dsh-vibe-math 2.7.1 → 2.7.3

package/tests/formal-verify-v2.test.mjs

@@ -28,11 +28,20 @@
 //
 // Run: node tests/formal-verify-v2.test.mjs
 // ============================================================
-import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, writeFileSync, statSync, mkdirSync } from 'node:fs'
+import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, writeFileSync, statSync, mkdirSync, renameSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, dirname, isAbsolute, resolve as pathResolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
+// Concurrency isolation: the shipped corpus is read by other probes (audit-prompt-invariants) while
+// this suite runs under the gate, so the write must be atomic — a reader must never see a truncated file.
+function writeFileAtomic(target, text) {
+  const tmp = target + '.tmp-' + process.pid + '-' + Math.random().toString(36).slice(2, 8)
+  writeFileSync(tmp, text, 'utf8')
+  renameSync(tmp, target)
+}
+
+
 // V2_PLUGIN may be a REPO-RELATIVE path or an ABSOLUTE one (a mutant copy outside the repo, e.g. a
 // temp dir). The previous `new URL('file:///' + path)` form only worked for drive-qualified Windows
 // paths and made out-of-repo variants impossible; this is the same isAbsolute-aware resolution the
@@ -1210,6 +1219,26 @@ section('15 the require gate also covers the judge-problem transfer')
   assert(!existsSync(join(proj, 'Verified', '数论_Verified.json')), 'no Verified card for the source proposition')
 }
 
+// ---------- 15g. P2 #7: the accuracy-sample caps are documented AND announced ----------
+// The caps (8 samples per object, 32 objects) are deliberate bounded retention, but they used to
+// evict SILENTLY — the H4 accuracy statistic then drifted with the object count and nothing said so.
+// This case drives a long debate (2 verifiers × several rounds ⇒ > 8 samples for one object) and
+// requires the eviction to show up in the activity log.
+section('15g P2 #7: accuracy-sample cap eviction is announced, not silent')
+{
+  const h = await makeCase('score-cap-warn')
+  // 一轮就凑够样本：10 个验证器 ⇒ 同一对象一次记 10 条（> 每对象上限 8），无需多轮辩论。
+  await h.call('vibe_math_set_params', { verifierCount: 10, maxParallelThreshold: 20, debateMaxRounds: 1, verdictMode: 'flat' })
+  await h.call('vibe_math_add_proposition', { id: 'p-cap', 概述: '计分上限告警', 概率: 0.6, 分类: '数论' })
+  await startScheduler(h)
+  const cand = await waitFor(() => { const x = verifiersOf(h, 'r-p-cap'); return x.length >= 10 ? x : undefined }, 80, 250)
+  assert(!!cand, '对照：10 个验证器都被派出（实测 verifier spawns=' + h.spawns.filter((s) => s.label.indexOf('verifier') === 0).length + '）')
+  if (cand) { fireVerdicts(h, cand, 0.5); await sleep(400); await tick() }
+  const acts = (await h.call('vibe_math_status', {})).recentActivity.map((a) => a.detail).join('\n')
+  assert(/评审计分样本达上限/.test(acts), '★★ [P2#7] 超过每对象 8 条待计分样本时**写告警**，不再静默丢弃（verifier spawns=' + h.spawns.filter((s) => s.label.indexOf('verifier') === 0).length + ' verifiers=' + verifiersOf(h, 'r-p-cap').length + ' followups=' + h.followups.length + ' acts=' + JSON.stringify(acts.slice(-260)) + '）')
+  await h.call('vibe_math_abort', {})
+}
+
 // ---------- 16. the prompt corpus (contract §10.10) ----------
 // A HUMAN must be able to re-read every prompt the framework emitted, not just the assertions
 // about them. Paths are normalised so the dump is deterministic, diffable and machine-free.
@@ -1292,7 +1321,9 @@ section('15c the framework push report and the gate notice are captured')
     else await sleep(150)
   }
   assert(!!gline && /require 模式搁置/.test(gline), '★★ the require-gate withholding reaches the human-readable channel (captured verbatim)')
-  assert(!!gline && /Formal\/TODO\.md/.test(gline), 'and the notice says where the withholding was recorded')
+  assert(!!gline && /Formal\/TODO\.md/.test(gline), 'and the notice says where the withholding was recorded')
+  assert(/下一步：/.test(String(gline)) && /代码 formal-required/.test(String(gline)) && !/（当前状态 none）/.test(String(gline)),
+    '★★ [A5] require-gate 反馈行给出**下一步**且状态已本地化（代码 token 保留），实测 ' + JSON.stringify(gline))
   g.feedbackLine = gline || ''
   await g.call('vibe_math_pause', {})
 }
@@ -1636,6 +1667,49 @@ async function driveSites(h, opts, qid) {
   await hv.call('vibe_math_abort', {})
 }
 
+// ---------- 15f. P2-v2 D4: ONE participant set / ONE count across the two views ----------
+// Pinned definition (must stay in sync with the plugin's voteCount() doc comment):
+//   * participant set of a verify task = `t.children` of the CURRENT round (their `childResults`
+//     entries are that round's votes);
+//   * "how many votes are required" = the task's **creation-time snapshot** `t.expectedCount`
+//     (written when processVerify creates the task) — NEVER live `params.verifierCount` /
+//     `params.maxParallelThreshold`.
+// Before the convergence the answer lived in three places (`consensus()` over reported votes with
+// the MIN_REVIEWERS constant, `finalizeVerification()` counting again, and two inline `allReported`
+// checks over `t.children`), so a mid-round hire/fire could make the debate view and the verdict
+// view disagree about whether the round is complete.
+section('15f P2-v2 D4: both views read ONE participant set (snapshot + round)')
+{
+  const h = await makeCase('d4-v2-midvote')
+  await h.call('vibe_math_set_params', { verifierCount: 2, debateMaxRounds: 2, verdictMode: 'flat' })
+  await h.call('vibe_math_add_proposition', { id: 'p-d4v2', 概述: 'D4 v2 参与集', 概率: 0.6, 分类: '数论' })
+  await startScheduler(h)
+  const staffed = await waitFor(() => { const x = h.spawns.filter((s) => s.label.startsWith('verifier:r-p-d4v2')); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!staffed, 'two reviewers were staffed for the round (the creation-time snapshot)')
+  const pick = (o) => ((o && o.verifyTasks) || []).filter((t) => String(t.rId).indexOf('p-d4v2') !== -1)[0]
+  const st1 = pick(await h.call('vibe_math_status', {}))
+  const rp1 = pick(await h.call('vibe_math_report', {}))
+  assert(!!st1 && !!rp1 && st1.expected === 2 && st1.dispatched === 2 && st1.round === 1,
+    '★★ [D4-v2] the projection reports the round snapshot: expected=2 dispatched=2 round=1（实测 ' + JSON.stringify({ status: st1, report: rp1 }) + '）')
+  assert(JSON.stringify(st1) === JSON.stringify(rp1),
+    '★★★ [D4-v2] status 与 report 两个视图对同一任务的参与集/票数**逐字段相同**（一个来源；实测 ' + JSON.stringify({ status: st1, report: rp1 }) + '）')
+  // mid-vote "hire more": the office raises verifierCount. The in-flight round keeps its snapshot —
+  // a view that re-read the live roster/params would now claim 4.
+  await h.call('vibe_math_set_params', { verifierCount: 4 })
+  const after = pick(await h.call('vibe_math_status', {}))
+  const afterR = pick(await h.call('vibe_math_report', {}))
+  assert(!!after && after.expected === 2 && after.dispatched === 2,
+    '★★★ [D4-v2] 中途调高 verifierCount **不改变**在飞轮次的参与集/需求票数（快照仍是 2；实测 ' + JSON.stringify(after) + '）')
+  assert(JSON.stringify(after) === JSON.stringify(afterR),
+    '★★ [D4-v2] 调参后两个视图仍然逐字段相同（实测 ' + JSON.stringify({ status: after, report: afterR }) + '）')
+  // 6.5：两条路径（buildReport / getStatus）都必须走同一个 verifyTasksView()，整数组逐字段相同。
+  const stAll = (await h.call('vibe_math_status', {})).verifyTasks || []
+  const rpAll = (await h.call('vibe_math_report', {})).verifyTasks || []
+  assert(stAll.length >= 1 && JSON.stringify(stAll) === JSON.stringify(rpAll),
+    '★★★★ [6.5] status/report 的 verifyTasks 由同一个 verifyTasksView() 产出、逐字段相同（实测 ' + JSON.stringify({ status: stAll, report: rpAll }) + '）')
+  await h.call('vibe_math_abort', {})
+}
+
 section('16 the captured prompt corpus is written for human review')
 {
   // Freeze the scheduler in every case FIRST: a still-running tick loop could emit one more
@@ -1651,7 +1725,11 @@ section('16 the captured prompt corpus is written for human review')
       .split(ws).join('<WS>')
       // Epoch-ms in a verification-log FILE NAME is run metadata: the final-paper material embeds the
       // evidence index verbatim, so it must be normalised or the shipped corpus changes every run.
-      .replace(/_[0-9]{10,16}\.json/g, '_<TIME>.json')
+      // 为什么必须保留可选短 id 组（不要"简化"掉）：P7 把裁决日志名改成了
+      // `<rId>_<epochMs>_<shortId>.json`，旧的 `_[0-9]{10,16}\.json` 因此不再匹配，
+      // 于是每次跑动都把自己那次的 时间戳+shortId 写进 shipped 语料（语料非确定性）。
+      // 去掉 `(_[0-9a-f]{8})?` 这个组会静默地重新引入"每次跑都不同"的语料。
+      .replace(/_[0-9]{10,16}(_[0-9a-f]{8})?\.json/g, '_<TIME>.json')
   }
   const entries = []
   for (const h of hosts) {
@@ -1668,8 +1746,16 @@ section('16 the captured prompt corpus is written for human review')
     // gate's withholding notice. It is captured once, in case 15c, for determinism.
     if (typeof h.feedbackLine === 'string' && h.feedbackLine) entries.push({ kind: 'feedback', case: h.label, label: 'activity-log', prompt: scrub(h, h.feedbackLine) })
   }
+  // F7：v2 各回执的对象类型不同（验证用 Result/Reason 大写；计划/求解/方法卡用小写键），历史上只在示例里
+  // 体现大小写。现在每一条**含 json 契约**的提示词都必须显式写明「键名大小写精确匹配、不接受别名」。
+  const jsonFenced = entries.filter((e) => e.prompt.indexOf('```json') !== -1 || /single JSON object/.test(e.prompt))
+  const missingCaseRule = jsonFenced.filter((e) => e.prompt.indexOf('KEY CASE IS PART OF THE REPLY CONTRACT') === -1)
+  assert(jsonFenced.length >= 4, 'F7: prompts carrying a json contract were captured (' + jsonFenced.length + ')')
+  assert(missingCaseRule.length === 0, '★★ [F7] every json-contract prompt states the canonical key-case rule (offenders=' + JSON.stringify(missingCaseRule.map((e) => e.label)) + ')')
+  const capitalised = entries.filter((e) => /"Result":/.test(e.prompt))
+  assert(capitalised.every((e) => e.prompt.indexOf('KEY CASE IS PART OF THE REPLY CONTRACT') !== -1), '★★ [F7] …including the capitalised Result/Reason contracts (' + capitalised.length + ')')
   mkdirSync(CORPUS_DIR, { recursive: true })
-  writeFileSync(join(CORPUS_DIR, 'formal-verify-v2.json'), JSON.stringify({ entries: entries }, null, 2), 'utf8')
+  writeFileAtomic(join(CORPUS_DIR, 'formal-verify-v2.json'), JSON.stringify({ entries: entries }, null, 2))
   const md = ['# V2 形式化验证交互语料（prompt corpus）', '',
     '> 由 `formal-verify-v2.test.mjs` 落盘：框架**真正发出**的每一条提示词原文。',
     '> 工作区路径归一化为 `<WS>`、VibeMath 根归一化为 `<VIBEMATH>`，因此可 diff、不泄露本机路径。',
@@ -1685,7 +1771,7 @@ section('16 the captured prompt corpus is written for human review')
     md.push('```')
     md.push('')
   }
-  writeFileSync(join(CORPUS_DIR, 'formal-verify-v2.md'), md.join('\n'), 'utf8')
+  writeFileAtomic(join(CORPUS_DIR, 'formal-verify-v2.md'), md.join('\n'))
   assert(existsSync(join(CORPUS_DIR, 'formal-verify-v2.json')) && existsSync(join(CORPUS_DIR, 'formal-verify-v2.md')), 'the prompt corpus was written (JSON + Markdown)')
   assert(entries.length >= 15, 'the corpus covers the whole run (' + entries.length + ' prompts)')
   assert(entries.some((e) => /【Lean 形式化验证（鼓励模式）】/.test(e.prompt)), 'the corpus contains the encourage verify prompt')

package/tests/formal-verify-v3.mutants.mjs

@@ -0,0 +1,117 @@
+// Registered mutant harness for the v3 formal-verify suite — the suite carries its own proof.
+// Mirrors tests/formal-verify-v4.mutants.mjs and tests/v5-institute-fixes.mutants.mjs: each family is a
+// SINGLE content-anchored mutation of the v3 preset (no line numbers), the suite runs through the
+// V3_PLUGIN seam, child runs are bounded (a timeout is a HANG, never a pass), and skipped families are
+// printed and counted. Exit criterion: every family reddens BY NAME; ALL MUTANTS RED AS REQUIRED.
+// Run: node tests/formal-verify-v3.mutants.mjs
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync, rmSync, readdirSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const PRESET = 'vibe-math-v3'
+const MAIN = PRESET + '.js'
+const SUITE = 'tests/formal-verify-v3.test.mjs'
+const ENV = 'V3_PLUGIN'
+// Measured: the v3 formal-verify suite is ~40 s per child run; MUTANT_CHILD_TIMEOUT_MS overrides it.
+const CHILD_TIMEOUT_MS = Number(process.env.MUTANT_CHILD_TIMEOUT_MS || 300000)
+const TIMES = []
+const hangs = []
+const skipped = []
+function copyGraph(file, dest) {
+  const src = join(REPO, PRESET, file)
+  copyFileSync(src, join(dest, file))
+  for (const m of readFileSync(src, 'utf8').matchAll(/from\s+'(\.\/[A-Za-z0-9_.-]+\.js)'/g)) {
+    const dep = m[1].slice(2)
+    if (!readdirSync(dest).includes(dep)) copyGraph(dep, dest)
+  }
+}
+function runFamily(f) {
+  const dest = join(tmpdir(), 'v3fv-mut-' + Math.random().toString(36).slice(2, 10))
+  mkdirSync(dest, { recursive: true })
+  copyGraph(MAIN, dest)
+  const target = join(dest, f.editFile || MAIN)
+  const before = readFileSync(target, 'utf8')
+  const n = before.split(f.from).length - 1
+  const okCount = f.lastOnly || f.all ? n >= 1 : n === 1
+  if (!okCount) {
+    skipped.push(f.name + ' (anchor x' + n + ')')
+    console.error('  SKIP - ' + f.name + ' (anchor x' + n + ')')
+    rmSync(dest, { recursive: true, force: true })
+    return false
+  }
+  const mutated = before.split(f.from).join(f.to)
+  writeFileSync(target, mutated, 'utf8')
+  try { execFileSync(process.execPath, ['--check', target], { stdio: 'pipe' }) }
+  catch (e) {
+    writeFileSync(target, before, 'utf8')
+    skipped.push(f.name + ' (mutation did not compile)')
+    console.error('  SKIP - ' + f.name + ' (mutation did not compile; restored)')
+    rmSync(dest, { recursive: true, force: true })
+    return false
+  }
+  const t0 = Date.now()
+  let out = ''
+  let code = 0
+  let hang = false
+  try {
+    out = execFileSync(process.execPath, [SUITE], {
+      cwd: REPO, encoding: 'utf8', timeout: CHILD_TIMEOUT_MS, killSignal: 'SIGKILL',
+      env: Object.assign({}, process.env, { [ENV]: join(dest, MAIN) }),
+    })
+  } catch (e) {
+    if (e && (e.killed || e.signal === 'SIGKILL')) hang = true
+    code = (e && e.status) || 1
+    out = String((e && e.stdout) || '') + String((e && e.stderr) || '')
+  }
+  const ms = Date.now() - t0
+  TIMES.push([f.name, ms])
+  if (hang) hangs.push(f.name + '(' + Math.round(ms / 1000) + 's)')
+  const named = out.split(/\r?\n/).filter((l) => /^\s*(FAIL - | {2}- )/.test(l) && f.expect.test(l)).map((l) => l.trim())
+  const ok = !hang && code !== 0 && named.length > 0
+  console.log((hang ? '  HANG - ' : (ok ? '  ok - ' : '  FAIL - ')) + f.name + ' [' + ms + 'ms]' + (named.length ? ' :: ' + named[0].slice(0, 150) : ' :: no named red (exit=' + code + ')'))
+  rmSync(dest, { recursive: true, force: true })
+  return ok
+}
+// MEASURED BOUNDARY (V3-G2): at this revision NO strictly count-preserving mutant exists for the
+// re-eligible-SLOT-set assertion. Reason (measured in-product): a re-verification creates a FRESH
+// task with `children: []` and `round: 1` (vibe-math-v3.js:2164) and the slot index comes from
+// `const index = t.children.length` (:2172), so any fixed index offset shifts round one too and the
+// two slot sets stay equal. The only mutant that reddens it therefore also changes the COUNT - it is
+// labelled NOT COUNT-PRESERVING below, and it is landed because the assertion itself is the semantic
+// unit (a re-verification that re-armed different slots satisfies the old count).
+//
+// TWO CANDIDATE MUTANTS WERE THEN MEASURED - BOTH REJECTED (so no V3-G2 family is shipped):
+//   (i) the ruled shape (children: [] inherits the previous children) is INERT: the concluded verify
+//       task is already deleted when the new one is built, so `tasks['verify:'+rId]` is undefined and
+//       the expression degrades to `[]` => the suite ran to exit 0 with NO named red (a mutant that
+//       changes nothing proves nothing);
+//  (ii) the broad form (verifier backfill disabled entirely) made the suite exceed the 300 s child
+//       cap => classified as a HANG, which is not a valid red either.
+// => RECORDED BOUNDARY: at this revision the re-eligible-SLOT-set assertion ships WITHOUT a
+//    discriminating mutant (measured, not assumed). The assertion itself is landed and green.
+
+const FAMILIES = [
+  {
+    // V3-G1: every verifier spawn for one object is stamped with the SAME slot index, so two "independent
+    // reviews" are really two copies of one slot. The fired-verifier COUNT stays 2 (the old assertion
+    // passes); the distinct-slot assertion is what catches it.
+    name: 'V3-G1: every review is stamped with the same slot index (count still 2)',
+    from: "'verifier:' + t.rId + ':' + index",
+    to: "'verifier:' + t.rId + ':0'",
+    expect: /V3-G1 .*DISTINCT verifier slots/,
+  },
+]
+let red = 0
+for (const f of FAMILIES) { const ok = runFamily(f); if (ok) red++ }
+const totalMs = TIMES.reduce((a, t) => a + t[1], 0)
+console.log('')
+console.log('mutant families reddening the v3 formal-verify suite by name: ' + red + '/' + FAMILIES.length)
+console.log('timings (per family): ' + TIMES.map((t) => String(t[0]).split(':')[0] + '=' + t[1] + 'ms').join('  '))
+console.log('TOTAL WALL TIME (all families + setup): ' + totalMs + 'ms (' + Math.round(totalMs / 1000) + 's)')
+console.log('hangs=[' + hangs.join(' | ') + ']')
+console.log('skipped=[' + skipped.join(' | ') + ']')
+if (red !== FAMILIES.length || skipped.length || hangs.length) process.exit(1)
+console.log('ALL MUTANTS RED AS REQUIRED')

package/tests/formal-verify-v3.test.mjs

@@ -19,11 +19,20 @@
 //
 // Run: node tests/formal-verify-v3.test.mjs
 // ============================================================
-import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, dirname, isAbsolute, resolve as pathResolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
+// Concurrency isolation: the shipped corpus is read by other probes (audit-prompt-invariants) while
+// this suite runs under the gate, so the write must be atomic — a reader must never see a truncated file.
+function writeFileAtomic(target, text) {
+  const tmp = target + '.tmp-' + process.pid + '-' + Math.random().toString(36).slice(2, 8)
+  writeFileSync(tmp, text, 'utf8')
+  renameSync(tmp, target)
+}
+
+
 // V3_PLUGIN may be a REPO-RELATIVE path or an ABSOLUTE one (a mutant copy outside the repo, e.g. a
 // temp dir). The previous `new URL('file:///' + path)` form only worked for drive-qualified Windows
 // paths and made out-of-repo variants impossible; this is the same isAbsolute-aware resolution the
@@ -34,11 +43,16 @@ const PLUGIN = process.env.V3_PLUGIN
 const HERE = dirname(fileURLToPath(import.meta.url))
 // AUDIT-CHECKLIST §2.4: the suite must also keep the INTERACTION TEXT it drove, so a human can
 // re-read the prompts the framework really emitted. V3_CORPUS_DIR overrides the destination.
-const CORPUS_DIR = process.env.V3_CORPUS_DIR ? pathResolve(process.env.V3_CORPUS_DIR) : join(HERE, '..', 'prompt-corpus-v3')
+const CORPUS_DIR = process.env.V3_CORPUS_DIR
+  ? pathResolve(process.env.V3_CORPUS_DIR)
+  // A MUTATED run (V3_PLUGIN set) must never rewrite the shipped corpus — same rule v2 and v4 already follow.
+  : (process.env.V3_PLUGIN ? join(tmpdir(), 'vibe-v3-prompt-corpus') : join(HERE, '..', 'prompt-corpus-v3'))
 const WS = mkdtempSync(join(tmpdir(), 'vibe-v3-lean-'))
 const VIBE = join(WS, 'VibeMath')
 const projRoot = (slug) => join(VIBE, 'Projects', slug)
 const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '')
+/** A missing directory lists as [] (a mutant cascade must surface as a NAMED red, not an ENOENT crash). */
+const listDirIf = (p) => (existsSync(p) ? readdirSync(p) : [])
 const reEsc = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 const verifyRe = (target) => new RegExp('^verifier:r-' + reEsc(target) + '(?:-\\w+)?:\\d+$')
 
@@ -121,7 +135,11 @@ const scrub = (s) => canonBrief(String(s == null ? '' : s)
   // Epoch-ms in a verification-log FILE NAME (`Logs/Verification/<rId>_<Date.now()>.json`) is run
   // metadata too: the final-paper material embeds the evidence index verbatim, so without this the
   // shipped corpus changed on every run (contract §10 item 10 demands byte determinism).
-  .replace(/_[0-9]{10,16}\.json/g, '_<TIME>.json')
+      // 为什么必须保留可选短 id 组（不要"简化"掉）：P7 把裁决日志名改成了
+      // `<rId>_<epochMs>_<shortId>.json`，旧的 `_[0-9]{10,16}\.json` 因此不再匹配，
+      // 于是每次跑动都把自己那次的 时间戳+shortId 写进 shipped 语料（语料非确定性）。
+      // 去掉 `(_[0-9a-f]{8})?` 这个组会静默地重新引入"每次跑都不同"的语料。
+  .replace(/_[0-9]{10,16}(_[0-9a-f]{8})?\.json/g, '_<TIME>.json')
 
 // A fake Lean: a file PASSES unless it still contains `sorry` or the marker `-- FAIL`.
 // `-- HANG` simulates a toolchain that never returns (the timeout path).
@@ -302,6 +320,21 @@ async function runVerifyRound(root, target, results, timeoutMs) {
   await sleep(220)
   return un
 }
+/** V3-G1: `unfiredVerifiers(...).length` is a COUNT - the semantic unit is that the fired reviews are
+ *  DISTINCT slots (the `:<index>` suffix), i.e. two genuinely independent reviews of the same object.
+ *  A founding that spawns the same slot twice keeps the count at 2 and used to pass. */
+/** The slot indices (`:<index>`) of a fired/eligible verifier round. */
+function slotsOf(round) { return (round || []).map((x) => String(x.label).split(':').pop()) }
+let gateSlots1 = null   // V3-G2: round-one slots (module scope: the require round lives in a block)
+
+function assertDistinctSlots(round, tag) {
+  assert(Array.isArray(round) && round.length > 0, tag + ': verifiers were fired')
+  const idx = round.map((x) => String(x.label).split(':').pop())
+  const rIds = round.map((x) => String(x.label).split(':')[1])
+  assert(new Set(idx).size === idx.length, '* V3-G1 ' + tag + ': the reviews are DISTINCT verifier slots (indices=' + JSON.stringify(idx) + ')')
+  assert(new Set(rIds).size === 1, '* V3-G1 ' + tag + ': every review targets the SAME object (targets=' + JSON.stringify(rIds) + ')')
+}
+
 /** Abort + restart: gives the next verification a FRESH task, so a prompt is guaranteed to be
  *  constructed after whatever changed in between (mode switch, archived proof, …). */
 async function restart(root) {
@@ -324,6 +357,7 @@ await callTool('vibe_math_add_proposition', { id: 'p-off', 概述: '关模式下
 await callTool('vibe_math_start', {}, RA)
 const offRound = await runVerifyRound(RA, 'p-off', [1, 1])
 assert(offRound !== null && offRound.length === 2, 'off: two independent verifiers were asked (投票流程照常)')
+  if (offRound) assertDistinctSlots(offRound, 'off round')
 const offProj = projRoot('lean-off')
 assert(await drive(RA, () => existsSync(join(offProj, 'Verified', '命题', 'p-off.md')), 'off Verified card'), "'off' still finalizes on a unanimous boolean vote with NO Lean artifact")
 {
@@ -488,6 +522,7 @@ await callTool('vibe_math_add_proposition', { id: 'p-enc', 概述: '鼓励模式
 await callTool('vibe_math_start', {}, RD)
 const encBatch = await runVerifyRound(RD, 'p-enc', [0.9, 0.95])
 assert(encBatch !== null, 'encourage: the first review round was asked')
+  if (encBatch) assertDistinctSlots(encBatch, 'encourage round')
 if (encBatch) {
   const vp = encBatch.map((s) => s.prompt).join('\n')
   assert(/【Lean 形式化验证（鼓励模式）】/.test(vp), 'the review prompt explains the Lean mode')
@@ -701,6 +736,7 @@ const gateProj = projRoot('lean-gate')
 await callTool('vibe_math_start', {}, RF)
 {
   const batch = await runVerifyRound(RF, 'p-gate', [1, 1])
+gateSlots1 = slotsOf(batch)   // V3-G2: measured ["0","1"]
   assert(batch !== null, 'require: the review round was asked')
   if (batch) {
     const vp = batch.map((s) => s.prompt).join('\n')
@@ -731,7 +767,7 @@ assert(!existsSync(join(gateProj, 'Verified', '命题', 'p-gate.md')), 'no Verif
   const st = await callTool('vibe_math_status', {}, RF)
   assert(st.formal.todo.some((t) => t.id === 'p-gate'), 'status lists the deferred object')
   assert(/formal-required/.test(st.recentActivity.map((e) => e.detail).join('\n')), 'the activity feed shows the formal-required deferral')
-  const voteLog = readdirSync(join(gateProj, 'Logs', 'Verification')).filter((f) => /^r-p-gate_/.test(f))
+  const voteLog = listDirIf(join(gateProj, 'Logs', 'Verification')).filter((f) => /^r-p-gate_/.test(f))
   assert(voteLog.length >= 1, 'the votes themselves are still recorded in Logs/Verification (nothing is lost)')
 }
 // runtime switch: the mode is read when the prompt is CONSTRUCTED, so a fresh round reflects it
@@ -767,6 +803,15 @@ await callTool('vibe_math_set_params', { formalVerify: 'require' }, RF)
 }
 await restart(RF)
 assert(await drive(RF, () => unfiredVerifiers(RF, verifyRe('p-gate')).length >= 2, 'p-gate re-eligible after passing'), '★ once the formal record satisfies the gate, the object becomes eligible for verification again')
+{
+  // V3-G2: `.length >= 2` is a COUNT - the semantic unit is that the RE-ELIGIBLE reviews are the
+  // SAME slots that fired in round one (a re-verification that re-armed different slots would
+  // still satisfy the count). Measured round-one slots: ["0","1"].
+  const un = unfiredVerifiers(RF, verifyRe('p-gate'))
+  const slots = slotsOf(un)
+  assert(slots.slice().sort().join(',') === gateSlots1.slice().sort().join(','), '* V3-G2 the re-eligible reviews are the SAME slots that fired in round one (before=' + JSON.stringify(gateSlots1) + ' after=' + JSON.stringify(slots) + ')')
+  assert(new Set(slots).size === slots.length, '* V3-G2 and they are still DISTINCT slots (the V3-G1 clause restated at this site)')
+}
 {
   const batch = await runVerifyRound(RF, 'p-gate', [1, 1])
   assert(batch !== null, 'the re-verification round was asked')
@@ -1136,6 +1181,7 @@ await callTool('vibe_math_lean_archive', { kind: 'proof', target: 'p-fid', conte
 await callTool('vibe_math_start', {}, RK)
 const fidBatch = await runVerifyRound(RK, 'p-fid', [0.9, 0.95])
 assert(fidBatch !== null, 'fidelity: the review round was asked')
+  if (fidBatch) assertDistinctSlots(fidBatch, 'fidelity round')
 if (fidBatch) {
   const vp = fidBatch.map((s) => s.prompt).join('\n')
   assert(/一致 → Result = 1/.test(vp), "★ the review prompt states the faithful case as `Result = 1` (v3's REAL reply field, not v4/v5's verdict)")
@@ -1577,10 +1623,43 @@ async function driveSiteV3(rw, opts, qid) {
   await callTool('vibe_math_abort', {}, rvv)
 }
 
+// ===============================================================
+// 5c. round-2 D4: ONE vote-count source — a mid-verification verifierCount change must not re-derive
+//     the in-flight task's quorum from live params (the audit's "same count, different code" bug).
+// ===============================================================
+section('5c D4 vote count: quorum comes from the task snapshot, not from live params')
+{
+  const RD4 = makeRoot()
+  await callTool('vibe_math_new_project', { name: 'd4-votecount' }, RD4)
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { verifierCount: 2 }), RD4)
+  await callTool('vibe_math_add_proposition', { id: 'p-d4', 概述: 'D4 票数单一来源', 概率: 0.6, 分类: '数论' }, RD4)
+  await callTool('vibe_math_start', {}, RD4)
+  const reD4 = verifyRe('p-d4')
+  assert(await drive(RD4, () => unfiredVerifiers(RD4, reD4).length >= 2, 'two verifiers for p-d4'), 'two verifiers were dispatched for p-d4 (the creation-time snapshot)')
+  // Mid-verification: the office asks for MORE verifiers. Intent-wise that is a NEW requirement for
+  // FUTURE objects; this task's participant set was frozen when it was created.
+  await callTool('vibe_math_set_params', Object.assign({}, VPARAMS, { verifierCount: 4 }), RD4)
+  await sleep(300)
+  // Count PER EXACT rId: the proposition may legitimately have several candidate rIds
+  // (r-p-d4, r-p-d4-pf0, …); only the in-flight task for one rId must stay pinned.
+  const labels = spawnOf(RD4, 'verifier:').map((x) => x.label)
+  const exact = {}
+  for (const l of labels) { const m = /^verifier:(r-p-d4):(\d+)$/.exec(l); if (m) exact[m[1]] = (exact[m[1]] || 0) + 1 }
+  const inFlight = exact['r-p-d4'] || 0
+  assert(inFlight === 2, '★ [D4] raising verifierCount mid-verification does NOT re-staff the in-flight task (participant set = the snapshot；实测 ' + JSON.stringify({ inFlight: inFlight, labels: labels }) + '）')
+  // Both dispatched votes satisfy the quorum ⇒ the object must conclude. A view that re-derived its
+  // quorum from the live params would demand 4 votes and stall here forever.
+  await runVerifyRound(RD4, 'p-d4', [1, 1])
+  const cardOf = () => readIf(join(projRoot('d4-votecount'), 'Propos', '数论', 'p-d4.md'))
+  const concluded = await drive(RD4, () => { const c = cardOf(); return /-\s*概率:\s*1(\D|$)/.test(c) || /状态:\s*已验证/.test(c) }, 'p-d4 concludes with the two votes it has', 15000)
+  assert(concluded, '★★★ [D4] the two dispatched votes still satisfy the quorum and the object concludes (no view may re-derive its quorum from live params；card=' + JSON.stringify(cardOf().slice(0, 220)) + '）')
+  await callTool('vibe_math_abort', {}, RD4)
+}
+
 section('10 the captured prompt corpus is written for human review')
 {
   mkdirSync(CORPUS_DIR, { recursive: true })
-  writeFileSync(join(CORPUS_DIR, 'formal-verify-v3.json'), JSON.stringify({ entries: corpus }, null, 2), 'utf8')
+  writeFileAtomic(join(CORPUS_DIR, 'formal-verify-v3.json'), JSON.stringify({ entries: corpus }, null, 2))
   const md = ['# V3 形式化验证交互语料（prompt corpus）', '',
     '> 由 `formal-verify-v3.test.mjs` 落盘：框架**真正发出**的每一条提示词原文。路径归一化：工作区 → `<WS>`，',
     '> VibeMath 根 → `<VIBEMATH>`（两者都按正/反斜杠两种写法替换，因此语料是确定性的、可 diff 的、不泄露本机路径）。',
@@ -1596,7 +1675,7 @@ section('10 the captured prompt corpus is written for human review')
     md.push('```')
     md.push('')
   }
-  writeFileSync(join(CORPUS_DIR, 'formal-verify-v3.md'), md.join('\n'), 'utf8')
+  writeFileAtomic(join(CORPUS_DIR, 'formal-verify-v3.md'), md.join('\n'))
   assert(existsSync(join(CORPUS_DIR, 'formal-verify-v3.json')) && existsSync(join(CORPUS_DIR, 'formal-verify-v3.md')), 'the prompt corpus was written (JSON + Markdown)')
   assert(corpus.length >= 25, 'the corpus covers the whole run (' + corpus.length + ' prompts)')
   assert(corpus.some((c) => c.label.startsWith('explorer:')) && corpus.some((c) => c.label.startsWith('solver:')) && corpus.some((c) => c.label.startsWith('method-keeper')) && corpus.some((c) => c.label.startsWith('verifier:')), 'the corpus covers every interaction type this suite drives')

package/tests/formal-verify-v4.mutants.mjs

@@ -0,0 +1,152 @@
+// Registered mutant harness for the v4 formal-verify suite — the suite carries its own proof.
+// Mirrors tests/v5-institute-fixes.mutants.mjs: each family is a SINGLE content-anchored mutation of the
+// v4 preset (no line numbers), the suite runs through the V4_PLUGIN seam, child runs are bounded (a
+// timeout is a HANG, never a pass), and skipped families are printed and counted.
+// Exit criterion: every family reddens BY NAME; ALL MUTANTS RED AS REQUIRED + exit 0 only then.
+// Run: node tests/formal-verify-v4.mutants.mjs
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync, rmSync, readdirSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const PRESET = 'vibe-math-v4'
+const MAIN = PRESET + '.js'
+const SUITE = 'tests/formal-verify-v4.test.mjs'
+const ENV = 'V4_PLUGIN'
+// The formal-verify suite is long, so the default child budget is generous; MUTANT_CHILD_TIMEOUT_MS
+// overrides it.
+const CHILD_TIMEOUT_MS = Number(process.env.MUTANT_CHILD_TIMEOUT_MS || 300000)
+const TIMES = []
+const hangs = []
+const skipped = []
+function copyGraph(file, dest) {
+  const src = join(REPO, PRESET, file)
+  copyFileSync(src, join(dest, file))
+  for (const m of readFileSync(src, 'utf8').matchAll(/from\s+'(\.\/[A-Za-z0-9_.-]+\.js)'/g)) {
+    const dep = m[1].slice(2)
+    if (!readdirSync(dest).includes(dep)) copyGraph(dep, dest)
+  }
+}
+function runFamily(f) {
+  const dest = join(tmpdir(), 'v4fv-mut-' + Math.random().toString(36).slice(2, 10))
+  mkdirSync(dest, { recursive: true })
+  copyGraph(MAIN, dest)
+  const target = join(dest, f.editFile || MAIN)
+  const before = readFileSync(target, 'utf8')
+  const n = before.split(f.from).length - 1
+  const okCount = f.lastOnly || f.all ? n >= 1 : n === 1
+  if (!okCount) {
+    skipped.push(f.name + ' (anchor x' + n + ')')
+    console.error('  SKIP - ' + f.name + ' (anchor x' + n + ')')
+    rmSync(dest, { recursive: true, force: true })
+    return false
+  }
+  const mutated = f.lastOnly
+    ? (() => { const i = before.lastIndexOf(f.from); return before.slice(0, i) + f.to + before.slice(i + f.from.length) })()
+    : before.split(f.from).join(f.to)
+  writeFileSync(target, mutated, 'utf8')
+  try { execFileSync(process.execPath, ['--check', target], { stdio: 'pipe' }) }
+  catch (e) {
+    writeFileSync(target, before, 'utf8')
+    skipped.push(f.name + ' (mutation did not compile)')
+    console.error('  SKIP - ' + f.name + ' (mutation did not compile; restored)')
+    rmSync(dest, { recursive: true, force: true })
+    return false
+  }
+  const t0 = Date.now()
+  let out = ''
+  let code = 0
+  let hang = false
+  try {
+    out = execFileSync(process.execPath, [SUITE], {
+      cwd: REPO, encoding: 'utf8', timeout: CHILD_TIMEOUT_MS, killSignal: 'SIGKILL',
+      env: Object.assign({}, process.env, { [ENV]: join(dest, MAIN) }),
+    })
+  } catch (e) {
+    if (e && (e.killed || e.signal === 'SIGKILL')) hang = true
+    code = (e && e.status) || 1
+    out = String((e && e.stdout) || '') + String((e && e.stderr) || '')
+  }
+  const ms = Date.now() - t0
+  TIMES.push([f.name, ms])
+  if (hang) hangs.push(f.name + '(' + Math.round(ms / 1000) + 's)')
+  const named = out.split(/\r?\n/).filter((l) => /^\s*(FAIL - | {2}- )/.test(l) && f.expect.test(l)).map((l) => l.trim())
+  const ok = !hang && code !== 0 && named.length > 0
+  console.log((hang ? '  HANG - ' : (ok ? '  ok - ' : '  FAIL - ')) + f.name + ' [' + ms + 'ms]' + (named.length ? ' :: ' + named[0].slice(0, 150) : ' :: no named red (exit=' + code + ')'))
+  rmSync(dest, { recursive: true, force: true })
+  return ok
+}
+const FAMILIES = [
+  {
+    // R10-F1: reading `allow` (a permission LIST) as a fence root — this is the branch the no-op path
+    // must keep dead, and the red proves case 1b actually reaches the helper with that shape.
+    name: 'F-5/1b: treat `allow` as a fence root',
+    from: '    else if(p.config && p.config.workspaceRoot !== undefined) pick = p.config.workspaceRoot',
+    to: '    else if(p.config && p.config.workspaceRoot !== undefined) pick = p.config.workspaceRoot\n    else if(p.allow !== undefined) pick = p.allow',
+    expect: /F-5\/1b .*produces NO warning/,
+  },
+  {
+    // the whole comparison removed: a real drift goes unnamed
+    name: 'F-5/ii: the drift comparison is never called',
+    from: 'fenceRootDriftNote(p);',
+    to: 'void 0;',
+    expect: /F-5\/ii the drift is NAMED exactly once/,
+  },
+  {
+    // containment disabled: agreeing/ancestor roots would warn (the per-session false alarm)
+    name: 'F-5/iii+iv: the containment predicate is disabled (always warn)',
+    from: '    if(contained) return',
+    to: '    if(false) return',
+    expect: /F-5\/iv an AGREEING resolved root produces NO warning/,
+  },
+  {
+    // one-shot dropped: the warning repeats on every policy resolution
+    name: 'F-5/ii: the one-shot is dropped',
+    from: '    if(!warnedFenceDrift){',
+    to: '    if(true){',
+    expect: /F-5\/ii the drift is NAMED exactly once .*matched=2/,
+  },
+  {
+    // F-6 site 4: the swallowed compaction failure becomes silent again
+    name: 'N15/4: the compaction-failure warning is silenced',
+    from: '} catch(e){ if(!warnedCompaction){ warnedCompaction=true;',
+    to: '} catch(e){ if(false){ warnedCompaction=true;',
+    expect: /N15\/4 realCompact: a failed compaction is NAMED exactly once/,
+  },
+  {
+    // F-5/1c: the `.` clause of the guard is dropped, so an UNKNOWN session cwd (workspaceRoot() ===
+    // ".") is reported as drift even though it is constructively unknown, not drifted.
+    name: 'F-5/1c: an unknown session cwd is warned about',
+    from: "    if(!session || session === '.') return",
+    to: '    if(!session) return',
+    expect: /F-5\/1c an UNKNOWN session cwd stays SILENT/,
+  },
+  {
+    // F6-v4: the `.current` marker write fails silently again (its guard is removed).
+    name: 'N18: a failed current-project marker write is silent again',
+    from: 'if(ok===false && !warnedCurrentProject){',
+    to: 'if(false){',
+    expect: /N18 the failed .*write is NAMED exactly once/,
+  },
+  {
+    // ③: the in-function naming is removed again, so a failed index write is silent for all six
+    // callers (the measured pre-fix behaviour).
+    name: 'N20-3b: a failed index write is silent again',
+    from: 'if((_idxLibOk === false || _idxProvedOk === false) && !warnedIndexRebuild){',
+    to: 'if(false){',
+    expect: /N20-3b a failed index write is NAMED exactly once/
+  },
+]
+let red = 0
+for (const f of FAMILIES) { const ok = runFamily(f); if (ok) red++ }
+console.log('')
+console.log('mutant families reddening the v4 formal-verify suite by name: ' + red + '/' + FAMILIES.length)
+console.log('timings: ' + TIMES.map((t) => String(t[0]).split(':')[0] + '=' + t[1] + 'ms').join('  '))
+const totalMs = TIMES.reduce((a, t) => a + t[1], 0)
+console.log('TOTAL WALL TIME (all families + setup): ' + totalMs + 'ms (' + Math.round(totalMs / 1000) + 's)')
+console.log('hangs=[' + hangs.join(' | ') + ']')
+console.log('skipped=[' + skipped.join(' | ') + ']')
+if (red !== FAMILIES.length || skipped.length || hangs.length) process.exit(1)
+console.log('ALL MUTANTS RED AS REQUIRED')