dsh-vibe-math 2.7.0 → 2.7.2

package/tests/audit-math-computation-contract.mjs

@@ -44,6 +44,12 @@ function ok(cond, label, detail) {
 }
 const read = (rel) => readFileSync(join(ROOT, rel), 'utf8')
 
+// round-8: the persona rule lines must be VERBATIM copies of the shared module constants, so a module
+// wording change can never silently leave one preset behind. Import the module once (ESM top level).
+const MATH_MODULE = await import(new URL('../vibe-math-v2/math-computation.js', import.meta.url).href)
+const ARCHIVE_RULE_ZH = MATH_MODULE.MATH_ARCHIVE_WORKFLOW_LINE
+const ARCHIVE_RULE_EN = MATH_MODULE.MATH_ARCHIVE_WORKFLOW_LINE_EN
+
 function block(src, startMarker, endMarker) {
   const i = src.indexOf(startMarker)
   if (i === -1) return ''
@@ -167,7 +173,48 @@ for (const P of PRESETS) {
   const wf = blocks.filter((b) => b.indexOf('scriptChanged') !== -1 && b.indexOf("mode:'file'") !== -1).length
   ok(wf >= 2, tag + 'both persona blocks carry the archive->edit->re-run rule (scriptChanged + mode:file)', 'blocks with the rule: ' + wf)
   ok(js.indexOf('MATH_ARCHIVE_WORKFLOW_LINE') !== -1, tag + 'references MATH_ARCHIVE_WORKFLOW_LINE (zh persona text source)')
+
+  // 4c. round-6 (A): both blocks must carry the substitution-honesty rule (zh, plus en on v4/v5).
+  const subZh = blocks.filter((b) => b.indexOf('替代必须声明') !== -1).length
+  ok(subZh >= 2, tag + 'both persona blocks carry the substitution-honesty rule (zh)', 'blocks with the rule: ' + subZh)
+  if (P.dir === 'vibe-math-v4' || P.dir === 'vibe-math-v5') {
+    const subEn = blocks.filter((b) => b.indexOf('Declare substitutions') !== -1).length
+    ok(subEn >= 2, tag + 'both persona blocks carry the substitution-honesty rule (en)', 'blocks with the rule: ' + subEn)
+  }
+  ok(js.indexOf('MATH_SUBSTITUTION_RULE_LINE') !== -1, tag + 'references MATH_SUBSTITUTION_RULE_LINE (zh persona text source)')
   if (P.dir === 'vibe-math-v4' || P.dir === 'vibe-math-v5') ok(js.indexOf('MATH_ARCHIVE_WORKFLOW_LINE_EN') !== -1, tag + 'references MATH_ARCHIVE_WORKFLOW_LINE_EN (en persona text source)')
+
+  // 4d. round-7 (fix 2): every preset must wire the bundled-runtime discovery seam, otherwise a
+  // machine whose only interpreter is DSH's own runtime still reports MATH_ENGINE_NOT_FOUND.
+  ok(js.indexOf('runtimeRoots') !== -1 && js.indexOf('listDirAbs') !== -1, tag + 'wires runtimeRoots + listDirAbs (DSH bundled-runtime discovery)')
+
+  // 4e. round-8 (P0/D3): every persona block mentioning the archived scriptPath must ALSO say how to
+  // open it (absolute `receipt.scriptAbs` / join with `receipt.cwd`): member file tools resolve
+  // against the SESSION CWD, while scriptPath is project-root relative.
+  const scriptBlocks = blocks.filter((b) => b.indexOf('scriptPath') !== -1)
+  const openableBlocks = scriptBlocks.filter((b) => /receipt\.scriptAbs/.test(b))
+  ok(scriptBlocks.length >= 2, tag + 'both persona blocks mention the archived scriptPath', 'blocks: ' + scriptBlocks.length)
+  ok(openableBlocks.length === scriptBlocks.length && openableBlocks.length >= 2, tag + '★ every scriptPath mention also gives the ABSOLUTE path receipt.scriptAbs', 'openable: ' + openableBlocks.length + '/' + scriptBlocks.length)
+
+  // 4e-ter. VERBATIM-from-constant guard: the archive-workflow rule must appear in BOTH persona
+  // blocks exactly as the shared module constant defines it (a wording change in the module that is
+  // not re-synced into a preset is a silent drift - this assertion reports the found count).
+  const zhRule = String(ARCHIVE_RULE_ZH).trim()
+  const enRule = String(ARCHIVE_RULE_EN).trim()
+  const zhFound = blocks.filter((b) => b.indexOf(zhRule) !== -1).length
+  ok(zhFound >= 2, tag + 'the zh archive-workflow rule appears VERBATIM in BOTH persona blocks', 'found ' + zhFound)
+  if (P.dir === 'vibe-math-v4' || P.dir === 'vibe-math-v5') {
+    const enFound = blocks.filter((b) => b.indexOf(enRule) !== -1).length
+    ok(enFound >= 2, tag + 'the en archive-workflow rule appears VERBATIM in BOTH persona blocks', 'found ' + enFound)
+  }
+}
+// 4e-bis. the SHARED module's rule text must carry the same instruction (zh + en), and the receipt
+// fields it points at must exist in the module.
+{
+  const mod = read('vibe-math-v2/math-computation.js')
+  ok(/receipt\.scriptAbs/.test(mod), 'the shared module rule mentions receipt.scriptAbs')
+  ok(/会话 cwd/.test(mod) && /SESSION CWD/.test(mod), 'the shared module rule states the session-cwd fact in BOTH languages')
+  ok(/scriptAbs: scriptAbs, cwd: root/.test(mod), 'the shared module WRITES scriptAbs + cwd into the receipt')
 }
 
 // 5. README (both languages) document the six parameters
@@ -181,7 +228,15 @@ for (const f of ['README.md', 'README.en.md']) {
 {
   const doc = existsSync(join(ROOT, 'docs/math-computation.md')) ? read('docs/math-computation.md') : ''
   ok(doc.indexOf('字符串级') !== -1 && doc.indexOf('不解析符号链接') !== -1, 'docs §6 states the path guard is string-level and does not resolve links/junctions')
-  ok(doc.indexOf('只通过假 subprocess seam 验证') !== -1, 'docs §6 states engine execution is verified only through the fake subprocess seam')
+  // round-9 (F0): the boundary paragraph must pin the CORRECTED truth - real engines were verified on
+  // this machine, AND the still-unverified set is named. (The old claim "only through the fake
+  // subprocess seam" is stale and must not be pinned any more.)
+  ok(doc.indexOf('假 subprocess seam') !== -1 && doc.indexOf('不再') !== -1, 'docs §6 keeps the fake-subprocess seam but states it is no longer the only evidence')
+  ok(doc.indexOf('python 3.12.10') !== -1 && doc.indexOf('R 4.6.1') !== -1, 'docs §6 names the real engines/versions verified on this machine')
+  ok(doc.indexOf('scriptHash') !== -1 && doc.indexOf('native') !== -1, 'docs §6 states the native-vs-cli parity (same numbers + same scriptHash)')
+  ok(doc.indexOf('MATH_TIMEOUT') !== -1 && doc.indexOf('MATH_NONZERO_EXIT') !== -1 && doc.indexOf('MATH_MISSING_PACKAGES') !== -1, 'docs §6 states the real-engine edge codes that were confirmed')
+  ok(doc.indexOf('Octave / Julia 未安装') !== -1 && doc.indexOf('VERIFY') !== -1 && doc.indexOf('无法强制禁网') !== -1, 'docs §6 keeps the still-unverified set (no Octave/Julia, commercial VERIFY, no network/write enforcement)')
+  ok(doc.indexOf('只通过假 subprocess seam 验证') === -1, 'docs §6 no longer claims engine execution was verified ONLY through the fake seam (stale claim removed)')
   ok(doc.indexOf('串行') !== -1 && doc.indexOf('跨进程') !== -1, 'docs §6 states the in-process serialisation and the cross-process limitation')
 }
 

package/tests/audit-math-computation-parity.mjs

@@ -99,7 +99,11 @@ for (const f of MODULES) {
 
 // ---- 5. descriptor invariants ----
 {
-  const E = await import(new URL('../vibe-math-v2/math-engines.js', import.meta.url).href)
+  // MATH_ENGINES_MODULE points this section at a MUTATED descriptor copy (round-6 mutants must be
+  // able to delete a dispatch manager or a scope reason without touching the repository).
+  const E = await import(process.env.MATH_ENGINES_MODULE
+    ? new URL('file:///' + String(process.env.MATH_ENGINES_MODULE).replace(/\\/g, '/')).href
+    : new URL('../vibe-math-v2/math-engines.js', import.meta.url).href)
   const order = E.MATH_ENGINE_ORDER
   ok(JSON.stringify(order) === JSON.stringify(['python', 'r', 'octave', 'julia', 'matlab', 'maple', 'wolfram', 'cli']), 'MATH_ENGINE_ORDER is exactly the P1 set')
   ok(E.MATH_ENGINES.cli.defaultOn === true, 'cli is flagged defaultOn')
@@ -114,6 +118,31 @@ for (const f of MODULES) {
   }
   ok(!!E.MATH_P2_ENGINES.sage && E.MATH_P2_ENGINES.sage.phase === 'P2', 'sage is kept as the P2 descriptor')
   ok(E.mathEngineCandidates('cli') === null, 'cli has no detection candidates')
+
+  // round-6 (B): python must ship the manager DISPATCH table, and each manager must carry both the
+  // install and the matching uninstall template (the audit is only honest if the uninstall matches).
+  const pm = E.MATH_ENGINES.python.install && E.MATH_ENGINES.python.install.managers
+  ok(!!pm, 'python install declares a managers{conda,mamba,uv,pip} dispatch table')
+  for (const mgr of ['conda', 'mamba', 'uv', 'pip']) {
+    ok(!!(pm && pm[mgr]), 'python dispatch has the ' + mgr + ' manager')
+    if (pm && pm[mgr]) {
+      // The user template is either the manager's own or (for the pip fallback) the engine-level one;
+      // that precedence is what opInstall implements (`mgrTmpl.userArgv || d.install.userArgv`).
+      const userTemplate = pm[mgr].userArgv || (mgr === 'pip' ? E.MATH_ENGINES.python.install.userArgv : null)
+      ok(Array.isArray(userTemplate) && userTemplate.length > 0, mgr + ' has a user-scope install template (own or the engine-level fallback)')
+      ok(Array.isArray(pm[mgr].uninstallArgv) && pm[mgr].uninstallArgv.length > 0, mgr + ' ships the MATCHING uninstall template')
+    }
+  }
+  ok(pm && /-c/.test(pm.conda.userArgv.join(' ')) && /conda-forge/.test(pm.conda.userArgv.join(' ')), 'conda installs from -c conda-forge')
+  ok(pm && pm.pip.systemArgv && pm.pip.systemArgv.length > 0, 'pip keeps a real system-scope template')
+  ok(!!(pm && pm.uv && pm.conda && pm.mamba) && !pm.uv.systemArgv && !pm.conda.systemArgv && !pm.mamba.systemArgv, 'uv/conda/mamba have NO system template (user-only by design)')
+
+  // round-6 (C): every user-only engine states WHY in the descriptor (the refusal message quotes it).
+  for (const name of ['r', 'octave', 'julia']) {
+    ok(!!(E.MATH_ENGINES[name].install && E.MATH_ENGINES[name].install.systemUnsupportedReason), name + ' explains why system scope is unsupported')
+    ok(!E.MATH_ENGINES[name].install.systemArgv, name + ' ships no system template (user-only by design)')
+  }
+  ok(!!pm.uv.systemUnsupportedReason && !!pm.conda.systemUnsupportedReason, 'conda/uv managers explain why system scope is unsupported')
 }
 
 // ── 6. round-3 item 3: the machine-readable refusal vocabulary cannot drift ──────────────────────

package/tests/audit-math-computation-sensitivity.mjs

@@ -77,8 +77,8 @@ const PROBES = [
   {
     name: 'script-fields-dropped-from-return',
     file: 'math-computation.js',
-    from: '    scriptPath: scriptRel, scriptHash: scriptHash,\n    attempt: attempt, attemptDir: dir, baseRunDir: baseDir,\n    scriptChanged: scriptChanged, scriptChangedDuringRun: scriptChangedDuringRun,\n    sourceFile: fileRel || null,\n    previousReceipt: receipt.previousReceipt,\n    packages: pk.found,',
-    to: '    packages: pk.found,',
+    from: '    engineInfo: receipt.engine,\n    argv: assembled.argv.slice(),\n    scriptPath: scriptRel, scriptHash: scriptHash,',
+    to: '    engineInfo: receipt.engine,\n    argv: assembled.argv.slice(),',
     expect: 'scriptPath + scriptHash are in the return value AND the receipt',
   },
   {

package/tests/audit-v5-sensitivity.mjs

@@ -68,7 +68,9 @@ const probes = [
     name: 'quorum-forced-to-one',
     ref: 'selfdrive-v5.mjs',
     guarantee: '④ only >= m boolean votes may verify (m must be min(quorumCap, |voters|))',
-    from: "      return Math.max(1, Math.min(cap, voterCount()))",
+    // The floor moved into `quorumMFrom(vc)` when the quorum became single-sourced (defect B of
+    // the 3rd self-test); the anchor follows the implementation, it is not relaxed.
+    from: "      return Math.max(1, Math.min(cap, vc))",
     to: "      return 1",
   },
   {

package/tests/e2e-v5-round2.test.mjs

@@ -21,6 +21,18 @@ import { createHash } from 'node:crypto'
 import { tmpdir } from 'node:os'
 import { join, dirname, isAbsolute } from 'node:path'
 
+// round-7 (fix 2) test isolation: engine discovery now also scans DSH's own runtime trees, and this
+// machine HAS a bundled python. round-9 adds the known per-OS INSTALL dirs, and this machine now really
+// has python/R installed. This suite injects ONE fake subprocess for everything (LaTeX + math), so an
+// unexpected engine probe would be recorded as a compiler call and would even write a fake paper.pdf.
+// Pinning all of those roots at an empty dir keeps the fixture's premise ("no math engine here") true
+// and the suite deterministic; production behaviour is unaffected.
+const EMPTY_ENGINE_ROOT = mkdtempSync(join(tmpdir(), 'vibe-v5-e2e-nodsh-'))
+process.env.DSH_HOME = EMPTY_ENGINE_ROOT
+process.env.ProgramFiles = EMPTY_ENGINE_ROOT
+process.env['ProgramFiles(x86)'] = EMPTY_ENGINE_ROOT
+process.env.LOCALAPPDATA = EMPTY_ENGINE_ROOT
+
 // V5_PLUGIN lets a sensitivity probe point this suite at a deliberately broken copy.
 // Without it every probe against this suite silently tested the UNMUTATED plugin and was
 // reported as a "detection" only because the probe's own spawn failed — i.e. the whole
@@ -1858,6 +1870,110 @@ console.log('\n[42] every Lean prompt site obeys the leanInitiative gate in both
   assert(s3on.indexOf(DAILY) === -1, 'S3 verifyPrompt: …and the daily line is still absent there')
 }
 
+// ---------- 43. pre-start diagnosis + coherent quorum (architecture self-test defects 1/2) -------
+// The self-test (§18 of _oneoff/method3-scripted-driving.md) found that before `start`:
+//   (1) record_progress / record_proposition / verdict answered a BARE `V5_MEMBER_NOT_FOUND`
+//       with no hint about why or what to do first;
+//   (2) `vibe_v5_status` reported `quorum.m=1` with `voters=0` — reading like a satisfied quorum.
+// Both are asserted here, INCLUDING the actionable `next` step, and the normal (post-start) path
+// is exercised in the same section so a follow-up self-test can see a non-error path.
+console.log('\n[43] pre-start tools explain themselves; the quorum is coherent before and after start')
+{
+  const h = makeHost({ pluginModule })
+  const pre = async (name, args) => await h.callTool(name, args, h.ROOT)
+  const rProg = await pre('vibe_v5_record_progress', { content: '自我测试' })
+  assert(rProg.ok === false && rProg.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rProg.message || '')) &&
+    rProg.next && rProg.next.kind === 'start' && rProg.next.tool === 'vibe_v5_start',
+    '★ pre-start record_progress: the code is unchanged but the answer names the state + the next step (' + JSON.stringify(rProg).slice(0, 200) + ')')
+  const rProp = await pre('vibe_v5_record_proposition', { statement: 's', value: 1, motive: 'm', p: 0.5 })
+  assert(rProp.ok === false && rProp.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rProp.message || '')) && rProp.next && rProp.next.kind === 'start',
+    '★ pre-start record_proposition: same actionable diagnosis (' + JSON.stringify(rProp).slice(0, 160) + ')')
+  const rVer = await pre('vibe_v5_verdict', { target: 'p-x', verdict: 1 })
+  assert(rVer.ok === false && rVer.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rVer.message || '')) && rVer.next && rVer.next.kind === 'start',
+    '★ pre-start verdict: same actionable diagnosis (' + JSON.stringify(rVer).slice(0, 160) + ')')
+  const st0 = await pre('vibe_v5_status', {})
+  assert(st0.quorum && st0.quorum.started === false && st0.quorum.m === 0 && st0.quorum.voterCount === 0 && st0.quorum.phase === 'not-started',
+    '★ pre-start quorum is COHERENT: started=false, m=0, voters=0 (' + JSON.stringify(st0.quorum) + ')')
+  assert(st0.quorum.next && st0.quorum.next.kind === 'start' && st0.quorum.next.tool === 'vibe_v5_start',
+    '★ …and it says what to do first (' + JSON.stringify(st0.quorum.next) + ')')
+  assert(st0.params && st0.params.m === 0 && st0.params.started === false,
+    'the params view agrees: m=0, started=false (' + JSON.stringify({ m: st0.params && st0.params.m, started: st0.params && st0.params.started }) + ')')
+  assert(st0.quorum.m !== 1 || st0.quorum.voterCount !== 0,
+    'the old inconsistent `m=1 with voters=0` reading is gone')
+  // ── the NORMAL path: after start, quorum is defined and the member tools work ──
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const st1 = await h.callTool('vibe_v5_status', {})
+  assert(st1.quorum && st1.quorum.started === true && st1.quorum.m >= 1 && st1.quorum.voterCount >= 1 && st1.quorum.voters.length === st1.quorum.voterCount,
+    '★ after start the quorum is real: started=true, m>=1, voters listed (' + JSON.stringify(st1.quorum) + ')')
+  const member = h.childAgent(h.childOf('r-1'))
+  const okProg = await h.callTool('vibe_v5_record_progress', { content: '启动后写进度' }, member)
+  assert(okProg.ok === true && /Members\/r-1\/Progress/.test(String(okProg.file || '')),
+    '★ after start the SAME tool succeeds for a member (normal path reachable) (' + JSON.stringify(okProg).slice(0, 120) + ')')
+}
+
+// ---------- 44. workspace containment + single-sourced quorum (3rd self-test defects A/B) --------
+// Defect A: member-facing text said the library root was `Members/<id>/` while a member's OWN
+// file tools resolve relative paths against the SESSION CWD ⇒ a stray `<cwd>/Members/acad/Propos/
+// p-*.md` appeared outside `VibeMath/Projects/…`. Every member-facing path is now CWD-relative,
+// and this section proves that a member card write cannot land outside the project tree.
+// Defect B: the office digest said m=2 while status/acad said m=3 in the same window (two roster
+// snapshots). Every view now reads ONE snapshot and carries `rosterVersion`, so all views at one
+// point in time must agree — including after a roster change.
+console.log('\n[44] paths stay inside the project root; every quorum view agrees')
+{
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  // (A1) the member brief must name the CWD-relative library root (the member's real baseline).
+  const brief = h.spawns.map((sp) => JSON.stringify(sp.request || {})).join('\n')
+  assert(brief.indexOf('VibeMath/Projects/default/Institutes/institute/Members/') !== -1,
+    '★ the member brief carries the CWD-relative library root (' + (brief.match(/Members\/[^"\\]{0,40}/) || [''])[0] + ')')
+  // A bare `Members/…` NOT preceded by a path separator is an institute-relative path: a member
+  // copying it into its own file tool would write it against the session cwd (defect A).
+  const bareLib = (brief.match(/(^|[^A-Za-z0-9/_.-])Members\//g) || [])
+  assert(bareLib.length === 0,
+    'no member-facing path is left institute-relative (bare ' + JSON.stringify(bareLib) + ')')
+  await h.settleSpawns()
+  // (A2) a member card write must not add anything at the workspace TOP level.
+  const topBefore = readdirSync(h.WS).sort().join(',')
+  const card = await h.callTool('vibe_v5_record_proposition', { id: 'p-stray-check', statement: '包层测试', value: 1, motive: 'm', p: 0.5 }, h.childAgent(h.childOf('r-1')))
+  const topAfter = readdirSync(h.WS).sort().join(',')
+  assert(card.ok === true && /Members\/r-1\/Propos\/p-stray-check\.md/.test(String(card.file || '')),
+    'the member card is written through the v5 tool (' + JSON.stringify(card).slice(0, 120) + ')')
+  assert(existsSync(join(h.WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'Members', 'r-1', 'Propos', 'p-stray-check.md')),
+    '…and it exists under VibeMath/Projects/<project>/…')
+  assert(topAfter === topBefore && !existsSync(join(h.WS, 'Members')),
+    '★ NO path outside VibeMath/Projects/… gained files (top level unchanged: ' + topBefore + ' → ' + topAfter + ')')
+  // (B) every quorum view agrees at one point in time, and they move TOGETHER after a hire.
+  const views = async () => {
+    const st = await h.callTool('vibe_v5_status', {})
+    const rp = await h.callTool('vibe_v5_report', {})
+    await h.callTool('vibe_v5_say', { to: 'r-1', text: '请继续推进。' }, h.childAgent(h.childOf('acad')))
+    const w = await h.peekWakeOf('r-1', 3000)
+    const pm = w ? /法定票数 m=(\d+)/.exec(w.text) : null
+    if (w) h.fireEnd(w.childId, { progress: '收到。', solved: false, contextPct: 10 })
+    await sleep(20)
+    return { st, rp, promptM: pm ? Number(pm[1]) : null }
+  }
+  const v1 = await views()
+  assert(v1.st.quorum && v1.rp.quorum && v1.st.quorum.m === v1.rp.quorum.m,
+    '★ status and report agree on m at one point in time (' + JSON.stringify({ status: v1.st.quorum && v1.st.quorum.m, report: v1.rp.quorum && v1.rp.quorum.m }) + ')')
+  assert(v1.st.quorum.rosterVersion === v1.rp.quorum.rosterVersion,
+    'both views carry the SAME rosterVersion (' + JSON.stringify({ s: v1.st.quorum.rosterVersion, r: v1.rp.quorum.rosterVersion }) + ')')
+  assert(v1.promptM === v1.st.quorum.m,
+    'the member-facing state block shows the same m (' + JSON.stringify({ prompt: v1.promptM, status: v1.st.quorum.m }) + ')')
+  // A roster change must reach EVERY view (the stale-snapshot bug). Dismissing a permanent
+  // researcher shrinks the voter set synchronously, so m MUST move in every view at once.
+  const rm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' })
+  assert(rm.ok === true, 'precondition: the roster change succeeded (' + JSON.stringify(rm).slice(0, 140) + ')')
+  await sleep(30)
+  const v2 = await views()
+  assert(v2.st.quorum.m === v2.rp.quorum.m,
+    '★ after the roster changes, status and report STILL agree (status=' + v2.st.quorum.m + ', report=' + v2.rp.quorum.m + ')')
+  assert(v2.st.quorum.rosterVersion !== v1.st.quorum.rosterVersion && v2.st.quorum.m !== v1.st.quorum.m,
+    'the roster change moved both m and rosterVersion (' + JSON.stringify({ before: v1.st.quorum.m, after: v2.st.quorum.m, v: [v1.st.quorum.rosterVersion, v2.st.quorum.rosterVersion] }) + ')')
+}
+
 console.log('')
 console.log('passed=' + passed + ' failed=' + failed)
 if (failed) { console.error('FAILURES:'); for (const f of failures) console.error('  - ' + f); process.exit(1) }

package/tests/formal-verify-v2.test.mjs

@@ -31,10 +31,14 @@
 import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, writeFileSync, statSync, mkdirSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, dirname, isAbsolute, resolve as pathResolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
+// V2_PLUGIN may be a REPO-RELATIVE path or an ABSOLUTE one (a mutant copy outside the repo, e.g. a
+// temp dir). The previous `new URL('file:///' + path)` form only worked for drive-qualified Windows
+// paths and made out-of-repo variants impossible; this is the same isAbsolute-aware resolution the
+// `math-computation-v*` suites use. Default behaviour (env var unset) is unchanged.
 const PLUGIN = process.env.V2_PLUGIN
-  ? new URL('file:///' + String(process.env.V2_PLUGIN).replace(/\\/g, '/'))
+  ? pathToFileURL(isAbsolute(process.env.V2_PLUGIN) ? process.env.V2_PLUGIN : join(dirname(fileURLToPath(import.meta.url)), '..', process.env.V2_PLUGIN))
   : new URL('../vibe-math-v2/vibe-math-v2.js', import.meta.url)
 // 纯函数测试面（__testHelpers）：参数归一化/搜索路径计划/哈希/指纹都从这里守卫。
 const MOD = await import(PLUGIN.href)
@@ -1568,6 +1572,108 @@ section('15d Lean 增量 + 异步（spec §1–§4 + 修订 §1–§5）：参
   await wOffEager.call('vibe_math_pause', {})
 }
 
+// ---------- 15e. round-2 lens-1 RUNTIME: the initiative axis is injected at EVERY site ----------
+// Three injection sites with three different shapes (explorer / rederive / solver). The static [sites]
+// check can only see that the producer call is not textually gated; THIS section proves the actual
+// prompt text of each site: (1) formalVerify:'off' + leanInitiative:'eager' must carry the daily line
+// at that site (and keep the verification block closed), (2) leanInitiative:'off' must drop it there
+// while the verification phase still follows formalVerify. Assertion names carry the site name, so a
+// single-site regression names itself instead of hiding behind a sibling site's coverage.
+const SITE_DAILY = /三条筛选判据/
+const SITE_VERIFY = /【Lean 形式化验证（/
+const FENCE = '`'.repeat(3)
+const jsonReply = (obj) => FENCE + 'json\n' + JSON.stringify(obj) + '\n' + FENCE
+/** Drive one problem through explorer -> solver(dead-end) -> re-derive and collect each site's prompt. */
+async function driveSites(h, opts, qid) {
+  const q = qid || 'qSite'
+  await h.call('vibe_math_set_params', Object.assign({ tickIntervalMs: 200, verifierCount: 2, leanAsync: false, maxExplorerRetries: 5, maxParallelThreshold: 4 }, opts))
+  await h.call('vibe_math_add_problem', { id: q, description: '站点级运行时用例' })
+  await startScheduler(h)
+  const label = (n) => h.spawns.filter((s) => s.label.startsWith(n + ':' + q))
+  const ex1 = await waitFor(() => label('explorer')[0], 80, 200)
+  const out = { explorer: (ex1 && ex1.prompt) || '' }
+  if (ex1) h.fireEnd({ id: ex1.childId, runId: 'rS1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.8 }] }) }] })
+  const so = await waitFor(() => label('solver')[0], 80, 200)
+  out.solver = (so && so.prompt) || ''
+  if (so) h.fireEnd({ id: so.childId, runId: 'rS2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ status: 'dead-end', dead_end_reason: '站点用例：本方向不可行', solution: '', solution_probability: 0.1, lemmas: [], routes: [], lessons: [], survival_probability: 0.2, sub_questions: [], new_inventions: [{ 类型: '工具', 标题: '站点工具', 内容描述: 'x', 是否已入库: false }] }) }] })
+  // every direction is now dead-end ⇒ the NEXT explorer for this problem is built by rederivePrompt
+  await waitFor(() => label('explorer').length >= 2 && label('explorer')[1], 80, 200)
+  const exs = label('explorer')
+  out.rederive = (exs[1] && exs[1].prompt) || ''
+  out.distinct = !!out.explorer && !!out.rederive && out.explorer !== out.rederive
+  await h.call('vibe_math_abort', {})
+  return out
+}
+{
+  // (1) eager 在 formalVerify:'off' 下也必须在**每一个**站点注入日线
+  const he = await makeCase('site-eager-off')
+  const A = await driveSites(he, { formalVerify: 'off', leanInitiative: 'eager' })
+  assert(SITE_DAILY.test(A.explorer), '★ [explorer site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(SITE_DAILY.test(A.solver), '★ [solver site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(SITE_DAILY.test(A.rederive), '★ [rederive site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(A.distinct, '★ [rederive site] the re-explore prompt really is the rederive builder (differs from the first explorer wave)')
+  assert(A.explorer.indexOf('【Lean 形式化验证（') === -1 && A.solver.indexOf('【Lean 形式化验证（') === -1 && A.rederive.indexOf('【Lean 形式化验证（') === -1, '★ [all sites] formalVerify:off keeps the verification-phase block closed while eager still injects the daily line')
+
+  // (2) leanInitiative:'off' ⇒ 每个站点都没有日线（同一驱动）
+  const ho = await makeCase('site-init-off')
+  const B = await driveSites(ho, { formalVerify: 'encourage', leanInitiative: 'off' }, 'qSiteOff')
+  assert(!SITE_DAILY.test(B.explorer) && !/【顺手形式化/.test(B.explorer), '★ [explorer site] leanInitiative:off drops the daily line')
+  assert(!SITE_DAILY.test(B.solver) && !/【顺手形式化/.test(B.solver), '★ [solver site] leanInitiative:off drops the daily line')
+  assert(!SITE_DAILY.test(B.rederive) && !/【顺手形式化/.test(B.rederive), '★ [rederive site] leanInitiative:off drops the daily line')
+
+  // (2b) …而验证段仍按 formalVerify 出现（同一参数下的另一个 root，驱动到 verifier）
+  const hv = await makeCase('site-init-off-verify')
+  await hv.call('vibe_math_set_params', { tickIntervalMs: 200, verifierCount: 2, leanAsync: false, formalVerify: 'encourage', leanInitiative: 'off' })
+  await hv.call('vibe_math_add_problem', { id: 'qV', description: '验证段仍在' })
+  await startScheduler(hv)
+  const exv = await waitFor(() => hv.spawns.find((s) => s.label.startsWith('explorer:qV')), 80, 200)
+  assert(!!exv && !SITE_DAILY.test(exv.prompt || ''), '★ [explorer site] 第二个 root：initiative off 时 explorer 仍无日线')
+  if (exv) hv.fireEnd({ id: exv.childId, runId: 'rV1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.8 }] }) }] })
+  const sov = await waitFor(() => hv.spawns.find((s) => s.label.startsWith('solver:qV')), 80, 200)
+  if (sov) hv.fireEnd({ id: sov.childId, runId: 'rV2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ status: 'success', solution: 'complete solution', solution_probability: 0.9, lemmas: [], routes: [], lessons: [], survival_probability: 0.9, dead_end_reason: null, sub_questions: [] }) }] })
+  const vv = await waitFor(() => hv.spawns.find((s) => /^verifier:/.test(s.label)), 100, 250)
+  assert(!!vv && SITE_VERIFY.test(vv.prompt || ''), '★ leanInitiative:off 时验证段仍按 formalVerify 注入（verifier 提示词含【Lean 形式化验证（）')
+  await hv.call('vibe_math_abort', {})
+}
+
+// ---------- 15f. P2-v2 D4: ONE participant set / ONE count across the two views ----------
+// Pinned definition (must stay in sync with the plugin's voteCount() doc comment):
+//   * participant set of a verify task = `t.children` of the CURRENT round (their `childResults`
+//     entries are that round's votes);
+//   * "how many votes are required" = the task's **creation-time snapshot** `t.expectedCount`
+//     (written when processVerify creates the task) — NEVER live `params.verifierCount` /
+//     `params.maxParallelThreshold`.
+// Before the convergence the answer lived in three places (`consensus()` over reported votes with
+// the MIN_REVIEWERS constant, `finalizeVerification()` counting again, and two inline `allReported`
+// checks over `t.children`), so a mid-round hire/fire could make the debate view and the verdict
+// view disagree about whether the round is complete.
+section('15f P2-v2 D4: both views read ONE participant set (snapshot + round)')
+{
+  const h = await makeCase('d4-v2-midvote')
+  await h.call('vibe_math_set_params', { verifierCount: 2, debateMaxRounds: 2, verdictMode: 'flat' })
+  await h.call('vibe_math_add_proposition', { id: 'p-d4v2', 概述: 'D4 v2 参与集', 概率: 0.6, 分类: '数论' })
+  await startScheduler(h)
+  const staffed = await waitFor(() => { const x = h.spawns.filter((s) => s.label.startsWith('verifier:r-p-d4v2')); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!staffed, 'two reviewers were staffed for the round (the creation-time snapshot)')
+  const pick = (o) => ((o && o.verifyTasks) || []).filter((t) => String(t.rId).indexOf('p-d4v2') !== -1)[0]
+  const st1 = pick(await h.call('vibe_math_status', {}))
+  const rp1 = pick(await h.call('vibe_math_report', {}))
+  assert(!!st1 && !!rp1 && st1.expected === 2 && st1.dispatched === 2 && st1.round === 1,
+    '★★ [D4-v2] the projection reports the round snapshot: expected=2 dispatched=2 round=1（实测 ' + JSON.stringify({ status: st1, report: rp1 }) + '）')
+  assert(JSON.stringify(st1) === JSON.stringify(rp1),
+    '★★★ [D4-v2] status 与 report 两个视图对同一任务的参与集/票数**逐字段相同**（一个来源；实测 ' + JSON.stringify({ status: st1, report: rp1 }) + '）')
+  // mid-vote "hire more": the office raises verifierCount. The in-flight round keeps its snapshot —
+  // a view that re-read the live roster/params would now claim 4.
+  await h.call('vibe_math_set_params', { verifierCount: 4 })
+  const after = pick(await h.call('vibe_math_status', {}))
+  const afterR = pick(await h.call('vibe_math_report', {}))
+  assert(!!after && after.expected === 2 && after.dispatched === 2,
+    '★★★ [D4-v2] 中途调高 verifierCount **不改变**在飞轮次的参与集/需求票数（快照仍是 2；实测 ' + JSON.stringify(after) + '）')
+  assert(JSON.stringify(after) === JSON.stringify(afterR),
+    '★★ [D4-v2] 调参后两个视图仍然逐字段相同（实测 ' + JSON.stringify({ status: after, report: afterR }) + '）')
+  await h.call('vibe_math_abort', {})
+}
+
 section('16 the captured prompt corpus is written for human review')
 {
   // Freeze the scheduler in every case FIRST: a still-running tick loop could emit one more

package/tests/formal-verify-v3.test.mjs

@@ -22,10 +22,14 @@
 import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, dirname, isAbsolute, resolve as pathResolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
+// V3_PLUGIN may be a REPO-RELATIVE path or an ABSOLUTE one (a mutant copy outside the repo, e.g. a
+// temp dir). The previous `new URL('file:///' + path)` form only worked for drive-qualified Windows
+// paths and made out-of-repo variants impossible; this is the same isAbsolute-aware resolution the
+// `math-computation-v*` suites use. Default behaviour (env var unset) is unchanged.
 const PLUGIN = process.env.V3_PLUGIN
-  ? new URL('file:///' + String(process.env.V3_PLUGIN).replace(/\\/g, '/'))
+  ? pathToFileURL(isAbsolute(process.env.V3_PLUGIN) ? process.env.V3_PLUGIN : join(dirname(fileURLToPath(import.meta.url)), '..', process.env.V3_PLUGIN))
   : new URL('../vibe-math-v3/vibe-math-v3.js', import.meta.url)
 const HERE = dirname(fileURLToPath(import.meta.url))
 // AUDIT-CHECKLIST §2.4: the suite must also keep the INTERACTION TEXT it drove, so a human can
@@ -1495,6 +1499,117 @@ section('9b Lean 增量 + 异步：参数/argv/队列/去重/只读面/主动性
 // 10. interaction corpus (AUDIT-CHECKLIST §2.4) — a HUMAN must be able to re-read
 //     every prompt the framework emitted, not just the assertions about them.
 // ===============================================================
+// ===============================================================
+// 5b. round-2 lens-1 RUNTIME: the initiative axis at EVERY v3 site
+// ===============================================================
+// Four sites: the three formalDailySection() call sites (explorer / rederive / solver) plus the
+// INLINE formalWorkLine() site inside methodKeeperPrompt. (1) formalVerify:'off' + leanInitiative:
+// 'eager' must carry the daily line at that site; (2) leanInitiative:'off' must drop it there while
+// the verification phase still follows formalVerify. Names carry the site so a single-site
+// regression names itself.
+const SITE_DAILY = /三条筛选判据/
+const SITE_VERIFY = /【Lean 形式化验证（/
+async function driveSiteV3(rw, opts, qid) {
+  const q = qid
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { methodKeepEvery: 1, maxExplorerRetries: 5 }, opts), rw)
+  await callTool('vibe_math_add_problem', { id: q, 陈述: '站点级运行时用例' }, rw)
+  await callTool('vibe_math_start', {}, rw)
+  const exs = () => spawnOf(rw, 'explorer:' + q)
+  await drive(rw, () => exs().length >= 1, 'explorer site ' + q)
+  const out = { explorer: (exs()[0] || {}).prompt || '' }
+  // answer explorers with directions until the solver appears (v3's fallback scheduler re-derives)
+  fireEnd(exs()[0].childId, { meta: { kind: 'directions', qid: q, directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: '', feasibility: 0.8 }] } })
+  for (let guard = 0; guard < 30 && !lastSpawn(rw, 'solver:' + q + ':d1'); guard++) {
+    const pend = exs().filter((s) => !firedChildren.has(s.childId)).slice(-1)[0]
+    if (pend) { firedChildren.add(pend.childId); fireEnd(pend.childId, { meta: { kind: 'directions', qid: q, directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: '', feasibility: 0.8 }] } }) }
+    await pump(rw); await sleep(80)
+  }
+  const so = lastSpawn(rw, 'solver:' + q + ':d1')
+  out.solver = (so && so.prompt) || ''
+  // dead-end + a pending invention: the direction is exhausted (⇒ re-derive) AND the method keeper fires
+  if (so) fireEnd(so.childId, { status: 'dead-end', survival_probability: 0.2, dead_end_reason: '站点用例：不可行', new_inventions: [{ 类型: '工具', 标题: '站点工具', 内容描述: 'x', 是否已入库: false }] })
+  await drive(rw, () => exs().length >= 2, 'rederive site ' + q)
+  out.rederive = (exs()[1] || {}).prompt || ''
+  out.distinct = !!out.explorer && !!out.rederive && out.explorer !== out.rederive
+  await drive(rw, () => !!lastSpawn(rw, 'method-keeper'), 'method-keeper site ' + q)
+  out.methodKeeper = (lastSpawn(rw, 'method-keeper') || {}).prompt || ''
+  await callTool('vibe_math_abort', {}, rw)
+  return out
+}
+{
+  const re = makeRoot()
+  await callTool('vibe_math_new_project', { name: 'site-eager-off' }, re)
+  const A = await driveSiteV3(re, { formalVerify: 'off', leanInitiative: 'eager' }, 'qS')
+  assert(SITE_DAILY.test(A.explorer), '★ [explorer site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(SITE_DAILY.test(A.solver), '★ [solver site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(SITE_DAILY.test(A.rederive), '★ [rederive site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(SITE_DAILY.test(A.methodKeeper), '★ [methodKeeper site] formalVerify:off + leanInitiative:eager injects the daily line (inline site)')
+  assert(A.explorer.indexOf('【Lean 形式化验证（') === -1 && A.solver.indexOf('【Lean 形式化验证（') === -1 && A.rederive.indexOf('【Lean 形式化验证（') === -1 && A.methodKeeper.indexOf('【Lean 形式化验证（') === -1, '★ [all sites] formalVerify:off keeps the verification-phase block closed while eager still injects the daily line')
+
+  const ro = makeRoot()
+  await callTool('vibe_math_new_project', { name: 'site-init-off' }, ro)
+  const B = await driveSiteV3(ro, { formalVerify: 'encourage', leanInitiative: 'off' }, 'qO')
+  assert(!SITE_DAILY.test(B.explorer) && !/【顺手形式化/.test(B.explorer), '★ [explorer site] leanInitiative:off drops the daily line')
+  assert(!SITE_DAILY.test(B.solver) && !/【顺手形式化/.test(B.solver), '★ [solver site] leanInitiative:off drops the daily line')
+  assert(!SITE_DAILY.test(B.rederive) && !/【顺手形式化/.test(B.rederive), '★ [rederive site] leanInitiative:off drops the daily line')
+  assert(!SITE_DAILY.test(B.methodKeeper) && !/【顺手形式化/.test(B.methodKeeper), '★ [methodKeeper site] leanInitiative:off drops the daily line (inline site)')
+
+  // verification phase still follows formalVerify under leanInitiative:'off'
+  const rvv = makeRoot()
+  await callTool('vibe_math_new_project', { name: 'site-init-off-verify' }, rvv)
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { formalVerify: 'encourage', leanInitiative: 'off' }), rvv)
+  await callTool('vibe_math_add_problem', { id: 'qV', 陈述: '验证段仍在' }, rvv)
+  await callTool('vibe_math_start', {}, rvv)
+  await drive(rvv, () => !!lastSpawn(rvv, 'explorer:qV'), 'explorer qV')
+  const exv = lastSpawn(rvv, 'explorer:qV')
+  assert(!!exv && !SITE_DAILY.test(exv.prompt || ''), '★ [explorer site] 第二个 root：initiative off 时 explorer 仍无日线')
+  if (exv) fireEnd(exv.childId, { meta: { kind: 'directions', qid: 'qV', directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: '', feasibility: 0.8 }] } })
+  for (let guard = 0; guard < 30 && !lastSpawn(rvv, 'solver:qV:d1'); guard++) {
+    const pend = spawnOf(rvv, 'explorer:qV').filter((s) => !firedChildren.has(s.childId)).slice(-1)[0]
+    if (pend) { firedChildren.add(pend.childId); fireEnd(pend.childId, { meta: { kind: 'directions', qid: 'qV', directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: '', feasibility: 0.8 }] } }) }
+    await pump(rvv); await sleep(80)
+  }
+  const sovv = lastSpawn(rvv, 'solver:qV:d1')
+  if (sovv) fireEnd(sovv.childId, { status: 'success', solution: 'complete solution', survival_probability: 0.9 })
+  await drive(rvv, () => spawnOf(rvv, 'verifier:').length >= 1, 'verifier qV')
+  const vsp = spawnOf(rvv, 'verifier:')[0]
+  assert(!!vsp && SITE_VERIFY.test(vsp.prompt || ''), '★ leanInitiative:off 时验证段仍按 formalVerify 注入（verifier 提示词含【Lean 形式化验证（）')
+  await callTool('vibe_math_abort', {}, rvv)
+}
+
+// ===============================================================
+// 5c. round-2 D4: ONE vote-count source — a mid-verification verifierCount change must not re-derive
+//     the in-flight task's quorum from live params (the audit's "same count, different code" bug).
+// ===============================================================
+section('5c D4 vote count: quorum comes from the task snapshot, not from live params')
+{
+  const RD4 = makeRoot()
+  await callTool('vibe_math_new_project', { name: 'd4-votecount' }, RD4)
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { verifierCount: 2 }), RD4)
+  await callTool('vibe_math_add_proposition', { id: 'p-d4', 概述: 'D4 票数单一来源', 概率: 0.6, 分类: '数论' }, RD4)
+  await callTool('vibe_math_start', {}, RD4)
+  const reD4 = verifyRe('p-d4')
+  assert(await drive(RD4, () => unfiredVerifiers(RD4, reD4).length >= 2, 'two verifiers for p-d4'), 'two verifiers were dispatched for p-d4 (the creation-time snapshot)')
+  // Mid-verification: the office asks for MORE verifiers. Intent-wise that is a NEW requirement for
+  // FUTURE objects; this task's participant set was frozen when it was created.
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { verifierCount: 4 }), RD4)
+  await sleep(300)
+  // Count PER EXACT rId: the proposition may legitimately have several candidate rIds
+  // (r-p-d4, r-p-d4-pf0, …); only the in-flight task for one rId must stay pinned.
+  const labels = spawnOf(RD4, 'verifier:').map((x) => x.label)
+  const exact = {}
+  for (const l of labels) { const m = /^verifier:(r-p-d4):(\d+)$/.exec(l); if (m) exact[m[1]] = (exact[m[1]] || 0) + 1 }
+  const inFlight = exact['r-p-d4'] || 0
+  assert(inFlight === 2, '★ [D4] raising verifierCount mid-verification does NOT re-staff the in-flight task (participant set = the snapshot；实测 ' + JSON.stringify({ inFlight: inFlight, labels: labels }) + '）')
+  // Both dispatched votes satisfy the quorum ⇒ the object must conclude. A view that re-derived its
+  // quorum from the live params would demand 4 votes and stall here forever.
+  await runVerifyRound(RD4, 'p-d4', [1, 1])
+  const cardOf = () => readIf(join(projRoot('d4-votecount'), 'Propos', '数论', 'p-d4.md'))
+  const concluded = await drive(RD4, () => { const c = cardOf(); return /-\s*概率:\s*1(\D|$)/.test(c) || /状态:\s*已验证/.test(c) }, 'p-d4 concludes with the two votes it has', 15000)
+  assert(concluded, '★★★ [D4] the two dispatched votes still satisfy the quorum and the object concludes (no view may re-derive its quorum from live params；card=' + JSON.stringify(cardOf().slice(0, 220)) + '）')
+  await callTool('vibe_math_abort', {}, RD4)
+}
+
 section('10 the captured prompt corpus is written for human review')
 {
   mkdirSync(CORPUS_DIR, { recursive: true })