dsh-vibe-math 2.6.0 → 2.7.0

package/vibe-math-v5//345/256/236/347/216/260/346/226/271/346/241/210.md

@@ -1197,7 +1197,74 @@ Progress/，不要从头再来"，**不得**复用 `【入职首轮】` 与"你
 `handle.terminate()`（存在才调）再返回 `LEAN_TIMEOUT`——只给 `graceMs` 是"请求"而非保证，
 runaway 的编译器会在框架已经报告超时之后继续存活；`done` 先到则释放计时器，不泄漏。
 
-**测试**：`formal-verify-v5.test.mjs`（138 断言，含 `defect` 的端到端路径：降级 + 撤回归档证明 +
+**异步编译队列（`leanAsync`，`docs/formal-verification.md` §7 + 修订）**：默认开启。`lean_run` /
+`lean_archive{run:true}` 只**入队**并把控制权还给成员（工具返回 `async:{jobId,state:'queued'}`，
+此时编译器进程尚未启动）；队列按会话串行（`leanJobsMaxParallel`，默认 1），每个作业预算 =
+既有 `leanTimeoutMs`，超时先 `terminate()`。作业镜像到 `Formal/Jobs/<jobId>.json`，
+`jobId = <target|name>-<sha(内容+引擎+归一化 argv+搜索路径)[0:12]>`——**构建上下文进哈希**，
+入队后改过 `leanArgs`/`leanSearchPaths` 的编译不会结算该作业。结算只在
+`settled(ok)`（exit 0 **且**内容哈希未变**且**构建上下文一致）时才允许置 `passed` 并写
+`Verified/Lean/<id>.lean`；其余一律 `attempted`（`timeout`/`interrupted`/`failed` 三态另记）。
+驱动点 = 既有心跳（`armHeartbeat` 回调先 `runLeanQueue()` 再 `scheduleNext()`，与调度器独立）+
+入队时的 0ms kick；会话 dispose（apply 层 `ctx.effect` 的 disposer）会 `terminate()` 在飞进程并把
+作业标为 `interrupted`。崩溃恢复在 `ready()`/`resume` 扫 `Formal/Jobs/*.json`：`running` 且内容
+未变 ⇒ 重新入队（旧结果不可知），内容已变 ⇒ 只标 `attempted` 且**不自动重驱**；只有
+exitCode 0 且哈希一致的记录才允许补归档。成员可用 `vibe_v5_lean_job {jobId?,waitMs?}`（无
+`jobId` 列本会话作业；`waitMs>0` 在工具内轮询队列，不阻塞心跳）或 `vibe_v5_lean_lib.jobs` 查结果；
+未公告的结算结果会作为一行注入该成员**下一次**提示词（一次性）。
+
+**搜索路径（修订 §2）**：每次 spawn 在**用户 `leanArgs` 之后、文件名之前**追加
+`leanSearchPaths`（按用户给的顺序，去重）再追加自动的 **绝对** VibeMath 根；用户 `leanArgs` 里
+已有 `--search-path`/`-R`/`--root` 时**不注入**（显式优先）。编译 `cwd` 仍是研究所根，所以注入
+的是绝对路径。模块根 = VibeMath 根 ⇒ 复用写 `import Formal.Lib.<name>` / `Formal.Proved.<name>`。
+
+**主动性（`leanInitiative`，修订 §1）**：与 `formalVerify` 分工——后者只决定**验证时**的要求强度，
+`leanInitiative` 决定**日常**主动性：`off` 不注入日常形式化提醒；`normal`（默认）沿用今天的分工
+（提醒随 `formalVerify`）；`eager` 即使 `formalVerify='off'` 也注入，并要求主动把有价值的小引理/
+命题/定义存库。工具面新增只读 `vibe_v5_lean_read {name,kind?}`（逐字读回归档文件，只允许
+`Formal/{Lib,Proved}` 下的 `.lean`，名字过 `idSafe` 且拒绝路径形状，64KB 截断）与
+`vibe_v5_lean_job`；`vibe_v5_lean_lib` 返回 `jobs` 与 `paths.searchPath`；`lean_archive` 同内容
+重复归档按内容哈希去重（`deduped:true`），Lib/Proved 索引新增**依赖**列（扫 `^\s*import\s+`）。
+
+**测试**：`e2e-v5-round2.test.mjs` 第 34–41 段新增 53 条断言，覆盖本节的每一条纪律：闭集 schema +
+`leanAsync:'false'` 归一化 + `leanInitiative` 回退 + `leanJobsMaxParallel` 地板 + `leanSearchPaths`
+顺序；"入队即返回且编译器尚未启动"；`settled(ok)` 才 `passed`（并写出 `Verified/Lean/`）；
+失败/超时（`terminate`）/dispose（`interrupted`）**都不算通过**；内容哈希去重（proof 与全局库）；
+`lean_read` 逐字返回 + 路径形状拒绝；**构建上下文**（入队后改 `leanArgs`）与**内容改变**都不结算；
+`leanJobsMaxParallel=1` 串行 / 抬到 2 后才并发；`leanInitiative` 对日常提醒的开关与验证段文案。
+变异证明：M1（结算忽略构建上下文/哈希）⇒ 3 红、M2（默认 `leanInitiative='eager'`）⇒ 1 红、
+M3（结算忽略内容哈希）⇒ 2 红、M4（入队即 `passed`）⇒ 3 红，控制组 288/0 绿。
+`formal-verify-v5.test.mjs`（157 断言）显式把 `leanAsync:false` 钉在 `foundInstitute` 上，
+因此它继续逐字验证**同步**路径；`prompt-v5-integrity.test.mjs`（510 断言）同样显式钉住同步路径
+并把新增的日常/验证段文案写进语料。
+### 14.8 数学计算 `math_computation`（共享模块接线）
+
+工具核心是**四套字节一致**的共享模块 `vibe-math-v5/math-computation.js`（+ `math-engines.js`），
+由 integration owner 维护；本预设只做**接线**（`INTERFACE-FREEZE.md` §5）：
+`DEFAULT_PARAMS` 六键取自 `MATH_PARAM_DEFAULTS`（数组 `slice()` 复制）、`normalizeParams` **逐键**交给
+`normalizeMathParams`（先由 v5 的类型数组定型，再由模块做闭集枚举/已知引擎/≥1000 的判定，未知值回退模块默认；
+**只复制调用者真正传的键**，避免局部调参把其它键重置）、闭集 `vibe_v5_set` schema 与 `visibleParams` 都显式含六键、
+`mkdirs()` 建 `Computation/`、`hint`/`usage` **不动**（P1 §5.7）。
+`registerMathComputation(host)` 只调用**一次**（v5 单层 `registerTool`），host 回调按**调用会话**解析：
+`params: () => mathActiveSession.params()`（活引用）、`projectRoot: () => instRoot()`（**研究所根** ⇒ 回执落
+`<研究所>/Computation/<runId>/`）、`writeText/readText/exists` 接既有 `writeTextRel/readTextRel` 并在本层复检
+`../`（纵深防御）、`spawn` 走既有 `subprocess` seam：`stdio.maxBytes = max(64KB, 模块给的 cap)`（**不预截断**，
+完整输出由模块落盘、返回体截 64KB）、超时 race + `handle.terminate()`，拿不到句柄返回 `null`
+（模块映射 `MATH_NO_SUBPROCESS`）。同一会话的 math 调用在插件层**串行化**，避免两个会话在模块 await 期间互相
+覆盖"当前会话"。
+提示词面：可用性行**在构造提示词那一刻**由 `probeMathEngines`(缓存) + `mathAvailabilityLine(probe,'zh',mathMode)`
+现算（写入 `normalPrompt`/`checkpointPrompt`/`initialPrompt`/`meetingPrompt`/`verifyPrompt` 的 `mathPushLine`），
+`mathComputation='off'` 时**零提及**；`mathMode='typed'` 时模块不追加 shell 兜底句（守卫按
+`MATH_RULE_LINES[0]`/`MATH_RULE_LINES_EN[0]` 做漂移检查，`MATH_TOOL_DESCRIPTION` 在注册后校验）；
+persona **两处**文本块含 `MATH_PERSONA_TOOL_LINE`（工具数 +1）。**测试**：
+`tests/math-computation-v5.test.mjs`（83 断言，假引擎经 `subprocess` seam 注入；覆盖六参数/闭集/visibleParams、
+probe 命中与缺引擎指引、三种 mode 的 argv 装配与回执路径、缺包不执行、商业许可、超时 terminate、非零退出、
+200KB 截断但落盘完整、路径越界拒绝、cli 默认开与两种禁用、bad-argv 不折叠、安装 plan→confirm 与作用域、
+"无 subprocess 返回 `MATH_NO_SUBPROCESS`"、提示词/persona 面）+ 5 个 mutant（M1 visibleParams 丢六键、M2 闭集丢六键、
+M3 绕过 `normalizeMathParams`、M4 `projectRoot` 改成 workspace 根、M5 提示词行被删）全部变红；
+`tests/audit-math-computation-{parity,contract}.mjs` 里 v5 项全绿。
+
+**历史**：`formal-verify-v5.test.mjs`（138 断言，含 `defect` 的端到端路径：降级 + 撤回归档证明 +
 进待办 + `require` 档不定论；"注入文本不得出现缩写工具名"；"超时路径真的调用 `terminate()`"；
 "宿主没有 `subprocess` 服务时返回 `NO_SUBPROCESS` 且代码仍能写下来归档"；`encourage` 档的
 弃权措辞），fake-Lean 通过 `subprocess` 服务注入，因此不需要真的装 Lean；
@@ -1310,7 +1377,10 @@ tex 只用 §5 允许的常见宏包，转义 `_ % & # $ { } ~ ^ \`。
 |---|---|---|
 | `vibe_v5_lean_run` | `{ file, target?, timeout_ms? }` | 在 `subprocess` 服务上执行 Lean，返回 `{ok, exitCode, ms, command, stdout, stderr}`。绝不抛异常：宿主没有 `subprocess` 服务 → `NO_SUBPROCESS`，缺工具链 → `LEAN_NOT_FOUND`，**超时 → 先 `handle.terminate()` 再返回 `LEAN_TIMEOUT`**，文件不存在 → `V5_NOT_FOUND`，路径越界或非 `.lean` → `V5_INVALID_ARGUMENT`。给了 `target` 就把这次运行记到该对象上 |
 | `vibe_v5_lean_archive` | `{ kind, name?, target?, content?, from?, note?, run? }` | `kind='def'/'lemma'` → 归档到**全局** `VibeMath/Formal/{Lib,Proved}/`；`kind='proof'` → 写 `Formal/<target>.lean`，运行通过则同时写 **`Verified/Lean/<target>.lean`** 并把对象标为 `passed`；`kind='blocked'` → 记录显式难度判断/阻塞原因（`note` 必填） |
-| `vibe_v5_lean_lib` | `{ refresh? }` | **重建并返回**三处索引（本所 `Formal/Index.md`、全局 `Lib/Index.md`、`Proved/Index.md`）与逐对象形式化状态；写新定义前先查重、直接复用 |
+| `vibe_v5_lean_lib` | `{ refresh? }` | **重建并返回**三处索引（本所 `Formal/Index.md`、全局 `Lib/Index.md`、`Proved/Index.md`）与逐对象形式化状态；索引含**依赖**列（import 扫描），另返回 `jobs`（本会话后台编译）与 `paths.searchPath`；写新定义前先查重、直接复用 |
+| `vibe_v5_lean_read` | `{ name, kind?('auto'\|'lib'\|'proved') }` | **只读**：逐字返回归档文件原文（`{ok,name,file,kind,sha256,bytes,text,truncated}`，64KB 截断）；只允许 `VibeMath/Formal/{Lib,Proved}/<name>.lean`，名字拒绝路径形状 |
+| `vibe_v5_lean_job` | `{ jobId?, waitMs? }` | **只读**：无 `jobId` 返回本会话作业清单；有则返回该作业的 state/exitCode/回执路径 `Formal/Jobs/<jobId>.json` 与（已通过时的）归档路径；`waitMs>0` 在工具内轮询队列最多等该毫秒数，超时返回当前 state |
+| `math_computation` | `{ op, engine?, mode?, code?, file?, expr?, packages?, timeoutMs?, captureFiles?, record?, cli?, scope?, dryRun?, confirm? }` | 共享模块（`./math-computation.js`，四套字节一致）注册的**引擎无关数学计算原语**（§14.8）：`op:'probe'` 探测引擎/包/许可 → `op:'run'`（`mode=code\|file\|expr`）计算并把脚本+输出+**实际 argv** 归档成 `Computation/<runId>/receipt.json`（相对**研究所根**）；`op:'receipt'` 幂等补写回执；`op:'install'` 两步（计划 → `confirm` token）。`engine:'cli'` 默认开（有回执/有上限，区别于宿主裸 shell）；商业引擎只探测不安装 |
 
 > 这四项工具是"以院士为中心"的机制落点。它们**只影响工作安排，绝不影响求真**——院士无法借此让任何对象进入 `Verified/`。
 
@@ -1399,7 +1469,17 @@ Lean 工具另外会返回**非错误码**的失败原因（都属于"可读结
 | `formalVerify` | `'off'` | **Lean 形式化验证开关**（§14.6）：`'off'` 不额外要求（默认）｜`'encourage'` 鼓励（按实现难度自行决定，做了就归档）｜`'require'` 强制（真/假定论前必须有 Lean 通过或显式阻塞记录，否则记为未定论并进入形式化待办）。非法值一律回退 `'off'`——**绝不回退到更强的模式** |
 | `leanCommand` | `'lean'` | 要执行的 Lean 可执行文件（例：`'lake'`） |
 | `leanArgs` | `[]` | 插在文件名之前的附加参数（例：`['env','lean']` 配合 `lakeCommand='lake'`） |
-| `leanTimeoutMs` | `120000` | 单次 Lean 运行的上限（<1000 会被抬到 1000） |
+| `leanTimeoutMs` | `120000` | 单次 Lean 运行的上限（<1000 会被抬到 1000）；异步队列里也是**每个作业**的预算 |
+| `leanAsync` | `true` | **后台编译队列**（§14.6）：`true` = `lean_run`/`lean_archive{run:true}` 入队即返回（`async:{jobId,state}`），心跳驱动、`settled(ok)` 才 `passed`；`false` = 完全回到同步 `await`。只接受真布尔或文档拼写，`'false'` 不得为真值 |
+| `leanInitiative` | `'normal'` | **日常主动性**（与 `formalVerify` 分工）：`off` 不注入日常形式化提醒｜`normal` 沿用今天（提醒随 `formalVerify`）｜`eager` 即使 `formalVerify='off'` 也注入并要求主动形式化有价值的小引理/命题/定义。非法值回退 `'normal'` |
+| `leanSearchPaths` | `[]` | 额外搜索根：注入在用户 `leanArgs` 之后、自动 VibeMath 根之前，去重；`leanArgs` 已有 `--search-path`/`-R`/`--root` 时不注入（显式优先） |
+| `leanJobsMaxParallel` | `1` | 同时运行的后台编译数（<1 抬到 1；1 = 串行） |
+| `mathComputation` | `'auto'` | **数学计算工具开关**（§14.8）：`'off'` 工具整体不可用（`MATH_NOT_AVAILABLE` + 开启提示，提示词**零提及**）｜`'auto'`（默认）｜`'on'`；默认值与归一化都取自共享模块 `./math-computation.js` |
+| `mathMode` | `'typed+shell'` | 提示词策略（插件**无法强制**宿主 shell，见 R9）：`'typed+shell'` 允许 shell 兜底但结论必须标注"未经工具归档"｜`'typed'` 不出现 shell 兜底句，且 `engine='cli'` 返回 `MATH_REFUSED` |
+| `mathEngines` | 8 项 | 允许引擎 `python,r,octave,julia,matlab,maple,wolfram,cli`（cli **默认开**，SageMath 属 P2）：未知引擎被丢弃；移除 `cli` 即禁用该逃生口 |
+| `mathTimeoutMs` | `60000` | 单次计算预算（<1000 抬到 1000） |
+| `mathPackages` | `[]` | 本次要求存在的包/工具箱（缺包只报告并出安装计划，**不自动装**） |
+| `mathInstallScope` | `'user'` | 安装作用域 `'user'`（默认）｜`'system'`（**每次显式给出、永不记忆**）；商业引擎永不代装 |
 | `finalPaper` | `true` | **最终论文**（§14.7）：收口时自动撰写；`false` = 自动关闭（手动 `/v5 paper` 仍可用并在返回里说明）。未知拼写显式拒绝（回退默认） |
 | `paperFormat` | `'both'` | `both`｜`md`｜`tex`（`paperFormat=md` 时不产出 tex，编译静默跳过） |
 | `paperLanguage` | `'zh'` | `zh`（ctexart，xelatex 优先）｜`en`（article，pdflatex 优先） |

package/vibe-math-v5//346/236/266/346/236/204/345/233/276.md

@@ -1,5 +1,11 @@
 # Vibe Math V5 架构图
 
+> **状态说明（round-3 补记）**：本文是**设计期文档**，写于 `math_computation`（数学计算工具）、
+> `leanAsync`/`leanJobsMaxParallel`/`leanSearchPaths`（Lean 异步作业与复用）、`paperEditor` 与
+> `paper.lock.json`（最终论文定稿/写锁）等新功能之前；**功能与参数的权威描述以 `docs/` 为准**
+> （`docs/math-computation.md`、`docs/formal-verification.md`、`docs/final-paper.md`、`docs/test-timing.md`），
+> 参数表以 README 的双语「共用参数 / 各预设专属参数」表为准。本文保留其原始设计意图，不再逐条追平。
+
 > 本文件是 v5 的图源（GitHub 上 Mermaid 会**原生渲染**）。总览大图另有一张生成好的
 > **SVG**：[`../示例图/框架图-v5.svg`](../示例图/框架图-v5.svg)，由
 > [`../docs/generate_framework_diagram_v5.mjs`](../docs/generate_framework_diagram_v5.mjs) 生成
@@ -440,3 +446,248 @@ flowchart LR
 | 解雇是真实的（释放子会话、收回任务） | `selfdrive-v5.mjs` |
 | 跨进程恢复不丢研究所 | `e2e-v5-round2.test.mjs` |
 | 每条不变式都有能让套件变红的探针 | `audit-v5-sensitivity.mjs` + [`../docs/AUDIT-CHECKLIST.md`](../docs/AUDIT-CHECKLIST.md) |
+
+
+---
+
+## 13. 从 README 移入的 v5 说明（原文保留）
+
+> 本节内容原先在 README / README.en.md 的「Vibe Math V5（研究所体系）」小节里。为让 README 中四套架构的篇幅均衡，
+> 这些段落移入本文件（README 只保留一句话摘要与指向本节的链接）。**文字未改写，仅在此保留**；
+> 其中与本篇 §1–§12 重叠的部分是刻意保留的原文，便于对照。
+
+### 13.1 中文原文（原 README.md）
+
+#### 职位与职权
+
+| 职位 | 代号 | 表决权 | 职权 |
+|---|---|---|---|
+| **院士**（领头人） | `acad` | ✅ 一票，**与他人等重** | **组织与协调中心**：建立全所视图（`overview`）、把原问题拆解成任务并**分派**（`assign`）、设定优先级（`prioritize`）、召集并主持会议（`convene`）、督导进度（`nudge`）、调配临时工、对外汇报。**不能单方面定论**，也不能自我扩张编制。 |
+| **常驻研究员** | `r-<n>` | ✅ 一票 | 在自己的方向上深入钻研；**可自主雇佣/解雇自己的临时工**；向院士汇报进展、接受其组织与分派（**有据理反对权**）。 |
+| **临时工** | `t-<n>` | ❌ | 为特定任务临时雇入：可读/可想/可发言/可写自己的成果库/可认领或被分派任务；由**雇主或院士**解雇。代号永不复用。 |
+| **所办**（主助手） | —— | ❌ | **不参与研究、不投票**。只汇报、把人的话翻译成工具调用，并代持平台要求的创建权（建所/增聘常驻研究员）。 |
+
+**分工一句话**：**组织由院士负责，但判断属于每个人自己** —— 院士分派的是**工作**，不是**结论**。
+
+#### 求真规则（V5 的核心）
+
+一个对象进入 `Verified/` 必须**同时**满足：
+
+1. 至少有 **m = min(`quorumCap`, 在册有表决权人数)** 名有表决权者投出**布尔概率值**；
+2. 这些票**全部**是 `1`（绝对为真）或**全部**是 `0`（绝对为假）。
+
+票是 `[0,1]` 的数值：**严格介于 0 与 1 之间 = 弃权/存疑**（不计入 m，但计入全组平均概率）。
+**任何一张反向布尔票都会阻塞定论** —— 少数派无法靠别人弃权把结论推过去。
+未达门槛的对象**留在原库**，并附上全组平均概率与完整辩论录，**不强行裁决**。
+
+表决两段式：先【独立初评】（彼此不可见），未定论再进入【公开辩论】后重投，轮次上限 `verdictMaxRounds`。
+`quorumMode: "all-unanimous"` 可切回 v4 的"全体一致"口径。
+
+#### 运行机制
+
+- **通信**：群聊（扇出给每位其他成员）、私信、只投给有表决权者；消息**逐收件人持久化**，
+  先落盘再投递，群聊按 `chatDigestMs` / `chatDigestMax` 合批摘要（私信/会议/表决不合批）。
+  一切所内通信都经框架中继（DSH 的邻接限制不允许成员之间直接发消息），但**署名始终是真实发送者**。
+- **会议与验证互斥**（双向）：验证进行中会议请求会**暂存**；会议进行中提出的验证会**排队**——
+  两个共识过程永不同时进行，避免互相饿死看门狗时钟。会议按**随机发言序**逐个收集意见，
+  收口时汇总表决并检查是否全体认为已解决。
+- **任务板**：compare-and-set（改前必须读到最新 `expected_revision`）+ 依赖 DAG（认领前必须全部依赖已完成，
+  环检测拒绝坏依赖）+ 写范围重叠告警；owner 被解雇时任务自动收回。
+- **雇佣 / 解雇**：院士与常驻研究员都可雇**自己的**临时工，配额按人（`maxTempPerMember`）与全所
+  （`maxTempTotal`）双限；解雇是**真实的**——取消在途回合、释放常驻子会话、收回任务、丢弃未投递邮件。
+- **活性**：主驱动是**一次性活动等待**（`vibe_v5_wait`，不轮询）；调度器按优先级推进
+  （进行中的会议/验证 → 队列中的验证 → 暂存会议 → 在办任务 → 加急邮件 → 群聊摘要 → 停滞自动开会 → 兜底心跳），
+  并发受 `maxParallel` 闸门限制；任务板的"推一把"按 `activityTimeoutMs` **节流**。
+- **看门狗**：会议/验证超过 2×`activityTimeoutMs` 没有新发言/新票 → 放弃它并回到自组织；
+  心跳**每次唤醒后都重新武装**，所以调度器不会永久冻结。
+- **上下文**：达 `compactThreshold`（%）或累计 `compactAfterRounds` 轮时要求成员把工作状态浓缩进
+  `Progress/`；**规章在 persona 里**，压缩后依然有效，不需要每轮重申。
+- **停止**：**仅当全体有表决权者都认为原问题已解决**才结题（写 `Problems/conclusion.md`）。
+
+#### 状态与持久化
+
+研究所状态只写在**研究所目录下的加固 JSON** `State/<研究所>.v5state.json` 里：框架的副作用只是把 11 类事件
+交给 `applyV5Event` 纯折叠成状态，再把整份快照**串行落盘**（每条序列化链只服务一个文件）。因此
+
+- **零 token 成本**：这些事件**不进模型上下文**，不占成员的对话预算；
+- **恢复走同一条代码路径**：跨进程重启与同进程 abort 后 resume 都靠"读前必 load"，两条路径是同一段代码；
+- v4 的 `State/*.json` 直写带来的"损坏静默覆盖 / 并发丢写 / 跨进程陈旧快照"这一整类问题在构造上被消除。
+
+**v5 不再把研究所事件写进宿主会话日志**：DSH 的会话持久化遇到日志里不认识的事件类型会**拒绝加载整个会话**
+（除非写入方标记 `ignorable: true`，而 `Session.append` 无法设置该字段），那会让**你自己的会话在下次恢复时打不开**。
+除状态文件之外的文件（成员成果库、群聊、会议纪要、辩论录、编制镜像、任务板镜像）都是**人可读产物**，
+手工改坏不会破坏研究所。
+
+#### 提示词是怎么构成的
+
+成员的"人设"（persona）承载**十节公共规章**（编制与同事、通用规章、资料库与 progress 格式、
+组织与协调、表决规则、每轮节奏、雇佣解雇、任务板、上下文纪律、停止条件），在**入职时冻结**并随会话持久化；
+每轮提示词只携带短小的**状态块**（我是谁 / 轮次 / m / 在册名单 / 我的任务 / 新到的消息）、**本轮问句**
+和**回执契约**。回执契约里框架真正处理的每个字段都会出现并按职位裁剪
+（临时工没有 `verdict`/`hire`/`fire`；非院士没有 `assign`/`prioritize`/`nudge`/`convene_meeting`）。
+
+框架把"成员读到的文字"当作产品来保证：身份**显式传递、绝不猜测**；成员**先落盘进编制、再构造**它的入职
+提示词；章程快照冻结在入职时，会话重建会框为 `【会话重建】` 而不是"刚入职"；没有院士时不出现任何院士叙事；
+消息框头按**真实来源**标注（所办分派 ≠ 院士分派；督办 ≠ 分派）；框架反馈有独立发送者，
+且**一次提示词只投递一条消息**。
+
+#### 目录结构（研究所）
+
+```
+<会话工作区>/VibeMath/Projects/<项目>/Institutes/<研究所>/
+├─ Institutes.md                 # 编制镜像（人读快照，勿手改）
+├─ Problems/<id>.md              # 原问题
+├─ Problems/conclusion.md        # 结题记录
+├─ Members/<代号>/
+│   ├─ Progress/progress.md      # 研究日志（压缩后恢复状态的主要依据）
+│   ├─ Propos/<id>.md            # 命题
+│   ├─ Methods/<id>.md           # 方法 / 理论 / 工具
+│   └─ Subproblems/<id>.md       # 子问题
+├─ Shared/
+│   ├─ Chat/<日期>.md            # 群聊记录
+│   ├─ Meetings/<mt-id>.md       # 会议纪要（含表决小节）
+│   ├─ Debates/<对象>.md         # 辩论录（各轮票与理由 + 平均概率）
+│   ├─ TaskBoard.md              # 任务板镜像
+│   └─ State-of-institute.md     # 成员对"是否已解决"的判断快照
+├─ Verified/<类型>/<id>.md       # 定论（只读；只有它能被当作已确立）
+└─ State/README.md               # 说明"这里的文件是镜像，请勿手改"
+```
+
+#### 工具面
+
+| 谁 | 工具 |
+|---|---|
+| **所办 / 人** | `vibe_v5_configure`（先配置）→ `vibe_v5_start`（开工）；`vibe_v5_resume` / `pause` / `stop`；`vibe_v5_set`（调参，立即生效）；`vibe_v5_status` / `report` / `members`；`vibe_v5_message` / `meeting`；`vibe_v5_hire` / `fire` / `add_researcher` / `remove_researcher`；斜杠命令 `/v5` |
+| **全体成员** | `vibe_v5_say`（群聊/私信/致全体表决者）、`vibe_v5_wait`（免轮询等待）、`vibe_v5_record_progress`、`vibe_v5_record_proposition` / `_method` / `_subproblem`、`vibe_v5_read_library`（跨读他人库，只读）、`vibe_v5_propose_verify`、`vibe_v5_verdict`、`vibe_v5_task_create` / `_list` / `_get` / `_update`、`vibe_v5_meeting`（提议） |
+| **院士**（另有 `academicianLeads` 开关） | `vibe_v5_overview`（全所视图）、`vibe_v5_assign`（分派，须写明理由与验收标准）、`vibe_v5_prioritize`、`vibe_v5_nudge` |
+
+#### 与 v4 的关键差异
+
+- **有领头人**：v4 无中央调度、一切靠讨论涌现；v5 在**所内**设有院士负责组织与分派
+  （**框架仍然绝不指派**——指派者是院士，同样受 m 票约束）。
+- **求真门槛从"全体一致"改为"≥ m 一致"**（可切回 v4 口径）。
+- **状态存于研究所目录下的加固 JSON** `State/<研究所>.v5state.json`（串行写、读前必 load）：恢复就是"读之前先 load"（见上）。
+- **三类职位 + 可雇用的临时工**：编制是可变的，雇佣/解雇是真实的可逆操作。
+- **不引入任何 npm 实验包**：v5 是 preset 内的单个 `.js` 文件，零依赖。
+- **会议与验证严格互斥**（双向排队）。
+
+详见 [`vibe-math-v5/实现方案.md`](vibe-math-v5/实现方案.md)（文字规格）与
+[`vibe-math-v5/架构图.md`](vibe-math-v5/架构图.md)（全部细节图）。
+
+### 13.2 English original (moved from README.en.md)
+
+#### Positions and Authority
+
+| Position | Codename | Voting right | Authority |
+|---|---|---|---|
+| **Academician** (leader) | `acad` | ✅ one vote, **of equal weight with others** | **Center of organization and coordination**: build an institute-wide overview (`overview`), decompose the original problem into tasks and **assign** them (`assign`), set priorities (`prioritize`), convene and chair meetings (`convene`), supervise progress (`nudge`), move temp workers around, report outward. **Cannot unilaterally conclude**, and cannot expand the roster on its own. |
+| **Resident researcher** | `r-<n>` | ✅ one vote | Digs deep in its own direction; **may autonomously hire/fire its own temp workers**; reports progress to the academician and accepts its organization and assignments (**has the right of reasoned objection**). |
+| **Temp worker** | `t-<n>` | ❌ | Hired temporarily for a specific task: can read/think/speak/write its own output library/claim or be assigned tasks; fired by its **employer or the academician**. Codenames are never reused. |
+| **Institute office** (main assistant) | —— | ❌ | **Does not take part in research and does not vote.** Only reports, translates the human's words into tool calls, and holds on the human's behalf the creation rights the platform requires (creating an institute / adding resident researchers). |
+
+**Division of labor in one sentence**: **organization is the academician's responsibility, but judgment belongs to each person individually** —— what the academician assigns is **work**, not **conclusions**.
+
+#### Truth Rules (the core of V5)
+
+For an object to enter `Verified/` it must **simultaneously** satisfy:
+
+1. At least **m = min(`quorumCap`, number of registered voting members)** voting members cast a **Boolean probability value**;
+2. These votes are **all** `1` (absolutely true) or **all** `0` (absolutely false).
+
+A vote is a numeric value in `[0,1]`: **strictly between 0 and 1 = abstention/doubt** (not counted toward m, but counted in the group's average probability).
+**Any single opposing Boolean vote blocks a conclusion** —— the minority cannot push a conclusion through by having others abstain.
+An object that falls short of the threshold **stays in its original library**, with the group's average probability and the complete debate record attached, and is **not forcibly ruled on**.
+
+Voting has two stages: first [independent initial assessment] (mutually invisible), and if undecided, then [open debate] followed by a re-vote, with a round cap of `verdictMaxRounds`.
+`quorumMode: "all-unanimous"` switches back to v4's "all-unanimous" standard.
+
+#### Operating Mechanisms
+
+- **Communication**: group chat (fanned out to every other member), direct message, votes cast only to members with voting rights; messages are **persisted per recipient**,
+  written to disk before delivery, and group chat is batched into digests by `chatDigestMs` / `chatDigestMax` (direct messages/meetings/votes are not batched).
+  All in-institute communication goes through the framework relay (DSH's adjacency restriction does not allow members to message each other directly), but **the signature is always the real sender**.
+- **Meetings and verification are mutually exclusive** (in both directions): meeting requests while verification is under way are **held**; verification requested while a meeting is under way is **queued** ——
+  the two consensus processes never run at the same time, avoiding mutual starvation of the watchdog clocks. Meetings collect opinions one by one in a **random speaking order**,
+  and at closing they aggregate the votes and check whether everyone considers the problem solved.
+- **Task board**: compare-and-set (the latest `expected_revision` must be read before a change) + dependency DAG (all dependencies must be complete before claiming;
+  cycle detection rejects bad dependencies) + write-scope overlap warnings; when an owner is fired, its tasks are automatically reclaimed.
+- **Hiring / firing**: both academicians and resident researchers can hire **their own** temp workers, with a dual quota per member (`maxTempPerMember`) and institute-wide
+  (`maxTempTotal`); firing is **real** —— it cancels in-flight turns, releases the resident sub-session, reclaims tasks, and discards undelivered mail.
+- **Liveness**: the main drive is a **one-shot activity wait** (`vibe_v5_wait`, no polling); the scheduler advances by priority
+  (in-progress meetings/verification → queued verification → held meetings → active tasks → urgent mail → group chat digest → auto-meeting on stall → fallback heartbeat),
+  and concurrency is gated by `maxParallel`; the task board's "nudge" is **throttled** by `activityTimeoutMs`.
+- **Watchdog**: if a meeting/verification goes beyond 2×`activityTimeoutMs` with no new speech/new votes → abandon it and return to self-organization;
+  the heartbeat is **re-armed after every wake**, so the scheduler never freezes permanently.
+- **Context**: upon reaching `compactThreshold` (%) or accumulating `compactAfterRounds` rounds, members are asked to condense their working state into
+  `Progress/`; **the charter lives in the persona**, remains in effect after compaction, and does not need to be restated every round.
+- **Stopping**: the problem is concluded (**writing `Problems/conclusion.md`**) **only when all voting members consider the original problem solved**.
+
+#### State and Persistence
+
+Institute state is written **only** to the **hardened JSON file** `State/<institute>.v5state.json` under the institute directory: the framework's only side effect is to hand 11 kinds of events to
+`applyV5Event`, which purely folds them into a state, and then to write that whole snapshot **serially to disk** (one serialization chain per file). Therefore
+
+- **Zero token cost**: these events **do not enter the model context** and do not consume members' conversation budget;
+- **Recovery takes the same code path**: both cross-process restarts and resume after an in-process abort are covered by the "mandatory load before read", which is the same code either way;
+- the whole class of problems caused by v4's direct writes to `State/*.json` — "corrupted silent overwrite / concurrent lost writes / stale cross-process snapshots" — is eliminated by construction.
+
+**v5 no longer writes institute events into the host session log**: DSH's session persistence **refuses to load an entire session** whose log carries an event type it does not know
+(unless the writer marked it `ignorable: true`, and `Session.append` cannot set that field) — which would make **your own session unopenable on the next resume**.
+Everything except the state file (member output libraries, group chat, meeting minutes, debate records, roster mirror, task board mirror) is a **human-readable artifact**,
+and breaking it by hand does not damage the institute.
+
+#### How the Prompt Is Composed
+
+A member's "persona" carries the **ten-section public charter** (roster and colleagues, general rules, knowledge base and progress format,
+organization and coordination, voting rules, per-round rhythm, hiring and firing, task board, context discipline, stopping conditions), which is **frozen at onboarding** and persists with the session;
+each round's prompt carries only a short **state block** (who I am / the round / m / the registered roster / my tasks / newly arrived messages), **this round's question**,
+and the **receipt contract**. Every field in the receipt contract that the framework actually handles appears, trimmed by position
+(temp workers have no `verdict`/`hire`/`fire`; non-academicians have no `assign`/`prioritize`/`nudge`/`convene_meeting`).
+
+The framework treats "the text a member reads" as a product to be guaranteed: identity is **passed explicitly and never guessed**; a member is **written to the roster first, and only then** are its onboarding
+prompts constructed; the charter snapshot is frozen at onboarding, and a session rebuild is framed as the literal marker `【会话重建 —— <role> <id>】` ("session rebuild") rather than "just onboarded"; no academician narrative appears when there is no academician;
+message headers are labeled by **true origin** (institute office assignment ≠ academician assignment; supervision ≠ assignment); framework feedback has its own sender,
+and **only one message is delivered per prompt**.
+
+#### Directory Structure (Institute)
+
+```
+<session workspace>/VibeMath/Projects/<project>/Institutes/<institute>/
+├─ Institutes.md                 # roster mirror (human-readable snapshot, do not edit by hand)
+├─ Problems/<id>.md              # original problem
+├─ Problems/conclusion.md        # conclusion record
+├─ Members/<codename>/
+│   ├─ Progress/progress.md      # research log (the main basis for restoring state after compaction)
+│   ├─ Propos/<id>.md            # proposition
+│   ├─ Methods/<id>.md           # method / theory / tool
+│   └─ Subproblems/<id>.md       # subproblem
+├─ Shared/
+│   ├─ Chat/<date>.md            # group chat log
+│   ├─ Meetings/<mt-id>.md       # meeting minutes (including the voting section)
+│   ├─ Debates/<object>.md       # debate record (each round's votes and reasons + average probability)
+│   ├─ TaskBoard.md              # task board mirror
+│   └─ State-of-institute.md     # snapshot of members' judgment on "whether it is solved"
+├─ Verified/<type>/<id>.md       # conclusion (read-only; only this can be treated as established)
+└─ State/README.md               # explains that "the files here are mirrors — do not hand-edit them"
+```
+
+#### Tool Surface
+
+| Who | Tools |
+|---|---|
+| **Institute office / human** | `vibe_v5_configure` (configure first) → `vibe_v5_start` (start work); `vibe_v5_resume` / `pause` / `stop`; `vibe_v5_set` (adjust parameters, effective immediately); `vibe_v5_status` / `report` / `members`; `vibe_v5_message` / `meeting`; `vibe_v5_hire` / `fire` / `add_researcher` / `remove_researcher`; slash command `/v5` |
+| **All members** | `vibe_v5_say` (group chat/direct message/to all voters), `vibe_v5_wait` (poll-free wait), `vibe_v5_record_progress`, `vibe_v5_record_proposition` / `_method` / `_subproblem`, `vibe_v5_read_library` (cross-read others' libraries, read-only), `vibe_v5_propose_verify`, `vibe_v5_verdict`, `vibe_v5_task_create` / `_list` / `_get` / `_update`, `vibe_v5_meeting` (propose) |
+| **Academician** (also has the `academicianLeads` switch) | `vibe_v5_overview` (institute-wide overview), `vibe_v5_assign` (assignment, must state the reason and acceptance criteria), `vibe_v5_prioritize`, `vibe_v5_nudge` |
+
+#### Key Differences from v4
+
+- **There is a leader**: v4 has no central scheduling and everything emerges from discussion; v5 has an academician responsible for organization and assignment **inside the institute**
+  (**the framework still never assigns** —— the assigner is the academician, who is likewise bound by the m votes).
+- **The truth gate changes from "all-unanimous" to "≥ m unanimous"** (switchable back to the v4 standard).
+- **State is stored in the hardened JSON file** `State/<institute>.v5state.json` under the institute directory (serial writes, a mandatory load before read): recovery is simply that load-before-read (see above).
+- **Three classes of positions + hireable temp workers**: the roster is mutable, and hiring/firing are real reversible operations.
+- **No npm experimental package is introduced**: v5 is a single `.js` file within the preset, with zero dependencies.
+- **Meetings and verification are strictly mutually exclusive** (queued in both directions).
+
+See [the v5 specification](vibe-math-v5/实现方案.md) (written specification) and
+[the v5 detail diagrams](vibe-math-v5/架构图.md) (all detail diagrams).