dsh-vibe-math 2.4.0 → 2.5.0

package/vibe-math-v5/vibe-math-v5.js

@@ -52,7 +52,6 @@
 // field — so the old projection-based primary made the user's own session unresumable.
 export const inject = ['subagents', 'agents', 'fs', 'tools', 'commands', 'timer']
 
-const PROJECTION_KEY = 'vibeMathV5'
 const PROJECTION_VERSION = 1
 const EV = {
   institute: 'vibe5/institute',
@@ -129,19 +128,13 @@ export function apply(ctx) {
   }
 
   // ---- utils -------------------------------------------------------------
-  const now = () => Date.now()
   function hex(n) { let s = ''; for (let i = 0; i < n; i++) s += '0123456789abcdef'[Math.floor(Math.random() * 16)]; return s }
   const shortId = () => hex(8)
-  function clamp01(v) { const n = Number(v); if (!Number.isFinite(n)) return 0.5; return Math.max(0, Math.min(1, n)) }
   // contextPct is a PERCENT (0-100); never clamp to 0-1 or the compactThreshold
   // comparison (e.g. 66) becomes `1.0 >= 66` and never fires (v4 §17 defect).
-  function clPct(x) { const n = Number(x); if (!Number.isFinite(n)) return 0; return Math.max(0, Math.min(100, n)) }
   // Positive duration with a safe fallback: a NEGATIVE/NaN duration parameter must
   // never make a watchdog fire instantly or an idle window never elapse (v4 §30-T41).
-  function posMs(v, def) { const n = Number(v); return (Number.isFinite(n) && n > 0) ? n : (def || 120000) }
   const textBlock = (t) => ({ type: 'text', text: String(t) })
-  function blocksToText(b) { if (!b) return ''; let o = ''; for (const x of b) { if (x && x.type === 'text' && typeof x.text === 'string') o += x.text + '\n' } return o }
-  function fmtTime(ts) { try { return new Date(ts || now()).toISOString().replace('T', ' ').slice(0, 19) } catch (e) { return String(ts || '') } }
   function makeSignal(ms) { try { return AbortSignal.timeout(posMs(ms, 30000)) } catch (e) { return undefined } }
 
   // Object ids (verify targets, card ids, member ids) become FILE NAMES and DIRECTORY
@@ -149,10 +142,6 @@ export function apply(ctx) {
   // characters would escape the project tree. Keep every harmless character (incl.
   // Chinese) and replace only separators/control chars; strip leading/trailing dots
   // and dashes so the name is never '.' or '..' (v4 §30-T39).
-  function idSafe(s) {
-    const t = String(s == null ? '' : s).trim().replace(/[\\/:*?"<>|\u0000-\u001f]+/g, '-').replace(/-{2,}/g, '-').replace(/^[.\-]+|[.\-]+$/g, '')
-    return t
-  }
   // Advisory write-scope normalisation, ported from DSH agent-teams: backslashes to
   // '/', strip a leading './' and trailing '/', reject empty/absolute/drive-letter/
   // '..'-segment scopes.
@@ -174,6 +163,9 @@ export function apply(ctx) {
   // The fold is shared by BOTH persistence backends, so the state machine is
   // defined exactly once. It must return a NEW top-level reference whenever
   // anything changed (the state store compares by Object.is).
+  // The acknowledgement ledger is an LRU window, NOT a full history: it exists to answer
+  // "was this message delivered?", and the whole snapshot is rewritten on every commit.
+  const DELIVERED_CAP = 500
   function emptyInstitute(key, project, institute) {
     return {
       key, project, institute,
@@ -276,10 +268,16 @@ export function apply(ctx) {
           for (const id of ids) { if (!set.has(id)) { set.add(id); changed = true } }
           if (!changed) return inst
           // Compact: a message that has been delivered may leave `messages` too, so
-          // the queue never grows without bound over a long run.
+          // the queue never grows without bound over a long run. `delivered` itself is
+          // bounded the same way `debates`/`meetings` are: it is an acknowledgement LEDGER,
+          // and every commit rewrites the whole snapshot, so an ever-growing array of every
+          // message id ever acked would make each write progressively more expensive
+          // (audit M7). Oldest entries are dropped first; `messages` holds only undelivered
+          // ids and is filtered by the same set, so dropping an id can never re-deliver.
           const delivered = Array.from(set)
+          const capped = delivered.length > DELIVERED_CAP ? delivered.slice(delivered.length - DELIVERED_CAP) : delivered
           const messages = inst.messages.filter((m) => !set.has(m.id))
-          return Object.assign({}, inst, { delivered, messages })
+          return Object.assign({}, inst, { delivered: capped, messages })
         })
       }
       if (t === EV.meeting) {
@@ -318,8 +316,21 @@ export function apply(ctx) {
           return Object.assign({}, inst, { formal, todo })
         })
       }
+      // `d.queue` is normally the new ARRAY, but a queue MUTATION (appending a proposal,
+      // taking the head to run) is passed as a FUNCTION instead. Applying it here, inside the
+      // fold, makes its read and its write one atomic step of the serial event chain: the old
+      // shape (read `inst().queue`, mutate the copy, `await putQueue(copy)`) lost one of two
+      // proposals made in the same tick, because both callers read the same array and each
+      // committed its own copy.
       if (t === EV.queue) {
-        return withInstitute(state, key, (inst) => Object.assign({}, inst, { queue: Array.isArray(d.queue) ? d.queue : [] }))
+        return withInstitute(state, key, (inst) => {
+          const next = typeof d.queue === 'function' ? d.queue(inst.queue) : d.queue
+          const list = Array.isArray(next) ? next : []
+          // A mutation that changed nothing (a duplicate proposal) leaves the queue object
+          // identical: return the institute unchanged rather than minting a new revision.
+          if (list === inst.queue) return inst
+          return Object.assign({}, inst, { queue: list })
+        })
       }
       if (t === EV.counters) {
         return withInstitute(state, key, (inst) => Object.assign({}, inst, { counters: Object.assign({}, inst.counters, d.counters || {}) }))
@@ -345,28 +356,84 @@ export function apply(ctx) {
   // the whole snapshot under a per-file serialization chain; nothing is written to a host session log
   // (see the PERSISTENCE note at the top of this file for why the projection backend was removed).
   // `pathOf` is a FUNCTION, not a captured string: the state path depends on the
-  // project/institute, which the first successful load syncs back into this session —
-  // a captured path would keep writing to the pre-load guess forever.
+  // project/institute, which `configure` may change mid-session — a captured path would
+  // keep writing to the pre-load guess forever.
+  //
+  // The load latch is PER PATH, and a write is only allowed for a path whose load
+  // SUCCEEDED. Both are needed to make the state file safe (the 2.4.1 audit's H1):
+  // a boolean "we have loaded something" latch let the first tool call of a session
+  // (typically `vibe_v5_status`, against the DEFAULT institute) latch the backend to the
+  // default path, after which `vibe_v5_configure {institute:'alpha'}` never read alpha's
+  // file and wrote an EMPTY institute over it. Switching paths now re-reads the new path
+  // first, and if that read fails the backend refuses to write instead of clobbering.
   function makeFileBackend(readTextAbs, writeTextAbs, pathOf) {
     let mem = initState()
     let chain = Promise.resolve(true)
-    let loaded = false
-    return {
+    let loadedPath            // the path whose file is currently folded into `mem`
+    let loadOk = false        // did the read of `loadedPath` actually succeed?
+    let loadPromise = null    // the in-flight load (dedupes concurrent callers)
+    let loadPendingPath = null
+    // Fold ONE path into `mem`. `readTextAbs` returning undefined means "no file yet", which
+    // is the only case that licences a later write; anything else (a throw, a parse error, a
+    // version mismatch) leaves `loadOk` false so commit() refuses to clobber it.
+    async function doLoad(p) {
+      let ok = false
+      try {
+        const raw = await readTextAbs(p)
+        if (raw === undefined || raw === null || raw === '') ok = true
+        else {
+          const parsed = JSON.parse(raw)
+          if (parsed && parsed.v === PROJECTION_VERSION) { mem = parsed; ok = true }
+        }
+      } catch (e) { /* a corrupt/unreadable file is ignored; it is not authoritative */ }
+      loadedPath = p
+      loadOk = ok
+      loadPromise = null
+      loadPendingPath = null
+      return mem
+    }
+    const backend = {
       kind: 'file',
       async load() {
-        if (loaded) return mem
-        loaded = true
-        try {
-          const raw = await readTextAbs(pathOf())
-          if (raw) {
-            const parsed = JSON.parse(raw)
-            if (parsed && parsed.v === PROJECTION_VERSION) mem = parsed
-          }
-        } catch (e) { /* a corrupt mirror is ignored; it is not authoritative */ }
-        return mem
+        const path = pathOf()
+        if (loadedPath === path && (loadOk || loadPromise === null)) return mem
+        // A different path (or a previously FAILED load of this one) is read again before it
+        // is ever written to. Switching paths starts from the empty initial state: `mem`
+        // holds only the fold of the file that is on disk for the CURRENT path.
+        if (loadedPath !== path) { mem = initState(); loadPromise = null }
+        if (loadPromise && loadPendingPath === path) return await loadPromise
+        loadPendingPath = path
+        loadPromise = doLoad(path)
+        await loadPromise
+        if (loadedPath === pathOf()) return mem
+        // The path moved again while we were reading: hand back the state for the path
+        // that is current NOW rather than one for a directory we are no longer using.
+        return await backend.load()
       },
       read() { return mem },
+      loadedFor() { return { path: loadedPath, ok: loadOk } },
+      // Read ONE specific path (used by `configure`, which must know whether the institute
+      // it is being pointed at already exists on disk) and report the state belonging to
+      // `useKey`. The path latch deliberately stays on the file that was actually read.
+      async loadAt(path, useKey) {
+        loadedPath = path
+        loadOk = false
+        loadPromise = null
+        loadPendingPath = null
+        mem = initState()
+        await doLoad(path)
+        return { state: mem, institute: useKey === undefined ? undefined : mem.institutes[String(useKey)] }
+      },
       async commit(type, data) {
+        // NEVER write a snapshot whose file was not successfully read first: an unread file
+        // is indistinguishable from "the read never ran", and whole-snapshot writes make
+        // that failure mode destructive.
+        const path = pathOf()
+        if (loadedPath !== path) await backend.load()
+        if (loadedPath !== path || !loadOk) {
+          throw v5err('V5_STATE_NOT_LOADED',
+            'refusing to overwrite ' + path + ' : its state file was never read successfully (a failed or unreadable load must not be clobbered)')
+        }
         mem = applyV5Event(mem, { type, data })
         const snapshot = mem
         // Serialize writes per file and defer JSON.stringify to execution time, so a
@@ -379,6 +446,7 @@ export function apply(ctx) {
         return mem
       },
     }
+    return backend
   }
 
   // ---- session registry --------------------------------------------------
@@ -506,28 +574,53 @@ export function apply(ctx) {
     async function writeTextAbs(p, content) {
       try {
         const t = await fsTargetAbs(p)
-        await fs.writeText(t, content, undefined, undefined, getPolicy())
-        return true
-      } catch (e) { return false }
+        // `fs.writeText` RESOLVES with an FsWriteOutcome ({operation, version, before, after})
+        // and REJECTS on a real failure, so the old `return true` here meant only "the call did
+        // not throw" and discarded the outcome (audit L4). Return the outcome itself: `undefined`
+        // now means "not written", an object means "written, and here is what the fs reported".
+        // A stub/mock fs that resolves with nothing is reported as an unknown-but-successful
+        // write, because the real host never resolves without an outcome.
+        const outcome = await fs.writeText(t, content, undefined, undefined, getPolicy())
+        return (outcome === undefined || outcome === null) ? { operation: 'unknown' } : outcome
+      } catch (e) { return undefined }
     }
     async function readTextRel(rel) { return await readTextAbs(instRoot() + '/' + rel) }
-    async function writeTextRel(rel, content) { return await writeTextAbs(instRoot() + '/' + rel, content) }
+    async function writeTextRel(rel, content) { return (await writeTextAbs(instRoot() + '/' + rel, content)) !== undefined }
 
     function installBackend() {
       backend = makeFileBackend(readTextAbs, writeTextAbs, () => instRoot() + '/State/' + instituteName + '.v5state.json')
       return backend
     }
+    // The ONE call site that awaits the backend's load (the sensitivity probe for
+    // "the file fallback must LOAD persisted state before any read" keys on it, and a
+    // duplicated copy of it would make that probe ambiguous).
+    async function awaitBackendLoad() {
+      if (backend.kind === 'file' && typeof backend.load === 'function') await backend.load()
+      return true
+    }
     // Every entry point that READS state must await this first. Without it the file
     // backend's `mem` is still the empty initial state, so a fresh process would report
     // an empty roster and `resume` would refuse with "no active member to resume" —
     // i.e. the fallback would silently lose the whole institute across a restart.
     async function ready() {
       if (!backend) installBackend()
-      if (backend.kind === 'file' && typeof backend.load === 'function') await backend.load()
-      return true
+      return await awaitBackendLoad()
+    }
+    // Load the CURRENT state path before its first read. `state()` is synchronous by design
+    // (the whole fold is read through it), so it kicks the load off eagerly; the caller that
+    // matters — `commit()` — always awaits it before the snapshot may be written.
+    function ensureLoaded() {
+      if (!backend) installBackend()
+      if (backend.kind !== 'file' || typeof backend.load !== 'function') return
+      const p = backend.load()
+      if (p && typeof p.then === 'function') p.catch(() => {})
     }
     function state() {
       if (!backend) installBackend()
+      // A read must never be served from the empty initial state while the path's file has
+      // not been folded in yet (the 2.4.1 audit's H1: a read-less `state()` was half of the
+      // overwrite). `ready()`/`commit()` await the same load; here it only has to START.
+      ensureLoaded()
       stateCache = backend.read()
       return stateCache
     }
@@ -535,10 +628,46 @@ export function apply(ctx) {
       const s = state()
       return s.institutes[key] || emptyInstitute(key, project, instituteName)
     }
+    // The institute stored in ANOTHER (project, institute) state file, or undefined. Used by
+    // `configure` before it switches identity: the requested institute may already exist on
+    // disk, and adopting it is the only alternative to overwriting it (audit H1).
+    async function instituteAt(np, ni, nkey) {
+      if (!backend) installBackend()
+      const path = (vibeRoot() + '/Projects/' + np + '/Institutes/' + ni + '/State/' + ni + '.v5state.json')
+      const r = await backend.loadAt(path, nkey)
+      return r.institute
+    }
+    // A FAILED load of an EXISTING file must never be silent: it is the one state in which
+    // the backend refuses to write (audit H1). The note is buffered here and folded into the
+    // state on the next commit that IS allowed, so it can never recurse into a commit.
+    let pendingLoadNotes = []
+    function noteLoadProblem(text) {
+      const t = String(text || '').slice(0, 300)
+      if (t && pendingLoadNotes.indexOf(t) === -1) pendingLoadNotes.push(t)
+      if (pendingLoadNotes.length > 5) pendingLoadNotes = pendingLoadNotes.slice(-5)
+    }
+    function drainLoadNotes() {
+      if (!pendingLoadNotes.length || !stateCache) return
+      const list = (stateCache.diagnostics || []).concat(pendingLoadNotes.map((t) => ({ at: now(), type: 'vibe5/load', error: t })))
+      pendingLoadNotes = []
+      stateCache = Object.assign({}, stateCache, { diagnostics: list.slice(-50) })
+    }
     async function commit(type, data) {
       if (!backend) installBackend()
-      if (backend.kind === 'file' && backend.load) await backend.load()
-      stateCache = await backend.commit(type, Object.assign({ version: PROJECTION_VERSION, key }, data))
+      // Explicit call (the audit's H3): `await backend.load` awaited the METHOD OBJECT, so
+      // the only load was the one the backend happened to do inside commit.
+      await awaitBackendLoad()
+      const loaded = backend.kind === 'file' && typeof backend.loadedFor === 'function' ? backend.loadedFor() : { ok: true }
+      try {
+        stateCache = await backend.commit(type, Object.assign({ version: PROJECTION_VERSION, key }, data))
+      } catch (e) {
+        // The write was refused because the state file could not be read. Say so loudly
+        // instead of clobbering it, and keep the note for the next write that is allowed.
+        noteLoadProblem('write REFUSED (a failed state-file load must not be clobbered): ' + String((e && e.message) || e))
+        throw e
+      }
+      if (!loaded.ok) noteLoadProblem('the state file ' + String(loaded.path || '?') + ' could not be read (corrupt, unreadable or version-mismatched); it will never be overwritten')
+      drainLoadNotes()
       const cur = stateCache.institutes[key]
       if (cur) {
         phase = cur.phase || phase
@@ -557,7 +686,9 @@ export function apply(ctx) {
     const putMeeting = (index) => commit(EV.meeting, { index })
     const putDebate = (index) => commit(EV.debate, { index })
     const putVerdict = (target, record) => commit(EV.verdict, { target, record })
-    const putQueue = (queue) => commit(EV.queue, { queue })
+    // The verify queue has NO whole-array setter any more: both of its mutations go through
+    // `appendToQueue`/`takeQueueHead` below, which hand a FUNCTION to the event fold so the
+    // read-modify-write is atomic (the lost-proposal race).
     const putCounters = (counters) => commit(EV.counters, { counters })
     const markProgress = async () => {
       lastProgressAt = now()
@@ -582,6 +713,15 @@ export function apply(ctx) {
       const a = activeMembers().find((m) => m.kind === 'academician')
       return a ? a.id : ''
     }
+    // `academicianId()` resolved against a roster that also counts a member which is NOT yet
+    // committed (the joiner whose charter is being built). Kept separate so the canonical
+    // resolver stays the live-roster one — the sensitivity probe for the leaderless charter
+    // mutates the `academicianId()` CALL, and that mutation must keep reaching the text.
+    function academicianIdWith(extraMember) {
+      if (!extraMember) return academicianId()
+      const a = activeMembers().concat([extraMember]).find((m) => m.kind === 'academician')
+      return a ? a.id : ''
+    }
 
     // ---- the institute charter (public regulations) -----------------------
     // Written into every member's `persona` at hire time. `persona` is part of the
@@ -589,8 +729,12 @@ export function apply(ctx) {
     // context compaction WITHOUT being re-injected into prompts — which is what
     // structurally removes v4's "re-anchor the rules after compaction" patch and
     // the "[核心规则重申]+[CONTEXT COMPACT] every round" leak it caused (§24.1-③).
-    function rosterLine() {
-      const ms = activeMembers()
+    function rosterLine(extraMember) {
+      // Written ONCE, at the member's creation (`newMember`), so the hire-time snapshot is
+      // frozen even for a member the host's live-child cap refuses and `resume` re-spawns
+      // later (audit M5). The joiner is folded in here so its own charter shows the institute
+      // WITH itself on the roster — exactly what the original build-at-spawn code produced.
+      const ms = extraMember ? activeMembers().concat([extraMember]) : activeMembers()
       const acad = ms.filter((m) => m.kind === 'academician').map((m) => m.id)
       const res = ms.filter((m) => m.kind === 'researcher').map((m) => m.id)
       const tmp = ms.filter((m) => m.kind === 'temp').map((m) => m.id + '(' + (m.hiredBy || '?') + '雇)')
@@ -704,7 +848,8 @@ export function apply(ctx) {
       // The leader's REAL id (or '' when the office founded a leaderless institute).
       // Charter text must never name a leader who is not on staff: a member told to
       // "report to the academician" when there is none has no one to report to.
-      const acadId = academicianId()
+      // `member` itself is counted as on-staff even before it is committed (see rosterLine).
+      const acadId = academicianIdWith(member)
       const L = []
       // ── opening ──────────────────────────────────────────────────────────
       if (kind === 'academician') {
@@ -771,7 +916,7 @@ export function apply(ctx) {
         L.push('  · **所办（对外接口）** —— 不参与研究、不投票。代表本所与外部沟通并转达外部指令。')
       }
       L.push('  你入职时的在册编制（这是一份**快照**，此后可能变化）：')
-      L.push(rosterLine())
+      L.push(rosterLine(member))
       L.push('  （权威的在册名单与法定票数 m 以每轮提示里的状态块为准；编制可能变化。）')
       L.push('')
       // ── 二、general rules ────────────────────────────────────────────────
@@ -1032,6 +1177,12 @@ export function apply(ctx) {
         return { ok: o.exitCode === 0, exitCode: o.exitCode }
       } catch (e) { return { ok: false, error: String((e && e.message) || e) } }
     }
+    // Directory creation must go through the INJECTED `fs` service, not the platform shell:
+    // the shell path passes no policy, so a deployment that confines writes through
+    // `fs` (read-only or narrowed workspace) was not confining this one (audit M8). The
+    // local/sandboxed fs backend creates missing parent directories on write
+    // (`writeFileAtomic` → `mkdir(dirname, {recursive:true})`), so writing a marker file per
+    // directory is what actually creates the tree — inside the policy.
     async function mkdirs() {
       const base = instRoot()
       const dirs = ['Shared/Chat', 'Shared/Meetings', 'Shared/Debates', 'State', 'Problems', 'Formal', 'Verified/Lean']
@@ -1043,10 +1194,26 @@ export function apply(ctx) {
         for (const d of ['Progress', 'Propos', 'Methods', 'Subproblems']) dirs.push('Members/' + m.id + '/' + d)
       }
       const paths = dirs.map((d) => base + '/' + d).concat(globalDirs.map((d) => vibeRoot() + '/' + d))
+      let fsCreated = 0
+      let fsFailed = false
+      try {
+        if (fs && typeof fs.writeText === 'function' && typeof fs.resolve === 'function') {
+          for (const p of paths) {
+            const t = await fsTargetAbs(p + '/.keep')
+            await fs.writeText(t, '', undefined, undefined, getPolicy())
+            fsCreated += 1
+          }
+        } else fsFailed = true
+      } catch (e) { fsFailed = true }
+      if (!fsFailed && fsCreated === paths.length) return { ok: true, dirs: fsCreated, via: 'fs' }
+      // Guarded fallback for a host whose fs backend refuses (or offers no writeText): the
+      // platform shell still creates the tree, exactly as before this change. It is only
+      // reached when the policy-compliant route failed, and it reports which route ran.
       const script = isWindows()
         ? 'New-Item -Force -ItemType Directory -Path ' + paths.map((p) => psQuote(p)).join(',') + ' | Out-Null'
         : 'mkdir -p ' + paths.map((p) => shQuote(p)).join(' ')
-      return await runShell(script)
+      const r = await runShell(script)
+      return Object.assign({ via: 'shell' }, r)
     }
 
     // ---- communication (durable per-recipient mailbox) --------------------
@@ -1174,7 +1341,12 @@ export function apply(ctx) {
         hiredBy: (opts && opts.hiredBy) || '',
         term: (opts && opts.term) || '',
         provider: String((opts && opts.provider) || 'spawn'),
-        persona: '',   // filled at spawn; kept for the durable-seal record
+        // The charter is FROZEN at hire time — it says "你入职时的在册编制（这是一份**快照**）".
+        // It therefore has to be CAPTURED here, not at the first successful spawn: a member
+        // the host's live-child cap refused is recorded `failed` and only spawned later by
+        // `resume`, and rebuilding the charter then would describe the resume-time roster
+        // (`memberPersona(member)` would also silently drop any `staffPersona` change).
+        persona: memberPersona({ id, kind, direction: String((opts && opts.direction) || ''), hiredBy: (opts && opts.hiredBy) || '' }),
         error: '',
         createdAt: now(),
         dismissedAt: 0,
@@ -1278,7 +1450,8 @@ export function apply(ctx) {
       roundsSinceCompact.set(member.id, (roundsSinceCompact.get(member.id) || 0) + 1)
       // The charter is FROZEN at hire time (it is the durable "seal" record and it says
       // "你入职时的在册编制"). Rebuilding it on resume would silently rewrite that
-      // hire-time snapshot into a resume-time one and make the sentence untrue.
+      // hire-time snapshot into a resume-time one and make the sentence untrue. `newMember`
+      // captures it, so every member has one by the time it can be spawned.
       const persona = member.persona || memberPersona(member)
       member.persona = persona
       const prompt = initialPrompt(member, initialTask, mode)
@@ -1404,8 +1577,7 @@ export function apply(ctx) {
         // 'office' rather than '' so the framing records a real, non-member sender.
         try { if (rootOf(agent) === agent) return 'office' } catch (e) { /* fall through */ }
         // An unrelated child agent: report no member. Member-only writes refuse with
-        // V5_MEMBER_NOT_FOUND (that guard is what makes guessing unnecessary), and the
-        // office-capable tools treat '' as the office.
+        // V5_MEMBER_NOT_FOUND (that guard is what makes guessing unnecessary).
         return ''
       }
       // No session id at all (a synthetic exec context). Only here may we fall back to
@@ -1413,6 +1585,22 @@ export function apply(ctx) {
       const c = currentMember
       return (c && memberById(c)) ? c : ''
     }
+    // Is this caller PROVABLY the office — the session root itself? `memberIdOfAgent` answers
+    // 'office' both for the root AND for any descendant of the root that is not a member child
+    // (a dismissed member's stale child, a nested helper agent), so it cannot tell them apart;
+    // only the direct root test can (audit L6). `isOffice(id)` no longer treats '' as the office
+    // either, so the office-capable handlers resolve their caller HERE and refuse on ''.
+    function isProvablyOffice(agent) {
+      try { return !!agent && sessionIdOf(agent) !== undefined && rootOf(agent) === agent } catch (e) { return false }
+    }
+    // The caller of an OFFICE-ONLY tool: a real member id, or 'office' when the caller is
+    // provably the session root, or '' when nobody can be identified. The tool handler must
+    // refuse on '' (V5_MEMBER_NOT_FOUND) instead of impersonating the office (audit L6).
+    function officeCaller(agent) {
+      const id = memberIdOfAgent(agent)
+      if (id && id !== 'office') return id
+      return isProvablyOffice(agent) ? 'office' : ''
+    }
 
     // ---- prompts ----------------------------------------------------------
     // The charter lives in `persona` (permanent). Every ROUND prompt therefore
@@ -1448,9 +1636,9 @@ export function apply(ctx) {
       L.push('  "task_update": {"task_id":"t-3","expected_revision":2,"action":"complete|release|reopen|edit|set_dependencies|delete"},')
       L.push('  "input": "本轮会议/辩论的发言正文（会议轮用；也可直接用 say）",')
       if (formalOn()) {
-        L.push('  "formal": {"target":"p-x","decision":"used|blocked|defect","file":"Formal/p-x.lean","note":"难度判断/阻塞原因"}')
+        L.push('  "formal": {"target":"p-x","decision":"used|blocked|defect","file":"Formal/p-x.lean","note":"难度判断（used）/ 阻塞原因（blocked）/ 具体偏差（defect）"}')
         L.push('             ← Lean 形式化：' + (formalMode() === 'require'
-          ? '**强制**：定论前必须有「Lean 已通过」或显式阻塞原因（note 必填），否则本轮裁定记为未定论，'
+          ? '**强制**：定论前必须有「Lean 已通过」或显式的阻塞记录（decision=\'blocked\' + note；used 的 note 不算），否则本轮裁定记为未定论，'
           : '**鼓励**：按实现难度自行决定；做了就归档，没做就写明难度判断，') + '详见提示词里的【Lean 形式化验证】段')
       }
       L.push('  "reject_assign": {"task_id":"t-3","why":"你对这项分派的异议理由"}   ← 有异议时填；理由会被广播给')
@@ -1605,7 +1793,7 @@ export function apply(ctx) {
         // The formal field belongs in the VOTING contract too: voters are exactly the agents
         // who must either formalize the object or record why they judged it infeasible.
         L.push('若你本轮做了形式化或给出难度判断，请一并加上：')
-        L.push('{"formal":{"target":"' + vs.target + '","decision":"used|blocked|defect","file":"Formal/' + vs.target + '.lean","note":"难度判断/阻塞原因"}}')
+        L.push('{"formal":{"target":"' + vs.target + '","decision":"used|blocked|defect","file":"Formal/' + vs.target + '.lean","note":"难度判断（used）/ 阻塞原因（blocked）/ 具体偏差（defect）"}}')
       }
       return L.join('\n')
     }
@@ -1844,24 +2032,33 @@ export function apply(ctx) {
         updatedAt: now(),
       }))
     }
-    // Withdrawing an archived proof needs a DELETE, but the fs service exposes no unlink and
-    // subprocess is optional. Use the shell when it is available; otherwise overwrite the
-    // file with an explicit withdrawal notice, so it can never be read as the object's proof.
+    // Withdrawing an archived proof means the file must stop looking like the object's proof.
+    // The POLICY-COMPLIANT route is an overwrite through the injected `fs` service (it carries
+    // `getPolicy()`); the platform shell is only a fallback, because `subprocess.spawn` has no
+    // policy slot and the shell path therefore sat outside a confining deployment's fs policy
+    // (audit M8). A stub host whose shell exits 0 without deleting anything is also handled by
+    // the read-back check.
     async function removeArchivedProof(rel) {
       const abs = leanAbsPath(rel)
       if (abs === null) return false
+      const withdrawn = '-- 已撤回（' + fmtTime() + '）：该形式化被认定与命题原文不一致。\n'
+        + '-- 原代码保留在工作文件 Formal/' + String(rel).split('/').pop() + '；修正并重新跑通后重新归档。\n'
+      // 1) the fs service (policy-confined) — an overwritten file is no longer a proof.
+      if ((await writeTextAbs(abs, withdrawn)) !== undefined) {
+        const nowText = await readTextAbs(abs)
+        if (nowText !== undefined && nowText.indexOf('已撤回') !== -1) return true
+      }
+      // 2) guarded fallback: a real DELETE through the platform shell, when it exists.
       const sub = subprocessOf()
       if (sub !== undefined && typeof sub.spawn === 'function') {
         const script = isWindows()
           ? 'Remove-Item -LiteralPath ' + psQuote(abs) + ' -Force -ErrorAction SilentlyContinue'
           : 'rm -f ' + shQuote(abs)
         try { await runShell(script) } catch (e) { /* fall through to the overwrite */ }
-        // A shell that exits 0 without removing anything (a stub host, a permissions quirk)
-        // must not leave a withdrawn proof where everyone looks for proofs: verify, fall back.
         if (await readTextAbs(abs) === undefined) return true
       }
-      return (await writeTextAbs(abs, '-- 已撤回（' + fmtTime() + '）：该形式化被认定与命题原文不一致。\n'
-        + '-- 原代码保留在工作文件 Formal/' + String(rel).split('/').pop() + '；修正并重新跑通后重新归档。\n')) !== false
+      // 3) last resort: the overwrite again, in case the delete recreated/left the file.
+      return (await writeTextAbs(abs, withdrawn)) !== undefined
     }
     // A formalization that says something else than the proposition is NOT a refutation:
     // withdraw the proof instead of letting the group conclude 假 (contract §4.1).
@@ -1886,9 +2083,12 @@ export function apply(ctx) {
       // overwrite also fails. The record is downgraded either way, so say it out loud:
       // otherwise the stale file stays at the exact path everyone looks for proofs, and
       // nothing in any prompt or index would disclose that the withdrawal was incomplete.
+      // `removed` means the archive no longer reads as a proof — either deleted, or
+      // OVERWRITTEN with the withdrawal notice (the fs-service route). Name both honestly:
+      // "deleted" would be false whenever the policy-confined overwrite was the route.
       const stillThere = removed ? [] : ['｜⚠ 归档证明 ', proofRel, ' 未能撤回（宿主删除与覆盖均失败）；记录已降级，请不要把它当作该对象的证明。']
       await saveChatLine('【形式化】' + (memberId || '成员') + ' 认定 ' + t + ' 的形式化**不忠实**：' + why
-        + ' —— 已撤回「已通过」状态' + (removed ? '并从 Verified/Lean/ 删除归档证明' : '') + '；请修正形式化、重新跑通后再投票。' + stillThere.join(''))
+        + ' —— 已撤回「已通过」状态' + (removed ? '，并已使 Verified/Lean/ 中的归档证明失效（删除或覆盖为撤回声明）' : '') + '；请修正形式化、重新跑通后再投票。' + stillThere.join(''))
       return { ok: true, target: t, status: 'attempted', removed }
     }
     function formalPromptBlock(target) {
@@ -1930,14 +2130,16 @@ export function apply(ctx) {
         L.push('  · **一旦 Lean 通过，你唯一需要确认的就是忠实性**：定义 / 对象 / 条件 / 假设 / 结论是否与')
         L.push('    命题原文逐条一致。请把注意力放在这种核对上，而不是重新做一遍推导。')
         if (mode === 'require') {
-          L.push('  · **本模式要求**：必须产出 Lean 形式化，或**必须**给出显式的阻塞原因（vibe_v5_lean_archive')
-          L.push('    kind=\'blocked\' note=… 或回执 formal.note）。若两者都没有，本次裁定不会生效，')
+          L.push('  · **本模式要求**：必须产出 Lean 形式化，或**必须**给出显式的阻塞原因——用')
+          L.push("    vibe_v5_lean_archive kind='blocked' note=… 记录，或用回执 formal:{decision:'blocked', note:…}。")
+          L.push('    只有 decision=\'blocked\' 的 note 会写成阻塞记录；decision=\'used\' 的 note 只是难度判断，')
+          L.push('    **不会**打开定论门禁。两者都没有时，本次裁定不会生效，')
           L.push('    会被记为未定论（原因 formal-required）并进入「形式化待办」。')
         } else {
           L.push("  · 若你判断不值得或无法形式化，可以不做，但请在回执的 formal 字段写明难度判断（decision='blocked' 时必须写明 note）。")
         }
         L.push('  · 归档可复用定义/引理前先跑通（vibe_v5_lean_archive run=true 或先 vibe_v5_lean_run）；跑不通不要入库。')
-        L.push('  · 宿主没有 Lean 工具链（LEAN_NOT_FOUND）或根本没有 subprocess 服务（NO_SUBPROCESS）时：把代码写下来归档，并在回执的 note 里写明"宿主无 Lean 工具链"——这两种都算显式阻塞原因，定论门禁可以据此放行。')
+        L.push('  · 宿主没有 Lean 工具链（LEAN_NOT_FOUND）或根本没有 subprocess 服务（NO_SUBPROCESS）时：把代码写下来归档，并把"宿主无 Lean 工具链"写成**阻塞记录**（vibe_v5_lean_archive kind=\'blocked\' note=… 或回执 formal:{decision:\'blocked\', note:…}）——这算显式阻塞原因，定论门禁可以据此放行。')
       }
       return L.join('\n')
     }
@@ -2033,8 +2235,8 @@ export function apply(ctx) {
         await writeFormalIndex()
       }
       if (run.ok) {
-        await saveChatLine('【形式化】' + (memberId || 'office') + ' 运行 Lean 通过：' + run.file
-          + '（' + (run.ms / 1000).toFixed(1) + 's）' + (args.target ? '｜对象 ' + args.target + ' 记为已尝试/已通过' : ''))
+        await saveChatLine('【形式化】' + memberId + ' 运行 Lean 通过：' + run.file
+          + '（' + (run.ms / 1000).toFixed(1) + 's）' + (args.target ? '｜对象 ' + args.target + ' 记为已尝试（若此前已通过/已阻塞则保留原状态）' : ''))
       }
       return Object.assign({ ok: !!run.ok }, run, {
         hint: run.ok
@@ -2125,7 +2327,7 @@ export function apply(ctx) {
     // (b) in the same wake as a soft-compact directive — never on every round. The
     // charter itself lives in `persona` and needs no reinforcement otherwise.
     const CORE_RULES = '[核心规则] 只有 Verified/（及标记"已验证·真/假"的卡片）算已确立；' +
-      '任何对象要进 Verified/ 必须 ≥m 名有表决权者一致给出 1 或 0，否则留库附平均概率；' +
+      '任何对象要进 Verified/，必须至少有 m 名有表决权者投出布尔值（恰好 1 或恰好 0）**且没有任何一张反向票**，否则留库附平均概率；' +
       '你只写自己的库（Members/<你>/），可只读任何人的库；组织与分派由院士负责，但判断属于你自己；' +
       '退出时只输出一个 JSON 对象。'
 
@@ -2145,12 +2347,24 @@ export function apply(ctx) {
     }
 
     // ---- artifact libraries (per member, append/write by the member itself) ----
-    const isOffice = (id) => !id || id === 'office'
+    // ONLY the literal 'office' is the office. An EMPTY id means "nobody identifiable" and is
+    // NOT the office: `memberIdOfAgent` answers '' for an unrelated descendant of the root (a
+    // dismissed member's stale child, a nested helper under the office root) and for a synthetic
+    // context with no known member, so `!id || id === 'office'` let such a caller pass EVERY
+    // office gate and sign its writes as the office (audit L6 follow-up). Office-capable tool
+    // handlers now resolve their caller with `officeCaller` and refuse on '' before reaching
+    // here; this predicate fails closed as the second line of defence.
+    const isOffice = (id) => id === 'office'
     const isAcademician = (id) => { const m = memberById(id); return !!m && m.kind === 'academician' }
-    function bumpArtifacts() {
+    // MUST be awaited by its callers: `inst()` reads `stateCache`, which `commit` only updates
+    // once its own await resolves. Fire-and-forget here meant two cards written in one reply
+    // (a single reply can carry `record: [ … ]`) both read the same `artifactCount` and
+    // committed the same `n`, and the `meetingKeepEvery` auto-sync could fire twice on one
+    // count (audit M6).
+    async function bumpArtifacts() {
       const inst0 = inst()
       const n = (Number(inst0.artifactCount) || 0) + 1
-      commit(EV.progress, { at: now(), artifactCount: n }).catch(() => {})
+      await commit(EV.progress, { at: now(), artifactCount: n })
       // Auto-sync meeting every `meetingKeepEvery` artifacts: the framework only
       // CONVENES it, never assigns work. Deferred while a meeting or verification is
       // already in progress so consensus is never preempted (v4 §26).
@@ -2191,7 +2405,7 @@ export function apply(ctx) {
         '- ID: ' + id,
         '- 类型: ' + (kind === 'proposition' ? '命题' : kind === 'method' ? String(args.type || '方法') : '子问题'),
         '- 状态: ' + (kind === 'proposition' ? '未定论' : kind === 'method' ? '经验' : '求解中'),
-        kind === 'proposition' ? '- 概率: ' + clamp01(args.p).toFixed(2) : '- 概率: ' + clamp01(args.p).toFixed(2),
+        '- 概率: ' + clamp01(args.p).toFixed(2),
         '- 价值程度: ' + clamp01(args.value).toFixed(2),
         '- 动机用途计划: ' + String(args.motive),
         '- 记录者: ' + memberId,
@@ -2209,7 +2423,7 @@ export function apply(ctx) {
       }
       const ok = await writeTextRel(rel, head.concat(body).join('\n'))
       if (!ok) return { ok: false, code: 'V5_WRITE_FAILED', message: 'could not write ' + rel }
-      bumpArtifacts()
+      await bumpArtifacts()
       notifyActivity()
       return { ok: true, id, file: rel, kind }
     }
@@ -2334,6 +2548,10 @@ export function apply(ctx) {
       return taskView(t)
     }
     async function taskUpdate(memberId, o) {
+      // An unknown caller must be refused HERE as well: `owner = task.ownerId === memberId` is true
+      // for an UNOWNED task (ownerId '') when memberId is '', so without this guard an
+      // unidentifiable caller would count as the owner of every unclaimed task (audit L6 follow-up).
+      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       const args = o || {}
       const id = String(args.task_id || args.taskId || '')
       const task = inst().tasks.find((x) => x.id === id)
@@ -2430,6 +2648,7 @@ export function apply(ctx) {
     // it can never make any statement true, and the assignee may object with reasons
     // (the objection is broadcast, not silently swallowed).
     async function taskAssign(memberId, o) {
+      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       if (!isOffice(memberId) && !(isAcademician(memberId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can assign tasks' }
       }
@@ -2473,6 +2692,7 @@ export function apply(ctx) {
       return { ok: true, task: taskView(withMeta) }
     }
     async function taskPrioritize(memberId, o) {
+      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       if (!isOffice(memberId) && !(isAcademician(memberId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can set priorities' }
       }
@@ -2551,7 +2771,6 @@ export function apply(ctx) {
     }
 
     // ---- consensus verification (m-vote boolean) --------------------------
-    function verifyRecords() { return Object.keys(inst().verdicts) }
     function currentVerify() {
       const vs = inst().verdicts
       for (const k of Object.keys(vs)) { if (vs[k] && !vs[k].closed) return vs[k] }
@@ -2632,6 +2851,9 @@ export function apply(ctx) {
     // in the mean. Any opposing assertion BLOCKS the verdict, so a minority can never
     // be out-voted by abstention.
     function judgeVerdict(vs) {
+      // E = the LIVE voter set (roster, recomputed on every call). A ballot cast by someone
+      // who is no longer in E — a dismissed member whose entry survived in `vs.votes` — is
+      // NOT counted, in either mode: `Verified/` may only ever be reached by current voters.
       const E = voters().map((m) => m.id)
       const P = E.length
       const m = quorumM()
@@ -2666,6 +2888,35 @@ export function apply(ctx) {
       if (bFalse >= m && bTrue === 0) return Object.assign(base, { outcome: 'false', reason: bFalse + ' >= m=' + m + ', all assert false' })
       return Object.assign(base, { outcome: 'undecided', reason: 'quorum not met' })
     }
+    // ONE atomic append to the durable verify queue. The duplicate check and the append both run
+    // INSIDE the event fold, so two proposals made in the same tick can no longer both read the
+    // same array and overwrite each other's entry (the audit's lost-proposal race: a
+    // `Promise.all` of two `vibe_v5_propose_verify` calls kept only the second, while both calls
+    // reported `ok:true` and the first target existed in neither the queue nor `verdicts`).
+    async function appendToQueue(entry) {
+      let result = { appended: false, length: 0 }
+      await commit(EV.queue, { queue: (cur) => {
+        const list = Array.isArray(cur) ? cur : []
+        if (list.some((p) => p && p.target === entry.target)) { result = { appended: false, length: list.length }; return list }
+        const next = list.concat([entry])
+        result = { appended: true, length: next.length }
+        return next
+      } })
+      return result
+    }
+    // Remove and return the head in ONE atomic commit: an append landing in between can never be
+    // lost by it, and a removed entry can never be resurrected by an append that read the queue
+    // before the removal.
+    async function takeQueueHead() {
+      let head = null
+      await commit(EV.queue, { queue: (cur) => {
+        const list = Array.isArray(cur) ? cur : []
+        if (!list.length) return list
+        head = list[0]
+        return list.slice(1)
+      } })
+      return head
+    }
     // Queue a proposal UNLESS the same object was just closed as 真/假 (a dedup window
     // prevents several members independently proposing the same object in one tick
     // from running it end-to-end twice — v4 §26 test9).
@@ -2676,18 +2927,20 @@ export function apply(ctx) {
       if (recent !== undefined && (now() - recent) < recoverStallMs()) {
         return { ok: true, deduped: true, message: t + ' 刚刚定论，忽略重复提议' }
       }
-      const q = inst().queue.slice()
-      if (q.some((p) => p.target === t)) return { ok: true, deduped: true, message: t + ' 已在验证队列中' }
-      if (currentVerify() && currentVerify().target === t) return { ok: true, deduped: true, message: t + ' 正在验证中' }
-      q.push({ target: t, kind: kind || guessTargetKind(t), proposer: isOffice(proposer) ? 'office' : proposer, reason: String(reason || ''), at: now() })
-      await putQueue(q)
+      const cv = currentVerify()
+      if (cv && cv.target === t) return { ok: true, deduped: true, message: t + ' 正在验证中' }
+      const added = await appendToQueue({
+        target: t, kind: kind || guessTargetKind(t),
+        proposer: isOffice(proposer) ? 'office' : proposer, reason: String(reason || ''), at: now(),
+      })
+      if (!added.appended) return { ok: true, deduped: true, message: t + ' 已在验证队列中' }
       notifyActivity()
       // Start it NOW rather than hoping a scheduling pass reaches it. A pass may already
       // be in flight and PAST its arming point, in which case a bare `scheduleNext()`
       // only sets the trampoline flag and the proposal waits for the next iteration.
       await armNextVerify()
       if (!hasVerifyInFlight()) await scheduleNext()
-      return { ok: true, queued: t, pendingVerifyCount: q.length, started: hasVerifyInFlight() }
+      return { ok: true, queued: t, pendingVerifyCount: added.length, started: hasVerifyInFlight() }
     }
     async function beginVerify(proposal) {
       dbg.begin += 1
@@ -2875,8 +3128,7 @@ export function apply(ctx) {
       // `maybeQueueVerify` calls this directly (bypassing schedulePass, whose meeting
       // check is what used to hide the asymmetry). The meeting's watchdog clock would
       // then be starved while two coordination processes competed for the same members.
-      // The proposal stays in the queue; schedulePass reaches this again once the
-      // meeting is over.
+      // The proposal stays in the queue; schedulePass reaches this again once the meeting is over.
       if (meeting) return
       // Only one begin may be in flight. Without this, two callers (a scheduling pass
       // and a fresh proposal) could both pass the `currentVerify()` check before either
@@ -2885,10 +3137,21 @@ export function apply(ctx) {
       if (currentVerify()) return
       beginLock = true
       try {
-        const q = inst().queue.slice()
-        while (q.length) {
-          const p = q.shift()
-          await putQueue(q)
+        while (true) {
+          // NEVER remove a proposal we are not about to run: the entry leaves the durable
+          // queue only in the same step that starts it. The old code shifted it out and then
+          // returned because a meeting was live, so the proposal existed in neither the queue
+          // nor `verdicts` until some later pass happened to re-arm it (audit M2). Re-check
+          // the exclusion guards here too: `await putQueue` can let a meeting open.
+          const q = inst().queue.slice()
+          if (!q.length) return
+          if (meeting || currentVerify()) return
+          // Take the head in ONE atomic commit (`takeQueueHead` re-reads the queue inside the
+          // fold). The exclusion guards above are deliberately NOT re-checked inside it: a third
+          // copy of them would make the sensitivity probes that remove the two real copies inert
+          // (they would still hold, and the suite would look like a blind spot).
+          const p = await takeQueueHead()
+          if (!p) return
           const recent = verifiedRecently.get(p.target)
           if (recent !== undefined && (now() - recent) < recoverStallMs()) continue
           const vs = await beginVerify(p)
@@ -3283,6 +3546,16 @@ export function apply(ctx) {
       roundsSinceCompact.delete(id)
       contextPct.delete(id)
       seeds.delete(id)
+      // A dismissed member is no longer a voter: drop its ballot from every OPEN verdict, so
+      // a verdict that has not closed yet can never be carried by a former member's vote
+      // (audit H2). `judgeVerdict` reads only the live roster anyway; this keeps the durable
+      // record honest too. Already-closed verdicts are history and are left untouched.
+      const openVerdicts = Object.values(inst().verdicts).filter((v) => v && !v.closed && v.votes && v.votes[id] !== undefined)
+      for (const v of openVerdicts) {
+        const votes = Object.assign({}, v.votes)
+        delete votes[id]
+        await putVerdict(v.target, Object.assign({}, v, { votes }))
+      }
       if (meeting) {
         delete meeting.inputs[id]
         delete meeting.extras[id]
@@ -3303,6 +3576,7 @@ export function apply(ctx) {
       return { ok: true, dismissed: id, reclaimedTasks: reclaimed, reason }
     }
     async function nudge(callerId, o) {
+      if (!callerId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       if (!isOffice(callerId) && !(isAcademician(callerId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can nudge members' }
       }
@@ -3382,9 +3656,13 @@ export function apply(ctx) {
       dbg.passes += 1
       clearHeartbeat()
       syncParamsFromState()
-      if (meeting) { await continueMeetingRound(); return }
+      // A verification that is ALREADY in flight is served first: the two coordination
+      // processes are mutually exclusive by construction, so the order only decides which
+      // of two impossible states wins — but checking `meeting` first meant a meeting that
+      // can never close starved the verification's own watchdog forever (audit M3).
       const vs = currentVerify()
       if (vs) { await continueVerifyRound(vs); return }
+      if (meeting) { await continueMeetingRound(); return }
       if (!currentVerify()) {
         await armNextVerify()
         if (hasVerifyInFlight()) return
@@ -3476,30 +3754,6 @@ export function apply(ctx) {
     }
 
     // ---- reply parsing -----------------------------------------------------
-    function tryJson(s) { try { return JSON.parse(s) } catch (e) { return undefined } }
-    function parseReply(text) {
-      let obj
-      const fence = /```(?:json)?[ \t]*([\s\S]*?)```/gi
-      let m
-      while ((m = fence.exec(text)) !== null) {
-        const o = tryJson(String(m[1]).trim())
-        if (o && typeof o === 'object' && !Array.isArray(o)) obj = o
-      }
-      if (!obj) {
-        const w = tryJson(String(text || '').trim())
-        if (w && typeof w === 'object' && !Array.isArray(w)) obj = w
-      }
-      if (!obj) {
-        // Last resort: the outermost {...} span (models sometimes wrap prose around it).
-        const t = String(text || '')
-        const i = t.indexOf('{'), j = t.lastIndexOf('}')
-        if (i !== -1 && j > i) {
-          const o = tryJson(t.slice(i, j + 1))
-          if (o && typeof o === 'object' && !Array.isArray(o)) obj = o
-        }
-      }
-      return obj || {}
-    }
     function normVerdictNumber(v) {
       // verdict is a PURE 0-1 probability. Models often send a quoted number, and a
       // quoted "0.9" used to fall through to a 0.5 default and be silently recorded
@@ -3704,23 +3958,6 @@ export function apply(ctx) {
     // Same guard as v2/v3/v4: `tools.restrict` throws for an unregistered name and the throw escapes
     // child creation, so a stale `vibe_v5_set{toolAllow|toolDeny|tempToolAllow|tempToolDeny}` would
     // make every member spawn fail silently. The host names the registered tools in its rejection.
-    function registeredToolsFromError(message){
-      const m = /known global tools:\s*([^]*)$/.exec(String(message || ''))
-      if(!m) return undefined
-      const names = m[1].split(',').map(function(s){ return s.trim() }).filter(Boolean)
-      return names.length > 0 ? new Set(names) : undefined
-    }
-    function sanitizeToolFilter(filter, known){
-      if(!filter || !(known instanceof Set) || known.size === 0) return filter
-      const out = {}
-      for(const key of ['allow','deny']){
-        const list = filter[key]
-        if(!Array.isArray(list)) continue
-        const kept = list.filter(function(n){ return known.has(String(n).trim()) })
-        if(kept.length > 0) out[key] = kept
-      }
-      return (out.allow || out.deny) ? out : undefined
-    }
     async function startWithToolFilter(toolFilter, makeSpec){
       try {
         return await subagents.startContinuable(makeSpec(toolFilter))
@@ -3803,6 +4040,14 @@ export function apply(ctx) {
       if (out.leanTimeoutMs !== undefined) out.leanTimeoutMs = Math.max(1000, out.leanTimeoutMs)
       if (out.researcherCount !== undefined && out.researcherCount < 0) out.researcherCount = 0
       if (out.quorumCap !== undefined && out.quorumCap < 1) out.quorumCap = 1
+      // NOT every non-positive number is harmless (audit L3). `compactThreshold <= 0` makes
+      // EVERY round look over the threshold (a permanent compaction directive), so it falls back
+      // to the default like a bad duration; `chatDigestMax < 1` would empty the digest bucket and
+      // `verdictMaxRounds < 1` silently collapsed every debate to a single round, so both floor
+      // at the smallest value that still means what the name says.
+      if (out.compactThreshold !== undefined && !(out.compactThreshold > 0)) delete out.compactThreshold
+      if (out.chatDigestMax !== undefined && out.chatDigestMax < 1) out.chatDigestMax = 1
+      if (out.verdictMaxRounds !== undefined && out.verdictMaxRounds < 1) out.verdictMaxRounds = 1
       return out
     }
     async function setParams(input) {
@@ -3837,6 +4082,12 @@ export function apply(ctx) {
     }
     async function configure(args) {
       const a = args || {}
+      // READ THE FILE FOR THE PATH THIS SESSION WAS ALREADY POINTED AT BEFORE ANY WORK.
+      // configure ends in a whole-snapshot commit; without this load the commit is exactly
+      // the write that destroyed a previously-run institute's state file (audit H1: the
+      // session's first tool call — typically `vibe_v5_status` — latched the DEFAULT path,
+      // after which `configure {institute:'alpha'}` never read alpha's file).
+      await ready()
       // configure is the PRE-START setup tool. Switching project/institute while a run
       // is live would split its state across two trees: the members' libraries and
       // briefs point at the OLD root while every later write goes to the NEW one.
@@ -3852,14 +4103,25 @@ export function apply(ctx) {
         const np = patch.project !== undefined ? patch.project : project
         const ni = patch.institute !== undefined ? patch.institute : instituteName
         const nkey = np + '::' + ni
-        if (nkey !== key && !inst().members.length) {
-          key = nkey
-          project = np
-          instituteName = ni
-          patch.project = np
-          patch.institute = ni
-        } else if (nkey !== key) {
-          return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'this session already holds an institute; use a new session to found another' }
+        if (nkey !== key) {
+          // The requested key lives in a DIFFERENT state file. Read that file first: a
+          // previously-run institute must be adopted, never overwritten with an empty one.
+          const stored = await instituteAt(np, ni, nkey)
+          if (stored && Array.isArray(stored.members) && stored.members.length) {
+            key = nkey
+            project = np
+            instituteName = ni
+            patch.project = np
+            patch.institute = ni
+          } else if (!inst().members.length) {
+            key = nkey
+            project = np
+            instituteName = ni
+            patch.project = np
+            patch.institute = ni
+          } else {
+            return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'this session already holds an institute; use a new session to found another' }
+          }
         }
       }
       patch.phase = 'idle'
@@ -3904,10 +4166,6 @@ export function apply(ctx) {
         '',
       ].join('\n'))
     }
-    function slugify(s) {
-      const t = String(s == null ? '' : s).trim().toLowerCase().replace(/[^a-z0-9_\-\u4e00-\u9fa5]+/g, '-').replace(/^-+|-+$/g, '')
-      return t || ''
-    }
     async function doStart(args) {
       const a = args || {}
       if (running && !autoDone) return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'already running' }
@@ -4035,6 +4293,8 @@ export function apply(ctx) {
         if (m.childId) continue
         try {
           const seedText = (await readTextRel('Members/' + m.id + '/Progress/progress.md')) || ''
+          // `mode='resume'` is what makes this a RESUME rather than an instruction: the prompt
+          // prints the seed as "恢复说明" (your own log, restored), not as a task to execute.
           await spawnMember(m, seedText ? seedText.slice(-4000) : '（你的 Progress/ 还是空的——请先把当前状态补写进去。）', 'resume')
           respawned += 1
         } catch (e) {
@@ -4050,6 +4310,11 @@ export function apply(ctx) {
       autoDone = false
       phase = 'active'
       await patchInstitute({ phase: 'active', lastProgressAt: now() })
+      // The mirrors must be refreshed on THIS path too (audit M9): resume is the one place
+      // where members' phase/rounds/employer actually change under them, and a staffing table
+      // that contradicts the authoritative roster is the opposite of a mirror's purpose.
+      await writeRosterMirror()
+      await writeTaskboardMirror()
       await saveChatLine('【恢复】研究所继续推进（重建成员 ' + respawned + ' 名）。')
       notifyActivity()
       await scheduleNext()
@@ -4098,6 +4363,9 @@ export function apply(ctx) {
         institute: instituteName, project, key, phase,
         running, autoDone, runId: s.runId,
         backend: backend ? backend.kind : 'uninitialized',
+        // Skipped/malformed events AND state-file load problems. Without this the two
+        // failure modes that silently drop state were invisible in the operator's view.
+        diagnostics: s.diagnostics || [],
         debug: Object.assign({ scheduling, reschedule }, dbg),
         quorum: { m: quorumM(), mode: params.quorumMode, voters: voters().map((m) => m.id), voterCount: voterCount() },
         members: s.members.map((m) => ({
@@ -4176,6 +4444,11 @@ export function apply(ctx) {
       if (pendingMeeting) L.push('- 暂存会议：' + pendingMeeting.agenda)
       L.push('- 历史会议：' + s.meetings.length + ' 次｜辩论录：' + s.debates.length + ' 份')
       L.push('- 解决票：' + (solveVotes.size ? Array.from(solveVotes.entries()).map(([k, v]) => k + '=' + v).join('、') : '（无）'))
+      if ((s.diagnostics || []).length) {
+        L.push('')
+        L.push('## ⚠ 状态诊断（被跳过的事件 / 状态文件读取问题）')
+        for (const d of s.diagnostics.slice(-10)) L.push('- ' + fmtTime(d.at) + '｜' + d.type + '｜' + d.error)
+      }
       L.push('')
       L.push('## Lean 形式化')
       if (!formalOn()) L.push('- 未启用（`formalVerify` = off；可用 vibe_v5_set 切到 encourage / require）')
@@ -4254,7 +4527,7 @@ export function apply(ctx) {
       // consensus / meetings
       maybeQueueVerify, castVerdict, currentVerify, hasVerifyInFlight, startMeeting, quorumM, voterCount,
       // authorization helpers (used by tool handlers)
-      memberIdOfAgent, isOffice, isAcademician, memberById, activeMembers,
+      memberIdOfAgent, isOffice, isAcademician, isProvablyOffice, officeCaller, memberById, activeMembers,
     }
   }
 
@@ -4282,16 +4555,51 @@ export function apply(ctx) {
   }
   const S = { type: 'string' }, N = { type: 'number' }, I = { type: 'integer' }, B = { type: 'boolean' }
   const SA = { type: 'array', items: { type: 'string' } }
+  /**
+   * Resolve the caller of a WRITING tool through `officeCaller` and refuse when nobody can be
+   * identified. `memberIdOfAgent` answers '' for a caller that is neither a member child nor the
+   * session root itself (a dismissed member's stale child, a nested helper under the office root,
+   * a synthetic context with no known member), and the office gates used to treat '' as the office
+   * (`isOffice`), so such a caller could sign assignments/priorities/tasks as 'office' (audit L6
+   * follow-up). A real member id and the provable session root ('office') still pass unchanged.
+   */
+  function withCaller(s, x, what, fn) {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: ' + what + ' needs a resolved member id or the office (the session root)' }
+    return fn(caller)
+  }
+  /**
+   * Resolve the caller of an OFFICE-ONLY control and refuse anything that is not the PROVABLE
+   * session root. `officeCaller` answers 'office' for that root, a member id for a member child, and
+   * '' for everyone else — an unidentifiable descendant of the root (a nested helper, a dismissed
+   * member's stale child) or a context with no session. A member child and the office share ONE
+   * institute session, so without this every lifecycle control (configure/start/resume/pause/stop/
+   * set) could be driven by a member: it could stop the institute or rewrite quorum/params as the
+   * office (audit L6 follow-up). ABSENCE of a caller is not the office either — that is exactly the
+   * shape an unidentifiable caller has, and the tool wrapper already refuses an agent-less call
+   * ('no session') before this point, so nothing here re-admits one.
+   */
+  function withOffice(s, x, what, fn) {
+    const caller = s.officeCaller(x)
+    if (caller !== 'office') {
+      return {
+        ok: false, code: 'V5_NOT_OFFICE',
+        message: 'only the office (the PROVABLE session root) may ' + what +
+          (caller ? '; the caller is member ' + caller : '; no caller could be identified'),
+      }
+    }
+    return fn()
+  }
 
   // ── office / host controls ────────────────────────────────────────────────
-  registerTool('vibe_v5_configure', 'Create/configure the research institute (project, institute name, problem, params) WITHOUT starting it. Use this FIRST, then vibe_v5_start.', objParams({ project: S, institute: S, problem: S, params: { type: 'object' } }), (s, a) => s.configure(a))
-  registerTool('vibe_v5_start', 'Found the institute: create the academician + N permanent researchers and begin. They brainstorm independently, then self-organize (the academician organizes and assigns; the framework only facilitates).', objParams({ problem: S, researcherCount: I, academician: B, params: { type: 'object' }, seedDirections: SA }), (s, a) => s.doStart(a))
-  registerTool('vibe_v5_resume', 'Resume a persisted institute: reconcile members against their durable sessions, rebuild any missing one from its Progress/, refresh consensus watchdogs, and restart scheduling.', objParams({}), (s) => s.resume())
-  registerTool('vibe_v5_pause', 'Pause the institute (in-flight turns finish; no new wakes until resume).', objParams({}), (s) => s.setPause())
-  registerTool('vibe_v5_stop', 'Stop the institute: interrupt every member, clear coordination state, and release their child sessions.', objParams({}), (s) => s.initStop())
+  registerTool('vibe_v5_configure', 'Create/configure the research institute (project, institute name, problem, params) WITHOUT starting it. Use this FIRST, then vibe_v5_start.', objParams({ project: S, institute: S, problem: S, params: { type: 'object' } }), (s, a, x) => withOffice(s, x, 'configure the institute', () => s.configure(a)))
+  registerTool('vibe_v5_start', 'Found the institute: create the academician + N permanent researchers and begin. They brainstorm independently, then self-organize (the academician organizes and assigns; the framework only facilitates).', objParams({ problem: S, researcherCount: I, academician: B, params: { type: 'object' }, seedDirections: SA }), (s, a, x) => withOffice(s, x, 'found the institute', () => s.doStart(a)))
+  registerTool('vibe_v5_resume', 'Resume a persisted institute: reconcile members against their durable sessions, rebuild any missing one from its Progress/, refresh consensus watchdogs, and restart scheduling.', objParams({}), (s, a, x) => withOffice(s, x, 'resume the institute', () => s.resume()))
+  registerTool('vibe_v5_pause', 'Pause the institute (in-flight turns finish; no new wakes until resume).', objParams({}), (s, a, x) => withOffice(s, x, 'pause the institute', () => s.setPause()))
+  registerTool('vibe_v5_stop', 'Stop the institute: interrupt every member, clear coordination state, and release their child sessions.', objParams({}), (s, a, x) => withOffice(s, x, 'stop the institute', () => s.initStop()))
   registerTool('vibe_v5_status', 'Machine-readable institute status (members, tasks, quorum, meetings, verification, mail).', objParams({}), (s) => s.status())
   registerTool('vibe_v5_report', 'Human-readable institute report (staffing, tasks, consensus, meetings, file locations).', objParams({}), (s) => s.report())
-  registerTool('vibe_v5_set', 'Tune institute parameters (persisted in State/<institute>.v5state.json). provider/model override staff LLM routes (empty = inherit the office route). toolAllow/toolDeny restrict PERMANENT staff tools; tempToolAllow/tempToolDeny restrict temp workers. quorumCap sets m = min(quorumCap, voters); quorumMode "m-unanimous" (v5) or "all-unanimous" (v4 legacy). formalVerify: "off" (default, no extra requirement) | "encourage" (agents decide by implementation difficulty whether to formalize in Lean; a passing Lean run turns the vote into a FIDELITY review of the Lean statements) | "require" (same, plus a gate: a true/false verdict is withheld as undecided until the object is Lean-passed or has an explicit reasoned blocker record).', objParams({
+  registerTool('vibe_v5_set', 'Tune institute parameters (persisted in State/<institute>.v5state.json). provider/model override staff LLM routes (empty = inherit the office route). toolAllow/toolDeny restrict PERMANENT staff tools; tempToolAllow/tempToolDeny restrict temp workers. quorumCap sets m = min(quorumCap, voters); an m-vote passes only when at least m Boolean votes (exactly 1 or exactly 0) exist AND no voter returns an opposing Boolean, so with the default roster it degenerates to unanimity among the current voters; only current voters count (a dismissed member\'s earlier ballot is dropped). quorumMode "m-unanimous" (v5) or "all-unanimous" (v4 legacy). formalVerify: "off" (default, no extra requirement) | "encourage" (agents decide by implementation difficulty whether to formalize in Lean; a passing Lean run turns the vote into a FIDELITY review of the Lean statements) | "require" (same, plus a gate: a true/false verdict is withheld as undecided until the object is Lean-passed or has an explicit reasoned blocker record).', objParams({
     academician: B, academicianLeads: B, memberMayRejectAssign: B, researcherCount: I,
     quorumCap: I, quorumMode: S, verdictMaxRounds: I,
     maxTempPerMember: I, maxTempTotal: I,
@@ -4300,20 +4608,49 @@ export function apply(ctx) {
     formalVerify: { type: 'string', enum: ['off', 'encourage', 'require'] },
     leanCommand: S, leanArgs: SA, leanTimeoutMs: I,
     provider: S, model: S, staffPersona: S, toolAllow: SA, toolDeny: SA, tempToolAllow: SA, tempToolDeny: SA,
-  }), (s, a) => s.setParams(a))
-  registerTool('vibe_v5_message', 'Relay a message from the office/human into the institute (to a member id, to "all", or to "voters").', objParams({ to: S, content: S }, ['to', 'content']), (s, a) => {
+  }), (s, a, x) => withOffice(s, x, 'tune institute parameters', () => s.setParams(a)))
+  registerTool('vibe_v5_message', 'Relay a message from the office/human into the institute (to a member id, to "all", or to "voters").', objParams({ to: S, content: S }, ['to', 'content']), (s, a, x) => {
+    // The relay is SIGNED as the office (`say('office', …)`), so only the PROVABLE session root may
+    // send it. `memberIdOfAgent` answers '' for an unidentifiable descendant of the root (a nested
+    // helper, a dismissed member's stale child) and for a synthetic context, and a member child is
+    // not the office either — without this check ANY caller's text was delivered as the office
+    // (audit L6 follow-up; the tool's own description says "from the office/human").
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: relaying a message as the office needs the office (the session root)' }
+    if (caller !== 'office') return { ok: false, code: 'V5_NOT_OFFICE', message: 'vibe_v5_message relays the OFFICE voice; a member speaks with vibe_v5_say' }
     const to = String(a.to || 'all')
     return s.say('office', { to, text: String(a.content), kind: to === 'all' || to === 'voters' ? 'office' : 'dm' })
   })
-  registerTool('vibe_v5_meeting', 'Convene a meeting (office/academician) or propose one (any other member — relayed to the academician/office). Parked automatically while a verification is in flight.', objParams({ agenda: S, kind: { type: 'string', enum: ['sync', 'division', 'verify-request', 'solve-vote'] }, target: S }, ['agenda']), (s, a, x) => s.startMeeting(s.memberIdOfAgent(x) || 'office', a))
+  registerTool('vibe_v5_meeting', 'Convene a meeting (office/academician) or propose one (any other member — relayed to the academician/office). Parked automatically while a verification is in flight. kind picks the meeting type: "sync" = routine coordination (default), "division" = split the work, "verify-request" = ask the group to verify an object, "solve-vote" = put "is the original problem solved?" to a vote; target names the object for verify-request/solve-vote.', objParams({ agenda: S, kind: { type: 'string', enum: ['sync', 'division', 'verify-request', 'solve-vote'] }, target: S }, ['agenda']), (s, a, x) => {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may convene/propose a meeting' }
+    return s.startMeeting(caller, a)
+  })
   registerTool('vibe_v5_members', 'List the institute roster (office, employer, phase, direction, rounds).', objParams({}), (s) => ({ ok: true, members: s.status().members, quorum: s.status().quorum }))
-  registerTool('vibe_v5_hire', 'Hire one temp worker (office; the academician and every permanent researcher may also hire their own). Requires purpose and initial_task.', objParams({ purpose: S, initial_task: S, direction: S, term: S, to: S }, ['purpose', 'initial_task']), (s, a, x) => {
-    const caller = a.to ? String(a.to) : (s.isOffice(s.memberIdOfAgent(x)) ? 'office' : s.memberIdOfAgent(x))
+  registerTool('vibe_v5_hire', 'Hire one temp worker (office; the academician and every permanent researcher may also hire their own). Requires purpose and initial_task. term (optional) is the task deadline/period text the worker is told at onboarding; direction (optional) states what it should work on.', objParams({ purpose: S, initial_task: S, direction: S, term: S, to: S }, ['purpose', 'initial_task']), (s, a, x) => {
+    const caller = a.to ? String(a.to) : s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may hire' }
     return s.hire(caller, a)
   })
-  registerTool('vibe_v5_fire', 'Dismiss a temp worker for real: cancel its turn, release its resident child, reclaim its tasks, drop its mail, and mark it dismissed (its id is never reused).', objParams({ id: S, reason: S }, ['id']), (s, a, x) => s.fire(s.memberIdOfAgent(x) || 'office', a))
-  registerTool('vibe_v5_add_researcher', 'Office only: hire another PERMANENT researcher (members may only propose this).', objParams({ direction: S }), (s, a, x) => s.addResearcher(s.memberIdOfAgent(x) || 'office', a && a.direction))
-  registerTool('vibe_v5_remove_researcher', 'Office only: dismiss a PERMANENT researcher.', objParams({ id: S }, ['id']), (s, a) => s.removeResearcher(a.id))
+  registerTool('vibe_v5_fire', 'Dismiss a temp worker for real: cancel its turn, release its resident child, reclaim its tasks, drop its mail, and mark it dismissed (its id is never reused).', objParams({ id: S, reason: S }, ['id']), (s, a, x) => {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or the employer may fire' }
+    return s.fire(caller, a)
+  })
+  registerTool('vibe_v5_add_researcher', 'Office only: hire another PERMANENT researcher (members may only propose this).', objParams({ direction: S }), (s, a, x) => {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: adding a permanent researcher is the office\'s decision (the session root)' }
+    return s.addResearcher(caller, a && a.direction)
+  })
+  // "Office only" (the tool's own description) must be ENFORCED, not just documented: the handler
+  // used to call `removeResearcher` with no caller at all, so any member child — or an
+  // unidentifiable descendant of the root — could dismiss a PERMANENT researcher (audit L6
+  // follow-up; the academician can only PROPOSE additions/removals).
+  registerTool('vibe_v5_remove_researcher', 'Office only: dismiss a PERMANENT researcher.', objParams({ id: S }, ['id']), (s, a, x) => withCaller(s, x, 'removing a permanent researcher', (caller) => (
+    s.isOffice(caller)
+      ? s.removeResearcher(a.id)
+      : { ok: false, code: 'V5_NOT_OFFICE', message: 'only the office (the session root) may dismiss a permanent researcher' }
+  )))
 
   // ── member-facing controls ────────────────────────────────────────────────
   registerTool('vibe_v5_say', '(member) Speak in the group chat (omit "to"), send a private message ("to":"r-2"), or address only the voters ("to":"voters").', objParams({ text: S, to: S }, ['text']), (s, a, x) => {
@@ -4337,12 +4674,12 @@ export function apply(ctx) {
   registerTool('vibe_v5_record_method', '(member) Record a theory/method/tool in your library. REQUIRES value, motive and p.', objParams({ id: S, title: S, type: S, content: S, notation: S, value: N, motive: S, p: N }, ['content', 'value', 'motive', 'p']), (s, a, x) => s.recordCard(s.memberIdOfAgent(x), 'method', a))
   registerTool('vibe_v5_record_subproblem', '(member) Record a sub-problem in your library. REQUIRES value, motive and p.', objParams({ id: S, title: S, statement: S, value: N, motive: S, p: N }, ['statement', 'value', 'motive', 'p']), (s, a, x) => s.recordCard(s.memberIdOfAgent(x), 'subproblem', a))
   registerTool('vibe_v5_read_library', '(member) Read anyone\'s library (read-only): their progress and recorded cards. Omit member to read everyone.', objParams({ member: S, kind: S, id: S }), (s, a) => s.readLibrary(a))
-  registerTool('vibe_v5_propose_verify', '(member) Propose an object for consensus verification. Any member may propose; only voting members decide.', objParams({ target: S, kind: S, reason: S }, ['target']), (s, a, x) => s.maybeQueueVerify(a.target, a.kind, s.memberIdOfAgent(x), a.reason))
+  registerTool('vibe_v5_propose_verify', '(member) Propose an object for consensus verification. Any member may propose; only voting members decide.', objParams({ target: S, kind: S, reason: S }, ['target']), (s, a, x) => withCaller(s, x, 'a verification proposal', (caller) => s.maybeQueueVerify(a.target, a.kind, caller, a.reason)))
   registerTool('vibe_v5_verdict', '(member) Cast your boolean verdict on the object under verification. verdict is [0,1]: exactly 1 = assert true, exactly 0 = assert false, anything in between = abstention (not counted toward m, counted in the mean).', objParams({ target: S, verdict: N, reason: S }, ['verdict']), (s, a, x) => s.castVerdict(s.memberIdOfAgent(x), a.target, a.verdict, a.reason))
-  registerTool('vibe_v5_task_create', '(member) Open a task on the shared board (subject, description, optional blockers, advisory write scopes, priority).', objParams({ subject: S, description: S, blocked_by: SA, write_scopes: SA, priority: I }, ['subject']), (s, a, x) => s.taskCreate(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_task_create', '(member) Open a task on the shared board (subject, description, optional blockers, advisory write scopes, priority).', objParams({ subject: S, description: S, blocked_by: SA, write_scopes: SA, priority: I }, ['subject']), (s, a, x) => withCaller(s, x, 'creating a task', (caller) => s.taskCreate(caller, a)))
   registerTool('vibe_v5_task_list', '(member) List shared tasks with readiness, owner, revision, blockers and write-scope warnings.', objParams({ status: S, owner: S, ready: B }), (s, a) => ({ ok: true, tasks: s.taskList(a) }))
   registerTool('vibe_v5_task_get', '(member) Read one task\'s latest value BEFORE changing it (the revision is the CAS precondition).', objParams({ task_id: S }, ['task_id']), (s, a) => ({ ok: true, task: s.getTask(a.task_id) }))
-  registerTool('vibe_v5_task_update', '(member) Compare-and-set a task action: claim|release|edit|set_dependencies|complete|reopen|reassign|delete. Pass expected_revision from task_get/task_list; a stale revision is refused.', objParams({ task_id: S, expected_revision: I, action: S, subject: S, description: S, blocked_by: SA, write_scopes: SA, owner: S }, ['task_id', 'expected_revision', 'action']), (s, a, x) => s.taskUpdate(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_task_update', '(member) Compare-and-set a task action: claim|release|edit|set_dependencies|complete|reopen|reassign|delete. Pass expected_revision from task_get/task_list; a stale revision is refused.', objParams({ task_id: S, expected_revision: I, action: S, subject: S, description: S, blocked_by: SA, write_scopes: SA, owner: S }, ['task_id', 'expected_revision', 'action']), (s, a, x) => withCaller(s, x, 'a task mutation', (caller) => s.taskUpdate(caller, a)))
 
   // ── the academician's organizational tools ────────────────────────────────
   registerTool('vibe_v5_overview', '(academician) Institute-wide view: roster, task board, every member\'s Progress tail, recent chat, and stall warnings. Use it instead of guessing.', objParams({}), async (s) => {
@@ -4384,17 +4721,17 @@ export function apply(ctx) {
     parts.push('- 距上次实质进展：' + Math.round(idleFor / 1000) + ' 秒')
     return { ok: true, overview: parts.join('\n') }
   })
-  registerTool('vibe_v5_assign', '(academician) ASSIGN work: create or pick a task and give it to a specific member (including temp workers), stating WHY and the acceptance criteria. The assignee executes by default and may object with reasons (which are broadcast).', objParams({ task_id: S, subject: S, description: S, to: S, why: S, acceptance: S, priority: I, write_scopes: SA }, ['to', 'why', 'acceptance']), (s, a, x) => s.taskAssign(s.memberIdOfAgent(x), a))
-  registerTool('vibe_v5_prioritize', '(academician) Set institute-wide priorities: an ordered list of {task_id, priority} plus WHY. This orders work only — it never changes what is true.', objParams({ order: { type: 'array', items: { type: 'object' } }, why: S }), (s, a, x) => s.taskPrioritize(s.memberIdOfAgent(x), a))
-  registerTool('vibe_v5_nudge', '(academician) Supervise: wake one member with a stated reason and a concrete suggested next step. Prefer a specific next step over a bare "hurry up".', objParams({ to: S, why: S, next_step: S }, ['to', 'why']), (s, a, x) => s.nudge(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_assign', '(academician) ASSIGN work: create or pick a task and give it to a specific member (including temp workers), stating WHY and the acceptance criteria. The assignee executes by default and may object with reasons (which are broadcast).', objParams({ task_id: S, subject: S, description: S, to: S, why: S, acceptance: S, priority: I, write_scopes: SA }, ['to', 'why', 'acceptance']), (s, a, x) => withCaller(s, x, 'an assignment', (caller) => s.taskAssign(caller, a)))
+  registerTool('vibe_v5_prioritize', '(academician) Set institute-wide priorities: an ordered list of {task_id, priority} plus WHY. This orders work only — it never changes what is true.', objParams({ order: { type: 'array', items: { type: 'object' } }, why: S }), (s, a, x) => withCaller(s, x, 'setting priorities', (caller) => s.taskPrioritize(caller, a)))
+  registerTool('vibe_v5_nudge', '(academician) Supervise: wake one member with a stated reason and a concrete suggested next step. Prefer a specific next step over a bare "hurry up".', objParams({ to: S, why: S, next_step: S }, ['to', 'why']), (s, a, x) => withCaller(s, x, 'a nudge', (caller) => s.nudge(caller, a)))
 
   // ── Lean formal verification (docs/formal-verification.md) ────────────────
   // These three tools are registered UNCONDITIONALLY: tool registration is static (a
   // dynamic registration would depend on a runtime knob and break the effect discipline),
   // while the MODE only decides whether the framework TELLS members about them. In 'off'
   // mode they still work if a human or agent calls them deliberately.
-  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT, and a non-zero exit returns the compiler output. Pass target=<object id> to also record the run against that object.', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => s.leanRunTool(s.memberIdOfAgent(x), a))
-  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (when the run passes) also Verified/Lean/<target>.lean, marking the object Lean-passed. kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => s.leanArchive(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT, and a non-zero exit returns the compiler output. Pass target=<object id> to also record the run against that object.', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => withCaller(s, x, 'a Lean run', (caller) => s.leanRunTool(caller, a)))
+  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (when the run passes) also Verified/Lean/<target>.lean, marking the object Lean-passed. kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => withCaller(s, x, 'a Lean archive', (caller) => s.leanArchive(caller, a)))
   registerTool('vibe_v5_lean_lib', '(member) List (and by default rebuild) the Lean reuse library: your institute\'s Formal/Index.md, plus the global cross-project Formal/Lib and Formal/Proved indexes. Look here BEFORE writing a new definition so you reuse instead of redefining.', objParams({ refresh: B }), async (s, a) => {
     const r = a && a.refresh === false ? { lib: null, proved: null, objects: Object.keys(s.formalRecords()).length } : await s.rebuildLeanLibIndexes()
     const st = s.status()
@@ -4414,8 +4751,20 @@ export function apply(ctx) {
     input: { hint: '[configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set]' },
     handler: async function (inv) {
       const s = getSession(inv && inv.agent)
-      if (!s) return { kind: 'success', text: JSON.stringify({ ok: false, error: 'no session' }) }
+      if (!s) return { kind: 'error', text: JSON.stringify({ ok: false, error: 'no session' }) }
       await s.ready()
+      // The `/v5` line is the OFFICE/human control surface (README: the institute-office row) and
+      // EVERY subcommand below acts AS the office (`say('office', …)`, `hire('office', …)`,
+      // `removeResearcher`, `setParams`, `initStop` …). It used to accept ANY caller whose session
+      // maps to the institute — a member child maps to the same office session — so the caller is
+      // resolved here too and refused unless it is the PROVABLE session root (audit L6 follow-up:
+      // the command surface had no caller check at all). Read-only subcommands are gated with the
+      // rest: a member reads state with vibe_v5_status / vibe_v5_report / vibe_v5_members.
+      const caller = s.officeCaller(inv && inv.agent)
+      if (caller !== 'office') {
+        const refused = { ok: false, code: 'V5_NOT_OFFICE', message: 'the /v5 control line belongs to the office (the session root); members use the vibe_v5_* tools' }
+        return { kind: 'error', text: JSON.stringify(refused, null, 2) }
+      }
       const line = String(inv && inv.rawInput ? inv.rawInput : '').trim()
       const parts = line.split(/\s+/)
       const cmd = parts[0] || ''
@@ -4446,7 +4795,11 @@ export function apply(ctx) {
         }
         r = await s.setParams(upd)
       } else r = { ok: false, usage: 'configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set' }
-      return { kind: 'success', text: JSON.stringify(r, null, 2) }
+      // A business failure (the dispatch result's own ok:false) is a FAILED command: the host's
+      // CommandResult union distinguishes success from error, and returning 'success' made a rejected
+      // invocation look identical to a successful one (same fix as v2/v3).
+      const failed = r !== null && typeof r === 'object' && r.ok === false
+      return { kind: failed ? 'error' : 'success', text: JSON.stringify(r, null, 2) }
     },
   }))
 
@@ -4486,3 +4839,97 @@ export function apply(ctx) {
       .finally(() => s.forgetAgent(info.id))
   })
 }
+
+const now = () => Date.now()
+
+// ---- test seam: pure, stateless helpers --------------------------------
+// These helpers were declared inside `apply()` and are now declared at module scope, so
+// `apply()` closes over exactly the same function objects this export hands out. The audit
+// suites therefore exercise the REAL implementations by importing this module, instead of
+// extracting source text and compiling function bodies through the Function constructor
+// (dynamic code execution, rejected by the plugin-catalog security scan as
+// DANGEROUS_DYNAMIC_EXECUTION).
+//
+// Contract: no member may touch `ctx`, session state or mutable module state. Most are pure;
+// three are deliberately non-deterministic (`uuid`/`shortId` use Math.random, `fmtTime` falls back
+// to the clock) and `parseProgress` normalises the object it is handed in place (pre-existing).
+// Nothing here is used by the plugin at runtime except through `apply()`, and behaviour is
+// byte-identical to the previous in-`apply` declarations.
+export const __testHelpers = {
+  clamp01,
+  clPct,
+  posMs,
+  blocksToText,
+  fmtTime,
+  idSafe,
+  slugify,
+  tryJson,
+  parseReply,
+  sanitizeToolFilter,
+  registeredToolsFromError,
+}
+
+function clamp01(v) { const n = Number(v); if (!Number.isFinite(n)) return 0.5; return Math.max(0, Math.min(1, n)) }
+
+function clPct(x) { const n = Number(x); if (!Number.isFinite(n)) return 0; return Math.max(0, Math.min(100, n)) }
+
+function posMs(v, def) { const n = Number(v); return (Number.isFinite(n) && n > 0) ? n : (def || 120000) }
+
+function blocksToText(b) { if (!b) return ''; let o = ''; for (const x of b) { if (x && x.type === 'text' && typeof x.text === 'string') o += x.text + '\n' } return o }
+
+function fmtTime(ts) { try { return new Date(ts || now()).toISOString().replace('T', ' ').slice(0, 19) } catch (e) { return String(ts || '') } }
+
+function idSafe(s) {
+  const t = String(s == null ? '' : s).trim().replace(/[\\/:*?"<>|\u0000-\u001f]+/g, '-').replace(/-{2,}/g, '-').replace(/^[.\-]+|[.\-]+$/g, '')
+  return t
+}
+
+function slugify(s) {
+  const t = String(s == null ? '' : s).trim().toLowerCase().replace(/[^a-z0-9_\-\u4e00-\u9fa5]+/g, '-').replace(/^-+|-+$/g, '')
+  return t || ''
+}
+
+function tryJson(s) { try { return JSON.parse(s) } catch (e) { return undefined } }
+
+function parseReply(text) {
+  let obj
+  const fence = /```(?:json)?[ \t]*([\s\S]*?)```/gi
+  let m
+  while ((m = fence.exec(text)) !== null) {
+    const o = tryJson(String(m[1]).trim())
+    if (o && typeof o === 'object' && !Array.isArray(o)) obj = o
+  }
+  if (!obj) {
+    const w = tryJson(String(text || '').trim())
+    if (w && typeof w === 'object' && !Array.isArray(w)) obj = w
+  }
+  if (!obj) {
+    // Last resort: the outermost {...} span (models sometimes wrap prose around it).
+    const t = String(text || '')
+    const i = t.indexOf('{'), j = t.lastIndexOf('}')
+    if (i !== -1 && j > i) {
+      const o = tryJson(t.slice(i, j + 1))
+      if (o && typeof o === 'object' && !Array.isArray(o)) obj = o
+    }
+  }
+  return obj || {}
+}
+
+function sanitizeToolFilter(filter, known){
+  if(!filter || !(known instanceof Set) || known.size === 0) return filter
+  const out = {}
+  for(const key of ['allow','deny']){
+    const list = filter[key]
+    if(!Array.isArray(list)) continue
+    const kept = list.filter(function(n){ return known.has(String(n).trim()) })
+    if(kept.length > 0) out[key] = kept
+  }
+  return (out.allow || out.deny) ? out : undefined
+}
+
+function registeredToolsFromError(message){
+  const m = /known global tools:\s*([^]*)$/.exec(String(message || ''))
+  if(!m) return undefined
+  const names = m[1].split(',').map(function(s){ return s.trim() }).filter(Boolean)
+  return names.length > 0 ? new Set(names) : undefined
+}