dsh-vibe-math 2.7.1 → 2.7.3

package/tests/prompt-v5-integrity.test.mjs

@@ -1166,16 +1166,27 @@ section('13 full-corpus sweep over every prompt ever sent')
   // A single prompt must not deliver the same message twice. The inbox used to be
   // prepended AND re-emitted from the [状态] block, so a member read every new message
   // twice in one prompt.
+  // A3 (assertion-quality review): this used to end with a vacuous `assert(true, …)` and to
+  // `break` after the FIRST duplicate frame, so (a) a property nobody checked was attributed to an
+  // assertion that asserted nothing, and (b) only one duplicate per prompt was ever reported.
+  // The loop now COLLECTS every duplicate frame and reports the count, and the summary assertion
+  // states exactly what was checked.
+  const duplicateFrames = []
+  let inboxOffenders = 0
   for (const c of corpus) {
     const bodies = c.prompt.match(/【[^】]*】[^\n]{20,}/g) || []
     for (const frame of new Set(bodies)) {
       const n = bodies.filter(b => b === frame).length
-      if (n > 1) { assert(false, 'message delivered ' + n + '× in one prompt (' + c.kind + '/' + c.owner + '): ' + frame.slice(0, 60)); break }
+      if (n > 1) duplicateFrames.push({ kind: c.kind, owner: c.owner, n, frame: frame.slice(0, 60) })
     }
     const inboxHeads = (c.prompt.match(/\[新到的消息/g) || []).length
+    if (inboxHeads > 1) inboxOffenders += 1
     assert(inboxHeads <= 1, c.kind + '/' + c.owner + ': at most one inbox section per prompt (found ' + inboxHeads + ')')
   }
-  assert(true, 'no prompt delivers the same framed message twice, and no prompt has two inbox sections')
+  assert(duplicateFrames.length === 0,
+    'no prompt delivers the same framed message twice (duplicate frames found: ' + duplicateFrames.length
+      + (duplicateFrames.length ? ' — ' + duplicateFrames.slice(0, 5).map(d => d.kind + '/' + d.owner + ' ' + d.n + '× ' + d.frame).join(' | ') : '')
+      + '); prompts with two inbox sections: ' + inboxOffenders)
   // The identity claim inside a prompt must agree with the persona shipped alongside it.
   for (const c of corpus) {
     if (!c.persona) continue

package/tests/run-tests.mjs

@@ -62,6 +62,115 @@ const asJson = has('json')
 const concurrency = Math.max(1, Number(flag('concurrency')[0] || Math.min(4, cpus().length)))
 
 const SELF = 'run-tests.mjs'
+// Per-suite HARD timeout (GATE_SUITE_TIMEOUT_MS overrides, ms). It bounds an intermittent hang so the
+// gate always terminates and a hang is reported - never mistaken for "still running". 180 s comes from
+// measurements: whole-gate wall ~200 s, slowest honest suite 135-144 s (audit-math-computation-sensitivity),
+// so 180 s bounds a hang without killing an honest slow suite. Do NOT raise it silently to "fix" reds.
+const SUITE_TIMEOUT_MS = Math.max(1000, Number(process.env.GATE_SUITE_TIMEOUT_MS || 180000))
+
+// NAMED per-suite overrides for suites that are HONEST but slow (measured, not guessed). Raising a
+// limit is a documented act: update the numbers here AND say so in the commit message - never silently.
+//   v2-fix-probes.mutants.mjs: ~43.1 s per family x 10 families ~= 430 s measured (inner child cap 120 s)
+//   v3-fix-probes.mutants.mjs: ~23.5 s per family x 11 families ~= 260 s measured (inner child cap 120 s)
+// Both report hangs=[] with their own 120 s child cap, i.e. they are slow, not hung - so the 180 s
+// default would misreport them. Everything else keeps the 180 s default.
+const TIMEOUT_OVERRIDES = {
+  'v2-fix-probes.mutants.mjs': 900000,
+  'v3-fix-probes.mutants.mjs': 900000,
+  // v5-institute-fixes.mutants.mjs: MEASURED 201.9 s wall (hangs=[], skipped=[], ALL MUTANTS RED
+  // AS REQUIRED) - i.e. OVER the 180 s default, so it gets the same 900 s as the v2/v3 families.
+  // History worth keeping: a writer CLAIMED this family fitted its override when it did not, and the
+  // gate caught it as "FAILED: v5-institute-fixes.mutants.mjs [probe] (TIMEOUT after 180s)" - the
+  // named-timeout mechanism doing its job. For contrast, formal-verify-v4.mutants.mjs MEASURED
+  // 70.9 s wall, i.e. ample headroom, so it needs no override.
+  'v5-institute-fixes.mutants.mjs': 900000,
+}
+/** One place decides a job limit: explicit job value, then the named override, then the default. */
+function jobLimit(job) { return job.timeoutMs || TIMEOUT_OVERRIDES[job.file] || SUITE_TIMEOUT_MS }
+/**
+ * DIAGNOSABILITY (protocol: every red must name an assertion): a failing suite's assertion NAMES are
+ * what a reader needs, and they must appear under the FAILED line - not only in the suite's own last
+ * stdout line. Extract the failing-assertion lines (this repo prints `  - <name>` or `  FAIL - <name>`,
+ * and suites that abort print `FAILURES:`/`Error:` markers), and fall back to the raw tail when a suite
+ * names nothing.
+ */
+/**
+ * A reporting line's OWN prefix decides whether it names a failure. Anchored at the start (after the
+ * reporter's indent) so a token appearing INSIDE a passing line (e.g. `  ok - FAIL - ★★★ message`) can
+ * never be extracted as a failure — that false positive made a green run look red.
+ *   own prefix: `FAIL`, `FAIL -`/`FAIL:`, `FAILURES:`; assertion bullets `- <name>` / `* <name>`; `✗`/`✘`.
+ *   line-anchored abort markers: `SyntaxError:`, `TypeError:`, `ReferenceError:`, `Error:`.
+ * `ok`-prefixed lines are excluded explicitly, so a passing bullet is never counted.
+ */
+function namedFailureLines(text) {
+  const out = []
+  for (const raw of String(text || '').split(/\r?\n/)) {
+    const l = raw.replace(/\s+$/, '')
+    if (!l.trim()) continue
+    if (/^\s*ok\b/.test(l)) continue                       // a PASSING line, whatever it contains
+    if (/^\s*(?:FAIL\b|FAILURES:|✗|✘)/.test(l)) { out.push(l); continue }
+    if (/^\s*(?:-|\*)\s+\S/.test(l)) { out.push(l); continue }
+    if (/^\s*(?:SyntaxError|TypeError|ReferenceError|Error):/.test(l)) { out.push(l); continue }
+  }
+  return out
+}
+
+function failureDetail(r) {
+  const lines = (String(r.out || '') + '\n' + String(r.err || '')).split('\n').map((l) => l.replace(/\s+$/, '')).filter(Boolean)
+  const named = namedFailureLines(String(r.out || '') + '\n' + String(r.err || ''))
+  const chosen = (named.length ? named : lines).slice(-40)
+  return chosen.length ? chosen : ['(no captured output)']
+}
+// `--self-check`: prove the diagnostics above actually surface a NAME. Runs one synthetic failing child
+// through the same extractor and asserts the extracted detail contains its assertion name; the mutant
+// that strips `failureDetail` makes this red.
+/** ONE place builds the failure line, so the reporter and the self-check cannot diverge. */
+function failedLine(b) {
+  const kind = '[' + b.job.kind + ']'
+  const why = b.timedOut ? 'TIMEOUT after ' + Math.round(jobLimit(b.job) / 1000) + 's'
+    : 'exit ' + b.code + (b.job.expectExit ? ', required exit ' + b.job.expectExit : '')
+  return '  FAILED: ' + label(b.job) + ' ' + kind + ' (' + why + ')'
+}
+
+if (process.argv.includes('--self-check')) {
+  const { spawnSync } = await import('node:child_process')
+  const synth = spawnSync(process.execPath, ['-e', "console.error('  - synthetic assertion name XYZ'); process.exit(1)"], { encoding: 'utf8' })
+  const detail = failureDetail({ out: synth.stdout, err: synth.stderr }).join('\n')
+  const okSelf = detail.indexOf('synthetic assertion name XYZ') !== -1
+  console.log((okSelf ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': a failing child yields a NAMED assertion line (' + detail.trim().slice(0, 80) + ')')
+  // FALSE-POSITIVE direction: a PASSING line whose message literally contains `FAIL - ` must extract
+  // NOTHING (the v2/v3 owner saw a green run look red this way).
+  const leaked = namedFailureLines('  ok - FAIL - ★★★ [F2cap] the assertion message mentions FAIL - inside it\n')
+  const okPassing = leaked.length === 0
+  console.log((okPassing ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': a passing line containing "FAIL - " is NOT extracted as a failure (' + JSON.stringify(leaked) + ')')
+  // FALSE-NEGATIVE direction stays closed: a genuine FAIL line and a line-anchored abort marker extract.
+  const okReal = namedFailureLines('  FAIL - ★★★ real failure\n').length === 1
+  const okAbort = namedFailureLines('TypeError: boom\n').length === 1
+  console.log((okReal && okAbort ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': a genuine FAIL line and an abort marker are still extracted')
+  // TIMEOUT case on the REAL path: a synthetic job that sleeps past a 1 s per-job limit, run through
+  // the SAME runSuite/reporting path the gate uses. A string-only check could pass with a half-armed
+  // timer; this one cannot, because it reads the run own timedOut/exit and the line the reporter builds.
+  const slow = await runSuite({ file: '(synthetic-sleeper)', args: [], expectExit: 0, kind: 'probe', eval: 'setTimeout(() => {}, 5000)', timeoutMs: 1000 })
+  const killedByRunner = slow.timedOut === true && slow.code !== 0
+  const line = failedLine(slow)
+  const namedTimeout = /FAILED: .*\[probe\] \(TIMEOUT after 1s\)/.test(line)
+  console.log((killedByRunner ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': the RUNNER kills a sleeping job at its per-job limit (timedOut=true, exit=' + slow.code + ')')
+  console.log((namedTimeout ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': the failure line names the timeout: ' + line.trim())
+  // OVERRIDE case (real path): the named override must actually EXTEND the limit. A job that sleeps
+  // 1.5 s would be killed by 1 s, so it must survive under the override and report its own seconds.
+  const NAMED_OVERRIDES = ['v2-fix-probes.mutants.mjs', 'v3-fix-probes.mutants.mjs', 'v5-institute-fixes.mutants.mjs']
+  const overrideOk = NAMED_OVERRIDES.every((f) => jobLimit({ file: f }) === 900000)
+    && jobLimit({ file: 'anything-else.mjs' }) === SUITE_TIMEOUT_MS
+    && jobLimit({ file: 'formal-verify-v4.mutants.mjs' }) === SUITE_TIMEOUT_MS   // measured 70.9 s: no override needed
+  const survived = await runSuite({ file: '(synthetic-ok)', args: [], expectExit: 0, kind: 'probe', eval: 'setTimeout(() => {}, 1500)', timeoutMs: 900000 })
+  const extended = survived.timedOut === false && survived.code === 0
+  const overrideLine = failedLine({ job: { file: 'v2-fix-probes.mutants.mjs', args: [], kind: 'probe', expectExit: 0 }, code: null, timedOut: true })
+  const namesOverride = /TIMEOUT after 900s/.test(overrideLine)
+  console.log((overrideOk ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': a named override is resolved for its suite and nothing else')
+  console.log((extended ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': a job that would die at 1 s SURVIVES under the override (real runSuite)')
+  console.log((namesOverride ? 'SELF-CHECK PASS' : 'SELF-CHECK FAIL') + ': a timed-out override reports its own limit (' + overrideLine.trim() + ')')
+  process.exit(okSelf && okPassing && okReal && okAbort && killedByRunner && namedTimeout && overrideOk && extended && namesOverride ? 0 : 1)
+}
 // The scripts that genuinely cannot run without arguments. They are named here (with the exact
 // command a human must run) instead of being omitted quietly: an entry that no longer exists
 // aborts the run, so a rename cannot turn into a silent gap.
@@ -81,6 +190,12 @@ const VARIANTS = [
   // The invariant scanner's own falsifiability check: it exits 0 only when every injected
   // mutation really made a run go RED (and the unmutated control stayed green).
   { file: 'audit-prompt-invariants.mjs', args: ['--self-probe'] },
+  // The participant-set proof, shipped: the guard's own predicates against broken strings.
+  { file: 'audit-participant-set-parity.mjs', args: ['--self-probe'] },
+  // §7/§8 predicates, shipped: same functions fed broken strings.
+  { file: 'audit-math-computation-parity.mjs', args: ['--self-probe'] },
+  // §30 verify-provenance predicates (case 3), shipped.
+  { file: 'math-computation-shared.test.mjs', args: ['--self-probe'] },
   // The two-registration-paths probe, inverted: it applies a real description mutation and
   // REQUIRES the parity check to exit 1 (exit 2 means the mutation no longer applies = drift).
   {
@@ -114,22 +229,38 @@ for (const v of VARIANTS) {
     if (DEV_CHECKOUT) { console.error('a VARIANTS entry names a missing script: ' + v.file); process.exit(2) }
     continue
   }
-  suites.push({ file: v.file, args: v.args || [], expectExit: v.expectExit || 0, kind: v.file.endsWith('.test.mjs') ? 'suite' : 'probe' })
+  // A VARIANT is an EXTRA instrumented run of the SAME script (argument variants), never an additional
+  // suite: the counting unit for `suites` is "the suites proper", one per script. Classifying by file name
+  // here would inflate `suites` whenever a suite gains a `--self-probe` job (R18: it did, 44 -> 45).
+  suites.push({ file: v.file, args: v.args || [], expectExit: v.expectExit || 0, kind: 'probe' })
 }
 suites.sort((a, b) => (label(a) < label(b) ? -1 : 1))
 if (only.length) suites = suites.filter((j) => only.some((o) => label(j).includes(o)))
 if (exclude.length) suites = suites.filter((j) => !exclude.some((o) => label(j).includes(o)))
 if (!suites.length) { console.error('no suites matched'); process.exit(2) }
 
+// --counts: print the DERIVED suite/probe totals (the same job list the gate runs) as JSON, then
+// exit. Docs quote these numbers, so they must be derived and checked rather than typed by hand.
+if (process.argv.includes('--counts')) {
+  const suiteN = suites.filter((j) => j.kind === 'suite').length
+  console.log(JSON.stringify({ total: suites.length, suites: suiteN, probes: suites.length - suiteN }))
+  process.exit(0)
+}
+
 function runSuite(job) {
   return new Promise((resolve) => {
     const t0 = Date.now()
-    const child = spawn(process.execPath, [join(HERE, job.file), ...job.args], { cwd: REPO, stdio: ['ignore', 'pipe', 'pipe'] })
+    const argv = job.eval ? ['-e', job.eval] : [join(HERE, job.file), ...job.args]
+    const limitMs = jobLimit(job)
+    const child = spawn(process.execPath, argv, { cwd: REPO, stdio: ['ignore', 'pipe', 'pipe'] })
+    let timedOut = false
+    const killer = setTimeout(() => { timedOut = true; try { child.kill('SIGKILL') } catch (e) { /* already gone */ } }, limitMs)
+    const clearKiller = () => clearTimeout(killer)
     let out = '', err = ''
     child.stdout.on('data', (d) => { out += d.toString() })
     child.stderr.on('data', (d) => { err += d.toString() })
-    child.on('error', (e) => resolve({ job, code: -1, ms: Date.now() - t0, out, err: err + '\n' + String(e) }))
-    child.on('close', (code) => resolve({ job, code, ms: Date.now() - t0, out, err }))
+    child.on('error', (e) => { clearKiller(); resolve({ job, code: -1, ms: Date.now() - t0, out, err: err + '\n' + String(e), timedOut }) })
+    child.on('close', (code) => { clearKiller(); resolve({ job, code, ms: Date.now() - t0, out, err, timedOut }) })
   })
 }
 
@@ -154,13 +285,11 @@ async function worker(id) {
         (tail ? '  ' + tail.slice(0, 60) : '')
       )
       if (!r.ok) {
-        const lines = (r.out + '\n' + r.err).split('\n').filter(Boolean)
-        for (const l of lines.slice(-15)) console.log('      ' + l)
+        for (const l of failureDetail(r)) console.log('      ' + l)
       }
     } else if (!r.ok) {
       // In --json mode keep stdout machine-readable: the failure detail travels in the JSON.
-      const lines = (r.out + '\n' + r.err).split('\n').filter(Boolean)
-      r.tailDetail = lines.slice(-15).join('\n')
+      r.tailDetail = failureDetail(r).join('\n')
     }
   }
 }
@@ -193,7 +322,8 @@ if (asJson) {
   console.log('TOTAL ' + results.length + '  PASS ' + (results.length - bad.length) + '  FAIL ' + bad.length
     + '  (suites ' + suiteCount + ' · probes ' + (results.length - suiteCount) + ')')
   for (const b of bad) {
-    console.log('  FAILED: ' + label(b.job) + ' (exit ' + b.code + (b.job.expectExit ? ', required exit ' + b.job.expectExit : '') + ')')
+    console.log(failedLine(b))
+    for (const l of failureDetail(b)) console.log('      ' + l)
   }
   for (const [f, why] of Object.entries(NEEDS_ARGS)) {
     console.log('  SKIPPED (needs CLI args): ' + f + ' — ' + why + (presentSet.has(f) ? '' : '  [not present in this checkout]'))

package/tests/run-tests.mutants.mjs

@@ -0,0 +1,70 @@
+// In-repo mutant harness for the runner-diagnostics guard (ships: `tests/*.mutants.mjs`).
+// It proves the `--self-check` guard can REDDEN: strip the named-failure detail from a COPY of
+// run-tests.mjs, then run that copy's own `--self-check` and require it to fail.
+// Usage: node tests/run-tests.mutants.mjs
+import { mkdtempSync, copyFileSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+const REPO = join(HERE, '..')
+const RUNNER = join(HERE, 'run-tests.mjs')
+
+let passed = 0, failed = 0
+const ok = (cond, label, detail) => {
+  if (cond) { passed++; console.log('  ok   ' + label); return true }
+  failed++; console.log('  FAIL ' + label + (detail ? ' — ' + detail : '')); return false
+}
+
+// baseline: the real runner's self-check must pass
+const base = spawnSync(process.execPath, [RUNNER, '--self-check'], { cwd: REPO, encoding: 'utf8' })
+ok(base.status === 0 && /SELF-CHECK PASS/.test(base.stdout || ''),
+  'baseline: the runner self-check passes (a failing child yields a named assertion)',
+  JSON.stringify(String(base.stdout || '').trim().slice(0, 80)))
+
+// mutant: strip the named-failure extraction (fall back to a constant) -> the self-check must REDDEN
+const dir = mkdtempSync(join(tmpdir(), 'runner-mut-'))
+// Normalise CRLF so the anchor is line-ending agnostic (the runner is checked out with CRLF on Windows).
+const src = readFileSync(RUNNER, 'utf8').replace(/\r\n/g, '\n')
+const from = "  const chosen = (named.length ? named : lines).slice(-40)\n  return chosen.length ? chosen : ['(no captured output)']"
+if (src.indexOf(from) === -1) {
+  ok(false, 'mutant anchor applies (the named-failure extraction is present)', 'ANCHOR MISS')
+} else {
+  writeFileSync(join(dir, 'run-tests.mjs'), src.replace(from, "  return ['(no captured output)']"))
+  const mut = spawnSync(process.execPath, [join(dir, 'run-tests.mjs'), '--self-check'], { cwd: REPO, encoding: 'utf8' })
+  ok(mut.status !== 0 && /SELF-CHECK FAIL/.test(String(mut.stdout || '')),
+    '★ mutant (named-failure detail stripped) makes the self-check RED',
+    'exit=' + mut.status + ' out=' + JSON.stringify(String(mut.stdout || '').trim().slice(0, 80)))
+}
+rmSync(dir, { recursive: true, force: true })
+// TIMEOUT path, BOTH directions (a criterion must be validated against a known-positive AND a
+// known-negative before it gates anything): the same real suite under a 1 s limit must be killed
+// and NAMED in the failure list; under the default limit it must not be reported as a timeout.
+const slowRun = spawnSync(process.execPath, [RUNNER, '--only', 'audit-prompt-invariants'], { cwd: REPO, encoding: 'utf8', env: Object.assign({}, process.env, { GATE_SUITE_TIMEOUT_MS: '1000' }) })
+const slowOut = String(slowRun.stdout || '') + String(slowRun.stderr || '')
+const failList = slowOut.split('\n').filter((l) => /^\s*FAILED:/.test(l))
+const timedOutLine = failList.find((l) => /\[probe\] \(TIMEOUT after 1s\)/.test(l)) || ''
+ok(slowRun.status !== 0 && !!timedOutLine,
+  '★ POSITIVE: a 1 s limit makes the runner kill the suite and NAME the timeout in the failure list',
+  'exit=' + slowRun.status + ' line=' + timedOutLine.trim())
+// NEGATIVE (two readings, so the criterion cannot be always-red):
+//   (a) ANY suite under the DEFAULT limit produces no TIMEOUT marker, whatever its own verdict;
+//   (b) a known-green fast suite exits 0 (no false timeout).
+// (a) is deliberately verdict-agnostic: at the time of writing audit-prompt-invariants is red for an
+// unrelated in-flight reason (v2/v3 I13/I14: the parameter schema parses to 0 keys), and a proof tool
+// must not inherit someone else's red.
+const fastRun = spawnSync(process.execPath, [RUNNER, '--only', 'audit-prompt-invariants'], { cwd: REPO, encoding: 'utf8' })
+const fastOut = String(fastRun.stdout || '') + String(fastRun.stderr || '')
+ok(!/TIMEOUT after/.test(fastOut),
+  'NEGATIVE (a): with the default limit no TIMEOUT marker is produced (the criterion is not always-red)',
+  'exit=' + fastRun.status + ' (its own verdict is another owner\'s concern)')
+const greenRun = spawnSync(process.execPath, [RUNNER, '--only', 'audit-package-membership'], { cwd: REPO, encoding: 'utf8' })
+const greenOut = String(greenRun.stdout || '') + String(greenRun.stderr || '')
+ok(greenRun.status === 0 && !/TIMEOUT after/.test(greenOut),
+  'NEGATIVE (b): a known-green suite exits 0 under the default limit (no false timeout)',
+  'exit=' + greenRun.status)
+console.log('')
+console.log('=== RUNNER DIAGNOSTICS MUTANTS: ' + passed + ' passed, ' + failed + ' failed ===')
+process.exit(failed === 0 ? 0 : 1)

package/tests/selfdrive-v5.mjs

@@ -257,7 +257,21 @@ async function drainVerifyRound(n) {
 console.log('-- V5 self-drive --')
 
 // ---------- founding ----------
-const started = await callTool('vibe_v5_start', { problem: '证明：不存在整数解 x^n + y^n = z^n（n>2）的初等情形', researcherCount: 3 })
+// F6 tightening (staff): the persona parameter must actually REACH the member prompts. MEASURED: a
+// single-site mutant that drops `params.staffPersona` (`const extra = ''`) is caught by NO current
+// suite (audit-participant-set-parity ok, audit-persona-sensitivity ok, audit-persona-surface 276/0).
+await callTool('vibe_v5_set', { staffPersona: 'STAFF-MARKER-X' })
+// V5-A5 (path contract, docs-vs-code class): `memberPathContractOk()` (vibe-math-v5.js:993) compares
+// the DOCUMENTED member root with the root the framework actually writes; a divergence logs a NAMED
+// error and folds into noteLoadProblem. MEASURED: no suite referenced it before this assertion.
+const pathErrs = []
+const realErrA5 = console.error
+console.error = (...a) => { const line = a.map(String).join(' '); if (/member library path contract BROKEN/.test(line)) pathErrs.push(line); realErrA5(...a) }
+let started
+try {
+  started = await callTool('vibe_v5_start', { problem: '证明：不存在整数解 x^n + y^n = z^n（n>2）的初等情形', researcherCount: 3 })
+} finally { console.error = realErrA5 }
+assert(pathErrs.length === 0, '* V5-A5 the documented member root equals the root the framework writes (no path-contract divergence; got ' + JSON.stringify(pathErrs.slice(0, 1)) + ')')
 assert(started.ok === true, 'vibe_v5_start ok (' + JSON.stringify(started).slice(0, 150) + ')')
 assert(spawns.length === 4, 'founded 1 academician + 3 researchers (got ' + spawns.length + ')')
 assert(!!spawnOf('acad'), 'academician acad exists')
@@ -332,6 +346,27 @@ assert(!!sv.verify, 'verification of ' + target + ' is in flight right after pro
   JSON.stringify({ verify: sv.verify, queue: sv.verifyQueue, undecided: sv.undecided, running: sv.running, autoDone: sv.autoDone, phase: sv.phase, meeting: sv.meeting, parked: sv.parkedMeeting, tasks: sv.tasks.length }))
 if (sv.verify) {
   assert(sv.verify.m === 3 && sv.verify.P === 4, 'verification reports m=3 over P=4 voters')
+// V5-A1: P=4 is a COUNT - assert the semantic unit too. The voter set is the roster identity that
+// quorum is computed over, so a duplicate id (P unchanged) must not pass. Measured shape:
+// status.verify.voters is the id array (product: `voters: E` in the verdict payload).
+// V5-A1: the SHAPE was measured first - status.verify carries {target,kind,stage,round,voted,m,P} but
+// NO voter list (vibe-math-v5.js:7316); the voter IDS live in `status.quorum` (quorumView(), :7277/:1262).
+const voterIds = (sv.quorum && Array.isArray(sv.quorum.voters)) ? sv.quorum.voters.map(String).sort() : null
+assert(!!voterIds && voterIds.join(',') === ['acad', 'r-1', 'r-2', 'r-3'].sort().join(','), '* V5-A1 the voter id SET is exactly {acad, r-1, r-2, r-3} (P=4 keeps the count; got ' + JSON.stringify(voterIds) + ')')
+// V5-A2 (roster): the published participant SET and its own COUNT must agree, and the ids must be
+// distinct. MEASURED: a mutant that publishes `vs.slice(1)` as `voters` while keeping `voterCount`
+// is caught by NO current suite (the parity audit checks field PRESENCE, not agreement).
+const qv = sv.quorum || {}
+const qvoters = Array.isArray(qv.voters) ? qv.voters.map(String) : null
+assert(!!qvoters && qvoters.length === Number(qv.voterCount), '* V5-A2 the published voter SET agrees with its own count (voters=' + (qvoters ? qvoters.length : 'none') + ' voterCount=' + qv.voterCount + ')')
+assert(!!qvoters && new Set(qvoters).size === qvoters.length, '* V5-A2 and the published voter ids are DISTINCT (got ' + JSON.stringify(qvoters) + ')')
+// V5-A3 (staff): the staffPersona set before founding must appear in the member PERSONA/prompts.
+// NOTE (measured): the existing `every member got the full charter` length check stays GREEN under
+// the mutant, so the marker search is the only discriminator.
+const marker = 'STAFF-MARKER-X'
+const sawStaff = spawns.some((sp) => String(sp.persona || '').indexOf(marker) !== -1)
+  || wakes.some((w) => (((w.blocks && w.blocks[0] && w.blocks[0].text) || '')).indexOf(marker) !== -1)
+assert(sawStaff, '* V5-A3 the staff persona reaches the member persona/prompts (marker=' + marker + '; spawns=' + spawns.length + ', wakes=' + wakes.length + ')')
 
   // Round: only ONE boolean vote (< m) must NOT verify.
   plannedVotes = new Map([['acad', 0.9], ['r-1', 1], ['r-2', 0.5], ['r-3', 0.7]])
@@ -396,6 +431,23 @@ const t1 = await callTool('vibe_v5_task_create', { subject: '整理已知特例'
 assert(t1.ok === true && t1.task.revision === 1, 'a member can open a task (revision 1)')
 const stale = await callTool('vibe_v5_task_update', { task_id: t1.task.id, expected_revision: 99, action: 'claim' }, childAgent(childOf('r-3')))
 assert(stale.ok === false && stale.code === 'V5_TASK_STALE_REVISION', 'a stale revision is refused (compare-and-set)')
+// V5-A4 (CAS semantic unit) - R17 scope refinement: the assertion detects any refused-but-written
+// change VISIBLE IN THE OBSERVABLE TRIPLE (revision|ownerId|status). Measured by R17: a
+// `task.status='done'` write inside the refusal branch => V5-A4 RED (`before=1||pending after=1||done`);
+// a write OUTSIDE the triple (e.g. `task.notes`) => V5-A4 green and remains a MEASURED BOUNDARY (the
+// harness cannot see it). The earlier, broader phrasing ("cannot be the sole discriminator") is
+// superseded by this scope statement.
+// The assertions above (here,
+// in e2e-v5-round2 and in prompt-v5-integrity) only check the RETURN VALUE, so a mutant that refuses
+// but still writes - or writes first and checks afterwards - would pass all of them. Read the task
+// back and compare the observable triple.
+const t1AfterStale = await callTool('vibe_v5_task_get', { task_id: t1.task.id }, childAgent(childOf('r-3')))
+const taskOf = (r) => (r && r.task) ? r.task : (r && r.id ? r : null)
+const t1Before = taskOf(t1) || {}
+const t1Now = taskOf(t1AfterStale) || {}
+const tupleOf = (t) => [t.revision, t.ownerId || '', t.status || ''].join('|')
+assert(!!t1Now.revision, '* V5-A4 the task is readable back after the refusal (got ' + JSON.stringify(t1AfterStale).slice(0, 120) + ')')
+assert(tupleOf(t1Now) === tupleOf(t1Before), '* V5-A4 a REFUSED stale CAS leaves the task UNCHANGED (before=' + tupleOf(t1Before) + ' after=' + tupleOf(t1Now) + ')')
 const claimed = await callTool('vibe_v5_task_update', { task_id: t1.task.id, expected_revision: 1, action: 'claim' }, childAgent(childOf('r-3')))
 assert(claimed.ok === true && claimed.task.ownerId === 'r-3', 'claiming sets the owner')
 const blocked = await callTool('vibe_v5_task_create', { subject: '依赖前一个', description: 'd', blocked_by: [t1.task.id] }, childAgent(childOf('r-3')))

package/tests/selfdrive-v5.mutants.mjs

@@ -0,0 +1,132 @@
+// Registered mutant harness for the v5 self-drive suite — the suite carries its own proof.
+// Mirrors tests/formal-verify-v4.mutants.mjs / formal-verify-v3.mutants.mjs: a SINGLE content-anchored
+// mutation of the v5 preset (no line numbers), run through the V5_PLUGIN seam, bounded child runs (a
+// timeout is a HANG, never a pass), skipped families printed and counted, and the family's TOTAL WALL
+// TIME reported (per-family numbers alone can hide a timeout).
+// Run: node tests/selfdrive-v5.mutants.mjs
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync, rmSync, readdirSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const PRESET = 'vibe-math-v5'
+const MAIN = PRESET + '.js'
+const SUITE = 'tests/selfdrive-v5.mjs'
+const ENV = 'V5_PLUGIN'
+// Measured: a selfdrive-v5 child run is ~2 s; MUTANT_CHILD_TIMEOUT_MS overrides it.
+const CHILD_TIMEOUT_MS = Number(process.env.MUTANT_CHILD_TIMEOUT_MS || 300000)
+const TIMES = []
+const hangs = []
+const skipped = []
+function copyGraph(file, dest) {
+  const src = join(REPO, PRESET, file)
+  copyFileSync(src, join(dest, file))
+  for (const m of readFileSync(src, 'utf8').matchAll(/from\s+'(\.\/[A-Za-z0-9_.-]+\.js)'/g)) {
+    const dep = m[1].slice(2)
+    if (!readdirSync(dest).includes(dep)) copyGraph(dep, dest)
+  }
+}
+function runFamily(f) {
+  const dest = join(tmpdir(), 'v5sd-mut-' + Math.random().toString(36).slice(2, 10))
+  mkdirSync(dest, { recursive: true })
+  copyGraph(MAIN, dest)
+  const target = join(dest, f.editFile || MAIN)
+  const before = readFileSync(target, 'utf8')
+  const n = before.split(f.from).length - 1
+  const okCount = f.lastOnly || f.all ? n >= 1 : n === 1
+  if (!okCount) {
+    skipped.push(f.name + ' (anchor x' + n + ')')
+    console.error('  SKIP - ' + f.name + ' (anchor x' + n + ')')
+    rmSync(dest, { recursive: true, force: true })
+    return false
+  }
+  writeFileSync(target, before.split(f.from).join(f.to), 'utf8')
+  try { execFileSync(process.execPath, ['--check', target], { stdio: 'pipe' }) }
+  catch (e) {
+    writeFileSync(target, before, 'utf8')
+    skipped.push(f.name + ' (mutation did not compile)')
+    console.error('  SKIP - ' + f.name + ' (mutation did not compile; restored)')
+    rmSync(dest, { recursive: true, force: true })
+    return false
+  }
+  const t0 = Date.now()
+  let out = ''
+  let code = 0
+  let hang = false
+  try {
+    out = execFileSync(process.execPath, [SUITE], {
+      cwd: REPO, encoding: 'utf8', timeout: CHILD_TIMEOUT_MS, killSignal: 'SIGKILL',
+      env: Object.assign({}, process.env, { [ENV]: join(dest, MAIN) }),
+    })
+  } catch (e) {
+    if (e && (e.killed || e.signal === 'SIGKILL')) hang = true
+    code = (e && e.status) || 1
+    out = String((e && e.stdout) || '') + String((e && e.stderr) || '')
+  }
+  const ms = Date.now() - t0
+  TIMES.push([f.name, ms])
+  if (hang) hangs.push(f.name + '(' + Math.round(ms / 1000) + 's)')
+  const named = out.split(/\r?\n/).filter((l) => /^\s*(FAIL - | {2}- )/.test(l) && f.expect.test(l)).map((l) => l.trim())
+  const ok = !hang && code !== 0 && named.length > 0
+  console.log((hang ? '  HANG - ' : (ok ? '  ok - ' : '  FAIL - ')) + f.name + ' [' + ms + 'ms]' + (named.length ? ' :: ' + named[0].slice(0, 150) : ' :: no named red (exit=' + code + ')'))
+  rmSync(dest, { recursive: true, force: true })
+  return ok
+}
+const FAMILIES = [
+  {
+    // V5-A1: the LAST voter is replaced by a DUPLICATE of the first, so P stays 4 (the count assertion
+    // passes) while the voter id SET loses a member - the roster identity, not the head-count.
+    name: 'V5-A1: the last voter is a duplicate of the first (P still 4)',
+    from: "const voters = () => activeMembers().filter((m) => m.kind === 'academician' || m.kind === 'researcher')",
+    to: "const voters = () => { const v = activeMembers().filter((m) => m.kind === 'academician' || m.kind === 'researcher'); return v.length > 1 ? v.slice(0, -1).concat([v[0]]) : v }",
+    expect: /V5-A1 the voter id SET is exactly/,
+  },
+  {
+    // F6 tightening (roster): the published voter set drops one member while its COUNT stays put.
+    name: 'V5-A2: the published voter set disagrees with its own count',
+    from: 'voters: vs.map((m) => m.id),',
+    to: 'voters: vs.slice(1).map((m) => m.id),',
+    expect: /V5-A2 the published voter SET agrees with its own count/,
+  },
+  {
+    // F6 tightening (staff): the member persona ignores `params.staffPersona` again.
+    name: 'V5-A3: the staff persona never reaches the prompts',
+    from: "const extra = String(params.staffPersona || '').trim()",
+    to: "const extra = ''",
+    expect: /V5-A3 the staff persona reaches the member persona\/prompts/,
+  },
+  {
+    // ④ CAS: the stale-revision guard is disabled, so a stale update lands (the return-value
+    // assertions AND the new "unchanged after refusal" assertion redden).
+    // R17 scope refinement for V5-A4: it detects any refused-but-written change VISIBLE IN THE
+    // OBSERVABLE TRIPLE (revision|ownerId|status) - measured: an in-branch `task.status='done'`
+    // makes it RED (`before=1||pending after=1||done`), while a write OUTSIDE the triple (e.g.
+    // `task.notes`) keeps it green and remains a MEASURED BOUNDARY (invisible to the harness).
+    // assertions AND the new "unchanged after refusal" assertion redden).
+    name: 'V5-A4: the stale-revision guard is disabled (a stale CAS lands)',
+    from: 'if (expected !== task.revision) {',
+    to: 'if (false) {',
+    expect: /V5-A4 a REFUSED stale CAS leaves the task UNCHANGED|a stale revision is refused/,
+  },
+  {
+    // ⑤ path contract: ONLY the documented composition moves (instRootRel), while the framework
+    // keeps writing through instRoot() - exactly the v4 58fff7f defect class this guard exists for.
+    name: 'V5-A5: the documented member root diverges from the written root',
+    from: "const instRootRel = () => 'VibeMath/Projects/' + project + '/Institutes/' + instituteName",
+    to: "const instRootRel = () => 'VibeMath/Projects/' + project + '/Institutes/' + instituteName + 'X'",
+    expect: /V5-A5 the documented member root equals the root the framework writes/
+  },
+]
+let red = 0
+for (const f of FAMILIES) { const ok = runFamily(f); if (ok) red++ }
+const totalMs = TIMES.reduce((a, t) => a + t[1], 0)
+console.log('')
+console.log('mutant families reddening the v5 self-drive suite by name: ' + red + '/' + FAMILIES.length)
+console.log('timings (per family): ' + TIMES.map((t) => String(t[0]).split(':')[0] + '=' + t[1] + 'ms').join('  '))
+console.log('TOTAL WALL TIME (all families + setup): ' + totalMs + 'ms (' + Math.round(totalMs / 1000) + 's)')
+console.log('hangs=[' + hangs.join(' | ') + ']')
+console.log('skipped=[' + skipped.join(' | ') + ']')
+if (red !== FAMILIES.length || skipped.length || hangs.length) process.exit(1)
+console.log('ALL MUTANTS RED AS REQUIRED')

package/tests/v2-fix-probes.mutants.mjs

@@ -0,0 +1,100 @@
+// Registered mutant harness for tests/v2-fix-probes.test.mjs — the probe carries its own proof.
+// Defect classes: surface-shape contract (F1), declared asymmetry (F-A), path-base mixing (F6),
+// silent-failure surfacing (F6a/F6b/F6c). Single content-anchored mutations; V2_PLUGIN seam.
+// Exit criterion: every family reddens BY NAME; any skipped family is printed and counted (never a
+// silent NO-OP impersonating a pass); ALL MUTANTS RED AS REQUIRED + exit 0 only then.
+// Run: node tests/v2-fix-probes.mutants.mjs
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync, rmSync, readdirSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+
+// Bound every child run: run-tests has no per-suite timeout, so an unbounded child hangs the gate.
+// A timeout is reported as HANG, counts as a failure for that family, and is listed in hangs=[].
+const CHILD_TIMEOUT_MS = Number(process.env.MUTANT_CHILD_TIMEOUT_MS || 120000)
+const TIMES = []
+// R15: whole-process wall time, printed at the end (the timeout row quotes this line).
+const START_MS = Date.now()
+const hangs = []
+let lastHang = false
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const PRESET = 'vibe-math-v2'
+const MAIN = PRESET + '.js'
+const SUITE = 'tests/v2-fix-probes.test.mjs'
+const ENV = 'V2_PLUGIN'
+function copyGraph(file, dest) {
+  const src = join(REPO, PRESET, file)
+  copyFileSync(src, join(dest, file))
+  for (const m of readFileSync(src, 'utf8').matchAll(/from\s+'(\.\/[A-Za-z0-9_.-]+\.js)'/g)) {
+    const dep = m[1].slice(2)
+    if (!readdirSync(dest).includes(dep)) copyGraph(dep, dest)
+  }
+}
+const skipped = []
+function runFamily(f) {
+  const dest = join(tmpdir(), 'v2probes-mut-' + Math.random().toString(36).slice(2, 10))
+  mkdirSync(dest, { recursive: true })
+  copyGraph(MAIN, dest)
+  const target = join(dest, f.editFile || MAIN)
+  const before = readFileSync(target, 'utf8')
+  const n = before.split(f.from).length - 1
+  const okCount = f.lastOnly || f.firstOnly || f.all ? n >= 1 : n === 1
+  if (!okCount) { skipped.push(f.name + ' (anchor x' + n + ')'); console.error('  SKIP - ' + f.name + ' (anchor x' + n + ')'); rmSync(dest, { recursive: true, force: true }); return false }
+  let mutated
+  if (f.lastOnly) { const i = before.lastIndexOf(f.from); mutated = before.slice(0, i) + f.to + before.slice(i + f.from.length) }
+  else if (f.firstOnly) { const i = before.indexOf(f.from); mutated = before.slice(0, i) + f.to + before.slice(i + f.from.length) }
+  else if (f.all) mutated = before.split(f.from).join(f.to)
+  else mutated = before.split(f.from).join(f.to)
+  writeFileSync(target, mutated, 'utf8')
+  try { execFileSync(process.execPath, ['--check', target], { stdio: 'pipe' }) }
+  catch (e) { writeFileSync(target, before, 'utf8'); skipped.push(f.name + ' (mutation did not compile)'); console.error('  SKIP - ' + f.name + ' (mutation did not compile; restored)'); rmSync(dest, { recursive: true, force: true }); return false }
+  let out = ''
+  let code = 0
+  try { out = execFileSync(process.execPath, [SUITE], { cwd: REPO, encoding: 'utf8', timeout: CHILD_TIMEOUT_MS, killSignal: 'SIGKILL', env: Object.assign({}, process.env, { [ENV]: join(dest, MAIN) }) }) }
+  catch (e) { if (e && (e.killed || e.signal === 'SIGKILL')) lastHang = true; code = (e && e.status) || 1; out = String((e && e.stdout) || '') + String((e && e.stderr) || '') }
+  const named = out.split(/\r?\n/).filter((l) => /^\s*(FAIL - | {2}- )/.test(l) && f.expect.test(l)).map((l) => l.trim())
+  const ok = code !== 0 && named.length > 0
+  console.log((ok ? '  ok - ' : '  FAIL - ') + f.name + (named.length ? ' :: ' + named[0].slice(0, 130) : ' :: no named red (exit=' + code + ')'))
+  rmSync(dest, { recursive: true, force: true })
+  return ok
+}
+const ANCHOR_LEN = "pendingDecisions: decisionQueue.filter(function (d) { return d.status === 'pending' }).length,"
+const FAMILIES = [
+  { name: 'F1: report pendingDecisions back to an array', expect: /\[F1\] pendingDecisions 两面同形/, from: ANCHOR_LEN, firstOnly: true,
+    to: "pendingDecisions: decisionQueue.filter(function (d) { return d.status === 'pending' }).map(function (d) { return { id: d.id, node: d.node, context: d.context } })," },
+  { name: 'F-A: status gains pendingDecisionItems', expect: /\[F-A\] status \*\*不得\*\*携带明细/, from: ANCHOR_LEN,
+    to: ANCHOR_LEN + "\n  pendingDecisionItems: decisionQueue.filter(function (d) { return d.status === 'pending' }).map(function (d) { return { id: d.id, node: d.node, context: d.context } }),", lastOnly: true },
+  { name: 'F6: paths base dropped from both surfaces', expect: /\[F6\] status\.formal\.paths 带 base \+ note/,
+    from: "paths: { base: frameworkRoot() + '/', project: 'Formal/', proofs: 'Verified/Lean/', lib:",
+    to: "paths: { project: 'Formal/', proofs: 'Verified/Lean/', lib:", all: true },
+  { name: 'F6a: provider list-failure warning removed', expect: /\[F6a\]/,
+    from: "warnProviderFallback('subagents.list() failed: ' + ((e && e.message) || e))", to: 'void e' },
+  { name: 'F6b: interrupt emit statement deleted (anchored by content)', expect: /\[F6b\/v2\]/,
+    from: "if (r && r.ok === false) logActivity('interrupt', '中断失败（' + why + '）：' + String(cid) + ' — ' + String(r.message || r.code || ''))", to: 'void r' },
+  { name: 'F6c: project-pointer write failure re-silenced', expect: /\[F6c\]/,
+    from: "noteStateWriteFailure('current.' + safeId(sessionId) + '.json', (e && e.message) || e)", to: 'void e' },
+]
+let red = 0
+FAMILIES.push(
+  { name: 'F5/v2: fence-root comparison removed', expect: /\[F5\/v2\] 围栏根漂移/,
+    from: 'if (actual && expected && actual !== expected) warnFenceDriftOnce(actual, expected)', to: 'void actual' },
+)
+FAMILIES.push(
+  { name: 'F-B: derivation drops the source descriptions', expect: /\[F-B\/v2\] 每个机读描述都来自真源且非空/,
+    from: 'if (e.description) p.description = e.description', to: 'void e /* MUTANT F-B: no source description */' },
+  { name: 'F-B: one exception entry deleted', expect: /\[F-B\/v2\] 例外集合 == docs\/parameter-schema\.md/,
+    from: "solverToolAllow: { type: 'array', items: { type: 'string' } },", to: '' },
+  { name: 'F-B: one registration site reverted to a literal', expect: /\[F-B\/v2\] 两处注册点都由 paramProps\(\)/,
+    from: "objParams(paramProps()), 'vibe_math_set_params')", to: "objParams({ mode: { type: 'string', enum: ['manual', 'auto'] } }), 'vibe_math_set_params')" },
+)
+for (const f of FAMILIES) { const t0 = Date.now(); lastHang = false; const ok = runFamily(f); const ms = Date.now() - t0; TIMES.push([f.name, ms]); if (lastHang) hangs.push(f.name + "(" + Math.round(ms / 1000) + "s)"); if (ok) red++ }
+console.log('')
+console.log('mutant families reddening the v2 probe by name: ' + red + '/' + FAMILIES.length)
+console.log('skipped=[' + skipped.join(' | ') + ']')
+console.log('timings: ' + TIMES.map((t) => String(t[0]).split(':')[0] + '=' + t[1] + 'ms').join('  '))
+console.log('TOTAL WALL TIME (all families + setup): ' + (Date.now() - START_MS) + 'ms (' + Math.round((Date.now() - START_MS) / 1000) + 's)')
+console.log('hangs=[' + hangs.join(' | ') + ']')
+if (red !== FAMILIES.length || skipped.length || hangs.length) process.exit(1)
+console.log('ALL MUTANTS RED AS REQUIRED')