dsh-vibe-math 2.7.1 → 2.7.3

package/tests/e2e-v5-round2.test.mjs

@@ -22,11 +22,16 @@ import { tmpdir } from 'node:os'
 import { join, dirname, isAbsolute } from 'node:path'
 
 // round-7 (fix 2) test isolation: engine discovery now also scans DSH's own runtime trees, and this
-// machine HAS a bundled python. This suite injects ONE fake subprocess for everything (LaTeX + math),
-// so an unexpected engine probe would be recorded as a compiler call and would even write a fake
-// paper.pdf. Pinning DSH_HOME at an empty dir keeps the fixture's premise ("no math engine here")
-// true and the suite deterministic; production behaviour is unaffected.
-process.env.DSH_HOME = mkdtempSync(join(tmpdir(), 'vibe-v5-e2e-nodsh-'))
+// machine HAS a bundled python. round-9 adds the known per-OS INSTALL dirs, and this machine now really
+// has python/R installed. This suite injects ONE fake subprocess for everything (LaTeX + math), so an
+// unexpected engine probe would be recorded as a compiler call and would even write a fake paper.pdf.
+// Pinning all of those roots at an empty dir keeps the fixture's premise ("no math engine here") true
+// and the suite deterministic; production behaviour is unaffected.
+const EMPTY_ENGINE_ROOT = mkdtempSync(join(tmpdir(), 'vibe-v5-e2e-nodsh-'))
+process.env.DSH_HOME = EMPTY_ENGINE_ROOT
+process.env.ProgramFiles = EMPTY_ENGINE_ROOT
+process.env['ProgramFiles(x86)'] = EMPTY_ENGINE_ROOT
+process.env.LOCALAPPDATA = EMPTY_ENGINE_ROOT
 
 // V5_PLUGIN lets a sensitivity probe point this suite at a deliberately broken copy.
 // Without it every probe against this suite silently tested the UNMUTATED plugin and was
@@ -66,7 +71,24 @@ function makeSession(id, parentSession) {
 function makeHost(opts) {
   const o = opts || {}
   const WS = o.ws || mkdtempSync(join(tmpdir(), 'vibe-v5r2-'))
-  const listeners = {}, toolRegs = [], commandRegs = [], spawns = [], wakes = [], interrupts = [], drains = []
+  const listeners = {}, toolRegs = [], commandRegs = [], spawns = [], wakes = [], interrupts = [], drains = [], sendAttempts = []
+  // Successful sends that SURVIVE consumption: `peekWakeOf` splices items out of `wakes`, so a probe that
+  // must compare "rounds" against "successful wakes" needs a counter that is never drained.
+  let wakeSends = 0
+  // G1 seam: force every `subagents.sendMessage` to throw (a real host failure / a member whose
+  // continuation is gone). `sendAttempts` records that the wake was TRIED, so a probe can tell
+  // "the wake failed" apart from "no wake was scheduled at all".
+  let failSend = !!o.failSendMessage
+  // spawnMember seam: force every `subagents.startContinuable` to throw (the host cap / a host outage).
+  // `startAttempts` records that founding was TRIED, so a probe can tell "the start failed" apart from
+  // "no start was attempted".
+  let failStart = !!o.failStartContinuable
+  const startAttempts = []
+  // F6 seam: refuse writes whose resolved path matches (the v4 paper suite's G3 seam, same shape), and —
+  // optionally — whose CONTENT matches as well. Every PROVIDED predicate must match, so a probe can target
+  // the FINALIZE-time append to paper.log.md without touching the ~15 log writes the flow makes earlier.
+  let failWriteOn = o.failWriteOn || null
+  let failWriteContent = o.failWriteContent || null
   // Every effect disposer, so a test can simulate a plugin UNLOAD (the Lean queue's disposer is
   // registered first: it terminates in-flight compiles and marks them interrupted).
   const effectDisposers = []
@@ -106,13 +128,26 @@ function makeHost(opts) {
     subagents: {
       list() { return ['spawn'] },
       async startContinuable({ label, request }) {
+        startAttempts.push(label)
+        if (failStart) {
+          // The HOST-CAP shape (not a generic error): `spawnMember` maps it to ACTIVATION_LIMIT_REACHED and
+          // the founding loop QUEUES the member, which is the path a healed host retries.
+          const e = new Error('subagent limit reached (active child limit: 2); wait for an existing child to finish or complete this work with the current agents')
+          e.code = 'ACTIVATION_LIMIT_REACHED'
+          throw e
+        }
         const id = 'c' + (spawns.length + 1)
         const childSession = makeSession(id, 'sess-A'); childSession.header.cwd = WS
         liveAgents.set(id, { id, session: childSession, options: request && request.agentOptions })
         spawns.push({ label, request, childId: id, persona: request && request.persona, ended: false })
         return { childId: id, messageId: 'm' + spawns.length }
       },
-      async sendMessage(parent, childId, blocks) { wakes.push({ childId, blocks }); return 'w' + wakes.length },
+      async sendMessage(parent, childId, blocks) {
+        sendAttempts.push(childId)
+        if (failSend) throw new Error('mock sendMessage failure (G1 seam)')
+        wakeSends += 1
+        wakes.push({ childId, blocks }); return 'w' + wakes.length
+      },
       interrupt(childId) { interrupts.push(childId) },
       async drainContinuableChildren(parent, ids) { drains.push(...ids); for (const i of ids) liveAgents.delete(i) },
     },
@@ -125,7 +160,15 @@ function makeHost(opts) {
       },
       async stat(t) { return existsSync(t.targetKey) ? { version: 'v1', type: 'file', size: 1 } : undefined },
       async readText(t) { return readFileSync(t.targetKey, 'utf8') },
-      async writeText(t, c) { mkdirSync(dirname(t.targetKey), { recursive: true }); writeFileSync(t.targetKey, c, 'utf8') },
+      async writeText(t, c) {
+        // F6 seam: a REAL fs refusal (sandbox denial) rejects, which `writeTextAbs` catches and reports as
+        // "not written" — the exact shape a failed required artifact write has in production.
+        const refuse = (failWriteOn || failWriteContent) &&
+          (!failWriteOn || failWriteOn.test(String(t.targetKey))) &&
+          (!failWriteContent || failWriteContent.test(String(c)))
+        if (refuse) throw new Error('F6_WRITE_FAIL (injected): ' + t.targetKey)
+        mkdirSync(dirname(t.targetKey), { recursive: true }); writeFileSync(t.targetKey, c, 'utf8')
+      },
       async listDir(t) { if (!existsSync(t.targetKey)) return []; return readdirSync(t.targetKey, { withFileTypes: true }).map(e => ({ name: e.name, type: e.isDirectory() ? 'directory' : 'file' })) },
     },
   }
@@ -223,7 +266,7 @@ function makeHost(opts) {
     }
     return null
   }
-  return { WS, ctx, ROOT, ROOT_SESSION, removedServiceQueries, spawns, wakes, interrupts, drains, toolRegs, commandRegs, listeners, effectDisposers, callTool, childAgent, fireEnd, spawnOf, childOf, labelOf, kindOf, settleSpawns, drain, peekWakeOf, peekWakeWhere, set plannedVotes(v) { plannedVotes = v }, get plannedVotes() { return plannedVotes }, set solvePlan(v) { solvePlan = v } }
+  return { WS, ctx, ROOT, ROOT_SESSION, removedServiceQueries, spawns, wakes, interrupts, drains, sendAttempts, startAttempts, setFailSend(v) { failSend = !!v }, setFailStart(v) { failStart = !!v }, setFailWriteOn(v) { failWriteOn = v || null }, setFailWriteContent(v) { failWriteContent = v || null }, get wakeSends() { return wakeSends }, toolRegs, commandRegs, listeners, effectDisposers, callTool, childAgent, fireEnd, spawnOf, childOf, labelOf, kindOf, settleSpawns, drain, peekWakeOf, peekWakeWhere, set plannedVotes(v) { plannedVotes = v }, get plannedVotes() { return plannedVotes }, set solvePlan(v) { solvePlan = v } }
 }
 
 const pluginModule = await import(PLUGIN.href + '?t=' + Date.now())
@@ -405,6 +448,20 @@ console.log('\n[1] the hardened JSON backend (host with no session services at a
     const parsed = JSON.parse(readFileSync(stFile, 'utf8'))
     const inst = parsed.institutes['default::institute']
     assert(!!inst && inst.members.length === 3, 'the persisted state holds 1 academician + 2 researchers (got ' + (inst ? inst.members.length : 'none') + ')')
+// MEASURED (R14, FULL runs): under the A5-ids and A5-kinds mutants BOTH count assertions stay GREEN
+// (0 red) while the new ID-SET / KIND assertion necessarily reddens; those runs show 82 / 21 reds
+// overall, and the remaining ones are the CASCADE of the same mutation (downstream cases reference
+// the id prefix or the kind). So the claim is NOT "only the new assertion reddens".
+// A5: the COUNT is only a lead - assert the semantic unit too. The persisted roster must be
+// exactly {acad, r-1, r-2} by ID and {academician:1, researcher:2} by KIND, so a founding that
+// minted a duplicate id (the allocator returning the same value twice), founded a researcher with
+// the academician kind, or dropped/added a member while still totalling 3 now FAILS.
+const ids = inst.members.map((m) => String(m.id)).sort()
+assert(ids.join(',') === ['acad', 'r-1', 'r-2'].sort().join(','), '* A5 the founded ID SET is exactly {acad, r-1, r-2} (got ' + JSON.stringify(ids) + ')')
+const kinds = {}
+for (const m of inst.members) kinds[String(m.kind)] = (kinds[String(m.kind)] || 0) + 1
+const kindList = Object.keys(kinds).sort().map((k) => k + ':' + kinds[k])
+assert(JSON.stringify(kindList) === JSON.stringify(['academician:1', 'researcher:2']), '* A5 the founded KIND MULTISET is exactly {academician:1, researcher:2} (got ' + JSON.stringify(kinds) + ')')
   }
   assert(h.ROOT_SESSION._events.length === 0, 'the whole founding wrote NOTHING to the host session log (' + h.ROOT_SESSION._events.length + ' events)')
 }
@@ -784,12 +841,49 @@ console.log('\n[15] the host live-child cap (ACTIVATION_LIMIT_REACHED) is named,
   assert(hired.ok === false && hired.code === 'ACTIVATION_LIMIT_REACHED', 'hire reports the host cap by its typed code (' + JSON.stringify(hired).slice(0, 160) + ')')
   assert(/maxActiveSubagents/.test(hired.message || ''), 'the hire failure names maxActiveSubagents, not the opaque host string')
   assert(hostCalls === callsBefore, 'the host was NOT asked again once the ceiling was known (skip-before-spawn; hostCalls=' + hostCalls + ')')
-  // The refused work is QUEUED, not lost: freeing a slot (fire a member) lets the next round retry.
+  // The refused work is QUEUED, not lost. G-6: freeing a slot is now picked up by the framework's
+  // OWN scheduling pass (`retryPendingSpawns()` is the first line of `schedulePass`), so the
+  // PRIMARY assertion here is the TERMINAL STATE — timing-independent, path-independent:
+  // baseline: the product's OWN derived queue, snapshotted immediately before the fire
+  const preAuto = await h.callTool('vibe_v5_status', {})
+  const queuedBeforeAuto = (preAuto.pendingSpawns || []).map(p => p.id)
+  assert(queuedBeforeAuto.length >= 1, 'precondition: deferred members are queued before the automatic case (' + JSON.stringify(queuedBeforeAuto) + ')')
   await h.callTool('vibe_v5_fire', { id: 'r-1', reason: 'cap test' })
-  const resumed = await h.callTool('vibe_v5_resume', {})
-  assert(resumed.ok === true && resumed.respawned >= 1, 'a slot freed by firing a member lets resume rebuild a capped member (respawned=' + (resumed && resumed.respawned) + ')')
+  await h.settleSpawns()
   const st2 = await h.callTool('vibe_v5_status', {})
   assert(st2.members.filter(m => m.phase === 'active' && m.childId).length === CAP, 'the institute is back at the host ceiling (active=' + st2.members.filter(m => m.phase === 'active').map(m => m.id).join(',') + ')')
+  // ONE freed slot is spent on the deferred work: the queue SHRINKS by exactly one (more members may
+  // be refused than a single freed slot can take — the rest stay queued, visibly).
+  const pendingAfterAuto = (st2.pendingSpawns || []).map(p => p.id)
+  const rebuiltByAuto = queuedBeforeAuto.filter(id => pendingAfterAuto.indexOf(id) === -1)
+  assert(rebuiltByAuto.length === 1 && pendingAfterAuto.length === queuedBeforeAuto.length - 1,
+    '★ the freed capacity was spent on exactly ONE deferred member (queued=' + JSON.stringify(queuedBeforeAuto) + ' → pending=' + JSON.stringify(pendingAfterAuto) + ', rebuilt=' + JSON.stringify(rebuiltByAuto) + ')')
+  assert(rebuiltByAuto.every(id => (st2.members.find(m => m.id === id) || {}).phase === 'active'),
+    '★ the rebuilt deferred member is ACTIVE (' + JSON.stringify(rebuiltByAuto) + ')')
+  // The MANUAL `resume` rebuild path stays pinned too — with the automatic retry disabled by the
+  // documented test seam, `resume` is the only thing that can rebuild, so this cannot race the
+  // scheduler (a disjunction accepting either path would be fine ONLY next to the terminal check).
+  process.env.V5_SPAWN_RETRY = 'manual'
+  try {
+    const beforeManual = await h.callTool('vibe_v5_status', {})
+    const queuedBeforeManual = (beforeManual.pendingSpawns || []).map(p => p.id)
+    assert(queuedBeforeManual.length >= 1, 'precondition: at least one deferred member is queued before the manual case (' + JSON.stringify(queuedBeforeManual) + ')')
+    // free exactly one slot; with the seam on, NOTHING rebuilds it — that is what makes the next
+    // assertion attributable to `resume` alone
+    const victim = beforeManual.members.find(m => m.phase === 'active' && m.childId)
+    await h.callTool('vibe_v5_fire', { id: victim.id, reason: 'manual-resume case' })
+    await h.settleSpawns()
+    const afterFree = await h.callTool('vibe_v5_status', {})
+    assert((afterFree.pendingSpawns || []).length === queuedBeforeManual.length,
+      '★ with the automatic retry disabled the freed slot leaves the queue UNTOUCHED (' + JSON.stringify((afterFree.pendingSpawns || []).map(p => p.id)) + ')')
+    const resumed = await h.callTool('vibe_v5_resume', {})
+    assert(resumed.ok === true && resumed.respawned >= 1,
+      'the MANUAL resume path rebuilds a deferred member on its own (respawned=' + (resumed && resumed.respawned) + ')')
+    const st3 = await h.callTool('vibe_v5_status', {})
+    const rebuilt = queuedBeforeManual.filter(id => (st3.members.find(m => m.id === id) || {}).phase === 'active')
+    assert(rebuilt.length >= 1, '★ the member `resume` was asked to rebuild is ACTIVE now (' + JSON.stringify(rebuilt) + ')')
+    assert(st3.members.filter(m => m.phase === 'active' && m.childId).length >= CAP, 'after the manual resume the terminal state holds the ceiling (active=' + st3.members.filter(m => m.phase === 'active').map(m => m.id).join(',') + ')')
+  } finally { delete process.env.V5_SPAWN_RETRY }
 }
 
 // ---------- 16. a state file that was never loaded must never be overwritten (audit H1) --------
@@ -1024,6 +1118,24 @@ console.log('\n[21] office-only tools refuse a caller that is neither a member n
   const ghostRm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' }, ghost)
   assert(ghostRm.ok === false && ghostRm.code === 'V5_MEMBER_NOT_FOUND',
     'vibe_v5_remove_researcher is refused for the unidentifiable caller (' + JSON.stringify(ghostRm).slice(0, 90) + ')')
+  // ---- 6.4: the DIAGNOSIS, not just the code -------------------------------------------------
+  const ghostRec = await h.callTool('vibe_v5_record_progress', { content: 'x' }, ghost)
+  assert(ghostRec.ok === false && ghostRec.code === 'V5_MEMBER_NOT_FOUND' && ghostRec.next && ghostRec.next.kind === 'member-call' && ghostRec.next.tool === 'vibe_v5_members',
+    '* 6.4 branch 3 (unidentifiable caller / the office has no member identity): code + next{kind:member-call, tool:vibe_v5_members} (' + JSON.stringify(ghostRec).slice(0, 120) + ')')
+  assert(typeof ghostRec.message === 'string' && /\u6240\u529e|\u6210\u5458/.test(ghostRec.message),
+    '* 6.4 branch 3 EXPLAINS the office/member distinction instead of a bare refusal (' + String(ghostRec.message).slice(0, 90) + ')')
+  const neverH = makeHost({ pluginModule })
+  const neverStarted = await neverH.callTool('vibe_v5_record_progress', { content: 'x' })
+  assert(neverStarted.ok === false && neverStarted.code === 'V5_MEMBER_NOT_FOUND' && neverStarted.next && neverStarted.next.kind === 'start' && neverStarted.next.tool === 'vibe_v5_start',
+    '* 6.4 branch 1 (the institute was never started): code + next{kind:start, tool:vibe_v5_start} (' + JSON.stringify(neverStarted).slice(0, 120) + ')')
+  // Branches 2 (running, zero active) and 4 (id no longer on the roster) are not reachable through
+  // the tool surface from this harness, so they are pinned STRUCTURALLY (each branch with its own
+  // next{} kind), while branches 1 and 3 above are pinned BEHAVIOURALLY.
+  const src5 = readFileSync(PLUGIN, 'utf8')
+  for (const k of ['start', 'staff', 'member-call', 'roster']) {
+    assert(new RegExp("kind: '" + k + "'").test(src5), '* 6.4 memberDiagnosis branch ' + k + ' exists with its own next{} kind')
+  }
+  assert(/vibe_v5_start/.test(src5) && /vibe_v5_add_researcher/.test(src5), '* 6.4 the start/staff branches point at real tools (vibe_v5_start / vibe_v5_add_researcher)')
   const memberRm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' }, h.childAgent(h.childOf('r-1')))
   assert(memberRm.ok === false && memberRm.code === 'V5_NOT_OFFICE',
     '...and refused for a member (the tool says Office only), not just for ghosts (' + JSON.stringify(memberRm).slice(0, 90) + ')')
@@ -1865,6 +1977,448 @@ console.log('\n[42] every Lean prompt site obeys the leanInitiative gate in both
   assert(s3on.indexOf(DAILY) === -1, 'S3 verifyPrompt: …and the daily line is still absent there')
 }
 
+// ---------- 43. pre-start diagnosis + coherent quorum (architecture self-test defects 1/2) -------
+// The self-test (§18 of _oneoff/slv-playbook.md（原 method3-scripted-driving.md）) found that before `start`:
+//   (1) record_progress / record_proposition / verdict answered a BARE `V5_MEMBER_NOT_FOUND`
+//       with no hint about why or what to do first;
+//   (2) `vibe_v5_status` reported `quorum.m=1` with `voters=0` — reading like a satisfied quorum.
+// Both are asserted here, INCLUDING the actionable `next` step, and the normal (post-start) path
+// is exercised in the same section so a follow-up self-test can see a non-error path.
+console.log('\n[43] pre-start tools explain themselves; the quorum is coherent before and after start')
+{
+  const h = makeHost({ pluginModule })
+  const pre = async (name, args) => await h.callTool(name, args, h.ROOT)
+  const rProg = await pre('vibe_v5_record_progress', { content: '自我测试' })
+  assert(rProg.ok === false && rProg.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rProg.message || '')) &&
+    rProg.next && rProg.next.kind === 'start' && rProg.next.tool === 'vibe_v5_start',
+    '★ pre-start record_progress: the code is unchanged but the answer names the state + the next step (' + JSON.stringify(rProg).slice(0, 200) + ')')
+  const rProp = await pre('vibe_v5_record_proposition', { statement: 's', value: 1, motive: 'm', p: 0.5 })
+  assert(rProp.ok === false && rProp.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rProp.message || '')) && rProp.next && rProp.next.kind === 'start',
+    '★ pre-start record_proposition: same actionable diagnosis (' + JSON.stringify(rProp).slice(0, 160) + ')')
+  const rVer = await pre('vibe_v5_verdict', { target: 'p-x', verdict: 1 })
+  assert(rVer.ok === false && rVer.code === 'V5_MEMBER_NOT_FOUND' && /尚未启动/.test(String(rVer.message || '')) && rVer.next && rVer.next.kind === 'start',
+    '★ pre-start verdict: same actionable diagnosis (' + JSON.stringify(rVer).slice(0, 160) + ')')
+  const st0 = await pre('vibe_v5_status', {})
+  assert(st0.quorum && st0.quorum.started === false && st0.quorum.m === 0 && st0.quorum.voterCount === 0 && st0.quorum.phase === 'not-started',
+    '★ pre-start quorum is COHERENT: started=false, m=0, voters=0 (' + JSON.stringify(st0.quorum) + ')')
+  assert(st0.quorum.next && st0.quorum.next.kind === 'start' && st0.quorum.next.tool === 'vibe_v5_start',
+    '★ …and it says what to do first (' + JSON.stringify(st0.quorum.next) + ')')
+  assert(st0.params && st0.params.m === 0 && st0.params.started === false,
+    'the params view agrees: m=0, started=false (' + JSON.stringify({ m: st0.params && st0.params.m, started: st0.params && st0.params.started }) + ')')
+  assert(st0.quorum.m !== 1 || st0.quorum.voterCount !== 0,
+    'the old inconsistent `m=1 with voters=0` reading is gone')
+  // ── the NORMAL path: after start, quorum is defined and the member tools work ──
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const st1 = await h.callTool('vibe_v5_status', {})
+  assert(st1.quorum && st1.quorum.started === true && st1.quorum.m >= 1 && st1.quorum.voterCount >= 1 && st1.quorum.voters.length === st1.quorum.voterCount,
+    '★ after start the quorum is real: started=true, m>=1, voters listed (' + JSON.stringify(st1.quorum) + ')')
+  const member = h.childAgent(h.childOf('r-1'))
+  const okProg = await h.callTool('vibe_v5_record_progress', { content: '启动后写进度' }, member)
+  assert(okProg.ok === true && /Members\/r-1\/Progress/.test(String(okProg.file || '')),
+    '★ after start the SAME tool succeeds for a member (normal path reachable) (' + JSON.stringify(okProg).slice(0, 120) + ')')
+}
+
+// ---------- 44. workspace containment + single-sourced quorum (3rd self-test defects A/B) --------
+// Defect A: member-facing text said the library root was `Members/<id>/` while a member's OWN
+// file tools resolve relative paths against the SESSION CWD ⇒ a stray `<cwd>/Members/acad/Propos/
+// p-*.md` appeared outside `VibeMath/Projects/…`. Every member-facing path is now CWD-relative,
+// and this section proves that a member card write cannot land outside the project tree.
+// Defect B: the office digest said m=2 while status/acad said m=3 in the same window (two roster
+// snapshots). Every view now reads ONE snapshot and carries `rosterVersion`, so all views at one
+// point in time must agree — including after a roster change.
+console.log('\n[44] paths stay inside the project root; every quorum view agrees')
+{
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  // (A1) the member brief must name the CWD-relative library root (the member's real baseline).
+  const brief = h.spawns.map((sp) => JSON.stringify(sp.request || {})).join('\n')
+  assert(brief.indexOf('VibeMath/Projects/default/Institutes/institute/Members/') !== -1,
+    '★ the member brief carries the CWD-relative library root (' + (brief.match(/Members\/[^"\\]{0,40}/) || [''])[0] + ')')
+  // The contract is ROOT-QUALIFIED declarations: the brief names the CWD-relative root (A1 above)
+  // AND every library declaration it offers carries the member root (`Members/<你>/<section>/…`), so a
+  // member copying one composes a path inside `Members/<id>/`. The legacy institute-relative shapes
+  // (`Progress/<你>/…` and friends) must be gone - those used to send the write outside the member tree.
+  const decls = (brief.match(/Members\/<[^>]*>\/(?:Progress|Propos|Methods|Subproblems)\//g) || [])
+  assert(decls.length >= 4,
+    '* every member-facing library declaration is root-qualified (Members/<你>/<section>/…) (found ' + decls.length + ')')
+  const legacy = (brief.match(/(?:^|[^A-Za-z0-9/_.-])(?:Progress|Propos|Methods|Subproblems)\/<你>\//g) || [])
+  assert(legacy.length === 0,
+    'no member-facing declaration is left in the legacy institute-relative shape (' + JSON.stringify(legacy) + ')')
+  await h.settleSpawns()
+  // (A2) a member card write must not add anything at the workspace TOP level.
+  const topBefore = readdirSync(h.WS).sort().join(',')
+  const card = await h.callTool('vibe_v5_record_proposition', { id: 'p-stray-check', statement: '包层测试', value: 1, motive: 'm', p: 0.5 }, h.childAgent(h.childOf('r-1')))
+  const topAfter = readdirSync(h.WS).sort().join(',')
+  assert(card.ok === true && /Members\/r-1\/Propos\/p-stray-check\.md/.test(String(card.file || '')),
+    'the member card is written through the v5 tool (' + JSON.stringify(card).slice(0, 120) + ')')
+  assert(existsSync(join(h.WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'Members', 'r-1', 'Propos', 'p-stray-check.md')),
+    '…and it exists under VibeMath/Projects/<project>/…')
+  assert(topAfter === topBefore && !existsSync(join(h.WS, 'Members')),
+    '★ NO path outside VibeMath/Projects/… gained files (top level unchanged: ' + topBefore + ' → ' + topAfter + ')')
+  // (B) every quorum view agrees at one point in time, and they move TOGETHER after a hire.
+  const views = async () => {
+    const st = await h.callTool('vibe_v5_status', {})
+    const rp = await h.callTool('vibe_v5_report', {})
+    await h.callTool('vibe_v5_say', { to: 'r-1', text: '请继续推进。' }, h.childAgent(h.childOf('acad')))
+    const w = await h.peekWakeOf('r-1', 3000)
+    const pm = w ? /法定票数 m=(\d+)/.exec(w.text) : null
+    if (w) h.fireEnd(w.childId, { progress: '收到。', solved: false, contextPct: 10 })
+    await sleep(20)
+    return { st, rp, promptM: pm ? Number(pm[1]) : null }
+  }
+  const v1 = await views()
+  assert(v1.st.quorum && v1.rp.quorum && v1.st.quorum.m === v1.rp.quorum.m,
+    '★ status and report agree on m at one point in time (' + JSON.stringify({ status: v1.st.quorum && v1.st.quorum.m, report: v1.rp.quorum && v1.rp.quorum.m }) + ')')
+  assert(v1.st.quorum.rosterVersion === v1.rp.quorum.rosterVersion,
+    'both views carry the SAME rosterVersion (' + JSON.stringify({ s: v1.st.quorum.rosterVersion, r: v1.rp.quorum.rosterVersion }) + ')')
+  assert(v1.promptM === v1.st.quorum.m,
+    'the member-facing state block shows the same m (' + JSON.stringify({ prompt: v1.promptM, status: v1.st.quorum.m }) + ')')
+  // A roster change must reach EVERY view (the stale-snapshot bug). Dismissing a permanent
+  // researcher shrinks the voter set synchronously, so m MUST move in every view at once.
+  const rm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' })
+  assert(rm.ok === true, 'precondition: the roster change succeeded (' + JSON.stringify(rm).slice(0, 140) + ')')
+  await sleep(30)
+  const v2 = await views()
+  assert(v2.st.quorum.m === v2.rp.quorum.m,
+    '★ after the roster changes, status and report STILL agree (status=' + v2.st.quorum.m + ', report=' + v2.rp.quorum.m + ')')
+  assert(v2.st.quorum.rosterVersion !== v1.st.quorum.rosterVersion && v2.st.quorum.m !== v1.st.quorum.m,
+    'the roster change moved both m and rosterVersion (' + JSON.stringify({ before: v1.st.quorum.m, after: v2.st.quorum.m, v: [v1.st.quorum.rosterVersion, v2.st.quorum.rosterVersion] }) + ')')
+}
+
+// ---------- 45. F2: paperSummary() semantics (md runs must not claim tex / compilation) ----------
+console.log('\n[45] paperSummary(): md runs claim no tex, no compilation, no engine')
+{
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  const mdZh = await h.callTool('vibe_v5_paper', { lang: 'zh', format: 'md', editor: 'office' })
+  const st = await h.callTool('vibe_v5_status', {})
+  const p = st.paper || {}
+  assert(mdZh.ok === true && p.format === 'md', '* the md run is reported as format=md (' + JSON.stringify({ ok: mdZh.ok, format: p.format }) + ')')
+  const arts = Array.isArray(p.artifacts) ? p.artifacts : []
+  assert(arts.indexOf('tex') === -1 && arts.indexOf('pdf') === -1, '* md runs list NO tex/pdf artifacts (found ' + JSON.stringify(arts) + ')')
+  assert(!p.engine, '* md runs report no LaTeX engine - i.e. no requirement on a LaTeX toolchain (engine=' + JSON.stringify(p.engine) + ')')
+  assert(typeof p.dir === 'string' && p.dir.indexOf('Paper/') === 0, '* status.paper.dir is the institute Paper/ dir (' + JSON.stringify(p.dir) + ')')
+  assert(p.meta === null || p.meta === undefined, '* meta stays empty until the paper is finalized (meta=' + JSON.stringify(p.meta) + ')')
+  // md x language and md x editor combinations
+  const h2 = makeHost({ pluginModule })                       // independent host: the first paper is already finalised
+  await h2.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  const mdEn = await h2.callTool('vibe_v5_paper', { lang: 'en', format: 'md', editor: 'academician' })
+  console.log('  [45] fresh-host vibe_v5_paper -> ' + JSON.stringify(mdEn).slice(0, 300))
+  const p2 = (await h2.callTool('vibe_v5_status', {})).paper || {}
+  assert(p2.format === 'md' && p2.lang === 'en', '* md x language: lang is honoured and the format stays md (' + JSON.stringify({ format: p2.format, lang: p2.lang, call: mdEn }) + ')')
+  const p2arts = Array.isArray(p2.artifacts) ? p2.artifacts : []
+  assert(p2arts.indexOf('tex') === -1 && p2arts.indexOf('pdf') === -1 && !p2.engine, '* md x editor: still no tex/pdf and no engine (editor=member)')
+  // the `editor` closed set is a CONTRACT: a valid value succeeds, an invalid one is refused by code
+  const hOk = makeHost({ pluginModule })
+  await hOk.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  const okOffice = await hOk.callTool('vibe_v5_paper', { lang: 'zh', format: 'md', editor: 'office' })
+  assert(okOffice.ok === true, '* editor=office is accepted (the closed set is office|academician) (' + JSON.stringify(okOffice).slice(0, 100) + ')')
+  const hBad = makeHost({ pluginModule })
+  await hBad.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  const badEditor = await hBad.callTool('vibe_v5_paper', { lang: 'zh', format: 'md', editor: 'member' })
+  assert(badEditor.ok === false && badEditor.code === 'V5_INVALID_ARGUMENT', '* an out-of-set editor is refused with V5_INVALID_ARGUMENT, not silently coerced (' + JSON.stringify(badEditor).slice(0, 120) + ')')
+}
+// ---------- 46. F6: memberDiagnosis branches — kind AND exact next.tool, exclusive & exhaustive -------
+console.log('\n[46] memberDiagnosis: per-branch kind + exact next.tool')
+{
+  const { readFileSync } = await import('node:fs')
+  const { fileURLToPath } = await import('node:url')
+  const src = readFileSync(fileURLToPath(new URL('../vibe-math-v5/vibe-math-v5.js', import.meta.url)), 'utf8')
+  const dStart = src.indexOf('function memberDiagnosis(')
+  const dEnd = src.indexOf('\n    function ', dStart + 10)
+  const body = src.slice(dStart, dEnd > 0 ? dEnd : dStart + 4000)   // scope: the diagnosis branches only
+  const pairs = [["start","vibe_v5_start"],["staff","vibe_v5_add_researcher"],["member-call","vibe_v5_members"],["roster","vibe_v5_members"]]
+  for (const [kind, tool] of pairs) {
+    assert(new RegExp("kind: '" + kind + "'[^\\n]*?tool: '" + tool + "'").test(body),
+      '* F6 branch ' + kind + ' pairs with next.tool=' + tool + ' (exact - not just ANY next{})')
+  }
+  for (const [kind] of pairs) {
+    const n = (body.match(new RegExp("kind: '" + kind + "'", 'g')) || []).length
+    assert(n === 1, '* F6 kind ' + kind + ' is declared exactly ONCE (mutually exclusive branches, no duplicate/typo kind) - found ' + n)
+  }
+  assert((body.match(/next: \{/g) || []).length >= 4, '* F6 the four branches are exhaustive: every refusal path carries its own next{}')
+}
+// ---------- 47. G1: a FAILED wake must not consume the mailbox (ack only after a successful send) ----
+console.log('\n[47] G1: a failed wake leaves the message PENDING (no ack before the send)')
+{
+  const h = makeHost({ pluginModule, failSendMessage: true })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  // Every wake is forced to fail while the dm is queued, so this message can never be delivered yet.
+  const attemptsBefore = h.sendAttempts.length
+  const said = await h.callTool('vibe_v5_say', { to: 'r-1', text: 'G1 未送达的消息' }, h.childAgent(h.childOf('acad')))
+  assert(said.ok === true && said.delivered === 1,
+    'precondition: the dm was accepted for exactly one recipient (' + JSON.stringify(said).slice(0, 120) + ')')
+  // `say` to an addressed recipient kicks a scheduling pass; wait until a wake is ATTEMPTED.
+  for (let i = 0; i < 60 && h.sendAttempts.length === attemptsBefore; i++) await sleep(25)
+  assert(h.sendAttempts.length > attemptsBefore,
+    '★ the wake was attempted while every send fails (attempts ' + attemptsBefore + ' -> ' + h.sendAttempts.length + ')')
+  assert(h.wakes.length === 0, 'no wake was queued while sendMessage throws (got ' + h.wakes.length + ')')
+  // Heal the host, then trigger a wake DETERMINISTICALLY: a second dm kicks a scheduling pass
+  // (v5 `say` -> scheduleNext), so we do not depend on the heartbeat timing. The prompt must carry
+  // BOTH messages — the first one is the assertion (a failed wake must not consume it), the second
+  // is the positive control that a wake really happened.
+  h.setFailSend(false)
+  await h.callTool('vibe_v5_say', { to: 'r-1', text: 'G1 正控消息' }, h.childAgent(h.childOf('acad')))
+  let prompt = ''
+  for (let i = 0; i < 4 && prompt.indexOf('G1 正控消息') === -1; i++) {
+    const w = await h.peekWakeOf('r-1', 4000)
+    if (w && w.text) prompt = w.text
+  }
+  assert(prompt.indexOf('G1 正控消息') !== -1,
+    '★ positive control: the second dm did wake r-1 (prompt=' + JSON.stringify(prompt.slice(0, 160)) + ')')
+  assert(prompt.indexOf('G1 未送达的消息') !== -1,
+    '★★★ [G1] a message whose wake FAILED is still pending on the next successful wake (prompt=' + JSON.stringify(prompt.slice(0, 220)) + ')')
+  // Two-sided: a SUCCESSFUL wake acks both once — neither may be delivered again.
+  h.fireEnd(h.childOf('r-1'), { progress: '收到', solved: false, contextPct: 20 })
+  await sleep(40)
+  await h.callTool('vibe_v5_say', { to: 'r-1', text: 'G1 第三条' }, h.childAgent(h.childOf('acad')))
+  let after = ''
+  for (let i = 0; i < 4 && after.indexOf('G1 第三条') === -1; i++) {
+    const w = await h.peekWakeOf('r-1', 4000)
+    if (w && w.text) after = w.text
+  }
+  assert(after.indexOf('G1 第三条') !== -1,
+    '★ positive control: the third dm woke r-1 again (prompt=' + JSON.stringify(after.slice(0, 160)) + ')')
+  assert(after.indexOf('G1 未送达的消息') === -1 && after.indexOf('G1 正控消息') === -1,
+    '★★ [G1] after a successful wake the message is ACKED exactly once (not redelivered; prompt=' + JSON.stringify(after.slice(0, 220)) + ')')
+}
+// ---------- 48. G2: a FAILED send must not consume a round (counters after the send) ----------------
+console.log('\n[48] G2: a failed wake does not consume a round (rounds == successful sends)')
+{
+  const h = makeHost({ pluginModule, failSendMessage: true })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const r1 = h.childOf('r-1')
+  // Addressed mail wakes r-1; while the host is broken every such wake FAILS.
+  await h.callTool('vibe_v5_say', { to: 'r-1', text: 'G2 失败唤醒' }, h.childAgent(h.childOf('acad')))
+  for (let i = 0; i < 60 && h.sendAttempts.filter(c => c === r1).length === 0; i++) await sleep(25)
+  const failedAttempts = h.sendAttempts.filter(c => c === r1).length
+  assert(failedAttempts >= 1, 'precondition: at least one wake for r-1 was attempted and failed (' + failedAttempts + ')')
+  assert(h.wakes.filter(w => w.childId === r1).length === 0, 'precondition: no wake for r-1 succeeded yet')
+  // Heal the host and wake r-1 for real.
+  h.setFailSend(false)
+  await h.callTool('vibe_v5_say', { to: 'r-1', text: 'G2 成功唤醒' }, h.childAgent(h.childOf('acad')))
+  let prompt = ''
+  for (let i = 0; i < 4 && prompt.indexOf('G2 成功唤醒') === -1; i++) {
+    const w = await h.peekWakeOf('r-1', 4000)
+    if (w && w.text) prompt = w.text
+  }
+  assert(prompt.indexOf('G2 成功唤醒') !== -1, '★ positive control: the healed host woke r-1 (' + JSON.stringify(prompt.slice(0, 140)) + ')')
+  // `wakeSends` survives `peekWakeOf`'s splice; the status line is built BEFORE the send, so the round it
+  // shows is the one being started: it must equal the number of successes (not attempts).
+  const succeeded = h.wakeSends
+  const mm = /轮次 (\d+)/.exec(prompt)
+  const shown = mm ? Number(mm[1]) : -1
+  assert(succeeded >= 1 && failedAttempts >= 1,
+    'precondition: at least one success and one failure for r-1 (successes=' + succeeded + ', failures=' + failedAttempts + ')')
+  assert(shown === succeeded,
+    '★★★ [G2] a failed send must not consume a round: 轮次=' + shown + ' vs 成功发送=' + succeeded +
+    ' (失败尝试=' + failedAttempts + ') — attempts must not count')
+}
+// ---------- 49. G4: assignment metadata travels INSIDE the CAS write (no second task write) ---------
+console.log('\n[49] G4: the assign writes the task exactly once, and a stale CAS is refused')
+{
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 2 })
+  await h.settleSpawns()
+  const created = await h.callTool('vibe_v5_assign', { subject: 'G4 任务', to: 'r-1', why: 'G4 理由', acceptance: 'G4 验收' })
+  assert(created.ok === true && created.task && created.task.id, 'the office can assign a task (' + JSON.stringify(created).slice(0, 140) + ')')
+  const got = await h.callTool('vibe_v5_task_get', { task_id: created.task.id })
+  const t = (got && got.task) || got
+  assert(t && t.assignedBy === 'office' && t.why === 'G4 理由' && t.acceptance === 'G4 验收',
+    '★ the metadata is part of the SAME task value (' + JSON.stringify([t && t.assignedBy, t && t.why, t && t.acceptance]) + ')')
+  assert(t && t.status === 'in_progress' && t.ownerId === 'r-1' && t.revision === 2,
+    '★ the reassign landed as exactly one revision step (revision=' + (t && t.revision) + ', owner=' + (t && t.ownerId) + ', status=' + (t && t.status) + ')')
+  // The compare-and-set token really is compared: the PRE-assign revision must be refused.
+  const stale = await h.callTool('vibe_v5_task_update', { task_id: created.task.id, expected_revision: 1, action: 'release' }, h.childAgent(h.childOf('acad')))
+  assert(stale.ok === false && stale.code === 'V5_TASK_STALE_REVISION',
+    '★★ a stale expected_revision is refused with V5_TASK_STALE_REVISION (' + JSON.stringify(stale).slice(0, 150) + ')')
+  // …and the reason the lost-update window existed: a second, unprotected write in the assign path.
+  // The source MUST be read through the SAME seam the plugin was loaded from (`PLUGIN`), or a mutant
+  // copy would be invisible here and this assertion would pass against the unmutated repo file.
+  const { readFileSync: rf } = await import('node:fs')
+  const { fileURLToPath: fp } = await import('node:url')
+  const src = rf(fp(PLUGIN), 'utf8')
+  const s0 = src.indexOf('async function taskAssign(')
+  const s1 = src.indexOf('\n    async function ', s0 + 10)
+  const body = src.slice(s0, s1 > 0 ? s1 : s0 + 4000)
+  const writes = (body.match(/putTask\(/g) || []).length
+  assert(writes === 0,
+    '★★★ [G4] the assign path issues NO second, unprotected task write (found ' + writes + ' putTask( in taskAssign) — ' +
+    'a second write reusing the just-read revision is the lost-update window')
+  assert(/assignedBy: isOffice\(memberId\)/.test(body),
+    '★ the metadata goes through the CAS call itself (assignedBy/why/acceptance passed as the internal meta argument)')
+}
+// ---------- 50. spawnMember: the founding round counts only on a SUCCESSFUL start -------------------
+console.log('\n[50] spawnMember: the first prompt shows 轮次 1, and a failed start consumes no round')
+{
+  const h = makeHost({ pluginModule })
+  const startPromptOf = (m) => {
+    const sp = h.spawnOf(m)
+    const blocks = (sp && sp.request && sp.request.prompt) || []
+    return blocks.map((b) => (b && b.text) || '').join('\n')
+  }
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  const first = startPromptOf('r-1')
+  assert(h.spawns.length >= 2 && first.length > 0, 'precondition: the founding prompt of r-1 was recorded (' + h.spawns.length + ' spawn(s))')
+  assert(/轮次 1/.test(first), '★ the FOUNDING prompt announces the round it is starting (轮次 1): ' + JSON.stringify((/轮次 \d+/.exec(first) || ['<none>'])[0]))
+  assert(!/轮次 0/.test(first), '★★ the founding prompt never displays 轮次 0 (the counter is applied after the start, so the value must be passed in explicitly)')
+  await h.settleSpawns()
+  // A FAILED founding must not consume a round: the retry's prompt must still say 轮次 1.
+  const h2 = makeHost({ pluginModule, failStartContinuable: true })
+  const startPromptOf2 = (m) => {
+    const sp = h2.spawnOf(m)
+    const blocks = (sp && sp.request && sp.request.prompt) || []
+    return blocks.map((b) => (b && b.text) || '').join('\n')
+  }
+  await h2.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  assert(h2.startAttempts.length >= 1 && h2.spawns.length === 0,
+    'precondition: founding was ATTEMPTED and every start failed (attempts=' + h2.startAttempts.length + ', spawns=' + h2.spawns.length + ')')
+  const st0 = await h2.callTool('vibe_v5_status', {})
+  assert(st0.members.some((m) => m.phase === 'failed'), 'the failed founders are recorded as failed, not left active')
+  // Heal the host and rebuild through the documented manual resume path.
+  h2.setFailStart(false)
+  await h2.callTool('vibe_v5_resume', {})
+  await h2.settleSpawns()
+  const retry = startPromptOf2('r-1')
+  assert(retry.length > 0, 'precondition: the resumed member was actually started on the retry')
+  assert(/轮次 1/.test(retry),
+    '★★★ [spawnMember] a FAILED start must not consume a round: the rebuilt member\'s first prompt shows 轮次 1, not 2 (' + JSON.stringify((/轮次 \d+/.exec(retry) || ['<none>'])[0]) + ')')
+}
+// ---------- 51. spawnMember: a FAILED resume must not move the round number backwards ----------------
+console.log('\n[51] spawnMember: a failed resume keeps the existing round number (never restarts it)')
+{
+  const h = makeHost({ pluginModule })
+  // The FIRST matching spawn is the founding one; after a rebuild the newest entry is the resumed one.
+  const lastStartPromptOf = (m) => {
+    const sp = h.spawns.slice().reverse().find((s) => String(s.label || '').indexOf('vibe5 ' + m + ' ') !== -1)
+    const blocks = (sp && sp.request && sp.request.prompt) || []
+    return blocks.map((b) => (b && b.text) || '').join('\n')
+  }
+  const roundOf = (t) => ((/轮次 (\d+)/.exec(t) || [])[1] || '<none>')
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  assert(roundOf(lastStartPromptOf('r-1')) === '1',
+    'precondition: the founding prompt starts the member at 轮次 1 (got ' + roundOf(lastStartPromptOf('r-1')) + ')')
+  // Simulate the HOST losing the children (a restart) WITHOUT dismissing the member: its count survives.
+  // (`vibe_v5_fire` deletes the counters on purpose, so it cannot be used for this scenario.)
+  await h.ctx.subagents.drainContinuableChildren(h.ROOT, [h.childOf('r-1')])
+  const attemptsBefore = h.startAttempts.length
+  h.setFailStart(true)
+  await h.callTool('vibe_v5_resume', {})
+  assert(h.startAttempts.length > attemptsBefore,
+    'precondition: the resume was ATTEMPTED while every start fails (attempts ' + attemptsBefore + ' -> ' + h.startAttempts.length + ')')
+  assert(roundOf(lastStartPromptOf('r-1')) === '1',
+    'precondition: the failed resume started nobody (the newest prompt is still the founding one)')
+  // Heal and resume again: the count must CONTINUE, not restart.
+  h.setFailStart(false)
+  await h.callTool('vibe_v5_resume', {})
+  await h.settleSpawns()
+  const resumed = lastStartPromptOf('r-1')
+  assert(h.spawns.filter((s) => String(s.label || '').indexOf('vibe5 r-1 ') !== -1).length >= 2,
+    'precondition: the member was actually rebuilt on the healed resume (' + h.spawns.length + ' spawns total)')
+  assert(roundOf(resumed) === '2',
+    '★★★ [spawnMember] a FAILED resume must not move the round number backwards: the rebuilt prompt says 轮次 ' +
+    roundOf(resumed) + ', expected 轮次 2 (the existing count must survive the failed attempt)')
+  assert(!/轮次 1/.test(resumed), '★★ the existing count was not restarted — no 轮次 1 on the resumed prompt')
+}
+// ---------- 52. F6: a failed REQUIRED artifact write is NAMED (once), and `files` stays honest ------
+console.log('\n[52] F6: a refused required write is named exactly once; a successful one is silent')
+{
+  const settle = async (h) => {
+    await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 0 })
+    await h.settleSpawns()
+    await h.callTool('vibe_v5_paper', {})
+    await drivePaper(h)
+  }
+  // (a) ANTI-VACUITY: a healthy finalisation writes meta and says NOTHING about write failures.
+  const okHost = makeHost({ pluginModule })
+  await settle(okHost)
+  const okSt = await okHost.callTool('vibe_v5_status', {})
+  const okDir = paperDirOf(okHost, 'institute')
+  assert(existsSync(join(okDir, 'paper.meta.json')), 'precondition: the healthy run wrote paper.meta.json')
+  const okWarn = (okSt.paper && okSt.paper.warnings) || []
+  assert(!okWarn.some((w) => /产物写入失败/.test(w)),
+    '★ anti-vacuity: a SUCCESSFUL required write produces no failure warning (' + JSON.stringify(okWarn) + ')')
+  assert((okSt.paper.artifacts || []).indexOf('paper.meta.json') !== -1,
+    '★ the healthy run lists paper.meta.json among its artifacts (' + JSON.stringify(okSt.paper.artifacts) + ')')
+  // (b) THE REFUSAL: paper.meta.json cannot be written.
+  const h = makeHost({ pluginModule, failWriteOn: /paper\.meta\.json$/ })
+  await settle(h)
+  const st = await h.callTool('vibe_v5_status', {})
+  const dir = paperDirOf(h, 'institute')
+  assert(!existsSync(join(dir, 'paper.meta.json')), 'precondition: the injected refusal really prevented the write')
+  const warns = (st.paper && st.paper.warnings) || []
+  const named = warns.filter((w) => /产物写入失败/.test(w) && /paper\.meta\.json/.test(w))
+  assert(named.length === 1,
+    '★★★ [F6] a failed REQUIRED write is named EXACTLY once, by artifact (' + JSON.stringify(warns) + ')')
+  assert(/refillPaperArtifacts|补写/.test(named[0]),
+    '★ the warning names the recovery path, not just the symptom (' + JSON.stringify(named[0].slice(0, 160)) + ')')
+  assert((st.paper.artifacts || []).indexOf('paper.meta.json') === -1,
+    '★ `files` stays HONEST — the artifact that did not land is absent from the list (' + JSON.stringify(st.paper.artifacts) + ')')
+  assert(existsSync(join(dir, 'paper.md')), 'the other artifacts still landed (only the refused one is missing)')
+  // …and the idempotent refill is what repairs it once the host allows writes again.
+  h.setFailWriteOn(null)
+  const refill = await h.callTool('vibe_v5_paper', {})
+  assert(refill.ok === true && existsSync(join(dir, 'paper.meta.json')),
+    '★ the documented recovery path refills the missing artifact (' + JSON.stringify(refill.refill || refill).slice(0, 140) + ')')
+  const st2 = await h.callTool('vibe_v5_status', {})
+  const named2 = ((st2.paper && st2.paper.warnings) || []).filter((w) => /产物写入失败/.test(w) && /paper\.meta\.json/.test(w))
+  assert(named2.length === 1, '★★ the read-only refill does NOT multiply the warning (still exactly one): ' + JSON.stringify(named2))
+  // (c) THE FLOW LOG, scoped to the FINALIZE-time append only (path + content): the ~15 earlier log writes
+  // must still land, so `paper.log.md` exists but lacks the 定稿 section. The content predicate is NOT
+  // anchored — an append carries the whole earlier log in front of the new section.
+  const hl = makeHost({ pluginModule, failWriteOn: /paper\.log\.md$/, failWriteContent: /## 定稿（/ })
+  await settle(hl)
+  const ldir = paperDirOf(hl, 'institute')
+  const logPath = join(ldir, 'paper.log.md')
+  assert(existsSync(logPath), 'precondition: the earlier paper.log.md writes landed (only the final append is refused)')
+  const logText = readFileSync(logPath, 'utf8')
+  assert(logText.indexOf('## 定稿（') === -1, 'precondition: the refused append really did not reach the log')
+  assert(logText.indexOf('## ') !== -1, 'precondition: the log still carries the flow entries written before finalisation')
+  const lst = await hl.callTool('vibe_v5_status', {})
+  const lwarn = ((lst.paper && lst.paper.warnings) || []).filter((w) => /产物写入失败/.test(w) && /paper\.log\.md/.test(w))
+  assert(lwarn.length === 1, '★★ [F6] a failed FINALIZE-time log write is named exactly once (' + JSON.stringify(lst.paper && lst.paper.warnings) + ')')
+  assert(/refillPaperArtifacts|补写/.test(lwarn[0]), '★ the log warning names the recovery path too')
+  const lmeta = existsSync(join(ldir, 'paper.meta.json')) ? JSON.parse(readFileSync(join(ldir, 'paper.meta.json'), 'utf8')) : null
+  assert(!!lmeta && (lmeta.warnings || []).some((w) => /产物写入失败/.test(w) && /paper\.log\.md/.test(w)),
+    '★★ the DURABLE meta is re-written so it also names the missing log (' + JSON.stringify(lmeta && lmeta.warnings) + ')')
+  assert((lst.paper.artifacts || []).indexOf('paper.meta.json') !== -1, 'the meta still landed and stays in the artifact list')
+  // Anti-vacuity for (c): the healthy run's log DOES contain the 定稿 section.
+  const okLog = existsSync(join(okDir, 'paper.log.md')) ? readFileSync(join(okDir, 'paper.log.md'), 'utf8') : ''
+  assert(okLog.indexOf('## 定稿（') !== -1, '★ anti-vacuity: the healthy run\'s log carries the 定稿 section (the seam is what removed it)')
+}
+// ---------- 53. v5 L1: a broken Lean path contract is SURFACED in report()'s diagnostics ------------
+console.log('\n[53] v5 L1 leanPathContractOk: the queued note reaches report() diagnostics')
+{
+  const { readFileSync: rf1 } = await import('node:fs')
+  const { fileURLToPath: fp1 } = await import('node:url')
+  const src = rf1(fp1(PLUGIN), 'utf8')
+  assert(src.indexOf('function leanPathContractOk() {') !== -1, '★ [v5 L1] the contract checker exists (symbol anchor)')
+  assert(src.indexOf("if (!leanPathContractOk()) noteLoadProblem('Lean path contract broken") !== -1,
+    '★ [v5 L1] the load path CALLS it and queues the named note (source anchor)')
+  assert(src.indexOf('drainLoadNotes()') > src.indexOf('leanPathContractOk()'),
+    '★ [v5 L1] the queued note is DRAINED on the next commit (the drain site follows the check)')
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 0 })
+  await h.settleSpawns()
+  // ONE more committing action: `commit()` is what drains the queued load notes into the diagnostics log.
+  await h.callTool('vibe_v5_message', { to: 'all', content: 'L1 probe commit' })
+  // `report()` returns a STRING, so the tool spec is invoked directly (callTool would JSON.parse it).
+  const spec = h.toolRegs.find((t) => t.name === 'vibe_v5_report')
+  const rep = spec ? String(await spec.execute({}, { agent: h.ROOT })) : ''
+  // MEASURED (2026-10, this suite): a healthy host's report() is ~1050 chars and does NOT contain the
+  // diagnostics section — that section is CONDITIONAL (it renders only when there is something to report),
+  // so the anti-vacuity check must be "the report tool was found and returned a substantive string", not
+  // "the diagnostics heading is present". The negative L1 assertion below is what discriminates, and the
+  // shipped family's v5-L1 mutant proves it can redden (12/12, named red on the line beneath).
+  assert(spec !== undefined && rep.length > 200,
+    '★ precondition: the report tool was found and returned a substantive report (' + rep.length + ' chars)')
+  assert(rep.indexOf('Lean path contract broken') === -1,
+    '★★ [v5 L1] a HEALTHY composition surfaces no Lean path contract note in report() diagnostics')
+}
 console.log('')
 console.log('passed=' + passed + ' failed=' + failed)
 if (failed) { console.error('FAILURES:'); for (const f of failures) console.error('  - ' + f); process.exit(1) }