dsh-vibe-math 2.5.0 → 2.7.0

package/vibe-math-v5/vibe-math-v5.js

@@ -52,6 +52,27 @@
 // field — so the old projection-based primary made the user's own session unresumable.
 export const inject = ['subagents', 'agents', 'fs', 'tools', 'commands', 'timer']
 
+// ── math_computation (docs/math-computation.md) ──────────────────────────────
+// The tool CORE lives in a shared module installed byte-identically into all four presets
+// (`_oneoff/mc-P1-ready/INTERFACE-FREEZE.md` §3/§4): this preset only wires it (import +
+// params + one registration + prompt text). The module imports `./math-engines.js` itself.
+import {
+  MATH_PARAM_NAMES,
+  MATH_PARAM_DEFAULTS,
+  MATH_CAPS,
+  MATH_SHELL_FALLBACK_MARK,
+  MATH_TOOL_DESCRIPTION,
+  MATH_PERSONA_TOOL_LINE,
+  MATH_RULE_LINES,
+  MATH_RULE_LINES_EN,
+  MATH_ARCHIVE_WORKFLOW_LINE,
+  MATH_ARCHIVE_WORKFLOW_LINE_EN,
+  normalizeMathParams,
+  probeMathEngines,
+  registerMathComputation,
+  mathAvailabilityLine,
+} from './math-computation.js'
+
 const PROJECTION_VERSION = 1
 const EV = {
   institute: 'vibe5/institute',
@@ -68,6 +89,120 @@ const EV = {
   formal: 'vibe5/formal',
 }
 
+// ── final paper (docs/final-paper.md) ─────────────────────────────────────────
+// The run's LAST deliverable. The permanent staff each write their own part, cross-review
+// each other's part, and the editor named by `paperEditor` finalises — but ONLY after the
+// whole institute has agreed the parts are deliverable, and (when the office edits) only
+// after the office has consulted the institute. The phase runs BEFORE the completion flags
+// are flipped (docs/final-paper.md §3): after `phase='solved'` the machinery refuses to wake
+// members (`wakeIfIdle`), to convene meetings (`startMeeting`) or to dispatch an end.
+const PAPER_MAX_ROUNDS = 3
+// Chinese first (docs/final-paper.md §8): xelatex covers CJK out of the box; English prefers pdflatex.
+const PAPER_ENGINE_ORDER = {
+  zh: ['xelatex', 'latexmk', 'pdflatex', 'lualatex', 'tectonic'],
+  en: ['pdflatex', 'latexmk', 'lualatex', 'tectonic', 'xelatex'],
+}
+// The repair pass keeps only what the text itself needs; everything else (hyperref,
+// longtable, booktabs, an unknown package) is dropped before the retry.
+const PAPER_REPAIR_CORE = ['amsmath', 'amssymb', 'amsthm', 'geometry', 'ctex']
+const PAPER_SECTIONS = [
+  '标题、作者、日期与摘要',
+  '引言与问题背景',
+  '原问题的完整解法',
+  '已检验通过的命题',
+  '已解决的子问题 / 中间成果',
+  '创造或发现的有价值之物：方法、理论、思想、经验与数学理解',
+  '规律总结',
+  '讨论、局限与展望',
+  '附录：证据与文件索引',
+]
+
+// ── Lean async compile queue + search path (docs/formal-verification.md §1/§5/§7) ──────────
+// The queue is a per-session FIFO driven by the existing heartbeat, so the constants and the
+// pure helpers live at module scope. Concurrency is a CONSTANT, not a parameter: compiles and
+// the model compete for the same CPU, and the parameter surface deliberately gains only
+// `leanAsync` (the per-compile budget reuses `leanTimeoutMs`).
+const LEAN_QUEUE_CONCURRENCY = 1
+// ONE place for the flag spelling: a toolchain that does not know `--search-path` only needs
+// this constant changed (never the interface).
+const LEAN_SEARCH_PATH_FLAG = '--search-path'
+const LEAN_READ_MAX_BYTES = 64 * 1024
+// A user-supplied search root wins: never inject a second one (explicit override first).
+function leanHasSearchFlag(args) {
+  return (Array.isArray(args) ? args : []).some((a) => {
+    const t = String(a)
+    return t === LEAN_SEARCH_PATH_FLAG || t.indexOf(LEAN_SEARCH_PATH_FLAG + '=') === 0 || t === '-R' || t === '--root'
+  })
+}
+// Content identity for queue dedupe: CRLF normalised, trailing blank lines dropped.
+function leanHashText(s) {
+  return String(s == null ? '' : s).replace(/\r\n?/g, '\n').replace(/[\s\n]+$/, '')
+}
+const SHA256_K = [
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]
+const sha256Rotr = (x, n) => ((x >>> n) | (x << (32 - n))) >>> 0
+// SHA-256 (FIPS 180-4), implemented here instead of importing `node:crypto`: this preset is a
+// self-contained file row with ZERO imports, and the digest is only a content identity (queue
+// dedupe + job id). `__testHelpers.sha256Hex` is checked against the published vectors AND
+// against `node:crypto` in the tests, so correctness is proven rather than assumed.
+function sha256Hex(input) {
+  const text = String(input == null ? '' : input)
+  const bytes = []
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i)
+    if (c < 0x80) bytes.push(c)
+    else if (c < 0x800) bytes.push(0xc0 | (c >> 6), 0x80 | (c & 63))
+    else if (c >= 0xd800 && c <= 0xdbff && i + 1 < text.length && text.charCodeAt(i + 1) >= 0xdc00 && text.charCodeAt(i + 1) <= 0xdfff) {
+      const cp = 0x10000 + ((c - 0xd800) << 10) + (text.charCodeAt(i + 1) - 0xdc00)
+      i++
+      bytes.push(0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 63), 0x80 | ((cp >> 6) & 63), 0x80 | (cp & 63))
+    } else bytes.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63))
+  }
+  const bitLen = bytes.length * 8
+  bytes.push(0x80)
+  while (bytes.length % 64 !== 56) bytes.push(0)
+  const hi = Math.floor(bitLen / 0x100000000)
+  bytes.push((hi >>> 24) & 255, (hi >>> 16) & 255, (hi >>> 8) & 255, hi & 255)
+  bytes.push((bitLen >>> 24) & 255, (bitLen >>> 16) & 255, (bitLen >>> 8) & 255, bitLen & 255)
+  let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a
+  let h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19
+  const w = new Array(64)
+  for (let off = 0; off < bytes.length; off += 64) {
+    for (let i = 0; i < 16; i++) {
+      const j = off + i * 4
+      w[i] = ((bytes[j] << 24) | (bytes[j + 1] << 16) | (bytes[j + 2] << 8) | bytes[j + 3]) >>> 0
+    }
+    for (let i = 16; i < 64; i++) {
+      const x = w[i - 15], y = w[i - 2]
+      const s0 = (sha256Rotr(x, 7) ^ sha256Rotr(x, 18) ^ (x >>> 3)) >>> 0
+      const s1 = (sha256Rotr(y, 17) ^ sha256Rotr(y, 19) ^ (y >>> 10)) >>> 0
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0
+    }
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7
+    for (let i = 0; i < 64; i++) {
+      const S1 = (sha256Rotr(e, 6) ^ sha256Rotr(e, 11) ^ sha256Rotr(e, 25)) >>> 0
+      const ch = ((e & f) ^ (~e & g)) >>> 0
+      const t1 = (h + S1 + ch + SHA256_K[i] + w[i]) >>> 0
+      const S0 = (sha256Rotr(a, 2) ^ sha256Rotr(a, 13) ^ sha256Rotr(a, 22)) >>> 0
+      const maj = ((a & b) ^ (a & c) ^ (b & c)) >>> 0
+      const t2 = (S0 + maj) >>> 0
+      h = g; g = f; f = e; e = (d + t1) >>> 0
+      d = c; c = b; b = a; a = (t1 + t2) >>> 0
+    }
+    h0 = (h0 + a) >>> 0; h1 = (h1 + b) >>> 0; h2 = (h2 + c) >>> 0; h3 = (h3 + d) >>> 0
+    h4 = (h4 + e) >>> 0; h5 = (h5 + f) >>> 0; h6 = (h6 + g) >>> 0; h7 = (h7 + h) >>> 0
+  }
+  return [h0, h1, h2, h3, h4, h5, h6, h7].map((x) => ('00000000' + x.toString(16)).slice(-8)).join('')
+}
+
 // Stable error codes (ported from DSH agent-teams' typed-error discipline).
 function v5err(code, message) {
   const e = new Error(message || code)
@@ -110,6 +245,15 @@ export function apply(ctx) {
   const tools = ctx.tools
   const commands = ctx.commands
 
+  // A plugin UNLOAD must not leave an orphan compiler behind (docs/formal-verification.md §7-6):
+  // every session registers its Lean disposer here, and this effect's disposer terminates what
+  // is in flight and marks it `interrupted` (never `passed`). Registered FIRST so a host that
+  // records effect disposers (the tests do) can reach it deterministically.
+  const leanDisposers = new Set()
+  ctx.effect(() => () => {
+    for (const d of Array.from(leanDisposers)) { try { d() } catch (e) { /* best effort */ } }
+  })
+
   // Optional services are resolved LAZILY at call time, never snapshotted in apply():
   // a `ctx.get()` snapshot taken here is order-sensitive, so a service provided later
   // would stay undefined for the whole session.
@@ -189,6 +333,9 @@ export function apply(ctx) {
       lastProgressAt: now(),
       artifactCount: 0,
       diagnostics: [],
+      // The final-paper flow (stage machine + its artifacts state). Durable like everything
+      // else, so a restart resumes the same stage instead of writing a second paper.
+      paper: null,
     }
   }
   function initState() { return { v: PROJECTION_VERSION, institutes: {}, order: [] } }
@@ -228,6 +375,16 @@ export function apply(ctx) {
           if (patch.runId !== undefined) n.runId = String(patch.runId)
           if (patch.lastProgressAt !== undefined) n.lastProgressAt = Number(patch.lastProgressAt) || 0
           if (patch.artifactCount !== undefined) n.artifactCount = Number(patch.artifactCount) || 0
+          // The final-paper state. A FUNCTION is a MUTATION applied inside the fold (the same
+          // trick the verify queue uses): the paper stage, its parts and its office-consultation
+          // counters are updated from several places (member replies, office messages, meetings),
+          // and a whole-object read-modify-write outside the fold would lose updates.
+          if (patch.paper !== undefined) {
+            const next = typeof patch.paper === 'function'
+              ? patch.paper(n.paper === undefined ? null : n.paper)
+              : patch.paper
+            if (next !== undefined) n.paper = next
+          }
           return n
         })
       }
@@ -510,6 +667,54 @@ export function apply(ctx) {
       leanCommand: 'lean',
       leanArgs: [],
       leanTimeoutMs: 120000,
+      // leanAsync: compile on a per-session background queue (default) instead of blocking the
+      // member's turn. `false` restores the previous synchronous `await` verbatim. Only
+      // `settled(ok)` (exit 0 AND the file's content hash unchanged) may mark an object
+      // `passed`; every other ending stays `attempted`.
+      leanAsync: true,
+      // leanInitiative: how EAGER the staff are about formalizing during normal work, kept
+      // separate from `formalVerify` (which only expresses the VERDICT-time requirement).
+      // 'off' = no daily drive (formalize only when verification asks); 'normal' (default) =
+      // today's behaviour (the reminder rides with formalVerify); 'eager' = push valuable small
+      // lemmas/propositions/definitions into the library even in daily rounds.
+      leanInitiative: 'normal',
+      // leanSearchPaths: extra `--search-path` roots injected BEFORE the automatic VibeMath
+      // root (deduped; an explicit --search-path/-R/--root in leanArgs wins).
+      leanSearchPaths: [],
+      // leanJobsMaxParallel: how many background compiles may run at once (default 1 = serial).
+      leanJobsMaxParallel: 1,
+      // ── math_computation (docs/math-computation.md; the shared module owns the semantics) ──
+      // mathComputation    — 'off' | 'auto' (default) | 'on': whether the tool is available
+      // mathMode           — 'typed+shell' (default: the host shell may be used as an unarchived
+      //                      fallback) | 'typed' (never mention the shell; engine='cli' refused)
+      // mathEngines        — allowed engine names (cli is ON by default; drop it to disable)
+      // mathTimeoutMs      — per-run budget (>=1000)
+      // mathPackages       — packages/toolboxes a computation may require
+      // mathInstallScope   — 'user' (default) | 'system' (per call only, never remembered)
+      // NOTE: the DEFAULTS come from the shared module so all four presets are byte-comparable;
+      // the arrays are COPIED (the module's defaults are frozen and must never be mutated).
+      mathComputation: MATH_PARAM_DEFAULTS.mathComputation,
+      mathMode: MATH_PARAM_DEFAULTS.mathMode,
+      mathEngines: MATH_PARAM_DEFAULTS.mathEngines.slice(),
+      mathTimeoutMs: MATH_PARAM_DEFAULTS.mathTimeoutMs,
+      mathPackages: MATH_PARAM_DEFAULTS.mathPackages.slice(),
+      mathInstallScope: MATH_PARAM_DEFAULTS.mathInstallScope,
+      // ── final paper (docs/final-paper.md; the phase runs BEFORE the completion flags) ──
+      // finalPaper        — write the final paper when the run concludes (manual /v5 paper
+      //                     still works when this is false, and says so).
+      // paperFormat       — 'both' | 'md' | 'tex'
+      // paperLanguage     — 'zh' | 'en'
+      // paperCompilePdf   — compile a PDF when a LaTeX engine is detected
+      // paperEditor       — 'academician' (default: the only editor reachable unattended) |
+      //                     'office' (manual /v5 paper only: the office must consult the
+      //                     institute first — messages + at least one meeting)
+      // paperLatexCommand — force ONE engine command instead of auto-detection ('' = auto)
+      finalPaper: true,
+      paperFormat: 'both',
+      paperLanguage: 'zh',
+      paperCompilePdf: true,
+      paperEditor: 'academician',
+      paperLatexCommand: '',
       // ── model / tools ────────────────────────────────────────────────────
       provider: '',
       model: '',
@@ -604,7 +809,17 @@ export function apply(ctx) {
     // i.e. the fallback would silently lose the whole institute across a restart.
     async function ready() {
       if (!backend) installBackend()
-      return await awaitBackendLoad()
+      await awaitBackendLoad()
+      // Crash recovery for the Lean queue runs ONCE per session, after the state file is
+      // folded in: a leftover Formal/Jobs/*.json is re-queued or explicitly interrupted, and
+      // is NEVER silently turned into `passed` (docs/formal-verification.md §7-7).
+      if (!leanRecoveryDone) {
+        try { await recoverLeanJobs() } catch (e) { console.error('vibe-math-v5: lean recovery: ' + String((e && e.message) || e)) }
+      }
+      // The math availability line is derived at session start (and on every tuning that
+      // touches the six math_* keys); `probeMathEngines` caches per host, so this is cheap.
+      try { await refreshMathLine() } catch (e) { console.error('vibe-math-v5: math probe: ' + String((e && e.message) || e)) }
+      return true
     }
     // Load the CURRENT state path before its first read. `state()` is synchronous by design
     // (the whole fold is read through it), so it kicks the load off eagerly; the caller that
@@ -671,7 +886,14 @@ export function apply(ctx) {
       const cur = stateCache.institutes[key]
       if (cur) {
         phase = cur.phase || phase
-        params = Object.assign({}, DEFAULT_PARAMS, cur.params || {})
+        // Restored params must go through the SAME normalisation as `vibe_v5_set`: a hand-edited
+        // or foreign-shaped state file (e.g. mathEngines as a comma STRING, a bogus enum, a
+        // sub-1000 timeout) would otherwise reach `visibleParams()` and v5's own
+        // `String(params.mathComputation/mathMode)` reads verbatim — the tool path is protected
+        // by the module's `effectiveMathParams`, the operator surface was not.
+        const droppedLoad = []
+        params = Object.assign({}, DEFAULT_PARAMS, normalizeParams(cur.params || {}, droppedLoad))
+        reportDroppedStateKeys(cur, droppedLoad, 'restore-load')
         project = cur.project || project
         instituteName = cur.institute || instituteName
       }
@@ -1094,6 +1316,9 @@ export function apply(ctx) {
         b.push('[形式化] ' + (formalMode() === 'require' ? '强制' : '鼓励') + ' Lean｜已通过 ' + passed
           + '｜已记录阻塞 ' + blocked + (formalTodo().length ? '｜形式化待办 ' + formalTodo().length + ' 项（见 Formal/TODO.md）' : ''))
       }
+      // Settled async compiles are announced EXACTLY ONCE, in the member's next prompt
+      // (docs/formal-verification.md §2.4: the announcement point is the next prompt).
+      for (const line of takeLeanNoticesFor(member.id)) b.push(line)
       const tasks = inst().tasks.filter((t) => t.status !== 'deleted')
       const mine = tasks.filter((t) => t.ownerId === member.id && t.status === 'in_progress')
       const ready = tasks.filter((t) => t.status === 'pending' && taskReady(t))
@@ -1185,7 +1410,7 @@ export function apply(ctx) {
     // directory is what actually creates the tree — inside the policy.
     async function mkdirs() {
       const base = instRoot()
-      const dirs = ['Shared/Chat', 'Shared/Meetings', 'Shared/Debates', 'State', 'Problems', 'Formal', 'Verified/Lean']
+      const dirs = ['Shared/Chat', 'Shared/Meetings', 'Shared/Debates', 'State', 'Problems', 'Formal', 'Formal/Jobs', 'Verified/Lean', 'Computation']
       // The REUSABLE Lean library is global (cross-project), so it hangs off the VibeMath
       // root rather than the institute root — creating it under instRoot would scatter a
       // second, invisible copy per institute.
@@ -1248,6 +1473,10 @@ export function apply(ctx) {
       }
       counters.message = n
       await putCounters(counters)
+      // The office talking to the institute is HALF of the `paperEditor='office'` consultation
+      // requirement; counting it here (the one place a message really is queued) means the gate
+      // cannot be satisfied by merely intending to consult (docs/final-paper.md §7).
+      if (from === 'office') await notePaperConsult('message')
       notifyActivity()
       // Kick one scheduling pass so an ADDRESSED message (dm/office/assign) wakes its
       // recipient promptly instead of waiting for the digest window. Plain chat stays
@@ -1679,6 +1908,7 @@ export function apply(ctx) {
       L.push('')
       if (initialTask) { L.push(resume ? '恢复说明：' : '你的初始任务/用途：'); L.push('  ' + initialTask); L.push('') }
       if (member.direction && !resume) { L.push('给你的起点方向：' + member.direction); L.push('') }
+      mathPushLine(L)
       L.push('------------')
       L.push(stateBlock(member))
       L.push('------------')
@@ -1696,7 +1926,8 @@ export function apply(ctx) {
         L.push('作为院士，除了做研究，你还要**统筹全所**：用 vibe_v5_overview 看清谁在做什么、')
         L.push('哪里是瓶颈；把工作拆成任务并用 vibe_v5_assign 分派；必要时用 vibe_v5_nudge 督办。')
       }
-      if (formalOn()) { L.push(''); L.push(formalWorkLine()) }
+      if (leanDailyOn()) { L.push(''); L.push(formalWorkLine()) }
+      mathPushLine(L)
       L.push('')
       L.push('------------')
       L.push(stateBlock(member))
@@ -1712,7 +1943,8 @@ export function apply(ctx) {
       L.push('读一读同事的库、推进你的子问题/引理/方法、尝试一条新路线；')
       L.push('或者向团队发消息（say）、开一个议题（propose_meeting）、给某个方向开任务（task_create）。')
       L.push('如果你确实已无路可走或认为原问题接近解决，请说明你的判断与理由。')
-      if (formalOn()) { L.push(''); L.push(formalWorkLine()) }
+      if (leanDailyOn()) { L.push(''); L.push(formalWorkLine()) }
+      mathPushLine(L)
       L.push('')
       L.push('------------')
       L.push(stateBlock(member))
@@ -1739,6 +1971,7 @@ export function apply(ctx) {
       L.push('（会议轮请把你的发言同时填进 JSON 的 "input" 字段，框架据此写会议纪要。）')
       L.push('如果你认为原问题已解决，请填 "vote_solved": true —— 只有当**全体有表决权者**都')
       L.push('一致认为是真时，本所才会停下来。')
+      mathPushLine(L)
       L.push('')
       L.push('------------')
       L.push(stateBlock(member))
@@ -1783,6 +2016,7 @@ export function apply(ctx) {
       }
       L.push('**不要为了配合别人而改票，也不要为了让流程往前走而给出你不相信的 1 或 0。**')
       L.push('本所宁可留下未定论，也不要一个骗人的结论。')
+      mathPushLine(L)
       L.push('')
       L.push('------------')
       L.push(stateBlock(member))
@@ -1818,6 +2052,9 @@ export function apply(ctx) {
       const delay = posMs(ms, posMs(params.activityTimeoutMs, 120000))
       heartbeatDisposer = ctx.timeout(() => {
         heartbeatDisposer = null
+        // Drain the Lean compile queue FIRST: it is independent of the scheduler and must run
+        // even when the pass below decides there is nothing to do (docs/formal-verification.md §7).
+        runLeanQueue().catch((e) => console.error('vibe-math-v5: lean queue: ' + String((e && e.message) || e)))
         scheduleNext().catch((e) => console.error('vibe-math-v5: heartbeat: ' + String((e && e.message) || e)))
       }, delay)
     }
@@ -1878,6 +2115,12 @@ export function apply(ctx) {
     const FORMAL_MODES = ['off', 'encourage', 'require']
     const formalMode = () => (FORMAL_MODES.indexOf(String(params.formalVerify)) !== -1 ? String(params.formalVerify) : 'off')
     const formalOn = () => formalMode() !== 'off'
+    // `leanInitiative` is SEPARATE from `formalVerify`: the latter only says how strong the
+    // requirement is AT VERDICT TIME, this says how eager the staff should be about formalizing
+    // during ordinary work. 'off' suppresses the daily reminder; 'eager' adds it even when
+    // `formalVerify` is off; 'normal' keeps today's rule (the reminder rides with formalVerify).
+    const leanInitiative = () => (['off', 'normal', 'eager'].indexOf(String(params.leanInitiative)) !== -1 ? String(params.leanInitiative) : 'normal')
+    const leanDailyOn = () => leanInitiative() !== 'off' && (formalOn() || leanInitiative() === 'eager')
     const formalRoot = () => instRoot() + '/Formal'
     const formalLibRoot = () => vibeRoot() + '/Formal/Lib'
     const formalProvedRoot = () => vibeRoot() + '/Formal/Proved'
@@ -1932,7 +2175,10 @@ export function apply(ctx) {
 
     // Run the toolchain on one file. NEVER throws into the scheduler: every failure mode
     // (no service, no executable, timeout, non-zero exit) becomes a readable result.
-    async function leanRunFile(relPath, timeoutMs) {
+    // `hooks.onHandle(handle)` (optional) hands the live process to the caller so a session
+    // dispose can terminate it; it is a hook rather than a return value because the run must
+    // stay a single awaitable result.
+    async function leanRunFile(relPath, timeoutMs, hooks) {
       const started = now()
       const rel = String(relPath || '').trim()
       if (!rel) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'file is required' }
@@ -1955,7 +2201,8 @@ export function apply(ctx) {
       } catch (e) {
         return { ok: false, code: 'LEAN_NOT_FOUND', message: 'cannot resolve "' + String(params.leanCommand || 'lean') + '": ' + String((e && e.message) || e) + ' — 仍可把形式化代码写下来归档，但无法在此宿主上执行', file: rel, ms: now() - started }
       }
-      const argv = [exe].concat((Array.isArray(params.leanArgs) ? params.leanArgs : []).map(String)).concat([abs])
+      const pfx = await leanRunPrefix()
+      const argv = [exe].concat(pfx.prefix.slice(1), [abs])
       let handle
       try {
         handle = sub.spawn({
@@ -1964,6 +2211,11 @@ export function apply(ctx) {
           stdio: { stdin: 'ignore', stdout: { maxBytes: 64 * 1024 }, stderr: { maxBytes: 64 * 1024 } },
           graceMs: cap,
         })
+        // Hand the live process to the async queue (session dispose terminates it) and the
+        // NORMALISED build prefix (engine + args + search paths, no file) to the settle check —
+        // a job may only settle the build context it was queued under.
+        if (hooks && typeof hooks.onHandle === 'function') hooks.onHandle(handle)
+        if (hooks && typeof hooks.onBuildPrefix === 'function') hooks.onBuildPrefix(pfx.prefix)
       } catch (e) {
         return { ok: false, code: 'LEAN_SPAWN_FAILED', message: String((e && e.message) || e), file: rel, ms: now() - started }
       }
@@ -2091,6 +2343,608 @@ export function apply(ctx) {
         + ' —— 已撤回「已通过」状态' + (removed ? '，并已使 Verified/Lean/ 中的归档证明失效（删除或覆盖为撤回声明）' : '') + '；请修正形式化、重新跑通后再投票。' + stillThere.join(''))
       return { ok: true, target: t, status: 'attempted', removed }
     }
+    // ================= async Lean compile queue (docs/formal-verification.md §7) ==========
+    // ONE compile at a time, per session. A tool call ENQUEUES and returns immediately; the
+    // queue is drained by the existing heartbeat (`armHeartbeat`) and by a 0ms kick armed at
+    // enqueue time, so a paused or concluded institute still drains what it accepted. Every job
+    // is mirrored to Formal/Jobs/<jobId>.json for crash recovery and for `lean_lib.jobs`.
+    // ONLY `settled(ok)` — exit 0 AND the file's content hash unchanged — may mark an object
+    // `passed` and write Verified/Lean/<id>.lean; every other ending stays `attempted`.
+    const leanJobs = new Map()
+    const leanActive = new Map()      // jobId -> { job, handle } (up to leanJobsMaxParallel)
+    let leanActiveJob = null          // the MOST RECENTLY started job (prompt/dispose reporting)
+    let leanActiveHandle = null
+    let leanDrainTimer = null
+    let leanRecoveryDone = false
+    let leanDisposed = false
+    const leanNotices = []            // settled results not yet announced to a member
+    function leanJobsMax() { return Math.max(1, Math.floor(Number(params.leanJobsMaxParallel) || 1)) }
+    function leanJobRel(jobId) { return 'Formal/Jobs/' + jobId + '.json' }
+    async function leanWriteJob(job) {
+      try { await writeTextRel(leanJobRel(job.jobId), JSON.stringify(job, null, 2) + '\n') } catch (e) { /* best effort */ }
+    }
+    async function leanReadJobMirror(jobId) {
+      try { return JSON.parse((await readTextRel(leanJobRel(jobId))) || 'null') } catch (e) { return null }
+    }
+    function leanJobMirrorSettled(rec) { return !!rec && rec.state === 'settled' && Number(rec.exitCode) === 0 }
+    // Has this EXACT library content already been compiled successfully? The job id digests the
+    // build context, so the check looks at the jobs rather than reconstructing an id: first the
+    // in-memory queue, then the durable mirrors in Formal/Jobs/.
+    async function leanLibArchivedOk(name, sha) {
+      for (const j of leanJobs.values()) {
+        if (j.kind === 'lib' && j.name === name && j.contentSha256 === sha && leanJobMirrorSettled(j)) return true
+      }
+      try {
+        const t = await fs.resolve(instRoot() + '/Formal/Jobs')
+        if (await fs.stat(t) !== undefined) {
+          for (const e of (await fs.listDir(t)) || []) {
+            if (!e || e.type !== 'file' || !/\.json$/.test(String(e.name))) continue
+            const rec = await leanReadJobMirror(String(e.name).replace(/\.json$/, ''))
+            if (rec && rec.kind === 'lib' && rec.name === name && rec.contentSha256 === sha && leanJobMirrorSettled(rec)) return true
+          }
+        }
+      } catch (e) { /* best effort: no mirror ⇒ no dedupe */ }
+      return false
+    }
+    function leanJobsView() {
+      return Array.from(leanJobs.values())
+        .sort((a, b) => (a.enqueuedAt || 0) - (b.enqueuedAt || 0))
+        .map((j) => ({ jobId: j.jobId, state: j.state, rel: j.file || j.rel || '', target: j.target || j.name || '', attempts: j.attempts || 1, settledAt: j.settledAt || 0 }))
+    }
+    function leanNextQueued() {
+      let best = null
+      for (const j of leanJobs.values()) if (j.state === 'queued' && (!best || (j.enqueuedAt || 0) < (best.enqueuedAt || 0))) best = j
+      return best
+    }
+    // The absolute VibeMath root handed to `--search-path` (the compile runs with cwd=instRoot()).
+    function leanSearchRootView() { return vibeRoot().replace(/\\/g, '/') }
+    async function leanSearchRoot() {
+      const root = vibeRoot()
+      if (root.charAt(0) === '/' || /^[a-z]:/i.test(root)) return root.replace(/\\/g, '/')
+      try {
+        const t = await fs.resolve(root)
+        const s = typeof t === 'string' ? t : String((t && (t.targetKey || t.displayPath)) || root)
+        return String(s).replace(/\\/g, '/')
+      } catch (e) { return root.replace(/\\/g, '/') }
+    }
+    async function leanHashFile(rel) {
+      const abs = leanAbsPath(rel)
+      if (abs === null) return undefined
+      const txt = await readTextAbs(abs)
+      return txt === undefined ? undefined : sha256Hex(leanHashText(txt))
+    }
+    function leanJobId(key, sha) {
+      // `sha` is the BUILD digest: content + engine + normalised argv + search paths, so the
+      // same text compiled under different flags gets a different job (amendment §4).
+      return String(key) + '-' + String(sha || '').slice(0, 12)
+    }
+    // The NORMALISED build prefix (engine + user args + injected search flags, WITHOUT the file
+    // name). It is what the job id digests and what the settle re-checks.
+    async function leanRunPrefix() {
+      const userArgs = (Array.isArray(params.leanArgs) ? params.leanArgs : []).map(String)
+      const engine = String(params.leanCommand || 'lean')
+      const searchList = await leanInjectedSearchList(userArgs)
+      const searchArgs = []
+      for (const p of searchList) searchArgs.push(LEAN_SEARCH_PATH_FLAG, p)
+      return { engine, userArgs, searchList, searchArgs, prefix: [engine].concat(userArgs, searchArgs) }
+    }
+    // leanSearchPaths FIRST (the order the user gave), then the automatic VibeMath root; deduped;
+    // empty when leanArgs already carries an explicit search flag (explicit override wins).
+    async function leanInjectedSearchList(userArgs) {
+      if (leanHasSearchFlag(userArgs)) return []
+      const extra = (Array.isArray(params.leanSearchPaths) ? params.leanSearchPaths : [])
+        .map((s) => String(s == null ? '' : s).trim()).filter(Boolean)
+      const root = await leanSearchRoot()
+      return Array.from(new Set(extra.concat([root])))
+    }
+    function leanBuildDigest(contentText, prefix) {
+      return sha256Hex(leanHashText(String(contentText == null ? '' : contentText)) + '|' + JSON.stringify((prefix || []).map(String)))
+    }
+    function leanBuildHash(prefix) { return sha256Hex(JSON.stringify((prefix || []).map(String))) }
+    function armLeanDrain(ms) {
+      if (leanDisposed || leanDrainTimer) return
+      // `posMs` treats 0 as "use the default" (120s!), which would stall the queue: the kick
+      // must be an IMMEDIATE next-tick timer.
+      const delay = (typeof ms === 'number' && ms > 0) ? Math.floor(ms) : 0
+      leanDrainTimer = ctx.timeout(() => {
+        leanDrainTimer = null
+        runLeanQueue().catch((e) => console.error('vibe-math-v5: lean queue: ' + String((e && e.message) || e)))
+      }, delay)
+    }
+    function clearLeanDrain() { if (leanDrainTimer) { try { leanDrainTimer() } catch (e) { /* ignore */ } leanDrainTimer = null } }
+    // The toolchain probe shared by the enqueue path: a host with no subprocess service — or no
+    // reachable executable — must keep today's honest NO_SUBPROCESS / LEAN_NOT_FOUND behaviour
+    // rather than queueing a job that can never settle.
+    async function leanPrecheck(relPath) {
+      const rel = String(relPath == null ? '' : relPath).trim()
+      if (!rel) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'file is required' }
+      const abs = leanAbsPath(rel)
+      if (abs === null) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'Lean file must live under ' + vibeRoot().replace(/\\/g, '/') + '/ (got ' + rel + ')' }
+      if (!/\.lean$/.test(abs)) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'only .lean files can be executed' }
+      if (await readTextAbs(abs) === undefined) return { ok: false, code: 'V5_NOT_FOUND', message: 'no such file: ' + rel }
+      const sub = subprocessOf()
+      if (sub === undefined || typeof sub.spawn !== 'function') {
+        return { ok: false, code: 'NO_SUBPROCESS', message: 'the host exposes no subprocess service; Lean cannot be executed here', file: rel }
+      }
+      try { await sub.resolveExecutable(String(params.leanCommand || 'lean')) } catch (e) {
+        return { ok: false, code: 'LEAN_NOT_FOUND', message: 'cannot resolve "' + String(params.leanCommand || 'lean') + '": ' + String((e && e.message) || e) + ' — 仍可把形式化代码写下来归档，但无法在此宿主上执行', file: rel }
+      }
+      return { ok: true, rel, abs }
+    }
+    async function enqueueLeanJob(spec) {
+      const job = Object.assign({}, spec, {
+        state: 'queued', attempts: 0, enqueuedAt: now(), startedAt: 0, settledAt: 0,
+        exitCode: null, ok: false, timedOut: false, interrupted: false,
+      })
+      leanJobs.set(job.jobId, job)
+      await leanWriteJob(job)
+      // Kick on a LATER tick: the tool must return before any compiler process starts.
+      armLeanDrain()
+      return job
+    }
+    async function runLeanQueue() {
+      let started = false
+      // Up to leanJobsMaxParallel compiles at once (default 1 = strictly serial). Each job runs
+      // to completion in the background; its own settle re-arms the queue.
+      while (leanActive.size < leanJobsMax()) {
+        const job = leanNextQueued()
+        if (!job) break
+        started = true
+        const slot = { job, handle: null }
+        leanActive.set(job.jobId, slot)
+        runLeanJob(job, slot)
+          .catch((e) => console.error('vibe-math-v5: lean job ' + job.jobId + ': ' + String((e && e.message) || e)))
+          .finally(() => {
+            leanActive.delete(job.jobId)
+            if (leanActiveJob === job) { leanActiveJob = null; leanActiveHandle = null }
+            if (leanNextQueued()) armLeanDrain()
+          })
+      }
+      return started
+    }
+    async function runLeanJob(job, slot) {
+      leanActiveJob = job
+      leanActiveHandle = null
+      job.state = 'running'
+      job.startedAt = now()
+      job.attempts = (Number(job.attempts) || 0) + 1
+      await leanWriteJob(job)
+      let run = null
+      let actualPrefix = null
+      try {
+        run = await leanRunFile(job.rel, job.timeoutMs, {
+          onHandle: (h) => { if (slot) slot.handle = h; if (leanActiveJob === job) leanActiveHandle = h },
+          onBuildPrefix: (p) => { actualPrefix = p },
+        })
+      } catch (e) {
+        run = { ok: false, code: 'LEAN_RUN_FAILED', message: String((e && e.message) || e), file: job.rel, ms: 0 }
+      }
+      const hashNow = await leanHashFile(job.rel)
+      const hashMatched = hashNow !== undefined && hashNow === job.contentSha256
+      // The build context must be the one the job was QUEUED under: args/search paths may have
+      // been retuned while it waited, and a compile under different flags settles nothing.
+      const buildMatched = !!actualPrefix && leanBuildHash(actualPrefix) === job.buildHash
+      const settledOk = !!run.ok && hashMatched && buildMatched
+      job.exitCode = run.exitCode === undefined ? null : run.exitCode
+      job.ok = settledOk
+      job.timedOut = !!run.timedOut
+      job.buildMatched = buildMatched
+      job.settledAt = now()
+      job.state = settledOk ? 'settled' : (job.interrupted === true ? 'interrupted' : (job.timedOut ? 'timeout' : 'failed'))
+      job.run = {
+        at: job.settledAt, ok: !!job.ok, exitCode: job.exitCode, ms: run.ms || 0,
+        timedOut: !!job.timedOut, interrupted: !!job.interrupted, buildMatched,
+        stderrTail: tail(run.stderr || (buildMatched ? '' : '构建上下文已改变（leanArgs/搜索路径在入队后被修改），本次结果不用于判定'), 800),
+      }
+      try { await leanApplySettle(job, run, settledOk, hashMatched && buildMatched) } catch (e) { console.error('vibe-math-v5: lean settle ' + job.jobId + ': ' + String((e && e.message) || e)) }
+      await leanWriteJob(job)
+      leanQueueNotice(job, run, hashMatched && buildMatched)
+    }
+    // The ONE place a job's outcome reaches the state — and the ONLY place an object may become
+    // `passed` from a compile (proof jobs, and only when settledOk).
+    async function leanApplySettle(job, run, settledOk, hashMatched) {
+      const asyncRec = {
+        jobId: job.jobId, state: job.state, attempts: job.attempts || 1,
+        enqueuedAt: job.enqueuedAt || 0, startedAt: job.startedAt || 0, settledAt: job.settledAt || 0,
+        exitCode: job.exitCode === undefined ? null : job.exitCode,
+      }
+      const target = idSafe(String(job.target || job.name || ''))
+      if (job.kind === 'proof') {
+        if (!target) return
+        const prev = formalOf(target)
+        const stale = hashMatched ? '' : '（异步落地：编译完成后文件内容已改变，本次结果不用于判定）'
+        const rec = Object.assign({}, prev, {
+          status: settledOk ? 'passed' : 'attempted',
+          file: job.rel,
+          proof: settledOk ? 'Verified/Lean/' + target + '.lean' : '',
+          decision: 'used',
+          note: (String(prev.note || '') + stale).trim(),
+          run: job.run, async: asyncRec, updatedAt: now(),
+        })
+        if (settledOk) await writeTextRel('Verified/Lean/' + target + '.lean', String(job.content == null ? '' : job.content))
+        await putFormal(target, rec)
+        await rebuildLeanLibIndexes()
+        await saveChatLine('【形式化】' + (job.member || '成员') + ' 的后台作业 ' + job.jobId + ' 落地：' + target + ' → ' + rec.status
+          + (settledOk ? '（已归档 ' + rec.proof + '，验证转为忠实性审查）' : '（未通过：' + tail(run.stderr || run.message, 160) + '）'))
+        return
+      }
+      if (job.kind === 'lib') {
+        if (target) {
+          const prev = formalOf(target)
+          await putFormal(target, Object.assign({}, prev, { file: job.file || prev.file || '', run: job.run, async: asyncRec, updatedAt: now() }))
+        }
+        await rebuildLeanLibIndexes()
+        await saveChatLine('【形式化】' + (job.member || '成员') + ' 的后台作业 ' + job.jobId + ' 落地：' + (job.file || job.rel) + ' → ' + (settledOk ? '通过' : '未通过')
+          + (settledOk ? '' : '（' + tail(run.stderr || run.message, 160) + '）'))
+        return
+      }
+      if (target) {
+        await formalSetRun(target, run)
+        const rec = formalOf(target)
+        await putFormal(target, Object.assign({}, rec, { async: asyncRec, updatedAt: now() }))
+      }
+      await writeFormalIndex()
+      await saveChatLine('【形式化】' + (job.member || '成员') + ' 的后台作业 ' + job.jobId + ' 落地：' + (job.file || job.rel) + ' → ' + (settledOk ? '通过' : '未通过')
+        + (settledOk ? '' : '（' + tail(run.stderr || run.message, 160) + '）'))
+    }
+    function leanQueueNotice(job, run, hashMatched) {
+      const secs = ((run && run.ms) || 0) / 1000
+      let line
+      if (job.state === 'settled') line = '【形式化结果】' + job.jobId + '：通过（exit 0，' + secs.toFixed(1) + 's' + (job.kind === 'proof' ? '，已归档 Verified/Lean/' + job.target + '.lean' : '') + '）'
+      else if (job.state === 'timeout') line = '【形式化结果】' + job.jobId + '：超时（leanTimeoutMs=' + posMs(params.leanTimeoutMs, 120000) + ' 已 terminate）'
+      else if (job.state === 'interrupted') line = '【形式化结果】' + job.jobId + '：中断（会话卸载或崩溃，已标记 attempted，可重跑）'
+      else line = '【形式化结果】' + job.jobId + '：失败（exit ' + job.exitCode + (hashMatched ? '' : '；文件内容已变，结果不可用') + '，见 stderr 尾部）'
+      leanNotices.push({ member: String(job.member || ''), jobId: job.jobId, line, at: now() })
+      while (leanNotices.length > 20) leanNotices.shift()
+    }
+    // ONE-SHOT: a member sees each settled result exactly once, in its next round prompt
+    // (the "announcement point is the next prompt" discipline).
+    function takeLeanNoticesFor(memberId) {
+      if (!leanNotices.length) return []
+      const mine = leanNotices.filter((n) => n.member === memberId)
+      if (!mine.length) return []
+      for (const n of mine) { const i = leanNotices.indexOf(n); if (i !== -1) leanNotices.splice(i, 1) }
+      return mine.map((n) => n.line)
+    }
+    // Crash recovery: an object is NEVER silently verified. Only a job record that says
+    // exitCode 0 AND whose content hash still matches may补 the archive; everything else is
+    // downgraded to `attempted` (or re-queued when the interrupted run is safe to retry).
+    async function leanMarkAttempted(rec, why) {
+      const target = idSafe(String(rec.target || ''))
+      if (!target) return
+      const prev = formalOf(target)
+      const sameJob = !!(prev && prev.async && prev.async.jobId === rec.jobId)
+      if (!sameJob && prev.status === 'passed') return       // never downgrade a newer pass
+      if (!sameJob && rec.kind !== 'proof') return
+      const note = String(prev.note || '')
+      await putFormal(target, Object.assign({}, prev, {
+        status: prev.status === 'blocked' ? 'blocked' : 'attempted',
+        proof: rec.kind === 'proof' ? '' : prev.proof,
+        async: { jobId: rec.jobId, state: 'interrupted', attempts: Number(rec.attempts) || 1, enqueuedAt: rec.enqueuedAt || 0, startedAt: rec.startedAt || 0, settledAt: now(), exitCode: rec.exitCode === undefined ? null : rec.exitCode },
+        note: (note.indexOf(why) === -1 ? (note + (note ? ' ' : '') + '（' + why + '）') : note).trim(),
+        updatedAt: now(),
+      }))
+      await writeFormalIndex()
+    }
+    async function leanApplyRecovered(rec) {
+      const target = idSafe(String(rec.target || ''))
+      const asyncRec = { jobId: rec.jobId, state: 'settled', attempts: Number(rec.attempts) || 1, enqueuedAt: rec.enqueuedAt || 0, startedAt: rec.startedAt || 0, settledAt: rec.settledAt || now(), exitCode: 0 }
+      if (rec.kind === 'proof' && target) {
+        const prev = formalOf(target)
+        await writeTextRel('Verified/Lean/' + target + '.lean', String(rec.content == null ? '' : rec.content))
+        await putFormal(target, Object.assign({}, prev, {
+          status: 'passed', file: rec.rel, proof: 'Verified/Lean/' + target + '.lean', decision: 'used',
+          run: Object.assign({}, rec.run || {}, { ok: true, exitCode: 0 }), async: asyncRec, updatedAt: now(),
+        }))
+        await rebuildLeanLibIndexes()
+        return true
+      }
+      if (target) {
+        const prev = formalOf(target)
+        await putFormal(target, Object.assign({}, prev, { run: Object.assign({}, rec.run || {}, { ok: true, exitCode: 0 }), async: asyncRec, updatedAt: now() }))
+      }
+      await rebuildLeanLibIndexes()
+      return true
+    }
+    async function recoverLeanJobs() {
+      if (leanRecoveryDone) return { scanned: 0, requeued: 0, attempted: 0 }
+      leanRecoveryDone = true
+      let entries = []
+      try {
+        const t = await fs.resolve(instRoot() + '/Formal/Jobs')
+        if (await fs.stat(t) !== undefined) entries = await fs.listDir(t)
+      } catch (e) { return { scanned: 0, requeued: 0, attempted: 0 } }
+      let scanned = 0, requeued = 0, attempted = 0
+      for (const e of entries || []) {
+        if (!e || e.type !== 'file' || !/\.json$/.test(String(e.name))) continue
+        const jobId = String(e.name).replace(/\.json$/, '')
+        const rec = await leanReadJobMirror(jobId)
+        if (!rec || !rec.jobId || !rec.rel) continue
+        scanned++
+        const hashNow = await leanHashFile(rec.rel)
+        const matched = hashNow !== undefined && hashNow === rec.contentSha256
+        if (rec.state === 'queued') {
+          rec.attempts = Number(rec.attempts) || 0
+          leanJobs.set(rec.jobId, rec)
+          requeued++
+          await saveChatLine('【形式化·恢复】后台作业 ' + rec.jobId + ' 从未开始，已重新入队。')
+          continue
+        }
+        if (rec.state === 'running' || rec.state === 'interrupted') {
+          rec.interrupted = true
+          await leanMarkAttempted(rec, matched ? '崩溃恢复：上一次运行的结果不可知' : '崩溃恢复：运行期间文件已被改写')
+          attempted++
+          if (matched) {
+            rec.state = 'queued'
+            rec.startedAt = 0
+            leanJobs.set(rec.jobId, rec)
+            requeued++
+            await saveChatLine('【形式化·恢复】后台作业 ' + rec.jobId + ' 中断且内容未变：已以新 attempts 重新入队（旧结果不可知）。')
+          } else {
+            rec.state = 'failed'
+            await leanWriteJob(rec)
+            await saveChatLine('【形式化·恢复】后台作业 ' + rec.jobId + ' 运行期间文件已被改写：**不自动重驱**，请手动重跑（对象保持 attempted）。')
+          }
+          continue
+        }
+        if (leanJobMirrorSettled(rec) && matched) {
+          await leanApplyRecovered(rec)
+          await saveChatLine('【形式化·恢复】后台作业 ' + rec.jobId + ' 已通过且内容未变：按作业记录补齐归档与 passed。')
+        } else {
+          await leanMarkAttempted(rec, '崩溃恢复：作业未通过或内容已变')
+          attempted++
+        }
+      }
+      if (leanNextQueued()) armLeanDrain()
+      return { scanned, requeued, attempted }
+    }
+    function leanJobView(job) {
+      if (!job) return null
+      return {
+        jobId: job.jobId, state: job.state, kind: job.kind || 'run',
+        file: job.file || job.rel || '', rel: job.rel || '', target: job.target || job.name || '',
+        attempts: job.attempts || 1, exitCode: job.exitCode === undefined ? null : job.exitCode,
+        ok: job.ok === true, timedOut: !!job.timedOut, interrupted: !!job.interrupted,
+        buildMatched: job.buildMatched !== false,
+        enqueuedAt: job.enqueuedAt || 0, startedAt: job.startedAt || 0, settledAt: job.settledAt || 0,
+        jobFile: leanJobRel(job.jobId),
+        proof: job.kind === 'proof' && job.ok === true ? 'Verified/Lean/' + job.target + '.lean' : '',
+        stderrTail: (job.run && job.run.stderrTail) || '',
+      }
+    }
+    // `lean_job {jobId?, waitMs?}` — the WAIT path for a background compile. It polls the queue
+    // itself (bounded by waitMs) and never touches the heartbeat; with no jobId it lists this
+    // session's jobs. Returns the CURRENT state on timeout rather than throwing.
+    async function leanJobTool(o) {
+      const args = o || {}
+      const jobId = String(args.jobId || '').trim()
+      const waitMs = Math.max(0, Math.min(600000, Math.floor(Number(args.waitMs) || 0)))
+      if (!jobId) return { ok: true, jobs: leanJobsView(), count: leanJobs.size, running: leanActive.size, maxParallel: leanJobsMax() }
+      let job = leanJobs.get(jobId) || await leanReadJobMirror(jobId)
+      if (!job) return { ok: false, code: 'V5_NOT_FOUND', message: 'no such job ' + jobId, jobs: leanJobsView() }
+      const deadline = now() + waitMs
+      let waitedMs = 0
+      while (waitMs > 0 && (job.state === 'queued' || job.state === 'running') && now() < deadline) {
+        const t0 = now()
+        try { await runLeanQueue() } catch (e) { console.error('vibe-math-v5: lean wait: ' + String((e && e.message) || e)) }
+        if (job.state === 'queued' || job.state === 'running') {
+          await new Promise((resolve) => { ctx.timeout(() => resolve(true), Math.min(25, waitMs)) })
+        }
+        waitedMs += now() - t0
+        job = leanJobs.get(jobId) || await leanReadJobMirror(jobId) || job
+      }
+      return { ok: true, job: leanJobView(job), waitedMs, timedOut: job.state === 'queued' || job.state === 'running' }
+    }
+    // Session dispose: terminate EVERY in-flight compile and mark it `interrupted` — never passed.
+    function disposeLeanJobs() {
+      leanDisposed = true
+      clearLeanDrain()
+      const jobs = []
+      for (const slot of leanActive.values()) {
+        const job = slot && slot.job
+        if (job) { job.interrupted = true; job.state = 'interrupted'; job.settledAt = now(); jobs.push(job) }
+        if (slot && slot.handle && typeof slot.handle.terminate === 'function') {
+          try { slot.handle.terminate() } catch (e) { /* best effort */ }
+        }
+      }
+      if (leanActiveHandle && typeof leanActiveHandle.terminate === 'function') {
+        try { leanActiveHandle.terminate() } catch (e) { /* best effort */ }
+      }
+      for (const job of jobs) {
+        leanWriteJob(job).catch(() => {})
+        leanQueueNotice(job, { ms: now() - (job.startedAt || now()) }, true)
+      }
+      return { terminated: jobs.length }
+    }
+    try { leanDisposers.add(disposeLeanJobs) } catch (e) { /* host without the disposer set */ }
+
+    // ============ math_computation seam (docs/math-computation.md) ============
+    // The shared module (`./math-computation.js`) owns detection/argv/receipts/install; this
+    // preset owns the HOST side. Every path the module hands over is institute-relative, and it
+    // is re-guarded here (defence in depth): a '../' path can never escape the institute even if
+    // the module's own guard regresses.
+    function mathRelPath(rel) {
+      const raw = String(rel == null ? '' : rel).trim().replace(/\\/g, '/')
+      if (!raw || raw.charAt(0) === '/' || /^[a-z]:/i.test(raw)) return null
+      const parts = []
+      for (const seg of raw.split('/')) {
+        if (!seg || seg === '.') continue
+        if (seg === '..') { if (!parts.length) return null; parts.pop(); continue }
+        parts.push(seg)
+      }
+      return parts.length ? parts.join('/') : null
+    }
+    async function mathWriteRel(rel, text) {
+      const r = mathRelPath(rel)
+      if (r === null) return false
+      return await writeTextRel(r, String(text == null ? '' : text))
+    }
+    async function mathReadRel(rel) {
+      const r = mathRelPath(rel)
+      if (r === null) return undefined
+      return await readTextRel(r)
+    }
+    async function mathExistsRel(rel) {
+      const r = mathRelPath(rel)
+      if (r === null) return false
+      try {
+        const t = await fs.resolve(instRoot() + '/' + r)
+        return (await fs.stat(t)) !== undefined
+      } catch (e) { return false }
+    }
+    // Optional host seam (P2a): the module uses it for the per-project retention cap. `''`/'.'
+    // means the project root itself.
+    async function mathListDirRel(rel) {
+      const raw = String(rel == null ? '' : rel).trim()
+      const r = raw === '' || raw === '.' ? '' : mathRelPath(raw)
+      if (r === null) return []
+      try {
+        const t = await fs.resolve(instRoot() + (r ? '/' + r : ''))
+        return (await fs.listDir(t)) || []
+      } catch (e) { return [] }
+    }
+    async function mathResolveExecutable(cmd) {
+      const sub = subprocessOf()
+      if (sub === undefined || typeof sub.resolveExecutable !== 'function') throw new Error('NO_SUBPROCESS: the host exposes no subprocess service')
+      const p = await sub.resolveExecutable(String(cmd))
+      if (typeof p === 'string' && p) return p
+      throw new Error('cannot resolve executable: ' + String(cmd))
+    }
+    // The module calls this with {argv, cwd, timeoutMs, stdoutCap, stderrCap} and expects the
+    // FULL captured output (it writes the complete text to disk and only truncates the RETURN
+    // shell itself, MATH_CAPS.stdout = 64KB) — so the stdio caps must be generous, never the
+    // return-shell size. A host without a subprocess service returns null instead of throwing:
+    // the module maps that to MATH_NO_SUBPROCESS (its `if (!r)` branch).
+    async function mathSpawn(opts) {
+      const o = opts || {}
+      const sub = subprocessOf()
+      if (sub === undefined || typeof sub.spawn !== 'function') return null
+      const argv = (o.argv || []).map(String)
+      if (!argv.length) return null
+      const started = now()
+      const cap = Math.max(1000, Math.floor(Number(o.timeoutMs) || Number(params.mathTimeoutMs) || 60000))
+      const outCap = Math.max(MATH_CAPS.stdout, Math.floor(Number(o.stdoutCap) || MATH_CAPS.file))
+      const errCap = Math.max(MATH_CAPS.stderr, Math.floor(Number(o.stderrCap) || MATH_CAPS.file))
+      let handle = null
+      try {
+        handle = sub.spawn({
+          argv,
+          cwd: String(o.cwd || instRoot()),
+          stdio: {
+            stdin: o.stdin === undefined ? 'ignore' : 'pipe',
+            stdout: { maxBytes: outCap },
+            stderr: { maxBytes: errCap },
+          },
+          graceMs: cap,
+        })
+      } catch (e) {
+        return { exit: null, timedOut: false, killed: false, ms: now() - started, stdout: '', stderr: String((e && e.message) || e) }
+      }
+      // A host whose spawn answers nothing usable (no service, refused, null handle) must reach
+      // the module's `if (!r)` branch as MATH_NO_SUBPROCESS instead of throwing here.
+      if (!handle) return null
+      if (o.stdin !== undefined && handle && handle.stdin && typeof handle.stdin.write === 'function') {
+        try { handle.stdin.write(String(o.stdin)); if (typeof handle.stdin.end === 'function') handle.stdin.end() } catch (e) { /* best effort */ }
+      }
+      // A TIMEOUT must actually KILL the process: `graceMs` is only a request to the host.
+      let timerDisposer = null
+      let timedOut = false
+      const ran = Promise.resolve(handle.done).then(
+        (v) => ({ settled: true, value: v }),
+        (e) => ({ settled: false, error: e }))
+      let outcome = null
+      try {
+        const r = await Promise.race([
+          ran,
+          new Promise((resolve) => {
+            timerDisposer = ctx.timeout(() => {
+              timedOut = true
+              try { if (typeof handle.terminate === 'function') handle.terminate() } catch (e) { /* the race result is the report */ }
+              resolve({ settled: true, value: { exitCode: null, signal: 'SIGTERM' } })
+            }, cap)
+          }),
+        ])
+        if (r.settled) outcome = r.value
+      } catch (e) {
+        return { exit: null, timedOut, killed: timedOut, ms: now() - started, stdout: '', stderr: String((e && e.message) || e) }
+      } finally {
+        if (timerDisposer) { try { timerDisposer() } catch (e) { /* already settled */ } }
+      }
+      let out = '', err = ''
+      try { if (handle.collected && handle.collected.stdout) out = handle.collected.stdout.readFrom(0).text } catch (e) { /* best effort */ }
+      try { if (handle.collected && handle.collected.stderr) err = handle.collected.stderr.readFrom(0).text } catch (e) { /* best effort */ }
+      const signal = (outcome && outcome.signal) || null
+      return {
+        exit: outcome && outcome.exitCode !== undefined ? outcome.exitCode : null,
+        timedOut,
+        killed: timedOut || !!signal,
+        ms: now() - started,
+        stdout: out,
+        stderr: err,
+      }
+    }
+    function mathLog(kind, msg) {
+      try { saveChatLine('【计算】' + String(msg == null ? '' : msg)) } catch (e) { /* a log line must never break a run */ }
+    }
+    // The per-session host the module talks to (also used by the availability-line probe, which
+    // runs OUTSIDE a tool call and therefore cannot rely on an ambient "current session").
+    const mathSessionHost = {
+      register: () => {},
+      params: () => Object.assign({}, params),
+      projectRoot: () => instRoot(),
+      designator: 'vibe-math-v5',
+      writeText: (rel, text) => mathWriteRel(rel, text),
+      readText: (rel) => mathReadRel(rel),
+      exists: (rel) => mathExistsRel(rel),
+      resolveExecutable: (cmd) => mathResolveExecutable(cmd),
+      spawn: (opts) => mathSpawn(opts),
+      // P2a optional fields: tell the module up front whether a compiler can run at all (so it
+      // reports MATH_NO_SUBPROCESS before engine detection), and let it check the retention cap.
+      hasSubprocess: () => { const sub = subprocessOf(); return !!(sub && typeof sub.spawn === 'function') },
+      listDir: (rel) => mathListDirRel(rel),
+      log: (kind, msg) => mathLog(kind, msg),
+    }
+    // The DYNAMIC per-round availability line: computed from a (cached) probe when the prompt is
+    // built, never frozen into the persona. `mathComputation:'off'` produces NO line at all
+    // (the zero-mention discipline); the mode decides whether the shell-fallback sentence is in.
+    let mathLineZh = ''
+    let mathLineEn = ''
+    async function refreshMathLine() {
+      if (String(params.mathComputation) === 'off') { mathLineZh = ''; mathLineEn = ''; return '' }
+      try {
+        const probe = await probeMathEngines(mathSessionHost)
+        mathLineZh = mathAvailabilityLine(probe, 'zh', String(params.mathMode))
+        mathLineEn = mathAvailabilityLine(probe, 'en', String(params.mathMode))
+        // Drift guard: the shared line must still carry the frozen rule text (a future module
+        // edit that drops the rules would silently remove a rule from every round prompt).
+        if (mathLineZh.indexOf(MATH_RULE_LINES[0]) === -1) console.error('vibe-math-v5: the math availability line lost the frozen rules')
+        if (mathLineEn.indexOf(MATH_RULE_LINES_EN[0]) === -1) console.error('vibe-math-v5: the EN math availability line lost the frozen rules')
+        // P2a: the archive→edit→re-run workflow rule must reach the prompt too (it is what makes
+        // `scriptChanged` actionable for a member).
+        if (mathLineZh.indexOf(MATH_ARCHIVE_WORKFLOW_LINE) === -1) console.error('vibe-math-v5: the math availability line lost the archive workflow rule')
+        if (mathLineEn.indexOf(MATH_ARCHIVE_WORKFLOW_LINE_EN) === -1) console.error('vibe-math-v5: the EN math availability line lost the archive workflow rule')
+        return mathLineZh
+      } catch (e) {
+        // A probe failure must never break prompt construction: keep whatever we had.
+        return mathLineZh
+      }
+    }
+    // The tool section of a member prompt: the availability line + the rules (both come from
+    // the module, so all four presets stay byte-comparable).
+    function mathPromptBlock(lang) {
+      const line = lang === 'en' ? mathLineEn : mathLineZh
+      if (line) return '\n' + line
+      // Fallback: when the dynamic line could not be built, the member still needs to know the
+      // tool exists, how to cite it, and (P2a) that an edited script needs a NEW receipt.
+      if (String(params.mathComputation) === 'off') return ''
+      return lang === 'en'
+        ? '\n' + MATH_PERSONA_TOOL_LINE + '\n' + MATH_ARCHIVE_WORKFLOW_LINE_EN
+        : '\n' + MATH_PERSONA_TOOL_LINE + '\n' + MATH_ARCHIVE_WORKFLOW_LINE
+    }
+    // Push the tool section into a prompt under construction (a no-op in the 'off' mode, which
+    // is the "off means zero mention" discipline).
+    function mathPushLine(L) { const b = mathPromptBlock('zh'); if (b) L.push(b) }
+
     function formalPromptBlock(target) {
       if (!formalOn()) return ''
       const mode = formalMode()
@@ -2124,6 +2978,9 @@ export function apply(ctx) {
         L.push('    请复核这个判断是否成立；若你认为其实可以形式化，请指出来并动手做。')
       } else {
         L.push('  · 请先判断该对象的**实现难度**：若能在可接受的工作量内形式化，优先写 Lean 代码并执行。')
+        // D4 criteria + async honesty (verbatim prompt text, docs/formal-verification.md §6).
+        L.push('  · 形式化只写你有把握的版本；没把握就记 blocked 并写清难点——不要用形式化掩盖不确定。')
+        L.push('  · 该对象若已有后台编译在队列中，**不得**在它落地前声称已通过或走忠实性审查；等 vibe_v5_lean_lib 显示 passed 再审。')
         L.push('  · 工具：vibe_v5_lean_run（执行）· vibe_v5_lean_archive（归档）· vibe_v5_lean_lib（查已有可复用库）')
         L.push('  · 工作目录：Formal/（相对研究所根）；可复用定义放 ' + formalLibRoot().replace(/\\/g, '/') + '/，')
         L.push('    已证引理放 ' + formalProvedRoot().replace(/\\/g, '/') + '/；写之前先 vibe_v5_lean_lib 查重。')
@@ -2144,11 +3001,21 @@ export function apply(ctx) {
       return L.join('\n')
     }
     function formalWorkLine() {
-      if (!formalOn()) return ''
-      return '【顺手形式化（' + (formalMode() === 'require' ? '强制' : '鼓励') + '）】把你工作中常用或可能复用的对象、假设、'
+      if (!leanDailyOn()) return ''
+      const eager = leanInitiative() === 'eager'
+      return '【顺手形式化（' + (formalOn() ? (formalMode() === 'require' ? '强制' : '鼓励') : '主动（leanInitiative=eager）') + '）】'
+        + (eager ? '**主动**把工作中出现的有价值的小引理、命题、定义顺手形式化并存库；' : '')
+        + '把你工作中常用或可能复用的对象、假设、'
         + '新定义用 Lean 形式化定义并归档到全局可复用库（vibe_v5_lean_archive kind=\'def\'），已成立的引理归到 Proved/'
         + '（kind=\'lemma\'）；写之前先 vibe_v5_lean_lib 查重，避免重复定义。'
         + '归档前先跑通（vibe_v5_lean_run 或 run=true）；跑不通的定义不要进可复用库。'
+        + '\n  · 判断标准：① 有价值或可能复用；② 较为关键或必要；③ 你对该陈述有把握（置信度高）。**没把握的先别入库**——'
+        + '进了 Formal/Proved 的东西会被当成已核对引理；没把握就记 blocked 并写清难点，别用形式化掩盖不确定。'
+        + '\n  · 复用优先：写新定义/证明前**先 vibe_v5_lean_lib 查已有库**；复用已归档内容用 '
+        + '`import Formal.Lib.<name>` / `import Formal.Proved.<name>`（模块根 = <VibeMath 根>，框架已把它加进编译搜索路径），'
+        + '或 `vibe_v5_lean_read {name}` 取原文逐字复制。**查不到再新写**；同内容重复归档会自动去重。'
+        + '\n  · 编译默认走后台队列（leanAsync=true）：入队后你可以继续工作；用 vibe_v5_lean_lib 的 jobs 字段或下一轮提示里的 '
+        + '【形式化结果】行看结果。**在作业落地为“通过”之前，不得把该对象当成已通过。**'
         + (formalMode() === 'require'
           ? '本模式下，任何要定论为真/假的对象都必须先有 Lean 通过或显式阻塞记录。'
           : '这会让后续的验证与证明省掉大量重复工作。')
@@ -2201,7 +3068,10 @@ export function apply(ctx) {
             const txt = (await readTextAbs(dirAbs + '/' + e.name)) || ''
             const name = String(e.name).replace(/\.lean$/, '')
             const first = (txt.split('\n').filter((l) => l.trim() && !/^\s*(\/\/|--|import)/.test(l))[0] || '').trim().slice(0, 110)
-            rows.push('| ' + name + ' | ' + rel + ' | ' + kindLabel + ' | ' + first.replace(/\|/g, '/') + ' |')
+            // Dependency column (docs/formal-verification.md §9): what this file imports — the
+            // answer to "can I reuse it, and what does it drag in?".
+            const depend = (txt.split('\n').filter((l) => /^\s*import\s+/.test(l)).map((l) => l.replace(/^\s*import\s+/, '').trim()).join('、')) || '—'
+            rows.push('| ' + name + ' | ' + rel + ' | ' + kindLabel + ' | ' + first.replace(/\|/g, '/') + ' | ' + depend.replace(/\|/g, '/') + ' |')
           }
         } catch (e) { /* listing is best-effort */ }
         return rows
@@ -2209,13 +3079,13 @@ export function apply(ctx) {
       const libRows = await scan(formalLibRoot(), 'Formal/Lib', 'def')
       await writeTextAbs(vibeRoot() + '/Formal/Lib/Index.md', ['# 可复用 Lean 定义库（跨项目）｜' + instituteName, '',
         '> 写新定义之前先查这里：能复用就不要重新定义。', '',
-        '| 名称 | 文件 | 类别 | 摘要 |', '|---|---|---|---|']
-        .concat(libRows.length ? libRows : ['| （暂无） | | | |']).join('\n') + '\n')
+        '| 名称 | 文件 | 类别 | 摘要 | 依赖 |', '|---|---|---|---|---|']
+        .concat(libRows.length ? libRows : ['| （暂无） | | | | |']).join('\n') + '\n')
       const provedRows = await scan(formalProvedRoot(), 'Formal/Proved', 'lemma')
       await writeTextAbs(vibeRoot() + '/Formal/Proved/Index.md', ['# 已成立的 Lean 命题 / 引理（机器已核对，可跨项目复用）｜' + instituteName, '',
         '> 这些文件是通过内核检查的引理，可直接 import 复用。', '',
-        '| 名称 | 文件 | 类别 | 陈述 |', '|---|---|---|---|']
-        .concat(provedRows.length ? provedRows : ['| （暂无） | | | |']).join('\n') + '\n')
+        '| 名称 | 文件 | 类别 | 陈述 | 依赖 |', '|---|---|---|---|---|']
+        .concat(provedRows.length ? provedRows : ['| （暂无） | | | | |']).join('\n') + '\n')
       await writeFormalIndex()
       await writeFormalTodo()
       return { lib: libRows.length, proved: provedRows.length, objects: Object.keys(formalRecords()).length }
@@ -2227,9 +3097,30 @@ export function apply(ctx) {
     // Execute one Lean file through the toolchain, record the run (optionally against an
     // object), refresh the indexes, and report the outcome verbatim. Deliberately called
     // even from `off` mode: a human debugging their toolchain may want it.
+    // `leanAsync` (default): ENQUEUE and return immediately — the compiler has not been
+    // started when this returns (docs/formal-verification.md §7-2). `false`: today's await.
     async function leanRunTool(memberId, o) {
       const args = o || {}
-      const run = await leanRunFile(String(args.file || ''), args.timeout_ms)
+      const rel = String(args.file || '')
+      if (params.leanAsync !== false) {
+        const pre = await leanPrecheck(rel)
+        if (pre.ok === false) return Object.assign({ async: null }, pre)
+        const fileText = await readTextAbs(pre.abs)
+        const text = fileText === undefined ? '' : String(fileText)
+        const pfx = await leanRunPrefix()
+        const target = idSafe(String(args.target || ''))
+        const job = await enqueueLeanJob({
+          jobId: leanJobId(target || pre.rel, leanBuildDigest(text, pfx.prefix)), kind: 'run', rel: pre.rel, file: pre.rel,
+          target, member: memberId, contentSha256: sha256Hex(leanHashText(text)), buildHash: leanBuildHash(pfx.prefix),
+          buildPrefix: pfx.prefix, timeoutMs: args.timeout_ms,
+        })
+        return {
+          ok: true, async: { jobId: job.jobId, state: 'queued' }, jobId: job.jobId,
+          file: pre.rel, target: target || undefined,
+          message: '已入队后台编译；你可以继续工作。结果会写入 Formal/ 与索引，并在下一轮提示里公告；也可用 vibe_v5_lean_lib 的 jobs 字段随时查看。',
+        }
+      }
+      const run = await leanRunFile(rel, args.timeout_ms)
       if (run.ok || run.file) {
         if (String(args.target || '').trim()) await formalSetRun(String(args.target), run)
         await writeFormalIndex()
@@ -2239,11 +3130,46 @@ export function apply(ctx) {
           + '（' + (run.ms / 1000).toFixed(1) + 's）' + (args.target ? '｜对象 ' + args.target + ' 记为已尝试（若此前已通过/已阻塞则保留原状态）' : ''))
       }
       return Object.assign({ ok: !!run.ok }, run, {
+        async: null,
         hint: run.ok
           ? '通过。若是某个对象的证明，请用 vibe_v5_lean_archive kind=\'proof\' 归档（会写入 Verified/Lean/ 并把审查对象变成忠实性）；若是可复用定义/引理，用 kind=\'def\'/\'lemma\' 归档到全局库。'
           : '未通过。请按上面的编译器输出修复后重跑；若判断无法完成，用 vibe_v5_lean_archive kind=\'blocked\' 记录原因。',
       })
     }
+    // Read an ARCHIVED definition/lemma verbatim (docs/formal-verification.md §5.4): the reuse
+    // path is `lean_lib` (what exists) → `lean_read` (its exact text) → `import` or copy.
+    async function leanRead(o) {
+      const args = o || {}
+      const raw = String(args.name || '').trim().replace(/\.lean$/i, '')
+      if (!raw) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'name is required' }
+      // Reject a path-shaped name outright: the guard must refuse `../`, absolute paths and
+      // any sub-directory, not silently sanitise them into a different file.
+      if (raw.indexOf('/') !== -1 || raw.indexOf('\\') !== -1 || raw.indexOf('..') !== -1 || /^[a-z]:/i.test(raw)) {
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'name must be a plain archived file name (no path separators, no .., no absolute path)' }
+      }
+      const name = idSafe(raw)
+      if (!name || name !== raw) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'name is not a valid archived file name' }
+      const kindArg = String(args.kind || 'auto')
+      if (['auto', 'lib', 'proved'].indexOf(kindArg) === -1) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: "kind must be 'auto' | 'lib' | 'proved'" }
+      const dirs = kindArg === 'auto' ? ['Lib', 'Proved'] : [kindArg === 'lib' ? 'Lib' : 'Proved']
+      for (const d of dirs) {
+        const rel = 'Formal/' + d + '/' + name + '.lean'
+        const abs = leanAbsPath(instRootless(rel))
+        if (abs === null) continue
+        const txt = await readTextAbs(abs)
+        if (txt === undefined) continue
+        const full = String(txt)
+        const truncated = full.length > LEAN_READ_MAX_BYTES
+        return {
+          ok: true, name, file: rel, kind: d === 'Lib' ? 'lib' : 'proved',
+          sha256: sha256Hex(leanHashText(full)),
+          bytes: new TextEncoder().encode(full).length,
+          text: truncated ? full.slice(0, LEAN_READ_MAX_BYTES) : full,
+          truncated,
+        }
+      }
+      return { ok: false, code: 'V5_NOT_FOUND', message: 'no archived ' + (kindArg === 'auto' ? 'definition/lemma' : kindArg) + ' named ' + name }
+    }
     async function leanArchive(memberId, o) {
       const args = o || {}
       const kind = String(args.kind || '')
@@ -2260,15 +3186,46 @@ export function apply(ctx) {
         }
         if (body === undefined) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'provide content, or from=<existing .lean file>' }
         const rel = 'Formal/' + (kind === 'def' ? 'Lib' : 'Proved') + '/' + name + '.lean'
+        const sha = sha256Hex(leanHashText(String(body)))
+        // Content-hash dedupe (docs/formal-verification.md §5.3): the file already holds EXACTLY
+        // this content AND the recorded run for that content succeeded ⇒ skip rewrite + compile.
+        const fileSha = await leanHashFile(instRootless(rel))
+        if (fileSha === sha && await leanLibArchivedOk(name, sha)) {
+          return { ok: true, deduped: true, kind, name, file: rel, sha256: sha, note: '内容与已归档版本一致，跳过重写与重编译' }
+        }
         const okWrite = await writeTextAbs(instRootless(rel), body)
         if (!okWrite) return { ok: false, code: 'V5_WRITE_FAILED', message: 'could not write ' + rel }
-        // The global library sits beside the project tree, so it must be executed through
-        // its ABSOLUTE path (the relative form would resolve inside the institute root).
+        if (args.run !== false && params.leanAsync !== false) {
+          // The global library sits beside the project tree, so it is executed through its
+          // ABSOLUTE path (the relative form would resolve inside the institute root).
+          const pre = await leanPrecheck(instRootless(rel))
+          if (pre.ok === true) {
+            const pfx = await leanRunPrefix()
+            const job = await enqueueLeanJob({
+              jobId: leanJobId(name, leanBuildDigest(String(body), pfx.prefix)), kind: 'lib', rel: instRootless(rel), file: rel, name,
+              member: memberId, contentSha256: sha, buildHash: leanBuildHash(pfx.prefix), buildPrefix: pfx.prefix, content: String(body),
+            })
+            await rebuildLeanLibIndexes()
+            await saveChatLine('【形式化】' + memberId + ' 归档了' + (kind === 'def' ? '可复用定义' : '已证引理') + ' `' + name + '` → ' + rel + '（已入队后台编译）')
+            return { ok: true, kind, name, file: rel, sha256: sha, async: { jobId: job.jobId, state: 'queued' }, jobId: job.jobId, note: '已并入全局可复用库（后台编译中）：用 vibe_v5_lean_lib 的 jobs 字段查看结果' }
+          }
+          // No usable toolchain on this host: fall through to the synchronous path so the honest
+          // NO_SUBPROCESS / LEAN_NOT_FOUND result is recorded exactly as before.
+        }
         const run = args.run === false ? null : await leanRunFile(instRootless(rel))
+        // Mirror the outcome as a job record: later re-archives of the SAME content dedupe
+        // against it (and it is what `Formal/Jobs/` recovery scans).
+        if (run) await leanWriteJob({
+          jobId: leanJobId(name, sha), kind: 'lib', rel: instRootless(rel), file: rel, name,
+          member: memberId, contentSha256: sha, state: run.ok ? 'settled' : (run.timedOut ? 'timeout' : 'failed'),
+          attempts: 1, enqueuedAt: now(), startedAt: now(), settledAt: now(),
+          exitCode: run.exitCode === undefined ? null : run.exitCode, ok: !!run.ok,
+          timedOut: !!run.timedOut, interrupted: false,
+        })
         await rebuildLeanLibIndexes()
         await saveChatLine('【形式化】' + memberId + ' 归档了' + (kind === 'def' ? '可复用定义' : '已证引理') + ' `' + name + '` → ' + rel
           + (run ? '（运行 ' + (run.ok ? '通过' : '未通过') + '）' : ''))
-        return { ok: true, kind, name, file: rel, run: run || undefined, note: '已并入全局可复用库，后续项目可直接 import 复用' }
+        return { ok: true, kind, name, file: rel, sha256: sha, async: null, run: run || undefined, note: '已并入全局可复用库，后续项目可直接 import 复用' }
       }
       if (kind === 'proof') {
         const target = idSafe(String(args.target || ''))
@@ -2281,9 +3238,41 @@ export function apply(ctx) {
         }
         if (body === undefined) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'provide content, or from=<existing .lean file>' }
         const workRel = 'Formal/' + target + '.lean'
+        const sha = sha256Hex(leanHashText(String(body)))
+        const prev = formalOf(target)
+        // Dedupe (§5.3): the object is already `passed` AND the work file still holds EXACTLY
+        // this content ⇒ the compile result is already known: skip rewrite + recompile.
+        if (prev.status === 'passed' && (await leanHashFile(workRel)) === sha) {
+          return { ok: true, deduped: true, kind, target, file: workRel, sha256: sha, proof: prev.proof || ('Verified/Lean/' + target + '.lean'), note: '内容与已归档版本一致，跳过重写与重编译' }
+        }
         if (!await writeTextRel(workRel, body)) return { ok: false, code: 'V5_WRITE_FAILED', message: 'could not write ' + workRel }
+        if (params.leanAsync !== false) {
+          const pre = await leanPrecheck(workRel)
+          if (pre.ok === true) {
+            const pfx = await leanRunPrefix()
+            const job = await enqueueLeanJob({
+              jobId: leanJobId(target, leanBuildDigest(String(body), pfx.prefix)), kind: 'proof', rel: workRel, file: workRel, target,
+              member: memberId, contentSha256: sha, buildHash: leanBuildHash(pfx.prefix), buildPrefix: pfx.prefix, content: String(body),
+            })
+            // The object is `attempted` while the job is queued: it may only become `passed`
+            // when the job settles ok (exit 0 + unchanged hash). A previous proof pointer is
+            // dropped because the file it referred to has just been overwritten.
+            const rec0 = Object.assign({}, prev, {
+              status: prev.status === 'blocked' ? 'blocked' : 'attempted',
+              file: workRel, proof: '',
+              decision: 'used', note: String(args.note || prev.note || ''),
+              async: { jobId: job.jobId, state: 'queued', attempts: 0, enqueuedAt: job.enqueuedAt, startedAt: 0, settledAt: 0, exitCode: null },
+              updatedAt: now(),
+            })
+            await putFormal(target, rec0)
+            await rebuildLeanLibIndexes()
+            await saveChatLine('【形式化】' + memberId + ' 为 ' + target + ' 归档形式化证明 ' + workRel
+              + '（已入队后台编译；落地为“通过”之前**不会**写 Verified/Lean/、也不会转为忠实性审查）')
+            return { ok: true, kind, target, file: workRel, sha256: sha, async: { jobId: job.jobId, state: 'queued' }, jobId: job.jobId, status: rec0.status, note: '已入队后台编译；只有作业落地为“通过”才会写 Verified/Lean/ 并转为忠实性审查' }
+          }
+          // No toolchain: fall through to the synchronous path (honest NO_SUBPROCESS record).
+        }
         const run = await leanRunFile(workRel)
-        const prev = formalOf(target)
         const passed = !!run.ok
         const rec = Object.assign({}, prev, {
           status: passed ? 'passed' : 'attempted',
@@ -2297,6 +3286,7 @@ export function apply(ctx) {
           decision: 'used',
           note: String(args.note || prev.note || ''),
           run: { at: now(), ok: !!run.ok, exitCode: run.exitCode === undefined ? null : run.exitCode, ms: run.ms || 0, stdoutTail: tail(run.stdout, 800), stderrTail: tail(run.stderr, 800) },
+          async: null,
           updatedAt: now(),
         })
         if (passed) await writeTextRel('Verified/Lean/' + target + '.lean', body)
@@ -2304,7 +3294,7 @@ export function apply(ctx) {
         await rebuildLeanLibIndexes()
         await saveChatLine('【形式化】' + memberId + ' 为 ' + target + ' 归档形式化证明 ' + workRel
           + '（运行 ' + (passed ? '**通过**，已归档到 ' + rec.proof + '，验证转为忠实性审查' : '**未通过**：' + tail(run.stderr || run.message, 160)) + '）')
-        return { ok: true, kind, target, file: workRel, proof: rec.proof, passed, run, status: rec.status }
+        return { ok: true, kind, target, file: workRel, sha256: sha, proof: rec.proof, passed, run, status: rec.status, async: null }
       }
       if (kind === 'blocked') {
         const target = idSafe(String(args.target || ''))
@@ -3311,6 +4301,11 @@ export function apply(ctx) {
       solveVotes.clear()
       await putMeeting({ id, agenda: meeting.agenda, kind: meeting.kind, at: now(), file: 'Shared/Meetings/' + id + '.md' })
       await saveChatLine('【会议 ' + id + '】召开：' + meeting.agenda + '（类型：' + meeting.kind + '｜召集人：' + meeting.by + '）')
+      // A meeting that ACTUALLY begins and was convened by the office is the other half of the
+      // `paperEditor='office'` consultation requirement (docs/final-paper.md §7). Counted here, not at the
+      // request: a parked/refused request is not a consultation. A FRAMEWORK-convened stall
+      // meeting (`auto:true`) is not the office's own act, so it does not count either.
+      if (meeting.by === 'office' && opts.auto !== true) await notePaperConsult('meeting')
       await mkdirs()
       await writeTextRel('Shared/Meetings/' + id + '.md', [
         '# 会议纪要｜' + id + '｜' + instituteName,
@@ -3429,9 +4424,24 @@ export function apply(ctx) {
     // Stop ONLY on a unanimous true solve-vote from every VOTING member. There is no
     // forced/flat/near-consensus closure: any objection keeps the institute working.
     async function checkSolved() {
+      if (autoDone) return true
       const vs = voters().map((m) => m.id)
       if (!vs.length) return false
       if (!vs.every((id) => solveVotes.get(id) === true)) return false
+      // ── THE FINAL PAPER PHASE COMES FIRST (docs/final-paper.md §3) ────────────────────────────────
+      // `finishRun` flips phase='solved' / autoDone / running=false, after which the machinery
+      // REFUSES: `wakeIfIdle` returns false, `startMeeting` rejects a concluded institute and
+      // nothing schedules — so the co-writing, the cross-review and the office consultation
+      // could never run. The run therefore stays alive here until the paper is finalised
+      // (or degraded with a report), and `finalizePaper` calls `finishRun` for us.
+      if (params.finalPaper !== false) {
+        const p = paper()
+        if (!p) { await startPaper('run-complete', {}); return true }
+        if (p.status !== 'finalized') {
+          if (!p.completesRun) await mutatePaper((cur) => (cur ? Object.assign({}, cur, { completesRun: true }) : cur))
+          return true
+        }
+      }
       await finishRun('全体有表决权者一致认为原问题已解决')
       return true
     }
@@ -3469,6 +4479,916 @@ export function apply(ctx) {
       notifyActivity()
     }
 
+    // ================= final paper (docs/final-paper.md) ============
+    // THE PHASE RUNS BEFORE `finishRun` (docs/final-paper.md §3). After `phase='solved'` the machinery
+    // refuses: `wakeIfIdle` (:3257) returns false, `startMeeting` refuses a concluded
+    // institute, and a concluded run has no scheduling at all — so the co-writing, the
+    // cross-review and the office consultation could never run. `checkSolved` therefore
+    // enters this phase while the run is still alive and only calls `finishRun` once the
+    // paper is finalised (or degraded with a report).
+    //
+    // Only evidence that ALREADY exists is written down: verified verdicts, the task board,
+    // the Lean records, the members' libraries and the members' own text. The framework never
+    // invents content — sections 3/6/7/8 are the members' own words, 4/5/9 are derived from
+    // durable state, and undecided/refuted items are always marked as such.
+    const PAPER_FILE = (id, file) => 'Paper/' + id + '/' + file
+    function paper() { return inst().paper || null }
+    function paperActive() { const p = paper(); return !!p && p.status !== 'finalized' }
+    function paperParticipants() {
+      return activeMembers().filter((m) => m.kind === 'academician' || m.kind === 'researcher').map((m) => m.id)
+    }
+    function paperActiveParticipants(p) {
+      return ((p && p.participants) || []).filter((id) => { const m = memberById(id); return !!m && m.phase === 'active' })
+    }
+    function paperConfiguredEditor() { return params.paperEditor === 'office' ? 'office' : 'academician' }
+    function paperIdFromState() {
+      const a = idSafe(instituteName)
+      if (a) return a
+      const b = idSafe(String(runId || (inst() && inst().runId) || ''))
+      return b || 'institute'
+    }
+    async function fileExistsAbs(abs) {
+      try { const t = await fsTargetAbs(abs); return (await fs.stat(t)) !== undefined } catch (e) { return false }
+    }
+    function paperAbs(id, file) { return instRoot() + '/' + PAPER_FILE(id, file) }
+    function paperDirRel(id) { return 'Paper/' + id }
+    async function mutatePaper(fn) {
+      await patchInstitute({ paper: (cur) => { const next = fn(cur === undefined ? null : cur); return next === undefined ? (cur === undefined ? null : cur) : next } })
+      return paper()
+    }
+    async function paperLog(title, body) {
+      const p = paper()
+      const id = (p && p.id) || paperIdFromState()
+      const rel = PAPER_FILE(id, 'paper.log.md')
+      const prev = (await readTextRel(rel)) || ('# 最终论文流程日志｜' + id + '\n\n')
+      await writeTextRel(rel, prev + '## ' + title + '\n\n' + String(body || '') + '\n\n')
+      return rel
+    }
+    function paperAskEvery() { return posMs(params.activityTimeoutMs, 120000) }
+    function paperNextStep(p) {
+      if (!p) return 'no paper flow yet: finish the run with finalPaper=true, or trigger /v5 paper manually'
+      if (p.status === 'finalized') return 'finalised — /v5 paper force rewrites it'
+      if (p.status === 'writing') return 'waiting for the staff parts (round ' + p.round + '/' + PAPER_MAX_ROUNDS + ')'
+      if (p.status === 'reviewing') return 'waiting for the cross-reviews (each reviewer judges another part)'
+      if (p.status === 'awaiting-editor' && p.editor === 'office') {
+        return 'awaiting the OFFICE: send >=1 office message and convene >=1 meeting, then call vibe_v5_finalize_paper (consultation so far: messages=' +
+          Number((p.consult || {}).messages || 0) + ', meetings=' + Number((p.consult || {}).meetings || 0) + ')'
+      }
+      if (p.status === 'awaiting-editor') return 'waiting for the academician to finalise'
+      return p.status
+    }
+    function paperAutoNote() {
+      return params.finalPaper === false ? '自动已关闭（finalPaper=false）；本次为手动触发，仍会生成论文。' : ''
+    }
+    function paperSummary() {
+      const p = paper()
+      if (!p) return null
+      return {
+        id: p.id, status: p.status, stage: p.stage, round: p.round,
+        editor: p.editor, editorFallback: !!p.editorFallback, completesRun: !!p.completesRun,
+        participants: p.participants || [],
+        parts: Object.keys(p.parts || {}).map((id) => ({ member: id, round: (p.parts[id] || {}).round, title: (p.parts[id] || {}).title || '' })),
+        reviews: Object.keys(p.reviews || {}).map((id) => ({ member: id, of: (p.reviews[id] || {}).of || '', round: (p.reviews[id] || {}).round, deliverable: (p.reviews[id] || {}).deliverable === true })),
+        reviewOf: p.reviewOf || {},
+        consult: Object.assign({ messages: 0, meetings: 0 }, p.consult || {}),
+        lang: p.lang, format: p.format, compilePdf: p.pdf === true,
+        compile: p.compile || null, engine: p.engine || '', artifacts: p.artifacts || [],
+        warnings: p.warnings || [], disagreement: p.disagreement || [], skipped: p.skipped || [],
+        forcedAfterCap: !!p.forcedAfterCap, finalizedAt: p.finalizedAt || null,
+        dir: 'Paper/' + p.id + '/', next: paperNextStep(p),
+        meta: p.status === 'finalized' ? 'Paper/' + p.id + '/paper.meta.json' : null,
+      }
+    }
+
+    // ---- the three asks ----------------------------------------------------
+    function paperWritePrompt(member, p) {
+      const L = []
+      L.push('【最终论文·撰写 —— ' + kindLabel(member.kind) + ' ' + member.id + '】')
+      L.push('本所对原问题的一致结论已经达成，现在撰写**最终论文**（第 ' + p.round + '/' + PAPER_MAX_ROUNDS + ' 轮）。')
+      L.push('请你**只写你自己库里已有证据支撑**的内容：')
+      L.push('- 直接引用你的卡片（Members/' + member.id + '/Propos|Methods|Subproblems/）、Members/' + member.id + '/Progress/progress.md、你参与的表决记录；')
+      L.push('- **不得编造**：没有证据的推测不要写成结论；未决 / 被否证的条目必须显式标注“未定论 / 已被否证”；')
+      L.push('- 在 evidence 里写清证据路径，附录会逐条索引。')
+      if (p.round > 1) {
+        const rv = (p.reviews || {})[member.id]
+        L.push('')
+        L.push('上一轮互审给你（' + member.id + '）部分的意见：' + (rv ? String(rv.comments || '（无具体意见）') : '（无）'))
+        L.push('请据此修订；若不同意该意见，请在 limits 里写明理由。')
+      }
+      L.push('')
+      L.push('------------')
+      L.push(stateBlock(member))
+      L.push('------------')
+      L.push('结束时只输出一个 JSON 对象：')
+      L.push('{ "paper_part": {')
+      L.push('    "title": "你这部分的标题",')
+      L.push('    "solution": "你对**原问题完整解法**的贡献（推理链与结论，只写有证据的）",')
+      L.push('    "methods": "你创造/发现的方法、理论、思想、有价值经验、数学理解",')
+      L.push('    "rules": "你从这些工作中归纳出的可复用规律",')
+      L.push('    "limits": "局限、未决、被否证之处（必须诚实、显式）",')
+      L.push('    "evidence": ["Members/' + member.id + '/Propos/p-x.md"] } }')
+      return L.join('\n')
+    }
+    function paperReviewPrompt(member, p, ofId) {
+      const part = ofId ? (p.parts || {})[ofId] : null
+      const L = []
+      L.push('【最终论文·互审 —— ' + kindLabel(member.kind) + ' ' + member.id + '】')
+      L.push('请你审阅 **' + (ofId || '（未指定）') + '** 撰写的部分，判断它是否可以交付（deliverable）。')
+      L.push('要点：证据是否充分；是否与已定论的表决一致；有无编造或未标注的未决项；术语与符号是否清楚。')
+      L.push('')
+      L.push('------------ 待审部分（' + (ofId || '') + '）------------')
+      L.push('标题：' + ((part && part.title) || '(无)'))
+      L.push('【完整解法】' + String((part && part.solution) || '(空)').slice(0, 6000))
+      L.push('【方法/理论/思想/经验/理解】' + String((part && part.methods) || '(空)').slice(0, 4000))
+      L.push('【规律】' + String((part && part.rules) || '(空)').slice(0, 3000))
+      L.push('【局限/未决】' + String((part && part.limits) || '(空)').slice(0, 3000))
+      L.push('【声称的证据】' + ((((part && part.evidence) || []).join('、')) || '(无)'))
+      L.push('------------')
+      L.push('')
+      L.push(stateBlock(member))
+      L.push('')
+      L.push('结束时只输出一个 JSON 对象：')
+      L.push('{ "paper_review": { "of": "' + (ofId || '') + '", "deliverable": true, "comments": "具体意见" } }')
+      L.push('deliverable 必须是 true（可交付）或 false（不可交付，需修改）。只有**全体参与成员**都投 true，定稿代表才能定稿。')
+      return L.join('\n')
+    }
+    function paperFinalPrompt(member, p) {
+      const L = []
+      L.push('【最终论文·定稿（院士）—— ' + member.id + '】')
+      L.push('全体参与成员已在互审中表示“可交付”。请你作为定稿代表做**最后一次**把关：')
+      L.push('核对合并稿与互审意见，确认没有编造、没有未标注的未决项、没有与表决记录矛盾之处，然后给出决定。')
+      L.push('')
+      L.push('------------ 合并稿（各成员部分）------------')
+      for (const id of paperActiveParticipants(p)) {
+        const part = (p.parts || {})[id] || {}
+        L.push('### ' + id + '｜' + String(part.title || ''))
+        L.push('【完整解法】' + String(part.solution || '').slice(0, 3000))
+        L.push('【方法/规律】' + (String(part.methods || '') + ' ' + String(part.rules || '')).slice(0, 2000))
+        L.push('【局限】' + String(part.limits || '').slice(0, 1500))
+        L.push('')
+      }
+      L.push('------------ 互审结论 ------------')
+      for (const id of Object.keys(p.reviews || {})) {
+        const rv = p.reviews[id] || {}
+        L.push('- ' + id + ' 审 ' + (rv.of || '?') + '：deliverable=' + (rv.deliverable === true) + '｜' + String(rv.comments || '').slice(0, 500))
+      }
+      if ((p.disagreement || []).length) L.push('- ⚠ 已达轮次上限仍有分歧：' + JSON.stringify(p.disagreement[p.disagreement.length - 1]).slice(0, 500))
+      L.push('------------')
+      L.push('')
+      L.push(stateBlock(member))
+      L.push('')
+      L.push('结束时只输出一个 JSON 对象：')
+      L.push('{ "paper_final": { "decision": "deliverable" | "revise",')
+      L.push('    "note": "定稿说明：你如何审阅、统一术语与符号、是否发现并纠正了问题",')
+      L.push('    "conclusion": "（可选）定稿代表对原问题的最终结论（只写有证据的）" } }')
+      L.push('decision="revise" 会退回继续修订（有轮次上限）。')
+      return L.join('\n')
+    }
+
+    // ---- the stage driver --------------------------------------------------
+    let paperLock = false
+    async function paperStep() {
+      const p = paper()
+      if (!p || p.status === 'finalized' || p.status === 'awaiting-editor') return false
+      const active = paperActiveParticipants(p)
+      if (!active.length) return await paperAdvance(p, active)
+      const parts = p.parts || {}
+      const reviews = p.reviews || {}
+      const missing = p.status === 'writing'
+        ? active.filter((id) => !(parts[id] && parts[id].round === p.round))
+        : active.filter((id) => !(reviews[id] && reviews[id].round === p.round))
+      if (!missing.length) return await paperAdvance(p, active)
+      const budget = Math.max(1, Math.floor(Number(params.maxParallel) || 3))
+      let asked = 0
+      for (const id of missing) {
+        if (asked >= budget) break
+        if (busy.has(id)) continue
+        const m = memberById(id)
+        if (!m || m.phase !== 'active') continue
+        const last = (p.lastAskAt || {})[id] || 0
+        if (last && (now() - last) < paperAskEvery()) continue
+        const prompt = p.status === 'writing'
+          ? paperWritePrompt(m, p)
+          : paperReviewPrompt(m, p, (p.reviewOf || {})[id])
+        // `wakeMember`, not `wakeIfIdle`: the paper phase deliberately drives members with a
+        // dedicated ask, and a research round must never be mistaken for a paper answer.
+        const ok = await wakeMember(m, prompt, 'paper')
+        if (ok) {
+          asked += 1
+          await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+            lastAskAt: Object.assign({}, cur.lastAskAt || {}, { [id]: now() }), updatedAt: now(),
+          }) : cur))
+        }
+      }
+      // Nothing to advance yet. ALWAYS re-arm: the pass that got here may have skipped an ask
+      // because its member is busy or still inside the ask window, and `schedulePass` returns
+      // from the paper branch BEFORE its own heartbeat arming — without this a paper whose ask
+      // was paced out would stall until some unrelated member turn ended.
+      if (asked) { armHeartbeat(); return false }
+      // Stall watchdog (same clock as meetings/verifications): a member whose turn never ends
+      // must not wedge the paper forever. The stuck members are recorded as non-participants.
+      const stale = now() - Number(p.updatedAt || p.createdAt || now())
+      if (stale >= recoverStallMs()) {
+        const stuck = missing.filter((id) => busy.has(id))
+        const name = stuck.length ? stuck : missing
+        const warn = '看门狗：' + name.join('、') + ' 在 ' + Math.round(stale / 1000) + 's 内没有交稿，已按“未参与”处理并记入附录。'
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          warnings: (cur.warnings || []).concat([warn]),
+          skipped: Array.from(new Set((cur.skipped || []).concat(name))), updatedAt: now(),
+        }) : cur))
+        await paperLog('看门狗', warn)
+        return await paperAdvance(paper(), paperActiveParticipants(paper()))
+      }
+      armHeartbeat()
+      return false
+    }
+    async function paperAdvance(p, active) {
+      if (p.status === 'writing') {
+        const reviewOf = {}
+        for (let i = 0; i < active.length; i++) reviewOf[active[i]] = active[(i + 1) % active.length]
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          status: 'reviewing', stage: 'reviewing', reviewOf, reviews: {}, lastAskAt: {}, updatedAt: now(),
+        }) : cur))
+        await paperLog('进入互审（第 ' + p.round + ' 轮）', active.map((a) => a + ' 审 ' + reviewOf[a]).join('；') || '（无参与成员）')
+        return true
+      }
+      if (p.status === 'reviewing') {
+        const reviews = p.reviews || {}
+        const refusers = active.filter((id) => !(reviews[id] && reviews[id].deliverable === true))
+        if (!refusers.length) {
+          await mutatePaper((cur) => (cur ? Object.assign({}, cur, { status: 'awaiting-editor', stage: 'awaiting-editor', lastAskAt: {}, updatedAt: now() }) : cur))
+          await paperLog('互审一致：可交付', '全体参与成员（' + active.join('、') + '）均表示可交付。定稿代表：' + p.editor)
+          return true
+        }
+        const detail = refusers.map((id) => id + '：' + String((reviews[id] || {}).comments || '未说明')).join('；')
+        const entry = { round: p.round, members: refusers, detail, at: now() }
+        if (p.round < PAPER_MAX_ROUNDS) {
+          await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+            status: 'writing', stage: 'writing', round: cur.round + 1, lastAskAt: {}, updatedAt: now(),
+            disagreement: (cur.disagreement || []).concat([entry]),
+          }) : cur))
+          await paperLog('互审未达成一致 → 进入第 ' + (p.round + 1) + ' 轮', detail)
+          return true
+        }
+        const warn = '互审在 ' + PAPER_MAX_ROUNDS + ' 轮上限仍未达成全体一致（' + refusers.join('、') + '）；分歧已写入论文附录。'
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          status: 'awaiting-editor', stage: 'awaiting-editor', lastAskAt: {}, updatedAt: now(),
+          warnings: (cur.warnings || []).concat([warn]), disagreement: (cur.disagreement || []).concat([entry]), forcedAfterCap: true,
+        }) : cur))
+        await paperLog('达到轮次上限：转交定稿代表', warn)
+        return true
+      }
+      return false
+    }
+    async function paperAwaitEditor(p) {
+      if (p.editor !== 'academician') return false   // office: waits for vibe_v5_finalize_paper
+      const id = academicianId()
+      if (!id) {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          editor: 'office', editorFallback: true, updatedAt: now(),
+          warnings: (cur.warnings || []).concat(['定稿代表 academician 不在册：已回退为 office（需人工定稿）。']),
+        }) : cur))
+        await paperLog('定稿代表回退', 'academician 不在册，回退为 office：用 /v5 paper 或 vibe_v5_finalize_paper 定稿（仍需先与全所交流并开会）。')
+        return false
+      }
+      const m = memberById(id)
+      if (!m || m.phase !== 'active') return false
+      if (busy.has(id)) { armHeartbeat(); return false }
+      const last = (p.lastAskAt || {})[id] || 0
+      if (last && (now() - last) < paperAskEvery()) { armHeartbeat(); return false }
+      const ok = await wakeMember(m, paperFinalPrompt(m, p), 'paper')
+      if (ok) await mutatePaper((cur) => (cur ? Object.assign({}, cur, { lastAskAt: Object.assign({}, cur.lastAskAt || {}, { [id]: now() }), updatedAt: now() }) : cur))
+      armHeartbeat()
+      return false
+    }
+    // The ONE driver. Called from `onMemberEnd` (after the reply is folded), from the manual
+    // tools/command, from the resume path and from `schedulePass`; `paperLock` keeps it single.
+    async function paperPass() {
+      if (paperLock) return false
+      paperLock = true
+      try {
+        for (let i = 0; i < 6; i++) {
+          const p = paper()
+          if (!p || p.status === 'finalized') return false
+          if (p.status === 'awaiting-editor') { await paperAwaitEditor(p); return false }
+          const advanced = await paperStep()
+          if (!advanced) return false
+        }
+        return false
+      } catch (e) {
+        console.error('vibe-math-v5: paper pass: ' + String((e && e.stack) || e))
+        return false
+      } finally { paperLock = false }
+    }
+
+    // ---- start / record / consult / finalize -------------------------------
+    async function startPaper(trigger, opts) {
+      const o = opts || {}
+      const trg = String(trigger || 'manual')
+      const existing = paper()
+      if (existing && existing.status === 'finalized' && !o.force) {
+        const refill = await refillPaperArtifacts(existing)
+        return { ok: true, alreadyFinalized: true, id: existing.id, dir: 'Paper/' + existing.id + '/', refill, autoDisabled: params.finalPaper === false, note: paperAutoNote() }
+      }
+      if (existing && existing.status !== 'finalized' && !o.force) {
+        return { ok: true, alreadyRunning: true, id: existing.id, status: existing.status, stage: existing.stage, round: existing.round, next: paperNextStep(existing), autoDisabled: params.finalPaper === false, note: paperAutoNote() }
+      }
+      const participants = paperParticipants()
+      // A per-call editor override (`/v5 paper editor=office`) is ONE-SHOT: it is not written
+      // back into the persisted params. An AUTOMATIC (run-complete) trigger always uses the
+      // academician — the office is the root session and has no wake path (docs/final-paper.md §7).
+      const configured = (o.editor === 'office' || o.editor === 'academician') ? o.editor : paperConfiguredEditor()
+      const editor = trg === 'run-complete' ? 'academician' : configured
+      const configWantsOffice = configured === 'office'
+      const editorNote = (trg === 'run-complete' && configWantsOffice)
+        ? 'paperEditor=office 已配置，但自动（收口）触发必须由**可唤醒**的院士定稿（所办是根会话，没有唤醒路径）；本次自动流程用 academician。要所办定稿请在收尾后用 /v5 paper 手动触发。'
+        : (editor === 'office' ? '所办定稿：必须先与全所交流（>=1 条所办消息）并至少召开一次会议，结论写进定稿说明，然后调用 vibe_v5_finalize_paper。' : '')
+      const lang = (o.lang === 'en' || o.lang === 'zh') ? o.lang : (params.paperLanguage === 'en' ? 'en' : 'zh')
+      const format = ['both', 'md', 'tex'].indexOf(o.format) !== -1 ? o.format : (['both', 'md', 'tex'].indexOf(params.paperFormat) !== -1 ? params.paperFormat : 'both')
+      const p = {
+        id: paperIdFromState(), status: 'writing', stage: 'writing', round: 1,
+        trigger: trg, createdAt: now(), updatedAt: now(),
+        participants, parts: {}, reviews: {}, reviewOf: {}, final: null,
+        editor, editorNote, completesRun: trg === 'run-complete',
+        lang, format, pdf: params.paperCompilePdf !== false,
+        consult: { messages: 0, meetings: 0 },
+        lastAskAt: {}, warnings: editorNote ? [editorNote] : [], disagreement: [], skipped: [], artifacts: [],
+        forced: !!o.force, forceReason: o.force ? String(o.reason || 'manual force') : '',
+      }
+      await patchInstitute({ paper: p })
+      await paperLog('流程开始（' + (trg === 'run-complete' ? '收口自动触发' : '手动触发') + '）', [
+        '- 目录：Paper/' + p.id + '/',
+        '- 语言：' + p.lang + '｜格式：' + p.format + '｜编译 PDF：' + p.pdf,
+        '- 参与成员：' + (participants.join('、') || '（无常驻成员）'),
+        '- 定稿代表：' + editor + (editorNote ? '（' + editorNote + '）' : ''),
+      ].join('\n'))
+      await paperPass()
+      return {
+        ok: true, started: true, id: p.id, dir: 'Paper/' + p.id + '/', status: 'writing',
+        participants, editor, next: paperNextStep(paper()),
+        autoDisabled: params.finalPaper === false, note: paperAutoNote(),
+      }
+    }
+    async function paperRecordPart(memberId, raw) {
+      const p = paper()
+      if (!p || p.status !== 'writing') return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper flow is not in its writing stage (now: ' + (p ? p.status : 'none') + ')' }
+      if ((p.participants || []).indexOf(memberId) === -1) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: memberId + ' is not a writing participant of this paper' }
+      const part = {
+        member: memberId, round: p.round,
+        title: String(raw.title || '').slice(0, 300),
+        solution: String(raw.solution || '').slice(0, 20000),
+        methods: String(raw.methods || '').slice(0, 20000),
+        rules: String(raw.rules || '').slice(0, 12000),
+        limits: String(raw.limits || '').slice(0, 12000),
+        evidence: Array.isArray(raw.evidence) ? raw.evidence.map(String).slice(0, 50) : [],
+        at: now(),
+      }
+      if (!part.title && !part.solution && !part.methods && !part.rules && !part.limits) {
+        await notice(memberId, 'paper_part 是空的：请至少给出 title 与你的贡献正文（solution/methods/rules/limits），只写库里已有证据支撑的内容。')
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'paper_part carries no content' }
+      }
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, { parts: Object.assign({}, cur.parts || {}, { [memberId]: part }), updatedAt: now() }) : cur))
+      await paperLog('收到 ' + memberId + ' 的部分（第 ' + p.round + ' 轮）', '- 标题：' + (part.title || '(无)') + '\n- 声称证据：' + (part.evidence.length || 0) + ' 条')
+      return { ok: true, recorded: memberId, round: p.round }
+    }
+    async function paperRecordReview(memberId, raw) {
+      const p = paper()
+      if (!p || p.status !== 'reviewing') return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper flow is not in its cross-review stage (now: ' + (p ? p.status : 'none') + ')' }
+      if ((p.participants || []).indexOf(memberId) === -1) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: memberId + ' is not a review participant of this paper' }
+      if (raw.deliverable !== true && raw.deliverable !== false) {
+        await notice(memberId, 'paper_review.deliverable 必须是 true 或 false（你敢不敢交付？未表态不算可交付）。')
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'paper_review.deliverable must be a boolean' }
+      }
+      const assigned = (p.reviewOf || {})[memberId]
+      const rev = {
+        member: memberId, of: String(raw.of || assigned || ''), round: p.round,
+        deliverable: raw.deliverable === true,
+        comments: String(raw.comments || '').slice(0, 8000), at: now(),
+      }
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, { reviews: Object.assign({}, cur.reviews || {}, { [memberId]: rev }), updatedAt: now() }) : cur))
+      await paperLog('互审意见｜' + memberId + ' → ' + rev.of, '- deliverable：' + rev.deliverable + '\n- 意见：' + (rev.comments || '（无）').slice(0, 2000))
+      return { ok: true, recorded: memberId, of: rev.of, deliverable: rev.deliverable }
+    }
+    async function paperRecordFinal(memberId, raw) {
+      const p = paper()
+      if (!p || p.status !== 'awaiting-editor') return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper is not awaiting its editor (now: ' + (p ? p.status : 'none') + ')' }
+      if (p.editor !== 'academician' || memberId !== academicianId()) {
+        return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'paperEditor is "' + p.editor + '": the academician does not finalise this paper' }
+      }
+      const decision = String(raw.decision || '')
+      if (decision !== 'deliverable' && decision !== 'revise') {
+        await notice(memberId, "paper_final.decision 必须是 'deliverable' 或 'revise'（收到 " + decision + '）。')
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'decision must be deliverable|revise' }
+      }
+      const fin = { by: memberId, decision, note: String(raw.note || '').slice(0, 4000), conclusion: String(raw.conclusion || '').slice(0, 20000), at: now() }
+      if (decision === 'deliverable') {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, { final: fin, updatedAt: now() }) : cur))
+        return await finalizePaper('academician-deliverable')
+      }
+      if (p.round < PAPER_MAX_ROUNDS) {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          final: fin, status: 'writing', stage: 'writing', round: cur.round + 1, lastAskAt: {}, updatedAt: now(),
+          disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: [memberId], detail: '定稿代表要求修订：' + fin.note, at: now() }]),
+        }) : cur))
+        await paperLog('定稿代表要求修订 → 第 ' + (p.round + 1) + ' 轮', fin.note || '（未说明）')
+        return { ok: true, revised: true, round: p.round + 1 }
+      }
+      const warn = '定稿代表在第 ' + PAPER_MAX_ROUNDS + ' 轮上限仍要求修订；按规格记警告并定稿（分歧写入附录）。'
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+        final: fin, warnings: (cur.warnings || []).concat([warn]), forcedAfterCap: true, updatedAt: now(),
+        disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: [memberId], detail: '定稿代表要求修订：' + fin.note, at: now() }]),
+      }) : cur))
+      await paperLog('达到轮次上限：定稿代表仍要求修订', warn)
+      return await finalizePaper('academician-revise-at-cap')
+    }
+    // The office consultation gate (v2 §A6 / the user's requirement): the office may finalise
+    // ONLY after it has actually talked to the institute (>=1 office message) AND convened at
+    // least one meeting; both counts are recorded in the finalisation note and the meta.
+    async function finalizePaperByOffice(o) {
+      const args = o || {}
+      const p = paper()
+      if (!p) return { ok: false, code: 'V5_PAPER_STATE', message: 'no paper flow has been started (finish the run with finalPaper=true, or use /v5 paper)' }
+      if (p.status === 'finalized' && !args.force) {
+        const refill = await refillPaperArtifacts(p)
+        return { ok: true, alreadyFinalized: true, id: p.id, refill, autoDisabled: params.finalPaper === false, note: paperAutoNote() }
+      }
+      if (p.status !== 'awaiting-editor') {
+        return { ok: false, code: 'V5_PAPER_STATE', message: 'the paper flow is in stage "' + p.status + '"; the editor finalises only after every part is written and cross-reviewed' }
+      }
+      if (p.editor !== 'office') {
+        return { ok: false, code: 'V5_NOT_OFFICE', message: 'paperEditor="academician": the academician finalises from its own round; the office does not' }
+      }
+      const decision = String(args.decision || '')
+      if (decision !== 'deliverable' && decision !== 'revise') return { ok: false, code: 'V5_INVALID_ARGUMENT', message: "decision must be 'deliverable' or 'revise'" }
+      const note = String(args.note || '').trim()
+      if (decision === 'deliverable' && !note) {
+        return { ok: false, code: 'V5_INVALID_ARGUMENT', message: '定稿说明（note）是必填的：写明你如何与全所交流、商讨、优化、审查，以及结论' }
+      }
+      const consult = Object.assign({ messages: 0, meetings: 0 }, p.consult || {})
+      if (!(Number(consult.messages) > 0) || !(Number(consult.meetings) > 0)) {
+        return {
+          ok: false, code: 'V5_PAPER_CONSULT_REQUIRED',
+          message: 'paperEditor="office" 要求所办先与全所交流、商讨、优化、审查：至少 1 条所办消息（vibe_v5_message）+ 至少 1 次会议（vibe_v5_meeting），然后才能定稿。当前：messages=' +
+            Number(consult.messages || 0) + ', meetings=' + Number(consult.meetings || 0),
+          consult: { messages: Number(consult.messages || 0), meetings: Number(consult.meetings || 0) },
+        }
+      }
+      const fin = {
+        by: 'office', decision, note: String(note).slice(0, 4000),
+        conclusion: String(args.conclusion || '').slice(0, 20000),
+        consult: { messages: Number(consult.messages || 0), meetings: Number(consult.meetings || 0) },
+        at: now(),
+      }
+      if (decision === 'deliverable') {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, { final: fin, updatedAt: now() }) : cur))
+        return await finalizePaper('office-deliverable')
+      }
+      if (p.round < PAPER_MAX_ROUNDS) {
+        await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+          final: fin, status: 'writing', stage: 'writing', round: cur.round + 1, lastAskAt: {}, updatedAt: now(),
+          disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: ['office'], detail: '所办要求修订：' + fin.note, at: now() }]),
+        }) : cur))
+        await paperLog('所办要求修订 → 第 ' + (p.round + 1) + ' 轮', fin.note)
+        return { ok: true, revised: true, round: p.round + 1 }
+      }
+      const warn = '所办在第 ' + PAPER_MAX_ROUNDS + ' 轮上限仍要求修订；按规格记警告并定稿（分歧写入附录）。'
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+        final: fin, warnings: (cur.warnings || []).concat([warn]), forcedAfterCap: true, updatedAt: now(),
+        disagreement: (cur.disagreement || []).concat([{ round: cur.round, members: ['office'], detail: '所办要求修订：' + fin.note, at: now() }]),
+      }) : cur))
+      await paperLog('达到轮次上限：所办仍要求修订', warn)
+      return await finalizePaper('office-revise-at-cap')
+    }
+    // Count the office's consultation evidence. Called from the ONE place each act really
+    // happens (`say` for a message, `beginMeeting` for a meeting that actually starts), so the
+    // gate cannot be satisfied by merely intending to consult.
+    async function notePaperConsult(kind) {
+      const p = paper()
+      if (!p || p.status === 'finalized') return
+      const key = kind === 'meeting' ? 'meetings' : 'messages'
+      await mutatePaper((cur) => {
+        if (!cur || cur.status === 'finalized') return cur
+        const consult = Object.assign({ messages: 0, meetings: 0 }, cur.consult || {})
+        consult[key] = Number(consult[key] || 0) + 1
+        return Object.assign({}, cur, { consult, updatedAt: now() })
+      })
+    }
+
+    // ---- artifacts ---------------------------------------------------------
+    function paperEvidence() {
+      const s = inst()
+      const V = s.verdicts || {}
+      const keys = Object.keys(V)
+      const closed = (o) => keys.filter((k) => V[k] && V[k].closed && V[k].outcome === o)
+      const tasks = (s.tasks || []).filter((t) => t && t.status !== 'deleted')
+      const formal = formalRecords()
+      return {
+        s, V,
+        trueV: closed('true'), falseV: closed('false'), undecidedV: closed('undecided'),
+        openV: keys.filter((k) => V[k] && !V[k].closed),
+        tasks, done: tasks.filter((t) => t.status === 'completed'), openT: tasks.filter((t) => t.status !== 'completed'),
+        formal, formalKeys: Object.keys(formal),
+        members: s.members || [],
+      }
+    }
+    function verdictCardRel(kind, id) { return 'Verified/' + (kind === 'subproblem' ? '问题' : kind === 'method' ? '方法' : '命题') + '/' + id + '.md' }
+    function cardDirOf(kind) { return kind === 'method' ? 'Methods' : kind === 'subproblem' ? 'Subproblems' : 'Propos' }
+    function paperTitle(p) {
+      const st = String((inst().problem || {}).statement || '').trim()
+      const head = st ? st.split(/\n/)[0].slice(0, 100) : ''
+      return head || ('研究所成果论文｜' + p.id)
+    }
+    function paperSources(p, active, ev) {
+      const out = []
+      out.push('Problems/conclusion.md（结题记录）')
+      if ((inst().problem || {}).id) out.push('Problems/' + inst().problem.id + '.md（原问题卡）')
+      out.push('State/' + instituteName + '.v5state.json（权威状态）')
+      for (const k of ev.trueV.concat(ev.falseV)) out.push(verdictCardRel((ev.V[k] || {}).kind, k) + '（Verified 卡片）')
+      for (const k of ev.trueV.concat(ev.falseV)) out.push('Shared/Debates/' + k + '.md（辩论录）')
+      for (const k of ev.formalKeys) {
+        const r = ev.formal[k] || {}
+        if (r.file) out.push(r.file + '（Lean 工作文件）')
+        if (r.proof) out.push(r.proof + '（归档证明）')
+      }
+      if (ev.formalKeys.length) out.push('Formal/Index.md', 'Formal/TODO.md')
+      for (const m of ev.members) {
+        out.push('Members/' + m.id + '/Progress/progress.md（' + m.id + ' 的研究日志）')
+        out.push('Members/' + m.id + '/{Propos,Methods,Subproblems}/（' + m.id + ' 的卡片）')
+      }
+      out.push('Institutes.md（编制镜像）', 'Shared/TaskBoard.md（任务板镜像）')
+      out.push('Paper/' + p.id + '/paper.log.md（本论文流程往来）')
+      for (const id of active) {
+        const part = (p.parts || {})[id] || {}
+        for (const e of (part.evidence || [])) out.push(String(e) + '（' + id + ' 声称的证据）')
+      }
+      return Array.from(new Set(out))
+    }
+    function paperSections(p, active, skipped, ev, extra) {
+      const o = extra || {}
+      const fin = o.final || p.final || null
+      const prob = ev.s.problem || {}
+      const S = []
+      // 1
+      const b1 = []
+      b1.push({ p: '标题：' + paperTitle(p) })
+      b1.push({ ul: [
+        '作者：' + ((p.participants || []).map((id) => id + '（' + ((memberById(id) || {}).kind === 'academician' ? '院士' : '常驻研究员') + '）').join('、') || '（无在册作者）'),
+        '研究所：' + instituteName + '｜项目：' + project + '｜运行：' + (ev.s.runId || runId || '（无）'),
+        '日期：' + fmtTime(p.finalizedAt || now()).slice(0, 10) + '｜语言：' + p.lang + '｜定稿代表：' + p.editor,
+      ] })
+      const mainConclusions = ev.trueV.length
+        ? ('已由表决确立的结论：' + ev.trueV.join('、'))
+        : '尚无经表决确立为真的结论（见第 4、8 节）。'
+      b1.push({ p: '摘要：' + (prob.statement ? String(prob.statement).replace(/\s+/g, ' ').slice(0, 400) : '（未设定原问题）') + '。' + mainConclusions })
+      if (fin && fin.note) b1.push({ p: '定稿说明：' + fin.note + (fin.consult ? '（定稿前与全所交流：消息 ' + fin.consult.messages + ' 条、会议 ' + fin.consult.meetings + ' 次）' : '') })
+      if (fin && fin.conclusion) b1.push({ p: '定稿结论：' + fin.conclusion })
+      S.push({ title: PAPER_SECTIONS[0], blocks: b1 })
+      // 2
+      S.push({ title: PAPER_SECTIONS[1], blocks: [
+        { p: prob.statement ? String(prob.statement) : '（本所未记录原问题的完整陈述——请勿在论文中补写。）' },
+        { p: '问题 ID：' + (prob.id || '（无）') + '｜参与成员：' + (p.participants || []).join('、') },
+      ] })
+      // 3
+      const b3 = []
+      const solvers = active.filter((id) => String(((p.parts || {})[id] || {}).solution || '').trim())
+      if (solvers.length) {
+        for (const id of solvers) {
+          const part = (p.parts || {})[id] || {}
+          b3.push({ h: id + '｜' + String(part.title || '贡献') })
+          b3.push({ p: String(part.solution) })
+        }
+      } else {
+        b3.push({ p: '（参与成员未提交可引用的完整解法叙述；请以第 4 节的表决结论与证据索引为准。）' })
+      }
+      if (o.conclusionText) b3.push({ h: '结题记录（Problems/conclusion.md）' }, { p: String(o.conclusionText).slice(0, 4000) })
+      S.push({ title: PAPER_SECTIONS[2], blocks: b3 })
+      // 4
+      const b4 = []
+      if (ev.trueV.length) {
+        b4.push({ p: '以下对象经 m 票布尔一致判定为**真**（证据：Verified 卡片 + 辩论录）：' })
+        b4.push({ ul: ev.trueV.map((k) => {
+          const v = ev.V[k] || {}
+          return '**' + k + '**（判为真；平均概率 ' + Number(v.mean || 0).toFixed(2) + '；m=' + (v.m || '?') + '；表决者 ' + ((v.voters || []).join('、') || '?') +
+            '；证据：' + verdictCardRel(v.kind, k) + '；辩论：Shared/Debates/' + k + '.md；提出者：' + (v.proposer || '(office)') + '）'
+        }) })
+      } else b4.push({ p: '（没有经表决判定为真的命题。）' })
+      if (ev.falseV.length) {
+        b4.push({ p: '**已被否证（显式标注，不得当作结论使用）**：' })
+        b4.push({ ul: ev.falseV.map((k) => {
+          const v = ev.V[k] || {}
+          return k + '（判为假；平均概率 ' + Number(v.mean || 0).toFixed(2) + '；m=' + (v.m || '?') + '；证据：' + verdictCardRel(v.kind, k) + '）'
+        }) })
+      }
+      S.push({ title: PAPER_SECTIONS[3], blocks: b4 })
+      // 5
+      const b5 = []
+      const subV = ev.trueV.filter((k) => (ev.V[k] || {}).kind === 'subproblem')
+      if (subV.length) b5.push({ ul: subV.map((k) => '子问题 ' + k + '（已判定为真；证据：' + verdictCardRel('subproblem', k) + '）') })
+      if (ev.done.length) b5.push({ ul: ev.done.map((t) => '任务 ' + t.id + '：' + String(t.subject || '') + '（owner=' + (t.ownerId || '?') + '；镜像：Shared/TaskBoard.md）') })
+      if (!subV.length && !ev.done.length) b5.push({ p: '（没有已完成的子问题或任务被记录。）' })
+      S.push({ title: PAPER_SECTIONS[4], blocks: b5 })
+      // 6
+      const b6 = []
+      const methodParts = active.filter((id) => String(((p.parts || {})[id] || {}).methods || '').trim())
+      for (const id of methodParts) b6.push({ h: id + '｜' + String(((p.parts || {})[id] || {}).title || '') }, { p: String(((p.parts || {})[id] || {}).methods) })
+      if (!methodParts.length) b6.push({ p: '（参与成员未提交方法/理论/思想/经验/数学理解的叙述。）' })
+      S.push({ title: PAPER_SECTIONS[5], blocks: b6 })
+      // 7
+      const b7 = []
+      const ruleParts = active.filter((id) => String(((p.parts || {})[id] || {}).rules || '').trim())
+      for (const id of ruleParts) b7.push({ h: id + '｜' + String(((p.parts || {})[id] || {}).title || '') }, { p: String(((p.parts || {})[id] || {}).rules) })
+      if (!ruleParts.length) b7.push({ p: '（参与成员未归纳出可复用规律。）' })
+      S.push({ title: PAPER_SECTIONS[6], blocks: b7 })
+      // 8
+      const b8 = []
+      const limitParts = active.filter((id) => String(((p.parts || {})[id] || {}).limits || '').trim())
+      for (const id of limitParts) b8.push({ h: id }, { p: String(((p.parts || {})[id] || {}).limits) })
+      const unresolved = []
+      for (const k of ev.undecidedV) unresolved.push('未定论：' + k + '（平均概率 ' + Number((ev.V[k] || {}).mean || 0).toFixed(2) + '，m=' + ((ev.V[k] || {}).m || '?') + '）')
+      for (const k of ev.openV) unresolved.push('尚未裁决：' + k)
+      for (const t of ev.openT) unresolved.push('未完成任务：' + t.id + '｜' + String(t.subject || '') + '（' + t.status + '）')
+      for (const m of ev.members.filter((x) => x.phase === 'failed' || x.phase === 'dismissed')) unresolved.push('成员 ' + m.id + '：' + m.phase + (m.error ? '（' + String(m.error).slice(0, 120) + '）' : ''))
+      for (const id of skipped) unresolved.push('未交稿/未参与：' + id)
+      if (unresolved.length) b8.push({ p: '**未决与未参与（显式标注）**：' }, { ul: unresolved })
+      if ((p.warnings || []).length) b8.push({ p: '流程警告：' }, { ul: (p.warnings || []).map(String) })
+      if (!limitParts.length && !unresolved.length && !(p.warnings || []).length) b8.push({ p: '（无特别记录的局限。）' })
+      S.push({ title: PAPER_SECTIONS[7], blocks: b8 })
+      // 9
+      const b9 = [{ p: '以下路径均相对于研究所根目录（与 State/<institute>.v5state.json 同级）。' }]
+      b9.push({ ul: paperSources(p, active, ev) })
+      if ((p.disagreement || []).length) {
+        b9.push({ h: '分歧记录（未达成全体一致 / 定稿代表要求修订）' })
+        b9.push({ ul: (p.disagreement || []).map((d) => '第 ' + d.round + ' 轮｜' + (d.members || []).join('、') + '：' + String(d.detail || '')) })
+      }
+      if (skipped.length) b9.push({ p: '按“未参与”处理的成员：' + skipped.join('、') })
+      S.push({ title: PAPER_SECTIONS[8], blocks: b9 })
+      return S
+    }
+    function renderPaperMd(p, S) {
+      const L = ['# ' + paperTitle(p), '']
+      S.forEach((sec, i) => {
+        L.push('## ' + (i + 1) + '. ' + sec.title)
+        L.push('')
+        for (const b of sec.blocks) {
+          if (b.h) { L.push('### ' + b.h); L.push('') }
+          else if (b.p !== undefined) { L.push(String(b.p)); L.push('') }
+          else if (b.ul) { for (const it of b.ul) L.push('- ' + String(it)); L.push('') }
+        }
+      })
+      return L.join('\n')
+    }
+    const TEX_ESCAPES = { '\\': '\\textbackslash{}', '&': '\\&', '%': '\\%', '$': '\\$', '#': '\\#', '_': '\\_', '{': '\\{', '}': '\\}', '~': '\\textasciitilde{}', '^': '\\textasciicircum{}' }
+    function texEscape(s) { return String(s == null ? '' : s).replace(/[\\&%$#_{}~^]/g, (c) => TEX_ESCAPES[c]) }
+    function renderPaperTex(p, S) {
+      const zh = p.lang !== 'en'
+      const L = [
+        '\\documentclass[11pt]{' + (zh ? 'ctexart' : 'article') + '}',
+        '\\usepackage{amsmath,amssymb,amsthm}',
+        '\\usepackage[margin=2.5cm]{geometry}',
+        '\\usepackage[hidelinks]{hyperref}',
+        '\\usepackage{longtable,booktabs}',
+        '\\title{' + texEscape(paperTitle(p)) + '}',
+        '\\author{' + texEscape(((p.participants || []).join('、')) || (zh ? '研究所' : 'Institute')) + '}',
+        '\\date{' + texEscape(fmtTime(p.finalizedAt || now()).slice(0, 10)) + '}',
+        '\\begin{document}',
+        '\\maketitle',
+      ]
+      S.forEach((sec, i) => {
+        L.push('\\section{' + texEscape((i + 1) + '. ' + sec.title) + '}')
+        for (const b of sec.blocks) {
+          if (b.h) L.push('\\subsection{' + texEscape(b.h) + '}')
+          else if (b.p !== undefined) L.push(texEscape(b.p) + '\n')
+          else if (b.ul) { L.push('\\begin{itemize}'); for (const it of b.ul) L.push('\\item ' + texEscape(it)); L.push('\\end{itemize}') }
+        }
+      })
+      L.push('\\end{document}')
+      return L.join('\n') + '\n'
+    }
+    // The repair pass keeps only the packages the text itself needs (docs/final-paper.md §8):
+    // every optional or unknown package is dropped before the engine swap retry.
+    function texStripOptionalPackages(tex) {
+      return String(tex).split('\n').filter((line) => {
+        if (/^\s*\\(?:input|include)\b/.test(line)) return false
+        const m = /^\s*\\usepackage(?:\[[^\]]*\])?\{([^}]+)\}/.exec(line)
+        if (!m) return true
+        return m[1].split(',').map((x) => x.trim()).some((pk) => PAPER_REPAIR_CORE.indexOf(pk) !== -1)
+      }).join('\n')
+    }
+    function texMinimal(tex, lang) {
+      const body = String(tex).replace(/[\s\S]*?\\begin\{document\}/, '').replace(/\\end\{document\}[\s\S]*$/, '')
+      return '\\documentclass[11pt]{' + (lang === 'en' ? 'article' : 'ctexart') + '}\n\\begin{document}\n' + body.trim() + '\n\\end{document}\n'
+    }
+    function paperEngineCandidates(lang) {
+      const order = PAPER_ENGINE_ORDER[lang === 'en' ? 'en' : 'zh'].slice()
+      const forced = String(params.paperLatexCommand || '').trim()
+      if (!forced) return order
+      return [forced].concat(order.filter((n) => n !== forced))
+    }
+    async function latexEngines(lang) {
+      const sub = subprocessOf()
+      if (!sub || typeof sub.resolveExecutable !== 'function') {
+        return { engines: [], reason: '宿主没有 subprocess 服务：无法检测或调用 LaTeX' }
+      }
+      const engines = []
+      for (const name of paperEngineCandidates(lang)) {
+        try { const exe = await sub.resolveExecutable(name); if (exe) engines.push({ name: String(name), exe: String(exe) }) } catch (e) { /* not installed */ }
+      }
+      return { engines, reason: engines.length ? '' : ('未检测到 LaTeX 引擎（' + paperEngineCandidates(lang).join('/') + '）') }
+    }
+    // ONE engine invocation. NEVER throws: every failure becomes a readable result (the Lean
+    // seam's discipline) and a timeout really terminates the process.
+    async function runPaperProcess(argv, cwd) {
+      const sub = subprocessOf()
+      const started = now()
+      if (!sub || typeof sub.spawn !== 'function') return { ok: false, exitCode: null, ms: 0, message: 'no subprocess service' }
+      let handle
+      try {
+        handle = sub.spawn({ argv, cwd, stdio: { stdin: 'ignore', stdout: { maxBytes: 64 * 1024 }, stderr: { maxBytes: 64 * 1024 } }, graceMs: 120000 })
+      } catch (e) { return { ok: false, exitCode: null, ms: now() - started, message: String((e && e.message) || e) } }
+      let outcome = null
+      let timer = null
+      try {
+        const ran = Promise.resolve(handle.done).then((v) => ({ settled: true, value: v }), (e) => ({ settled: false, error: e }))
+        const r = await Promise.race([
+          ran,
+          new Promise((resolve) => {
+            timer = ctx.timeout(() => {
+              try { if (typeof handle.terminate === 'function') handle.terminate() } catch (e) { /* the race result is the report */ }
+              resolve({ settled: true, value: { exitCode: null, signal: 'SIGTERM' } })
+            }, 120000)
+          }),
+        ])
+        if (!r.settled) return { ok: false, exitCode: null, ms: now() - started, message: String((r.error && r.error.message) || r.error) }
+        outcome = r.value
+      } finally { if (timer) { try { timer() } catch (e) { /* already settled */ } } }
+      const exitCode = outcome ? outcome.exitCode : null
+      return { ok: exitCode === 0, exitCode, ms: now() - started, message: '' }
+    }
+    // Compile attempts are CAPPED (docs/final-paper.md §8): full → nonstopmode rerun → engine swap with
+    // the optional packages stripped → one minimal-template retry → report and degrade.
+    async function compilePaperTex(id, tex, lang) {
+      if (await fileExistsAbs(paperAbs(id, 'paper.pdf'))) {
+        return { status: 'kept-existing', engine: '', reason: 'Paper/' + id + '/paper.pdf 已存在：不覆盖（docs/final-paper.md §5）', attempts: [] }
+      }
+      const det = await latexEngines(lang)
+      if (!det.engines.length) return { status: 'not-detected', engine: '', reason: det.reason, attempts: [] }
+      const e0 = det.engines[0], e1 = det.engines[1] || e0
+      const plan = [
+        { label: 'full', engine: e0, text: tex, nonstopOnly: false },
+        { label: 'nonstopmode-rerun', engine: e0, text: tex, nonstopOnly: true },
+        { label: 'engine-swap+stripped', engine: e1, text: texStripOptionalPackages(tex), nonstopOnly: true },
+        { label: 'minimal-template', engine: e0, text: texMinimal(tex, lang), nonstopOnly: true },
+      ]
+      const attempts = []
+      for (const a of plan) {
+        const r = await runLatexAttempt(id, a)
+        attempts.push(r)
+        if (r.ok) return { status: 'compiled', engine: a.engine.name, attempts }
+      }
+      return { status: 'failed', engine: '', reason: '编译在 ' + attempts.length + ' 次尝试后仍失败（已保留 paper.tex 与 paper.md）', attempts }
+    }
+    async function runLatexAttempt(id, a) {
+      const dirRel = paperDirRel(id)
+      const dirAbs = instRoot() + '/' + dirRel
+      if (!await writeTextRel(dirRel + '/paper.tex', a.text)) {
+        return { label: a.label, engine: a.engine.name, ok: false, exitCode: null, ms: 0, message: 'tex 写入失败' }
+      }
+      const started = now()
+      const args = a.engine.name === 'tectonic'
+        ? ['-X', 'paper.tex']
+        : (a.nonstopOnly ? ['-interaction=nonstopmode', 'paper.tex'] : ['-interaction=nonstopmode', '-halt-on-error', 'paper.tex'])
+      const argv = [a.engine.exe].concat(args)
+      // TWO passes (docs/final-paper.md §8): the second resolves references/TOC. A failed first pass is not
+      // rerun — the retry PLAN is what varies the command, not a blind repeat.
+      const first = await runPaperProcess(argv, dirAbs)
+      if (!first.ok) return { label: a.label, engine: a.engine.name, ok: false, exitCode: first.exitCode, ms: now() - started, message: first.message || 'first pass failed' }
+      const second = await runPaperProcess(argv, dirAbs)
+      const pdf = await fileExistsAbs(paperAbs(id, 'paper.pdf'))
+      return { label: a.label, engine: a.engine.name, ok: second.ok && pdf, exitCode: second.exitCode, ms: now() - started, message: pdf ? (second.message || '') : '编译器没有产出 paper.pdf' }
+    }
+    function paperMeta(p, extra) {
+      const o = extra || {}
+      const active = paperActiveParticipants(p)
+      const skipped = (p.participants || []).filter((x) => active.indexOf(x) === -1)
+      return {
+        id: p.id,
+        dir: 'Paper/' + p.id + '/',
+        institute: instituteName, project, runId: inst().runId || runId || '',
+        problemId: (inst().problem || {}).id || '',
+        trigger: p.trigger,
+        finalizedAt: o.finalizedAt || (p.finalizedAt || now()),
+        language: p.lang, format: p.format, compilePdf: p.pdf === true,
+        editor: p.editor, editorNote: p.editorNote || '', editorFallback: !!p.editorFallback,
+        finalisation: p.final || null,
+        consultation: Object.assign({ messages: 0, meetings: 0 }, p.consult || {}),
+        participants: p.participants || [], skipped,
+        rounds: p.round, maxRounds: PAPER_MAX_ROUNDS,
+        parts: Object.keys(p.parts || {}).map((id) => ({ member: id, round: (p.parts[id] || {}).round, title: (p.parts[id] || {}).title || '', evidence: ((p.parts[id] || {}).evidence || []).length })),
+        reviews: Object.keys(p.reviews || {}).map((id) => ({ member: id, of: (p.reviews[id] || {}).of, round: (p.reviews[id] || {}).round, deliverable: (p.reviews[id] || {}).deliverable === true })),
+        disagreement: p.disagreement || [], warnings: o.warnings || p.warnings || [],
+        forcedAfterCap: !!p.forcedAfterCap,
+        sections: PAPER_SECTIONS.length,
+        compile: o.compile || { status: p.compile || 'unknown', engine: p.engine || '', attempts: [] },
+        params: {
+          finalPaper: params.finalPaper, paperFormat: params.paperFormat, paperLanguage: params.paperLanguage,
+          paperCompilePdf: params.paperCompilePdf, paperEditor: params.paperEditor, paperLatexCommand: params.paperLatexCommand,
+        },
+        files: o.files || [],
+      }
+    }
+    async function refillPaperArtifacts(p) {
+      const id = p.id
+      const active = paperActiveParticipants(p)
+      const skipped = (p.participants || []).filter((x) => active.indexOf(x) === -1)
+      const conclusionText = await readTextRel('Problems/conclusion.md')
+      const S = paperSections(p, active, skipped, paperEvidence(), { final: p.final, conclusionText })
+      const filled = []
+      if (p.format !== 'tex' && (await readTextAbs(paperAbs(id, 'paper.md'))) === undefined) {
+        if (await writeTextRel(PAPER_FILE(id, 'paper.md'), renderPaperMd(p, S))) filled.push('paper.md')
+      }
+      let tex = await readTextAbs(paperAbs(id, 'paper.tex'))
+      if (p.format !== 'md' && tex === undefined) {
+        tex = renderPaperTex(p, S)
+        if (await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)) filled.push('paper.tex')
+      }
+      if (p.format !== 'md' && p.pdf === true && !await fileExistsAbs(paperAbs(id, 'paper.pdf'))) {
+        const c = await compilePaperTex(id, tex || renderPaperTex(p, S), p.lang)
+        if (c.status === 'compiled') filled.push('paper.pdf')
+        // Same rule as finalizePaper: the delivered tex is always the canonical generated one.
+        if (tex !== undefined && tex !== null) await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)
+      }
+      if ((await readTextAbs(paperAbs(id, 'paper.meta.json'))) === undefined) {
+        if (await writeTextRel(PAPER_FILE(id, 'paper.meta.json'), JSON.stringify(paperMeta(p, { refilled: true }), null, 2) + '\n')) filled.push('paper.meta.json')
+      }
+      if ((await readTextAbs(paperAbs(id, 'paper.log.md'))) === undefined) {
+        await paperLog('重复触发：补写缺失产物', '- 本次补写：' + (filled.join('、') || '（无缺失）'))
+        filled.push('paper.log.md')
+      } else if (filled.length) {
+        await paperLog('重复触发：补写缺失产物', '- 本次补写：' + filled.join('、'))
+      }
+      return { filled }
+    }
+    async function finalizePaper(reason) {
+      const p = paper()
+      if (!p) return { ok: false, code: 'V5_PAPER_STATE', message: 'no paper flow' }
+      const id = p.id
+      const active = paperActiveParticipants(p)
+      const skipped = (p.participants || []).filter((x) => active.indexOf(x) === -1)
+      const ev = paperEvidence()
+      const conclusionText = await readTextRel('Problems/conclusion.md')
+      const finalizedAt = now()
+      const S = paperSections(p, active, skipped, ev, { final: p.final, conclusionText })
+      const files = []
+      if (p.format !== 'tex') {
+        if (await writeTextRel(PAPER_FILE(id, 'paper.md'), renderPaperMd(p, S))) files.push('paper.md')
+      }
+      let tex = ''
+      if (p.format !== 'md') {
+        tex = renderPaperTex(p, S)
+        if (await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)) files.push('paper.tex')
+      }
+      // `paperFormat=md` with `paperCompilePdf=true` must NOT warn about a missing tex: no tex
+      // was produced, so compilation is skipped silently (docs/final-paper.md §8).
+      let compile
+      if (p.format === 'md') compile = { status: 'skipped', engine: '', reason: 'paperFormat=md：未产出 tex，跳过编译', attempts: [] }
+      else if (p.pdf !== true) compile = { status: 'skipped', engine: '', reason: 'paperCompilePdf=false', attempts: [] }
+      else compile = await compilePaperTex(id, tex, p.lang)
+      // The repair attempts overwrite `paper.tex` with stripped/minimal variants to get past a
+      // broken engine. Whatever the compile outcome, the DELIVERED tex must be the real,
+      // fully-generated one (the attempts are recorded in the meta either way).
+      if (p.format !== 'md') await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)
+      if (await fileExistsAbs(paperAbs(id, 'paper.pdf'))) files.push('paper.pdf')
+      const warnings = (p.warnings || []).slice()
+      if (compile.status === 'failed') warnings.push('LaTeX 编译失败（已保留 paper.tex 与 paper.md，不阻塞定稿）：' + (compile.attempts || []).map((a) => a.engine + '/' + a.label + ' exit=' + a.exitCode + (a.message ? '(' + a.message + ')' : '')).join('；'))
+      if (compile.status === 'not-detected') warnings.push('未检测到 LaTeX 引擎（' + (compile.reason || '') + '）：只交付 paper.tex 与 paper.md。')
+      const meta = paperMeta(Object.assign({}, p, { finalizedAt, compile: compile.status, engine: compile.engine || '' }), {
+        finalizedAt, warnings, compile: { status: compile.status, engine: compile.engine || '', reason: compile.reason || '', attempts: compile.attempts || [] }, files,
+      })
+      if (await writeTextRel(PAPER_FILE(id, 'paper.meta.json'), JSON.stringify(meta, null, 2) + '\n')) files.push('paper.meta.json')
+      await paperLog('定稿（' + reason + '）', [
+        '- 目录：Paper/' + id + '/',
+        '- 产物：' + files.join('、'),
+        '- 编译：' + compile.status + (compile.engine ? '（' + compile.engine + '）' : '') + '｜尝试 ' + (compile.attempts || []).length + ' 次',
+        '- 定稿代表：' + p.editor + '｜轮次：' + p.round + '/' + PAPER_MAX_ROUNDS,
+        '- 所办交流：消息 ' + Number((p.consult || {}).messages || 0) + ' 条、会议 ' + Number((p.consult || {}).meetings || 0) + ' 次',
+        (p.final && p.final.note ? '- 定稿说明：' + p.final.note : ''),
+        (warnings.length ? '- 警告：\n  - ' + warnings.join('\n  - ') : ''),
+      ].filter(Boolean).join('\n'))
+      await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
+        status: 'finalized', stage: 'finalized', finalizedAt, compile: compile.status,
+        engine: compile.engine || '', warnings, artifacts: files, updatedAt: now(),
+      }) : cur))
+      await saveChatLine('【论文】最终论文已定稿：Paper/' + id + '/（' + (files.join('、') || '（无产物）') + '；编译 ' + compile.status + '）。')
+      notifyActivity()
+      // The run is only now complete (docs/final-paper.md §3): the paper phase ran BEFORE the flags.
+      if (p.completesRun && !autoDone) await finishRun('全体有表决权者一致认为原问题已解决')
+      return {
+        ok: true, finalized: true, id, dir: 'Paper/' + id + '/', files,
+        compile: compile.status, engine: compile.engine || '', attempts: (compile.attempts || []).length,
+        warnings, agreement: !(p.disagreement || []).length, rounds: p.round,
+      }
+    }
+
     // ---- hire / fire -------------------------------------------------------
     function employedTemps() { return activeMembers().filter((m) => m.kind === 'temp') }
     // ANY academician or permanently-employed researcher may hire its own temp
@@ -3623,7 +5543,13 @@ export function apply(ctx) {
     // activity wait, which costs no tokens while the institute is genuinely idle.
     function syncParamsFromState() {
       const cur = inst()
-      if (cur && cur.params) params = Object.assign({}, DEFAULT_PARAMS, cur.params)
+      // Same rule as the load path above: never adopt a persisted value without normalising it
+      // (a foreign-shaped state file must not leak straight into the runtime params).
+      if (cur && cur.params) {
+        const droppedSync = []
+        params = Object.assign({}, DEFAULT_PARAMS, normalizeParams(cur.params, droppedSync))
+        reportDroppedStateKeys(cur, droppedSync, 'restore-sync')
+      }
       if (cur && cur.project) project = cur.project
       if (cur && cur.institute) instituteName = cur.institute
       if (cur) phase = cur.phase || phase
@@ -3673,6 +5599,16 @@ export function apply(ctx) {
         await beginMeeting({ agenda: p.agenda, kind: p.kind, target: p.target, by: p.by })
         return
       }
+      // The final-paper phase (docs/final-paper.md §3) owns the room once it is active: a paper ask is its
+      // own kind of turn, and a research round must not be mistaken for a paper answer. While
+      // the flow waits for the OFFICE the institute keeps working normally — the required
+      // consultation needs office messages and a real meeting to be deliverable.
+      if (paperActive()) {
+        await paperPass()
+        const cur = paper()
+        const waitingForOffice = !!cur && cur.status === 'awaiting-editor' && cur.editor === 'office'
+        if (!waitingForOffice) return
+      }
       const budget = Math.max(1, Math.floor(Number(params.maxParallel) || 3))
       const idleMs = posMs(params.activityTimeoutMs, 120000)
       let filled = 0
@@ -3723,7 +5659,7 @@ export function apply(ctx) {
       const stallMs = posMs(params.stallAutoMeetingMs, 360000)
       if (!meeting && !pendingMeeting && !hasVerifyInFlight() && phase === 'active' &&
         busy.size === 0 && (now() - lastProgressAt) >= stallMs) {
-        await startMeeting('office', { agenda: '本所较长时间没有新进展。请你们自行讨论：现在最该推进的是什么？谁来做？是否需要发起验证？', kind: 'sync' })
+        await startMeeting('office', { agenda: '本所较长时间没有新进展。请你们自行讨论：现在最该推进的是什么？谁来做？是否需要发起验证？', kind: 'sync', auto: true })
         return
       }
       // (e) heartbeat: push the longest-idle member to make progress rather than just
@@ -3897,6 +5833,12 @@ export function apply(ctx) {
       }
       // (10) solve votes / personal judgement
       if (p.vote_solved !== undefined) await recordSolveVote(member.id, p.vote_solved === true)
+      // (10b) final-paper channels: the member's own part, a cross-review, or the editor's
+      // decision. Each is only honoured in the stage that asked for it (the record functions
+      // refuse otherwise), so a stray/stale field can never advance the paper.
+      if (p.paper_part && typeof p.paper_part === 'object') await paperRecordPart(member.id, p.paper_part)
+      if (p.paper_review && typeof p.paper_review === 'object') await paperRecordReview(member.id, p.paper_review)
+      if (p.paper_final && typeof p.paper_final === 'object') await paperRecordFinal(member.id, p.paper_final)
       // (11) meeting input collection (keyed on the LIVE member set, so a member who
       // joined mid-meeting still has to speak and a dismissed one stops blocking it)
       if (kind === 'meeting' && meeting) {
@@ -3952,6 +5894,9 @@ export function apply(ctx) {
       try { await maybeRealCompact(childId, member) } catch (e) { /* compaction is best-effort */ }
       wakeKind.delete(member.id)
       if (member.activeMeetingId) delete member.activeMeetingId
+      // The final-paper phase is driven by member turns, exactly like a meeting: the reply was
+      // just folded, so advance the paper BEFORE asking the (possibly inert) scheduler.
+      try { await paperPass() } catch (e) { console.error('vibe-math-v5: paper after end: ' + String((e && e.message) || e)) }
       await scheduleNext()
     }
     // ---- toolFilter names the host may not register -------------------------
@@ -4009,16 +5954,26 @@ export function apply(ctx) {
     }
 
     // ---- control plane -----------------------------------------------------
-    function normalizeParams(input) {
+    function normalizeParams(input, dropped) {
       const out = {}
-      const ints = ['researcherCount', 'quorumCap', 'verdictMaxRounds', 'maxTempPerMember', 'maxTempTotal',
+      // NOTE: new INT params go BEFORE the last two entries. The cross-preset
+      // prompt-invariants self-probe mutates the exact TAIL of this array (dropping
+      // leanTimeoutMs from the accept-set), so appending a key after it would silently
+      // disarm that guard.
+      const ints = ['leanJobsMaxParallel', 'mathTimeoutMs', 'researcherCount', 'quorumCap', 'verdictMaxRounds', 'maxTempPerMember', 'maxTempTotal',
         'compactThreshold', 'compactAfterRounds', 'maxParallel', 'activityTimeoutMs', 'stallAutoMeetingMs',
         'chatDigestMs', 'chatDigestMax', 'meetingKeepEvery', 'leanTimeoutMs']
-      const bools = ['academician', 'academicianLeads', 'memberMayRejectAssign']
-      const strs = ['quorumMode', 'provider', 'model', 'staffPersona', 'formalVerify', 'leanCommand']
-      const arrs = ['toolAllow', 'toolDeny', 'tempToolAllow', 'tempToolDeny', 'leanArgs']
+      const bools = ['academician', 'academicianLeads', 'memberMayRejectAssign', 'finalPaper', 'paperCompilePdf', 'leanAsync']
+      const strs = ['quorumMode', 'provider', 'model', 'staffPersona', 'formalVerify', 'leanCommand',
+        'paperFormat', 'paperLanguage', 'paperEditor', 'paperLatexCommand', 'leanInitiative',
+        'mathComputation', 'mathMode', 'mathInstallScope']
+      const arrs = ['toolAllow', 'toolDeny', 'tempToolAllow', 'tempToolDeny', 'leanArgs', 'leanSearchPaths',
+        'mathEngines', 'mathPackages']
       for (const k of ints) if (input[k] !== undefined) { const n = Math.floor(Number(input[k])); if (Number.isFinite(n)) out[k] = n }
-      for (const k of bools) if (input[k] !== undefined) out[k] = (input[k] === true || input[k] === 'true')
+      // Explicit boolean coercion (docs/final-paper.md §2): the old `=== true || === 'true'` turned a
+      // legitimate `1` / `'yes'` into FALSE and left junk values truthy-looking. An
+      // unrecognised spelling is REJECTED (the default wins) rather than guessed.
+      for (const k of bools) if (input[k] !== undefined) out[k] = coerceBool(input[k], false)
       for (const k of strs) if (input[k] !== undefined) out[k] = String(input[k])
       for (const k of arrs) {
         if (input[k] === undefined) continue
@@ -4032,6 +5987,44 @@ export function apply(ctx) {
         out.formalVerify = ['off', 'encourage', 'require'].indexOf(out.formalVerify) !== -1 ? out.formalVerify : 'off'
       }
       if (out.leanCommand !== undefined && !String(out.leanCommand).trim()) out.leanCommand = 'lean'
+      // `leanAsync` gets an EXPLICIT branch (not just the shared bool loop): the mode must be
+      // selected only by a real boolean (or the documented spellings) and an unknown value must
+      // keep the DEFAULT (true) — and the string 'false' must never survive as truthy.
+      if (input.leanAsync !== undefined) {
+        out.leanAsync = (input.leanAsync === true || input.leanAsync === false)
+          ? input.leanAsync
+          : coerceBool(input.leanAsync, DEFAULT_PARAMS.leanAsync)
+      }
+      // `leanInitiative` is a CLOSED enum (like quorumMode/formalVerify): a typo degrades to the
+      // documented default ('normal') rather than becoming an unreachable fourth mode.
+      if (out.leanInitiative !== undefined) {
+        out.leanInitiative = ['off', 'normal', 'eager'].indexOf(String(out.leanInitiative)) !== -1 ? String(out.leanInitiative) : 'normal'
+      }
+      // Concurrency floor, same discipline as quorumCap/verdictMaxRounds.
+      if (out.leanJobsMaxParallel !== undefined && out.leanJobsMaxParallel < 1) out.leanJobsMaxParallel = 1
+      // The six math_computation keys are normalised by the SHARED module (one implementation
+      // for all four presets — docs/math-computation.md): explicit enum/array/integer coercion,
+      // so a string 'false', an unknown engine name or a sub-1000 timeout can never leak
+      // through. ONLY the keys the caller actually passed are copied, so a partial update can
+      // never reset the others back to their defaults.
+      if (MATH_PARAM_NAMES.some((k) => input[k] !== undefined)) {
+        for (const k of MATH_PARAM_NAMES) {
+          if (input[k] === undefined) continue
+          // The typed loops above already coerced the SHAPE (a comma string became an array, an
+          // integer was floored); the module then applies the semantic rules (closed enums, known
+          // engines, >=1000 timeout). A value the module rejects falls back to its own default.
+          const src = out[k] !== undefined ? out[k] : input[k]
+          const norm = normalizeMathParams({ [k]: src })
+          const v = norm[k] !== undefined ? norm[k] : MATH_PARAM_DEFAULTS[k]
+          out[k] = Array.isArray(v) ? v.slice() : v
+        }
+      }
+      // ── final-paper enums (closed sets; an unknown value degrades to the documented
+      // default instead of silently becoming an unreachable fourth mode) ────────────────
+      if (out.paperFormat !== undefined) out.paperFormat = coercePaperEnum('paperFormat', out.paperFormat, ['both', 'md', 'tex'], 'both')
+      if (out.paperLanguage !== undefined) out.paperLanguage = coercePaperEnum('paperLanguage', out.paperLanguage, ['zh', 'en'], 'zh')
+      if (out.paperEditor !== undefined) out.paperEditor = coercePaperEnum('paperEditor', out.paperEditor, ['office', 'academician'], 'academician')
+      if (out.paperLatexCommand !== undefined) out.paperLatexCommand = String(out.paperLatexCommand).trim()
       // Guard every duration against a negative/NaN value: such a value would make a
       // watchdog fire instantly and abandon all consensus (v4 §30-T41).
       for (const k of ['activityTimeoutMs', 'stallAutoMeetingMs', 'chatDigestMs', 'leanTimeoutMs']) {
@@ -4048,13 +6041,44 @@ export function apply(ctx) {
       if (out.compactThreshold !== undefined && !(out.compactThreshold > 0)) delete out.compactThreshold
       if (out.chatDigestMax !== undefined && out.chatDigestMax < 1) out.chatDigestMax = 1
       if (out.verdictMaxRounds !== undefined && out.verdictMaxRounds < 1) out.verdictMaxRounds = 1
+      // round-4 item 2: an unknown key used to vanish with NO report (hand-edited state files).
+      // Never lose information silently: collect the accepted-key set's complement and hand it to
+      // the caller's collector (the restore/set sites turn it into a diagnostic + a warning).
+      if (dropped) {
+        const known = new Set(ints.concat(bools, strs, arrs))
+        for (const k of Object.keys(input || {})) if (!known.has(k)) dropped.push(k)
+      }
       return out
     }
+    // round-4 item 2: report keys a state file (or a caller) carried but the whitelist rejected.
+    // `stateObj` is the state the drop belongs to (the load site has it in hand); falls back to the
+    // live institute. Deduplicated so a repeated sync cannot spam the diagnostics.
+    function reportDroppedStateKeys(stateObj, dropped, where) {
+      const keys = Array.isArray(dropped) ? dropped.slice().sort() : []
+      if (!keys.length) return keys
+      const target = (stateObj && Array.isArray(stateObj.diagnostics)) ? stateObj : (inst() || null)
+      if (target && Array.isArray(target.diagnostics)) {
+        const last = target.diagnostics[target.diagnostics.length - 1]
+        const duplicate = !!(last && last.kind === 'state-dropped-keys' && JSON.stringify(last.keys) === JSON.stringify(keys))
+        // round-4 item 4: only a NEWLY recorded entry warns, and the record goes through the same
+        // retention as every other diagnostics writer in this preset (slice(-50)).
+        if (duplicate) return keys
+        target.diagnostics.push({ kind: 'state-dropped-keys', where: where, keys: keys })
+        while (target.diagnostics.length > 50) target.diagnostics.shift()
+      }
+      console.warn('vibe-math-v5: 忽略未知参数键（不静默丢失，已记入 diagnostics）：' + keys.join(', ') + '（来源：' + where + '）')
+      return keys
+    }
     async function setParams(input) {
-      const patch = normalizeParams(input || {})
+      const droppedSet = []
+      const patch = normalizeParams(input || {}, droppedSet)
+      reportDroppedStateKeys(inst(), droppedSet, 'set')
       const merged = Object.assign({}, params, patch)
       await patchInstitute({ params: merged })
       params = Object.assign({}, DEFAULT_PARAMS, merged)
+      // The math availability line is MODE-DEPENDENT (mathComputation/mathMode/mathEngines), so
+      // a tuning call must re-derive it immediately instead of leaving a stale line in prompts.
+      if (MATH_PARAM_NAMES.some((k) => patch[k] !== undefined)) await refreshMathLine()
       // An already-armed heartbeat keeps the delay it was armed with, so a lowered
       // activityTimeoutMs (or a raised maxParallel) would not take effect until some
       // unrelated event drove a pass. Tuning must apply immediately.
@@ -4076,6 +6100,17 @@ export function apply(ctx) {
         chatDigestMax: params.chatDigestMax, meetingKeepEvery: params.meetingKeepEvery,
         formalVerify: params.formalVerify, leanCommand: params.leanCommand,
         leanArgs: params.leanArgs, leanTimeoutMs: params.leanTimeoutMs,
+        leanAsync: params.leanAsync, leanInitiative: params.leanInitiative,
+        leanSearchPaths: params.leanSearchPaths, leanJobsMaxParallel: params.leanJobsMaxParallel,
+        // `visibleParams` is an EXPLICIT object (landing.md §3): a new key is invisible to
+        // `/v5 status` until it is added here.
+        mathComputation: params.mathComputation, mathMode: params.mathMode,
+        mathEngines: (params.mathEngines || []).slice(), mathTimeoutMs: params.mathTimeoutMs,
+        mathPackages: (params.mathPackages || []).slice(), mathInstallScope: params.mathInstallScope,
+        // ── final paper ──────────────────────────────────────────────────────
+        finalPaper: params.finalPaper, paperFormat: params.paperFormat,
+        paperLanguage: params.paperLanguage, paperCompilePdf: params.paperCompilePdf,
+        paperEditor: params.paperEditor, paperLatexCommand: params.paperLatexCommand,
         provider: params.provider, model: params.model,
         toolAllow: params.toolAllow, toolDeny: params.toolDeny,
       }
@@ -4318,6 +6353,11 @@ export function apply(ctx) {
       await saveChatLine('【恢复】研究所继续推进（重建成员 ' + respawned + ' 名）。')
       notifyActivity()
       await scheduleNext()
+      // An interrupted FINAL PAPER resumes its own stage (the paper phase runs before the
+      // completion flags, so a crash there leaves a live, resumable institute).
+      if (paperActive()) { try { await paperPass() } catch (e) { console.error('vibe-math-v5: paper after resume: ' + String((e && e.message) || e)) } }
+      // Leftover Lean jobs are re-driven (or explicitly interrupted) on the resume path too.
+      try { await recoverLeanJobs() } catch (e) { /* already reported on the ready() path */ }
       return { ok: true, resumed: true, members: members.map((m) => m.id), respawned, running: true }
     }
     function setPause() {
@@ -4388,12 +6428,16 @@ export function apply(ctx) {
           mode: formalMode(),
           objects: Object.keys(formalRecords()).map((k) => {
             const r = formalRecords()[k] || {}
-            return { target: k, status: r.status, file: r.file || '', proof: r.proof || '', note: r.note || '', run: r.run ? { ok: r.run.ok, exitCode: r.run.exitCode, ms: r.run.ms } : null }
+            return { target: k, status: r.status, file: r.file || '', proof: r.proof || '', note: r.note || '', run: r.run ? { ok: r.run.ok, exitCode: r.run.exitCode, ms: r.run.ms } : null, async: r.async || null }
           }),
           passed: Object.keys(formalRecords()).filter((k) => (formalRecords()[k] || {}).status === 'passed'),
           blocked: Object.keys(formalRecords()).filter((k) => (formalRecords()[k] || {}).status === 'blocked'),
           todo: formalTodo(),
         },
+        // The final-paper flow: stage, who wrote/reviewed what, the office-consultation
+        // counters and the compile result. Without this an operator cannot tell whether the
+        // run is waiting for the office, for a member, or for nobody.
+        paper: paperSummary(),
         lastProgressAt, params: visibleParams(),
       }
     }
@@ -4460,6 +6504,21 @@ export function apply(ctx) {
         L.push('- 可复用库：VibeMath/Formal/{Lib,Proved}/（跨项目）｜本所形式化：Formal/｜归档证明：Verified/Lean/')
       }
       L.push('')
+      L.push('## 最终论文')
+      {
+        const pp = paper()
+        if (!pp) L.push('- 尚未开始（' + (params.finalPaper === false ? '自动已关闭（finalPaper=false），可用 /v5 paper 手动生成' : '收口时会自动开始；也可用 /v5 paper 手动开始') + '）')
+        else {
+          L.push('- 目录：Paper/' + pp.id + '/｜状态：' + pp.status + '｜阶段：' + pp.stage + '｜轮次：' + pp.round + '/' + PAPER_MAX_ROUNDS)
+          L.push('- 定稿代表：' + pp.editor + (pp.editorFallback ? '（原定代表不在册，已回退）' : '') + '｜语言：' + pp.lang + '｜格式：' + pp.format)
+          L.push('- 交稿：' + (Object.keys(pp.parts || {}).join('、') || '（无）') + '｜互审：' + (Object.keys(pp.reviews || {}).map((k) => k + '→' + ((pp.reviews[k] || {}).of || '?') + (pp.reviews[k] && pp.reviews[k].deliverable === true ? '(可交付)' : '(需修改)')).join('、') || '（无）'))
+          L.push('- 所办交流：消息 ' + Number((pp.consult || {}).messages || 0) + ' 条｜会议 ' + Number((pp.consult || {}).meetings || 0) + ' 次')
+          if (pp.compile) L.push('- 编译：' + pp.compile + (pp.engine ? '（' + pp.engine + '）' : ''))
+          if ((pp.warnings || []).length) L.push('- 警告：' + pp.warnings.join('；'))
+          L.push('- 下一步：' + paperNextStep(pp))
+        }
+      }
+      L.push('')
       L.push('## 文件位置')
       L.push('- 根目录：' + instRoot())
       L.push('- 已确立：Verified/｜成员库：Members/<id>/｜群聊：Shared/Chat/｜会议：Shared/Meetings/｜辩论：Shared/Debates/')
@@ -4523,9 +6582,16 @@ export function apply(ctx) {
       // Lean formal verification (docs/formal-verification.md)
       formalMode, formalOn, formalRecords, formalTodo, formalOf, rebuildLeanLibIndexes,
       leanArchive, leanRunTool, writeFormalIndex, writeFormalTodo, recordFidelityDefect,
+      leanRead, leanJobTool, leanJobView, leanJobsView, leanSearchRootView, leanInitiative, leanDailyOn,
+      // math_computation (docs/math-computation.md)
+      refreshMathLine, mathLine: () => mathLineZh, mathSessionHost: () => mathSessionHost,
+      runLeanQueue, disposeLeanJobs, leanRecover: recoverLeanJobs,
+      leanQueueApi: async () => { await runLeanQueue(); return { jobs: leanJobsView(), notices: leanNotices.length } },
       leanRunToolApi: async (relPath, timeoutMs) => await leanRunFile(relPath, timeoutMs),
       // consensus / meetings
       maybeQueueVerify, castVerdict, currentVerify, hasVerifyInFlight, startMeeting, quorumM, voterCount,
+      // final paper (docs/final-paper.md; the phase runs BEFORE finishRun)
+      startPaper, paperStatus: paperSummary, finalizePaperByOffice,
       // authorization helpers (used by tool handlers)
       memberIdOfAgent, isOffice, isAcademician, isProvablyOffice, officeCaller, memberById, activeMembers,
     }
@@ -4568,6 +6634,54 @@ export function apply(ctx) {
     if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: ' + what + ' needs a resolved member id or the office (the session root)' }
     return fn(caller)
   }
+
+  // ================= math_computation registration (docs/math-computation.md) =================
+  // The SHARED module is instantiated PER CALLING SESSION, so every host callback closes over
+  // exactly one session's LIVE params/root/fs — there is NO ambient "current session" slot that
+  // a concurrent call from another session could overwrite (audit C: a single slot meant that
+  // while session A awaited a spawn, session B could take it over, and A's later
+  // params/writeText/projectRoot would silently be B's). The tool FACE is installed exactly once
+  // (the module's own contract: one `host.register` call per preset); the per-session instances
+  // are created lazily and their `register` callback is deliberately ignored.
+  // The module's tool NAME has no `vibe_` prefix on purpose (it is the same primitive in all
+  // four presets), and `projectRoot()` is the INSTITUTE root, so receipts land in
+  // <institute>/Computation/<runId>/.
+  let mathToolMeta = null              // { name, description, parameters } — the frozen face
+  const mathSessionHandlers = new WeakMap() // session API object -> that session's module handler
+  // The metadata instance: its callbacks are never invoked (its handler is never called), it
+  // exists only so the module can hand us the frozen tool face exactly once.
+  const mathMetaHost = {
+    register: (name, description, parameters) => { if (!mathToolMeta) mathToolMeta = { name, description, parameters } },
+    params: () => DEFAULT_PARAMS,
+    projectRoot: () => '.',
+    designator: 'vibe-math-v5',
+    writeText: async () => false,
+    readText: async () => undefined,
+    exists: async () => false,
+    resolveExecutable: async () => { throw new Error('metadata host') },
+    spawn: async () => null,
+    log: () => {},
+  }
+  registerMathComputation(mathMetaHost)
+  // Drift guard: the installed face must BE the shared frozen text (all four presets must ship
+  // the same description — a re-typed copy here would diverge silently).
+  if (!mathToolMeta || mathToolMeta.description !== MATH_TOOL_DESCRIPTION) {
+    console.error('vibe-math-v5: math_computation was registered with a description that is not MATH_TOOL_DESCRIPTION')
+  }
+  function mathHandlerFor(s) {
+    let handler = mathSessionHandlers.get(s)
+    if (!handler) {
+      // One instance per session: its host callbacks are the session's own seam.
+      const inst = registerMathComputation(s.mathSessionHost())
+      handler = inst && typeof inst.handler === 'function' ? inst.handler : async () => ({ ok: false, code: 'MATH_INVALID_ARGUMENT', message: 'math_computation: no session handler' })
+      mathSessionHandlers.set(s, handler)
+    }
+    return handler
+  }
+  if (mathToolMeta) {
+    registerTool(mathToolMeta.name, mathToolMeta.description, mathToolMeta.parameters,
+      (s, args) => mathHandlerFor(s)(args))
+  }
   /**
    * Resolve the caller of an OFFICE-ONLY control and refuse anything that is not the PROVABLE
    * session root. `officeCaller` answers 'office' for that root, a member id for a member child, and
@@ -4599,14 +6713,23 @@ export function apply(ctx) {
   registerTool('vibe_v5_stop', 'Stop the institute: interrupt every member, clear coordination state, and release their child sessions.', objParams({}), (s, a, x) => withOffice(s, x, 'stop the institute', () => s.initStop()))
   registerTool('vibe_v5_status', 'Machine-readable institute status (members, tasks, quorum, meetings, verification, mail).', objParams({}), (s) => s.status())
   registerTool('vibe_v5_report', 'Human-readable institute report (staffing, tasks, consensus, meetings, file locations).', objParams({}), (s) => s.report())
-  registerTool('vibe_v5_set', 'Tune institute parameters (persisted in State/<institute>.v5state.json). provider/model override staff LLM routes (empty = inherit the office route). toolAllow/toolDeny restrict PERMANENT staff tools; tempToolAllow/tempToolDeny restrict temp workers. quorumCap sets m = min(quorumCap, voters); an m-vote passes only when at least m Boolean votes (exactly 1 or exactly 0) exist AND no voter returns an opposing Boolean, so with the default roster it degenerates to unanimity among the current voters; only current voters count (a dismissed member\'s earlier ballot is dropped). quorumMode "m-unanimous" (v5) or "all-unanimous" (v4 legacy). formalVerify: "off" (default, no extra requirement) | "encourage" (agents decide by implementation difficulty whether to formalize in Lean; a passing Lean run turns the vote into a FIDELITY review of the Lean statements) | "require" (same, plus a gate: a true/false verdict is withheld as undecided until the object is Lean-passed or has an explicit reasoned blocker record).', objParams({
+  registerTool('vibe_v5_set', 'Tune institute parameters (persisted in State/<institute>.v5state.json). provider/model override staff LLM routes (empty = inherit the office route). toolAllow/toolDeny restrict PERMANENT staff tools; tempToolAllow/tempToolDeny restrict temp workers. quorumCap sets m = min(quorumCap, voters); an m-vote passes only when at least m Boolean votes (exactly 1 or exactly 0) exist AND no voter returns an opposing Boolean, so with the default roster it degenerates to unanimity among the current voters; only current voters count (a dismissed member\'s earlier ballot is dropped). quorumMode "m-unanimous" (v5) or "all-unanimous" (v4 legacy). formalVerify: "off" (default, no extra requirement) | "encourage" (agents decide by implementation difficulty whether to formalize in Lean; a passing Lean run turns the vote into a FIDELITY review of the Lean statements) | "require" (same, plus a gate: a true/false verdict is withheld as undecided until the object is Lean-passed or has an explicit reasoned blocker record). LEAN TOOLCHAIN: leanCommand names the Lean executable (e.g. "lake" with leanArgs ["env","lean"]); leanArgs are inserted before the file name (the framework appends --search-path <VibeMath root> unless leanArgs already sets one); leanTimeoutMs is the per-run budget in ms (>=1000, and the per-job budget of the async queue). FINAL PAPER: finalPaper (default true) writes the final paper when the run concludes — the paper phase runs BEFORE the run is marked complete, the permanent staff write their own part, cross-review each other, and the editor named by paperEditor finalises; paperFormat "both"|"md"|"tex"; paperLanguage "zh"|"en"; paperCompilePdf compiles a PDF when a LaTeX engine is detected; paperEditor "academician" (default, the only editor an unattended run can reach) | "office" (manual /v5 paper only — the office must first consult the whole institute: >=1 office message AND >=1 meeting, recorded in the finalisation note); paperLatexCommand forces one engine command instead of auto-detection (empty = auto: xelatex -> latexmk -> pdflatex -> lualatex -> tectonic, English prefers pdflatex). LEAN ASYNC: leanAsync (default true) compiles on a per-session background queue (vibe_v5_lean_run / vibe_v5_lean_archive run=true enqueue and return immediately; inspect them with vibe_v5_lean_job or vibe_v5_lean_lib.jobs and wait with vibe_v5_lean_job {jobId,waitMs}); leanAsync=false restores the previous synchronous behaviour. Only a settled job (exit 0, unchanged content hash AND the same build context) may mark an object passed; a job id is the content+build-context digest. leanInitiative "off"|"normal" (default)|"eager" separates DAILY eagerness about formalizing from formalVerify (which stays the verdict-time requirement). leanSearchPaths (string[]) adds extra --search-path roots before the automatic VibeMath root (deduped; an explicit --search-path/-R/--root in leanArgs wins). leanJobsMaxParallel (default 1) caps simultaneous background compiles. MATH COMPUTATION: mathComputation "off"|"auto" (default)|"on" gates the math_computation tool; mathMode "typed+shell" (default: the host shell may be used as a fallback, but a shell run carries no receipt and its conclusion must be marked 未经工具归档/not tool-archived) | "typed" (never mention the shell; engine=cli is refused); mathEngines lists the allowed engines (cli is on by default, SageMath is a later phase); mathTimeoutMs is the per-run budget (>=1000); mathPackages are packages a computation may require; mathInstallScope "user" (default) | "system" (per call only, never remembered). Installs are two-step (plan then confirm-token) and commercial engines are never installed. Unknown spellings of these enums fall back to the documented default.', objParams({
     academician: B, academicianLeads: B, memberMayRejectAssign: B, researcherCount: I,
     quorumCap: I, quorumMode: S, verdictMaxRounds: I,
     maxTempPerMember: I, maxTempTotal: I,
     compactThreshold: I, compactAfterRounds: I, maxParallel: I,
     activityTimeoutMs: I, stallAutoMeetingMs: I, chatDigestMs: I, chatDigestMax: I, meetingKeepEvery: I,
     formalVerify: { type: 'string', enum: ['off', 'encourage', 'require'] },
-    leanCommand: S, leanArgs: SA, leanTimeoutMs: I,
+    leanCommand: S, leanArgs: SA, leanTimeoutMs: I, leanAsync: B,
+    leanInitiative: { type: 'string', enum: ['off', 'normal', 'eager'] },
+    leanSearchPaths: SA, leanJobsMaxParallel: I,
+    mathComputation: { type: 'string', enum: ['off', 'auto', 'on'] },
+    mathMode: { type: 'string', enum: ['typed', 'typed+shell'] },
+    mathEngines: SA, mathTimeoutMs: I, mathPackages: SA,
+    mathInstallScope: { type: 'string', enum: ['user', 'system'] },
+    finalPaper: B, paperFormat: { type: 'string', enum: ['both', 'md', 'tex'] },
+    paperLanguage: { type: 'string', enum: ['zh', 'en'] },
+    paperCompilePdf: B, paperEditor: { type: 'string', enum: ['office', 'academician'] }, paperLatexCommand: S,
     provider: S, model: S, staffPersona: S, toolAllow: SA, toolDeny: SA, tempToolAllow: SA, tempToolDeny: SA,
   }), (s, a, x) => withOffice(s, x, 'tune institute parameters', () => s.setParams(a)))
   registerTool('vibe_v5_message', 'Relay a message from the office/human into the institute (to a member id, to "all", or to "voters").', objParams({ to: S, content: S }, ['to', 'content']), (s, a, x) => {
@@ -4651,6 +6774,16 @@ export function apply(ctx) {
       ? s.removeResearcher(a.id)
       : { ok: false, code: 'V5_NOT_OFFICE', message: 'only the office (the session root) may dismiss a permanent researcher' }
   )))
+  // ── final paper (docs/final-paper.md) ─────────────────────────────────────
+  registerTool('vibe_v5_paper', 'Final paper: start (or re-run) the team-authored paper for this run. The permanent staff write their own part, cross-review another member\'s part, and the editor named by paperEditor finalises. lang/format override paperLanguage/paperFormat for THIS paper; editor overrides paperEditor for THIS paper only (office = the manual path, which parks the flow until the office consults the institute and calls vibe_v5_finalize_paper); force rewrites an already-finalised paper (idempotent otherwise: it only fills artifacts that are missing).', objParams({ lang: S, format: S, editor: { type: 'string', enum: ['office', 'academician'] }, force: B, reason: S }), (s, a, x) => withOffice(s, x, 'write the final paper', () => {
+    const lang = a.lang === undefined ? undefined : String(a.lang)
+    const format = a.format === undefined ? undefined : String(a.format)
+    if (lang !== undefined && lang !== 'zh' && lang !== 'en') return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'lang must be zh|en' }
+    if (format !== undefined && ['both', 'md', 'tex'].indexOf(format) === -1) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'format must be both|md|tex' }
+    if (a.editor !== undefined && ['office', 'academician'].indexOf(String(a.editor)) === -1) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'editor must be office|academician' }
+    return s.startPaper(a.reason === 'run-complete' ? 'run-complete' : 'manual', { lang, format, editor: a.editor, force: a.force === true, reason: a.reason })
+  }))
+  registerTool('vibe_v5_finalize_paper', 'Office: finalise the final paper after consulting the whole institute. Required when paperEditor="office": at least one office message (vibe_v5_message) AND at least one meeting convened by the office must happen first (paper.meta.json records them, and the note must state the conclusion). decision="revise" asks for another writing round (bounded).', objParams({ decision: { type: 'string', enum: ['deliverable', 'revise'] }, note: S, conclusion: S, force: B }, ['decision']), (s, a, x) => withOffice(s, x, 'finalise the final paper', () => s.finalizePaperByOffice(a)))
 
   // ── member-facing controls ────────────────────────────────────────────────
   registerTool('vibe_v5_say', '(member) Speak in the group chat (omit "to"), send a private message ("to":"r-2"), or address only the voters ("to":"voters").', objParams({ text: S, to: S }, ['text']), (s, a, x) => {
@@ -4730,25 +6863,33 @@ export function apply(ctx) {
   // dynamic registration would depend on a runtime knob and break the effect discipline),
   // while the MODE only decides whether the framework TELLS members about them. In 'off'
   // mode they still work if a human or agent calls them deliberately.
-  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT, and a non-zero exit returns the compiler output. Pass target=<object id> to also record the run against that object.', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => withCaller(s, x, 'a Lean run', (caller) => s.leanRunTool(caller, a)))
-  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (when the run passes) also Verified/Lean/<target>.lean, marking the object Lean-passed. kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => withCaller(s, x, 'a Lean archive', (caller) => s.leanArchive(caller, a)))
-  registerTool('vibe_v5_lean_lib', '(member) List (and by default rebuild) the Lean reuse library: your institute\'s Formal/Index.md, plus the global cross-project Formal/Lib and Formal/Proved indexes. Look here BEFORE writing a new definition so you reuse instead of redefining.', objParams({ refresh: B }), async (s, a) => {
+  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. With leanAsync (default true) the compile is ENQUEUED and this returns immediately with async:{jobId,state} — nothing is compiled yet; inspect it via vibe_v5_lean_lib.jobs or wait for the next round\'s 【形式化结果】 line. With leanAsync=false it blocks and returns the compiler output (exitCode/stdout/stderr). Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT. Pass target=<object id> to also record the run against that object. The framework appends `--search-path <VibeMath root>` before the file name (unless leanArgs already sets a search root).', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => withCaller(s, x, 'a Lean run', (caller) => s.leanRunTool(caller, a)))
+  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (only once the queued compile settles ok) also Verified/Lean/<target>.lean, marking the object Lean-passed. Re-archiving IDENTICAL content is de-duplicated (deduped:true, no rewrite/recompile). kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => withCaller(s, x, 'a Lean archive', (caller) => s.leanArchive(caller, a)))
+  registerTool('vibe_v5_lean_lib', '(member) List (and by default rebuild) the Lean reuse library: your institute\'s Formal/Index.md (with an import-dependency column), plus the global cross-project Formal/Lib and Formal/Proved indexes, the background-compile jobs (jobs) and the injected search path (paths.searchPath). Look here BEFORE writing a new definition so you reuse instead of redefining.', objParams({ refresh: B }), async (s, a) => {
     const r = a && a.refresh === false ? { lib: null, proved: null, objects: Object.keys(s.formalRecords()).length } : await s.rebuildLeanLibIndexes()
     const st = s.status()
     return {
       ok: true, mode: s.formalMode(), rebuilt: !(a && a.refresh === false),
-      counts: r, todo: s.formalTodo(),
-      objects: Object.keys(s.formalRecords()).map((k) => ({ target: k, status: (s.formalRecords()[k] || {}).status, file: (s.formalRecords()[k] || {}).file, proof: (s.formalRecords()[k] || {}).proof, note: (s.formalRecords()[k] || {}).note })),
-      paths: { project: 'Formal/（相对研究所根）', lib: 'VibeMath/Formal/Lib/', proved: 'VibeMath/Formal/Proved/', proofs: 'Verified/Lean/' },
-      hint: '复用优先：先在 Lib/ 里找现成定义；新定义用 vibe_v5_lean_archive kind=\'def\' 归档，已证引理用 kind=\'lemma\'。',
+      counts: r, todo: s.formalTodo(), jobs: s.leanJobsView(),
+      objects: Object.keys(s.formalRecords()).map((k) => ({ target: k, status: (s.formalRecords()[k] || {}).status, file: (s.formalRecords()[k] || {}).file, proof: (s.formalRecords()[k] || {}).proof, note: (s.formalRecords()[k] || {}).note, async: (s.formalRecords()[k] || {}).async || null })),
+      paths: { project: 'Formal/（相对研究所根）', lib: 'VibeMath/Formal/Lib/', proved: 'VibeMath/Formal/Proved/', proofs: 'Verified/Lean/', searchPath: s.leanSearchRootView() },
+      hint: '复用优先：先在 Lib/ 里找现成定义；新定义用 vibe_v5_lean_archive kind=\'def\' 归档，已证引理用 kind=\'lemma\'。复用已归档内容：import Formal.Lib.<name> / import Formal.Proved.<name>，或用 vibe_v5_lean_read {name} 取原文逐字复制。同内容重复归档会自动去重。',
       verify: st.verify ? st.verify.target : null,
     }
   })
+  // Read-only: the EXACT text of an archived definition/lemma (docs/formal-verification.md §5.4).
+  // Only <VibeMath root>/Formal/{Lib,Proved}/<name>.lean is reachable; a path-shaped name is
+  // refused (never sanitised into a different file).
+  registerTool('vibe_v5_lean_read', '(member) Read one archived Lean file VERBATIM so it can be reused: name is the archived file name (no extension needed), kind is "auto" (Lib then Proved, default), "lib" or "proved". Returns {ok,name,file,kind,sha256,bytes,text,truncated} (text capped at 64KB). Only the global reusable library is reachable.', objParams({ name: S, kind: { type: 'string', enum: ['auto', 'lib', 'proved'] } }, ['name']), (s, a) => s.leanRead(a))
+  // Wait/observe the background compile queue (docs/formal-verification.md §7: no polling tool
+  // for the member's own turn — `waitMs` is a bounded internal wait, and the state is returned
+  // either way, so a member can also just check and continue).
+  registerTool('vibe_v5_lean_job', '(member) Inspect the background Lean compile queue. With no jobId it lists this session\'s jobs ({jobs,count,running,maxParallel}); with jobId it returns that job\'s state/exitCode, its receipt Formal/Jobs/<jobId>.json and, when it passed, the archived proof path. waitMs>0 waits up to that many milliseconds for a queued/running job to settle (it polls the queue instead of blocking the heartbeat) and otherwise returns the CURRENT state.', objParams({ jobId: S, waitMs: I }), (s, a) => s.leanJobTool(a))
 
   // ── /v5 slash command ────────────────────────────────────────────────────
   ctx.effect(() => commands.register({
     name: 'v5', description: 'control the Vibe Math V5 research institute',
-    input: { hint: '[configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set]' },
+    input: { hint: '[configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set|paper [lang=en] [format=tex] [editor=office] [force]]' },
     handler: async function (inv) {
       const s = getSession(inv && inv.agent)
       if (!s) return { kind: 'error', text: JSON.stringify({ ok: false, error: 'no session' }) }
@@ -4784,7 +6925,28 @@ export function apply(ctx) {
       else if (cmd === 'fire') r = await s.fire('office', { id: rest[0] || '', reason: rest.slice(1).join(' ') })
       else if (cmd === 'add') r = await s.addResearcher('office', rest.join(' '))
       else if (cmd === 'remove') r = await s.removeResearcher(rest[0] || '')
-      else if (cmd === 'set') {
+      else if (cmd === 'paper') {
+        // `/v5 paper [lang=en] [format=tex] [force] [editor=office|academician]`
+        const o = {}
+        let force = false
+        let bad = ''
+        for (const tok of rest) {
+          if (tok === 'force') { force = true; continue }
+          const eq = tok.indexOf('=')
+          if (eq <= 0) { bad = 'unknown paper argument: ' + tok; break }
+          const k = tok.slice(0, eq), v = tok.slice(eq + 1)
+          if (k === 'lang' || k === 'format' || k === 'editor') o[k] = v
+          else { bad = 'unknown paper option: ' + k + ' (use lang=zh|en format=both|md|tex editor=office|academician force)'; break }
+        }
+        if (!bad && o.lang !== undefined && o.lang !== 'zh' && o.lang !== 'en') bad = 'lang must be zh|en'
+        if (!bad && o.format !== undefined && ['both', 'md', 'tex'].indexOf(o.format) === -1) bad = 'format must be both|md|tex'
+        if (!bad && o.editor !== undefined && ['office', 'academician'].indexOf(o.editor) === -1) bad = 'editor must be office|academician'
+        if (bad) return { kind: 'error', text: JSON.stringify({ ok: false, code: 'V5_INVALID_ARGUMENT', message: bad }, null, 2) }
+        // `editor=office` is the manual path that uses the office as the finalising
+        // representative (docs/final-paper.md §7 — never reachable from an automatic run). One-shot: it
+        // does not rewrite the persisted `paperEditor`.
+        r = await s.startPaper('manual', { lang: o.lang, format: o.format, editor: o.editor, force })
+      } else if (cmd === 'set') {
         const upd = {}
         for (const tok of rest) {
           const eq = tok.indexOf('=')
@@ -4794,7 +6956,7 @@ export function apply(ctx) {
           upd[k] = Number.isFinite(n) && v !== '' ? n : (v === 'true' ? true : v === 'false' ? false : v)
         }
         r = await s.setParams(upd)
-      } else r = { ok: false, usage: 'configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set' }
+      } else r = { ok: false, usage: 'configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set|paper [lang=zh|en] [format=both|md|tex] [editor=office|academician] [force]' }
       // A business failure (the dispatch result's own ok:false) is a FAILED command: the host's
       // CommandResult union distinguishes success from error, and returning 'success' made a rejected
       // invocation look identical to a successful one (same fix as v2/v3).
@@ -4867,6 +7029,9 @@ export const __testHelpers = {
   parseReply,
   sanitizeToolFilter,
   registeredToolsFromError,
+  sha256Hex,
+  leanHashText,
+  leanHasSearchFlag,
 }
 
 function clamp01(v) { const n = Number(v); if (!Number.isFinite(n)) return 0.5; return Math.max(0, Math.min(1, n)) }
@@ -4889,6 +7054,32 @@ function slugify(s) {
   return t || ''
 }
 
+// Explicit parameter coercion (docs/final-paper.md §2). A boolean parameter spelled `'false'`, `0`, `'no'`
+// or `'off'` must be false — the old `=== true || === 'true'` silently treated `1`/`'yes'` as
+// false. An unrecognised spelling is REJECTED (the caller's default wins), never guessed.
+function coerceBool(v, def) {
+  if (v === undefined) return def
+  if (v === true || v === 1 || v === '1') return true
+  if (v === false || v === 0 || v === '0') return false
+  const t = String(v).trim().toLowerCase()
+  if (['true', 'yes', 'on', 'y', 't'].indexOf(t) !== -1) return true
+  if (['false', 'no', 'off', 'n', 'f', ''].indexOf(t) !== -1) return false
+  return def
+}
+
+// Enum coercion with legacy aliases (.v5 / older flat spellings) and a documented fallback.
+const ENUM_ALIASES = {
+  paperFormat: { markdown: 'md', latex: 'tex', texonly: 'tex', all: 'both' },
+  paperLanguage: { cn: 'zh', chinese: 'zh', 'zh-cn': 'zh', english: 'en', 'en-us': 'en' },
+  paperEditor: { root: 'office', host: 'office', acad: 'academician', dean: 'academician' },
+}
+function coercePaperEnum(key, v, allowed, def) {
+  const t = String(v == null ? '' : v).trim().toLowerCase()
+  if (allowed.indexOf(t) !== -1) return t
+  const alias = (ENUM_ALIASES[key] || {})[t]
+  return alias !== undefined && allowed.indexOf(alias) !== -1 ? alias : def
+}
+
 function tryJson(s) { try { return JSON.parse(s) } catch (e) { return undefined } }
 
 function parseReply(text) {