dsh-vibe-math 2.7.1 → 2.7.3

package/vibe-math-v4/vibe-math-v4.js

@@ -93,6 +93,11 @@ export function apply(ctx) {
   // automatic parent creation). Reading on demand removes that dependency on mount order.
   const subprocessOf = () => { try { return ctx.get('subprocess') } catch(e){ return undefined } }
   const sandboxPolicyOf = () => { try { return ctx.get('sandboxPolicy') } catch(e){ return undefined } }
+ // G-7 invariant (class guard): AGENT-FACING compaction MUST take the agent-local instance via
+ // `compactionForAgent(agent)` - this preset mounts its compaction row inside the preset's `compaction`
+ // isolate realm, and a realm NEVER falls back to the host-root instance. Only NON-agent sites may use
+ // `compactionOf()`. Guarded by the text-level assertion in tests/formal-verify-v4.test.mjs.
+
   const compactionOf = () => { try { return ctx.get('compaction') } catch(e){ return undefined } }
 
   const sessions = new Map()      // rootAgentId -> Session
@@ -255,6 +260,11 @@ export function apply(ctx) {
     }
     let running = false, autoDone = false, phase = 'idle'
     let residents = new Map(), mailboxes = new Map(), taskboard = [], decisions = []
+    // round-9 (P2/D4): the participant set is frozen per verify/meeting together with this version, so
+    // every view reads the SAME roster instead of re-deriving it from the live map (mid-flight
+    // addMember/removeMember is possible: removeMember reconciles in-flight work, addMember has no
+    // verify/meeting gate).
+    let rosterVersion = 0
     let meetings = [], reports = [], activityLog = []
     let problemText = '', problemId = 'problem', runId = 'run-' + shortId()
     // Lean formalization records, keyed by object id. v4 has no session-log projection, so this
@@ -334,8 +344,62 @@ export function apply(ctx) {
     // escape the project tree. Keep every harmless character (incl. Chinese) and replace only
     // separators/control chars; strip leading/trailing dots/dashes so the name is never '.'/'..'.
     let warnedNoPolicy = false
+let warnedDeferFormalTodo = false   // F-6: name a swallowed deferForFormal failure once, WITH its consequence
+let warnedIndexRebuild = false   // F-6: name a swallowed settleLeanJob failure once, WITH its consequence
+let warnedCompaction = false   // F-6: name a swallowed realCompact failure once, WITH its consequence
+let warnedWriteFormalTodo = false   // F-6 (1/4): name a swallowed verify-conclusion write once, WITH its consequence
+let warnedContextProbe = false   // F-6 (:786): name a failed build-context comparison once (unknown != unchanged)
+let warnedPaperWrite = false   // G3: name a paper whose required artifact is missing after finalize (once)
+let warnedMkdir = false   // F-4c: name a failed mkdir ONCE (the deferred/distorted-diagnosis fix)
+let warnedFenceDrift = false   // F-5: name a resolved fence root that is NOT this session workspace (once)
+let warnedCurrentProject = false   // F-6: name a failed `.current` marker write once, WITH its consequence
     function warnNoPolicyOnce(){ if(!warnedNoPolicy){ warnedNoPolicy=true; console.error('vibe-math-v4: sandboxPolicy unavailable; writes go out with no explicit policy') } }
-    function getPolicy(){ const sp=sandboxPolicyOf(); if(!sp){ warnNoPolicyOnce(); return undefined } try { if(rootAgent&&rootAgent.session) return sp.resolve({session:rootAgent.session}) } catch(e){ warnNoPolicyOnce() } try { const p=sp.resolve({}); if(!warnedNoPolicy){ warnedNoPolicy=true; console.error('vibe-math-v4: falling back to sandboxPolicy.resolve({}) — the fence root is the host-configured workspace, not necessarily this session cwd') } return p } catch(e){ warnNoPolicyOnce() } return undefined }
+    function getPolicy(){ const sp=sandboxPolicyOf(); if(!sp){ warnNoPolicyOnce(); return undefined } try { if(rootAgent&&rootAgent.session){ const p=sp.resolve({session:rootAgent.session}); fenceRootDriftNote(p); return p } } catch(e){ warnNoPolicyOnce() } try { const p=sp.resolve({}); if(!warnedNoPolicy){ warnedNoPolicy=true; console.error('vibe-math-v4: falling back to sandboxPolicy.resolve({}) — the fence root is the host-configured workspace, not necessarily this session cwd') } return p } catch(e){ warnNoPolicyOnce() } return undefined }
+    /**
+     * F-5 (R9 ruling): the SESSION-scoped policy can resolve to a fence root that does not CONTAIN
+     * this session workspace - the host silently widened or re-homed the write fence. Shape mirrored
+     * from v3 (policyRootOf / warnFenceDriftOnce / checkFenceRoot returning p), with the conservative
+     * predicate the probe requires:
+     *   - containment, never equality: an ANCESTOR root is a legitimate configuration, so equality
+     *     alone would report normal setups as drift (once per session);
+     *   - an array of roots (list-style fences) => accept when the workspace is inside ANY element;
+     *   - no root field / non-string / an object shape we cannot interpret (e.g. {allow,deny}) =>
+     *     NO-OP: today's behaviour. The live probe could not read the real host resolve() shape (no
+     *     service is reachable from a plugin row in this sandbox), so we never guess - the no-op path
+     *     is asserted positively in tests instead;
+     *   - the `resolve({})` fallback is NEVER compared (it already has its own named warning and its
+     *     root is by definition not this session cwd => comparing it could only add noise);
+     *   - normalisation: separators -> "/", trailing slashes stripped, case-folded ONLY on win32 (on a
+     *     case-sensitive host folding would hide a real drift = a false negative).
+     * Zero behaviour change: no refusal, and getPolicy() still returns the resolved policy.
+     */
+    function policyRootCandidatesOf(p){
+      try {
+        if(!p || typeof p !== 'object') return []
+        let pick
+        if(p.workspaceRoot !== undefined) pick = p.workspaceRoot
+        else if(p.root !== undefined) pick = p.root
+        else if(p.cwd !== undefined) pick = p.cwd
+        else if(p.config && p.config.workspaceRoot !== undefined) pick = p.config.workspaceRoot
+        if(Array.isArray(pick)) return pick.filter(x => typeof x === 'string' && x)
+        return (typeof pick === 'string' && pick) ? [pick] : []
+      } catch(e) { return [] }
+    }
+    function fenceRootDriftNote(p){
+      try {
+        const cands = policyRootCandidatesOf(p)
+        if(!cands.length) return   // no comparable root => documented NO-OP (asserted in tests)
+        const norm = (x) => { let v = String(x).replace(/\\/g, '/'); if(v.length > 1) v = v.replace(/\/+$/, ''); return process.platform === 'win32' ? v.toLowerCase() : v }
+        const session = norm(workspaceRoot())
+        if(!session || session === '.') return
+        const contained = cands.some((c) => { const r = norm(c); return !!r && (session === r || session.indexOf(r + '/') === 0) })
+        if(contained) return
+        if(!warnedFenceDrift){
+          warnedFenceDrift = true
+          console.error('vibe-math-v4: sandbox fence root does not CONTAIN this session workspace (resolved="' + cands.join('", "') + '", session="' + workspaceRoot() + '") - writes may be fenced away from the session workspace; boundary: a policy exposing no interpretable root field cannot be compared')
+        }
+      } catch(e) { /* a diagnostic must never break policy resolution */ }
+    }
     function psQuote(p){ return "'"+String(p).replace(/'/g,"''")+"'" }
     /** POSIX 单引号引用：把 ' 换成 '\'' 以安全嵌入任意路径。 */
     function shQuote(p){ return "'"+String(p).replace(/'/g,"'\\''")+"'" }
@@ -435,12 +499,36 @@ export function apply(ctx) {
       // project tree, NOT inside it: cross-project reuse is the whole point (spec §3). It is
       // created here so the first `lean_archive kind='def'` never has to invent its parent.
       const globalDirs=['Formal/Lib','Formal/Proved']
-      return await runShell(mkdirCmd([vibeRoot()+'/Projects'].concat(dirs.map(d=>base+'/'+d)).concat(globalDirs.map(d=>vibeRoot()+'/'+d))))
+      const res = await runShell(mkdirCmd([vibeRoot()+'/Projects'].concat(dirs.map(d=>base+'/'+d)).concat(globalDirs.map(d=>vibeRoot()+'/'+d))))
+      // F-4c: ensureDirs() returns the shell result and never throws, so a failed mkdir used to surface only
+      // later and as a DISTORTED diagnosis ('write failed' instead of 'mkdir failed, and where'). Name it here,
+      // once, through the same channel as warnNoPolicyOnce() (deferred/distorted diagnosis -> named warning).
+      try {
+        const _code = res && (res.exitCode !== undefined ? res.exitCode : res.code)
+        if (_code !== undefined && Number(_code) !== 0 && !warnedMkdir) {
+          warnedMkdir = true
+          console.error('vibe-math-v4: ensureDirs: mkdir failed (exit ' + _code + ') under ' + vibeRoot() + ' - later writes into a missing directory will fail; check the shell/policy')
+        }
+      } catch(e) { /* best effort: the warning must never break ensureDirs */ }
+      return res
     }
     async function readTextAbs(path){ try { const t=await fs.resolve(path); const s=await fs.stat(t); if(s===undefined) return undefined; return await fs.readText(t) } catch(e){ return undefined } }
     async function writeTextAbs(path,content){ try { const t=await fs.resolve(path); await fs.writeText(t,content,undefined,undefined,getPolicy()); return true } catch(e){ return false } }
     async function readCurrentProject(){ try { const t=await readTextAbs(vibeRoot()+'/.current'); if(t) return String(t).trim() } catch(e){} return currentProject }
-    async function writeCurrentProject(){ try { await writeTextAbs(vibeRoot()+'/.current', currentProject) } catch(e){} }
+    // F-6 boundaries MEASURED on this revision (recorded, not fixed here - both would need a readText
+// failure signal and therefore touch as many callers as writeTextAbs, which the lead deferred):
+//   - readCurrentProject(): a failed READ is swallowed inside readTextAbs (:514), so this function
+//     cannot tell "read failed" from "no marker"; its silent fallback stays.
+//   - assertWritable()'s outer `catch(e){}` (:491) CANNOT FIRE, because readText (:438) has already
+//     erased the failure: it swallows every error and returns undefined, so a present-but-unreadable
+//     file is treated as MISSING and the overwrite guard silently allows the write. The silent skip
+//     therefore happens ONE LAYER UP, not in the catch. Surfacing it means making readText REPORT
+//     failure - the same breadth as :515 writeTextAbs, which the lead deferred.
+//   - writeCurrentProject()'s own `catch` branch is likewise DEFENSIVE-ONLY: writeTextAbs never throws
+//     (it catches internally and returns a boolean), so the `ok===false` branch is the only reachable
+//     one; the exception path is kept as belt-and-braces and is recorded as unreachable (measured: a
+//     mutant that removes it cannot redden the N18 assertion, so it ships without a family entry).
+async function writeCurrentProject(){ try { const ok=await writeTextAbs(vibeRoot()+'/.current', currentProject); if(ok===false && !warnedCurrentProject){ warnedCurrentProject=true; console.error('vibe-math-v4: the current-project marker was NOT persisted - the next session may load the previous project') } } catch(e){ if(!warnedCurrentProject){ warnedCurrentProject=true; console.error('vibe-math-v4: the current-project marker was NOT persisted - the next session may load the previous project') } } }
 
     // ================= Lean formal verification ==============================
     // Contract: docs/formal-verification.md (shared by v2/v3/v4/v5).
@@ -758,10 +846,16 @@ export function apply(ctx) {
       // the job was in flight, RECORD that the current context differs (the compile itself was done
       // with the recorded context, which is what the job id attests to).
       let contextChanged=false
-      try { const nowCtx=await leanBuildContext()
+      try {
+        const nowCtx=await leanBuildContext()
         contextChanged=JSON.stringify([nowCtx.engine,nowCtx.argv,nowCtx.searchPaths])!==JSON.stringify([(job.build||{}).engine,(job.build||{}).argv,(job.build||{}).searchPaths])
-        if(contextChanged) logActivity('formal','作业 '+job.jobId+' 的结果属于记录中的构建上下文（engine/argv/search-paths 已被改动，未影响该次编译的结论）')
-      } catch(e){ /* best effort */ }
+      } catch(e){
+        // F-6 (:786): a comparison that could NOT run must not be recorded as "unchanged" -
+        // unknown != unchanged. Record null AND name it once, with the consequence.
+        contextChanged=null
+        if(!warnedContextProbe){ warnedContextProbe=true; console.error('vibe-math-v4: settleLeanJob: the build-context comparison could not be performed - contextChanged=false is NOT a measurement (recorded as null/unknown)') }
+      }
+      if(contextChanged===true) logActivity('formal','作业 '+job.jobId+' 的结果属于记录中的构建上下文（engine/argv/search-paths 已被改动，未影响该次编译的结论）')
       const ok=!!(run&&run.ok)&&hashMatch
       const timedOut=!!(run&&run.timedOut)
       const state=ok?'settled':(timedOut?'timeout':'failed')
@@ -796,7 +890,7 @@ export function apply(ctx) {
         }
       }
       await writeLeanJob(settled)
-      try { await rebuildLeanLibIndexes() } catch(e){ /* best-effort */ }
+      try { await rebuildLeanLibIndexes() } catch(e){ if(!warnedIndexRebuild){ warnedIndexRebuild=true; console.error('vibe-math-v4: settleLeanJob: rebuildLeanLibIndexes failed - the library indexes are STALE; residents may reuse a stale index until the next successful rebuild') } /* best-effort */ }
       pushLeanNotice(settled,Object.assign({},run,{ok,hashMatch}))
       return settled
     }
@@ -851,6 +945,9 @@ export function apply(ctx) {
      * §2.6 crash/restart recovery: scan `<project>/Formal/Jobs/*.json` AFTER the project dirs exist.
      * It NEVER mints a `passed` anything unless the job record itself says exitCode===0 AND the file
      * on disk still hashes to the enqueued content.
+ * INVARIANT (F2): after redriving, the recovery DRAINS the queue itself (`await runLeanQueue()`) and only
+ * then arms one heartbeat - it must NOT rely on an already-armed heartbeat. Deleting that drain silently
+ * restores the cold-recovery stall (see the §20 tripwire in tests/formal-verify-v4.test.mjs).
      */
     async function recoverLeanJobs(opts){
       const o=opts||{}
@@ -903,7 +1000,7 @@ export function apply(ctx) {
           }
         }
       }
-      if(queued+redriven+stale+completed){ await writeLeanLibIndexesSafe() ; if(leanQueue.length) armHeartbeat() }
+      if(queued+redriven+stale+completed){ await writeLeanLibIndexesSafe() ; if(leanQueue.length){ await runLeanQueue() ; armHeartbeat() } }   // cold-recovery drain: the heartbeat alone did not drain while the run was not yet live (verified by the §20 tripwire)
       return {scanned:(files||[]).length,queued,redriven,stale,completed}
     }
     async function writeLeanLibIndexesSafe(){ try { await rebuildLeanLibIndexes() } catch(e){ /* best-effort */ } }
@@ -1182,15 +1279,23 @@ export function apply(ctx) {
         return rows
       }
       const libRows=await scan(formalLibRoot(),'Formal/Lib','def')
-      await writeTextAbs(formalLibRoot()+'/Index.md',['# 可复用 Lean 定义库（跨项目）｜'+currentProject,'',
+      const _idxLibOk = await writeTextAbs(formalLibRoot()+'/Index.md',['# 可复用 Lean 定义库（跨项目）｜'+currentProject,'',
         '> 写新定义之前先查这里：能复用就不要重新定义。复用方式：`import Formal.Lib.<名称>`（模块根 = VibeMath 根，框架已加入编译搜索路径），或用 vibe_v4_lean_read 取原文逐字复制。','',
         '| 名称 | 文件 | 类别 | 依赖 | 摘要 |','|---|---|---|---|---|']
         .concat(libRows.length?libRows:['| （暂无） | | | | |']).join('\n')+'\n')
       const provedRows=await scan(formalProvedRoot(),'Formal/Proved','lemma')
-      await writeTextAbs(formalProvedRoot()+'/Index.md',['# 已成立的 Lean 命题 / 引理（机器已核对，可跨项目复用）｜'+currentProject,'',
+      const _idxProvedOk = await writeTextAbs(formalProvedRoot()+'/Index.md',['# 已成立的 Lean 命题 / 引理（机器已核对，可跨项目复用）｜'+currentProject,'',
         '> 这些文件是通过内核检查的引理，可直接 `import Formal.Proved.<名称>` 复用（模块根 = VibeMath 根）。','',
         '| 名称 | 文件 | 类别 | 依赖 | 陈述 |','|---|---|---|---|---|']
         .concat(provedRows.length?provedRows:['| （暂无） | | | | |']).join('\n')+'\n')
+      // ③ MEASURED: these two writes ignored `writeTextAbs`'s boolean (it swallows and returns
+      // false), so a failed index write looked like success - and that silence propagated to ALL SIX
+      // callers (settleLeanJob, writeLeanLibIndexesSafe, the three leanArchive paths, the lean_lib
+      // tool). Naming it HERE, once, covers every caller (same shape as ensureDirs/warnedMkdir).
+      if((_idxLibOk === false || _idxProvedOk === false) && !warnedIndexRebuild){
+        warnedIndexRebuild = true
+        console.error('vibe-math-v4: rebuildLeanLibIndexes: the Lean library index could NOT be written (lib=' + _idxLibOk + ' proved=' + _idxProvedOk + ') - the index is STALE until the next successful rebuild, so reuse lookups may miss entries')
+      }
       await writeFormalIndex()
       await writeFormalTodo()
       return {lib:libRows.length,proved:provedRows.length,objects:Object.keys(formalRecords()).length}
@@ -1550,23 +1655,24 @@ export function apply(ctx) {
     async function inboxText(rId){ const mb=mailboxes.get(rId)||[]; if(mb.length===0) return '  (no new messages)\n'; return mb.map(m=>'  ['+senderLabel(m.from)+'] '+m.content).join('\n')+'\n' }
     function residentLibraries(){
       const base=frameworkRoot()
-      return '你的资料库根目录：'+base+'/\n'
+      return '你的资料库根目录（**绝对前缀**，下面每条都已带库根）：'+base+'/\n'
         +'  Progress/<你>/progress.md —— 你的研究日志（叙述，可追加。主要内容是尝试过的各方法、路线、历程、进度，当前研究进展/进度、将来的计划与打算，及各路线、过程中遇到的障碍及其原因，对各路线、方法的看法、可行性评估，自己研究过程中的一些有价值看法、感想、猜想、理解。以及其它各种你认为有价值的值得记录的事物、经验、方法/想法、创新等都可进行记录）。\n'
         +'  Propos/<你>/<id>.md —— 你的命题/引理。格式：\n'
         +'    - ID: p-<id>; - 状态: 未定论; - 概率: <0-1>; - 价值程度: <0-1>; - 动机用途计划: <为何重要/打算怎么用>\n'
         +'    然后 ## 陈述 <陈述>；## 证明尝试；## 证伪尝试。\n'
         +'  Methods/<你>/<id>.md —— 你的理论/方法/工具。格式：- ID: m-<id>; - 状态: 经验; - 可信断言: []; - 价值程度: <0-1>; - 动机用途计划: ...；然后 ## 核心内容；## 定义与记号；## 应用记录；## 改进历史。\n'
         +'  Subproblems/<你>/<id>.md —— 你的子问题。格式：- ID: s-<id>; - 状态: 求解中; - 价值程度: <0-1>; - 动机用途计划: ...；然后 ## 陈述；## 进度。\n'
+        +'  ⚠ 你的文件工具（读/写）按**会话 cwd** 解析路径：上面列出的相对子路径都要先拼上**成员库根** '+base+'/ 再使用（例如 '+base+'/Propos/r-1/p-1.md）；计算产物同理——请用回执里的**绝对**字段 receipt.scriptAbs，或把 receipt.cwd 与 receipt.scriptPath 拼起来，不要用相对路径。\n'
     }
     function toolList(){
       return 'vibe_v4_send_message {to, content} —— 给某常驻发消息（to=all 广播）。\n'
         +'vibe_v4_meeting {agenda} —— 发起/参与会议（框架会把各常驻的实际 input 转给其他人，让大家看到并讨论/辩论）。\n'
         +'vibe_v4_propose_task/claim_task/task_done/list_tasks —— 共享任务板（提议/认领/完成/查看；任务板是你们协调分工的载体）。\n'
-        +'vibe_v4_publish_progress/record_proposition/record_method/record_subproblem —— 便捷记录器（可选；推荐直接用 fs 写自己的文件）。\n'
+        +'vibe_v4_publish_progress/record_proposition/record_method/record_subproblem —— 便捷记录器（可选；推荐直接用 fs 写自己的文件，路径必须带库根 ）。\n'
         +'vibe_v4_read_progress {id} —— 只读某常驻的进展。\n'
         +'vibe_v4_list_residents / vibe_v4_list_tasks —— 查看团队组成 / 开放任务。\n'
         +'vibe_v4_report_context {pct} —— 上报上下文占比（框架据此压缩你的上下文）。\n'
-        +'fs (read/write/list) —— 读取任意文件；写入你自己的文件（推荐直接用 fs 直接写自己的 md）。\n'
+        +'fs (read/write/list) —— 读取任意文件；写入你自己的文件（推荐直接用 fs 直接写自己的 md；**路径必须带库根 ，否则会落到别处**）。\n'
     }
     // A shared, complete context block so a resident always knows the situation: mission,
     // work model, what it can do, which files it owns (+ formats), what others' files are,
@@ -1582,14 +1688,14 @@ export function apply(ctx) {
       s.push('### 工作模式（会发生什么）')
       s.push('1. 每人有一份持久、全组可见的专属资料库（见下）。')
       s.push('2. 你们自由发消息、开会；**会议会把每个人实际说的话（input）转给其他人**，让你看得到、能回复、能讨论、能辩论。')
-      s.push('3. 你独立研究，并**直接用 fs 写入你自己的文件**（按格式），供全组阅读。')
+      s.push('3. 你独立研究，并**直接用 fs 写入你自己的文件**（**路径必须带库根 **，按格式），供全组阅读。')
       s.push('4. 任何"已确立"的东西须**全组一致**验证（全真或全假）才作数；否则只是带概率的工作估计。')
       s.push('5. 只有**全组在会议上一致认为原问题已解决**，run 才停止。')
       s.push('')
       s.push('### 你负责的文件（你只写自己的；但可读任何人的）')
       s.push(residentLibraries())
       s.push('其他人把结论/进展写进他们的目录，你就能读到。**你应主动读别人的库**，对齐事实、彼此衔接、避免重复劳动。')
-      if(level!=='full'){ s.push('（格式见你最初的说明；直接用 fs 写自己的文件即可。）') }
+      if(level!=='full'){ s.push('（格式见你最初的说明；直接用 fs 写自己的文件即可，**路径必须带库根 **。）') }
       s.push('')
       s.push('### 可用工具')
       s.push(toolList())
@@ -1628,7 +1734,7 @@ export function apply(ctx) {
         +(r.direction?('\n\n你被建议的初始方向（可自行调整/细化）：\n'+r.direction+'\n'):'')
         +'## 这是你的第一轮：独立头脑风暴\n'
         +'独立地想清楚：你对这个问题的洞察 / 解决方向 / 关键子问题 / 可能的引理 / 粗略计划。你还未见到其他人，先独立产出。\n'
-        +'把有价值的产物**直接用 fs 写进你自己的文件**（按上面格式），并在 summary 里概述你的切入方向与初步结论（标注哪些是猜想、哪些凭你已确证）。\n'
+        +'把有价值的产物**直接用 fs 写进你自己的文件**（**路径带库根 **，按上面格式），并在 summary 里概述你的切入方向与初步结论（标注哪些是猜想、哪些凭你已确证）。\n'
         +'Reply with ONLY a JSON object:\n'
         +'{"summary":"<your insight / direction / rough plan, one tight paragraph>","solved":false}'
     }
@@ -1640,7 +1746,7 @@ export function apply(ctx) {
       await refreshMathAvailability()
       const mathAvail=mathAvailabilityBlock()
       return (params.residentPersona?params.residentPersona+'\n':'')
-        +'Resident researcher '+r.rId+' — 第 '+r.rounds+' 轮。一切由你和团队讨论决定。动手前先**读别人的库**对齐事实、避免重复；把新进展/结论**直接用 fs 写进你自己的文件**；想对团队说的话放 "input"（会转给其他常驻）。\n'
+        +'Resident researcher '+r.rId+' — 第 '+r.rounds+' 轮。一切由你和团队讨论决定。动手前先**读别人的库**对齐事实、避免重复；把新进展/结论**直接用 fs 写进你自己的文件**（**路径带库根 **）；想对团队说的话放 "input"（会转给其他常驻）。\n'
         +'\n团队成员：\n'+banner()+'\n'
         +'New items:\n'+ (await inboxText(r.rId)) +'\n'
         // Settled background compiles are announced ONCE, in the next prompt constructed (spec §2.4):
@@ -1659,8 +1765,8 @@ export function apply(ctx) {
       const prior=Object.entries(st.inputs).filter(([k])=>k!==r.rId).map(([k,iv])=>'  ['+k+'] '+String(iv.input||iv.summary||'')).join('\n')
       return (params.residentPersona?params.residentPersona+'\n':'')
         +'Resident '+r.rId+' — 团队会议进行中。 A meeting is in progress (agenda: '+st.agenda+').'
-        +'\n这是一场真实讨论：下面已有人发言（转给你），请先看，然后**加入讨论/补充/反驳/表决**。'
-        +(prior?('\n\n### 已有发言（他人 input，已转发给你）\n'+prior):'\n（目前还没人发言，你先说。）')
+        +(prior?'\n这是一场真实讨论：下面已有人发言（转给你），请先看，然后**加入讨论/补充/反驳/表决**。':'\n本轮是**并行独立发言**：同轮内不会有人先发言给你（唤醒是并行的），你的 input 会在**下一次唤醒/下一轮**转给其他人；请先给出你自己的判断。')
+        +(prior?('\n\n### 已有发言（他人 input，已转发给你）\n'+prior):'')
         +'\n\n你可以：提议任务（propose_task）、认领开放任务（claim_task）、提议验证对象（propose_verify）、或对"原问题是否已解决"表决（voteSolved）。请把**你的实际发言**写进 "input"。'
         +'\n**停止表决必须是绝对票**：`voteSolved:true` 只表示你认为原问题**已解决**；只要有一名在册常驻没投 `true`（投 false、弃权、或漏写这个字段），run 就**不会**停止。不确定就投 false。'        +'\nReply with ONLY a JSON object:\n'
         +'{"input":"<your real contribution to this discussion>","propose_task":"<task title or null>","task_desc":"...","claim_task":"<task id or null>","propose_verify":"<id or null>","voteSolved":true}'
@@ -1673,7 +1779,7 @@ export function apply(ctx) {
       const others=Object.entries(src).map(([k,v])=>'- '+k+': 正确概率 '+String(v.prob!=null?Number(v.prob).toFixed(2):0.5)+' → '+v.reason).join('\n')
       const L=[]
       L.push((params.residentPersona?params.residentPersona+'\n':'')
-        +'Resident '+r.rId+' — 团队验证。 The group is verifying object '+vs.targetId+'（'+targetTypeWord(vs.targetType)+'，提出者 '+vs.targetOwner+'）。\n'
+        +'Resident '+r.rId+' — 团队验证。 The group is verifying object '+vs.targetId+'（'+targetTypeWord(vs.targetType)+(String(vs.targetOwner||'').trim()?('，提出者 '+vs.targetOwner):'')+'）。\n'
         +'请给出你对「该对象为真」的**正确概率 `verdict`**，仅一个 0–1 数值：**1 = 绝对为真，0 = 绝对为假，0.5 = 完全不确定，其余为介于其间的程度**（不要给 TRUE/FALSE，就给一个数值）。\n'
         // ── THE VOTE CONTRACT (why the example below is 1 and not 0.9) ──────────────────────────
         // Only an EXACT 1 or 0 is a vote; anything strictly between is the model's honest
@@ -1684,7 +1790,8 @@ export function apply(ctx) {
         +'**投票契约**：只有**恰好 1**（你认为是**绝对**为真）和**恰好 0**（你认为是**绝对**为假）算表决；**严格介于 0 与 1 之间**（例如 0.9、0.95、0.5）是**弃权**——它是你对"该对象为真"的**概率估计**，不是你的一票。\n'
         +'  · 有把握认为它为真就投 **1**；不要为了"留一点余地"投 0.9——那会让全组永远无法定论。\n'
         +'  · 弃权会被如实统计：本轮没有人全票 → 对象**不会**停止验证，而是把全组的**平均概率**写回它在库中的卡片（`- 概率:`），带概率继续留在库里。\n'
-        +'  · 弃权的两种合法用途：① 你确实不确定（用 0.5 附近的值表达）；② 已归档的机器检查证明与命题原文不一致、你**不能**用 0 表达"命题为假"（此时请用 `formal` 回执的 `decision:"defect"` 报告偏差，见下方形式化段）。\n'
+        +'  · 弃权的合法用途：你确实不确定（用 0.5 附近的值表达）。\n'
+        +(formalOn()?('  · 另一种弃权：已归档的机器检查证明与命题原文不一致、你**不能**用 0 表达"命题为假"（此时请用 `formal` 回执的 `decision:"defect"` 报告偏差）。\n'):'')
         +'判定规则：**仅当全体在册常驻都恰好给 1（都认为是真）、或都恰好给 0（都认为是假）**，才按「真/假」写入 Verified/ 并回写来源卡的「已验证·真/假」；否则**只按概率数值（一种程度）保留在库中**，附全组平均正确概率，不写成真/假。\n'
         +'请给出你**诚实独立的判断**'
         +(vs.stage==='debate'?'，并参考他人意见：\n':'。\n')
@@ -1898,10 +2005,23 @@ export function apply(ctx) {
     function byChild(childId){ for(const [,r] of residents){ if(r.childId===childId) return r } return undefined }
 
     // ---- artifact writers (resident-facing) ----
-    async function publishProgress(rId,content){ if(!rId||!residents.has(rId)) return {ok:false,message:'no such resident'} ; const rel='Progress/'+rId+'/progress.md'; const prev=(await readText(rel))||''; await writeText(rel, prev+'\n### '+fmtTime()+'｜'+rId+'\n'+String(content||'')+'\n'); return {ok:true} }
-    async function recordProposition(rId,o){ if(!rId||!residents.has(rId)) return {ok:false,message:'no such resident'} ; const id=o.id?idSafe(o.id):('p-'+shortId()); const lines=['# 命题｜'+(o.title||id),'- 标题: '+(o.title||id),'- ID: '+id,'- 类型: 命题','- 状态: 未定论','- 概率: '+cl(o.prob!=null?o.prob:0.5),'- 价值程度: '+cl(o.value!=null?o.value:0.5),'- 动机用途计划: '+(o.motivation||''),'- 依赖: []','','## 陈述',String(o.statement||''),'','## 证明尝试','','## 证伪尝试','']; await writeText('Propos/'+rId+'/'+id+'.md',lines.join('\n')); logActivity('record',rId+' 命题 '+id); bumpArtifacts(); return {ok:true,id,file:'Propos/'+rId+'/'+id+'.md'} }
-    async function recordMethod(rId,o){ if(!rId||!residents.has(rId)) return {ok:false,message:'no such resident'} ; const id=o.id?idSafe(o.id):('m-'+shortId()); const lines=['# 方法｜'+(o.title||id),'- 标题: '+(o.title||id),'- ID: '+id,'- 类型: '+(o.type||'方法'),'- 状态: 经验','- 可信断言: []','- 价值程度: '+cl(o.value!=null?o.value:0.5),'- 动机用途计划: '+(o.motivation||''),'','## 核心内容',String(o.content||''),'','## 定义与记号',String(o.notation||''),'','## 应用记录','## 改进历史','']; await writeText('Methods/'+rId+'/'+id+'.md',lines.join('\n')); logActivity('record',rId+' 方法 '+id); bumpArtifacts(); return {ok:true,id,file:'Methods/'+rId+'/'+id+'.md'} }
-    async function recordSubproblem(rId,o){ if(!rId||!residents.has(rId)) return {ok:false,message:'no such resident'} ; const id=o.id?idSafe(o.id):('s-'+shortId()); const lines=['# 子问题｜'+(o.title||id),'- 标题: '+(o.title||id),'- ID: '+id,'- 状态: 求解中','- 价值程度: '+cl(o.value!=null?o.value:0.5),'- 动机用途计划: '+(o.motivation||''),'- 依赖: []','','## 陈述',String(o.statement||''),'','## 进度','']; await writeText('Subproblems/'+rId+'/'+id+'.md',lines.join('\n')); logActivity('record',rId+' 子问题 '+id); bumpArtifacts(); return {ok:true,id,file:'Subproblems/'+rId+'/'+id+'.md'} }
+    /** Cross-preset audit D1: a member-facing tool must never answer with a bare `no such resident`.
+     *  "not started yet" / "wrong id" / "already dismissed" are DIFFERENT problems, so the answer
+     *  carries a code, the LIVE roster state and an actionable next step (v5's `memberDiagnosis`). */
+    function noSuchResident(id, tool){
+      const ids=[...residents.keys()]
+      const active=[...residents.values()].filter(r=>r&&r.childId).length
+      const nextTool=tool||(running?'vibe_v4_list_members':'vibe_v4_start')
+      return {ok:false,code:'V4_NO_SUCH_RESIDENT',
+        message:'no such resident: '+String(id||'(none)')+(running?('（当前在册 '+residents.size+' 名，active '+active+' 名）'):'（本次运行尚未 start）'),
+        status:{running:!!running,autoDone:!!autoDone,residentCount:residents.size,activeCount:active,ids:ids},
+        next:{tool:nextTool,
+          hint:running?'核对有效 id（新建成员可能仍在 spawn 中）；列表用 vibe_v4_list_members':'先 vibe_v4_start 或 vibe_v4_add_member，再调用 '+nextTool}}
+    }
+    async function publishProgress(rId,content){ if(!rId||!residents.has(rId)) return noSuchResident(rId) ; const rel='Progress/'+rId+'/progress.md'; const prev=(await readText(rel))||''; await writeText(rel, prev+'\n### '+fmtTime()+'｜'+rId+'\n'+String(content||'')+'\n'); return {ok:true} }
+    async function recordProposition(rId,o){ if(!rId||!residents.has(rId)) return noSuchResident(rId) ; const id=o.id?idSafe(o.id):('p-'+shortId()); const lines=['# 命题｜'+(o.title||id),'- 标题: '+(o.title||id),'- ID: '+id,'- 类型: 命题','- 状态: 未定论','- 概率: '+cl(o.prob!=null?o.prob:0.5),'- 价值程度: '+cl(o.value!=null?o.value:0.5),'- 动机用途计划: '+(o.motivation||''),'- 依赖: []','','## 陈述',String(o.statement||''),'','## 证明尝试','','## 证伪尝试','']; await writeText('Propos/'+rId+'/'+id+'.md',lines.join('\n')); logActivity('record',rId+' 命题 '+id); bumpArtifacts(); return {ok:true,id,file:'Propos/'+rId+'/'+id+'.md'} }
+    async function recordMethod(rId,o){ if(!rId||!residents.has(rId)) return noSuchResident(rId) ; const id=o.id?idSafe(o.id):('m-'+shortId()); const lines=['# 方法｜'+(o.title||id),'- 标题: '+(o.title||id),'- ID: '+id,'- 类型: '+(o.type||'方法'),'- 状态: 经验','- 可信断言: []','- 价值程度: '+cl(o.value!=null?o.value:0.5),'- 动机用途计划: '+(o.motivation||''),'','## 核心内容',String(o.content||''),'','## 定义与记号',String(o.notation||''),'','## 应用记录','## 改进历史','']; await writeText('Methods/'+rId+'/'+id+'.md',lines.join('\n')); logActivity('record',rId+' 方法 '+id); bumpArtifacts(); return {ok:true,id,file:'Methods/'+rId+'/'+id+'.md'} }
+    async function recordSubproblem(rId,o){ if(!rId||!residents.has(rId)) return noSuchResident(rId) ; const id=o.id?idSafe(o.id):('s-'+shortId()); const lines=['# 子问题｜'+(o.title||id),'- 标题: '+(o.title||id),'- ID: '+id,'- 状态: 求解中','- 价值程度: '+cl(o.value!=null?o.value:0.5),'- 动机用途计划: '+(o.motivation||''),'- 依赖: []','','## 陈述',String(o.statement||''),'','## 进度','']; await writeText('Subproblems/'+rId+'/'+id+'.md',lines.join('\n')); logActivity('record',rId+' 子问题 '+id); bumpArtifacts(); return {ok:true,id,file:'Subproblems/'+rId+'/'+id+'.md'} }
     // ── auto-sync meeting: every `meetingKeepEvery` NEW artifacts, convene a coordination meeting ──
     //
     // The counting basis is the RESIDENTS' card libraries themselves (Propos/Methods/Subproblems),
@@ -2015,7 +2135,7 @@ export function apply(ctx) {
 
     // ---- messaging ----
     async function postMessage(from,to,content){
-      const r=residents.get(to); if(!r) return {ok:false,message:'no such resident'}
+      const r=residents.get(to); if(!r) return noSuchResident(to,'vibe_v4_send_message')
       if(!busy.has(to)){
         currentResident=r.rId
         const ok=await wakeResident(r, (await normalPrompt(r))+'\n\n[NEW MESSAGE from '+from+']\n'+content,'normal')
@@ -2075,7 +2195,7 @@ export function apply(ctx) {
       // who sees no one else's contribution"; a real discussion lets each member lead sometimes.
       const rot=Math.floor(Math.random()*Math.max(1,ids.length))
       const order=ids.slice(rot).concat(ids.slice(0,rot))
-      meetingState={id:'mt-'+shortId(),agenda,type:type||'general',targetId:targetId||null,round:0,asked:[],inputs:{},transcript:[],order,at:now(),lastInputAt:now()}
+      meetingState={id:'mt-'+shortId(),agenda,type:type||'general',targetId:targetId||null,round:0,asked:[],inputs:{},transcript:[],order,at:now(),lastInputAt:now(),rosterSnapshot:order.slice(),rosterVersion}
       markProgress();
       logActivity('meeting','start: '+agenda); await saveAll(); await scheduleNext(); return {ok:true,id:meetingState.id}
     }
@@ -2090,7 +2210,7 @@ export function apply(ctx) {
         meetingState=null; wakeKind.clear(); logActivity('meeting','abandoned (stuck: no resident spoke)')
         await saveAll(); await scheduleNext(); return
       }
-      const ids=Array.from(residents.keys()); const allSpoke=ids.every(id=>st.inputs[id]!==undefined)
+      const ids=(st.rosterSnapshot||Array.from(residents.keys())).slice(); const allSpoke=ids.every(id=>st.inputs[id]!==undefined)
       if(allSpoke){ await finalizeMeeting(); return }
       // only wake IDLE un-spoken residents (rotated order); in-flight ones re-trigger this on end.
       // NOTE: we deliberately do NOT flush mailboxes here — drafting an un-spoken resident into a normal
@@ -2109,7 +2229,7 @@ export function apply(ctx) {
       let doSchedule=false
       try {
         const st=meetingState
-        const ids=Array.from(residents.keys()); const allSpoke=ids.length>0 && ids.every(id=>st.inputs[id]!==undefined)
+        const ids=(st.rosterSnapshot||Array.from(residents.keys())).slice(); const allSpoke=ids.length>0 && ids.every(id=>st.inputs[id]!==undefined)
         const lines=['# 会议 '+st.id+'｜'+fmtTime(),'','**议程**：'+st.agenda,'']
         for(const [id,iv] of Object.entries(st.inputs)){ lines.push('### '+id); lines.push(iv.input||''); lines.push('') }
         await writeText('Shared/meetings/'+st.id+'.md', lines.join('\n'))
@@ -2178,7 +2298,7 @@ export function apply(ctx) {
           await saveAll(); await scheduleNext(); return
         }
       }
-      verifyState={targetId:pv.targetId,targetType:pv.targetType,targetOwner:pv.proposer||'',stage:'independent',round:0,asked:[],verdicts:{},history:{},transcript:[],at:now(),lastVerdictAt:now()}
+      verifyState={targetId:pv.targetId,targetType:pv.targetType,targetOwner:pv.proposer||'',stage:'independent',round:0,asked:[],verdicts:{},history:{},transcript:[],at:now(),lastVerdictAt:now(),rosterSnapshot:Array.from(residents.keys()),rosterVersion}
       markProgress();
       logActivity('verify','debate begin: '+pv.targetId+' ('+pv.targetType+')'); await saveAll(); await scheduleNext()
     }
@@ -2193,7 +2313,7 @@ export function apply(ctx) {
         verifyState=null; wakeKind.clear(); logActivity('verify',vs.targetId+' abandoned (stuck: no unanimous verdict reachable)')
         await saveAll(); await scheduleNext(); return
       }
-      const ids=Array.from(residents.keys()); const allVoted=ids.every(id=>vs.verdicts[id]!==undefined)
+      const ids=(vs.rosterSnapshot||Array.from(residents.keys())).slice(); const allVoted=ids.every(id=>vs.verdicts[id]!==undefined)
       if(allVoted){ await finalizeVerify(); return }
       // NOTE: we deliberately do NOT flush mailboxes here — drafting an un-voted resident into a normal
       // mail round would delay its verdict and can starve the verify past its watchdog when the backlog
@@ -2209,9 +2329,14 @@ export function apply(ctx) {
       finalizeLock='verify'
       let doSchedule=false
       try {
-        const vs=verifyState; const expected=Array.from(residents.keys()).length
-        const allVoted = expected>0 && Object.keys(vs.verdicts).length>=expected
-        const vals=Object.values(vs.verdicts)
+    const vs=verifyState; // F1: the requirement set is the FROZEN snapshot (live map fallback) - the ONE
+    // predicate is MEMBERSHIP, exactly like the on-end path at :2247. A count-only check could be
+    // satisfied by a ballot from someone NOT in the frozen set (a member added after the freeze, or a
+    // late reply from a removed one), which would promote 真/假 while a frozen voter is still silent.
+    const ids=(vs.rosterSnapshot||Array.from(residents.keys())).slice()
+    const expected=ids.length
+    const allVoted = ids.length>0 && ids.every(id=>vs.verdicts[id]!==undefined)
+    const vals=ids.filter(id=>vs.verdicts[id]!==undefined).map(id=>vs.verdicts[id])
         // verdict is a PURE 0-1 probability; only ALL=1 (true) or ALL=0 (false) is a binary verdict.
         const allTrue = allVoted && vals.every(x=>Number(x.prob)===1)
         const allFalse = allVoted && vals.every(x=>Number(x.prob)===0)
@@ -2259,7 +2384,7 @@ export function apply(ctx) {
       if(formalOn() && formalTodos.some(t=>t.id===target)){
         formalTodos=formalTodos.filter(t=>t.id!==target)
         await saveFormal()
-        try { await writeFormalTodo(); await writeFormalIndex() } catch(e){ /* best-effort */ }
+        try { await writeFormalTodo(); await writeFormalIndex() } catch(e){ if(!warnedWriteFormalTodo){ warnedWriteFormalTodo=true; console.error('vibe-math-v4: closeVerify: writeFormalTodo/writeFormalIndex failed - the verify conclusion is NOT recorded on disk (best effort continues; it is lost on reload)') } /* best-effort */ }
       }
       logActivity('verify',target+' → Verified ('+(isTrue?'真':'假')+') by unanimous consensus'+(formalOn()?('｜形式化: '+formalStatusLine(target)):''))
       verifyState=null; wakeKind.clear(); await saveAll()
@@ -2286,7 +2411,7 @@ export function apply(ctx) {
       await rewriteSourceProb(target,mean,vs.targetOwner)
       if(!formalTodos.some(t=>t.id===target)) formalTodos.push({id:target,at:now(),why,verdict:isTrue?1:0})
       await putFormal(target,rec,formalTodos)   // single durable write of records + todo together
-      try { await writeFormalTodo(); await writeFormalIndex() } catch(e){ /* best-effort */ }
+      try { await writeFormalTodo(); await writeFormalIndex() } catch(e){ if(!warnedDeferFormalTodo){ warnedDeferFormalTodo=true; console.error('vibe-math-v4: deferForFormal: writeFormalTodo/writeFormalIndex failed - the formal-required deferral (TODO + index) is NOT persisted; the object stays unverified and this decision is lost on reload') } /* best-effort */ }
       logActivity('verify',target+' 的表决结果为 '+(isTrue?'真':'假')+'，但 **require 模式**要求先有 Lean 通过或显式阻塞记录，因此本轮**不定论**（已记入 Formal/TODO.md；原因 formal-required）')
       verifyState=null; wakeKind.clear(); await saveAll()
       // Scheduling is done by finalizeVerify (doSchedule=true) AFTER it releases finalizeLock:
@@ -2516,21 +2641,22 @@ export function apply(ctx) {
       if(!agent || !agent.session) return
       const compaction = compactionForAgent(agent)
       if(compaction===undefined) return
-      // `compactIfNeeded` is a POLICY call on the current host: it may return null without compacting
-      // and nothing records that, so a real /compact would silently do nothing. `compactNow` is the
-      // forcing verb; feature-detected so older hosts keep the policy call.
-      const force = typeof compaction.compactNow === 'function'
-      if(!force && typeof compaction.compactIfNeeded !== 'function') return
+      // F2 (user ruling): compaction is driven by the CONFIGURED THRESHOLD only. `compactIfNeeded` is the
+      // POLICY verb, so a host that also offers the FORCING verb (`compactNow`) must NOT be forced - the
+      // per-turn call is a cheap no-op below the threshold, and the core-rules re-anchor happens ONLY when
+      // the policy call reports that it actually compacted.
+      if(typeof compaction.compactIfNeeded !== 'function') return
       try {
-        const signal = makeSignal(params.activityTimeoutMs||60000)
-        const result = force ? await compaction.compactNow(agent, signal) : await compaction.compactIfNeeded(agent, 'pressure', signal)
-        if(result && (result.shadowedSeqs||[]).length>0){
+      const signal = makeSignal(params.activityTimeoutMs||60000)
+      const result = await compaction.compactIfNeeded(agent, 'pressure', signal)
+        const didCompact = !!(result && ((result.shadowedSeqs||[]).length>0 || Number(result.shadowedTokenCount||0)>0))
+        if(didCompact){
           // the resident's real session was compacted → its context is now a summary.
           // Flag needCompact so the NEXT wake re-anchors the core rules (they may have been blurred).
           r.roundsSinceCompact=0; r.needCompact=true; r.contextPct=Math.min(r.contextPct||15,25)
           logActivity('compact', r.rId+' real /compact (shadowed '+result.shadowedSeqs.length+' items, ~'+String(result.shadowedTokenCount||0)+' tokens)')
         }
-      } catch(e){ /* real compaction unavailable/failed; the soft directive already covers it */ }
+      } catch(e){ if(!warnedCompaction){ warnedCompaction=true; console.error('vibe-math-v4: realCompact: the compaction call failed - context pressure was NOT compacted; the round/flag heuristic may desync from the real context size') } /* real compaction unavailable/failed; the soft directive already covers it */ }
     }
 
     // ---- liveness / scheduling ----
@@ -2627,7 +2753,12 @@ export function apply(ctx) {
         // the top of the next pass — never in a tight loop here.
         if(!r.childId) continue
         let ok=false
-        try { ok = await wakeResident(r, await heartbeatPrompt(r), 'normal') } catch(e){ ok=false }
+        // F4 (measured then reverted): this is the ONLY heartbeatPrompt wake site in v4 - the fairness/idle
+// fill. Both the soft-compaction design and the guards T13/A1 require THIS round to be a NORMAL
+// research round when contextPct >= compactThreshold (that is where the [CONTEXT COMPACT ...]
+// self-summary directive must land). Re-kinding it as its own kind therefore breaks them, and F4's
+// premise (a distinct non-research CHECKPOINT wake) has no separate path on this revision.
+try { ok = await wakeResident(r, await heartbeatPrompt(r), 'normal') } catch(e){ ok=false }
         if(ok) started++
         await saveAll()
         if(!ok) continue             // a failed wake must NOT stop the fill; try the next idle resident
@@ -2719,7 +2850,15 @@ export function apply(ctx) {
         else if(typeof v.verdict==='string' && v.verdict.trim()!=='' && Number.isFinite(Number(v.verdict))){ p=clamp01(Number(v.verdict)) }
         else { p=clamp01(Number(v.confidence)) }
         // verdict is a PURE 0-1 probability (a degree); no binary TRUE/FALSE classification.
-        verifyState.verdicts[r.rId]={prob:p,confidence:p,reason:String(v.reason||parsed.summary||'')}
+        // F1: a ballot from a member who is NOT in the frozen participant set must NOT be recorded -
+        // otherwise a late reply from a removed member re-creates its key and the count predicate can
+        // reach `expected` while a frozen voter has no verdict. v5 states the same rule explicitly.
+        const _inRoster = !Array.isArray(verifyState.rosterSnapshot) || verifyState.rosterSnapshot.indexOf(r.rId)!==-1
+        if(!_inRoster){ logActivity('verify', r.rId+' 的表决未计入（不在本次验证的冻结名单中）') }
+        else {
+          verifyState.verdicts[r.rId]={prob:p,confidence:p,reason:String(v.reason||parsed.summary||'')}
+          verifyState.lastVerdictAt=now()
+        }
         verifyState.lastVerdictAt=now()
         await saveAll()
         if(!running || autoDone) return   // pause: freeze (resume refreshes the clocks and re-drives)
@@ -3339,6 +3478,7 @@ export function apply(ctx) {
       if(ps.compile&&ps.compile.result==='ok') ps.files.push('paper.pdf')
       ps.finalizedAt=now(); ps.status='done'
       await paperWriteMeta(); await paperWriteLog()
+      await paperWriteMeta(); await paperWriteLog()
       // v2 §A1: the paper phase was entered from INSIDE the closing branch, BEFORE the completion
       // flags — so the run only becomes "done" here, once the paper exists (or has degraded safely).
       if(ps.deferCompletion && autoDone!==true){
@@ -3347,6 +3487,21 @@ export function apply(ctx) {
         logActivity('stop','all residents agree: problem solved（一致性停止票；最终论文已产出）')
         await saveAll()
       }
+      // G3: `done` is a CLAIM that the deliverable is complete. `final.md` is written unchecked and the
+      // meta/log results are discarded, so VERIFY THE ARTIFACTS EXIST instead of trusting return values.
+      // (readTextAbs returns undefined for a missing file and never throws on ENOENT.)
+      const _paperNeed=['final.md']
+      if(ps.cfg.format!=='tex') _paperNeed.push('paper.md')
+      if(ps.cfg.format!=='md') _paperNeed.push('paper.tex')
+      if(_paperNeed.indexOf('paper.md')===-1&&ps.files.indexOf('paper.md')!==-1) _paperNeed.push('paper.md')
+      if(_paperNeed.indexOf('paper.tex')===-1&&ps.files.indexOf('paper.tex')!==-1) _paperNeed.push('paper.tex')
+      _paperNeed.push('paper.meta.json','paper.log.md')
+      const _paperGone=[]
+      for(const _f of _paperNeed){ if((await readText(ps.dir+'/'+_f))===undefined) _paperGone.push(_f) }
+      if(_paperGone.length){
+        ps.status='failed'   // terminal, like a failed compile: no complete deliverable is claimed
+        if(!warnedPaperWrite){ warnedPaperWrite=true; console.error('vibe-math-v4: paperFinalize: required paper artifact(s) MISSING after finalize (' + _paperGone.join(', ') + ') - the paper is marked FAILED instead of done; the deliverable is incomplete and `files` never claims a missing artifact') }
+      }
       const warn=[ps.warning,ps.compile&&ps.compile.result==='failed'?ps.compile.error:''].filter(Boolean).join('；')
       if(warn) logActivity('paper','最终论文完成（有警告）：'+ps.dir+'｜'+warn)
       else logActivity('paper','最终论文完成：'+ps.dir+'（'+ps.files.join('、')+(ps.compile?('｜编译 '+(ps.compile.result||'')):'')+'）')
@@ -3357,6 +3512,10 @@ export function apply(ctx) {
       return {
         params:{finalPaper:params.finalPaper,paperFormat:params.paperFormat,paperLanguage:params.paperLanguage,paperCompilePdf:params.paperCompilePdf,paperEditor:params.paperEditor,paperLatexCommand:params.paperLatexCommand},
         id:ps?ps.id:paperIdFor(), dir:ps?ps.dir:paperDirFor(), status:ps?ps.status:'idle',
+        // round-9 (F2): with no paper state this path is a PROJECTION (f2: paperIdFor/paperDirFor are
+        // pure - reading `status` touches no fs and creates no directory). Say so explicitly instead of
+        // handing callers a path that looks like it exists.
+        dirProjected:!ps, dirSource:ps?'paper-state':'projection', readSideEffect:false,
         running:!!(ps&&ps.status!=='done'&&ps.status!=='failed'), trigger:ps?ps.trigger:'',
         rounds:ps?ps.round:0, maxRounds:ps?ps.maxRounds:PAPER_MAX_ROUNDS, participants:ps?ps.participants:[],
         editor:ps?(ps.editorId||ps.cfg.editor):params.paperEditor, editorDowngraded:!!(ps&&ps.editorDowngraded),
@@ -3368,6 +3527,8 @@ export function apply(ctx) {
     function paperStatusSummary(){
       const v=paperStatusView()
       return {ok:true, id:v.id, dir:v.dir, status:v.status, running:v.running, trigger:v.trigger, lang:v.params.paperLanguage,
+        // round-9 (F2): carry the projection flags through the SUMMARY too (this is what `status` returns).
+        dirProjected:v.dirProjected, dirSource:v.dirSource, readSideEffect:v.readSideEffect,
         format:v.params.paperFormat, editor:v.editor, editorDowngraded:v.editorDowngraded, participants:v.participants,
         parts:v.parts, reviews:v.reviews, rounds:v.rounds+'/'+v.maxRounds, finalizedAt:v.finalizedAt, files:v.files,
         params:v.params,
@@ -3462,6 +3623,9 @@ export function apply(ctx) {
     async function start({problem,residentCount,seedDirections}){
       await loadSettings()
       currentProject=await readCurrentProject(); if(!currentProject||currentProject==='default'){ currentProject='default'; }
+      // F-3/F-4c verdicts: tool registration is wrapped once, in the registerTool helper (ctx.effect),
+      // so no call site needs its own wrapper; and a failed mkdir is named ONCE inside ensureDirs itself,
+      // which covers every caller (including this bare one) - no caller-side return check is needed.
       await ensureDirs()
       if(problem) problemText=String(problem)
       if(!problemText) return {ok:false,message:'problem text required (pass problem, or use vibe_v4_configure first)'}
@@ -3565,7 +3729,23 @@ export function apply(ctx) {
       if(verifyState && verifyState.lastVerdictAt) verifyState.lastVerdictAt=now()
       logActivity('resume','restarted'+(crossProcess?' (cross-process: re-spawned)':needRespawn?' (re-spawned)':'')); await saveAll(); await scheduleNext(); return {ok:true,message:'resumed',project:currentProject}
     }
+    /** Round A F1/F2: the roster version must never be observable as unchanged while the frozen
+     *  participant set changed, and a frozen set must always travel WITH its own version. Every
+     *  roster change calls this AFTER all snapshot mutations (meeting + verify prunes included), so
+     *  {snapshot.rosterVersion, snapshot.rosterSnapshot} is one atomic pair and the live counter
+     *  still strictly increases on hire/fire. */
+    function bumpRoster(){ rosterVersion++; if(meetingState&&Array.isArray(meetingState.rosterSnapshot)) meetingState.rosterVersion=rosterVersion; if(verifyState&&Array.isArray(verifyState.rosterSnapshot)) verifyState.rosterVersion=rosterVersion; return rosterVersion }
+    /** The frozen participant set an operator should read right now (verify wins while it is live). */
+    function activeRosterSnapshot(){ return (verifyState&&Array.isArray(verifyState.rosterSnapshot))?verifyState:((meetingState&&Array.isArray(meetingState.rosterSnapshot))?meetingState:null) }
     function status(){ return { ok:true, running, phase, autoDone, project:currentProject, residentCount:residents.size,
+      // round-9 (P2): the roster VERSION travels with every status read, and an active verify/meeting
+      // reports the participant set it froze (never a re-derivation from the live map).
+      rosterVersion,
+rosterVersion, liveRosterVersion: rosterVersion,
+// Round A F1: the pair is ATOMIC - `frozen.version` is the version the SNAPSHOT recorded when it
+// was frozen (and re-stamped on every roster change), never the live counter beside a stale set.
+frozen: (function(sn){ return {version: sn?sn.rosterVersion:null, participants: sn?sn.rosterSnapshot:null, kind: sn?(sn===verifyState?'verify':'meeting'):null} })(activeRosterSnapshot()),
+frozenParticipants: (activeRosterSnapshot()||{}).rosterSnapshot||null,   // deprecated: use `frozen` (set + version together)
       residents:listResidents(), busy:[...busy], taskboard:taskboard.length,
       // Residents the host's live-child cap refused (maxActiveSubagents): queued, not lost. Without
       // this the only trace would be the one console line, and `residentCount` alone cannot tell a
@@ -3576,8 +3756,8 @@ export function apply(ctx) {
       // The coordination counters (`spoke k/N`, `voted k/N`, the verification round) used to live only
       // in `report()`: from `status()` alone an operator could not tell "the group is progressing"
       // from "the group is stuck at 2/4 votes", which is exactly how F1/F2/F7 stay invisible.
-      consensus: meetingState?{kind:'meeting',id:meetingState.id,agenda:meetingState.agenda,round:meetingState.round,spoke:Object.keys(meetingState.inputs).length,expected:residents.size,solvedVotes:Object.values(meetingState.inputs).filter(iv=>iv.voteSolved===true).length}
-        :(verifyState?{kind:'verify',target:verifyState.targetId,targetType:verifyState.targetType,stage:verifyState.stage,round:verifyState.round,voted:Object.keys(verifyState.verdicts).length,expected:residents.size}:null),
+      consensus: meetingState?{kind:'meeting',id:meetingState.id,agenda:meetingState.agenda,round:meetingState.round,rosterVersion:meetingState.rosterVersion,participants:meetingState.rosterSnapshot,spoke:Object.keys(meetingState.inputs).length,expected:(meetingState.rosterSnapshot||Array.from(residents.keys())).length,solvedVotes:Object.values(meetingState.inputs).filter(iv=>iv.voteSolved===true).length,rosterVersion:meetingState.rosterVersion}
+        :(verifyState?{kind:'verify',target:verifyState.targetId,targetType:verifyState.targetType,stage:verifyState.stage,round:verifyState.round,rosterVersion:verifyState.rosterVersion,participants:verifyState.rosterSnapshot,voted:Object.keys(verifyState.verdicts).length,expected:(verifyState.rosterSnapshot||Array.from(residents.keys())).length,rosterVersion:verifyState.rosterVersion}:null),
       artifactCount: artifactCount, artifactBaseline: artifactBaseline,
       paper: paperStatusSummary(),
       // The Lean knobs and the per-object formal records are part of the readable status: without
@@ -3598,8 +3778,8 @@ export function apply(ctx) {
     }
     function report(){ return { ok:true, running, phase, autoDone, project:currentProject, problem:problemText,
       residents:listResidents(), taskboard:taskboard.filter(t=>t.status!=='done'),
-      meeting: meetingState?{id:meetingState.id, agenda:meetingState.agenda, spoke:Object.keys(meetingState.inputs).length+'/'+residents.size}:null,
-      verify: verifyState?{target:verifyState.targetId,stage:verifyState.stage, voted:Object.keys(verifyState.verdicts).length+'/'+residents.size}:null,
+      meeting: meetingState?{id:meetingState.id, agenda:meetingState.agenda, spoke:Object.keys(meetingState.inputs).length+'/'+(meetingState.rosterSnapshot||Array.from(residents.keys())).length,rosterVersion:meetingState.rosterVersion}:null,
+      verify: verifyState?{target:verifyState.targetId,stage:verifyState.stage, voted:Object.keys(verifyState.verdicts).length+'/'+(verifyState.rosterSnapshot||Array.from(residents.keys())).length,rosterVersion:verifyState.rosterVersion}:null,
       pendingVerify: pendingVerify.length?pendingVerify[0].targetId:null,
       parkedMeeting: pendingMeeting?pendingMeeting.agenda:null,
       formal: formalView(),
@@ -3619,10 +3799,16 @@ export function apply(ctx) {
       // residents) can never be true for the new member (not in the snapshot order) and the meeting is
       // only ever released by the stuck watchdog instead of finalizing with everyone's input.
       if(meetingState){ if(!Array.isArray(meetingState.order)) meetingState.order=Array.from(residents.keys()); if(!meetingState.order.includes(r.rId)) meetingState.order.push(r.rId) }
+    rosterVersion++   // additions never extend a frozen set: the live counter moves ahead (staleness stays visible)
+      // P2: the roster CHANGED - bump the version so any frozen participant set is visibly stale.
+
       // Mid-verify additions are automatically asked to vote (continueVerifyRound recomputes ids from
       // the live residents map), so no extra handling is needed there.
       return {ok:true,id:r.rId,direction:r.direction} }
-    async function removeMember(id){ const r=residents.get(id); if(!r) return {ok:false}; if(r.childId){ try{ subagents.interrupt(r.childId,{kind:'ancestor',agent:rootAgent}) }catch(e){} } residents.delete(id); busy.delete(id); mailboxes.delete(id); wakeKind.delete(id); if(currentResident===id) currentResident=''
+    async function removeMember(id){ const r=residents.get(id); if(!r) return noSuchResident(id,'vibe_v4_remove_member'); if(r.childId){ try{ subagents.interrupt(r.childId,{kind:'ancestor',agent:rootAgent}) }catch(e){} } residents.delete(id); busy.delete(id); mailboxes.delete(id); wakeKind.delete(id); if(currentResident===id) currentResident=''
+      // P2: the roster CHANGED - bump the version (a frozen participant set stays readable, but is
+      // now visibly stale; every view reports the same version it snapshotted).
+
       // Reconcile in-progress coordination so a removed member cannot hang consensus or crash a round:
       // drop its meeting speech / verify verdict and prune it from the meeting's speaking order so the
       // find() there never selects a ghost. Its QUEUED verify proposals are deliberately KEPT: a
@@ -3632,6 +3818,13 @@ export function apply(ctx) {
       // only the first entry, which may belong to the removed member).
       if(meetingState){ delete meetingState.inputs[id]; meetingState.order=(meetingState.order||[]).filter(x=>x!==id) }
       if(verifyState){ delete verifyState.verdicts[id] }
+      // P2 (round-9): REMOVAL prunes the FROZEN participant set as well - v4's long-standing contract is
+      // that removing an in-flight voter RELEASES the wait (T26/T31), while the snapshot still gives
+      // every view one identical set + version. Additions never touch a frozen set (that is the point
+      // of freezing); the version bump above marks the set as changed.
+      if(meetingState&&Array.isArray(meetingState.rosterSnapshot)) meetingState.rosterSnapshot=meetingState.rosterSnapshot.filter(x=>x!==id)
+      if(verifyState&&Array.isArray(verifyState.rosterSnapshot)) verifyState.rosterSnapshot=verifyState.rosterSnapshot.filter(x=>x!==id)
+    bumpRoster()   // F2: AFTER every snapshot mutation - version and set stay one atomic pair
       await saveAll()
       // Re-drive the scheduler right away. If the removed member was the ONLY turn in flight (e.g. the
       // last unspoken meeting speaker / the last unvoted voter, interrupted mid-turn), NO subagent/end