dsh-vibe-math 2.7.1 → 2.7.3

package/tests/math-computation-shared.test.mjs

@@ -15,7 +15,8 @@
 // Usage: node tests/math-computation-shared.test.mjs
 // ============================================================================================
 import { makeFakeHost } from './helpers/math-computation-fake-seam.mjs'
-import { pathToFileURL } from 'node:url'
+import { pathToFileURL, fileURLToPath } from 'node:url'
+import { readFileSync } from 'node:fs'
 
 // The sensitivity probe (tests/audit-math-computation-sensitivity.mjs) points this at a MUTATED copy
 // of the module pair; the default is the shipped copy in vibe-math-v2/.
@@ -24,6 +25,97 @@ const MODULE = process.env.MATH_COMPUTATION_MODULE
   : new URL('../vibe-math-v2/math-computation.js', import.meta.url).href
 const M = await import(MODULE)
 
+// §30 predicates — used by the §30 assertions AND by `--self-probe` case 3, so the shipped proof and the
+// audit cannot drift ("same predicate, broken input"). Unit: descriptor entries carrying the reason.
+const carriesVerifyProvenance = (v) => !!v && v.verify === true && typeof v.verifyReason === 'string' && v.verifyReason.length > 0
+const hasNoVerifySlot = (v) => !!v && !('verify' in v) && !('verifyReason' in v)
+
+// ── --self-probe (shipped): prove the §32 evidence assertion can REDDEN, from the tarball alone.
+// It copies the module, removes ONE `fail()` whitelist line, and requires the named §32 assertion
+// to fail in the child. Usage: node tests/math-computation-shared.test.mjs --self-probe
+if (process.argv.includes('--self-probe')) {
+  const { mkdtempSync, copyFileSync, readFileSync: rf, writeFileSync: wf, rmSync } = await import('node:fs')
+  const { tmpdir } = await import('node:os')
+  const { join, dirname } = await import('node:path')
+  const { spawnSync } = await import('node:child_process')
+  const modPath = process.env.MATH_COMPUTATION_MODULE || fileURLToPath(new URL('../vibe-math-v2/math-computation.js', import.meta.url))
+  const dir = mkdtempSync(join(tmpdir(), 'mc-shared-selfprobe-'))
+  const enginesSrc = join(dirname(modPath), 'math-engines.js')
+  try { copyFileSync(enginesSrc, join(dir, 'math-engines.js')) } catch (e) { /* engines may be resolved elsewhere */ }
+  const src = rf(modPath, 'utf8')
+  const whitelist = '  if (extra && Array.isArray(extra.absent)) out.absent = extra.absent\n'
+  if (src.indexOf(whitelist) === -1) {
+    console.log('SELF-PROBE FAIL: the fail() whitelist line for absent[] was not found (the probe cannot mutate what it cannot see)')
+    rmSync(dir, { recursive: true, force: true })
+    process.exit(1)
+  }
+  wf(join(dir, 'math-computation.js'), src.replace(whitelist, ''))
+  const child = spawnSync(process.execPath, [fileURLToPath(import.meta.url)], { encoding: 'utf8', maxBuffer: 1 << 26, env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: join(dir, 'math-computation.js') }) })
+  const out = String(child.stdout || '') + String(child.stderr || '')
+  const failLines = out.split('\n').filter((l) => /^\s*FAIL\b/.test(l))
+  const named = failLines.some((l) => l.indexOf('S2 absence evidence: the failure carries an absent[] list') !== -1)
+  const sum = (out.split('\n').filter((l) => /passed, \d+ failed/.test(l)).slice(-1)[0] || '').trim()
+  console.log((child.status !== 0 && named ? 'SELF-PROBE PASS' : 'SELF-PROBE FAIL') + ': removing ONE fail() whitelist line reddens the named §32 assertion (' + sum + ')')
+  if (!named) for (const l of failLines.slice(0, 4)) console.log('      child FAIL line: ' + l.trim().slice(0, 140))
+  rmSync(dir, { recursive: true, force: true })
+  // case 2 (S4/S5): remove the single `out.installedSoFar = …` assignment and require the NAMED §33
+  // assertion in the child's FAIL line (a label found anywhere in the output is NOT a red).
+  const s45line = '      out.installedSoFar = results.filter((x) => x.exit === 0).map((x) => x.argv)\n'
+  const dir2 = mkdtempSync(join(tmpdir(), 'mc-shared-selfprobe2-'))
+  const src2 = rf(modPath, 'utf8')
+  let ok2 = false
+  if (src2.indexOf(s45line) === -1) {
+    console.log('SELF-PROBE FAIL: the installedSoFar assignment was not found (cannot mutate what it cannot see)')
+  } else {
+    try { copyFileSync(join(dirname(modPath), 'math-engines.js'), join(dir2, 'math-engines.js')) } catch (e) { /* optional */ }
+    wf(join(dir2, 'math-computation.js'), src2.replace(s45line, ''))
+    const child2 = spawnSync(process.execPath, [fileURLToPath(import.meta.url)], { encoding: 'utf8', maxBuffer: 1 << 26, env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: join(dir2, 'math-computation.js') }) })
+    const out2 = String(child2.stdout || '') + String(child2.stderr || '')
+    const failLines2 = out2.split('\n').filter((l) => /^\s*FAIL\b/.test(l))
+    ok2 = child2.status !== 0 && failLines2.some((l) => l.indexOf('reports what already succeeded (installedSoFar)') !== -1)
+    const sum2 = (out2.split('\n').filter((l) => /passed, \d+ failed/.test(l)).slice(-1)[0] || '').trim()
+    console.log((ok2 ? 'SELF-PROBE PASS' : 'SELF-PROBE FAIL') + ': removing ONE installedSoFar assignment reddens the named §33 assertion (' + sum2 + ')')
+    if (!ok2) for (const l of failLines2.slice(0, 4)) console.log('      child FAIL line: ' + l.trim().slice(0, 140))
+  }
+  rmSync(dir2, { recursive: true, force: true })
+  // case 3 (§30, verify provenance): the SAME predicates the §30 assertions use, fed a broken helper.
+  // The real `verifyFields(engine)` helper is extracted from the module under test and run against a stub
+  // descriptor table; dropping its single reason line (or the no-empty-slot guard) must flip its predicate.
+  const src3 = rf(modPath, 'utf8')
+  const hStart = src3.indexOf('function verifyFields(engine) {')
+  let helper = ''
+  if (hStart !== -1) {
+    let d = 0, end = hStart
+    for (let i = hStart; i < src3.length; i++) { if (src3[i] === '{') d++; else if (src3[i] === '}') { d--; if (d === 0) { end = i + 1; break } } }
+    helper = src3.slice(hStart, end)
+  }
+  const REASON_LINE = "  if (typeof d.verifyReason === 'string' && d.verifyReason) out.verifyReason = d.verifyReason\n"
+  const GUARD_LINE = '  if (!d.verify) return {}\n'
+  let ok3 = false
+  if (helper.indexOf(REASON_LINE) === -1 || helper.indexOf(GUARD_LINE) === -1) {
+    console.log('SELF-PROBE FAIL: the §30 helper anchors were not found (the probe cannot mutate what it cannot see)')
+  } else {
+    const stub = { maple: { verify: true, verifyReason: 'CLI spelling varies by Maple version - confirm on a licensed machine' }, python: { license: 'free' } }
+    const make = (s) => new Function('MATH_ENGINES', s + '\nreturn verifyFields;')(stub)
+    const good = make(helper)
+    const broken = make(helper.replace(REASON_LINE, ''))
+    const brokenGuard = make(helper.replace(GUARD_LINE, ''))
+    const cases3 = [
+      ['§30 probe carries WHY (shared predicate carriesVerifyProvenance)', carriesVerifyProvenance(good('maple')), carriesVerifyProvenance(broken('maple'))],
+      ['§30 no empty slot without a declared reason (hasNoVerifySlot)', hasNoVerifySlot(good('python')), hasNoVerifySlot(brokenGuard('python'))],
+    ]
+    let bad3 = 0
+    for (const [name, greenNow, redWhenBroken] of cases3) {
+      const okc = greenNow === true && redWhenBroken === false
+      if (!okc) bad3++
+      console.log((okc ? '  ok   ' : '  FAIL ') + name + ' :: green-now=' + greenNow + ' broken-goes-red=' + !redWhenBroken)
+    }
+    ok3 = bad3 === 0
+    console.log('  --- §30 verify-provenance predicates: ' + (cases3.length - bad3) + '/' + cases3.length + ' as required')
+  }
+  process.exit(child.status !== 0 && named && ok2 && ok3 ? 0 : 1)
+}
+
 let passed = 0, failed = 0
 const failures = []
 function ok(cond, label, detail) {
@@ -116,7 +208,11 @@ console.log('-- math_computation shared contract --')
   await withHost({ installed: [] }, async (state) => {
     const r = await state.call({ op: 'probe' })
     ok(r.ok === false && r.code === 'MATH_ENGINE_NOT_FOUND', 'no engine -> ENGINE_NOT_FOUND')
-    ok(r.next && r.next.kind === 'user-install' && r.next.command, 'ENGINE_NOT_FOUND carries the per-OS user-install guide')
+    // round-9: the guide is per-OS and always carries the SUGGESTED command; `command` itself is only
+    // populated when that OS's package manager is actually resolvable on this machine.
+    ok(r.next && r.next.kind === 'user-install' && r.next.perOs && r.next.perOs.windows && r.next.perOs.linux, 'ENGINE_NOT_FOUND carries the per-OS user-install guide')
+    ok(r.next.suggestedCommand === r.next.perOs[r.next.platform], 'the guide keeps the suggested per-OS command alongside the executable one')
+    ok(r.next.packageManagerAvailable === false ? r.next.command === '' : typeof r.next.command === 'string', 'command ⇔ package-manager availability (never a command that cannot run)')
   })
   await withHost({ packages: { numpy: 'present', sympy: 'missing' } }, async (state) => {
     const r = await state.call({ op: 'probe', packages: ['numpy', 'sympy'] })
@@ -800,7 +896,305 @@ console.log('-- math_computation shared contract --')
   ok(!(r.warnings || []).some((w) => w.code === 'PACKAGE_PRECHECK_UNKNOWN'), 'the precheck RAN (no PACKAGE_PRECHECK_UNKNOWN on a fresh root)')
 }
 
+// ── 22. round-8 (P0/D3): member-facing artifact paths must be OPENABLE by members
+// The receipt's scriptPath is PROJECT-ROOT relative, but members' file tools resolve against the
+// SESSION CWD. The receipt/return therefore carry the absolute `scriptAbs` and the `cwd` to join with.
+{
+  const h = makeFakeHost({ installed: ['python3'] })
+  M.registerMathComputation(h.host)
+  const r = await h.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n' })
+  ok(r.ok === true, 'a run succeeds (P0 context)')
+  ok(typeof r.scriptAbs === 'string' && r.scriptAbs.length > 0, '★ the return carries an ABSOLUTE scriptAbs (members can open it directly)')
+  ok(typeof r.cwd === 'string' && r.cwd.length > 0, '★ the return carries cwd (the project root to join with)')
+  ok(String(r.scriptAbs).replace(/\\/g, '/').endsWith(String(r.scriptPath).replace(/\\/g, '/')), '★ scriptAbs ends with the receipt-relative scriptPath (join consistency)')
+  ok(!!h.files && h.files.has(String(r.scriptPath).replace(/\\/g, '/')), '★ the archived script really exists at scriptPath (the path handed to members is real)')
+  const rj = JSON.parse(h.files.get(String(r.receipt.json).replace(/\\/g, '/')))
+  ok(rj.scriptAbs === r.scriptAbs && rj.cwd === r.cwd, 'the RECEIPT carries scriptAbs + cwd too (a later reader can reconstruct the location)')
+  ok(String(M.MATH_ARCHIVE_WORKFLOW_LINE).indexOf('receipt.scriptAbs') !== -1 && String(M.MATH_ARCHIVE_WORKFLOW_LINE_EN).indexOf('receipt.scriptAbs') !== -1, 'the injected archive rule tells members HOW to open the script (zh+en)')
+  ok(/会话 cwd/.test(String(M.MATH_ARCHIVE_WORKFLOW_LINE)) && /SESSION CWD/.test(String(M.MATH_ARCHIVE_WORKFLOW_LINE_EN)), 'the rule states the session-cwd resolution fact (zh+en)')
+}
+
+// ── 23. round-9 (real-engine): an engine INSTALLED but not on PATH must still be discovered
+// R 4.6.1 went to `C:\Program Files\R\R-4.6.1\bin` without touching PATH, so `probe` used to say R
+// was missing even though it was installed.
+{
+  // round-B (F4): the candidate roots are INJECTED through the host seam, so this fixture cannot depend
+  // on the ambient machine's ProgramFiles/LOCALAPPDATA (which made it a false red on other layouts).
+  const RROOT = 'X:/installs/R'
+  const absTree = {
+    [RROOT]: [{ name: 'R-4.6.1', type: 'directory' }],
+    [RROOT + '/R-4.6.1/bin']: [{ name: 'Rscript.exe', type: 'file' }, { name: 'R.exe', type: 'file' }],
+  }
+  const h = makeFakeHost({ installed: [], absTree: absTree, runtimeRoots: [], installRoots: { r: [RROOT] } })
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'r' })
+  ok(p.ok === true && p.engine === 'r', '★ a Rscript that exists ONLY in the default install dir is discovered (not on PATH)')
+  ok(!!p.engineInfo && /installs\/R\/R-4\.6\.1\/bin\/Rscript/.test(String(p.engineInfo.path)), 'the discovered path is the versioned install dir (' + String(p.engineInfo && p.engineInfo.path).slice(0, 60) + ')')
+}
+// ── 23b. round-B (F3): the SAME walker covers Octave and Julia default dirs (both layout shapes)
+{
+  const OROOT = 'X:/installs/GNU Octave'
+  const JROOT = 'X:/home/.juliaup/bin'
+  const absTree = {
+    [OROOT]: [{ name: 'Octave-9.2.0', type: 'directory' }],
+    [OROOT + '/Octave-9.2.0']: [{ name: 'mingw64', type: 'directory' }],
+    [OROOT + '/Octave-9.2.0/mingw64/bin']: [{ name: 'octave-cli.exe', type: 'file' }],
+    [JROOT]: [{ name: 'julia.exe', type: 'file' }],
+  }
+  const h = makeFakeHost({ installed: [], absTree: absTree, runtimeRoots: [], installRoots: { octave: [OROOT], julia: [JROOT] } })
+  M.registerMathComputation(h.host)
+  const po = await h.call({ op: 'probe', engine: 'octave' })
+  ok(po.ok === true && /Octave-9\.2\.0\/mingw64\/bin\/octave-cli/.test(String(po.engineInfo && po.engineInfo.path)), '★ an Octave installed in its default dir (no PATH) is discovered (versioned + mingw64/bin layout)')
+  const pj = await h.call({ op: 'probe', engine: 'julia' })
+  ok(pj.ok === true && /\.juliaup\/bin\/julia/.test(String(pj.engineInfo && pj.engineInfo.path)), '★ a juliaup-managed Julia (flat bin dir, no PATH) is discovered by the same walker')
+  const pr = await h.call({ op: 'probe' })
+  ok((pr.absent || []).some((a) => a.engine === 'r' && a.why === 'not-found-on-this-machine'), 'an engine with no injected roots and no PATH entry is still honestly listed as absent')
+  // F3: the per-engine default roots are part of the contract (the release notes claim "installed but not
+  // on PATH is found"), so their coverage is asserted directly - not only via an injected fixture.
+  for (const e of ['r', 'python', 'octave', 'julia', 'matlab']) {
+    ok(typeof M.mathInstallRoots === 'function' && M.mathInstallRoots(e, {}, true).length > 0 && M.mathInstallRoots(e, {}, false).length > 0,
+      '★ every engine with a well-defined default install dir declares per-OS roots: ' + e)
+  }
+}
+// ── 24. round-9 (real-engine): never suggest an install command that cannot run on this machine
+{
+  const h = makeFakeHost({ installed: [] })   // `winget` is NOT resolvable here
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'octave' })
+  ok(p.ok === false && p.code === 'MATH_ENGINE_NOT_FOUND', 'a missing engine still fails with ENGINE_NOT_FOUND')
+  ok(!!p.next && p.next.kind === 'user-install', 'the guidance is still user-install shaped')
+  ok(String(p.next.command) === '', '★ no runnable-looking command when its package manager is absent (command is empty)')
+  ok(!/winget|brew|apt|choco|scoop/i.test(String(p.next.command) + ' ' + String(p.message)), '★ no winget/brew/apt suggestion anywhere when that manager is absent')
+  ok(p.next.packageManager === 'winget' && p.next.packageManagerAvailable === false, 'the response SAYS which manager was assumed and that it is unavailable')
+  ok(typeof p.next.note === 'string' && p.next.note.length > 0, 'an explicit note explains that the suggested command cannot run')
+  const h2 = makeFakeHost({ installed: [], resolveMap: { winget: 'C:/fake/winget.exe' } })
+  M.registerMathComputation(h2.host)
+  const p2 = await h2.call({ op: 'probe', engine: 'octave' })
+  ok(/winget/i.test(String(p2.next.command)) && p2.next.packageManagerAvailable === true, 'when the manager IS present the command is offered as before')
+}
+
+// ── 25. round-9 F3/F5/F7: probe completeness, uniform failure evidence, explicit constraint policy
+{
+  // F3: a partial availability line must NAME the configured-but-absent engines.
+  const h = makeFakeHost({ installed: ['python3'] })
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'python' })
+  ok(p.ok === true && Array.isArray(p.absent) && p.absent.length > 0, '★ probe names the configured-but-absent engines instead of being silently partial')
+  ok(p.absent.some((a) => a.engine === 'r' && a.why === 'not-found-on-this-machine'), 'the absent list carries a reason (key `why`) per engine')
+  ok(p.absent.some((a) => a.engine === 'cli' && /caller-supplied/.test(a.why)), 'cli is explained as needing a caller-supplied command')
+  ok(/未发现/.test(String(p.message)), 'the message states which configured engines were not found')
+  // F5: MATH_TIMEOUT carries the SAME evidence fields a non-zero exit does.
+  const h2 = makeFakeHost({ installed: ['python3'], hang: true })
+  M.registerMathComputation(h2.host)
+  const t = await h2.call({ op: 'run', engine: 'python', mode: 'code', code: 'while True: pass\n', timeoutMs: 1000 })
+  ok(t.ok === false && t.code === 'MATH_TIMEOUT', 'a hanging run reports MATH_TIMEOUT')
+  ok(t.timedOut === true && 'exit' in t && t.exit === null, '★ MATH_TIMEOUT carries timedOut:true and an explicit exit field (uniform with NONZERO_EXIT)')
+  ok('stderr' in t && typeof t.stderr === 'string', '★ MATH_TIMEOUT carries the captured stderr like NONZERO_EXIT does')
+  // F7: the response says the constraints are existence-only, and lists the ones that were NOT checked.
+  const h3 = makeFakeHost({ installed: ['python3'], packages: { numpy: 'present' } })
+  M.registerMathComputation(h3.host)
+  const c = await h3.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n', packages: ['numpy>=1'] })
+  ok(c.ok === true && /existence-only/.test(String(c.versionPolicy)), '★ the run response states the version constraints are existence-only')
+  ok(Array.isArray(c.constraintsNotEnforced) && c.constraintsNotEnforced.indexOf('numpy>=1') !== -1, '★ the response names the constraint it did NOT check (no silent drop)')
+  const c2 = await h3.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n', packages: ['numpy'] })
+  ok(Array.isArray(c2.constraintsNotEnforced) && c2.constraintsNotEnforced.length === 0, 'an unconstrained request reports an empty not-enforced list')
+  const m = await h3.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n', packages: ['pandas>=2'] })
+  ok(m.ok === false && /existence-only/.test(String(m.versionPolicy)), 'the missing-package failure also states the constraint policy')
+}
+
+// ── 26. round-9 (N1): edited-archived-script evidence integrity
+// The documented P2a flow: edit the ORIGINAL source, re-run mode:'file' ⇒ SAME archive id, attempt>=2,
+// scriptChanged:true, previousReceipt at the prior attempt, prior attempt untouched. Pointing mode:'file'
+// at an ARCHIVED script is a NEW archive id by design (the id is keyed by the SOURCE PATH) - which must
+// be SAID (fileIsArchivedScript + a warning), not look like broken change detection.
+{
+  const h = makeFakeHost({ installed: ['python3'], files: { 'Problems/x.py': 'print(1)\n' } })
+  M.registerMathComputation(h.host)
+  const r1 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: 'Problems/x.py' })
+  ok(r1.ok === true && r1.attempt === 1 && r1.scriptChanged === false, 'first run of a source file: attempt 1, no change')
+  const rj1 = JSON.parse(h.files.get(String(r1.receipt.json).replace(/\\/g, '/')))
+  ok(typeof r1.runId === 'string' && rj1.runId === r1.runId, '★ the run response exposes its archive id (matches the durable receipt.runId) - needed to check "same archive id"')
+  // round-B (F6): the DURABLE receipt must record the constraint policy too (not just the response).
+  ok(typeof rj1.versionPolicy === 'string' && /existence-only/.test(rj1.versionPolicy) && Array.isArray(rj1.constraintsNotEnforced),
+    '★ the durable receipt records versionPolicy + constraintsNotEnforced (the promise is auditable evidence)')
+  h.files.set('Problems/x.py', 'print(2)\n')
+  const r2 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: 'Problems/x.py' })
+  ok(r2.ok === true && r2.runId === r1.runId, '★ editing the ORIGINAL source and re-running lands on the SAME archive id')
+  ok(r2.attempt >= 2 && /\/attempts\/\d+/.test(String(r2.attemptDir || '')), '★ the re-run is attempt>=2 under attempts/<n>/')
+  ok(r2.scriptChanged === true, '★ the re-run reports scriptChanged:true')
+  ok(!!r2.previousReceipt && r2.previousReceipt.attempt === r1.attempt && r2.previousReceipt.scriptHash === r1.scriptHash, '★ previousReceipt points at the prior attempt (attempt + scriptHash)')
+  ok(h.files.get(String(r1.scriptPath).replace(/\\/g, '/')) === 'print(1)\n', '★ the prior attempt\'s script is NOT overwritten (append-only)')
+  // A DIFFERENT source path (e.g. a copy of the old script, or a brand-new file) is a NEW archive id BY
+  // DESIGN: the id is keyed by the source path, so there is no history for that id and
+  // scriptChanged/previousReceipt are - correctly - empty. This is the case a finder can mistake for
+  // "broken change detection"; it is not, and the docs now say so.
+  h.files.set('Problems/copy_of_old.py', 'print(1)\n')
+  const r3 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: 'Problems/copy_of_old.py' })
+  ok(r3.ok === true, 'a run of a different source path succeeds (' + JSON.stringify({ ok: r3.ok, code: r3.code }) + ')')
+  ok(r3.runId !== r1.runId, '★ a DIFFERENT source path gets a DIFFERENT archive id')
+  ok(r3.attempt === 1, '★ …and therefore starts at attempt 1 (fresh archive, by design)')
+  ok(r3.scriptChanged === false, '★ …and reports scriptChanged:false (no history FOR THIS id)')
+  ok(r3.previousReceipt === null || r3.previousReceipt === undefined, '★ …and has no previousReceipt (expected, not broken change detection)')
+  ok(h.files.get(String(r1.scriptPath).replace(/\\/g, '/')) === 'print(1)\n', 'the earlier attempt is still untouched after that run')
+  // Review round A (F1/F2): the ARCHIVED copy is REACHABLE (projectRel() is purely lexical - it rejects
+  // absolute paths and escaping `..` only). The shipped guidance must therefore say the truth: pointing
+  // mode:'file' at the archived copy yields a NEW archive (new id, attempt 1, no history), flagged by
+  // fileIsArchivedScript + ARCHIVED_SCRIPT_RERUN - it is NOT "a new attempt of the same archive".
+  const archivedPath = String(r1.scriptPath).replace(/\\/g, '/')
+  const r4 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: archivedPath })
+  ok(r4.ok === true, '★ pointing mode:file at the ARCHIVED copy succeeds (the guard is lexical, it does not refuse Computation/)')
+  ok(r4.fileIsArchivedScript === true, '★ the response flags fileIsArchivedScript for an archived source')
+  ok((r4.warnings || []).some((w) => w.code === 'ARCHIVED_SCRIPT_RERUN'), '★ the response warns ARCHIVED_SCRIPT_RERUN (so it cannot read as broken change detection)')
+  ok(r4.runId !== r1.runId && r4.attempt === 1 && r4.scriptChanged === false && (r4.previousReceipt === null || r4.previousReceipt === undefined),
+    '★ …and it really is a NEW archive (new id, attempt 1, no history) - NOT a new attempt of the same archive')
+  ok(h.files.get(archivedPath) === 'print(1)\n', 'the archived original is still byte-identical after that run')
+}
+// ── 27. round-9 (N2): a TIMEOUT carries its partial output in BOTH the response and the receipt
+{
+  const h = makeFakeHost({ installed: ['python3'], hang: true, stdoutBytes: 16 })
+  M.registerMathComputation(h.host)
+  const t = await h.call({ op: 'run', engine: 'python', mode: 'code', code: 'print("before-timeout")\n', timeoutMs: 1000 })
+  ok(t.ok === false && t.code === 'MATH_TIMEOUT', 'the hanging run reports MATH_TIMEOUT')
+  ok('stdout' in t && 'stderr' in t, '★ the TIMEOUT response carries stdout AND stderr (not just the archived file)')
+  const rj = JSON.parse(h.files.get(String(t.receipt.json).replace(/\\/g, '/')))
+  ok(typeof rj.partialStdout === 'string' && typeof rj.partialStderr === 'string', '★ the TIMEOUT receipt JSON carries the capped partial output (as strings)')
+}
+
+// ── 28. descriptor sweep: NO spawn may ever carry an unsubstituted argv placeholder
+// Sweep finding (HIGH, fixed): matlab's scriptArgv EMBEDS the placeholder (`run('<script>')`) while the
+// module substituted by EXACT element equality, so the literal `run('<script>')` reached the engine and
+// the archived script never ran. This section walks the whole descriptor table.
+{
+  const PLACEHOLDER = /<script>|<expr>|<pkgs>|<pkgs\.\.\.>|<probeCode>|<exe>|<pkg>|<cliArgv/
+  for (const name of (M.MATH_PARAM_DEFAULTS.mathEngines || [])) {
+    if (name === 'cli') continue
+    const h = makeFakeHost({ installed: [name], files: {}, licence: true })
+    M.registerMathComputation(h.host)
+    const r = await h.call({ op: 'run', engine: name, mode: 'code', code: 'x=1\n' })
+    const bad = (h.spawns || []).map((s) => (s && s.argv) || []).flat().filter((a) => typeof a === 'string' && PLACEHOLDER.test(a))
+    ok(bad.length === 0, '★ ' + name + ': no spawn carries a literal argv placeholder', JSON.stringify(bad.slice(0, 2)))
+    if (name === 'matlab' && r.ok === true) {
+      const runs = (h.spawns || []).map((s) => s.argv).filter((a) => a.join(' ').indexOf('-batch') !== -1 && a.join(' ').indexOf('disp(version)') === -1)
+      const run = runs.pop() || []
+      ok(run.some((a) => /run\('.*script\.m'\)/.test(a)), '★ matlab: the EMBEDDED placeholder is substituted (run(\'<abs script.m>\'))', JSON.stringify(run))
+    }
+  }
+}
+
+// ── 29. cli policy is SINGLE-SOURCED (descriptor), not hard-coded in the module
+// Sweep ruling: `cli.policy.requiresMathMode` / `requiresEngineInList` were declared but never consumed
+// (the same rule was hard-coded twice), so descriptor and behaviour could drift. The refusals now carry
+// the DESCRIPTOR value, which is exactly what makes a hard-coded revert observable.
+{
+  const h = makeFakeHost({ installed: ['python3'], params: { mathMode: 'typed' }, cliCommands: ['python3'] })
+  M.registerMathComputation(h.host)
+  const r = await h.call({ op: 'run', engine: 'cli', mode: 'code', code: 'print(1)\n', cli: { command: 'python3' } })
+  ok(r.ok === false && r.code === 'MATH_REFUSED', 'cli under mathMode=typed is refused')
+  ok(r.next && r.next.reason === 'policy' && r.next.requiresMathMode === 'typed+shell',
+    '★ the refusal carries the DESCRIPTOR policy value (next.requiresMathMode === typed+shell)', JSON.stringify(r.next))
+  const h2 = makeFakeHost({ installed: ['python3'], params: { mathMode: 'typed+shell', mathEngines: ['python', 'r'] }, cliCommands: ['python3'] })
+  M.registerMathComputation(h2.host)
+  const r2 = await h2.call({ op: 'run', engine: 'cli', mode: 'code', code: 'print(1)\n', cli: { command: 'python3' } })
+  ok(r2.ok === false && r2.next && r2.next.reason === 'engine-not-allowed' && r2.next.requiresEngineInList === true,
+    '★ when cli is not in mathEngines the refusal surfaces requiresEngineInList from the descriptor', JSON.stringify(r2.next))
+}
+
+// ── 30. a commercial template's VERIFY provenance REACHES the user (item 2)
+// `maple.verify`/`verifyReason` were declared but never reached any response, so a user told "commercial
+// template needs confirmation" could not see WHY. It is surfaced on the probe result (per-engine entry +
+// engineInfo) and on the vendor-guidance payloads; engines without a declared reason print no empty slot.
+{
+  const h = makeFakeHost({ installed: ['maple'], licence: true, files: {} })
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'maple' })
+  ok(p.ok === true && !!p.engineInfo && p.engineInfo.verify === true, 'probe reports the verify flag for a commercial template')
+  ok(!!p.engineInfo && typeof p.engineInfo.verifyReason === 'string' && p.engineInfo.verifyReason.length > 0 && /version/i.test(p.engineInfo.verifyReason),
+    '★ probe carries WHY the template needs confirmation (engineInfo.verifyReason)', JSON.stringify(p.engineInfo && p.engineInfo.verifyReason))
+  const entry = (p.engines || []).find((e) => e.name === 'maple')
+  ok(carriesVerifyProvenance(entry), 'the per-engine probe entry carries the same provenance')
+  const hp = makeFakeHost({ installed: ['python3'], files: {} })
+  M.registerMathComputation(hp.host)
+  const pp = await hp.call({ op: 'probe', engine: 'python' })
+  ok(hasNoVerifySlot(pp.engineInfo),
+    '★ an engine without a declared reason prints NO empty slot (assemble-only-when-present)')
+  const hm = makeFakeHost({ installed: [], files: {} })
+  M.registerMathComputation(hm.host)
+  const pm = await hm.call({ op: 'probe', engine: 'maple' })
+  ok(pm.ok === false && !!pm.next && typeof pm.next.verifyReason === 'string' && /version/i.test(pm.next.verifyReason),
+    '★ the not-found guidance also says why the commercial template needs confirmation', JSON.stringify(pm.next && pm.next.verifyReason))
+}
+
+// ── 31. S3 symmetry: EVERY failure kind surfaces partial stdout AND stderr (like the timeout)
+{
+  const h1 = makeFakeHost({ installed: ['python3'], exit: 2, stdoutBytes: 16 })
+  M.registerMathComputation(h1.host)
+  const r1 = await h1.call({ op: 'run', engine: 'python', mode: 'code', code: 'x=1\n' })
+  ok(r1.ok === false && r1.code === 'MATH_NONZERO_EXIT', 'a non-zero exit reports MATH_NONZERO_EXIT')
+  ok('stdout' in r1 && 'stderr' in r1, '★ S3 symmetry: MATH_NONZERO_EXIT carries BOTH partial stdout and stderr', JSON.stringify({ so: 'stdout' in r1, se: 'stderr' in r1 }))
+  const h2 = makeFakeHost({ installed: ['python3'], argError: 'unknown option', stdoutBytes: 16 })
+  M.registerMathComputation(h2.host)
+  const r2 = await h2.call({ op: 'run', engine: 'python', mode: 'code', code: 'x=1\n' })
+  ok(r2.ok === false && r2.code === 'MATH_ENGINE_BAD_ARGV', 'a usage error reports MATH_ENGINE_BAD_ARGV')
+  ok('stdout' in r2 && 'stderr' in r2, '★ S3 symmetry: MATH_ENGINE_BAD_ARGV carries BOTH partial stdout and stderr')
+}
+// ── 32. S2: the failure a user actually hits carries the SAME absence evidence as the success shape
+{
+  const h = makeFakeHost({ installed: [] })
+  M.registerMathComputation(h.host)
+  const r = await h.call({ op: 'probe' })
+  ok(r.ok === false && r.code === 'MATH_ENGINE_NOT_FOUND', 'no resolvable engine reports MATH_ENGINE_NOT_FOUND')
+  ok(Array.isArray(r.configured) && r.configured.length > 0, '★ S2 absence evidence: the failure names the CONFIGURED engines', JSON.stringify(r.configured ?? null))
+  const absent = Array.isArray(r.absent) ? r.absent : []
+  ok(absent.length > 0, '★ S2 absence evidence: the failure carries an absent[] list (not a silent partial)', JSON.stringify(r.absent ?? null))
+  ok(absent.every((a) => a && typeof a.why === 'string' && a.why.length > 0), 'every absent[] entry carries a why', JSON.stringify(absent))
+}
 console.log('')
+// ── 33. S4/S5: install failures are discriminated WITHOUT a new code (frozen interface). Reads the
+// ENV-RESOLVED module (MATH_COMPUTATION_MODULE), so the --self-probe case 2 above can reach exactly
+// what these assertions read (the parity-located version could not be reddened by any mutant).
+{
+  const src = readFileSync(fileURLToPath(new URL(MODULE)), 'utf8')
+  ok(src.indexOf("out.op = 'install'") !== -1, '★ S4/S5 install discrimination: a failed install sets op=install')
+  ok(/out\.timedOut = !!/.test(src), '★ S4/S5 install discrimination: a failed install carries timedOut')
+  ok(/out\.installedSoFar = results\.filter/.test(src), '★ S4/S5 install discrimination: a failed install reports what already succeeded (installedSoFar)')
+  ok(/installedSoFar: commands\.map/.test(src), 'the success path reports installedSoFar too (no special-casing by the caller)')
+  ok(src.indexOf('MATH_INSTALL_FAILED') === -1, 'no 12th failure code was added (MATH_FAILURE_CODES stays frozen)')
+}
+
+// ── 34. S6: the install plan, the run path and the missing-package failure state ONE policy the
+// same way (behavioural: read from the responses, not from the source text).
+{
+  const PREFIX = 'version-constraints-are-existence-only: '
+  const h = makeFakeHost({ installed: ['python3'] })
+  M.registerMathComputation(h.host)
+  const plan = await h.call({ op: 'install', packages: ['numpy==1.2.3'] })
+  const planPolicy = String((plan && plan.plan && plan.plan.versionPolicy) || '')
+  ok(plan.ok === true && !!plan.plan, 'S6: an install dry-run returns a plan', JSON.stringify(plan && plan.code))
+  ok(planPolicy.indexOf(PREFIX) === 0, '★ S6: the install plan uses the SAME policy wording as the run path', planPolicy.slice(0, 70))
+  ok(planPolicy.indexOf('numpy==1.2.3') !== -1, '★ S6: the plan names the pinned spec it does not enforce', planPolicy.slice(0, 90))
+  const miss = await h.call({ op: 'run', engine: 'python', mode: 'code', packages: ['numpy==1.2.3'], code: 'x=1\n' })
+  ok(miss.ok === false && miss.code === 'MATH_MISSING_PACKAGES', 'S6: a pinned-but-missing package fails as MATH_MISSING_PACKAGES', JSON.stringify(miss.code))
+  ok(String(miss.versionPolicy || '').indexOf(PREFIX) === 0, '★ S6: the failure path uses the same wording', String(miss.versionPolicy || '').slice(0, 70))
+  ok(String(miss.versionPolicy || '') === planPolicy, '★ S6: plan and failure wording are byte-identical for the same spec', JSON.stringify([planPolicy.slice(0, 40), String(miss.versionPolicy || '').slice(0, 40)]))
+  ok(String(miss.message || '').indexOf('只检查是否存在；版本求解交给包管理器') !== -1, '★ S6: the MATH_MISSING_PACKAGES detail derives the same clause', String(miss.message || '').slice(0, 70))
+  const badSpec = M.parsePackageSpec('numpy@1.2')
+  ok(badSpec && badSpec.ok === false && String(badSpec.problem || '').indexOf('只检查是否存在；版本求解交给包管理器') !== -1, '★ S6: the unsupported-version-syntax message derives the same clause', String((badSpec && badSpec.problem) || '').slice(0, 80))
+  ok(String(planPolicy || '').indexOf('只检查是否存在；版本求解交给包管理器') !== -1, '★ S6: the policy FIELD itself contains that clause (one literal, three surfaces)', planPolicy.slice(0, 80))
+}
+
+// ── 35. S6 derivation is LOAD-BEARING (found by mutant case 2): "the message contains the clause" also
+// passes when the message RE-INLINES the same words, so the real checks are (a) the clause exists as
+// exactly ONE literal in the module and (b) the two human messages are built from the constant.
+{
+  const src = readFileSync(fileURLToPath(new URL(MODULE)), 'utf8')
+  const clause = '只检查是否存在；版本求解交给包管理器'
+  const occurrences = src.split(clause).length - 1
+  ok(occurrences === 1, '★ S6: the policy clause exists as exactly ONE literal in the module (a re-inlined message is caught)', 'occurrences=' + occurrences)
+  ok(/MATH_MISSING_PACKAGES[\s\S]{0,160}MATH_VERSION_POLICY_CLAUSE/.test(src), '★ S6: the missing-package detail is built from the clause constant', 'MATH_MISSING_PACKAGES … MATH_VERSION_POLICY_CLAUSE')
+  ok(/unsupported version syntax[\s\S]{0,160}MATH_VERSION_POLICY_CLAUSE/.test(src), '★ S6: the unsupported-version-syntax message is built from the clause constant')
+  ok(/const MATH_VERSION_POLICY = .*MATH_VERSION_POLICY_CLAUSE/.test(src), '★ S6: the long policy sentence is derived from the clause')
+}
+
 console.log('=== MATH COMPUTATION SHARED: ' + passed + ' passed, ' + failed + ' failed ===')
 if (failures.length) for (const f of failures) console.error('  - ' + f)
 process.exit(failed === 0 ? 0 : 1)