dsh-vibe-math 2.4.1 → 2.6.0

package/vibe-math-v5/vibe-math-v5.js

@@ -52,7 +52,6 @@
 // field — so the old projection-based primary made the user's own session unresumable.
 export const inject = ['subagents', 'agents', 'fs', 'tools', 'commands', 'timer']
 
-const PROJECTION_KEY = 'vibeMathV5'
 const PROJECTION_VERSION = 1
 const EV = {
   institute: 'vibe5/institute',
@@ -69,6 +68,34 @@ const EV = {
   formal: 'vibe5/formal',
 }
 
+// ── final paper (docs/final-paper.md) ─────────────────────────────────────────
+// The run's LAST deliverable. The permanent staff each write their own part, cross-review
+// each other's part, and the editor named by `paperEditor` finalises — but ONLY after the
+// whole institute has agreed the parts are deliverable, and (when the office edits) only
+// after the office has consulted the institute. The phase runs BEFORE the completion flags
+// are flipped (docs/final-paper.md §3): after `phase='solved'` the machinery refuses to wake
+// members (`wakeIfIdle`), to convene meetings (`startMeeting`) or to dispatch an end.
+const PAPER_MAX_ROUNDS = 3
+// Chinese first (docs/final-paper.md §8): xelatex covers CJK out of the box; English prefers pdflatex.
+const PAPER_ENGINE_ORDER = {
+  zh: ['xelatex', 'latexmk', 'pdflatex', 'lualatex', 'tectonic'],
+  en: ['pdflatex', 'latexmk', 'lualatex', 'tectonic', 'xelatex'],
+}
+// The repair pass keeps only what the text itself needs; everything else (hyperref,
+// longtable, booktabs, an unknown package) is dropped before the retry.
+const PAPER_REPAIR_CORE = ['amsmath', 'amssymb', 'amsthm', 'geometry', 'ctex']
+const PAPER_SECTIONS = [
+  '标题、作者、日期与摘要',
+  '引言与问题背景',
+  '原问题的完整解法',
+  '已检验通过的命题',
+  '已解决的子问题 / 中间成果',
+  '创造或发现的有价值之物：方法、理论、思想、经验与数学理解',
+  '规律总结',
+  '讨论、局限与展望',
+  '附录：证据与文件索引',
+]
+
 // Stable error codes (ported from DSH agent-teams' typed-error discipline).
 function v5err(code, message) {
   const e = new Error(message || code)
@@ -164,6 +191,9 @@ export function apply(ctx) {
   // The fold is shared by BOTH persistence backends, so the state machine is
   // defined exactly once. It must return a NEW top-level reference whenever
   // anything changed (the state store compares by Object.is).
+  // The acknowledgement ledger is an LRU window, NOT a full history: it exists to answer
+  // "was this message delivered?", and the whole snapshot is rewritten on every commit.
+  const DELIVERED_CAP = 500
   function emptyInstitute(key, project, institute) {
     return {
       key, project, institute,
@@ -187,6 +217,9 @@ export function apply(ctx) {
       lastProgressAt: now(),
       artifactCount: 0,
       diagnostics: [],
+      // The final-paper flow (stage machine + its artifacts state). Durable like everything
+      // else, so a restart resumes the same stage instead of writing a second paper.
+      paper: null,
     }
   }
   function initState() { return { v: PROJECTION_VERSION, institutes: {}, order: [] } }
@@ -226,6 +259,16 @@ export function apply(ctx) {
           if (patch.runId !== undefined) n.runId = String(patch.runId)
           if (patch.lastProgressAt !== undefined) n.lastProgressAt = Number(patch.lastProgressAt) || 0
           if (patch.artifactCount !== undefined) n.artifactCount = Number(patch.artifactCount) || 0
+          // The final-paper state. A FUNCTION is a MUTATION applied inside the fold (the same
+          // trick the verify queue uses): the paper stage, its parts and its office-consultation
+          // counters are updated from several places (member replies, office messages, meetings),
+          // and a whole-object read-modify-write outside the fold would lose updates.
+          if (patch.paper !== undefined) {
+            const next = typeof patch.paper === 'function'
+              ? patch.paper(n.paper === undefined ? null : n.paper)
+              : patch.paper
+            if (next !== undefined) n.paper = next
+          }
           return n
         })
       }
@@ -266,10 +309,16 @@ export function apply(ctx) {
           for (const id of ids) { if (!set.has(id)) { set.add(id); changed = true } }
           if (!changed) return inst
           // Compact: a message that has been delivered may leave `messages` too, so
-          // the queue never grows without bound over a long run.
+          // the queue never grows without bound over a long run. `delivered` itself is
+          // bounded the same way `debates`/`meetings` are: it is an acknowledgement LEDGER,
+          // and every commit rewrites the whole snapshot, so an ever-growing array of every
+          // message id ever acked would make each write progressively more expensive
+          // (audit M7). Oldest entries are dropped first; `messages` holds only undelivered
+          // ids and is filtered by the same set, so dropping an id can never re-deliver.
           const delivered = Array.from(set)
+          const capped = delivered.length > DELIVERED_CAP ? delivered.slice(delivered.length - DELIVERED_CAP) : delivered
           const messages = inst.messages.filter((m) => !set.has(m.id))
-          return Object.assign({}, inst, { delivered, messages })
+          return Object.assign({}, inst, { delivered: capped, messages })
         })
       }
       if (t === EV.meeting) {
@@ -308,8 +357,21 @@ export function apply(ctx) {
           return Object.assign({}, inst, { formal, todo })
         })
       }
+      // `d.queue` is normally the new ARRAY, but a queue MUTATION (appending a proposal,
+      // taking the head to run) is passed as a FUNCTION instead. Applying it here, inside the
+      // fold, makes its read and its write one atomic step of the serial event chain: the old
+      // shape (read `inst().queue`, mutate the copy, `await putQueue(copy)`) lost one of two
+      // proposals made in the same tick, because both callers read the same array and each
+      // committed its own copy.
       if (t === EV.queue) {
-        return withInstitute(state, key, (inst) => Object.assign({}, inst, { queue: Array.isArray(d.queue) ? d.queue : [] }))
+        return withInstitute(state, key, (inst) => {
+          const next = typeof d.queue === 'function' ? d.queue(inst.queue) : d.queue
+          const list = Array.isArray(next) ? next : []
+          // A mutation that changed nothing (a duplicate proposal) leaves the queue object
+          // identical: return the institute unchanged rather than minting a new revision.
+          if (list === inst.queue) return inst
+          return Object.assign({}, inst, { queue: list })
+        })
       }
       if (t === EV.counters) {
         return withInstitute(state, key, (inst) => Object.assign({}, inst, { counters: Object.assign({}, inst.counters, d.counters || {}) }))
@@ -335,28 +397,84 @@ export function apply(ctx) {
   // the whole snapshot under a per-file serialization chain; nothing is written to a host session log
   // (see the PERSISTENCE note at the top of this file for why the projection backend was removed).
   // `pathOf` is a FUNCTION, not a captured string: the state path depends on the
-  // project/institute, which the first successful load syncs back into this session —
-  // a captured path would keep writing to the pre-load guess forever.
+  // project/institute, which `configure` may change mid-session — a captured path would
+  // keep writing to the pre-load guess forever.
+  //
+  // The load latch is PER PATH, and a write is only allowed for a path whose load
+  // SUCCEEDED. Both are needed to make the state file safe (the 2.4.1 audit's H1):
+  // a boolean "we have loaded something" latch let the first tool call of a session
+  // (typically `vibe_v5_status`, against the DEFAULT institute) latch the backend to the
+  // default path, after which `vibe_v5_configure {institute:'alpha'}` never read alpha's
+  // file and wrote an EMPTY institute over it. Switching paths now re-reads the new path
+  // first, and if that read fails the backend refuses to write instead of clobbering.
   function makeFileBackend(readTextAbs, writeTextAbs, pathOf) {
     let mem = initState()
     let chain = Promise.resolve(true)
-    let loaded = false
-    return {
+    let loadedPath            // the path whose file is currently folded into `mem`
+    let loadOk = false        // did the read of `loadedPath` actually succeed?
+    let loadPromise = null    // the in-flight load (dedupes concurrent callers)
+    let loadPendingPath = null
+    // Fold ONE path into `mem`. `readTextAbs` returning undefined means "no file yet", which
+    // is the only case that licences a later write; anything else (a throw, a parse error, a
+    // version mismatch) leaves `loadOk` false so commit() refuses to clobber it.
+    async function doLoad(p) {
+      let ok = false
+      try {
+        const raw = await readTextAbs(p)
+        if (raw === undefined || raw === null || raw === '') ok = true
+        else {
+          const parsed = JSON.parse(raw)
+          if (parsed && parsed.v === PROJECTION_VERSION) { mem = parsed; ok = true }
+        }
+      } catch (e) { /* a corrupt/unreadable file is ignored; it is not authoritative */ }
+      loadedPath = p
+      loadOk = ok
+      loadPromise = null
+      loadPendingPath = null
+      return mem
+    }
+    const backend = {
       kind: 'file',
       async load() {
-        if (loaded) return mem
-        loaded = true
-        try {
-          const raw = await readTextAbs(pathOf())
-          if (raw) {
-            const parsed = JSON.parse(raw)
-            if (parsed && parsed.v === PROJECTION_VERSION) mem = parsed
-          }
-        } catch (e) { /* a corrupt mirror is ignored; it is not authoritative */ }
-        return mem
+        const path = pathOf()
+        if (loadedPath === path && (loadOk || loadPromise === null)) return mem
+        // A different path (or a previously FAILED load of this one) is read again before it
+        // is ever written to. Switching paths starts from the empty initial state: `mem`
+        // holds only the fold of the file that is on disk for the CURRENT path.
+        if (loadedPath !== path) { mem = initState(); loadPromise = null }
+        if (loadPromise && loadPendingPath === path) return await loadPromise
+        loadPendingPath = path
+        loadPromise = doLoad(path)
+        await loadPromise
+        if (loadedPath === pathOf()) return mem
+        // The path moved again while we were reading: hand back the state for the path
+        // that is current NOW rather than one for a directory we are no longer using.
+        return await backend.load()
       },
       read() { return mem },
+      loadedFor() { return { path: loadedPath, ok: loadOk } },
+      // Read ONE specific path (used by `configure`, which must know whether the institute
+      // it is being pointed at already exists on disk) and report the state belonging to
+      // `useKey`. The path latch deliberately stays on the file that was actually read.
+      async loadAt(path, useKey) {
+        loadedPath = path
+        loadOk = false
+        loadPromise = null
+        loadPendingPath = null
+        mem = initState()
+        await doLoad(path)
+        return { state: mem, institute: useKey === undefined ? undefined : mem.institutes[String(useKey)] }
+      },
       async commit(type, data) {
+        // NEVER write a snapshot whose file was not successfully read first: an unread file
+        // is indistinguishable from "the read never ran", and whole-snapshot writes make
+        // that failure mode destructive.
+        const path = pathOf()
+        if (loadedPath !== path) await backend.load()
+        if (loadedPath !== path || !loadOk) {
+          throw v5err('V5_STATE_NOT_LOADED',
+            'refusing to overwrite ' + path + ' : its state file was never read successfully (a failed or unreadable load must not be clobbered)')
+        }
         mem = applyV5Event(mem, { type, data })
         const snapshot = mem
         // Serialize writes per file and defer JSON.stringify to execution time, so a
@@ -369,6 +487,7 @@ export function apply(ctx) {
         return mem
       },
     }
+    return backend
   }
 
   // ---- session registry --------------------------------------------------
@@ -432,6 +551,22 @@ export function apply(ctx) {
       leanCommand: 'lean',
       leanArgs: [],
       leanTimeoutMs: 120000,
+      // ── final paper (docs/final-paper.md; the phase runs BEFORE the completion flags) ──
+      // finalPaper        — write the final paper when the run concludes (manual /v5 paper
+      //                     still works when this is false, and says so).
+      // paperFormat       — 'both' | 'md' | 'tex'
+      // paperLanguage     — 'zh' | 'en'
+      // paperCompilePdf   — compile a PDF when a LaTeX engine is detected
+      // paperEditor       — 'academician' (default: the only editor reachable unattended) |
+      //                     'office' (manual /v5 paper only: the office must consult the
+      //                     institute first — messages + at least one meeting)
+      // paperLatexCommand — force ONE engine command instead of auto-detection ('' = auto)
+      finalPaper: true,
+      paperFormat: 'both',
+      paperLanguage: 'zh',
+      paperCompilePdf: true,
+      paperEditor: 'academician',
+      paperLatexCommand: '',
       // ── model / tools ────────────────────────────────────────────────────
       provider: '',
       model: '',
@@ -496,28 +631,53 @@ export function apply(ctx) {
     async function writeTextAbs(p, content) {
       try {
         const t = await fsTargetAbs(p)
-        await fs.writeText(t, content, undefined, undefined, getPolicy())
-        return true
-      } catch (e) { return false }
+        // `fs.writeText` RESOLVES with an FsWriteOutcome ({operation, version, before, after})
+        // and REJECTS on a real failure, so the old `return true` here meant only "the call did
+        // not throw" and discarded the outcome (audit L4). Return the outcome itself: `undefined`
+        // now means "not written", an object means "written, and here is what the fs reported".
+        // A stub/mock fs that resolves with nothing is reported as an unknown-but-successful
+        // write, because the real host never resolves without an outcome.
+        const outcome = await fs.writeText(t, content, undefined, undefined, getPolicy())
+        return (outcome === undefined || outcome === null) ? { operation: 'unknown' } : outcome
+      } catch (e) { return undefined }
     }
     async function readTextRel(rel) { return await readTextAbs(instRoot() + '/' + rel) }
-    async function writeTextRel(rel, content) { return await writeTextAbs(instRoot() + '/' + rel, content) }
+    async function writeTextRel(rel, content) { return (await writeTextAbs(instRoot() + '/' + rel, content)) !== undefined }
 
     function installBackend() {
       backend = makeFileBackend(readTextAbs, writeTextAbs, () => instRoot() + '/State/' + instituteName + '.v5state.json')
       return backend
     }
+    // The ONE call site that awaits the backend's load (the sensitivity probe for
+    // "the file fallback must LOAD persisted state before any read" keys on it, and a
+    // duplicated copy of it would make that probe ambiguous).
+    async function awaitBackendLoad() {
+      if (backend.kind === 'file' && typeof backend.load === 'function') await backend.load()
+      return true
+    }
     // Every entry point that READS state must await this first. Without it the file
     // backend's `mem` is still the empty initial state, so a fresh process would report
     // an empty roster and `resume` would refuse with "no active member to resume" —
     // i.e. the fallback would silently lose the whole institute across a restart.
     async function ready() {
       if (!backend) installBackend()
-      if (backend.kind === 'file' && typeof backend.load === 'function') await backend.load()
-      return true
+      return await awaitBackendLoad()
+    }
+    // Load the CURRENT state path before its first read. `state()` is synchronous by design
+    // (the whole fold is read through it), so it kicks the load off eagerly; the caller that
+    // matters — `commit()` — always awaits it before the snapshot may be written.
+    function ensureLoaded() {
+      if (!backend) installBackend()
+      if (backend.kind !== 'file' || typeof backend.load !== 'function') return
+      const p = backend.load()
+      if (p && typeof p.then === 'function') p.catch(() => {})
     }
     function state() {
       if (!backend) installBackend()
+      // A read must never be served from the empty initial state while the path's file has
+      // not been folded in yet (the 2.4.1 audit's H1: a read-less `state()` was half of the
+      // overwrite). `ready()`/`commit()` await the same load; here it only has to START.
+      ensureLoaded()
       stateCache = backend.read()
       return stateCache
     }
@@ -525,10 +685,46 @@ export function apply(ctx) {
       const s = state()
       return s.institutes[key] || emptyInstitute(key, project, instituteName)
     }
+    // The institute stored in ANOTHER (project, institute) state file, or undefined. Used by
+    // `configure` before it switches identity: the requested institute may already exist on
+    // disk, and adopting it is the only alternative to overwriting it (audit H1).
+    async function instituteAt(np, ni, nkey) {
+      if (!backend) installBackend()
+      const path = (vibeRoot() + '/Projects/' + np + '/Institutes/' + ni + '/State/' + ni + '.v5state.json')
+      const r = await backend.loadAt(path, nkey)
+      return r.institute
+    }
+    // A FAILED load of an EXISTING file must never be silent: it is the one state in which
+    // the backend refuses to write (audit H1). The note is buffered here and folded into the
+    // state on the next commit that IS allowed, so it can never recurse into a commit.
+    let pendingLoadNotes = []
+    function noteLoadProblem(text) {
+      const t = String(text || '').slice(0, 300)
+      if (t && pendingLoadNotes.indexOf(t) === -1) pendingLoadNotes.push(t)
+      if (pendingLoadNotes.length > 5) pendingLoadNotes = pendingLoadNotes.slice(-5)
+    }
+    function drainLoadNotes() {
+      if (!pendingLoadNotes.length || !stateCache) return
+      const list = (stateCache.diagnostics || []).concat(pendingLoadNotes.map((t) => ({ at: now(), type: 'vibe5/load', error: t })))
+      pendingLoadNotes = []
+      stateCache = Object.assign({}, stateCache, { diagnostics: list.slice(-50) })
+    }
     async function commit(type, data) {
       if (!backend) installBackend()
-      if (backend.kind === 'file' && backend.load) await backend.load()
-      stateCache = await backend.commit(type, Object.assign({ version: PROJECTION_VERSION, key }, data))
+      // Explicit call (the audit's H3): `await backend.load` awaited the METHOD OBJECT, so
+      // the only load was the one the backend happened to do inside commit.
+      await awaitBackendLoad()
+      const loaded = backend.kind === 'file' && typeof backend.loadedFor === 'function' ? backend.loadedFor() : { ok: true }
+      try {
+        stateCache = await backend.commit(type, Object.assign({ version: PROJECTION_VERSION, key }, data))
+      } catch (e) {
+        // The write was refused because the state file could not be read. Say so loudly
+        // instead of clobbering it, and keep the note for the next write that is allowed.
+        noteLoadProblem('write REFUSED (a failed state-file load must not be clobbered): ' + String((e && e.message) || e))
+        throw e
+      }
+      if (!loaded.ok) noteLoadProblem('the state file ' + String(loaded.path || '?') + ' could not be read (corrupt, unreadable or version-mismatched); it will never be overwritten')
+      drainLoadNotes()
       const cur = stateCache.institutes[key]
       if (cur) {
         phase = cur.phase || phase
@@ -547,7 +743,9 @@ export function apply(ctx) {
     const putMeeting = (index) => commit(EV.meeting, { index })
     const putDebate = (index) => commit(EV.debate, { index })
     const putVerdict = (target, record) => commit(EV.verdict, { target, record })
-    const putQueue = (queue) => commit(EV.queue, { queue })
+    // The verify queue has NO whole-array setter any more: both of its mutations go through
+    // `appendToQueue`/`takeQueueHead` below, which hand a FUNCTION to the event fold so the
+    // read-modify-write is atomic (the lost-proposal race).
     const putCounters = (counters) => commit(EV.counters, { counters })
     const markProgress = async () => {
       lastProgressAt = now()
@@ -572,6 +770,15 @@ export function apply(ctx) {
       const a = activeMembers().find((m) => m.kind === 'academician')
       return a ? a.id : ''
     }
+    // `academicianId()` resolved against a roster that also counts a member which is NOT yet
+    // committed (the joiner whose charter is being built). Kept separate so the canonical
+    // resolver stays the live-roster one — the sensitivity probe for the leaderless charter
+    // mutates the `academicianId()` CALL, and that mutation must keep reaching the text.
+    function academicianIdWith(extraMember) {
+      if (!extraMember) return academicianId()
+      const a = activeMembers().concat([extraMember]).find((m) => m.kind === 'academician')
+      return a ? a.id : ''
+    }
 
     // ---- the institute charter (public regulations) -----------------------
     // Written into every member's `persona` at hire time. `persona` is part of the
@@ -579,8 +786,12 @@ export function apply(ctx) {
     // context compaction WITHOUT being re-injected into prompts — which is what
     // structurally removes v4's "re-anchor the rules after compaction" patch and
     // the "[核心规则重申]+[CONTEXT COMPACT] every round" leak it caused (§24.1-③).
-    function rosterLine() {
-      const ms = activeMembers()
+    function rosterLine(extraMember) {
+      // Written ONCE, at the member's creation (`newMember`), so the hire-time snapshot is
+      // frozen even for a member the host's live-child cap refuses and `resume` re-spawns
+      // later (audit M5). The joiner is folded in here so its own charter shows the institute
+      // WITH itself on the roster — exactly what the original build-at-spawn code produced.
+      const ms = extraMember ? activeMembers().concat([extraMember]) : activeMembers()
       const acad = ms.filter((m) => m.kind === 'academician').map((m) => m.id)
       const res = ms.filter((m) => m.kind === 'researcher').map((m) => m.id)
       const tmp = ms.filter((m) => m.kind === 'temp').map((m) => m.id + '(' + (m.hiredBy || '?') + '雇)')
@@ -694,7 +905,8 @@ export function apply(ctx) {
       // The leader's REAL id (or '' when the office founded a leaderless institute).
       // Charter text must never name a leader who is not on staff: a member told to
       // "report to the academician" when there is none has no one to report to.
-      const acadId = academicianId()
+      // `member` itself is counted as on-staff even before it is committed (see rosterLine).
+      const acadId = academicianIdWith(member)
       const L = []
       // ── opening ──────────────────────────────────────────────────────────
       if (kind === 'academician') {
@@ -761,7 +973,7 @@ export function apply(ctx) {
         L.push('  · **所办（对外接口）** —— 不参与研究、不投票。代表本所与外部沟通并转达外部指令。')
       }
       L.push('  你入职时的在册编制（这是一份**快照**，此后可能变化）：')
-      L.push(rosterLine())
+      L.push(rosterLine(member))
       L.push('  （权威的在册名单与法定票数 m 以每轮提示里的状态块为准；编制可能变化。）')
       L.push('')
       // ── 二、general rules ────────────────────────────────────────────────
@@ -1022,6 +1234,12 @@ export function apply(ctx) {
         return { ok: o.exitCode === 0, exitCode: o.exitCode }
       } catch (e) { return { ok: false, error: String((e && e.message) || e) } }
     }
+    // Directory creation must go through the INJECTED `fs` service, not the platform shell:
+    // the shell path passes no policy, so a deployment that confines writes through
+    // `fs` (read-only or narrowed workspace) was not confining this one (audit M8). The
+    // local/sandboxed fs backend creates missing parent directories on write
+    // (`writeFileAtomic` → `mkdir(dirname, {recursive:true})`), so writing a marker file per
+    // directory is what actually creates the tree — inside the policy.
     async function mkdirs() {
       const base = instRoot()
       const dirs = ['Shared/Chat', 'Shared/Meetings', 'Shared/Debates', 'State', 'Problems', 'Formal', 'Verified/Lean']
@@ -1033,10 +1251,26 @@ export function apply(ctx) {
         for (const d of ['Progress', 'Propos', 'Methods', 'Subproblems']) dirs.push('Members/' + m.id + '/' + d)
       }
       const paths = dirs.map((d) => base + '/' + d).concat(globalDirs.map((d) => vibeRoot() + '/' + d))
+      let fsCreated = 0
+      let fsFailed = false
+      try {
+        if (fs && typeof fs.writeText === 'function' && typeof fs.resolve === 'function') {
+          for (const p of paths) {
+            const t = await fsTargetAbs(p + '/.keep')
+            await fs.writeText(t, '', undefined, undefined, getPolicy())
+            fsCreated += 1
+          }
+        } else fsFailed = true
+      } catch (e) { fsFailed = true }
+      if (!fsFailed && fsCreated === paths.length) return { ok: true, dirs: fsCreated, via: 'fs' }
+      // Guarded fallback for a host whose fs backend refuses (or offers no writeText): the
+      // platform shell still creates the tree, exactly as before this change. It is only
+      // reached when the policy-compliant route failed, and it reports which route ran.
       const script = isWindows()
         ? 'New-Item -Force -ItemType Directory -Path ' + paths.map((p) => psQuote(p)).join(',') + ' | Out-Null'
         : 'mkdir -p ' + paths.map((p) => shQuote(p)).join(' ')
-      return await runShell(script)
+      const r = await runShell(script)
+      return Object.assign({ via: 'shell' }, r)
     }
 
     // ---- communication (durable per-recipient mailbox) --------------------
@@ -1071,6 +1305,10 @@ export function apply(ctx) {
       }
       counters.message = n
       await putCounters(counters)
+      // The office talking to the institute is HALF of the `paperEditor='office'` consultation
+      // requirement; counting it here (the one place a message really is queued) means the gate
+      // cannot be satisfied by merely intending to consult (docs/final-paper.md §7).
+      if (from === 'office') await notePaperConsult('message')
       notifyActivity()
       // Kick one scheduling pass so an ADDRESSED message (dm/office/assign) wakes its
       // recipient promptly instead of waiting for the digest window. Plain chat stays
@@ -1164,7 +1402,12 @@ export function apply(ctx) {
         hiredBy: (opts && opts.hiredBy) || '',
         term: (opts && opts.term) || '',
         provider: String((opts && opts.provider) || 'spawn'),
-        persona: '',   // filled at spawn; kept for the durable-seal record
+        // The charter is FROZEN at hire time — it says "你入职时的在册编制（这是一份**快照**）".
+        // It therefore has to be CAPTURED here, not at the first successful spawn: a member
+        // the host's live-child cap refused is recorded `failed` and only spawned later by
+        // `resume`, and rebuilding the charter then would describe the resume-time roster
+        // (`memberPersona(member)` would also silently drop any `staffPersona` change).
+        persona: memberPersona({ id, kind, direction: String((opts && opts.direction) || ''), hiredBy: (opts && opts.hiredBy) || '' }),
         error: '',
         createdAt: now(),
         dismissedAt: 0,
@@ -1268,7 +1511,8 @@ export function apply(ctx) {
       roundsSinceCompact.set(member.id, (roundsSinceCompact.get(member.id) || 0) + 1)
       // The charter is FROZEN at hire time (it is the durable "seal" record and it says
       // "你入职时的在册编制"). Rebuilding it on resume would silently rewrite that
-      // hire-time snapshot into a resume-time one and make the sentence untrue.
+      // hire-time snapshot into a resume-time one and make the sentence untrue. `newMember`
+      // captures it, so every member has one by the time it can be spawned.
       const persona = member.persona || memberPersona(member)
       member.persona = persona
       const prompt = initialPrompt(member, initialTask, mode)
@@ -1394,8 +1638,7 @@ export function apply(ctx) {
         // 'office' rather than '' so the framing records a real, non-member sender.
         try { if (rootOf(agent) === agent) return 'office' } catch (e) { /* fall through */ }
         // An unrelated child agent: report no member. Member-only writes refuse with
-        // V5_MEMBER_NOT_FOUND (that guard is what makes guessing unnecessary), and the
-        // office-capable tools treat '' as the office.
+        // V5_MEMBER_NOT_FOUND (that guard is what makes guessing unnecessary).
         return ''
       }
       // No session id at all (a synthetic exec context). Only here may we fall back to
@@ -1403,6 +1646,22 @@ export function apply(ctx) {
       const c = currentMember
       return (c && memberById(c)) ? c : ''
     }
+    // Is this caller PROVABLY the office — the session root itself? `memberIdOfAgent` answers
+    // 'office' both for the root AND for any descendant of the root that is not a member child
+    // (a dismissed member's stale child, a nested helper agent), so it cannot tell them apart;
+    // only the direct root test can (audit L6). `isOffice(id)` no longer treats '' as the office
+    // either, so the office-capable handlers resolve their caller HERE and refuse on ''.
+    function isProvablyOffice(agent) {
+      try { return !!agent && sessionIdOf(agent) !== undefined && rootOf(agent) === agent } catch (e) { return false }
+    }
+    // The caller of an OFFICE-ONLY tool: a real member id, or 'office' when the caller is
+    // provably the session root, or '' when nobody can be identified. The tool handler must
+    // refuse on '' (V5_MEMBER_NOT_FOUND) instead of impersonating the office (audit L6).
+    function officeCaller(agent) {
+      const id = memberIdOfAgent(agent)
+      if (id && id !== 'office') return id
+      return isProvablyOffice(agent) ? 'office' : ''
+    }
 
     // ---- prompts ----------------------------------------------------------
     // The charter lives in `persona` (permanent). Every ROUND prompt therefore
@@ -1438,9 +1697,9 @@ export function apply(ctx) {
       L.push('  "task_update": {"task_id":"t-3","expected_revision":2,"action":"complete|release|reopen|edit|set_dependencies|delete"},')
       L.push('  "input": "本轮会议/辩论的发言正文（会议轮用；也可直接用 say）",')
       if (formalOn()) {
-        L.push('  "formal": {"target":"p-x","decision":"used|blocked|defect","file":"Formal/p-x.lean","note":"难度判断/阻塞原因"}')
+        L.push('  "formal": {"target":"p-x","decision":"used|blocked|defect","file":"Formal/p-x.lean","note":"难度判断（used）/ 阻塞原因（blocked）/ 具体偏差（defect）"}')
         L.push('             ← Lean 形式化：' + (formalMode() === 'require'
-          ? '**强制**：定论前必须有「Lean 已通过」或显式阻塞原因（note 必填），否则本轮裁定记为未定论，'
+          ? '**强制**：定论前必须有「Lean 已通过」或显式的阻塞记录（decision=\'blocked\' + note；used 的 note 不算），否则本轮裁定记为未定论，'
           : '**鼓励**：按实现难度自行决定；做了就归档，没做就写明难度判断，') + '详见提示词里的【Lean 形式化验证】段')
       }
       L.push('  "reject_assign": {"task_id":"t-3","why":"你对这项分派的异议理由"}   ← 有异议时填；理由会被广播给')
@@ -1595,7 +1854,7 @@ export function apply(ctx) {
         // The formal field belongs in the VOTING contract too: voters are exactly the agents
         // who must either formalize the object or record why they judged it infeasible.
         L.push('若你本轮做了形式化或给出难度判断，请一并加上：')
-        L.push('{"formal":{"target":"' + vs.target + '","decision":"used|blocked|defect","file":"Formal/' + vs.target + '.lean","note":"难度判断/阻塞原因"}}')
+        L.push('{"formal":{"target":"' + vs.target + '","decision":"used|blocked|defect","file":"Formal/' + vs.target + '.lean","note":"难度判断（used）/ 阻塞原因（blocked）/ 具体偏差（defect）"}}')
       }
       return L.join('\n')
     }
@@ -1834,24 +2093,33 @@ export function apply(ctx) {
         updatedAt: now(),
       }))
     }
-    // Withdrawing an archived proof needs a DELETE, but the fs service exposes no unlink and
-    // subprocess is optional. Use the shell when it is available; otherwise overwrite the
-    // file with an explicit withdrawal notice, so it can never be read as the object's proof.
+    // Withdrawing an archived proof means the file must stop looking like the object's proof.
+    // The POLICY-COMPLIANT route is an overwrite through the injected `fs` service (it carries
+    // `getPolicy()`); the platform shell is only a fallback, because `subprocess.spawn` has no
+    // policy slot and the shell path therefore sat outside a confining deployment's fs policy
+    // (audit M8). A stub host whose shell exits 0 without deleting anything is also handled by
+    // the read-back check.
     async function removeArchivedProof(rel) {
       const abs = leanAbsPath(rel)
       if (abs === null) return false
+      const withdrawn = '-- 已撤回（' + fmtTime() + '）：该形式化被认定与命题原文不一致。\n'
+        + '-- 原代码保留在工作文件 Formal/' + String(rel).split('/').pop() + '；修正并重新跑通后重新归档。\n'
+      // 1) the fs service (policy-confined) — an overwritten file is no longer a proof.
+      if ((await writeTextAbs(abs, withdrawn)) !== undefined) {
+        const nowText = await readTextAbs(abs)
+        if (nowText !== undefined && nowText.indexOf('已撤回') !== -1) return true
+      }
+      // 2) guarded fallback: a real DELETE through the platform shell, when it exists.
       const sub = subprocessOf()
       if (sub !== undefined && typeof sub.spawn === 'function') {
         const script = isWindows()
           ? 'Remove-Item -LiteralPath ' + psQuote(abs) + ' -Force -ErrorAction SilentlyContinue'
           : 'rm -f ' + shQuote(abs)
         try { await runShell(script) } catch (e) { /* fall through to the overwrite */ }
-        // A shell that exits 0 without removing anything (a stub host, a permissions quirk)
-        // must not leave a withdrawn proof where everyone looks for proofs: verify, fall back.
         if (await readTextAbs(abs) === undefined) return true
       }
-      return (await writeTextAbs(abs, '-- 已撤回（' + fmtTime() + '）：该形式化被认定与命题原文不一致。\n'
-        + '-- 原代码保留在工作文件 Formal/' + String(rel).split('/').pop() + '；修正并重新跑通后重新归档。\n')) !== false
+      // 3) last resort: the overwrite again, in case the delete recreated/left the file.
+      return (await writeTextAbs(abs, withdrawn)) !== undefined
     }
     // A formalization that says something else than the proposition is NOT a refutation:
     // withdraw the proof instead of letting the group conclude 假 (contract §4.1).
@@ -1876,9 +2144,12 @@ export function apply(ctx) {
       // overwrite also fails. The record is downgraded either way, so say it out loud:
       // otherwise the stale file stays at the exact path everyone looks for proofs, and
       // nothing in any prompt or index would disclose that the withdrawal was incomplete.
+      // `removed` means the archive no longer reads as a proof — either deleted, or
+      // OVERWRITTEN with the withdrawal notice (the fs-service route). Name both honestly:
+      // "deleted" would be false whenever the policy-confined overwrite was the route.
       const stillThere = removed ? [] : ['｜⚠ 归档证明 ', proofRel, ' 未能撤回（宿主删除与覆盖均失败）；记录已降级，请不要把它当作该对象的证明。']
       await saveChatLine('【形式化】' + (memberId || '成员') + ' 认定 ' + t + ' 的形式化**不忠实**：' + why
-        + ' —— 已撤回「已通过」状态' + (removed ? '并从 Verified/Lean/ 删除归档证明' : '') + '；请修正形式化、重新跑通后再投票。' + stillThere.join(''))
+        + ' —— 已撤回「已通过」状态' + (removed ? '，并已使 Verified/Lean/ 中的归档证明失效（删除或覆盖为撤回声明）' : '') + '；请修正形式化、重新跑通后再投票。' + stillThere.join(''))
       return { ok: true, target: t, status: 'attempted', removed }
     }
     function formalPromptBlock(target) {
@@ -1920,14 +2191,16 @@ export function apply(ctx) {
         L.push('  · **一旦 Lean 通过，你唯一需要确认的就是忠实性**：定义 / 对象 / 条件 / 假设 / 结论是否与')
         L.push('    命题原文逐条一致。请把注意力放在这种核对上，而不是重新做一遍推导。')
         if (mode === 'require') {
-          L.push('  · **本模式要求**：必须产出 Lean 形式化，或**必须**给出显式的阻塞原因（vibe_v5_lean_archive')
-          L.push('    kind=\'blocked\' note=… 或回执 formal.note）。若两者都没有，本次裁定不会生效，')
+          L.push('  · **本模式要求**：必须产出 Lean 形式化，或**必须**给出显式的阻塞原因——用')
+          L.push("    vibe_v5_lean_archive kind='blocked' note=… 记录，或用回执 formal:{decision:'blocked', note:…}。")
+          L.push('    只有 decision=\'blocked\' 的 note 会写成阻塞记录；decision=\'used\' 的 note 只是难度判断，')
+          L.push('    **不会**打开定论门禁。两者都没有时，本次裁定不会生效，')
           L.push('    会被记为未定论（原因 formal-required）并进入「形式化待办」。')
         } else {
           L.push("  · 若你判断不值得或无法形式化，可以不做，但请在回执的 formal 字段写明难度判断（decision='blocked' 时必须写明 note）。")
         }
         L.push('  · 归档可复用定义/引理前先跑通（vibe_v5_lean_archive run=true 或先 vibe_v5_lean_run）；跑不通不要入库。')
-        L.push('  · 宿主没有 Lean 工具链（LEAN_NOT_FOUND）或根本没有 subprocess 服务（NO_SUBPROCESS）时：把代码写下来归档，并在回执的 note 里写明"宿主无 Lean 工具链"——这两种都算显式阻塞原因，定论门禁可以据此放行。')
+        L.push('  · 宿主没有 Lean 工具链（LEAN_NOT_FOUND）或根本没有 subprocess 服务（NO_SUBPROCESS）时：把代码写下来归档，并把"宿主无 Lean 工具链"写成**阻塞记录**（vibe_v5_lean_archive kind=\'blocked\' note=… 或回执 formal:{decision:\'blocked\', note:…}）——这算显式阻塞原因，定论门禁可以据此放行。')
       }
       return L.join('\n')
     }
@@ -2023,8 +2296,8 @@ export function apply(ctx) {
         await writeFormalIndex()
       }
       if (run.ok) {
-        await saveChatLine('【形式化】' + (memberId || 'office') + ' 运行 Lean 通过：' + run.file
-          + '（' + (run.ms / 1000).toFixed(1) + 's）' + (args.target ? '｜对象 ' + args.target + ' 记为已尝试/已通过' : ''))
+        await saveChatLine('【形式化】' + memberId + ' 运行 Lean 通过：' + run.file
+          + '（' + (run.ms / 1000).toFixed(1) + 's）' + (args.target ? '｜对象 ' + args.target + ' 记为已尝试（若此前已通过/已阻塞则保留原状态）' : ''))
       }
       return Object.assign({ ok: !!run.ok }, run, {
         hint: run.ok
@@ -2115,7 +2388,7 @@ export function apply(ctx) {
     // (b) in the same wake as a soft-compact directive — never on every round. The
     // charter itself lives in `persona` and needs no reinforcement otherwise.
     const CORE_RULES = '[核心规则] 只有 Verified/（及标记"已验证·真/假"的卡片）算已确立；' +
-      '任何对象要进 Verified/ 必须 ≥m 名有表决权者一致给出 1 或 0，否则留库附平均概率；' +
+      '任何对象要进 Verified/，必须至少有 m 名有表决权者投出布尔值（恰好 1 或恰好 0）**且没有任何一张反向票**，否则留库附平均概率；' +
       '你只写自己的库（Members/<你>/），可只读任何人的库；组织与分派由院士负责，但判断属于你自己；' +
       '退出时只输出一个 JSON 对象。'
 
@@ -2135,12 +2408,24 @@ export function apply(ctx) {
     }
 
     // ---- artifact libraries (per member, append/write by the member itself) ----
-    const isOffice = (id) => !id || id === 'office'
+    // ONLY the literal 'office' is the office. An EMPTY id means "nobody identifiable" and is
+    // NOT the office: `memberIdOfAgent` answers '' for an unrelated descendant of the root (a
+    // dismissed member's stale child, a nested helper under the office root) and for a synthetic
+    // context with no known member, so `!id || id === 'office'` let such a caller pass EVERY
+    // office gate and sign its writes as the office (audit L6 follow-up). Office-capable tool
+    // handlers now resolve their caller with `officeCaller` and refuse on '' before reaching
+    // here; this predicate fails closed as the second line of defence.
+    const isOffice = (id) => id === 'office'
     const isAcademician = (id) => { const m = memberById(id); return !!m && m.kind === 'academician' }
-    function bumpArtifacts() {
+    // MUST be awaited by its callers: `inst()` reads `stateCache`, which `commit` only updates
+    // once its own await resolves. Fire-and-forget here meant two cards written in one reply
+    // (a single reply can carry `record: [ … ]`) both read the same `artifactCount` and
+    // committed the same `n`, and the `meetingKeepEvery` auto-sync could fire twice on one
+    // count (audit M6).
+    async function bumpArtifacts() {
       const inst0 = inst()
       const n = (Number(inst0.artifactCount) || 0) + 1
-      commit(EV.progress, { at: now(), artifactCount: n }).catch(() => {})
+      await commit(EV.progress, { at: now(), artifactCount: n })
       // Auto-sync meeting every `meetingKeepEvery` artifacts: the framework only
       // CONVENES it, never assigns work. Deferred while a meeting or verification is
       // already in progress so consensus is never preempted (v4 §26).
@@ -2181,7 +2466,7 @@ export function apply(ctx) {
         '- ID: ' + id,
         '- 类型: ' + (kind === 'proposition' ? '命题' : kind === 'method' ? String(args.type || '方法') : '子问题'),
         '- 状态: ' + (kind === 'proposition' ? '未定论' : kind === 'method' ? '经验' : '求解中'),
-        kind === 'proposition' ? '- 概率: ' + clamp01(args.p).toFixed(2) : '- 概率: ' + clamp01(args.p).toFixed(2),
+        '- 概率: ' + clamp01(args.p).toFixed(2),
         '- 价值程度: ' + clamp01(args.value).toFixed(2),
         '- 动机用途计划: ' + String(args.motive),
         '- 记录者: ' + memberId,
@@ -2199,7 +2484,7 @@ export function apply(ctx) {
       }
       const ok = await writeTextRel(rel, head.concat(body).join('\n'))
       if (!ok) return { ok: false, code: 'V5_WRITE_FAILED', message: 'could not write ' + rel }
-      bumpArtifacts()
+      await bumpArtifacts()
       notifyActivity()
       return { ok: true, id, file: rel, kind }
     }
@@ -2324,6 +2609,10 @@ export function apply(ctx) {
       return taskView(t)
     }
     async function taskUpdate(memberId, o) {
+      // An unknown caller must be refused HERE as well: `owner = task.ownerId === memberId` is true
+      // for an UNOWNED task (ownerId '') when memberId is '', so without this guard an
+      // unidentifiable caller would count as the owner of every unclaimed task (audit L6 follow-up).
+      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       const args = o || {}
       const id = String(args.task_id || args.taskId || '')
       const task = inst().tasks.find((x) => x.id === id)
@@ -2420,6 +2709,7 @@ export function apply(ctx) {
     // it can never make any statement true, and the assignee may object with reasons
     // (the objection is broadcast, not silently swallowed).
     async function taskAssign(memberId, o) {
+      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       if (!isOffice(memberId) && !(isAcademician(memberId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can assign tasks' }
       }
@@ -2463,6 +2753,7 @@ export function apply(ctx) {
       return { ok: true, task: taskView(withMeta) }
     }
     async function taskPrioritize(memberId, o) {
+      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       if (!isOffice(memberId) && !(isAcademician(memberId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can set priorities' }
       }
@@ -2541,7 +2832,6 @@ export function apply(ctx) {
     }
 
     // ---- consensus verification (m-vote boolean) --------------------------
-    function verifyRecords() { return Object.keys(inst().verdicts) }
     function currentVerify() {
       const vs = inst().verdicts
       for (const k of Object.keys(vs)) { if (vs[k] && !vs[k].closed) return vs[k] }
@@ -2622,6 +2912,9 @@ export function apply(ctx) {
     // in the mean. Any opposing assertion BLOCKS the verdict, so a minority can never
     // be out-voted by abstention.
     function judgeVerdict(vs) {
+      // E = the LIVE voter set (roster, recomputed on every call). A ballot cast by someone
+      // who is no longer in E — a dismissed member whose entry survived in `vs.votes` — is
+      // NOT counted, in either mode: `Verified/` may only ever be reached by current voters.
       const E = voters().map((m) => m.id)
       const P = E.length
       const m = quorumM()
@@ -2656,6 +2949,35 @@ export function apply(ctx) {
       if (bFalse >= m && bTrue === 0) return Object.assign(base, { outcome: 'false', reason: bFalse + ' >= m=' + m + ', all assert false' })
       return Object.assign(base, { outcome: 'undecided', reason: 'quorum not met' })
     }
+    // ONE atomic append to the durable verify queue. The duplicate check and the append both run
+    // INSIDE the event fold, so two proposals made in the same tick can no longer both read the
+    // same array and overwrite each other's entry (the audit's lost-proposal race: a
+    // `Promise.all` of two `vibe_v5_propose_verify` calls kept only the second, while both calls
+    // reported `ok:true` and the first target existed in neither the queue nor `verdicts`).
+    async function appendToQueue(entry) {
+      let result = { appended: false, length: 0 }
+      await commit(EV.queue, { queue: (cur) => {
+        const list = Array.isArray(cur) ? cur : []
+        if (list.some((p) => p && p.target === entry.target)) { result = { appended: false, length: list.length }; return list }
+        const next = list.concat([entry])
+        result = { appended: true, length: next.length }
+        return next
+      } })
+      return result
+    }
+    // Remove and return the head in ONE atomic commit: an append landing in between can never be
+    // lost by it, and a removed entry can never be resurrected by an append that read the queue
+    // before the removal.
+    async function takeQueueHead() {
+      let head = null
+      await commit(EV.queue, { queue: (cur) => {
+        const list = Array.isArray(cur) ? cur : []
+        if (!list.length) return list
+        head = list[0]
+        return list.slice(1)
+      } })
+      return head
+    }
     // Queue a proposal UNLESS the same object was just closed as 真/假 (a dedup window
     // prevents several members independently proposing the same object in one tick
     // from running it end-to-end twice — v4 §26 test9).
@@ -2666,18 +2988,20 @@ export function apply(ctx) {
       if (recent !== undefined && (now() - recent) < recoverStallMs()) {
         return { ok: true, deduped: true, message: t + ' 刚刚定论，忽略重复提议' }
       }
-      const q = inst().queue.slice()
-      if (q.some((p) => p.target === t)) return { ok: true, deduped: true, message: t + ' 已在验证队列中' }
-      if (currentVerify() && currentVerify().target === t) return { ok: true, deduped: true, message: t + ' 正在验证中' }
-      q.push({ target: t, kind: kind || guessTargetKind(t), proposer: isOffice(proposer) ? 'office' : proposer, reason: String(reason || ''), at: now() })
-      await putQueue(q)
+      const cv = currentVerify()
+      if (cv && cv.target === t) return { ok: true, deduped: true, message: t + ' 正在验证中' }
+      const added = await appendToQueue({
+        target: t, kind: kind || guessTargetKind(t),
+        proposer: isOffice(proposer) ? 'office' : proposer, reason: String(reason || ''), at: now(),
+      })
+      if (!added.appended) return { ok: true, deduped: true, message: t + ' 已在验证队列中' }
       notifyActivity()
       // Start it NOW rather than hoping a scheduling pass reaches it. A pass may already
       // be in flight and PAST its arming point, in which case a bare `scheduleNext()`
       // only sets the trampoline flag and the proposal waits for the next iteration.
       await armNextVerify()
       if (!hasVerifyInFlight()) await scheduleNext()
-      return { ok: true, queued: t, pendingVerifyCount: q.length, started: hasVerifyInFlight() }
+      return { ok: true, queued: t, pendingVerifyCount: added.length, started: hasVerifyInFlight() }
     }
     async function beginVerify(proposal) {
       dbg.begin += 1
@@ -2865,8 +3189,7 @@ export function apply(ctx) {
       // `maybeQueueVerify` calls this directly (bypassing schedulePass, whose meeting
       // check is what used to hide the asymmetry). The meeting's watchdog clock would
       // then be starved while two coordination processes competed for the same members.
-      // The proposal stays in the queue; schedulePass reaches this again once the
-      // meeting is over.
+      // The proposal stays in the queue; schedulePass reaches this again once the meeting is over.
       if (meeting) return
       // Only one begin may be in flight. Without this, two callers (a scheduling pass
       // and a fresh proposal) could both pass the `currentVerify()` check before either
@@ -2875,10 +3198,21 @@ export function apply(ctx) {
       if (currentVerify()) return
       beginLock = true
       try {
-        const q = inst().queue.slice()
-        while (q.length) {
-          const p = q.shift()
-          await putQueue(q)
+        while (true) {
+          // NEVER remove a proposal we are not about to run: the entry leaves the durable
+          // queue only in the same step that starts it. The old code shifted it out and then
+          // returned because a meeting was live, so the proposal existed in neither the queue
+          // nor `verdicts` until some later pass happened to re-arm it (audit M2). Re-check
+          // the exclusion guards here too: `await putQueue` can let a meeting open.
+          const q = inst().queue.slice()
+          if (!q.length) return
+          if (meeting || currentVerify()) return
+          // Take the head in ONE atomic commit (`takeQueueHead` re-reads the queue inside the
+          // fold). The exclusion guards above are deliberately NOT re-checked inside it: a third
+          // copy of them would make the sensitivity probes that remove the two real copies inert
+          // (they would still hold, and the suite would look like a blind spot).
+          const p = await takeQueueHead()
+          if (!p) return
           const recent = verifiedRecently.get(p.target)
           if (recent !== undefined && (now() - recent) < recoverStallMs()) continue
           const vs = await beginVerify(p)
@@ -3038,6 +3372,11 @@ export function apply(ctx) {
       solveVotes.clear()
       await putMeeting({ id, agenda: meeting.agenda, kind: meeting.kind, at: now(), file: 'Shared/Meetings/' + id + '.md' })
       await saveChatLine('【会议 ' + id + '】召开：' + meeting.agenda + '（类型：' + meeting.kind + '｜召集人：' + meeting.by + '）')
+      // A meeting that ACTUALLY begins and was convened by the office is the other half of the
+      // `paperEditor='office'` consultation requirement (docs/final-paper.md §7). Counted here, not at the
+      // request: a parked/refused request is not a consultation. A FRAMEWORK-convened stall
+      // meeting (`auto:true`) is not the office's own act, so it does not count either.
+      if (meeting.by === 'office' && opts.auto !== true) await notePaperConsult('meeting')
       await mkdirs()
       await writeTextRel('Shared/Meetings/' + id + '.md', [
         '# 会议纪要｜' + id + '｜' + instituteName,
@@ -3156,9 +3495,24 @@ export function apply(ctx) {
     // Stop ONLY on a unanimous true solve-vote from every VOTING member. There is no
     // forced/flat/near-consensus closure: any objection keeps the institute working.
     async function checkSolved() {
+      if (autoDone) return true
       const vs = voters().map((m) => m.id)
       if (!vs.length) return false
       if (!vs.every((id) => solveVotes.get(id) === true)) return false
+      // ── THE FINAL PAPER PHASE COMES FIRST (docs/final-paper.md §3) ────────────────────────────────
+      // `finishRun` flips phase='solved' / autoDone / running=false, after which the machinery
+      // REFUSES: `wakeIfIdle` returns false, `startMeeting` rejects a concluded institute and
+      // nothing schedules — so the co-writing, the cross-review and the office consultation
+      // could never run. The run therefore stays alive here until the paper is finalised
+      // (or degraded with a report), and `finalizePaper` calls `finishRun` for us.
+      if (params.finalPaper !== false) {
+        const p = paper()
+        if (!p) { await startPaper('run-complete', {}); return true }
+        if (p.status !== 'finalized') {
+          if (!p.completesRun) await mutatePaper((cur) => (cur ? Object.assign({}, cur, { completesRun: true }) : cur))
+          return true
+        }
+      }
       await finishRun('全体有表决权者一致认为原问题已解决')
       return true
     }
@@ -3196,6 +3550,916 @@ export function apply(ctx) {
       notifyActivity()
     }
 
+    // ================= final paper (docs/final-paper.md) ============
+    // THE PHASE RUNS BEFORE `finishRun` (docs/final-paper.md §3). After `phase='solved'` the machinery
+    // refuses: `wakeIfIdle` (:3257) returns false, `startMeeting` refuses a concluded
+    // institute, and a concluded run has no scheduling at all — so the co-writing, the
+    // cross-review and the office consultation could never run. `checkSolved` therefore
+    // enters this phase while the run is still alive and only calls `finishRun` once the
+    // paper is finalised (or degraded with a report).
+    //
+    // Only evidence that ALREADY exists is written down: verified verdicts, the task board,
+    // the Lean records, the members' libraries and the members' own text. The framework never
+    // invents content — sections 3/6/7/8 are the members' own words, 4/5/9 are derived from
+    // durable state, and undecided/refuted items are always marked as such.
+    const PAPER_FILE = (id, file) => 'Paper/' + id + '/' + file
+    function paper() { return inst().paper || null }
+    function paperActive() { const p = paper(); return !!p && p.status !== 'finalized' }
+    function paperParticipants() {
+      return activeMembers().filter((m) => m.kind === 'academician' || m.kind === 'researcher').map((m) => m.id)
+    }
+    function paperActiveParticipants(p) {
+      return ((p && p.participants) || []).filter((id) => { const m = memberById(id); return !!m && m.phase === 'active' })
+    }
+    function paperConfiguredEditor() { return params.paperEditor === 'office' ? 'office' : 'academician' }
+    function paperIdFromState() {
+      const a = idSafe(instituteName)
+      if (a) return a
+      const b = idSafe(String(runId || (inst() && inst().runId) || ''))
+      return b || 'institute'
+    }
+    async function fileExistsAbs(abs) {
+      try { const t = await fsTargetAbs(abs); return (await fs.stat(t)) !== undefined } catch (e) { return false }
+    }
+    function paperAbs(id, file) { return instRoot() + '/' + PAPER_FILE(id, file) }
+    function paperDirRel(id) { return 'Paper/' + id }
+    async function mutatePaper(fn) {
+      await patchInstitute({ paper: (cur) => { const next = fn(cur === undefined ? null : cur); return next === undefined ? (cur === undefined ? null : cur) : next } })
+      return paper()
+    }
+    async function paperLog(title, body) {
+      const p = paper()
+      const id = (p && p.id) || paperIdFromState()
+      const rel = PAPER_FILE(id, 'paper.log.md')
+      const prev = (await readTextRel(rel)) || ('# 最终论文流程日志｜' + id + '\n\n')
+      await writeTextRel(rel, prev + '## ' + title + '\n\n' + String(body || '') + '\n\n')
+      return rel
+    }
+    function paperAskEvery() { return posMs(params.activityTimeoutMs, 120000) }
+    function paperNextStep(p) {
+      if (!p) return 'no paper flow yet: finish the run with finalPaper=true, or trigger /v5 paper manually'
+      if (p.status === 'finalized') return 'finalised — /v5 paper force rewrites it'
+      if (p.status === 'writing') return 'waiting for the staff parts (round ' + p.round + '/' + PAPER_MAX_ROUNDS + ')'
+      if (p.status === 'reviewing') return 'waiting for the cross-reviews (each reviewer judges another part)'
+      if (p.status === 'awaiting-editor' && p.editor === 'office') {
+        return 'awaiting the OFFICE: send >=1 office message and convene >=1 meeting, then call vibe_v5_finalize_paper (consultation so far: messages=' +
+          Number((p.consult || {}).messages || 0) + ', meetings=' + Number((p.consult || {}).meetings || 0) + ')'
+      }
+      if (p.status === 'awaiting-editor') return 'waiting for the academician to finalise'
+      return p.status
+    }
+    function paperAutoNote() {
+      return params.finalPaper === false ? '自动已关闭（finalPaper=false）；本次为手动触发，仍会生成论文。' : ''
+    }
+    function paperSummary() {
+      const p = paper()
+      if (!p) return null
+      return {
+        id: p.id, status: p.status, stage: p.stage, round: p.round,
+        editor: p.editor, editorFallback: !!p.editorFallback, completesRun: !!p.completesRun,
+        participants: p.participants || [],
+        parts: Object.keys(p.parts || {}).map((id) => ({ member: id, round: (p.parts[id] || {}).round, title: (p.parts[id] || {}).title || '' })),
+        reviews: Object.keys(p.reviews || {}).map((id) => ({ member: id, of: (p.reviews[id] || {}).of || '', round: (p.reviews[id] || {}).round, deliverable: (p.reviews[id] || {}).deliverable === true })),
+        reviewOf: p.reviewOf || {},
+        consult: Object.assign({ messages: 0, meetings: 0 }, p.consult || {}),
+        lang: p.lang, format: p.format, compilePdf: p.pdf === true,
+        compile: p.compile || null, engine: p.engine || '', artifacts: p.artifacts || [],
+        warnings: p.warnings || [], disagreement: p.disagreement || [], skipped: p.skipped || [],
+        forcedAfterCap: !!p.forcedAfterCap, finalizedAt: p.finalizedAt || null,
+        dir: 'Paper/' + p.id + '/', next: paperNextStep(p),
+        meta: p.status === 'finalized' ? 'Paper/' + p.id + '/paper.meta.json' : null,
+      }
+    }
+
+    // ---- the three asks ----------------------------------------------------
+    function paperWritePrompt(member, p) {
+      const L = []
+      L.push('【最终论文·撰写 —— ' + kindLabel(member.kind) + ' ' + member.id + '】')
+      L.push('本所对原问题的一致结论已经达成，现在撰写**最终论文**（第 ' + p.round + '/' + PAPER_MAX_ROUNDS + ' 轮）。')
+      L.push('请你**只写你自己库里已有证据支撑**的内容：')
+      L.push('- 直接引用你的卡片（Members/' + member.id + '/Propos|Methods|Subproblems/）、Members/' + member.id + '/Progress/progress.md、你参与的表决记录；')
+      L.push('- **不得编造**：没有证据的推测不要写成结论；未决 / 被否证的条目必须显式标注“未定论 / 已被否证”；')
+      L.push('- 在 evidence 里写清证据路径，附录会逐条索引。')
+      if (p.round > 1) {
+        const rv = (p.reviews || {})[member.id]
+        L.push('')
+        L.push('上一轮互审给你（' + member.id + '）部分的意见：' + (rv ? String(rv.comments || '（无具体意见）') : '（无）'))
+        L.push('请据此修订；若不同意该意见，请在 limits 里写明理由。')
+      }
+      L.push('')
+      L.push('------------')
+      L.push(stateBlock(member))
+      L.push('------------')
+      L.push('结束时只输出一个 JSON 对象：')
+      L.push('{ "paper_part": {')
+      L.push('    "title": "你这部分的标题",')
+      L.push('    "solution": "你对**原问题完整解法**的贡献（推理链与结论，只写有证据的）",')
+      L.push('    "methods": "你创造/发现的方法、理论、思想、有价值经验、数学理解",')
+      L.push('    "rules": "你从这些工作中归纳出的可复用规律",')
+      L.push('    "limits": "局限、未决、被否证之处（必须诚实、显式）",')
+      L.push('    "evidence": ["Members/' + member.id + '/Propos/p-x.md"] } }')
+      return L.join('\n')
+    }
+    function paperReviewPrompt(member, p, ofId) {
+      const part = ofId ? (p.parts || {})[ofId] : null
+      const L = []
+      L.push('【最终论文·互审 —— ' + kindLabel(member.kind) + ' ' + member.id + '】')
+      L.push('请你审阅 **' + (ofId || '（未指定）') + '** 撰写的部分，判断它是否可以交付（deliverable）。')
+      L.push('要点：证据是否充分；是否与已定论的表决一致；有无编造或未标注的未决项；术语与符号是否清楚。')
+      L.push('')
+      L.push('------------ 待审部分（' + (ofId || '') + '）------------')
+      L.push('标题：' + ((part && part.title) || '(无)'))
+      L.push('【完整解法】' + String((part && part.solution) || '(空)').slice(0, 6000))
+      L.push('【方法/理论/思想/经验/理解】' + String((part && part.methods) || '(空)').slice(0, 4000))
+      L.push('【规律】' + String((part && part.rules) || '(空)').slice(0, 3000))
+      L.push('【局限/未决】' + String((part && part.limits) || '(空)').slice(0, 3000))
+      L.push('【声称的证据】' + ((((part && part.evidence) || []).join('、')) || '(无)'))
+      L.push('------------')
+      L.push('')
+      L.push(stateBlock(member))
+      L.push('')
+      L.push('结束时只输出一个 JSON 对象：')
+      L.push('{ "paper_review": { "of": "' + (ofId || '') + '", "deliverable": true, "comments": "具体意见" } }')
+      L.push('deliverable 必须是 true（可交付）或 false（不可交付，需修改）。只有**全体参与成员**都投 true，定稿代表才能定稿。')
+      return L.join('\n')
+    }
+    function paperFinalPrompt(member, p) {
+      const L = []
+      L.push('【最终论文·定稿（院士）—— ' + member.id + '】')
+      L.push('全体参与成员已在互审中表示“可交付”。请你作为定稿代表做**最后一次**把关：')
+      L.push('核对合并稿与互审意见，确认没有编造、没有未标注的未决项、没有与表决记录矛盾之处，然后给出决定。')
+      L.push('')
+      L.push('------------ 合并稿（各成员部分）------------')
+      for (const id of paperActiveParticipants(p)) {
+        const part = (p.parts || {})[id] || {}
+        L.push('### ' + id + '｜' + String(part.title || ''))
+        L.push('【完整解法】' + String(part.solution || '').slice(0, 3000))
+        L.push('【方法/规律】' + (String(part.methods || '') + ' ' + String(part.rules || '')).slice(0, 2000))
+        L.push('【局限】' + String(part.limits || '').slice(0, 1500))
+        L.push('')
+      }
+      L.push('------------ 互审结论 ------------')
+      for (const id of Object.keys(p.reviews || {})) {
+        const rv = p.reviews[id] || {}
+        L.push('- ' + id + ' 审 ' + (rv.of || '?') + '：deliverable=' + (rv.deliverable === true) + '｜' + String(rv.comments || '').slice(0, 500))
+      }
+      if ((p.disagreement || []).length) L.push('- ⚠ 已达轮次上限仍有分歧：' + JSON.stringify(p.disagreement[p.disagreement.length - 1]).slice(0, 500))
+      L.push('------------')
+      L.push('')
+      L.push(stateBlock(member))
+      L.push('')
+      L.push('结束时只输出一个 JSON 对象：')
+      L.push('{ "paper_final": { "decision": "deliverable" | "revise",')
+      L.push('    "note": "定稿说明：你如何审阅、统一术语与符号、是否发现并纠正了问题",')
+      L.push('    "conclusion": "（可选）定稿代表对原问题的最终结论（只写有证据的）" } }')
+      L.push('decision="revise" 会退回继续修订（有轮次上限）。')
+      return L.join('\n')
+    }
+
+    // ---- the stage driver --------------------------------------------------
+    let paperLock = false
+    async function paperStep() {
+      const p = paper()
+      if (!p || p.status === 'finalized' || p.status === 'awaiting-editor') return false
+      const active = paperActiveParticipants(p)
+      if (!active.length) return await paperAdvance(p, active)
+      const parts = p.parts || {}
+      const reviews = p.reviews || {}
+      const missing = p.status === 'writing'
+        ? active.filter((id) => !(parts[id] && parts[id].round === p.round))
+        : active.filter((id) => !(reviews[id] && reviews[id].round === p.round))
+      if (!missing.length) return await paperAdvance(p, active)
+      const budget = Math.max(1, Math.floor(Number(params.maxParallel) || 3))
+      let asked = 0
+      for (const id of missing) {
+        if (asked >= budget) break
+        if (busy.has(id)) continue
+        const m = memberById(id)
+        if (!m || m.phase !== 'active') continue
+        const last = (p.lastAskAt || {})[id] || 0
+        if (last && (now() - last) < paperAskEvery()) continue
+        const prompt = p.status === 'writing'
+          ? paperWritePrompt(m, p)
+          : paperReviewPrompt(m, p, (p.reviewOf || {})[id])
+        // `wakeMember`, not `wakeIfIdle`: the paper phase deliberately drives members with a
+        // dedicated ask, and a research round must never be mistaken for a paper answer.
+        const ok = await wakeMember(m, prompt, 'paper')
+        if (ok) {
+          asked += 1
+          await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+            lastAskAt: Object.assign({}, cur.lastAskAt || {}, { [id]: now() }), updatedAt: now(),
+          }) : cur))
+        }
+      }
+      // Nothing to advance yet. ALWAYS re-arm: the pass that got here may have skipped an ask
+      // because its member is busy or still inside the ask window, and `schedulePass` returns
+      // from the paper branch BEFORE its own heartbeat arming — without this a paper whose ask
+      // was paced out would stall until some unrelated member turn ended.
+      if (asked) { armHeartbeat(); return false }
+      // Stall watchdog (same clock as meetings/verifications): a member whose turn never ends
+      // must not wedge the paper forever. The stuck members are recorded as non-participants.
+      const stale = now() - Number(p.updatedAt || p.createdAt || now())
+      if (stale >= recoverStallMs()) {
+        const stuck = missing.filter((id) => busy.has(id))
+        const name = stuck.length ? stuck : missing
+        const warn = '看门狗：' + name.join('、') + ' 在 ' + Math.round(stale / 1000) + 's 内没有交稿，已按“未参与”处理并记入附录。'
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          warnings: (cur.warnings || []).concat([warn]),
+          skipped: Array.from(new Set((cur.skipped || []).concat(name))), updatedAt: now(),
+        }) : cur))
+        await paperLog('看门狗', warn)
+        return await paperAdvance(paper(), paperActiveParticipants(paper()))
+      }
+      armHeartbeat()
+      return false
+    }
+    async function paperAdvance(p, active) {
+      if (p.status === 'writing') {
+        const reviewOf = {}
+        for (let i = 0; i < active.length; i++) reviewOf[active[i]] = active[(i + 1) % active.length]
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          status: 'reviewing', stage: 'reviewing', reviewOf, reviews: {}, lastAskAt: {}, updatedAt: now(),
+        }) : cur))
+        await paperLog('进入互审（第 ' + p.round + ' 轮）', active.map((a) => a + ' 审 ' + reviewOf[a]).join('；') || '（无参与成员）')
+        return true
+      }
+      if (p.status === 'reviewing') {
+        const reviews = p.reviews || {}
+        const refusers = active.filter((id) => !(reviews[id] && reviews[id].deliverable === true))
+        if (!refusers.length) {
+          await mutatePaper((cur) => (cur ? Object.assign({}, cur, { status: 'awaiting-editor', stage: 'awaiting-editor', lastAskAt: {}, updatedAt: now() }) : cur))
+          await paperLog('互审一致：可交付', '全体参与成员（' + active.join('、') + '）均表示可交付。定稿代表：' + p.editor)
+          return true
+        }
+        const detail = refusers.map((id) => id + '：' + String((reviews[id] || {}).comments || '未说明')).join('；')
+        const entry = { round: p.round, members: refusers, detail, at: now() }
+        if (p.round < PAPER_MAX_ROUNDS) {
+          await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+            status: 'writing', stage: 'writing', round: cur.round + 1, lastAskAt: {}, updatedAt: now(),
+            disagreement: (cur.disagreement || []).concat([entry]),
+          }) : cur))
+          await paperLog('互审未达成一致 → 进入第 ' + (p.round + 1) + ' 轮', detail)
+          return true
+        }
+        const warn = '互审在 ' + PAPER_MAX_ROUNDS + ' 轮上限仍未达成全体一致（' + refusers.join('、') + '）；分歧已写入论文附录。'
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          status: 'awaiting-editor', stage: 'awaiting-editor', lastAskAt: {}, updatedAt: now(),
+          warnings: (cur.warnings || []).concat([warn]), disagreement: (cur.disagreement || []).concat([entry]), forcedAfterCap: true,
+        }) : cur))
+        await paperLog('达到轮次上限：转交定稿代表', warn)
+        return true
+      }
+      return false
+    }
+    async function paperAwaitEditor(p) {
+      if (p.editor !== 'academician') return false   // office: waits for vibe_v5_finalize_paper
+      const id = academicianId()
+      if (!id) {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          editor: 'office', editorFallback: true, updatedAt: now(),
+          warnings: (cur.warnings || []).concat(['定稿代表 academician 不在册：已回退为 office（需人工定稿）。']),
+        }) : cur))
+        await paperLog('定稿代表回退', 'academician 不在册，回退为 office：用 /v5 paper 或 vibe_v5_finalize_paper 定稿（仍需先与全所交流并开会）。')
+        return false
+      }
+      const m = memberById(id)
+      if (!m || m.phase !== 'active') return false
+      if (busy.has(id)) { armHeartbeat(); return false }
+      const last = (p.lastAskAt || {})[id] || 0
+      if (last && (now() - last) < paperAskEvery()) { armHeartbeat(); return false }
+      const ok = await wakeMember(m, paperFinalPrompt(m, p), 'paper')
+      if (ok) await mutatePaper((cur) => (cur ? Object.assign({}, cur, { lastAskAt: Object.assign({}, cur.lastAskAt || {}, { [id]: now() }), updatedAt: now() }) : cur))
+      armHeartbeat()
+      return false
+    }
+    // The ONE driver. Called from `onMemberEnd` (after the reply is folded), from the manual
+    // tools/command, from the resume path and from `schedulePass`; `paperLock` keeps it single.
+    async function paperPass() {
+      if (paperLock) return false
+      paperLock = true
+      try {
+        for (let i = 0; i < 6; i++) {
+          const p = paper()
+          if (!p || p.status === 'finalized') return false
+          if (p.status === 'awaiting-editor') { await paperAwaitEditor(p); return false }
+          const advanced = await paperStep()
+          if (!advanced) return false
+        }
+        return false
+      } catch (e) {
+        console.error('vibe-math-v5: paper pass: ' + String((e && e.stack) || e))
+        return false
+      } finally { paperLock = false }
+    }
+
+    // ---- start / record / consult / finalize -------------------------------
+    async function startPaper(trigger, opts) {
+      const o = opts || {}
+      const trg = String(trigger || 'manual')
+      const existing = paper()
+      if (existing && existing.status === 'finalized' && !o.force) {
+        const refill = await refillPaperArtifacts(existing)
+        return { ok: true, alreadyFinalized: true, id: existing.id, dir: 'Paper/' + existing.id + '/', refill, autoDisabled: params.finalPaper === false, note: paperAutoNote() }
+      }
+      if (existing && existing.status !== 'finalized' && !o.force) {
+        return { ok: true, alreadyRunning: true, id: existing.id, status: existing.status, stage: existing.stage, round: existing.round, next: paperNextStep(existing), autoDisabled: params.finalPaper === false, note: paperAutoNote() }
+      }
+      const participants = paperParticipants()
+      // A per-call editor override (`/v5 paper editor=office`) is ONE-SHOT: it is not written
+      // back into the persisted params. An AUTOMATIC (run-complete) trigger always uses the
+      // academician — the office is the root session and has no wake path (docs/final-paper.md §7).
+      const configured = (o.editor === 'office' || o.editor === 'academician') ? o.editor : paperConfiguredEditor()
+      const editor = trg === 'run-complete' ? 'academician' : configured
+      const configWantsOffice = configured === 'office'
+      const editorNote = (trg === 'run-complete' && configWantsOffice)
+        ? 'paperEditor=office 已配置，但自动（收口）触发必须由**可唤醒**的院士定稿（所办是根会话，没有唤醒路径）；本次自动流程用 academician。要所办定稿请在收尾后用 /v5 paper 手动触发。'
+        : (editor === 'office' ? '所办定稿：必须先与全所交流（>=1 条所办消息）并至少召开一次会议，结论写进定稿说明，然后调用 vibe_v5_finalize_paper。' : '')
+      const lang = (o.lang === 'en' || o.lang === 'zh') ? o.lang : (params.paperLanguage === 'en' ? 'en' : 'zh')
+      const format = ['both', 'md', 'tex'].indexOf(o.format) !== -1 ? o.format : (['both', 'md', 'tex'].indexOf(params.paperFormat) !== -1 ? params.paperFormat : 'both')
+      const p = {
+        id: paperIdFromState(), status: 'writing', stage: 'writing', round: 1,
+        trigger: trg, createdAt: now(), updatedAt: now(),
+        participants, parts: {}, reviews: {}, reviewOf: {}, final: null,
+        editor, editorNote, completesRun: trg === 'run-complete',
+        lang, format, pdf: params.paperCompilePdf !== false,
+        consult: { messages: 0, meetings: 0 },
+        lastAskAt: {}, warnings: editorNote ? [editorNote] : [], disagreement: [], skipped: [], artifacts: [],
+        forced: !!o.force, forceReason: o.force ? String(o.reason || 'manual force') : '',
+      }
+      await patchInstitute({ paper: p })
+      await paperLog('流程开始（' + (trg === 'run-complete' ? '收口自动触发' : '手动触发') + '）', [
+        '- 目录：Paper/' + p.id + '/',
+        '- 语言：' + p.lang + '｜格式：' + p.format + '｜编译 PDF：' + p.pdf,
+        '- 参与成员：' + (participants.join('、') || '（无常驻成员）'),
+        '- 定稿代表：' + editor + (editorNote ? '（' + editorNote + '）' : ''),
+      ].join('\n'))
+      await paperPass()
+      return {
+        ok: true, started: true, id: p.id, dir: 'Paper/' + p.id + '/', status: 'writing',
+        participants, editor, next: paperNextStep(paper()),
+        autoDisabled: params.finalPaper === false, note: paperAutoNote(),
+      }
+    }
+    async function paperRecordPart(memberId, raw) {
+      const p = paper()
+      if (!p || p.status !== 'writing') return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper flow is not in its writing stage (now: ' + (p ? p.status : 'none') + ')' }
+      if ((p.participants || []).indexOf(memberId) === -1) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: memberId + ' is not a writing participant of this paper' }
+      const part = {
+        member: memberId, round: p.round,
+        title: String(raw.title || '').slice(0, 300),
+        solution: String(raw.solution || '').slice(0, 20000),
+        methods: String(raw.methods || '').slice(0, 20000),
+        rules: String(raw.rules || '').slice(0, 12000),
+        limits: String(raw.limits || '').slice(0, 12000),
+        evidence: Array.isArray(raw.evidence) ? raw.evidence.map(String).slice(0, 50) : [],
+        at: now(),
+      }
+      if (!part.title && !part.solution && !part.methods && !part.rules && !part.limits) {
+        await notice(memberId, 'paper_part 是空的：请至少给出 title 与你的贡献正文（solution/methods/rules/limits），只写库里已有证据支撑的内容。')
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'paper_part carries no content' }
+      }
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, { parts: Object.assign({}, cur.parts || {}, { [memberId]: part }), updatedAt: now() }) : cur))
+      await paperLog('收到 ' + memberId + ' 的部分（第 ' + p.round + ' 轮）', '- 标题：' + (part.title || '(无)') + '\n- 声称证据：' + (part.evidence.length || 0) + ' 条')
+      return { ok: true, recorded: memberId, round: p.round }
+    }
+    async function paperRecordReview(memberId, raw) {
+      const p = paper()
+      if (!p || p.status !== 'reviewing') return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper flow is not in its cross-review stage (now: ' + (p ? p.status : 'none') + ')' }
+      if ((p.participants || []).indexOf(memberId) === -1) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: memberId + ' is not a review participant of this paper' }
+      if (raw.deliverable !== true && raw.deliverable !== false) {
+        await notice(memberId, 'paper_review.deliverable 必须是 true 或 false（你敢不敢交付？未表态不算可交付）。')
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'paper_review.deliverable must be a boolean' }
+      }
+      const assigned = (p.reviewOf || {})[memberId]
+      const rev = {
+        member: memberId, of: String(raw.of || assigned || ''), round: p.round,
+        deliverable: raw.deliverable === true,
+        comments: String(raw.comments || '').slice(0, 8000), at: now(),
+      }
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, { reviews: Object.assign({}, cur.reviews || {}, { [memberId]: rev }), updatedAt: now() }) : cur))
+      await paperLog('互审意见｜' + memberId + ' → ' + rev.of, '- deliverable：' + rev.deliverable + '\n- 意见：' + (rev.comments || '（无）').slice(0, 2000))
+      return { ok: true, recorded: memberId, of: rev.of, deliverable: rev.deliverable }
+    }
+    async function paperRecordFinal(memberId, raw) {
+      const p = paper()
+      if (!p || p.status !== 'awaiting-editor') return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper is not awaiting its editor (now: ' + (p ? p.status : 'none') + ')' }
+      if (p.editor !== 'academician' || memberId !== academicianId()) {
+        return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'paperEditor is "' + p.editor + '": the academician does not finalise this paper' }
+      }
+      const decision = String(raw.decision || '')
+      if (decision !== 'deliverable' && decision !== 'revise') {
+        await notice(memberId, "paper_final.decision 必须是 'deliverable' 或 'revise'（收到 " + decision + '）。')
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'decision must be deliverable|revise' }
+      }
+      const fin = { by: memberId, decision, note: String(raw.note || '').slice(0, 4000), conclusion: String(raw.conclusion || '').slice(0, 20000), at: now() }
+      if (decision === 'deliverable') {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, { final: fin, updatedAt: now() }) : cur))
+        return await finalizePaper('academician-deliverable')
+      }
+      if (p.round < PAPER_MAX_ROUNDS) {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          final: fin, status: 'writing', stage: 'writing', round: cur.round + 1, lastAskAt: {}, updatedAt: now(),
+          disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: [memberId], detail: '定稿代表要求修订：' + fin.note, at: now() }]),
+        }) : cur))
+        await paperLog('定稿代表要求修订 → 第 ' + (p.round + 1) + ' 轮', fin.note || '（未说明）')
+        return { ok: true, revised: true, round: p.round + 1 }
+      }
+      const warn = '定稿代表在第 ' + PAPER_MAX_ROUNDS + ' 轮上限仍要求修订；按规格记警告并定稿（分歧写入附录）。'
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+        final: fin, warnings: (cur.warnings || []).concat([warn]), forcedAfterCap: true, updatedAt: now(),
+        disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: [memberId], detail: '定稿代表要求修订：' + fin.note, at: now() }]),
+      }) : cur))
+      await paperLog('达到轮次上限：定稿代表仍要求修订', warn)
+      return await finalizePaper('academician-revise-at-cap')
+    }
+    // The office consultation gate (v2 §A6 / the user's requirement): the office may finalise
+    // ONLY after it has actually talked to the institute (>=1 office message) AND convened at
+    // least one meeting; both counts are recorded in the finalisation note and the meta.
+    async function finalizePaperByOffice(o) {
+      const args = o || {}
+      const p = paper()
+      if (!p) return { ok: false, code: 'V5_PAPER_STATE', message: 'no paper flow has been started (finish the run with finalPaper=true, or use /v5 paper)' }
+      if (p.status === 'finalized' && !args.force) {
+        const refill = await refillPaperArtifacts(p)
+        return { ok: true, alreadyFinalized: true, id: p.id, refill, autoDisabled: params.finalPaper === false, note: paperAutoNote() }
+      }
+      if (p.status !== 'awaiting-editor') {
+        return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper flow is in stage "' + p.status + '"; the editor finalises only after every part is written and cross-reviewed' }
+      }
+      if (p.editor !== 'office') {
+        return { ok: false, code: 'V5_NOT_OFFICE', message: 'paperEditor="academician": the academician finalises from its own round; the office does not' }
+      }
+      const decision = String(args.decision || '')
+      if (decision !== 'deliverable' && decision !== 'revise') return { ok: false, code: 'V5_INVALID_ARGUMENT', message: "decision must be 'deliverable' or 'revise'" }
+      const note = String(args.note || '').trim()
+      if (decision === 'deliverable' && !note) {
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: '定稿说明（note）是必填的：写明你如何与全所交流、商讨、优化、审查，以及结论' }
+      }
+      const consult = Object.assign({ messages: 0, meetings: 0 }, p.consult || {})
+      if (!(Number(consult.messages) > 0) || !(Number(consult.meetings) > 0)) {
+        return {
+          ok: false, code: 'V5_PAPER_CONSULT_REQUIRED',
+          message: 'paperEditor="office" 要求所办先与全所交流、商讨、优化、审查：至少 1 条所办消息（vibe_v5_message）+ 至少 1 次会议（vibe_v5_meeting），然后才能定稿。当前：messages=' +
+            Number(consult.messages || 0) + ', meetings=' + Number(consult.meetings || 0),
+          consult: { messages: Number(consult.messages || 0), meetings: Number(consult.meetings || 0) },
+        }
+      }
+      const fin = {
+        by: 'office', decision, note: String(note).slice(0, 4000),
+        conclusion: String(args.conclusion || '').slice(0, 20000),
+        consult: { messages: Number(consult.messages || 0), meetings: Number(consult.meetings || 0) },
+        at: now(),
+      }
+      if (decision === 'deliverable') {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, { final: fin, updatedAt: now() }) : cur))
+        return await finalizePaper('office-deliverable')
+      }
+      if (p.round < PAPER_MAX_ROUNDS) {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          final: fin, status: 'writing', stage: 'writing', round: cur.round + 1, lastAskAt: {}, updatedAt: now(),
+          disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: ['office'], detail: '所办要求修订：' + fin.note, at: now() }]),
+        }) : cur))
+        await paperLog('所办要求修订 → 第 ' + (p.round + 1) + ' 轮', fin.note)
+        return { ok: true, revised: true, round: p.round + 1 }
+      }
+      const warn = '所办在第 ' + PAPER_MAX_ROUNDS + ' 轮上限仍要求修订；按规格记警告并定稿（分歧写入附录）。'
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+        final: fin, warnings: (cur.warnings || []).concat([warn]), forcedAfterCap: true, updatedAt: now(),
+        disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: ['office'], detail: '所办要求修订：' + fin.note, at: now() }]),
+      }) : cur))
+      await paperLog('达到轮次上限：所办仍要求修订', warn)
+      return await finalizePaper('office-revise-at-cap')
+    }
+    // Count the office's consultation evidence. Called from the ONE place each act really
+    // happens (`say` for a message, `beginMeeting` for a meeting that actually starts), so the
+    // gate cannot be satisfied by merely intending to consult.
+    async function notePaperConsult(kind) {
+      const p = paper()
+      if (!p || p.status === 'finalized') return
+      const key = kind === 'meeting' ? 'meetings' : 'messages'
+      await mutatePaper((cur) => {
+        if (!cur || cur.status === 'finalized') return cur
+        const consult = Object.assign({ messages: 0, meetings: 0 }, cur.consult || {})
+        consult[key] = Number(consult[key] || 0) + 1
+        return Object.assign({}, cur, { consult, updatedAt: now() })
+      })
+    }
+
+    // ---- artifacts ---------------------------------------------------------
+    function paperEvidence() {
+      const s = inst()
+      const V = s.verdicts || {}
+      const keys = Object.keys(V)
+      const closed = (o) => keys.filter((k) => V[k] && V[k].closed && V[k].outcome === o)
+      const tasks = (s.tasks || []).filter((t) => t && t.status !== 'deleted')
+      const formal = formalRecords()
+      return {
+        s, V,
+        trueV: closed('true'), falseV: closed('false'), undecidedV: closed('undecided'),
+        openV: keys.filter((k) => V[k] && !V[k].closed),
+        tasks, done: tasks.filter((t) => t.status === 'completed'), openT: tasks.filter((t) => t.status !== 'completed'),
+        formal, formalKeys: Object.keys(formal),
+        members: s.members || [],
+      }
+    }
+    function verdictCardRel(kind, id) { return 'Verified/' + (kind === 'subproblem' ? '问题' : kind === 'method' ? '方法' : '命题') + '/' + id + '.md' }
+    function cardDirOf(kind) { return kind === 'method' ? 'Methods' : kind === 'subproblem' ? 'Subproblems' : 'Propos' }
+    function paperTitle(p) {
+      const st = String((inst().problem || {}).statement || '').trim()
+      const head = st ? st.split(/\n/)[0].slice(0, 100) : ''
+      return head || ('研究所成果论文｜' + p.id)
+    }
+    function paperSources(p, active, ev) {
+      const out = []
+      out.push('Problems/conclusion.md（结题记录）')
+      if ((inst().problem || {}).id) out.push('Problems/' + inst().problem.id + '.md（原问题卡）')
+      out.push('State/' + instituteName + '.v5state.json（权威状态）')
+      for (const k of ev.trueV.concat(ev.falseV)) out.push(verdictCardRel((ev.V[k] || {}).kind, k) + '（Verified 卡片）')
+      for (const k of ev.trueV.concat(ev.falseV)) out.push('Shared/Debates/' + k + '.md（辩论录）')
+      for (const k of ev.formalKeys) {
+        const r = ev.formal[k] || {}
+        if (r.file) out.push(r.file + '（Lean 工作文件）')
+        if (r.proof) out.push(r.proof + '（归档证明）')
+      }
+      if (ev.formalKeys.length) out.push('Formal/Index.md', 'Formal/TODO.md')
+      for (const m of ev.members) {
+        out.push('Members/' + m.id + '/Progress/progress.md（' + m.id + ' 的研究日志）')
+        out.push('Members/' + m.id + '/{Propos,Methods,Subproblems}/（' + m.id + ' 的卡片）')
+      }
+      out.push('Institutes.md（编制镜像）', 'Shared/TaskBoard.md（任务板镜像）')
+      out.push('Paper/' + p.id + '/paper.log.md（本论文流程往来）')
+      for (const id of active) {
+        const part = (p.parts || {})[id] || {}
+        for (const e of (part.evidence || [])) out.push(String(e) + '（' + id + ' 声称的证据）')
+      }
+      return Array.from(new Set(out))
+    }
+    function paperSections(p, active, skipped, ev, extra) {
+      const o = extra || {}
+      const fin = o.final || p.final || null
+      const prob = ev.s.problem || {}
+      const S = []
+      // 1
+      const b1 = []
+      b1.push({ p: '标题：' + paperTitle(p) })
+      b1.push({ ul: [
+        '作者：' + ((p.participants || []).map((id) => id + '（' + ((memberById(id) || {}).kind === 'academician' ? '院士' : '常驻研究员') + '）').join('、') || '（无在册作者）'),
+        '研究所：' + instituteName + '｜项目：' + project + '｜运行：' + (ev.s.runId || runId || '（无）'),
+        '日期：' + fmtTime(p.finalizedAt || now()).slice(0, 10) + '｜语言：' + p.lang + '｜定稿代表：' + p.editor,
+      ] })
+      const mainConclusions = ev.trueV.length
+        ? ('已由表决确立的结论：' + ev.trueV.join('、'))
+        : '尚无经表决确立为真的结论（见第 4、8 节）。'
+      b1.push({ p: '摘要：' + (prob.statement ? String(prob.statement).replace(/\s+/g, ' ').slice(0, 400) : '（未设定原问题）') + '。' + mainConclusions })
+      if (fin && fin.note) b1.push({ p: '定稿说明：' + fin.note + (fin.consult ? '（定稿前与全所交流：消息 ' + fin.consult.messages + ' 条、会议 ' + fin.consult.meetings + ' 次）' : '') })
+      if (fin && fin.conclusion) b1.push({ p: '定稿结论：' + fin.conclusion })
+      S.push({ title: PAPER_SECTIONS[0], blocks: b1 })
+      // 2
+      S.push({ title: PAPER_SECTIONS[1], blocks: [
+        { p: prob.statement ? String(prob.statement) : '（本所未记录原问题的完整陈述——请勿在论文中补写。）' },
+        { p: '问题 ID：' + (prob.id || '（无）') + '｜参与成员：' + (p.participants || []).join('、') },
+      ] })
+      // 3
+      const b3 = []
+      const solvers = active.filter((id) => String(((p.parts || {})[id] || {}).solution || '').trim())
+      if (solvers.length) {
+        for (const id of solvers) {
+          const part = (p.parts || {})[id] || {}
+          b3.push({ h: id + '｜' + String(part.title || '贡献') })
+          b3.push({ p: String(part.solution) })
+        }
+      } else {
+        b3.push({ p: '（参与成员未提交可引用的完整解法叙述；请以第 4 节的表决结论与证据索引为准。）' })
+      }
+      if (o.conclusionText) b3.push({ h: '结题记录（Problems/conclusion.md）' }, { p: String(o.conclusionText).slice(0, 4000) })
+      S.push({ title: PAPER_SECTIONS[2], blocks: b3 })
+      // 4
+      const b4 = []
+      if (ev.trueV.length) {
+        b4.push({ p: '以下对象经 m 票布尔一致判定为**真**（证据：Verified 卡片 + 辩论录）：' })
+        b4.push({ ul: ev.trueV.map((k) => {
+          const v = ev.V[k] || {}
+          return '**' + k + '**（判为真；平均概率 ' + Number(v.mean || 0).toFixed(2) + '；m=' + (v.m || '?') + '；表决者 ' + ((v.voters || []).join('、') || '?') +
+            '；证据：' + verdictCardRel(v.kind, k) + '；辩论：Shared/Debates/' + k + '.md；提出者：' + (v.proposer || '(office)') + '）'
+        }) })
+      } else b4.push({ p: '（没有经表决判定为真的命题。）' })
+      if (ev.falseV.length) {
+        b4.push({ p: '**已被否证（显式标注，不得当作结论使用）**：' })
+        b4.push({ ul: ev.falseV.map((k) => {
+          const v = ev.V[k] || {}
+          return k + '（判为假；平均概率 ' + Number(v.mean || 0).toFixed(2) + '；m=' + (v.m || '?') + '；证据：' + verdictCardRel(v.kind, k) + '）'
+        }) })
+      }
+      S.push({ title: PAPER_SECTIONS[3], blocks: b4 })
+      // 5
+      const b5 = []
+      const subV = ev.trueV.filter((k) => (ev.V[k] || {}).kind === 'subproblem')
+      if (subV.length) b5.push({ ul: subV.map((k) => '子问题 ' + k + '（已判定为真；证据：' + verdictCardRel('subproblem', k) + '）') })
+      if (ev.done.length) b5.push({ ul: ev.done.map((t) => '任务 ' + t.id + '：' + String(t.subject || '') + '（owner=' + (t.ownerId || '?') + '；镜像：Shared/TaskBoard.md）') })
+      if (!subV.length && !ev.done.length) b5.push({ p: '（没有已完成的子问题或任务被记录。）' })
+      S.push({ title: PAPER_SECTIONS[4], blocks: b5 })
+      // 6
+      const b6 = []
+      const methodParts = active.filter((id) => String(((p.parts || {})[id] || {}).methods || '').trim())
+      for (const id of methodParts) b6.push({ h: id + '｜' + String(((p.parts || {})[id] || {}).title || '') }, { p: String(((p.parts || {})[id] || {}).methods) })
+      if (!methodParts.length) b6.push({ p: '（参与成员未提交方法/理论/思想/经验/数学理解的叙述。）' })
+      S.push({ title: PAPER_SECTIONS[5], blocks: b6 })
+      // 7
+      const b7 = []
+      const ruleParts = active.filter((id) => String(((p.parts || {})[id] || {}).rules || '').trim())
+      for (const id of ruleParts) b7.push({ h: id + '｜' + String(((p.parts || {})[id] || {}).title || '') }, { p: String(((p.parts || {})[id] || {}).rules) })
+      if (!ruleParts.length) b7.push({ p: '（参与成员未归纳出可复用规律。）' })
+      S.push({ title: PAPER_SECTIONS[6], blocks: b7 })
+      // 8
+      const b8 = []
+      const limitParts = active.filter((id) => String(((p.parts || {})[id] || {}).limits || '').trim())
+      for (const id of limitParts) b8.push({ h: id }, { p: String(((p.parts || {})[id] || {}).limits) })
+      const unresolved = []
+      for (const k of ev.undecidedV) unresolved.push('未定论：' + k + '（平均概率 ' + Number((ev.V[k] || {}).mean || 0).toFixed(2) + '，m=' + ((ev.V[k] || {}).m || '?') + '）')
+      for (const k of ev.openV) unresolved.push('尚未裁决：' + k)
+      for (const t of ev.openT) unresolved.push('未完成任务：' + t.id + '｜' + String(t.subject || '') + '（' + t.status + '）')
+      for (const m of ev.members.filter((x) => x.phase === 'failed' || x.phase === 'dismissed')) unresolved.push('成员 ' + m.id + '：' + m.phase + (m.error ? '（' + String(m.error).slice(0, 120) + '）' : ''))
+      for (const id of skipped) unresolved.push('未交稿/未参与：' + id)
+      if (unresolved.length) b8.push({ p: '**未决与未参与（显式标注）**：' }, { ul: unresolved })
+      if ((p.warnings || []).length) b8.push({ p: '流程警告：' }, { ul: (p.warnings || []).map(String) })
+      if (!limitParts.length && !unresolved.length && !(p.warnings || []).length) b8.push({ p: '（无特别记录的局限。）' })
+      S.push({ title: PAPER_SECTIONS[7], blocks: b8 })
+      // 9
+      const b9 = [{ p: '以下路径均相对于研究所根目录（与 State/<institute>.v5state.json 同级）。' }]
+      b9.push({ ul: paperSources(p, active, ev) })
+      if ((p.disagreement || []).length) {
+        b9.push({ h: '分歧记录（未达成全体一致 / 定稿代表要求修订）' })
+        b9.push({ ul: (p.disagreement || []).map((d) => '第 ' + d.round + ' 轮｜' + (d.members || []).join('、') + '：' + String(d.detail || '')) })
+      }
+      if (skipped.length) b9.push({ p: '按“未参与”处理的成员：' + skipped.join('、') })
+      S.push({ title: PAPER_SECTIONS[8], blocks: b9 })
+      return S
+    }
+    function renderPaperMd(p, S) {
+      const L = ['# ' + paperTitle(p), '']
+      S.forEach((sec, i) => {
+        L.push('## ' + (i + 1) + '. ' + sec.title)
+        L.push('')
+        for (const b of sec.blocks) {
+          if (b.h) { L.push('### ' + b.h); L.push('') }
+          else if (b.p !== undefined) { L.push(String(b.p)); L.push('') }
+          else if (b.ul) { for (const it of b.ul) L.push('- ' + String(it)); L.push('') }
+        }
+      })
+      return L.join('\n')
+    }
+    const TEX_ESCAPES = { '\\': '\\textbackslash{}', '&': '\\&', '%': '\\%', '$': '\\$', '#': '\\#', '_': '\\_', '{': '\\{', '}': '\\}', '~': '\\textasciitilde{}', '^': '\\textasciicircum{}' }
+    function texEscape(s) { return String(s == null ? '' : s).replace(/[\\&%$#_{}~^]/g, (c) => TEX_ESCAPES[c]) }
+    function renderPaperTex(p, S) {
+      const zh = p.lang !== 'en'
+      const L = [
+        '\\documentclass[11pt]{' + (zh ? 'ctexart' : 'article') + '}',
+        '\\usepackage{amsmath,amssymb,amsthm}',
+        '\\usepackage[margin=2.5cm]{geometry}',
+        '\\usepackage[hidelinks]{hyperref}',
+        '\\usepackage{longtable,booktabs}',
+        '\\title{' + texEscape(paperTitle(p)) + '}',
+        '\\author{' + texEscape(((p.participants || []).join('、')) || (zh ? '研究所' : 'Institute')) + '}',
+        '\\date{' + texEscape(fmtTime(p.finalizedAt || now()).slice(0, 10)) + '}',
+        '\\begin{document}',
+        '\\maketitle',
+      ]
+      S.forEach((sec, i) => {
+        L.push('\\section{' + texEscape((i + 1) + '. ' + sec.title) + '}')
+        for (const b of sec.blocks) {
+          if (b.h) L.push('\\subsection{' + texEscape(b.h) + '}')
+          else if (b.p !== undefined) L.push(texEscape(b.p) + '\n')
+          else if (b.ul) { L.push('\\begin{itemize}'); for (const it of b.ul) L.push('\\item ' + texEscape(it)); L.push('\\end{itemize}') }
+        }
+      })
+      L.push('\\end{document}')
+      return L.join('\n') + '\n'
+    }
+    // The repair pass keeps only the packages the text itself needs (docs/final-paper.md §8):
+    // every optional or unknown package is dropped before the engine swap retry.
+    function texStripOptionalPackages(tex) {
+      return String(tex).split('\n').filter((line) => {
+        if (/^\s*\\(?:input|include)\b/.test(line)) return false
+        const m = /^\s*\\usepackage(?:\[[^\]]*\])?\{([^}]+)\}/.exec(line)
+        if (!m) return true
+        return m[1].split(',').map((x) => x.trim()).some((pk) => PAPER_REPAIR_CORE.indexOf(pk) !== -1)
+      }).join('\n')
+    }
+    function texMinimal(tex, lang) {
+      const body = String(tex).replace(/[\s\S]*?\\begin\{document\}/, '').replace(/\\end\{document\}[\s\S]*$/, '')
+      return '\\documentclass[11pt]{' + (lang === 'en' ? 'article' : 'ctexart') + '}\n\\begin{document}\n' + body.trim() + '\n\\end{document}\n'
+    }
+    function paperEngineCandidates(lang) {
+      const order = PAPER_ENGINE_ORDER[lang === 'en' ? 'en' : 'zh'].slice()
+      const forced = String(params.paperLatexCommand || '').trim()
+      if (!forced) return order
+      return [forced].concat(order.filter((n) => n !== forced))
+    }
+    async function latexEngines(lang) {
+      const sub = subprocessOf()
+      if (!sub || typeof sub.resolveExecutable !== 'function') {
+        return { engines: [], reason: '宿主没有 subprocess 服务：无法检测或调用 LaTeX' }
+      }
+      const engines = []
+      for (const name of paperEngineCandidates(lang)) {
+        try { const exe = await sub.resolveExecutable(name); if (exe) engines.push({ name: String(name), exe: String(exe) }) } catch (e) { /* not installed */ }
+      }
+      return { engines, reason: engines.length ? '' : ('未检测到 LaTeX 引擎（' + paperEngineCandidates(lang).join('/') + '）') }
+    }
+    // ONE engine invocation. NEVER throws: every failure becomes a readable result (the Lean
+    // seam's discipline) and a timeout really terminates the process.
+    async function runPaperProcess(argv, cwd) {
+      const sub = subprocessOf()
+      const started = now()
+      if (!sub || typeof sub.spawn !== 'function') return { ok: false, exitCode: null, ms: 0, message: 'no subprocess service' }
+      let handle
+      try {
+        handle = sub.spawn({ argv, cwd, stdio: { stdin: 'ignore', stdout: { maxBytes: 64 * 1024 }, stderr: { maxBytes: 64 * 1024 } }, graceMs: 120000 })
+      } catch (e) { return { ok: false, exitCode: null, ms: now() - started, message: String((e && e.message) || e) } }
+      let outcome = null
+      let timer = null
+      try {
+        const ran = Promise.resolve(handle.done).then((v) => ({ settled: true, value: v }), (e) => ({ settled: false, error: e }))
+        const r = await Promise.race([
+          ran,
+          new Promise((resolve) => {
+            timer = ctx.timeout(() => {
+              try { if (typeof handle.terminate === 'function') handle.terminate() } catch (e) { /* the race result is the report */ }
+              resolve({ settled: true, value: { exitCode: null, signal: 'SIGTERM' } })
+            }, 120000)
+          }),
+        ])
+        if (!r.settled) return { ok: false, exitCode: null, ms: now() - started, message: String((r.error && r.error.message) || r.error) }
+        outcome = r.value
+      } finally { if (timer) { try { timer() } catch (e) { /* already settled */ } } }
+      const exitCode = outcome ? outcome.exitCode : null
+      return { ok: exitCode === 0, exitCode, ms: now() - started, message: '' }
+    }
+    // Compile attempts are CAPPED (docs/final-paper.md §8): full → nonstopmode rerun → engine swap with
+    // the optional packages stripped → one minimal-template retry → report and degrade.
+    async function compilePaperTex(id, tex, lang) {
+      if (await fileExistsAbs(paperAbs(id, 'paper.pdf'))) {
+        return { status: 'kept-existing', engine: '', reason: 'Paper/' + id + '/paper.pdf 已存在：不覆盖（docs/final-paper.md §5）', attempts: [] }
+      }
+      const det = await latexEngines(lang)
+      if (!det.engines.length) return { status: 'not-detected', engine: '', reason: det.reason, attempts: [] }
+      const e0 = det.engines[0], e1 = det.engines[1] || e0
+      const plan = [
+        { label: 'full', engine: e0, text: tex, nonstopOnly: false },
+        { label: 'nonstopmode-rerun', engine: e0, text: tex, nonstopOnly: true },
+        { label: 'engine-swap+stripped', engine: e1, text: texStripOptionalPackages(tex), nonstopOnly: true },
+        { label: 'minimal-template', engine: e0, text: texMinimal(tex, lang), nonstopOnly: true },
+      ]
+      const attempts = []
+      for (const a of plan) {
+        const r = await runLatexAttempt(id, a)
+        attempts.push(r)
+        if (r.ok) return { status: 'compiled', engine: a.engine.name, attempts }
+      }
+      return { status: 'failed', engine: '', reason: '编译在 ' + attempts.length + ' 次尝试后仍失败（已保留 paper.tex 与 paper.md）', attempts }
+    }
+    async function runLatexAttempt(id, a) {
+      const dirRel = paperDirRel(id)
+      const dirAbs = instRoot() + '/' + dirRel
+      if (!await writeTextRel(dirRel + '/paper.tex', a.text)) {
+        return { label: a.label, engine: a.engine.name, ok: false, exitCode: null, ms: 0, message: 'tex 写入失败' }
+      }
+      const started = now()
+      const args = a.engine.name === 'tectonic'
+        ? ['-X', 'paper.tex']
+        : (a.nonstopOnly ? ['-interaction=nonstopmode', 'paper.tex'] : ['-interaction=nonstopmode', '-halt-on-error', 'paper.tex'])
+      const argv = [a.engine.exe].concat(args)
+      // TWO passes (docs/final-paper.md §8): the second resolves references/TOC. A failed first pass is not
+      // rerun — the retry PLAN is what varies the command, not a blind repeat.
+      const first = await runPaperProcess(argv, dirAbs)
+      if (!first.ok) return { label: a.label, engine: a.engine.name, ok: false, exitCode: first.exitCode, ms: now() - started, message: first.message || 'first pass failed' }
+      const second = await runPaperProcess(argv, dirAbs)
+      const pdf = await fileExistsAbs(paperAbs(id, 'paper.pdf'))
+      return { label: a.label, engine: a.engine.name, ok: second.ok && pdf, exitCode: second.exitCode, ms: now() - started, message: pdf ? (second.message || '') : '编译器没有产出 paper.pdf' }
+    }
+    function paperMeta(p, extra) {
+      const o = extra || {}
+      const active = paperActiveParticipants(p)
+      const skipped = (p.participants || []).filter((x) => active.indexOf(x) === -1)
+      return {
+        id: p.id,
+        dir: 'Paper/' + p.id + '/',
+        institute: instituteName, project, runId: inst().runId || runId || '',
+        problemId: (inst().problem || {}).id || '',
+        trigger: p.trigger,
+        finalizedAt: o.finalizedAt || (p.finalizedAt || now()),
+        language: p.lang, format: p.format, compilePdf: p.pdf === true,
+        editor: p.editor, editorNote: p.editorNote || '', editorFallback: !!p.editorFallback,
+        finalisation: p.final || null,
+        consultation: Object.assign({ messages: 0, meetings: 0 }, p.consult || {}),
+        participants: p.participants || [], skipped,
+        rounds: p.round, maxRounds: PAPER_MAX_ROUNDS,
+        parts: Object.keys(p.parts || {}).map((id) => ({ member: id, round: (p.parts[id] || {}).round, title: (p.parts[id] || {}).title || '', evidence: ((p.parts[id] || {}).evidence || []).length })),
+        reviews: Object.keys(p.reviews || {}).map((id) => ({ member: id, of: (p.reviews[id] || {}).of, round: (p.reviews[id] || {}).round, deliverable: (p.reviews[id] || {}).deliverable === true })),
+        disagreement: p.disagreement || [], warnings: o.warnings || p.warnings || [],
+        forcedAfterCap: !!p.forcedAfterCap,
+        sections: PAPER_SECTIONS.length,
+        compile: o.compile || { status: p.compile || 'unknown', engine: p.engine || '', attempts: [] },
+        params: {
+          finalPaper: params.finalPaper, paperFormat: params.paperFormat, paperLanguage: params.paperLanguage,
+          paperCompilePdf: params.paperCompilePdf, paperEditor: params.paperEditor, paperLatexCommand: params.paperLatexCommand,
+        },
+        files: o.files || [],
+      }
+    }
+    async function refillPaperArtifacts(p) {
+      const id = p.id
+      const active = paperActiveParticipants(p)
+      const skipped = (p.participants || []).filter((x) => active.indexOf(x) === -1)
+      const conclusionText = await readTextRel('Problems/conclusion.md')
+      const S = paperSections(p, active, skipped, paperEvidence(), { final: p.final, conclusionText })
+      const filled = []
+      if (p.format !== 'tex' && (await readTextAbs(paperAbs(id, 'paper.md'))) === undefined) {
+        if (await writeTextRel(PAPER_FILE(id, 'paper.md'), renderPaperMd(p, S))) filled.push('paper.md')
+      }
+      let tex = await readTextAbs(paperAbs(id, 'paper.tex'))
+      if (p.format !== 'md' && tex === undefined) {
+        tex = renderPaperTex(p, S)
+        if (await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)) filled.push('paper.tex')
+      }
+      if (p.format !== 'md' && p.pdf === true && !await fileExistsAbs(paperAbs(id, 'paper.pdf'))) {
+        const c = await compilePaperTex(id, tex || renderPaperTex(p, S), p.lang)
+        if (c.status === 'compiled') filled.push('paper.pdf')
+        // Same rule as finalizePaper: the delivered tex is always the canonical generated one.
+        if (tex !== undefined && tex !== null) await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)
+      }
+      if ((await readTextAbs(paperAbs(id, 'paper.meta.json'))) === undefined) {
+        if (await writeTextRel(PAPER_FILE(id, 'paper.meta.json'), JSON.stringify(paperMeta(p, { refilled: true }), null, 2) + '\n')) filled.push('paper.meta.json')
+      }
+      if ((await readTextAbs(paperAbs(id, 'paper.log.md'))) === undefined) {
+        await paperLog('重复触发：补写缺失产物', '- 本次补写：' + (filled.join('、') || '（无缺失）'))
+        filled.push('paper.log.md')
+      } else if (filled.length) {
+        await paperLog('重复触发：补写缺失产物', '- 本次补写：' + filled.join('、'))
+      }
+      return { filled }
+    }
+    async function finalizePaper(reason) {
+      const p = paper()
+      if (!p) return { ok: false, code: 'V5_PAPER_STATE', message: 'no paper flow' }
+      const id = p.id
+      const active = paperActiveParticipants(p)
+      const skipped = (p.participants || []).filter((x) => active.indexOf(x) === -1)
+      const ev = paperEvidence()
+      const conclusionText = await readTextRel('Problems/conclusion.md')
+      const finalizedAt = now()
+      const S = paperSections(p, active, skipped, ev, { final: p.final, conclusionText })
+      const files = []
+      if (p.format !== 'tex') {
+        if (await writeTextRel(PAPER_FILE(id, 'paper.md'), renderPaperMd(p, S))) files.push('paper.md')
+      }
+      let tex = ''
+      if (p.format !== 'md') {
+        tex = renderPaperTex(p, S)
+        if (await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)) files.push('paper.tex')
+      }
+      // `paperFormat=md` with `paperCompilePdf=true` must NOT warn about a missing tex: no tex
+      // was produced, so compilation is skipped silently (docs/final-paper.md §8).
+      let compile
+      if (p.format === 'md') compile = { status: 'skipped', engine: '', reason: 'paperFormat=md：未产出 tex，跳过编译', attempts: [] }
+      else if (p.pdf !== true) compile = { status: 'skipped', engine: '', reason: 'paperCompilePdf=false', attempts: [] }
+      else compile = await compilePaperTex(id, tex, p.lang)
+      // The repair attempts overwrite `paper.tex` with stripped/minimal variants to get past a
+      // broken engine. Whatever the compile outcome, the DELIVERED tex must be the real,
+      // fully-generated one (the attempts are recorded in the meta either way).
+      if (p.format !== 'md') await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)
+      if (await fileExistsAbs(paperAbs(id, 'paper.pdf'))) files.push('paper.pdf')
+      const warnings = (p.warnings || []).slice()
+      if (compile.status === 'failed') warnings.push('LaTeX 编译失败（已保留 paper.tex 与 paper.md，不阻塞定稿）：' + (compile.attempts || []).map((a) => a.engine + '/' + a.label + ' exit=' + a.exitCode + (a.message ? '(' + a.message + ')' : '')).join('；'))
+      if (compile.status === 'not-detected') warnings.push('未检测到 LaTeX 引擎（' + (compile.reason || '') + '）：只交付 paper.tex 与 paper.md。')
+      const meta = paperMeta(Object.assign({}, p, { finalizedAt, compile: compile.status, engine: compile.engine || '' }), {
+        finalizedAt, warnings, compile: { status: compile.status, engine: compile.engine || '', reason: compile.reason || '', attempts: compile.attempts || [] }, files,
+      })
+      if (await writeTextRel(PAPER_FILE(id, 'paper.meta.json'), JSON.stringify(meta, null, 2) + '\n')) files.push('paper.meta.json')
+      await paperLog('定稿（' + reason + '）', [
+        '- 目录：Paper/' + id + '/',
+        '- 产物：' + files.join('、'),
+        '- 编译：' + compile.status + (compile.engine ? '（' + compile.engine + '）' : '') + '｜尝试 ' + (compile.attempts || []).length + ' 次',
+        '- 定稿代表：' + p.editor + '｜轮次：' + p.round + '/' + PAPER_MAX_ROUNDS,
+        '- 所办交流：消息 ' + Number((p.consult || {}).messages || 0) + ' 条、会议 ' + Number((p.consult || {}).meetings || 0) + ' 次',
+        (p.final && p.final.note ? '- 定稿说明：' + p.final.note : ''),
+        (warnings.length ? '- 警告：\n  - ' + warnings.join('\n  - ') : ''),
+      ].filter(Boolean).join('\n'))
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+        status: 'finalized', stage: 'finalized', finalizedAt, compile: compile.status,
+        engine: compile.engine || '', warnings, artifacts: files, updatedAt: now(),
+      }) : cur))
+      await saveChatLine('【论文】最终论文已定稿：Paper/' + id + '/（' + (files.join('、') || '（无产物）') + '；编译 ' + compile.status + '）。')
+      notifyActivity()
+      // The run is only now complete (docs/final-paper.md §3): the paper phase ran BEFORE the flags.
+      if (p.completesRun && !autoDone) await finishRun('全体有表决权者一致认为原问题已解决')
+      return {
+        ok: true, finalized: true, id, dir: 'Paper/' + id + '/', files,
+        compile: compile.status, engine: compile.engine || '', attempts: (compile.attempts || []).length,
+        warnings, agreement: !(p.disagreement || []).length, rounds: p.round,
+      }
+    }
+
     // ---- hire / fire -------------------------------------------------------
     function employedTemps() { return activeMembers().filter((m) => m.kind === 'temp') }
     // ANY academician or permanently-employed researcher may hire its own temp
@@ -3273,6 +4537,16 @@ export function apply(ctx) {
       roundsSinceCompact.delete(id)
       contextPct.delete(id)
       seeds.delete(id)
+      // A dismissed member is no longer a voter: drop its ballot from every OPEN verdict, so
+      // a verdict that has not closed yet can never be carried by a former member's vote
+      // (audit H2). `judgeVerdict` reads only the live roster anyway; this keeps the durable
+      // record honest too. Already-closed verdicts are history and are left untouched.
+      const openVerdicts = Object.values(inst().verdicts).filter((v) => v && !v.closed && v.votes && v.votes[id] !== undefined)
+      for (const v of openVerdicts) {
+        const votes = Object.assign({}, v.votes)
+        delete votes[id]
+        await putVerdict(v.target, Object.assign({}, v, { votes }))
+      }
       if (meeting) {
         delete meeting.inputs[id]
         delete meeting.extras[id]
@@ -3293,6 +4567,7 @@ export function apply(ctx) {
       return { ok: true, dismissed: id, reclaimedTasks: reclaimed, reason }
     }
     async function nudge(callerId, o) {
+      if (!callerId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
       if (!isOffice(callerId) && !(isAcademician(callerId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can nudge members' }
       }
@@ -3372,9 +4647,13 @@ export function apply(ctx) {
       dbg.passes += 1
       clearHeartbeat()
       syncParamsFromState()
-      if (meeting) { await continueMeetingRound(); return }
+      // A verification that is ALREADY in flight is served first: the two coordination
+      // processes are mutually exclusive by construction, so the order only decides which
+      // of two impossible states wins — but checking `meeting` first meant a meeting that
+      // can never close starved the verification's own watchdog forever (audit M3).
       const vs = currentVerify()
       if (vs) { await continueVerifyRound(vs); return }
+      if (meeting) { await continueMeetingRound(); return }
       if (!currentVerify()) {
         await armNextVerify()
         if (hasVerifyInFlight()) return
@@ -3385,6 +4664,16 @@ export function apply(ctx) {
         await beginMeeting({ agenda: p.agenda, kind: p.kind, target: p.target, by: p.by })
         return
       }
+      // The final-paper phase (docs/final-paper.md §3) owns the room once it is active: a paper ask is its
+      // own kind of turn, and a research round must not be mistaken for a paper answer. While
+      // the flow waits for the OFFICE the institute keeps working normally — the required
+      // consultation needs office messages and a real meeting to be deliverable.
+      if (paperActive()) {
+        await paperPass()
+        const cur = paper()
+        const waitingForOffice = !!cur && cur.status === 'awaiting-editor' && cur.editor === 'office'
+        if (!waitingForOffice) return
+      }
       const budget = Math.max(1, Math.floor(Number(params.maxParallel) || 3))
       const idleMs = posMs(params.activityTimeoutMs, 120000)
       let filled = 0
@@ -3435,7 +4724,7 @@ export function apply(ctx) {
       const stallMs = posMs(params.stallAutoMeetingMs, 360000)
       if (!meeting && !pendingMeeting && !hasVerifyInFlight() && phase === 'active' &&
         busy.size === 0 && (now() - lastProgressAt) >= stallMs) {
-        await startMeeting('office', { agenda: '本所较长时间没有新进展。请你们自行讨论：现在最该推进的是什么？谁来做？是否需要发起验证？', kind: 'sync' })
+        await startMeeting('office', { agenda: '本所较长时间没有新进展。请你们自行讨论：现在最该推进的是什么？谁来做？是否需要发起验证？', kind: 'sync', auto: true })
         return
       }
       // (e) heartbeat: push the longest-idle member to make progress rather than just
@@ -3609,6 +4898,12 @@ export function apply(ctx) {
       }
       // (10) solve votes / personal judgement
       if (p.vote_solved !== undefined) await recordSolveVote(member.id, p.vote_solved === true)
+      // (10b) final-paper channels: the member's own part, a cross-review, or the editor's
+      // decision. Each is only honoured in the stage that asked for it (the record functions
+      // refuse otherwise), so a stray/stale field can never advance the paper.
+      if (p.paper_part && typeof p.paper_part === 'object') await paperRecordPart(member.id, p.paper_part)
+      if (p.paper_review && typeof p.paper_review === 'object') await paperRecordReview(member.id, p.paper_review)
+      if (p.paper_final && typeof p.paper_final === 'object') await paperRecordFinal(member.id, p.paper_final)
       // (11) meeting input collection (keyed on the LIVE member set, so a member who
       // joined mid-meeting still has to speak and a dismissed one stops blocking it)
       if (kind === 'meeting' && meeting) {
@@ -3664,6 +4959,9 @@ export function apply(ctx) {
       try { await maybeRealCompact(childId, member) } catch (e) { /* compaction is best-effort */ }
       wakeKind.delete(member.id)
       if (member.activeMeetingId) delete member.activeMeetingId
+      // The final-paper phase is driven by member turns, exactly like a meeting: the reply was
+      // just folded, so advance the paper BEFORE asking the (possibly inert) scheduler.
+      try { await paperPass() } catch (e) { console.error('vibe-math-v5: paper after end: ' + String((e && e.message) || e)) }
       await scheduleNext()
     }
     // ---- toolFilter names the host may not register -------------------------
@@ -3726,11 +5024,15 @@ export function apply(ctx) {
       const ints = ['researcherCount', 'quorumCap', 'verdictMaxRounds', 'maxTempPerMember', 'maxTempTotal',
         'compactThreshold', 'compactAfterRounds', 'maxParallel', 'activityTimeoutMs', 'stallAutoMeetingMs',
         'chatDigestMs', 'chatDigestMax', 'meetingKeepEvery', 'leanTimeoutMs']
-      const bools = ['academician', 'academicianLeads', 'memberMayRejectAssign']
-      const strs = ['quorumMode', 'provider', 'model', 'staffPersona', 'formalVerify', 'leanCommand']
+      const bools = ['academician', 'academicianLeads', 'memberMayRejectAssign', 'finalPaper', 'paperCompilePdf']
+      const strs = ['quorumMode', 'provider', 'model', 'staffPersona', 'formalVerify', 'leanCommand',
+        'paperFormat', 'paperLanguage', 'paperEditor', 'paperLatexCommand']
       const arrs = ['toolAllow', 'toolDeny', 'tempToolAllow', 'tempToolDeny', 'leanArgs']
       for (const k of ints) if (input[k] !== undefined) { const n = Math.floor(Number(input[k])); if (Number.isFinite(n)) out[k] = n }
-      for (const k of bools) if (input[k] !== undefined) out[k] = (input[k] === true || input[k] === 'true')
+      // Explicit boolean coercion (docs/final-paper.md §2): the old `=== true || === 'true'` turned a
+      // legitimate `1` / `'yes'` into FALSE and left junk values truthy-looking. An
+      // unrecognised spelling is REJECTED (the default wins) rather than guessed.
+      for (const k of bools) if (input[k] !== undefined) out[k] = coerceBool(input[k], false)
       for (const k of strs) if (input[k] !== undefined) out[k] = String(input[k])
       for (const k of arrs) {
         if (input[k] === undefined) continue
@@ -3744,6 +5046,12 @@ export function apply(ctx) {
         out.formalVerify = ['off', 'encourage', 'require'].indexOf(out.formalVerify) !== -1 ? out.formalVerify : 'off'
       }
       if (out.leanCommand !== undefined && !String(out.leanCommand).trim()) out.leanCommand = 'lean'
+      // ── final-paper enums (closed sets; an unknown value degrades to the documented
+      // default instead of silently becoming an unreachable fourth mode) ────────────────
+      if (out.paperFormat !== undefined) out.paperFormat = coercePaperEnum('paperFormat', out.paperFormat, ['both', 'md', 'tex'], 'both')
+      if (out.paperLanguage !== undefined) out.paperLanguage = coercePaperEnum('paperLanguage', out.paperLanguage, ['zh', 'en'], 'zh')
+      if (out.paperEditor !== undefined) out.paperEditor = coercePaperEnum('paperEditor', out.paperEditor, ['office', 'academician'], 'academician')
+      if (out.paperLatexCommand !== undefined) out.paperLatexCommand = String(out.paperLatexCommand).trim()
       // Guard every duration against a negative/NaN value: such a value would make a
       // watchdog fire instantly and abandon all consensus (v4 §30-T41).
       for (const k of ['activityTimeoutMs', 'stallAutoMeetingMs', 'chatDigestMs', 'leanTimeoutMs']) {
@@ -3752,6 +5060,14 @@ export function apply(ctx) {
       if (out.leanTimeoutMs !== undefined) out.leanTimeoutMs = Math.max(1000, out.leanTimeoutMs)
       if (out.researcherCount !== undefined && out.researcherCount < 0) out.researcherCount = 0
       if (out.quorumCap !== undefined && out.quorumCap < 1) out.quorumCap = 1
+      // NOT every non-positive number is harmless (audit L3). `compactThreshold <= 0` makes
+      // EVERY round look over the threshold (a permanent compaction directive), so it falls back
+      // to the default like a bad duration; `chatDigestMax < 1` would empty the digest bucket and
+      // `verdictMaxRounds < 1` silently collapsed every debate to a single round, so both floor
+      // at the smallest value that still means what the name says.
+      if (out.compactThreshold !== undefined && !(out.compactThreshold > 0)) delete out.compactThreshold
+      if (out.chatDigestMax !== undefined && out.chatDigestMax < 1) out.chatDigestMax = 1
+      if (out.verdictMaxRounds !== undefined && out.verdictMaxRounds < 1) out.verdictMaxRounds = 1
       return out
     }
     async function setParams(input) {
@@ -3780,12 +5096,22 @@ export function apply(ctx) {
         chatDigestMax: params.chatDigestMax, meetingKeepEvery: params.meetingKeepEvery,
         formalVerify: params.formalVerify, leanCommand: params.leanCommand,
         leanArgs: params.leanArgs, leanTimeoutMs: params.leanTimeoutMs,
+        // ── final paper ──────────────────────────────────────────────────────
+        finalPaper: params.finalPaper, paperFormat: params.paperFormat,
+        paperLanguage: params.paperLanguage, paperCompilePdf: params.paperCompilePdf,
+        paperEditor: params.paperEditor, paperLatexCommand: params.paperLatexCommand,
         provider: params.provider, model: params.model,
         toolAllow: params.toolAllow, toolDeny: params.toolDeny,
       }
     }
     async function configure(args) {
       const a = args || {}
+      // READ THE FILE FOR THE PATH THIS SESSION WAS ALREADY POINTED AT BEFORE ANY WORK.
+      // configure ends in a whole-snapshot commit; without this load the commit is exactly
+      // the write that destroyed a previously-run institute's state file (audit H1: the
+      // session's first tool call — typically `vibe_v5_status` — latched the DEFAULT path,
+      // after which `configure {institute:'alpha'}` never read alpha's file).
+      await ready()
       // configure is the PRE-START setup tool. Switching project/institute while a run
       // is live would split its state across two trees: the members' libraries and
       // briefs point at the OLD root while every later write goes to the NEW one.
@@ -3801,14 +5127,25 @@ export function apply(ctx) {
         const np = patch.project !== undefined ? patch.project : project
         const ni = patch.institute !== undefined ? patch.institute : instituteName
         const nkey = np + '::' + ni
-        if (nkey !== key && !inst().members.length) {
-          key = nkey
-          project = np
-          instituteName = ni
-          patch.project = np
-          patch.institute = ni
-        } else if (nkey !== key) {
-          return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'this session already holds an institute; use a new session to found another' }
+        if (nkey !== key) {
+          // The requested key lives in a DIFFERENT state file. Read that file first: a
+          // previously-run institute must be adopted, never overwritten with an empty one.
+          const stored = await instituteAt(np, ni, nkey)
+          if (stored && Array.isArray(stored.members) && stored.members.length) {
+            key = nkey
+            project = np
+            instituteName = ni
+            patch.project = np
+            patch.institute = ni
+          } else if (!inst().members.length) {
+            key = nkey
+            project = np
+            instituteName = ni
+            patch.project = np
+            patch.institute = ni
+          } else {
+            return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'this session already holds an institute; use a new session to found another' }
+          }
         }
       }
       patch.phase = 'idle'
@@ -3980,6 +5317,8 @@ export function apply(ctx) {
         if (m.childId) continue
         try {
           const seedText = (await readTextRel('Members/' + m.id + '/Progress/progress.md')) || ''
+          // `mode='resume'` is what makes this a RESUME rather than an instruction: the prompt
+          // prints the seed as "恢复说明" (your own log, restored), not as a task to execute.
           await spawnMember(m, seedText ? seedText.slice(-4000) : '（你的 Progress/ 还是空的——请先把当前状态补写进去。）', 'resume')
           respawned += 1
         } catch (e) {
@@ -3995,9 +5334,17 @@ export function apply(ctx) {
       autoDone = false
       phase = 'active'
       await patchInstitute({ phase: 'active', lastProgressAt: now() })
+      // The mirrors must be refreshed on THIS path too (audit M9): resume is the one place
+      // where members' phase/rounds/employer actually change under them, and a staffing table
+      // that contradicts the authoritative roster is the opposite of a mirror's purpose.
+      await writeRosterMirror()
+      await writeTaskboardMirror()
       await saveChatLine('【恢复】研究所继续推进（重建成员 ' + respawned + ' 名）。')
       notifyActivity()
       await scheduleNext()
+      // An interrupted FINAL PAPER resumes its own stage (the paper phase runs before the
+      // completion flags, so a crash there leaves a live, resumable institute).
+      if (paperActive()) { try { await paperPass() } catch (e) { console.error('vibe-math-v5: paper after resume: ' + String((e && e.message) || e)) } }
       return { ok: true, resumed: true, members: members.map((m) => m.id), respawned, running: true }
     }
     function setPause() {
@@ -4043,6 +5390,9 @@ export function apply(ctx) {
         institute: instituteName, project, key, phase,
         running, autoDone, runId: s.runId,
         backend: backend ? backend.kind : 'uninitialized',
+        // Skipped/malformed events AND state-file load problems. Without this the two
+        // failure modes that silently drop state were invisible in the operator's view.
+        diagnostics: s.diagnostics || [],
         debug: Object.assign({ scheduling, reschedule }, dbg),
         quorum: { m: quorumM(), mode: params.quorumMode, voters: voters().map((m) => m.id), voterCount: voterCount() },
         members: s.members.map((m) => ({
@@ -4071,6 +5421,10 @@ export function apply(ctx) {
           blocked: Object.keys(formalRecords()).filter((k) => (formalRecords()[k] || {}).status === 'blocked'),
           todo: formalTodo(),
         },
+        // The final-paper flow: stage, who wrote/reviewed what, the office-consultation
+        // counters and the compile result. Without this an operator cannot tell whether the
+        // run is waiting for the office, for a member, or for nobody.
+        paper: paperSummary(),
         lastProgressAt, params: visibleParams(),
       }
     }
@@ -4121,6 +5475,11 @@ export function apply(ctx) {
       if (pendingMeeting) L.push('- 暂存会议：' + pendingMeeting.agenda)
       L.push('- 历史会议：' + s.meetings.length + ' 次｜辩论录：' + s.debates.length + ' 份')
       L.push('- 解决票：' + (solveVotes.size ? Array.from(solveVotes.entries()).map(([k, v]) => k + '=' + v).join('、') : '（无）'))
+      if ((s.diagnostics || []).length) {
+        L.push('')
+        L.push('## ⚠ 状态诊断（被跳过的事件 / 状态文件读取问题）')
+        for (const d of s.diagnostics.slice(-10)) L.push('- ' + fmtTime(d.at) + '｜' + d.type + '｜' + d.error)
+      }
       L.push('')
       L.push('## Lean 形式化')
       if (!formalOn()) L.push('- 未启用（`formalVerify` = off；可用 vibe_v5_set 切到 encourage / require）')
@@ -4132,6 +5491,21 @@ export function apply(ctx) {
         L.push('- 可复用库：VibeMath/Formal/{Lib,Proved}/（跨项目）｜本所形式化：Formal/｜归档证明：Verified/Lean/')
       }
       L.push('')
+      L.push('## 最终论文')
+      {
+        const pp = paper()
+        if (!pp) L.push('- 尚未开始（' + (params.finalPaper === false ? '自动已关闭（finalPaper=false），可用 /v5 paper 手动生成' : '收口时会自动开始；也可用 /v5 paper 手动开始') + '）')
+        else {
+          L.push('- 目录：Paper/' + pp.id + '/｜状态：' + pp.status + '｜阶段：' + pp.stage + '｜轮次：' + pp.round + '/' + PAPER_MAX_ROUNDS)
+          L.push('- 定稿代表：' + pp.editor + (pp.editorFallback ? '（原定代表不在册，已回退）' : '') + '｜语言：' + pp.lang + '｜格式：' + pp.format)
+          L.push('- 交稿：' + (Object.keys(pp.parts || {}).join('、') || '（无）') + '｜互审：' + (Object.keys(pp.reviews || {}).map((k) => k + '→' + ((pp.reviews[k] || {}).of || '?') + (pp.reviews[k] && pp.reviews[k].deliverable === true ? '(可交付)' : '(需修改)')).join('、') || '（无）'))
+          L.push('- 所办交流：消息 ' + Number((pp.consult || {}).messages || 0) + ' 条｜会议 ' + Number((pp.consult || {}).meetings || 0) + ' 次')
+          if (pp.compile) L.push('- 编译：' + pp.compile + (pp.engine ? '（' + pp.engine + '）' : ''))
+          if ((pp.warnings || []).length) L.push('- 警告：' + pp.warnings.join('；'))
+          L.push('- 下一步：' + paperNextStep(pp))
+        }
+      }
+      L.push('')
       L.push('## 文件位置')
       L.push('- 根目录：' + instRoot())
       L.push('- 已确立：Verified/｜成员库：Members/<id>/｜群聊：Shared/Chat/｜会议：Shared/Meetings/｜辩论：Shared/Debates/')
@@ -4198,8 +5572,10 @@ export function apply(ctx) {
       leanRunToolApi: async (relPath, timeoutMs) => await leanRunFile(relPath, timeoutMs),
       // consensus / meetings
       maybeQueueVerify, castVerdict, currentVerify, hasVerifyInFlight, startMeeting, quorumM, voterCount,
+      // final paper (docs/final-paper.md; the phase runs BEFORE finishRun)
+      startPaper, paperStatus: paperSummary, finalizePaperByOffice,
       // authorization helpers (used by tool handlers)
-      memberIdOfAgent, isOffice, isAcademician, memberById, activeMembers,
+      memberIdOfAgent, isOffice, isAcademician, isProvablyOffice, officeCaller, memberById, activeMembers,
     }
   }
 
@@ -4227,16 +5603,51 @@ export function apply(ctx) {
   }
   const S = { type: 'string' }, N = { type: 'number' }, I = { type: 'integer' }, B = { type: 'boolean' }
   const SA = { type: 'array', items: { type: 'string' } }
+  /**
+   * Resolve the caller of a WRITING tool through `officeCaller` and refuse when nobody can be
+   * identified. `memberIdOfAgent` answers '' for a caller that is neither a member child nor the
+   * session root itself (a dismissed member's stale child, a nested helper under the office root,
+   * a synthetic context with no known member), and the office gates used to treat '' as the office
+   * (`isOffice`), so such a caller could sign assignments/priorities/tasks as 'office' (audit L6
+   * follow-up). A real member id and the provable session root ('office') still pass unchanged.
+   */
+  function withCaller(s, x, what, fn) {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: ' + what + ' needs a resolved member id or the office (the session root)' }
+    return fn(caller)
+  }
+  /**
+   * Resolve the caller of an OFFICE-ONLY control and refuse anything that is not the PROVABLE
+   * session root. `officeCaller` answers 'office' for that root, a member id for a member child, and
+   * '' for everyone else — an unidentifiable descendant of the root (a nested helper, a dismissed
+   * member's stale child) or a context with no session. A member child and the office share ONE
+   * institute session, so without this every lifecycle control (configure/start/resume/pause/stop/
+   * set) could be driven by a member: it could stop the institute or rewrite quorum/params as the
+   * office (audit L6 follow-up). ABSENCE of a caller is not the office either — that is exactly the
+   * shape an unidentifiable caller has, and the tool wrapper already refuses an agent-less call
+   * ('no session') before this point, so nothing here re-admits one.
+   */
+  function withOffice(s, x, what, fn) {
+    const caller = s.officeCaller(x)
+    if (caller !== 'office') {
+      return {
+        ok: false, code: 'V5_NOT_OFFICE',
+        message: 'only the office (the PROVABLE session root) may ' + what +
+          (caller ? '; the caller is member ' + caller : '; no caller could be identified'),
+      }
+    }
+    return fn()
+  }
 
   // ── office / host controls ────────────────────────────────────────────────
-  registerTool('vibe_v5_configure', 'Create/configure the research institute (project, institute name, problem, params) WITHOUT starting it. Use this FIRST, then vibe_v5_start.', objParams({ project: S, institute: S, problem: S, params: { type: 'object' } }), (s, a) => s.configure(a))
-  registerTool('vibe_v5_start', 'Found the institute: create the academician + N permanent researchers and begin. They brainstorm independently, then self-organize (the academician organizes and assigns; the framework only facilitates).', objParams({ problem: S, researcherCount: I, academician: B, params: { type: 'object' }, seedDirections: SA }), (s, a) => s.doStart(a))
-  registerTool('vibe_v5_resume', 'Resume a persisted institute: reconcile members against their durable sessions, rebuild any missing one from its Progress/, refresh consensus watchdogs, and restart scheduling.', objParams({}), (s) => s.resume())
-  registerTool('vibe_v5_pause', 'Pause the institute (in-flight turns finish; no new wakes until resume).', objParams({}), (s) => s.setPause())
-  registerTool('vibe_v5_stop', 'Stop the institute: interrupt every member, clear coordination state, and release their child sessions.', objParams({}), (s) => s.initStop())
+  registerTool('vibe_v5_configure', 'Create/configure the research institute (project, institute name, problem, params) WITHOUT starting it. Use this FIRST, then vibe_v5_start.', objParams({ project: S, institute: S, problem: S, params: { type: 'object' } }), (s, a, x) => withOffice(s, x, 'configure the institute', () => s.configure(a)))
+  registerTool('vibe_v5_start', 'Found the institute: create the academician + N permanent researchers and begin. They brainstorm independently, then self-organize (the academician organizes and assigns; the framework only facilitates).', objParams({ problem: S, researcherCount: I, academician: B, params: { type: 'object' }, seedDirections: SA }), (s, a, x) => withOffice(s, x, 'found the institute', () => s.doStart(a)))
+  registerTool('vibe_v5_resume', 'Resume a persisted institute: reconcile members against their durable sessions, rebuild any missing one from its Progress/, refresh consensus watchdogs, and restart scheduling.', objParams({}), (s, a, x) => withOffice(s, x, 'resume the institute', () => s.resume()))
+  registerTool('vibe_v5_pause', 'Pause the institute (in-flight turns finish; no new wakes until resume).', objParams({}), (s, a, x) => withOffice(s, x, 'pause the institute', () => s.setPause()))
+  registerTool('vibe_v5_stop', 'Stop the institute: interrupt every member, clear coordination state, and release their child sessions.', objParams({}), (s, a, x) => withOffice(s, x, 'stop the institute', () => s.initStop()))
   registerTool('vibe_v5_status', 'Machine-readable institute status (members, tasks, quorum, meetings, verification, mail).', objParams({}), (s) => s.status())
   registerTool('vibe_v5_report', 'Human-readable institute report (staffing, tasks, consensus, meetings, file locations).', objParams({}), (s) => s.report())
-  registerTool('vibe_v5_set', 'Tune institute parameters (persisted in State/<institute>.v5state.json). provider/model override staff LLM routes (empty = inherit the office route). toolAllow/toolDeny restrict PERMANENT staff tools; tempToolAllow/tempToolDeny restrict temp workers. quorumCap sets m = min(quorumCap, voters); quorumMode "m-unanimous" (v5) or "all-unanimous" (v4 legacy). formalVerify: "off" (default, no extra requirement) | "encourage" (agents decide by implementation difficulty whether to formalize in Lean; a passing Lean run turns the vote into a FIDELITY review of the Lean statements) | "require" (same, plus a gate: a true/false verdict is withheld as undecided until the object is Lean-passed or has an explicit reasoned blocker record).', objParams({
+  registerTool('vibe_v5_set', 'Tune institute parameters (persisted in State/<institute>.v5state.json). provider/model override staff LLM routes (empty = inherit the office route). toolAllow/toolDeny restrict PERMANENT staff tools; tempToolAllow/tempToolDeny restrict temp workers. quorumCap sets m = min(quorumCap, voters); an m-vote passes only when at least m Boolean votes (exactly 1 or exactly 0) exist AND no voter returns an opposing Boolean, so with the default roster it degenerates to unanimity among the current voters; only current voters count (a dismissed member\'s earlier ballot is dropped). quorumMode "m-unanimous" (v5) or "all-unanimous" (v4 legacy). formalVerify: "off" (default, no extra requirement) | "encourage" (agents decide by implementation difficulty whether to formalize in Lean; a passing Lean run turns the vote into a FIDELITY review of the Lean statements) | "require" (same, plus a gate: a true/false verdict is withheld as undecided until the object is Lean-passed or has an explicit reasoned blocker record). FINAL PAPER: finalPaper (default true) writes the final paper when the run concludes — the paper phase runs BEFORE the run is marked complete, the permanent staff write their own part, cross-review each other, and the editor named by paperEditor finalises; paperFormat "both"|"md"|"tex"; paperLanguage "zh"|"en"; paperCompilePdf compiles a PDF when a LaTeX engine is detected; paperEditor "academician" (default, the only editor an unattended run can reach) | "office" (manual /v5 paper only — the office must first consult the whole institute: >=1 office message AND >=1 meeting, recorded in the finalisation note); paperLatexCommand forces one engine command instead of auto-detection (empty = auto: xelatex -> latexmk -> pdflatex -> lualatex -> tectonic, English prefers pdflatex). Unknown spellings of these enums fall back to the documented default.', objParams({
     academician: B, academicianLeads: B, memberMayRejectAssign: B, researcherCount: I,
     quorumCap: I, quorumMode: S, verdictMaxRounds: I,
     maxTempPerMember: I, maxTempTotal: I,
@@ -4244,21 +5655,63 @@ export function apply(ctx) {
     activityTimeoutMs: I, stallAutoMeetingMs: I, chatDigestMs: I, chatDigestMax: I, meetingKeepEvery: I,
     formalVerify: { type: 'string', enum: ['off', 'encourage', 'require'] },
     leanCommand: S, leanArgs: SA, leanTimeoutMs: I,
+    finalPaper: B, paperFormat: { type: 'string', enum: ['both', 'md', 'tex'] },
+    paperLanguage: { type: 'string', enum: ['zh', 'en'] },
+    paperCompilePdf: B, paperEditor: { type: 'string', enum: ['office', 'academician'] }, paperLatexCommand: S,
     provider: S, model: S, staffPersona: S, toolAllow: SA, toolDeny: SA, tempToolAllow: SA, tempToolDeny: SA,
-  }), (s, a) => s.setParams(a))
-  registerTool('vibe_v5_message', 'Relay a message from the office/human into the institute (to a member id, to "all", or to "voters").', objParams({ to: S, content: S }, ['to', 'content']), (s, a) => {
+  }), (s, a, x) => withOffice(s, x, 'tune institute parameters', () => s.setParams(a)))
+  registerTool('vibe_v5_message', 'Relay a message from the office/human into the institute (to a member id, to "all", or to "voters").', objParams({ to: S, content: S }, ['to', 'content']), (s, a, x) => {
+    // The relay is SIGNED as the office (`say('office', …)`), so only the PROVABLE session root may
+    // send it. `memberIdOfAgent` answers '' for an unidentifiable descendant of the root (a nested
+    // helper, a dismissed member's stale child) and for a synthetic context, and a member child is
+    // not the office either — without this check ANY caller's text was delivered as the office
+    // (audit L6 follow-up; the tool's own description says "from the office/human").
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: relaying a message as the office needs the office (the session root)' }
+    if (caller !== 'office') return { ok: false, code: 'V5_NOT_OFFICE', message: 'vibe_v5_message relays the OFFICE voice; a member speaks with vibe_v5_say' }
     const to = String(a.to || 'all')
     return s.say('office', { to, text: String(a.content), kind: to === 'all' || to === 'voters' ? 'office' : 'dm' })
   })
-  registerTool('vibe_v5_meeting', 'Convene a meeting (office/academician) or propose one (any other member — relayed to the academician/office). Parked automatically while a verification is in flight.', objParams({ agenda: S, kind: { type: 'string', enum: ['sync', 'division', 'verify-request', 'solve-vote'] }, target: S }, ['agenda']), (s, a, x) => s.startMeeting(s.memberIdOfAgent(x) || 'office', a))
+  registerTool('vibe_v5_meeting', 'Convene a meeting (office/academician) or propose one (any other member — relayed to the academician/office). Parked automatically while a verification is in flight. kind picks the meeting type: "sync" = routine coordination (default), "division" = split the work, "verify-request" = ask the group to verify an object, "solve-vote" = put "is the original problem solved?" to a vote; target names the object for verify-request/solve-vote.', objParams({ agenda: S, kind: { type: 'string', enum: ['sync', 'division', 'verify-request', 'solve-vote'] }, target: S }, ['agenda']), (s, a, x) => {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may convene/propose a meeting' }
+    return s.startMeeting(caller, a)
+  })
   registerTool('vibe_v5_members', 'List the institute roster (office, employer, phase, direction, rounds).', objParams({}), (s) => ({ ok: true, members: s.status().members, quorum: s.status().quorum }))
-  registerTool('vibe_v5_hire', 'Hire one temp worker (office; the academician and every permanent researcher may also hire their own). Requires purpose and initial_task.', objParams({ purpose: S, initial_task: S, direction: S, term: S, to: S }, ['purpose', 'initial_task']), (s, a, x) => {
-    const caller = a.to ? String(a.to) : (s.isOffice(s.memberIdOfAgent(x)) ? 'office' : s.memberIdOfAgent(x))
+  registerTool('vibe_v5_hire', 'Hire one temp worker (office; the academician and every permanent researcher may also hire their own). Requires purpose and initial_task. term (optional) is the task deadline/period text the worker is told at onboarding; direction (optional) states what it should work on.', objParams({ purpose: S, initial_task: S, direction: S, term: S, to: S }, ['purpose', 'initial_task']), (s, a, x) => {
+    const caller = a.to ? String(a.to) : s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may hire' }
     return s.hire(caller, a)
   })
-  registerTool('vibe_v5_fire', 'Dismiss a temp worker for real: cancel its turn, release its resident child, reclaim its tasks, drop its mail, and mark it dismissed (its id is never reused).', objParams({ id: S, reason: S }, ['id']), (s, a, x) => s.fire(s.memberIdOfAgent(x) || 'office', a))
-  registerTool('vibe_v5_add_researcher', 'Office only: hire another PERMANENT researcher (members may only propose this).', objParams({ direction: S }), (s, a, x) => s.addResearcher(s.memberIdOfAgent(x) || 'office', a && a.direction))
-  registerTool('vibe_v5_remove_researcher', 'Office only: dismiss a PERMANENT researcher.', objParams({ id: S }, ['id']), (s, a) => s.removeResearcher(a.id))
+  registerTool('vibe_v5_fire', 'Dismiss a temp worker for real: cancel its turn, release its resident child, reclaim its tasks, drop its mail, and mark it dismissed (its id is never reused).', objParams({ id: S, reason: S }, ['id']), (s, a, x) => {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or the employer may fire' }
+    return s.fire(caller, a)
+  })
+  registerTool('vibe_v5_add_researcher', 'Office only: hire another PERMANENT researcher (members may only propose this).', objParams({ direction: S }), (s, a, x) => {
+    const caller = s.officeCaller(x)
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: adding a permanent researcher is the office\'s decision (the session root)' }
+    return s.addResearcher(caller, a && a.direction)
+  })
+  // "Office only" (the tool's own description) must be ENFORCED, not just documented: the handler
+  // used to call `removeResearcher` with no caller at all, so any member child — or an
+  // unidentifiable descendant of the root — could dismiss a PERMANENT researcher (audit L6
+  // follow-up; the academician can only PROPOSE additions/removals).
+  registerTool('vibe_v5_remove_researcher', 'Office only: dismiss a PERMANENT researcher.', objParams({ id: S }, ['id']), (s, a, x) => withCaller(s, x, 'removing a permanent researcher', (caller) => (
+    s.isOffice(caller)
+      ? s.removeResearcher(a.id)
+      : { ok: false, code: 'V5_NOT_OFFICE', message: 'only the office (the session root) may dismiss a permanent researcher' }
+  )))
+  // ── final paper (docs/final-paper.md) ─────────────────────────────────────
+  registerTool('vibe_v5_paper', 'Final paper: start (or re-run) the team-authored paper for this run. The permanent staff write their own part, cross-review another member\'s part, and the editor named by paperEditor finalises. lang/format override paperLanguage/paperFormat for THIS paper; editor overrides paperEditor for THIS paper only (office = the manual path, which parks the flow until the office consults the institute and calls vibe_v5_finalize_paper); force rewrites an already-finalised paper (idempotent otherwise: it only fills artifacts that are missing).', objParams({ lang: S, format: S, editor: { type: 'string', enum: ['office', 'academician'] }, force: B, reason: S }), (s, a, x) => withOffice(s, x, 'write the final paper', () => {
+    const lang = a.lang === undefined ? undefined : String(a.lang)
+    const format = a.format === undefined ? undefined : String(a.format)
+    if (lang !== undefined && lang !== 'zh' && lang !== 'en') return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'lang must be zh|en' }
+    if (format !== undefined && ['both', 'md', 'tex'].indexOf(format) === -1) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'format must be both|md|tex' }
+    if (a.editor !== undefined && ['office', 'academician'].indexOf(String(a.editor)) === -1) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'editor must be office|academician' }
+    return s.startPaper(a.reason === 'run-complete' ? 'run-complete' : 'manual', { lang, format, editor: a.editor, force: a.force === true, reason: a.reason })
+  }))
+  registerTool('vibe_v5_finalize_paper', 'Office: finalise the final paper after consulting the whole institute. Required when paperEditor="office": at least one office message (vibe_v5_message) AND at least one meeting convened by the office must happen first (paper.meta.json records them, and the note must state the conclusion). decision="revise" asks for another writing round (bounded).', objParams({ decision: { type: 'string', enum: ['deliverable', 'revise'] }, note: S, conclusion: S, force: B }, ['decision']), (s, a, x) => withOffice(s, x, 'finalise the final paper', () => s.finalizePaperByOffice(a)))
 
   // ── member-facing controls ────────────────────────────────────────────────
   registerTool('vibe_v5_say', '(member) Speak in the group chat (omit "to"), send a private message ("to":"r-2"), or address only the voters ("to":"voters").', objParams({ text: S, to: S }, ['text']), (s, a, x) => {
@@ -4282,12 +5735,12 @@ export function apply(ctx) {
   registerTool('vibe_v5_record_method', '(member) Record a theory/method/tool in your library. REQUIRES value, motive and p.', objParams({ id: S, title: S, type: S, content: S, notation: S, value: N, motive: S, p: N }, ['content', 'value', 'motive', 'p']), (s, a, x) => s.recordCard(s.memberIdOfAgent(x), 'method', a))
   registerTool('vibe_v5_record_subproblem', '(member) Record a sub-problem in your library. REQUIRES value, motive and p.', objParams({ id: S, title: S, statement: S, value: N, motive: S, p: N }, ['statement', 'value', 'motive', 'p']), (s, a, x) => s.recordCard(s.memberIdOfAgent(x), 'subproblem', a))
   registerTool('vibe_v5_read_library', '(member) Read anyone\'s library (read-only): their progress and recorded cards. Omit member to read everyone.', objParams({ member: S, kind: S, id: S }), (s, a) => s.readLibrary(a))
-  registerTool('vibe_v5_propose_verify', '(member) Propose an object for consensus verification. Any member may propose; only voting members decide.', objParams({ target: S, kind: S, reason: S }, ['target']), (s, a, x) => s.maybeQueueVerify(a.target, a.kind, s.memberIdOfAgent(x), a.reason))
+  registerTool('vibe_v5_propose_verify', '(member) Propose an object for consensus verification. Any member may propose; only voting members decide.', objParams({ target: S, kind: S, reason: S }, ['target']), (s, a, x) => withCaller(s, x, 'a verification proposal', (caller) => s.maybeQueueVerify(a.target, a.kind, caller, a.reason)))
   registerTool('vibe_v5_verdict', '(member) Cast your boolean verdict on the object under verification. verdict is [0,1]: exactly 1 = assert true, exactly 0 = assert false, anything in between = abstention (not counted toward m, counted in the mean).', objParams({ target: S, verdict: N, reason: S }, ['verdict']), (s, a, x) => s.castVerdict(s.memberIdOfAgent(x), a.target, a.verdict, a.reason))
-  registerTool('vibe_v5_task_create', '(member) Open a task on the shared board (subject, description, optional blockers, advisory write scopes, priority).', objParams({ subject: S, description: S, blocked_by: SA, write_scopes: SA, priority: I }, ['subject']), (s, a, x) => s.taskCreate(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_task_create', '(member) Open a task on the shared board (subject, description, optional blockers, advisory write scopes, priority).', objParams({ subject: S, description: S, blocked_by: SA, write_scopes: SA, priority: I }, ['subject']), (s, a, x) => withCaller(s, x, 'creating a task', (caller) => s.taskCreate(caller, a)))
   registerTool('vibe_v5_task_list', '(member) List shared tasks with readiness, owner, revision, blockers and write-scope warnings.', objParams({ status: S, owner: S, ready: B }), (s, a) => ({ ok: true, tasks: s.taskList(a) }))
   registerTool('vibe_v5_task_get', '(member) Read one task\'s latest value BEFORE changing it (the revision is the CAS precondition).', objParams({ task_id: S }, ['task_id']), (s, a) => ({ ok: true, task: s.getTask(a.task_id) }))
-  registerTool('vibe_v5_task_update', '(member) Compare-and-set a task action: claim|release|edit|set_dependencies|complete|reopen|reassign|delete. Pass expected_revision from task_get/task_list; a stale revision is refused.', objParams({ task_id: S, expected_revision: I, action: S, subject: S, description: S, blocked_by: SA, write_scopes: SA, owner: S }, ['task_id', 'expected_revision', 'action']), (s, a, x) => s.taskUpdate(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_task_update', '(member) Compare-and-set a task action: claim|release|edit|set_dependencies|complete|reopen|reassign|delete. Pass expected_revision from task_get/task_list; a stale revision is refused.', objParams({ task_id: S, expected_revision: I, action: S, subject: S, description: S, blocked_by: SA, write_scopes: SA, owner: S }, ['task_id', 'expected_revision', 'action']), (s, a, x) => withCaller(s, x, 'a task mutation', (caller) => s.taskUpdate(caller, a)))
 
   // ── the academician's organizational tools ────────────────────────────────
   registerTool('vibe_v5_overview', '(academician) Institute-wide view: roster, task board, every member\'s Progress tail, recent chat, and stall warnings. Use it instead of guessing.', objParams({}), async (s) => {
@@ -4329,17 +5782,17 @@ export function apply(ctx) {
     parts.push('- 距上次实质进展：' + Math.round(idleFor / 1000) + ' 秒')
     return { ok: true, overview: parts.join('\n') }
   })
-  registerTool('vibe_v5_assign', '(academician) ASSIGN work: create or pick a task and give it to a specific member (including temp workers), stating WHY and the acceptance criteria. The assignee executes by default and may object with reasons (which are broadcast).', objParams({ task_id: S, subject: S, description: S, to: S, why: S, acceptance: S, priority: I, write_scopes: SA }, ['to', 'why', 'acceptance']), (s, a, x) => s.taskAssign(s.memberIdOfAgent(x), a))
-  registerTool('vibe_v5_prioritize', '(academician) Set institute-wide priorities: an ordered list of {task_id, priority} plus WHY. This orders work only — it never changes what is true.', objParams({ order: { type: 'array', items: { type: 'object' } }, why: S }), (s, a, x) => s.taskPrioritize(s.memberIdOfAgent(x), a))
-  registerTool('vibe_v5_nudge', '(academician) Supervise: wake one member with a stated reason and a concrete suggested next step. Prefer a specific next step over a bare "hurry up".', objParams({ to: S, why: S, next_step: S }, ['to', 'why']), (s, a, x) => s.nudge(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_assign', '(academician) ASSIGN work: create or pick a task and give it to a specific member (including temp workers), stating WHY and the acceptance criteria. The assignee executes by default and may object with reasons (which are broadcast).', objParams({ task_id: S, subject: S, description: S, to: S, why: S, acceptance: S, priority: I, write_scopes: SA }, ['to', 'why', 'acceptance']), (s, a, x) => withCaller(s, x, 'an assignment', (caller) => s.taskAssign(caller, a)))
+  registerTool('vibe_v5_prioritize', '(academician) Set institute-wide priorities: an ordered list of {task_id, priority} plus WHY. This orders work only — it never changes what is true.', objParams({ order: { type: 'array', items: { type: 'object' } }, why: S }), (s, a, x) => withCaller(s, x, 'setting priorities', (caller) => s.taskPrioritize(caller, a)))
+  registerTool('vibe_v5_nudge', '(academician) Supervise: wake one member with a stated reason and a concrete suggested next step. Prefer a specific next step over a bare "hurry up".', objParams({ to: S, why: S, next_step: S }, ['to', 'why']), (s, a, x) => withCaller(s, x, 'a nudge', (caller) => s.nudge(caller, a)))
 
   // ── Lean formal verification (docs/formal-verification.md) ────────────────
   // These three tools are registered UNCONDITIONALLY: tool registration is static (a
   // dynamic registration would depend on a runtime knob and break the effect discipline),
   // while the MODE only decides whether the framework TELLS members about them. In 'off'
   // mode they still work if a human or agent calls them deliberately.
-  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT, and a non-zero exit returns the compiler output. Pass target=<object id> to also record the run against that object.', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => s.leanRunTool(s.memberIdOfAgent(x), a))
-  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (when the run passes) also Verified/Lean/<target>.lean, marking the object Lean-passed. kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => s.leanArchive(s.memberIdOfAgent(x), a))
+  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT, and a non-zero exit returns the compiler output. Pass target=<object id> to also record the run against that object.', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => withCaller(s, x, 'a Lean run', (caller) => s.leanRunTool(caller, a)))
+  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (when the run passes) also Verified/Lean/<target>.lean, marking the object Lean-passed. kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => withCaller(s, x, 'a Lean archive', (caller) => s.leanArchive(caller, a)))
   registerTool('vibe_v5_lean_lib', '(member) List (and by default rebuild) the Lean reuse library: your institute\'s Formal/Index.md, plus the global cross-project Formal/Lib and Formal/Proved indexes. Look here BEFORE writing a new definition so you reuse instead of redefining.', objParams({ refresh: B }), async (s, a) => {
     const r = a && a.refresh === false ? { lib: null, proved: null, objects: Object.keys(s.formalRecords()).length } : await s.rebuildLeanLibIndexes()
     const st = s.status()
@@ -4356,11 +5809,23 @@ export function apply(ctx) {
   // ── /v5 slash command ────────────────────────────────────────────────────
   ctx.effect(() => commands.register({
     name: 'v5', description: 'control the Vibe Math V5 research institute',
-    input: { hint: '[configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set]' },
+    input: { hint: '[configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set|paper [lang=en] [format=tex] [editor=office] [force]]' },
     handler: async function (inv) {
       const s = getSession(inv && inv.agent)
-      if (!s) return { kind: 'success', text: JSON.stringify({ ok: false, error: 'no session' }) }
+      if (!s) return { kind: 'error', text: JSON.stringify({ ok: false, error: 'no session' }) }
       await s.ready()
+      // The `/v5` line is the OFFICE/human control surface (README: the institute-office row) and
+      // EVERY subcommand below acts AS the office (`say('office', …)`, `hire('office', …)`,
+      // `removeResearcher`, `setParams`, `initStop` …). It used to accept ANY caller whose session
+      // maps to the institute — a member child maps to the same office session — so the caller is
+      // resolved here too and refused unless it is the PROVABLE session root (audit L6 follow-up:
+      // the command surface had no caller check at all). Read-only subcommands are gated with the
+      // rest: a member reads state with vibe_v5_status / vibe_v5_report / vibe_v5_members.
+      const caller = s.officeCaller(inv && inv.agent)
+      if (caller !== 'office') {
+        const refused = { ok: false, code: 'V5_NOT_OFFICE', message: 'the /v5 control line belongs to the office (the session root); members use the vibe_v5_* tools' }
+        return { kind: 'error', text: JSON.stringify(refused, null, 2) }
+      }
       const line = String(inv && inv.rawInput ? inv.rawInput : '').trim()
       const parts = line.split(/\s+/)
       const cmd = parts[0] || ''
@@ -4380,7 +5845,28 @@ export function apply(ctx) {
       else if (cmd === 'fire') r = await s.fire('office', { id: rest[0] || '', reason: rest.slice(1).join(' ') })
       else if (cmd === 'add') r = await s.addResearcher('office', rest.join(' '))
       else if (cmd === 'remove') r = await s.removeResearcher(rest[0] || '')
-      else if (cmd === 'set') {
+      else if (cmd === 'paper') {
+        // `/v5 paper [lang=en] [format=tex] [force] [editor=office|academician]`
+        const o = {}
+        let force = false
+        let bad = ''
+        for (const tok of rest) {
+          if (tok === 'force') { force = true; continue }
+          const eq = tok.indexOf('=')
+          if (eq <= 0) { bad = 'unknown paper argument: ' + tok; break }
+          const k = tok.slice(0, eq), v = tok.slice(eq + 1)
+          if (k === 'lang' || k === 'format' || k === 'editor') o[k] = v
+          else { bad = 'unknown paper option: ' + k + ' (use lang=zh|en format=both|md|tex editor=office|academician force)'; break }
+        }
+        if (!bad && o.lang !== undefined && o.lang !== 'zh' && o.lang !== 'en') bad = 'lang must be zh|en'
+        if (!bad && o.format !== undefined && ['both', 'md', 'tex'].indexOf(o.format) === -1) bad = 'format must be both|md|tex'
+        if (!bad && o.editor !== undefined && ['office', 'academician'].indexOf(o.editor) === -1) bad = 'editor must be office|academician'
+        if (bad) return { kind: 'error', text: JSON.stringify({ ok: false, code: 'V5_INVALID_ARGUMENT', message: bad }, null, 2) }
+        // `editor=office` is the manual path that uses the office as the finalising
+        // representative (docs/final-paper.md §7 — never reachable from an automatic run). One-shot: it
+        // does not rewrite the persisted `paperEditor`.
+        r = await s.startPaper('manual', { lang: o.lang, format: o.format, editor: o.editor, force })
+      } else if (cmd === 'set') {
         const upd = {}
         for (const tok of rest) {
           const eq = tok.indexOf('=')
@@ -4390,8 +5876,12 @@ export function apply(ctx) {
           upd[k] = Number.isFinite(n) && v !== '' ? n : (v === 'true' ? true : v === 'false' ? false : v)
         }
         r = await s.setParams(upd)
-      } else r = { ok: false, usage: 'configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set' }
-      return { kind: 'success', text: JSON.stringify(r, null, 2) }
+      } else r = { ok: false, usage: 'configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set|paper [lang=zh|en] [format=both|md|tex] [editor=office|academician] [force]' }
+      // A business failure (the dispatch result's own ok:false) is a FAILED command: the host's
+      // CommandResult union distinguishes success from error, and returning 'success' made a rejected
+      // invocation look identical to a successful one (same fix as v2/v3).
+      const failed = r !== null && typeof r === 'object' && r.ok === false
+      return { kind: failed ? 'error' : 'success', text: JSON.stringify(r, null, 2) }
     },
   }))
 
@@ -4481,6 +5971,32 @@ function slugify(s) {
   return t || ''
 }
 
+// Explicit parameter coercion (docs/final-paper.md §2). A boolean parameter spelled `'false'`, `0`, `'no'`
+// or `'off'` must be false — the old `=== true || === 'true'` silently treated `1`/`'yes'` as
+// false. An unrecognised spelling is REJECTED (the caller's default wins), never guessed.
+function coerceBool(v, def) {
+  if (v === undefined) return def
+  if (v === true || v === 1 || v === '1') return true
+  if (v === false || v === 0 || v === '0') return false
+  const t = String(v).trim().toLowerCase()
+  if (['true', 'yes', 'on', 'y', 't'].indexOf(t) !== -1) return true
+  if (['false', 'no', 'off', 'n', 'f', ''].indexOf(t) !== -1) return false
+  return def
+}
+
+// Enum coercion with legacy aliases (.v5 / older flat spellings) and a documented fallback.
+const ENUM_ALIASES = {
+  paperFormat: { markdown: 'md', latex: 'tex', texonly: 'tex', all: 'both' },
+  paperLanguage: { cn: 'zh', chinese: 'zh', 'zh-cn': 'zh', english: 'en', 'en-us': 'en' },
+  paperEditor: { root: 'office', host: 'office', acad: 'academician', dean: 'academician' },
+}
+function coercePaperEnum(key, v, allowed, def) {
+  const t = String(v == null ? '' : v).trim().toLowerCase()
+  if (allowed.indexOf(t) !== -1) return t
+  const alias = (ENUM_ALIASES[key] || {})[t]
+  return alias !== undefined && allowed.indexOf(alias) !== -1 ? alias : def
+}
+
 function tryJson(s) { try { return JSON.parse(s) } catch (e) { return undefined } }
 
 function parseReply(text) {