningful.
   // The VibeMath ROOT gets its own token (not `<WS>/VibeMath`), so v5's corpus can be diffed
   // side by side with v2/v3/v4's, which render the same root as `<VIBEMATH>`.
-  return t.replace(/\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}(?::\d{2})?/g, '<TIME>')
+  t = t.replace(/\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}(?::\d{2})?/g, '<TIME>')
     .replace(/[A-Za-z]:\/[^\s"'`）)，。；：]*?[\\/]VibeMath/g, '<VIBEMATH>')
     .replace(/\/VibeMath/g, '<VIBEMATH>')
-    .replace(re, '<WS>')
+  for (const ws of WORKSPACES) {
+    const re = new RegExp(ws.replace(/\\/g, '/').replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi')
+    t = t.replace(re, '<WS>')
+  }
+  return t
 }
 // Every Lean tool mention in agent-facing text must be the REGISTERED name.
 // `Verified/Lean/` is a contract PATH, not a tool name, and on a case-insensitive reading it
@@ -521,6 +507,22 @@ for (const sp of founding) {
 }
 for (const sp of founding) { sp._ended = true; fireEnd(sp.childId, { progress: memberOfChild(sp.childId) + '：初始见解。', solved: false, contextPct: 10 }); await settle() }
 await settleInstitute(RA)
+// ★ The persistence contract after the DSH 0.2.0 audit: institute state lives in the hardened
+// JSON file State/<institute>.v5state.json and NOTHING is appended to the host session log. The
+// old projection backend wrote `vibe5/*` events into the user's own session, and DSH's session
+// persistence refuses to load a log with an unknown event type unless it is marked
+// `ignorable: true` — which `Session.append` cannot set — so that session became unresumable.
+{
+  assert(RA.session._events.length === 0,
+    '★ the plugin appends NOTHING to the host session log (' + RA.session._events.length + ' events after a full founding)')
+  const stateFile = join(wsOf(RA), 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'State', 'institute.v5state.json')
+  for (let i = 0; i < 40 && !existsSync(stateFile); i++) await settle()
+  assert(existsSync(stateFile), 'the institute state is on disk in State/institute.v5state.json')
+  const RB0 = makeRoot(wsOf(RA))   // a second root over the same workspace = a reload
+  const stReload = await callTool('vibe_v5_status', {}, RB0)
+  assert(stReload.members.length === 4, '★ a reload reads the 4-member roster back out of the JSON file (got ' + stReload.members.length + ')')
+  assert(RB0.session._events.length === 0, '★ the reloading root appends nothing to its session log either')
+}
 await endCase(RA)
 
 // =============== CASE 2: round prompts (normal + checkpoint) =====================
@@ -901,7 +903,7 @@ for (const w of meetingOne) {
 await settleInstitute(RI)
 const stMtg = await callTool('vibe_v5_status', {}, RI)
 assert(stMtg.meeting === null, 'the meeting finished instead of deadlocking')
-const minutes = join(WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'Shared', 'Meetings', 'mt-1.md')
+const minutes = join(wsOf(RI), 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'Shared', 'Meetings', 'mt-1.md')
 assert(existsSync(minutes), 'the meeting minutes were written')
 if (existsSync(minutes)) {
   const t = readFileSync(minutes, 'utf8')

package/tests/selfdrive-v5.mjs

@@ -1,8 +1,10 @@
 // ============================================================
 // Vibe-Math-V5 SELF-DRIVING TEST — drives the REAL vibe-math-v5 plugin with a mock
-// host, including a faithful mock of the HOST-ONLY session projection unit it relies
-// on (register / eager fold on append / stateOf), so the projection storage path is
-// actually exercised rather than stubbed out.
+// host. The host deliberately offers NO session services: v5 keeps its durable state in
+// the hardened JSON file State/<institute>.v5state.json and appends NOTHING to the host
+// session log (an unknown event type in the log makes the session unresumable, because
+// DSH's session persistence refuses to load it unless the writer marked it `ignorable`
+// — and `Session.append` cannot set that field).
 //
 // Run: node tests/selfdrive-v5.mjs   (temp workspace; assertions; non-zero exit on failure)
 // ============================================================
@@ -20,52 +22,22 @@ const failures = []
 const assert = (c, m) => { if (c) { passed++; console.log('  ok - ' + m) } else { failed++; failures.push(m); console.error('  FAIL - ' + m) } }
 const sleep = ms => new Promise(r => setTimeout(r, ms))
 
-// ---------- mock host: projection registry ----------
-// Mirrors the contract the plugin depends on: register returns a disposer, every
-// committed event is folded EAGERLY into every unit's cell, stateOf materialises a
-// cell lazily with init().
-function makeProjectionRegistry() {
-  const units = new Map()
-  const cells = new Map()
-  function cellMap(sess) {
-    const id = String(sess.id)
-    let m = cells.get(id)
-    if (!m) { m = new Map(); cells.set(id, m) }
-    return m
-  }
-  return {
-    register(def) {
-      if (!def || typeof def.key !== 'string') throw new Error('projection: key required')
-      units.set(def.key, def)
-      return () => { units.delete(def.key) }
-    },
-    stateOf(session, key) {
-      const def = units.get(key)
-      if (!def) return undefined
-      const m = cellMap(session)
-      if (!m.has(key)) m.set(key, def.init(session.header, session.inheritedEventCount || 0))
-      return m.get(key)
-    },
-    checkpoint(session) {
-      const out = {}
-      const m = cellMap(session)
-      for (const [k, def] of units) out[k] = { ver: def.stateVersion, seq: session.seq, val: m.get(k) }
-      return out
-    },
-    _drive(session, event) {
-      const m = cellMap(session)
-      for (const [k, def] of units) {
-        const cur = m.has(k) ? m.get(k) : def.init(session.header, session.inheritedEventCount || 0)
-        let next
-        try { next = def.apply(cur, event) } catch (e) { next = cur }
-        m.set(k, next)
-      }
-    },
-    _units: units,
+// The durable authority. Reading it back is how this suite observes "committed": the
+// plugin no longer writes anything a test could read out of the session log.
+const V5STATE = join(WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'State', 'institute.v5state.json')
+const readV5State = () => { try { return JSON.parse(readFileSync(V5STATE, 'utf8')) } catch (e) { return null } }
+// Commits are applied to the in-memory snapshot at once but WRITTEN through a deferred per-file
+// chain, so a test that wants to observe a commit must wait for it to land on disk.
+const waitV5State = async (pred, tries = 80) => {
+  let s = readV5State()
+  for (let i = 0; i < tries; i++) {
+    if (s && (!pred || pred(s))) return s
+    await sleep(10)
+    s = readV5State()
   }
+  return s
 }
 
-const projections = makeProjectionRegistry()
 const listeners = {}
 const toolRegs = []
 const commandRegs = []
@@ -75,6 +47,7 @@ const interrupts = []
 const drains = []
 const liveAgents = new Map()
 
+// The session records whatever it is handed, so the suite can assert that it was handed NOTHING.
 function makeMockSession(id, parentSession) {
   const events = []
   const s = {
@@ -85,10 +58,9 @@ function makeMockSession(id, parentSession) {
     append(type, data) {
       const ev = { type, data, seq: events.length, time: Date.now() }
       events.push(ev)
-      projections._drive(s, ev)
       return ev
     },
-    deriveMessages() { return [] },   // non-surface events must never become messages
+    deriveMessages() { return [] },   // nothing may enter the model history
     snapshotEvents(from) { return events.slice(from || 0) },
     ownEvents() { return events.slice() },
     _events: events,
@@ -100,7 +72,6 @@ const ROOT = { id: 'sess-A', options: { provider: 'mock', model: 'm' }, session:
 
 const ctx = {
   get(name) {
-    if (name === 'sessionProjections') return projections
     if (name === 'sandboxPolicy') return undefined
     if (name === 'compaction') return undefined
     if (name === 'subprocess') {
@@ -126,7 +97,6 @@ const ctx = {
   timeout(cb, ms) { const h = setTimeout(cb, ms); return () => clearTimeout(h) },
   tools: { register(spec) { toolRegs.push(spec); return () => {} } },
   commands: { register(spec) { commandRegs.push(spec); return () => {} } },
-  sessions: { async flush() { return true } },
   subagents: {
     list() { return ['spawn'] },
     async startContinuable({ label, request }) {
@@ -280,10 +250,20 @@ assert(spawns[0].persona.indexOf('分派') !== -1 && spawns[0].persona.indexOf('
 assert(spawns[0].persona.indexOf('m = 3') !== -1 || /至少有 m = \d+ 名有表决权者/.test(spawns[0].persona), 'charter states the m-vote rule with the live m')
 
 const st0 = await callTool('vibe_v5_status', {})
-assert(st0.backend === 'projection', 'durable state uses the session-projections backend (got ' + st0.backend + ')')
+assert(st0.backend === 'file', 'durable state uses the hardened JSON backend (got ' + st0.backend + ')')
 assert(st0.members.length === 4 && st0.members.filter(m => m.kind === 'researcher').length === 3, 'status roster is 1 academician + 3 researchers')
-assert(ROOT_SESSION._events.some(e => String(e.type).indexOf('vibe5/') === 0), 'institute events are appended to the session log')
-assert(ROOT_SESSION.deriveMessages().length === 0, 'institute events never enter the model history (zero context cost)')
+// ★ The whole point of the persistence fix: the plugin used to append `vibe5/*` events to the
+// user's own session log, which made that session UNRESUMABLE (DSH refuses to load a log with an
+// unknown event type unless it is marked `ignorable`, and `Session.append` cannot set that field).
+// The state now lives in the JSON file, so the log must stay COMPLETELY empty.
+assert(ROOT_SESSION._events.filter(e => String(e.type).indexOf('vibe5/') === 0).length === 0,
+  '★ the plugin appends NO institute events to the host session log')
+assert(ROOT_SESSION._events.length === 0,
+  '★ the host session log is untouched by the whole founding (the user session stays resumable)')
+assert(ROOT_SESSION.deriveMessages().length === 0, 'nothing enters the model history (zero context cost)')
+const st0File = await waitV5State(s => s.institutes['default::institute'].members.length === 4)
+assert(!!st0File && !!st0File.institutes['default::institute'], 'the institute state is on disk in State/institute.v5state.json')
+assert(!!st0File && st0File.institutes['default::institute'].members.length === 4, 'the JSON state holds the same 4 members (got ' + (st0File ? st0File.institutes['default::institute'].members.length : 'none') + ')')
 assert(st0.quorum.m === 3 && st0.quorum.voterCount === 4, 'm = min(quorumCap=3, P=4) = 3 (got ' + st0.quorum.m + ')')
 assert(st0.members.every(m => m.busy === true), 'every member is marked in-flight while its founding turn runs')
 
@@ -429,8 +409,15 @@ if (existsSync(rosterMirror)) {
 }
 const boardMirror = join(WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'Shared', 'TaskBoard.md')
 assert(existsSync(boardMirror), 'the human-readable task board mirror (Shared/TaskBoard.md) was written')
-assert(existsSync(join(WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'State', 'README.md')),
-  'State/ carries a README stating that the authoritative state is the session-log projection')
+const stateReadme = join(WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'State', 'README.md')
+assert(existsSync(stateReadme), 'State/ carries a README')
+if (existsSync(stateReadme)) {
+  const readmeText = readFileSync(stateReadme, 'utf8')
+  assert(/权威状态/.test(readmeText) && /v5state\.json/.test(readmeText),
+    'the State/ README names State/<研究所>.v5state.json as the authoritative state')
+  assert(/不在任何宿主会话日志里/.test(readmeText),
+    'the State/ README states that the authority is NOT in any host session log')
+}
 
 // ---------- the institute stops only on a unanimous solve vote ----------
 solvePlan = false

package/vibe-math-v2/vibe-math-v2.js

@@ -2594,13 +2594,17 @@ export function apply(ctx) {
     input: { hint: '[start|resume|pause|abort|status|report|mode <auto|manual>|setup|save|template [global|project]|add <id> <desc>|add-proposition <id> <概述>|list-propositions|project [list|new <name>|<name>]|decisions|agents]' },
     handler: async function (invocation) {
       const s = getSession(invocation && invocation.agent)
-      if (!s) return { kind: 'success', text: JSON.stringify({ ok: false, error: 'no vibe-math session for this agent' }) }
+      if (!s) return { kind: 'error', text: JSON.stringify({ ok: false, error: 'no vibe-math session for this agent' }) }
       const line = String(invocation && invocation.rawInput ? invocation.rawInput : '').trim()
       const parts = line.length > 0 ? line.split(/\s+/) : []
       const cmd = parts[0] || ''
       const rest = parts.slice(1)
       const result = await s.dispatchVibeCommand(cmd, rest)
-      return { kind: 'success', text: JSON.stringify(result, null, 2) }
+      // A business failure (the dispatch result's own ok:false) is a FAILED command: the host's
+      // CommandResult union distinguishes success from error, and returning 'success' made a rejected
+      // invocation look identical to a successful one in the UI.
+      const failed = result !== null && typeof result === 'object' && result.ok === false
+      return { kind: failed ? 'error' : 'success', text: JSON.stringify(result, null, 2) }
     },
   }))
 

package/vibe-math-v3/vibe-math-v3.js

@@ -3772,13 +3772,17 @@ export function apply(ctx) {
     input: { hint: '[start|resume|pause|abort|status|report|mode <auto|manual>|setup|save|template [global|project]|add <id> <desc>|add-proposition <id> <概述>|list-propositions|methods|index|plan|lock|project [list|new <name>|<name>]|decisions|agents]' },
     handler: async function (invocation) {
       const s = getSession(invocation && invocation.agent)
-      if (!s) return { kind: 'success', text: JSON.stringify({ ok: false, error: 'no vibe-math session for this agent' }) }
+      if (!s) return { kind: 'error', text: JSON.stringify({ ok: false, error: 'no vibe-math session for this agent' }) }
       const line = String(invocation && invocation.rawInput ? invocation.rawInput : '').trim()
       const parts = line.length > 0 ? line.split(/\s+/) : []
       const cmd = parts[0] || ''
       const rest = parts.slice(1)
       const result = await s.dispatchVibeCommand(cmd, rest)
-      return { kind: 'success', text: JSON.stringify(result, null, 2) }
+      // A business failure (the dispatch result's own ok:false) is a FAILED command: the host's
+      // CommandResult union distinguishes success from error, and returning 'success' made a rejected
+      // invocation look identical to a successful one in the UI.
+      const failed = result !== null && typeof result === 'object' && result.ok === false
+      return { kind: failed ? 'error' : 'success', text: JSON.stringify(result, null, 2) }
     },
   }))