dsh-vibe-math 2.7.1 → 2.7.2

package/tests/audit-math-computation-contract.mjs

@@ -44,6 +44,12 @@ function ok(cond, label, detail) {
 }
 const read = (rel) => readFileSync(join(ROOT, rel), 'utf8')
 
+// round-8: the persona rule lines must be VERBATIM copies of the shared module constants, so a module
+// wording change can never silently leave one preset behind. Import the module once (ESM top level).
+const MATH_MODULE = await import(new URL('../vibe-math-v2/math-computation.js', import.meta.url).href)
+const ARCHIVE_RULE_ZH = MATH_MODULE.MATH_ARCHIVE_WORKFLOW_LINE
+const ARCHIVE_RULE_EN = MATH_MODULE.MATH_ARCHIVE_WORKFLOW_LINE_EN
+
 function block(src, startMarker, endMarker) {
   const i = src.indexOf(startMarker)
   if (i === -1) return ''
@@ -181,6 +187,34 @@ for (const P of PRESETS) {
   // 4d. round-7 (fix 2): every preset must wire the bundled-runtime discovery seam, otherwise a
   // machine whose only interpreter is DSH's own runtime still reports MATH_ENGINE_NOT_FOUND.
   ok(js.indexOf('runtimeRoots') !== -1 && js.indexOf('listDirAbs') !== -1, tag + 'wires runtimeRoots + listDirAbs (DSH bundled-runtime discovery)')
+
+  // 4e. round-8 (P0/D3): every persona block mentioning the archived scriptPath must ALSO say how to
+  // open it (absolute `receipt.scriptAbs` / join with `receipt.cwd`): member file tools resolve
+  // against the SESSION CWD, while scriptPath is project-root relative.
+  const scriptBlocks = blocks.filter((b) => b.indexOf('scriptPath') !== -1)
+  const openableBlocks = scriptBlocks.filter((b) => /receipt\.scriptAbs/.test(b))
+  ok(scriptBlocks.length >= 2, tag + 'both persona blocks mention the archived scriptPath', 'blocks: ' + scriptBlocks.length)
+  ok(openableBlocks.length === scriptBlocks.length && openableBlocks.length >= 2, tag + '★ every scriptPath mention also gives the ABSOLUTE path receipt.scriptAbs', 'openable: ' + openableBlocks.length + '/' + scriptBlocks.length)
+
+  // 4e-ter. VERBATIM-from-constant guard: the archive-workflow rule must appear in BOTH persona
+  // blocks exactly as the shared module constant defines it (a wording change in the module that is
+  // not re-synced into a preset is a silent drift - this assertion reports the found count).
+  const zhRule = String(ARCHIVE_RULE_ZH).trim()
+  const enRule = String(ARCHIVE_RULE_EN).trim()
+  const zhFound = blocks.filter((b) => b.indexOf(zhRule) !== -1).length
+  ok(zhFound >= 2, tag + 'the zh archive-workflow rule appears VERBATIM in BOTH persona blocks', 'found ' + zhFound)
+  if (P.dir === 'vibe-math-v4' || P.dir === 'vibe-math-v5') {
+    const enFound = blocks.filter((b) => b.indexOf(enRule) !== -1).length
+    ok(enFound >= 2, tag + 'the en archive-workflow rule appears VERBATIM in BOTH persona blocks', 'found ' + enFound)
+  }
+}
+// 4e-bis. the SHARED module's rule text must carry the same instruction (zh + en), and the receipt
+// fields it points at must exist in the module.
+{
+  const mod = read('vibe-math-v2/math-computation.js')
+  ok(/receipt\.scriptAbs/.test(mod), 'the shared module rule mentions receipt.scriptAbs')
+  ok(/会话 cwd/.test(mod) && /SESSION CWD/.test(mod), 'the shared module rule states the session-cwd fact in BOTH languages')
+  ok(/scriptAbs: scriptAbs, cwd: root/.test(mod), 'the shared module WRITES scriptAbs + cwd into the receipt')
 }
 
 // 5. README (both languages) document the six parameters
@@ -194,7 +228,15 @@ for (const f of ['README.md', 'README.en.md']) {
 {
   const doc = existsSync(join(ROOT, 'docs/math-computation.md')) ? read('docs/math-computation.md') : ''
   ok(doc.indexOf('字符串级') !== -1 && doc.indexOf('不解析符号链接') !== -1, 'docs §6 states the path guard is string-level and does not resolve links/junctions')
-  ok(doc.indexOf('只通过假 subprocess seam 验证') !== -1, 'docs §6 states engine execution is verified only through the fake subprocess seam')
+  // round-9 (F0): the boundary paragraph must pin the CORRECTED truth - real engines were verified on
+  // this machine, AND the still-unverified set is named. (The old claim "only through the fake
+  // subprocess seam" is stale and must not be pinned any more.)
+  ok(doc.indexOf('假 subprocess seam') !== -1 && doc.indexOf('不再') !== -1, 'docs §6 keeps the fake-subprocess seam but states it is no longer the only evidence')
+  ok(doc.indexOf('python 3.12.10') !== -1 && doc.indexOf('R 4.6.1') !== -1, 'docs §6 names the real engines/versions verified on this machine')
+  ok(doc.indexOf('scriptHash') !== -1 && doc.indexOf('native') !== -1, 'docs §6 states the native-vs-cli parity (same numbers + same scriptHash)')
+  ok(doc.indexOf('MATH_TIMEOUT') !== -1 && doc.indexOf('MATH_NONZERO_EXIT') !== -1 && doc.indexOf('MATH_MISSING_PACKAGES') !== -1, 'docs §6 states the real-engine edge codes that were confirmed')
+  ok(doc.indexOf('Octave / Julia 未安装') !== -1 && doc.indexOf('VERIFY') !== -1 && doc.indexOf('无法强制禁网') !== -1, 'docs §6 keeps the still-unverified set (no Octave/Julia, commercial VERIFY, no network/write enforcement)')
+  ok(doc.indexOf('只通过假 subprocess seam 验证') === -1, 'docs §6 no longer claims engine execution was verified ONLY through the fake seam (stale claim removed)')
   ok(doc.indexOf('串行') !== -1 && doc.indexOf('跨进程') !== -1, 'docs §6 states the in-process serialisation and the cross-process limitation')
 }
 

package/tests/audit-math-computation-sensitivity.mjs

@@ -77,8 +77,8 @@ const PROBES = [
   {
     name: 'script-fields-dropped-from-return',
     file: 'math-computation.js',
-    from: '    scriptPath: scriptRel, scriptHash: scriptHash,\n    attempt: attempt, attemptDir: dir, baseRunDir: baseDir,\n    scriptChanged: scriptChanged, scriptChangedDuringRun: scriptChangedDuringRun,\n    sourceFile: fileRel || null,\n    previousReceipt: receipt.previousReceipt,\n    cliScriptAppended: !!(receipt.cli && receipt.cli.scriptAppended),\n    packages: pk.found,',
-    to: '    packages: pk.found,',
+    from: '    engineInfo: receipt.engine,\n    argv: assembled.argv.slice(),\n    scriptPath: scriptRel, scriptHash: scriptHash,',
+    to: '    engineInfo: receipt.engine,\n    argv: assembled.argv.slice(),',
     expect: 'scriptPath + scriptHash are in the return value AND the receipt',
   },
   {

package/tests/audit-v5-sensitivity.mjs

@@ -68,7 +68,9 @@ const probes = [
     name: 'quorum-forced-to-one',
     ref: 'selfdrive-v5.mjs',
     guarantee: '④ only >= m boolean votes may verify (m must be min(quorumCap, |voters|))',
-    from: "      return Math.max(1, Math.min(cap, voterCount()))",
+    // The floor moved into `quorumMFrom(vc)` when the quorum became single-sourced (defect B of
+    // the 3rd self-test); the anchor follows the implementation, it is not relaxed.
+    from: "      return Math.max(1, Math.min(cap, vc))",
     to: "      return 1",
   },
   {

package/tests/e2e-v5-round2.test.mjs

@@ -22,11 +22,16 @@ import { tmpdir } from 'node:os'
 import { join, dirname, isAbsolute } from 'node:path'
 
 // round-7 (fix 2) test isolation: engine discovery now also scans DSH's own runtime trees, and this
-// machine HAS a bundled python. This suite injects ONE fake subprocess for everything (LaTeX + math),
-// so an unexpected engine probe would be recorded as a compiler call and would even write a fake
-// paper.pdf. Pinning DSH_HOME at an empty dir keeps the fixture's premise ("no math engine here")
-// true and the suite deterministic; production behaviour is unaffected.
-process.env.DSH_HOME = mkdtempSync(join(tmpdir(), 'vibe-v5-e2e-nodsh-'))
+// machine HAS a bundled python. round-9 adds the known per-OS INSTALL dirs, and this machine now really
+// has python/R installed. This suite injects ONE fake subprocess for everything (LaTeX + math), so an
+// unexpected engine probe would be recorded as a compiler call and would even write a fake paper.pdf.
+// Pinning all of those roots at an empty dir keeps the fixture's premise ("no math engine here") true
+// and the suite deterministic; production behaviour is unaffected.
+const EMPTY_ENGINE_ROOT = mkdtempSync(join(tmpdir(), 'vibe-v5-e2e-nodsh-'))
+process.env.DSH_HOME = EMPTY_ENGINE_ROOT
+process.env.ProgramFiles = EMPTY_ENGINE_ROOT
+process.env['ProgramFiles(x86)'] = EMPTY_ENGINE_ROOT
+process.env.LOCALAPPDATA = EMPTY_ENGINE_ROOT
 
 // V5_PLUGIN lets a sensitivity probe point this suite at a deliberately broken copy.
 // Without it every probe against this suite silently tested the UNMUTATED plugin and was
@@ -1865,6 +1870,110 @@ console.log('\n[42] every Lean prompt site obeys the leanInitiative gate in both
   assert(s3on.indexOf(DAILY) === -1, 'S3 verifyPrompt: …and the daily line is still absent there')
 }
 
+// ---------- 43. pre-start diagnosis + coherent quorum (architecture self-test defects 1/2) -------
+// The self-test (§18 of _oneoff/method3-scripted-driving.md) found that before `start`:
+//   (1) record_progress / record_proposition / verdict answered a BARE `V5_MEMBER_NOT_FOUND`
+//       with no hint about why or what to do first;
+//   (2) `vibe_v5_status` reported `quorum.m=1` with `voters=0` — reading like a satisfied quorum.
+// Both are asserted here, INCLUDING the actionable `next` step, and the normal (post-start) path
+// is exercised in the same section so a follow-up self-test can see a non-error path.
+console.log('\n[43] pre-start tools explain themselves; the quorum is coherent before and after start')
+{
+  const h = makeHost({ pluginModule })
+  const pre = async (name, args) => await h.callTool(name, args, h.ROOT)
+  const rProg = await pre('vibe_v5_record_progress', { content: '自我测试' })
+  assert(rProg.ok === false && rProg.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rProg.message || '')) &&
+    rProg.next && rProg.next.kind === 'start' && rProg.next.tool === 'vibe_v5_start',
+    '★ pre-start record_progress: the code is unchanged but the answer names the state + the next step (' + JSON.stringify(rProg).slice(0, 200) + ')')
+  const rProp = await pre('vibe_v5_record_proposition', { statement: 's', value: 1, motive: 'm', p: 0.5 })
+  assert(rProp.ok === false && rProp.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rProp.message || '')) && rProp.next && rProp.next.kind === 'start',
+    '★ pre-start record_proposition: same actionable diagnosis (' + JSON.stringify(rProp).slice(0, 160) + ')')
+  const rVer = await pre('vibe_v5_verdict', { target: 'p-x', verdict: 1 })
+  assert(rVer.ok === false && rVer.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rVer.message || '')) && rVer.next && rVer.next.kind === 'start',
+    '★ pre-start verdict: same actionable diagnosis (' + JSON.stringify(rVer).slice(0, 160) + ')')
+  const st0 = await pre('vibe_v5_status', {})
+  assert(st0.quorum && st0.quorum.started === false && st0.quorum.m === 0 && st0.quorum.voterCount === 0 && st0.quorum.phase === 'not-started',
+    '★ pre-start quorum is COHERENT: started=false, m=0, voters=0 (' + JSON.stringify(st0.quorum) + ')')
+  assert(st0.quorum.next && st0.quorum.next.kind === 'start' && st0.quorum.next.tool === 'vibe_v5_start',
+    '★ …and it says what to do first (' + JSON.stringify(st0.quorum.next) + ')')
+  assert(st0.params && st0.params.m === 0 && st0.params.started === false,
+    'the params view agrees: m=0, started=false (' + JSON.stringify({ m: st0.params && st0.params.m, started: st0.params && st0.params.started }) + ')')
+  assert(st0.quorum.m !== 1 || st0.quorum.voterCount !== 0,
+    'the old inconsistent `m=1 with voters=0` reading is gone')
+  // ── the NORMAL path: after start, quorum is defined and the member tools work ──
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const st1 = await h.callTool('vibe_v5_status', {})
+  assert(st1.quorum && st1.quorum.started === true && st1.quorum.m >= 1 && st1.quorum.voterCount >= 1 && st1.quorum.voters.length === st1.quorum.voterCount,
+    '★ after start the quorum is real: started=true, m>=1, voters listed (' + JSON.stringify(st1.quorum) + ')')
+  const member = h.childAgent(h.childOf('r-1'))
+  const okProg = await h.callTool('vibe_v5_record_progress', { content: '启动后写进度' }, member)
+  assert(okProg.ok === true && /Members\/r-1\/Progress/.test(String(okProg.file || '')),
+    '★ after start the SAME tool succeeds for a member (normal path reachable) (' + JSON.stringify(okProg).slice(0, 120) + ')')
+}
+
+// ---------- 44. workspace containment + single-sourced quorum (3rd self-test defects A/B) --------
+// Defect A: member-facing text said the library root was `Members/<id>/` while a member's OWN
+// file tools resolve relative paths against the SESSION CWD ⇒ a stray `<cwd>/Members/acad/Propos/
+// p-*.md` appeared outside `VibeMath/Projects/…`. Every member-facing path is now CWD-relative,
+// and this section proves that a member card write cannot land outside the project tree.
+// Defect B: the office digest said m=2 while status/acad said m=3 in the same window (two roster
+// snapshots). Every view now reads ONE snapshot and carries `rosterVersion`, so all views at one
+// point in time must agree — including after a roster change.
+console.log('\n[44] paths stay inside the project root; every quorum view agrees')
+{
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  // (A1) the member brief must name the CWD-relative library root (the member's real baseline).
+  const brief = h.spawns.map((sp) => JSON.stringify(sp.request || {})).join('\n')
+  assert(brief.indexOf('VibeMath/Projects/default/Institutes/institute/Members/') !== -1,
+    '★ the member brief carries the CWD-relative library root (' + (brief.match(/Members\/[^"\\]{0,40}/) || [''])[0] + ')')
+  // A bare `Members/…` NOT preceded by a path separator is an institute-relative path: a member
+  // copying it into its own file tool would write it against the session cwd (defect A).
+  const bareLib = (brief.match(/(^|[^A-Za-z0-9/_.-])Members\//g) || [])
+  assert(bareLib.length === 0,
+    'no member-facing path is left institute-relative (bare ' + JSON.stringify(bareLib) + ')')
+  await h.settleSpawns()
+  // (A2) a member card write must not add anything at the workspace TOP level.
+  const topBefore = readdirSync(h.WS).sort().join(',')
+  const card = await h.callTool('vibe_v5_record_proposition', { id: 'p-stray-check', statement: '包层测试', value: 1, motive: 'm', p: 0.5 }, h.childAgent(h.childOf('r-1')))
+  const topAfter = readdirSync(h.WS).sort().join(',')
+  assert(card.ok === true && /Members\/r-1\/Propos\/p-stray-check\.md/.test(String(card.file || '')),
+    'the member card is written through the v5 tool (' + JSON.stringify(card).slice(0, 120) + ')')
+  assert(existsSync(join(h.WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'Members', 'r-1', 'Propos', 'p-stray-check.md')),
+    '…and it exists under VibeMath/Projects/<project>/…')
+  assert(topAfter === topBefore && !existsSync(join(h.WS, 'Members')),
+    '★ NO path outside VibeMath/Projects/… gained files (top level unchanged: ' + topBefore + ' → ' + topAfter + ')')
+  // (B) every quorum view agrees at one point in time, and they move TOGETHER after a hire.
+  const views = async () => {
+    const st = await h.callTool('vibe_v5_status', {})
+    const rp = await h.callTool('vibe_v5_report', {})
+    await h.callTool('vibe_v5_say', { to: 'r-1', text: '请继续推进。' }, h.childAgent(h.childOf('acad')))
+    const w = await h.peekWakeOf('r-1', 3000)
+    const pm = w ? /法定票数 m=(\d+)/.exec(w.text) : null
+    if (w) h.fireEnd(w.childId, { progress: '收到。', solved: false, contextPct: 10 })
+    await sleep(20)
+    return { st, rp, promptM: pm ? Number(pm[1]) : null }
+  }
+  const v1 = await views()
+  assert(v1.st.quorum && v1.rp.quorum && v1.st.quorum.m === v1.rp.quorum.m,
+    '★ status and report agree on m at one point in time (' + JSON.stringify({ status: v1.st.quorum && v1.st.quorum.m, report: v1.rp.quorum && v1.rp.quorum.m }) + ')')
+  assert(v1.st.quorum.rosterVersion === v1.rp.quorum.rosterVersion,
+    'both views carry the SAME rosterVersion (' + JSON.stringify({ s: v1.st.quorum.rosterVersion, r: v1.rp.quorum.rosterVersion }) + ')')
+  assert(v1.promptM === v1.st.quorum.m,
+    'the member-facing state block shows the same m (' + JSON.stringify({ prompt: v1.promptM, status: v1.st.quorum.m }) + ')')
+  // A roster change must reach EVERY view (the stale-snapshot bug). Dismissing a permanent
+  // researcher shrinks the voter set synchronously, so m MUST move in every view at once.
+  const rm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' })
+  assert(rm.ok === true, 'precondition: the roster change succeeded (' + JSON.stringify(rm).slice(0, 140) + ')')
+  await sleep(30)
+  const v2 = await views()
+  assert(v2.st.quorum.m === v2.rp.quorum.m,
+    '★ after the roster changes, status and report STILL agree (status=' + v2.st.quorum.m + ', report=' + v2.rp.quorum.m + ')')
+  assert(v2.st.quorum.rosterVersion !== v1.st.quorum.rosterVersion && v2.st.quorum.m !== v1.st.quorum.m,
+    'the roster change moved both m and rosterVersion (' + JSON.stringify({ before: v1.st.quorum.m, after: v2.st.quorum.m, v: [v1.st.quorum.rosterVersion, v2.st.quorum.rosterVersion] }) + ')')
+}
+
 console.log('')
 console.log('passed=' + passed + ' failed=' + failed)
 if (failed) { console.error('FAILURES:'); for (const f of failures) console.error('  - ' + f); process.exit(1) }

package/tests/formal-verify-v2.test.mjs

@@ -1636,6 +1636,44 @@ async function driveSites(h, opts, qid) {
   await hv.call('vibe_math_abort', {})
 }
 
+// ---------- 15f. P2-v2 D4: ONE participant set / ONE count across the two views ----------
+// Pinned definition (must stay in sync with the plugin's voteCount() doc comment):
+//   * participant set of a verify task = `t.children` of the CURRENT round (their `childResults`
+//     entries are that round's votes);
+//   * "how many votes are required" = the task's **creation-time snapshot** `t.expectedCount`
+//     (written when processVerify creates the task) — NEVER live `params.verifierCount` /
+//     `params.maxParallelThreshold`.
+// Before the convergence the answer lived in three places (`consensus()` over reported votes with
+// the MIN_REVIEWERS constant, `finalizeVerification()` counting again, and two inline `allReported`
+// checks over `t.children`), so a mid-round hire/fire could make the debate view and the verdict
+// view disagree about whether the round is complete.
+section('15f P2-v2 D4: both views read ONE participant set (snapshot + round)')
+{
+  const h = await makeCase('d4-v2-midvote')
+  await h.call('vibe_math_set_params', { verifierCount: 2, debateMaxRounds: 2, verdictMode: 'flat' })
+  await h.call('vibe_math_add_proposition', { id: 'p-d4v2', 概述: 'D4 v2 参与集', 概率: 0.6, 分类: '数论' })
+  await startScheduler(h)
+  const staffed = await waitFor(() => { const x = h.spawns.filter((s) => s.label.startsWith('verifier:r-p-d4v2')); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!staffed, 'two reviewers were staffed for the round (the creation-time snapshot)')
+  const pick = (o) => ((o && o.verifyTasks) || []).filter((t) => String(t.rId).indexOf('p-d4v2') !== -1)[0]
+  const st1 = pick(await h.call('vibe_math_status', {}))
+  const rp1 = pick(await h.call('vibe_math_report', {}))
+  assert(!!st1 && !!rp1 && st1.expected === 2 && st1.dispatched === 2 && st1.round === 1,
+    '★★ [D4-v2] the projection reports the round snapshot: expected=2 dispatched=2 round=1（实测 ' + JSON.stringify({ status: st1, report: rp1 }) + '）')
+  assert(JSON.stringify(st1) === JSON.stringify(rp1),
+    '★★★ [D4-v2] status 与 report 两个视图对同一任务的参与集/票数**逐字段相同**（一个来源；实测 ' + JSON.stringify({ status: st1, report: rp1 }) + '）')
+  // mid-vote "hire more": the office raises verifierCount. The in-flight round keeps its snapshot —
+  // a view that re-read the live roster/params would now claim 4.
+  await h.call('vibe_math_set_params', { verifierCount: 4 })
+  const after = pick(await h.call('vibe_math_status', {}))
+  const afterR = pick(await h.call('vibe_math_report', {}))
+  assert(!!after && after.expected === 2 && after.dispatched === 2,
+    '★★★ [D4-v2] 中途调高 verifierCount **不改变**在飞轮次的参与集/需求票数（快照仍是 2；实测 ' + JSON.stringify(after) + '）')
+  assert(JSON.stringify(after) === JSON.stringify(afterR),
+    '★★ [D4-v2] 调参后两个视图仍然逐字段相同（实测 ' + JSON.stringify({ status: after, report: afterR }) + '）')
+  await h.call('vibe_math_abort', {})
+}
+
 section('16 the captured prompt corpus is written for human review')
 {
   // Freeze the scheduler in every case FIRST: a still-running tick loop could emit one more

package/tests/formal-verify-v3.test.mjs

@@ -1577,6 +1577,39 @@ async function driveSiteV3(rw, opts, qid) {
   await callTool('vibe_math_abort', {}, rvv)
 }
 
+// ===============================================================
+// 5c. round-2 D4: ONE vote-count source — a mid-verification verifierCount change must not re-derive
+//     the in-flight task's quorum from live params (the audit's "same count, different code" bug).
+// ===============================================================
+section('5c D4 vote count: quorum comes from the task snapshot, not from live params')
+{
+  const RD4 = makeRoot()
+  await callTool('vibe_math_new_project', { name: 'd4-votecount' }, RD4)
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { verifierCount: 2 }), RD4)
+  await callTool('vibe_math_add_proposition', { id: 'p-d4', 概述: 'D4 票数单一来源', 概率: 0.6, 分类: '数论' }, RD4)
+  await callTool('vibe_math_start', {}, RD4)
+  const reD4 = verifyRe('p-d4')
+  assert(await drive(RD4, () => unfiredVerifiers(RD4, reD4).length >= 2, 'two verifiers for p-d4'), 'two verifiers were dispatched for p-d4 (the creation-time snapshot)')
+  // Mid-verification: the office asks for MORE verifiers. Intent-wise that is a NEW requirement for
+  // FUTURE objects; this task's participant set was frozen when it was created.
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { verifierCount: 4 }), RD4)
+  await sleep(300)
+  // Count PER EXACT rId: the proposition may legitimately have several candidate rIds
+  // (r-p-d4, r-p-d4-pf0, …); only the in-flight task for one rId must stay pinned.
+  const labels = spawnOf(RD4, 'verifier:').map((x) => x.label)
+  const exact = {}
+  for (const l of labels) { const m = /^verifier:(r-p-d4):(\d+)$/.exec(l); if (m) exact[m[1]] = (exact[m[1]] || 0) + 1 }
+  const inFlight = exact['r-p-d4'] || 0
+  assert(inFlight === 2, '★ [D4] raising verifierCount mid-verification does NOT re-staff the in-flight task (participant set = the snapshot；实测 ' + JSON.stringify({ inFlight: inFlight, labels: labels }) + '）')
+  // Both dispatched votes satisfy the quorum ⇒ the object must conclude. A view that re-derived its
+  // quorum from the live params would demand 4 votes and stall here forever.
+  await runVerifyRound(RD4, 'p-d4', [1, 1])
+  const cardOf = () => readIf(join(projRoot('d4-votecount'), 'Propos', '数论', 'p-d4.md'))
+  const concluded = await drive(RD4, () => { const c = cardOf(); return /-\s*概率:\s*1(\D|$)/.test(c) || /状态:\s*已验证/.test(c) }, 'p-d4 concludes with the two votes it has', 15000)
+  assert(concluded, '★★★ [D4] the two dispatched votes still satisfy the quorum and the object concludes (no view may re-derive its quorum from live params；card=' + JSON.stringify(cardOf().slice(0, 220)) + '）')
+  await callTool('vibe_math_abort', {}, RD4)
+}
+
 section('10 the captured prompt corpus is written for human review')
 {
   mkdirSync(CORPUS_DIR, { recursive: true })

package/tests/formal-verify-v4.test.mjs

@@ -270,6 +270,24 @@ async function proposeAndVote(h, target, opts = {}) {
   // The verification may only have been QUEUED by the proposal round; finish it.
   return await settleVerify(h, opts.plan || (() => (opts.verdict === undefined ? 1 : opts.verdict)))
 }
+/**
+ * Start a verification and KEEP IT IN FLIGHT (the first half of `proposeAndVote`): record a card, have
+ * r-1 propose verifying it, and stop driving as soon as the verify view is ACTIVE. Note the trap:
+ * `verifyInProgress` is already true while the verification is merely QUEUED, so `consensus.kind`
+ * is the only reliable "it is really running" signal.
+ */
+async function startVerifyOnly(h, target) {
+  const card = { id: target, title: target, statement: '待验证对象 ' + target, prob: 0.8, value: 0.6, motivation: 'm' }
+  await h.callTool('vibe_v4_record_proposition', card, h.resAgent(h.childOf('r-1')))
+  const before = h.followups.length
+  await h.callTool('vibe_v4_message', { to: 'r-1', content: '请处理本轮工作。' })
+  for (let i = 0; i < 300 && h.followups.length === before; i++) await sleep(10)
+  await drive(h, () => ({ summary: '提议验证 ' + target + '。', solved: false, propose_verify: target, contextPct: 20 }), async () => {
+    const s = await h.callTool('vibe_v4_status', {})
+    return !!(s.consensus && s.consensus.kind === 'verify')
+  })
+  return await h.callTool('vibe_v4_status', {})
+}
 /** Wake exactly the given resident with an ordinary work round and return that wake. */
 async function workWake(h, rId) {
   const before = h.followups.length
@@ -1479,6 +1497,75 @@ section('18 every daily-line injection site (coreRules/normal/heartbeat) obeys t
   await N.callTool('vibe_v4_set', { formalVerify: 'off', leanInitiative: 'normal' })
 }
 
+// ===============================================================
+// 22. cross-preset audit P0 (v4 station): the member-visible library text must state that the
+//     residents' file tools resolve against the SESSION CWD, so the listed sub-paths must be used
+//     with the ABSOLUTE prefix (and computation artifacts via receipt.scriptAbs / receipt.cwd).
+// ===============================================================
+section('22 audit P0: member-facing paths carry the session-cwd / absolute-prefix instruction')
+{
+  const N = await establish()
+  const texts = [await N.prompts('brainstorm', 'r-1'), await N.prompts('coreRules'), await N.prompts('normal', 'r-1')]
+  const ok = texts.filter((t) => t.indexOf('会话 cwd') !== -1 && t.indexOf('绝对前缀') !== -1)
+  assert(ok.length >= 1, '★ the member-visible library text says file tools resolve against the SESSION CWD and that listed paths need the ABSOLUTE prefix (found in ' + ok.length + '/3 variants)')
+  assert(ok.some((t) => t.indexOf('receipt.scriptAbs') !== -1 || t.indexOf('receipt.cwd') !== -1), '★ …and names the absolute receipt field (receipt.scriptAbs / receipt.cwd) for computation artifacts')
+}
+
+// ===============================================================
+// 23. cross-preset audit P1 (v4 stations): a member-facing not-found must be diagnosable — code +
+//     live roster status + an actionable next step — including `removeMember` (previously a bare
+//     {ok:false}) and the not-yet-started case.
+// ===============================================================
+section('23 audit P1: member-facing not-found carries code + status + next')
+{
+  const N = await establish()
+  const wrong = await N.callTool('vibe_v4_send_message', { to: 'r-404', content: 'hi' }, N.resAgent(N.childOf('r-1')))
+  assert(wrong.ok === false && wrong.code === 'V4_NO_SUCH_RESIDENT' && !!wrong.next && !!wrong.next.tool, '★ wrong resident id ⇒ code V4_NO_SUCH_RESIDENT + next{tool} (not a bare message)')
+  assert(wrong.status && wrong.status.residentCount >= 1 && wrong.status.running === true, '★ …plus LIVE roster status, so "wrong id" is distinguishable from "not started"')
+  const kicked = await N.callTool('vibe_v4_remove_member', { id: 'r-404' })
+  assert(kicked.ok === false && kicked.code === 'V4_NO_SUCH_RESIDENT' && !!kicked.next && kicked.next.tool === 'vibe_v4_remove_member', '★ vibe_v4_remove_member {id:r-404} ⇒ code + next naming that tool (was a bare {ok:false})')
+  const fresh = await mount()
+  const notStarted = await fresh.callTool('vibe_v4_publish_progress', { content: 'x' })
+  assert(notStarted.ok === false && notStarted.code === 'V4_NO_SUCH_RESIDENT' && !!notStarted.next && !!notStarted.status && notStarted.status.running === false, '★ run not started ⇒ code + next + status.running=false')
+}
+
+// ---------- D4 cross-view: mid-verify hire/fire must not split the views ----------
+section('D4 cross-view: one frozen participant set, seen identically by every view')
+{
+  const h = await establish()
+  const st = await startVerifyOnly(h, 'p-d4')
+  assert(st.consensus && st.consensus.kind === 'verify', 'precondition: an ACTIVE verification for the cross-view check (' + JSON.stringify({ c: st.consensus && st.consensus.kind, ip: st.verifyInProgress }) + ')')
+  const c0 = st.consensus
+  const rp0 = await h.callTool('vibe_v4_report', {})
+  const rv0 = rp0.verify
+  assert(Array.isArray(st.frozenParticipants) && rv0, 'the frozen participant set and the report() verify view are both exposed')
+  assert(c0.expected === st.frozenParticipants.length, '★ consensus.expected === the frozen participant set size')
+  assert(Number(String(rv0.voted).split('/')[1]) === c0.expected, '★ the two views agree on the DENOMINATOR (status().consensus.expected vs report().verify k/N)')
+  assert(rv0.rosterVersion === c0.rosterVersion && c0.rosterVersion === st.rosterVersion, '★ both views (and status) report the SAME rosterVersion')
+  // HIRE mid-verify: the newcomer must NOT join the frozen set (that is what freezing means).
+  const hire = await h.callTool('vibe_v4_add_member', { direction: 'D4 cross-view assertion' })
+  const st2 = await h.callTool('vibe_v4_status', {})
+  const rv2 = (await h.callTool('vibe_v4_report', {})).verify
+  assert(st2.rosterVersion > c0.rosterVersion, 'hiring mid-verify bumps rosterVersion (' + c0.rosterVersion + ' -> ' + st2.rosterVersion + ')')
+  assert(st2.consensus.expected === st2.frozenParticipants.length && st2.consensus.expected === c0.expected,
+    '★ after a mid-verify HIRE the frozen set is UNCHANGED and both views still agree (newcomer did not join)')
+  assert(rv2.rosterVersion === st2.consensus.rosterVersion,
+    '★ after the HIRE the two FROZEN views (status().consensus + report().verify) still report the SAME rosterVersion')
+  assert(st2.rosterVersion > rv2.rosterVersion,
+    '★ …while status().rosterVersion is the LIVE counter and has moved past the snapshot (staleness is visible)')
+  // FIRE mid-verify: the frozen set is pruned so the in-flight verification can still conclude.
+  if (hire && hire.ok && hire.id) await h.callTool('vibe_v4_remove_member', { id: hire.id })
+  const st3 = await h.callTool('vibe_v4_status', {})
+  const rv3 = (await h.callTool('vibe_v4_report', {})).verify
+  assert(st3.consensus.expected === st3.frozenParticipants.length && Number(String(rv3.voted).split('/')[1]) === st3.consensus.expected && rv3.rosterVersion === st3.consensus.rosterVersion,
+    '★ after a mid-verify FIRE the two views STILL agree (the frozen set was pruned together)')
+  assert(st3.frozenParticipants.indexOf(hire && hire.id) === -1, '★ the removed member is not in the frozen set any more (pruned on removal)')
+  // …and the verification really does conclude after that churn (T26/T31 contract).
+  await settleVerify(h, () => 1)
+  const st4 = await h.callTool('vibe_v4_status', {})
+  assert(st4.verifyInProgress === false, '★ the mid-verify hire/fire did NOT prevent the verification from concluding')
+}
+
 // ===============================================================
 console.log('')
 console.log('passed=' + passed + ' failed=' + failed)

package/tests/math-computation-shared.test.mjs

@@ -116,7 +116,11 @@ console.log('-- math_computation shared contract --')
   await withHost({ installed: [] }, async (state) => {
     const r = await state.call({ op: 'probe' })
     ok(r.ok === false && r.code === 'MATH_ENGINE_NOT_FOUND', 'no engine -> ENGINE_NOT_FOUND')
-    ok(r.next && r.next.kind === 'user-install' && r.next.command, 'ENGINE_NOT_FOUND carries the per-OS user-install guide')
+    // round-9: the guide is per-OS and always carries the SUGGESTED command; `command` itself is only
+    // populated when that OS's package manager is actually resolvable on this machine.
+    ok(r.next && r.next.kind === 'user-install' && r.next.perOs && r.next.perOs.windows && r.next.perOs.linux, 'ENGINE_NOT_FOUND carries the per-OS user-install guide')
+    ok(r.next.suggestedCommand === r.next.perOs[r.next.platform], 'the guide keeps the suggested per-OS command alongside the executable one')
+    ok(r.next.packageManagerAvailable === false ? r.next.command === '' : typeof r.next.command === 'string', 'command ⇔ package-manager availability (never a command that cannot run)')
   })
   await withHost({ packages: { numpy: 'present', sympy: 'missing' } }, async (state) => {
     const r = await state.call({ op: 'probe', packages: ['numpy', 'sympy'] })
@@ -800,6 +804,127 @@ console.log('-- math_computation shared contract --')
   ok(!(r.warnings || []).some((w) => w.code === 'PACKAGE_PRECHECK_UNKNOWN'), 'the precheck RAN (no PACKAGE_PRECHECK_UNKNOWN on a fresh root)')
 }
 
+// ── 22. round-8 (P0/D3): member-facing artifact paths must be OPENABLE by members
+// The receipt's scriptPath is PROJECT-ROOT relative, but members' file tools resolve against the
+// SESSION CWD. The receipt/return therefore carry the absolute `scriptAbs` and the `cwd` to join with.
+{
+  const h = makeFakeHost({ installed: ['python3'] })
+  M.registerMathComputation(h.host)
+  const r = await h.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n' })
+  ok(r.ok === true, 'a run succeeds (P0 context)')
+  ok(typeof r.scriptAbs === 'string' && r.scriptAbs.length > 0, '★ the return carries an ABSOLUTE scriptAbs (members can open it directly)')
+  ok(typeof r.cwd === 'string' && r.cwd.length > 0, '★ the return carries cwd (the project root to join with)')
+  ok(String(r.scriptAbs).replace(/\\/g, '/').endsWith(String(r.scriptPath).replace(/\\/g, '/')), '★ scriptAbs ends with the receipt-relative scriptPath (join consistency)')
+  ok(!!h.files && h.files.has(String(r.scriptPath).replace(/\\/g, '/')), '★ the archived script really exists at scriptPath (the path handed to members is real)')
+  const rj = JSON.parse(h.files.get(String(r.receipt.json).replace(/\\/g, '/')))
+  ok(rj.scriptAbs === r.scriptAbs && rj.cwd === r.cwd, 'the RECEIPT carries scriptAbs + cwd too (a later reader can reconstruct the location)')
+  ok(String(M.MATH_ARCHIVE_WORKFLOW_LINE).indexOf('receipt.scriptAbs') !== -1 && String(M.MATH_ARCHIVE_WORKFLOW_LINE_EN).indexOf('receipt.scriptAbs') !== -1, 'the injected archive rule tells members HOW to open the script (zh+en)')
+  ok(/会话 cwd/.test(String(M.MATH_ARCHIVE_WORKFLOW_LINE)) && /SESSION CWD/.test(String(M.MATH_ARCHIVE_WORKFLOW_LINE_EN)), 'the rule states the session-cwd resolution fact (zh+en)')
+}
+
+// ── 23. round-9 (real-engine): an engine INSTALLED but not on PATH must still be discovered
+// R 4.6.1 went to `C:\Program Files\R\R-4.6.1\bin` without touching PATH, so `probe` used to say R
+// was missing even though it was installed.
+{
+  const absTree = {
+    'C:/Program Files/R': [{ name: 'R-4.6.1', type: 'directory' }],
+    'C:/Program Files/R/R-4.6.1/bin': [{ name: 'Rscript.exe', type: 'file' }, { name: 'R.exe', type: 'file' }],
+  }
+  const h = makeFakeHost({ installed: [], absTree: absTree, runtimeRoots: [] })
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'r' })
+  ok(p.ok === true && p.engine === 'r', '★ a Rscript that exists ONLY in the default install dir is discovered (not on PATH)')
+  ok(!!p.engineInfo && /Program Files\/R\/R-4\.6\.1\/bin\/Rscript/.test(String(p.engineInfo.path)), 'the discovered path is the versioned install dir (' + String(p.engineInfo && p.engineInfo.path).slice(0, 60) + ')')
+}
+// ── 24. round-9 (real-engine): never suggest an install command that cannot run on this machine
+{
+  const h = makeFakeHost({ installed: [] })   // `winget` is NOT resolvable here
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'octave' })
+  ok(p.ok === false && p.code === 'MATH_ENGINE_NOT_FOUND', 'a missing engine still fails with ENGINE_NOT_FOUND')
+  ok(!!p.next && p.next.kind === 'user-install', 'the guidance is still user-install shaped')
+  ok(String(p.next.command) === '', '★ no runnable-looking command when its package manager is absent (command is empty)')
+  ok(!/winget|brew|apt|choco|scoop/i.test(String(p.next.command) + ' ' + String(p.message)), '★ no winget/brew/apt suggestion anywhere when that manager is absent')
+  ok(p.next.packageManager === 'winget' && p.next.packageManagerAvailable === false, 'the response SAYS which manager was assumed and that it is unavailable')
+  ok(typeof p.next.note === 'string' && p.next.note.length > 0, 'an explicit note explains that the suggested command cannot run')
+  const h2 = makeFakeHost({ installed: [], resolveMap: { winget: 'C:/fake/winget.exe' } })
+  M.registerMathComputation(h2.host)
+  const p2 = await h2.call({ op: 'probe', engine: 'octave' })
+  ok(/winget/i.test(String(p2.next.command)) && p2.next.packageManagerAvailable === true, 'when the manager IS present the command is offered as before')
+}
+
+// ── 25. round-9 F3/F5/F7: probe completeness, uniform failure evidence, explicit constraint policy
+{
+  // F3: a partial availability line must NAME the configured-but-absent engines.
+  const h = makeFakeHost({ installed: ['python3'] })
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'python' })
+  ok(p.ok === true && Array.isArray(p.absent) && p.absent.length > 0, '★ probe names the configured-but-absent engines instead of being silently partial')
+  ok(p.absent.some((a) => a.engine === 'r' && a.why === 'not-found-on-this-machine'), 'the absent list carries a reason (key `why`) per engine')
+  ok(p.absent.some((a) => a.engine === 'cli' && /caller-supplied/.test(a.why)), 'cli is explained as needing a caller-supplied command')
+  ok(/未发现/.test(String(p.message)), 'the message states which configured engines were not found')
+  // F5: MATH_TIMEOUT carries the SAME evidence fields a non-zero exit does.
+  const h2 = makeFakeHost({ installed: ['python3'], hang: true })
+  M.registerMathComputation(h2.host)
+  const t = await h2.call({ op: 'run', engine: 'python', mode: 'code', code: 'while True: pass\n', timeoutMs: 1000 })
+  ok(t.ok === false && t.code === 'MATH_TIMEOUT', 'a hanging run reports MATH_TIMEOUT')
+  ok(t.timedOut === true && 'exit' in t && t.exit === null, '★ MATH_TIMEOUT carries timedOut:true and an explicit exit field (uniform with NONZERO_EXIT)')
+  ok('stderr' in t && typeof t.stderr === 'string', '★ MATH_TIMEOUT carries the captured stderr like NONZERO_EXIT does')
+  // F7: the response says the constraints are existence-only, and lists the ones that were NOT checked.
+  const h3 = makeFakeHost({ installed: ['python3'], packages: { numpy: 'present' } })
+  M.registerMathComputation(h3.host)
+  const c = await h3.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n', packages: ['numpy>=1'] })
+  ok(c.ok === true && /existence-only/.test(String(c.versionPolicy)), '★ the run response states the version constraints are existence-only')
+  ok(Array.isArray(c.constraintsNotEnforced) && c.constraintsNotEnforced.indexOf('numpy>=1') !== -1, '★ the response names the constraint it did NOT check (no silent drop)')
+  const c2 = await h3.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n', packages: ['numpy'] })
+  ok(Array.isArray(c2.constraintsNotEnforced) && c2.constraintsNotEnforced.length === 0, 'an unconstrained request reports an empty not-enforced list')
+  const m = await h3.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n', packages: ['pandas>=2'] })
+  ok(m.ok === false && /existence-only/.test(String(m.versionPolicy)), 'the missing-package failure also states the constraint policy')
+}
+
+// ── 26. round-9 (N1): edited-archived-script evidence integrity
+// The documented P2a flow: edit the ORIGINAL source, re-run mode:'file' ⇒ SAME archive id, attempt>=2,
+// scriptChanged:true, previousReceipt at the prior attempt, prior attempt untouched. Pointing mode:'file'
+// at an ARCHIVED script is a NEW archive id by design (the id is keyed by the SOURCE PATH) - which must
+// be SAID (fileIsArchivedScript + a warning), not look like broken change detection.
+{
+  const h = makeFakeHost({ installed: ['python3'], files: { 'Problems/x.py': 'print(1)\n' } })
+  M.registerMathComputation(h.host)
+  const r1 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: 'Problems/x.py' })
+  ok(r1.ok === true && r1.attempt === 1 && r1.scriptChanged === false, 'first run of a source file: attempt 1, no change')
+  const rj1 = JSON.parse(h.files.get(String(r1.receipt.json).replace(/\\/g, '/')))
+  ok(typeof r1.runId === 'string' && rj1.runId === r1.runId, '★ the run response exposes its archive id (matches the durable receipt.runId) - needed to check "same archive id"')
+  h.files.set('Problems/x.py', 'print(2)\n')
+  const r2 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: 'Problems/x.py' })
+  ok(r2.ok === true && r2.runId === r1.runId, '★ editing the ORIGINAL source and re-running lands on the SAME archive id')
+  ok(r2.attempt >= 2 && /\/attempts\/\d+/.test(String(r2.attemptDir || '')), '★ the re-run is attempt>=2 under attempts/<n>/')
+  ok(r2.scriptChanged === true, '★ the re-run reports scriptChanged:true')
+  ok(!!r2.previousReceipt && r2.previousReceipt.attempt === r1.attempt && r2.previousReceipt.scriptHash === r1.scriptHash, '★ previousReceipt points at the prior attempt (attempt + scriptHash)')
+  ok(h.files.get(String(r1.scriptPath).replace(/\\/g, '/')) === 'print(1)\n', '★ the prior attempt\'s script is NOT overwritten (append-only)')
+  // A DIFFERENT source path (e.g. a copy of the old script, or a brand-new file) is a NEW archive id BY
+  // DESIGN: the id is keyed by the source path, so there is no history for that id and
+  // scriptChanged/previousReceipt are - correctly - empty. This is the case a finder can mistake for
+  // "broken change detection"; it is not, and the docs now say so.
+  h.files.set('Problems/copy_of_old.py', 'print(1)\n')
+  const r3 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: 'Problems/copy_of_old.py' })
+  ok(r3.ok === true, 'a run of a different source path succeeds (' + JSON.stringify({ ok: r3.ok, code: r3.code }) + ')')
+  ok(r3.runId !== r1.runId, '★ a DIFFERENT source path gets a DIFFERENT archive id')
+  ok(r3.attempt === 1, '★ …and therefore starts at attempt 1 (fresh archive, by design)')
+  ok(r3.scriptChanged === false, '★ …and reports scriptChanged:false (no history FOR THIS id)')
+  ok(r3.previousReceipt === null || r3.previousReceipt === undefined, '★ …and has no previousReceipt (expected, not broken change detection)')
+  ok(h.files.get(String(r1.scriptPath).replace(/\\/g, '/')) === 'print(1)\n', 'the earlier attempt is still untouched after that run')
+}
+// ── 27. round-9 (N2): a TIMEOUT carries its partial output in BOTH the response and the receipt
+{
+  const h = makeFakeHost({ installed: ['python3'], hang: true, stdoutBytes: 16 })
+  M.registerMathComputation(h.host)
+  const t = await h.call({ op: 'run', engine: 'python', mode: 'code', code: 'print("before-timeout")\n', timeoutMs: 1000 })
+  ok(t.ok === false && t.code === 'MATH_TIMEOUT', 'the hanging run reports MATH_TIMEOUT')
+  ok('stdout' in t && 'stderr' in t, '★ the TIMEOUT response carries stdout AND stderr (not just the archived file)')
+  const rj = JSON.parse(h.files.get(String(t.receipt.json).replace(/\\/g, '/')))
+  ok(typeof rj.partialStdout === 'string' && typeof rj.partialStderr === 'string', '★ the TIMEOUT receipt JSON carries the capped partial output (as strings)')
+}
+
 console.log('')
 console.log('=== MATH COMPUTATION SHARED: ' + passed + ' passed, ' + failed + ' failed ===')
 if (failures.length) for (const f of failures) console.error('  - ' + f)

package/vibe-math-v2/agent.cordis.yml

@@ -42,7 +42,7 @@
 
       - math_computation {op: probe|run|receipt|install, engine, mode: code|file|expr, …} — 先 probe 预检引擎/包/许可，再调引擎计算并把脚本与输出归档成可复核回执；缺引擎/缺包只报告与给安装指引/计划；shell 兜底不算归档。
       - 替代必须声明（诚实性）：当替代方案改变了**精确性或结论强度**时（精确符号解 → 数值近似、闭式解 → 采样/求积、改了精度/容差/假设、换了算法类），结论里**必须写明**，不得读起来像得到了原本（精确/所要求的）结果；拿不到精确结果就直说。
-      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>），你可以用普通文件工具打开并编辑它；编辑后用 mode:'file' 指向它重跑，会写出一份**新回执/新 attempt**（含新的 scriptHash）。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
+      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>，**相对项目根**）；**成员的文件工具是按会话 cwd 解析的**，所以打开它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）；编辑后用 mode:'file' 指向它重跑，会写出一份**新回执/新 attempt**（含新的 scriptHash）。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
 
       Final paper: strict termination writes Paper/<project>/{paper.md,paper.tex,paper.pdf,paper.meta.json,paper.log.md}
       automatically — a dedicated paper-writing child assembles the solved material (finalPaper=false disables only that
@@ -120,7 +120,7 @@
 
       - math_computation {op: probe|run|receipt|install, engine, mode: code|file|expr, …} — 先 probe 预检引擎/包/许可，再调引擎计算并把脚本与输出归档成可复核回执；缺引擎/缺包只报告与给安装指引/计划；shell 兜底不算归档。
       - 替代必须声明（诚实性）：当替代方案改变了**精确性或结论强度**时（精确符号解 → 数值近似、闭式解 → 采样/求积、改了精度/容差/假设、换了算法类），结论里**必须写明**，不得读起来像得到了原本（精确/所要求的）结果；拿不到精确结果就直说。
-      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>），你可以用普通文件工具打开并编辑它；编辑后用 mode:'file' 指向它重跑，会写出一份**新回执/新 attempt**（含新的 scriptHash）。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
+      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>，**相对项目根**）；**成员的文件工具是按会话 cwd 解析的**，所以打开它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）；编辑后用 mode:'file' 指向它重跑，会写出一份**新回执/新 attempt**（含新的 scriptHash）。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
 
       Final paper: strict termination writes Paper/<project>/{paper.md,paper.tex,paper.pdf,paper.meta.json,paper.log.md}
       automatically — a dedicated paper-writing child assembles the solved material (finalPaper=false disables only that