dsh-vibe-math 2.7.1 → 2.7.3

package/vibe-math-v5/vibe-math-v5.js

@@ -86,7 +86,7 @@ const EV = {
   debate: 'vibe5/debate',
   verdict: 'vibe5/verdict',
   queue: 'vibe5/queue',
-  counters: 'vibe5/counters',
+  solve: 'vibe5/solve',
   progress: 'vibe5/progress',
   formal: 'vibe5/formal',
 }
@@ -330,26 +330,47 @@ export function apply(ctx) {
       formal: {},
       todo: [],
       queue: [],
+      // Per-member answers to the "is the original problem solved?" question (HIGH 3). It used to
+      // live in an in-memory Map: the tally gated `solved` and was PUBLISHED by status/report, but
+      // a restart or a second session over the same institute lost it, so cross-session unanimity
+      // was impossible and the published view was wrong. Durable like `verdicts`.
+      solve: {},
       counters: { academician: 0, researcher: 0, temp: 0, task: 0, meeting: 0, message: 0, verify: 0 },
       runId: '',
       lastProgressAt: now(),
       artifactCount: 0,
       diagnostics: [],
+      // F6 (status/report review): the durable marker of a meeting that STARTED but never
+      // FINALIZED. The meeting index entry is appended at `beginMeeting`, so before this marker a
+      // restart made an unfinished meeting look like ordinary history (minutes never written).
+      meetingOpen: null,
+      // F4 (status/report review): how many office-addressed requests the fold had to drop because
+      // of `OFFICE_REQUEST_CAP`. Without a counter the truncation was invisible in status/report.
+      officeRequestsDropped: 0,
       // The final-paper flow (stage machine + its artifacts state). Durable like everything
       // else, so a restart resumes the same stage instead of writing a second paper.
       paper: null,
     }
   }
-  function initState() { return { v: PROJECTION_VERSION, institutes: {}, order: [] } }
+  // LOW (deep review): `state.order` used to be maintained here and preserved in the diagnostics
+  // fallback, but NOTHING ever read it — dead payload written into every snapshot. Removed: the
+  // institutes map is the index (`Object.keys(state.institutes)`), and old files that still carry
+  // an `order` key are simply ignored.
+  function initState() { return { v: PROJECTION_VERSION, institutes: {} } }
 
+  // S3 (deep-review 4): the returned state now PRESERVES every unknown TOP-LEVEL key from the
+  // loaded file (`Object.assign({}, state, …)`) instead of rebuilding `{v, institutes,
+  // diagnostics}` and thereby silently erasing anything a NEWER revision wrote at that level. The
+  // institute level already behaved that way (the fold copies the institute object), so this makes
+  // the two levels consistent. `order` stays gone for good (it was written-but-never-read and was
+  // removed in the previous round), so nothing is re-added here.
   function withInstitute(state, key, mut) {
     const cur = state.institutes[key] || emptyInstitute(key, '', '')
     const nextInst = mut(cur)
     if (nextInst === cur) return state
     const institutes = Object.assign({}, state.institutes)
     institutes[key] = nextInst
-    const order = state.order.indexOf(key) === -1 ? state.order.concat([key]) : state.order
-    return { v: state.v, institutes, order, diagnostics: state.diagnostics }
+    return Object.assign({}, state, { institutes })
   }
 
   // Fold ONE event. Unknown/malformed events are SKIPPED and recorded in
@@ -357,6 +378,41 @@ export function apply(ctx) {
   // log purism, and a malformed event is a code defect that tests must catch.
   // (DSH's own team projection latches `state.failure` forever instead — a shape
   // v5 deliberately does not copy.)
+  // ── in-fold id allocation (deep-review HIGH 1) ───────────────────────────────
+  // Ids used to be minted OUTSIDE the fold (read `counters` → `msg-N` → `await putMessage`), so
+  // two same-tick writers could mint the SAME id; the fold then deduped (`messages`) or upserted
+  // (`members`/`tasks`), silently dropping or overwriting one object while BOTH callers reported
+  // success. An event may now carry `d.make(alloc)` instead of a ready object: it runs INSIDE the
+  // fold, allocates its id from the fold's OWN counters, and returns the object(s) to
+  // append/upsert — the fold applies the object AND the bumped counters in the same step, so two
+  // concurrent appends cannot collide. Already-identified objects (`d.member`/`d.task`/
+  // `d.message`/`d.index`, the update paths) keep working unchanged.
+  const ID_PREFIX = { message: 'msg-', task: 't-', meeting: 'mt-', researcher: 'r-', temp: 't-' }
+  // MEDIUM 4 (deep review): the OFFICE is not a member, so `to:'voters'` never reaches it — yet
+  // `addResearcher`/`startMeeting` told the caller "已向所办提议" while only voters were addressed
+  // (and only the office may approve either). Office-addressed requests are now a first-class
+  // target: a durable message under this pseudo-id, surfaced by `status().officeRequests` and by
+  // `report()`, capped so the queue cannot grow without bound.
+  const OFFICE_INBOX = 'office'
+  const OFFICE_REQUEST_CAP = 10
+  function makeIdAllocator(inst) {
+    const counters = Object.assign({}, inst.counters)
+    let dirty = false
+    return {
+      next(kind) {
+        if (kind === 'academician') {
+          counters.academician = Math.max(1, Number(counters.academician) || 0)
+          dirty = true
+          return 'acad'
+        }
+        const n = Math.max(0, Number(counters[kind]) || 0) + 1
+        counters[kind] = n
+        dirty = true
+        return (ID_PREFIX[kind] || kind + '-') + n
+      },
+      counters() { return dirty ? counters : inst.counters },
+    }
+  }
   function applyV5Event(state, event) {
     try {
       if (!event || typeof event.type !== 'string') return state
@@ -377,6 +433,9 @@ export function apply(ctx) {
           if (patch.runId !== undefined) n.runId = String(patch.runId)
           if (patch.lastProgressAt !== undefined) n.lastProgressAt = Number(patch.lastProgressAt) || 0
           if (patch.artifactCount !== undefined) n.artifactCount = Number(patch.artifactCount) || 0
+          // F6 / F4 (status/report review): two durable markers the published surfaces read.
+          if (patch.meetingOpen !== undefined) n.meetingOpen = patch.meetingOpen === null ? null : Object.assign({}, patch.meetingOpen)
+          if (patch.officeRequestsDropped !== undefined) n.officeRequestsDropped = Number(patch.officeRequestsDropped) || 0
           // The final-paper state. A FUNCTION is a MUTATION applied inside the fold (the same
           // trick the verify queue uses): the paper stage, its parts and its office-consultation
           // counters are updated from several places (member replies, office messages, meetings),
@@ -392,30 +451,79 @@ export function apply(ctx) {
       }
       if (t === EV.member) {
         return withInstitute(state, key, (inst) => {
-          const m = d.member
-          if (!m || typeof m.id !== 'string') return inst
+          const alloc = typeof d.make === 'function' ? makeIdAllocator(inst) : null
+          const made = alloc ? d.make(alloc) : d.member
+          const list = (Array.isArray(made) ? made : [made]).filter(Boolean)
+          if (!list.length) return inst
           const members = inst.members.slice()
-          const i = members.findIndex((x) => x.id === m.id)
-          if (i === -1) members.push(m); else members[i] = m
-          return Object.assign({}, inst, { members })
+          let changed = false
+          for (const m of list) {
+            if (!m || typeof m.id !== 'string' || !m.id) continue
+            const i = members.findIndex((x) => x.id === m.id)
+            if (i === -1) members.push(m); else members[i] = m
+            changed = true
+          }
+          if (!changed) return inst
+          const out = Object.assign({}, inst, { members })
+          if (alloc) out.counters = alloc.counters()
+          return out
         })
       }
       if (t === EV.task) {
         return withInstitute(state, key, (inst) => {
-          const task = d.task
-          if (!task || typeof task.id !== 'string') return inst
+          const alloc = typeof d.make === 'function' ? makeIdAllocator(inst) : null
+          const made = alloc ? d.make(alloc) : d.task
+          const list = (Array.isArray(made) ? made : [made]).filter(Boolean)
+          if (!list.length) return inst
           const tasks = inst.tasks.slice()
-          const i = tasks.findIndex((x) => x.id === task.id)
-          if (i === -1) tasks.push(task); else tasks[i] = task
-          return Object.assign({}, inst, { tasks })
+          let changed = false
+          for (const task of list) {
+            if (!task || typeof task.id !== 'string' || !task.id) continue
+            const i = tasks.findIndex((x) => x.id === task.id)
+            if (i === -1) tasks.push(task); else tasks[i] = task
+            changed = true
+          }
+          if (!changed) return inst
+          const out = Object.assign({}, inst, { tasks })
+          if (alloc) out.counters = alloc.counters()
+          return out
         })
       }
       if (t === EV.message) {
         return withInstitute(state, key, (inst) => {
-          const msg = d.message
-          if (!msg || typeof msg.id !== 'string') return inst
-          if (inst.messages.some((x) => x.id === msg.id)) return inst
-          return Object.assign({}, inst, { messages: inst.messages.concat([msg]) })
+          const alloc = typeof d.make === 'function' ? makeIdAllocator(inst) : null
+          const made = alloc ? d.make(alloc) : d.message
+          const list = (Array.isArray(made) ? made : [made]).filter(Boolean)
+          if (!list.length) return inst
+          const messages = inst.messages.slice()
+          let changed = false
+          for (const msg of list) {
+            if (!msg || typeof msg.id !== 'string' || !msg.id) continue
+            if (messages.some((x) => x.id === msg.id)) continue
+            messages.push(msg)
+            changed = true
+          }
+          if (!changed) return inst
+          // MEDIUM 4 (deep review): office-addressed requests (a member proposal that ONLY the
+          // office can approve) are never "delivered" — the office is not a member and has no
+          // inbox drain — so they are capped here, newest kept, oldest dropped. Without that cap
+          // `messages` would grow for the whole run.
+          let self = messages
+          let dropped = 0
+          const officeMsgs = self.filter((m) => m.to === OFFICE_INBOX)
+          if (officeMsgs.length > OFFICE_REQUEST_CAP) {
+            const drop = new Set(officeMsgs.slice(0, officeMsgs.length - OFFICE_REQUEST_CAP).map((m) => m.id))
+            self = self.filter((m) => !drop.has(m.id))
+            dropped = drop.size
+          }
+          // F4 (status/report review): the truncation is COUNTED, so `status()`/`report()` can say
+          // "显示最新 N / 累计丢弃 K" instead of presenting a truncated list as complete.
+          const out = Object.assign({}, inst, {
+            messages: self,
+            officeRequestsDropped: Number(inst.officeRequestsDropped || 0) + dropped,
+          })
+          if (alloc) out.counters = alloc.counters()
+          return out
         })
       }
       if (t === EV.delivered) {
@@ -441,11 +549,14 @@ export function apply(ctx) {
       }
       if (t === EV.meeting) {
         return withInstitute(state, key, (inst) => {
-          const idx = d.index
-          if (!idx || typeof idx.id !== 'string') return inst
+          const alloc = typeof d.make === 'function' ? makeIdAllocator(inst) : null
+          const idx = alloc ? d.make(alloc) : d.index
+          if (!idx || typeof idx.id !== 'string' || !idx.id) return inst
           if (inst.meetings.some((x) => x.id === idx.id)) return inst
           const meetings = inst.meetings.concat([idx])
-          return Object.assign({}, inst, { meetings: meetings.length > 200 ? meetings.slice(meetings.length - 200) : meetings })
+          const out = Object.assign({}, inst, { meetings: meetings.length > 200 ? meetings.slice(meetings.length - 200) : meetings })
+          if (alloc) out.counters = alloc.counters()
+          return out
         })
       }
       if (t === EV.debate) {
@@ -469,9 +580,23 @@ export function apply(ctx) {
         return withInstitute(state, key, (inst) => {
           if (!d.target || typeof d.target !== 'string') return inst
           const formal = Object.assign({}, inst.formal)
-          if (d.record === null) delete formal[d.target]
+          // MEDIUM 6 (deep review): `record` and `todo` accept a FUNCTION (a mutation applied
+          // inside the fold), exactly like `EV.queue`/`patch.paper`. The old shape built them from
+          // reads taken OUTSIDE the fold (`formalTodo().filter(...)`) and replaced the durable
+          // value wholesale, so two same-tick writers for different targets lost one entry —
+          // the lost-update class the queue fix at this file's queue branch already removed.
+          if (typeof d.record === 'function') {
+            const target = d.target
+            const next = d.record(formal[target] === undefined ? null : formal[target])
+            if (next === null || next === undefined) delete formal[target]
+            else formal[target] = next
+          } else if (d.record === null) delete formal[d.target]
           else formal[d.target] = d.record
-          const todo = d.todo === undefined ? (inst.todo || []) : (Array.isArray(d.todo) ? d.todo : (inst.todo || []))
+          const todo = d.todo === undefined
+            ? (inst.todo || [])
+            : (typeof d.todo === 'function'
+              ? (d.todo(inst.todo || []) || inst.todo || [])
+              : (Array.isArray(d.todo) ? d.todo : (inst.todo || [])))
           return Object.assign({}, inst, { formal, todo })
         })
       }
@@ -491,8 +616,19 @@ export function apply(ctx) {
           return Object.assign({}, inst, { queue: list })
         })
       }
-      if (t === EV.counters) {
-        return withInstitute(state, key, (inst) => Object.assign({}, inst, { counters: Object.assign({}, inst.counters, d.counters || {}) }))
+      if (t === EV.solve) {
+        // HIGH 3: one durable place for the "is it solved?" tally. `d.clear` resets it (a new
+        // solve question), `d.member`+`d.value` records/withdraws ONE member's answer (`null`
+        // withdraws, mirroring how `fire` drops a dismissed member's ballot).
+        return withInstitute(state, key, (inst) => {
+          if (d.clear) return Object.assign({}, inst, { solve: {} })
+          const member = String(d.member || '')
+          if (!member) return inst
+          const cur = Object.assign({}, inst.solve || {})
+          if (d.value === null || d.value === undefined) delete cur[member]
+          else cur[member] = d.value === true
+          return Object.assign({}, inst, { solve: cur })
+        })
       }
       if (t === EV.progress) {
         return withInstitute(state, key, (inst) => Object.assign({}, inst, {
@@ -505,7 +641,8 @@ export function apply(ctx) {
       // Never throw out of the fold: one bad event must not break every later read.
       try {
         const diagnostics = (state.diagnostics || []).concat([{ at: now(), type: String(event && event.type), error: String((e && e.message) || e) }])
-        return { v: state.v, institutes: state.institutes, order: state.order, diagnostics: diagnostics.slice(-50) }
+        // S3: keep every unknown top-level key here too (see `withInstitute`).
+        return Object.assign({}, state, { v: state.v, institutes: state.institutes, diagnostics: diagnostics.slice(-50) })
       } catch (e2) { return state }
     }
   }
@@ -525,7 +662,7 @@ export function apply(ctx) {
   // default path, after which `vibe_v5_configure {institute:'alpha'}` never read alpha's
   // file and wrote an EMPTY institute over it. Switching paths now re-reads the new path
   // first, and if that read fails the backend refuses to write instead of clobbering.
-  function makeFileBackend(readTextAbs, writeTextAbs, pathOf) {
+  function makeFileBackend(readTextAbs, writeTextAbs, pathOf, onWriteFailure, onLoadProblem) {
     let mem = initState()
     let chain = Promise.resolve(true)
     let loadedPath            // the path whose file is currently folded into `mem`
@@ -535,22 +672,40 @@ export function apply(ctx) {
     // Fold ONE path into `mem`. `readTextAbs` returning undefined means "no file yet", which
     // is the only case that licences a later write; anything else (a throw, a parse error, a
     // version mismatch) leaves `loadOk` false so commit() refuses to clobber it.
+    // S2 (deep-review 4): the REASON is recorded (`loadProblem`), because "no file" and "a file we
+    // could not use" used to look identical to every reader — an operator saw an empty institute
+    // with no hint that their state file exists and was rejected, and the note only appeared after
+    // a WRITE was attempted.
+    let loadProblem = ''
     async function doLoad(p) {
       let ok = false
+      loadProblem = ''
       try {
         const raw = await readTextAbs(p)
         if (raw === undefined || raw === null || raw === '') ok = true
         else {
-          const parsed = JSON.parse(raw)
-          if (parsed && parsed.v === PROJECTION_VERSION) { mem = parsed; ok = true }
+          let parsed = null
+          try { parsed = JSON.parse(raw) } catch (e) { loadProblem = 'invalid JSON (truncated or corrupt)' }
+          if (parsed) {
+            if (parsed.v === PROJECTION_VERSION) { mem = parsed; ok = true }
+            else loadProblem = 'schema version mismatch: file has v=' + JSON.stringify(parsed.v) + ', this build reads v=' + PROJECTION_VERSION
+          }
         }
-      } catch (e) { /* a corrupt/unreadable file is ignored; it is not authoritative */ }
+      } catch (e) { loadProblem = 'unreadable: ' + String((e && e.message) || e) }
       loadedPath = p
       loadOk = ok
       loadPromise = null
       loadPendingPath = null
       return mem
     }
+    // S2: the actionable text for a file that EXISTS but could not be used (vs "no file yet").
+    function loadProblemText(where) {
+      if (!loadProblem) return ''
+      return 'the state file ' + where + ' exists but could NOT be used (' + loadProblem + '); '
+        + 'writes are refused so it is never clobbered. Fix: back it up, then either restore a v'
+        + PROJECTION_VERSION + ' file or remove/rename it to start a fresh institute in that path '
+        + '(the current file is left untouched).'
+    }
     const backend = {
       kind: 'file',
       async load() {
@@ -564,6 +719,9 @@ export function apply(ctx) {
         loadPendingPath = path
         loadPromise = doLoad(path)
         await loadPromise
+        // S2: a file that EXISTS but was rejected is reported on the READ path too (not only when
+        // a write is refused), so `/v5 status` can never silently look like "nothing here yet".
+        if (!loadOk && loadProblem) { try { onLoadProblem(loadProblemText(path)) } catch (e) { /* diagnostics must not break the load */ } }
         if (loadedPath === pathOf()) return mem
         // The path moved again while we were reading: hand back the state for the path
         // that is current NOW rather than one for a directory we are no longer using.
@@ -599,7 +757,17 @@ export function apply(ctx) {
         // late writer always lands the FULL newest state and can never overwrite with
         // a stale subset (v4 §27 writeJson defect).
         chain = chain.then(async () => {
-          try { await writeTextAbs(pathOf(), JSON.stringify(snapshot, null, 2)) } catch (e) { /* best effort */ }
+          // MEDIUM 7 (deep review): the write used to be wrapped in `catch { /* best effort */ }`,
+          // and `writeTextAbs` already swallows its own failures (it returns `undefined`), so a
+          // failed write was INVISIBLE: the in-memory state advanced, every caller reported
+          // success, and the operator believed the run was persisted. The fold cannot be rolled
+          // back here, so the failure is made durable + visible instead (`onWriteFailure` feeds the
+          // same `diagnostics` list that `report()` prints under `## ⚠ 状态诊断`) and also logged.
+          const outcome = await writeTextAbs(pathOf(), JSON.stringify(snapshot, null, 2))
+          if (outcome === undefined) {
+            try { onWriteFailure(pathOf()) } catch (e) { /* diagnostics must never break the chain */ }
+            try { console.error('vibe-math-v5: state write FAILED for ' + pathOf() + ' — the in-memory state advanced but the file is STALE') } catch (e) { /* ignore */ }
+          }
           return true
         })
         return mem
@@ -741,6 +909,15 @@ export function apply(ctx) {
     const roundsSinceCompact = new Map()
     const contextPct = new Map()
     const needReanchor = new Set()
+    // G1 (mailbox): ids already PREPENDED to a prompt for this member but not yet acked. The prompt can
+    // legitimately be built more than once before the wake (that was the v4 §24 duplicate-read defect),
+    // so the injection mark keeps "at most one inbox section per prompt" while the messages stay pending
+    // until the send actually succeeds. Cleared on every concluded wake attempt.
+    const inboxInjected = new Map()
+    // G1: members whose mail `promptFor` is prepending IN THIS BUILD — `briefBlock` must then omit its
+    // own `[新到的消息/通知]` block, or the same messages appear twice in one prompt (the duplicate-read
+    // defect the prompt-v5-integrity suite pins). Only set while a block is actually being prepended.
+    const inboxSuppressed = new Set()
     const seeds = new Map()           // memberId -> condensed self-summary seed
     const lastActiveAt = new Map()
     let currentMember = ''
@@ -760,15 +937,99 @@ export function apply(ctx) {
     let backend = null
     let stateCache = null
 
+    // G-7 (installer ROUND2, safety): the host's `sandboxPolicy.resolve()` may fall back to a WIDER
+    // root than this session's workspace (the host lib catches and resolves `{}` on its own errors).
+    // v5 cannot override the host fence — it passes the policy straight to `fs.writeText` — but it
+    // CAN compare the root it believes in (the session cwd, which every member-facing path is built
+    // from) with the root the policy advertises, and surface a NAMED warning when they disagree.
+    // Recorded once per session (a diagnostic, never a write refusal: refusing would silently stop
+    // persisting legitimate work, and v5 has no way to widen or narrow the host's fence itself).
+    let sandboxPolicyChecked = false
+    let sandboxPolicyMismatch = null
+    function sessionCwd() {
+      try { if (rootAgent && rootAgent.session && rootAgent.session.header && rootAgent.session.header.cwd) return String(rootAgent.session.header.cwd) } catch (e) { /* unknown */ }
+      return ''
+    }
+    const normRoot = (p) => String(p || '').replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase()
+    function checkSandboxPolicyRoot() {
+      if (sandboxPolicyChecked) return
+      sandboxPolicyChecked = true
+      try {
+        const sp = sandboxPolicyOf()
+        const policyRoot = sp && sp.workspaceRoot ? String(sp.workspaceRoot) : ''
+        const expected = sessionCwd()
+        if (!policyRoot || !expected) return
+        if (normRoot(policyRoot) !== normRoot(expected)) {
+          sandboxPolicyMismatch = {
+            at: now(), expected, policyRoot,
+            note: '沙箱策略声明的可写根与会话工作目录不一致：v5 用会话工作目录拼所有路径（成员提示词/状态/Formal/Verified），'
+              + '若宿主按策略根解析写操作，产物可能落在预期之外的那棵树。请核对 sandbox 策略的 workspaceRoot。',
+          }
+          console.error('vibe-math-v5: ⚠ 沙箱策略根与会话工作目录不一致（策略=' + policyRoot + '，会话=' + expected + '）：写盘位置可能不是你预期的那棵树')
+        }
+      } catch (e) { /* a diagnostic must never break path resolution */ }
+    }
     function workspaceRoot() {
-      try { if (rootAgent && rootAgent.session && rootAgent.session.header && rootAgent.session.header.cwd) return rootAgent.session.header.cwd } catch (e) { /* fall through */ }
+      const cwd = sessionCwd()
+      if (cwd) { checkSandboxPolicyRoot(); return cwd }
       const sp = sandboxPolicyOf()
-      if (sp && sp.workspaceRoot) return sp.workspaceRoot
+      if (sp && sp.workspaceRoot) { checkSandboxPolicyRoot(); return sp.workspaceRoot }
       return '.'
     }
     const vibeRoot = () => (workspaceRoot() + '/VibeMath').replace(/\\/g, '/')
     const projectRoot = () => vibeRoot() + '/Projects/' + project
     const instRoot = () => projectRoot() + '/Institutes/' + instituteName
+    // DEFECT A (3rd self-test): member-facing text used INSTITUTE-relative paths
+    // (`Members/<id>/…`), but a member's OWN file tools resolve a relative path against the
+    // SESSION CWD — so a member following that text verbatim created `<cwd>/Members/…`, a stray
+    // tree outside `VibeMath/Projects/…` (the self-test's `Members/acad/Propos/p-*.md`). Every
+    // member-facing path now uses the CWD-relative form (their real baseline); the framework's own
+    // writes keep going through `instRoot()`. `instRel()` is the one place that composes it.
+    const instRootRel = () => 'VibeMath/Projects/' + project + '/Institutes/' + instituteName
+    const instRel = (rel) => instRootRel() + '/' + String(rel == null ? '' : rel).replace(/^\/+/, '')
+    // CLASS GUARD (lead's re-verification round): "documented member write paths must be paths the
+    // framework scans/reads". `instRootRel()` (what the member-facing text advertises) and
+    // `instRoot()` (what `writeTextRel`/`readTextRel`/`readLibrary`/`findCardRel`/`mkdirs` actually
+    // use) are two COMPOSITIONS of the same layout: if a future edit changes one and not the other,
+    // the text advertises a directory nothing writes to (exactly the v4 defect found in 58fff7f).
+    // Comparing the two compositions — instead of trusting two hand-copied strings — is what makes
+    // that class impossible to reintroduce silently.
+    function memberPathContractOk() {
+      const probe = 'Members/__probe__/Progress/progress.md'
+      const documented = instRel(probe)
+      const abs = (instRoot() + '/' + probe).replace(/\\/g, '/')
+      const ws = String(workspaceRoot() || '').replace(/\\/g, '/')
+      if (!ws || ws === '.') return true                 // no cwd to strip: nothing to compare
+      const actual = abs.indexOf(ws) === 0 ? abs.slice(ws.length).replace(/^\/+/, '') : abs
+      if (documented !== actual) {
+        console.error('vibe-math-v5: member library path contract BROKEN — the member-facing text says "'
+          + documented + '" but the framework writes/reads "' + actual + '"')
+        return false
+      }
+      return true
+    }
+    // LEAN CLASS GUARD (L1 of the Lean deep review, same spirit as `memberPathContractOk`): the path
+    // the Lean prompts tell a member to write must be RESOLVABLE BY THE TOOL THAT CONSUMES IT.
+    // `leanAbsPath` is called long after this point, so it is looked up lazily via the closure (it is
+    // a function declaration inside this scope, hence hoisted) and the comparison is between the
+    // COMPOSITIONS on both sides — never two hand-copied strings.
+    function leanPathContractOk() {
+      const probe = 'Formal/__probe__.lean'
+      const expected = normalizeAbsPath(instRoot() + '/' + probe)
+      // The EXACT composition the prompt prints (`formalRootRel()`), plus the two spellings a member
+      // may pass to a tool. All three must name the file the framework uses.
+      const printedProbe = formalRootRel().replace(/\/+$/, '') + '/__probe__.lean'
+      const viaPrinted = leanAbsPath(printedProbe)
+      const viaDocumented = leanAbsPath(instRel(probe))   // what the prompt advertises (cwd-relative)
+      const viaShort = leanAbsPath(probe)                 // the tools' short form (institute-relative)
+      if (viaPrinted !== expected || viaDocumented !== expected || viaShort !== expected) {
+        console.error('vibe-math-v5: Lean path contract BROKEN — printed "' + printedProbe
+          + '" resolves to ' + String(viaPrinted) + ', documented "' + instRel(probe) + '" to '
+          + String(viaDocumented) + ', short form to ' + String(viaShort) + ', but the framework uses ' + expected)
+        return false
+      }
+      return true
+    }
 
     function getPolicy() {
       const sp = sandboxPolicyOf()
@@ -795,7 +1056,9 @@ export function apply(ctx) {
     async function writeTextRel(rel, content) { return (await writeTextAbs(instRoot() + '/' + rel, content)) !== undefined }
 
     function installBackend() {
-      backend = makeFileBackend(readTextAbs, writeTextAbs, () => instRoot() + '/State/' + instituteName + '.v5state.json')
+      backend = makeFileBackend(readTextAbs, writeTextAbs, () => instRoot() + '/State/' + instituteName + '.v5state.json',
+        (p) => noteWriteProblem(p),                       // MEDIUM 7: a failed write must be visible, never swallowed
+        (text) => { lastLoadProblem = text; noteLoadProblem(text) })   // S2: a rejected file is visible on READS too
       return backend
     }
     // The ONE call site that awaits the backend's load (the sensitivity probe for
@@ -809,9 +1072,24 @@ export function apply(ctx) {
     // backend's `mem` is still the empty initial state, so a fresh process would report
     // an empty roster and `resume` would refuse with "no active member to resume" —
     // i.e. the fallback would silently lose the whole institute across a restart.
+    // MEDIUM 8 (deep review): "a read must be preceded by an awaited load" was only a CONVENTION.
+    // `state()` stays synchronous by design (the whole fold reads through it), so it can only
+    // START the load — a read that lands before that load settles sees the empty/previous `mem`.
+    // Enforcement is impossible without making every read async, so the rule is now explicit and
+    // OBSERVABLE:
+    //   • SAFE (they all `await ready()` first): every `registerTool` handler, the `/v5` command,
+    //     `commit()` (it awaits `awaitBackendLoad()` before touching `mem`) and `schedulePass()`
+    //     (see its `ready()` call).
+    //   • UNSAFE by construction: any other synchronous consumer of the session API
+    //     (`inst()`/`state()` called from inside ANOTHER plugin, or from a raw host callback that
+    //     does not go through a tool wrapper). Those get a counter (`prematureReads`) surfaced by
+    //     `status()`/`report()` so the gap is visible instead of silent.
+    let loadSettled = false
+    let prematureReads = 0
     async function ready() {
       if (!backend) installBackend()
       await awaitBackendLoad()
+      loadSettled = true
       // Crash recovery for the Lean queue runs ONCE per session, after the state file is
       // folded in: a leftover Formal/Jobs/*.json is re-queued or explicitly interrupted, and
       // is NEVER silently turned into `passed` (docs/formal-verification.md §7-7).
@@ -821,6 +1099,11 @@ export function apply(ctx) {
       // The math availability line is derived at session start (and on every tuning that
       // touches the six math_* keys); `probeMathEngines` caches per host, so this is cheap.
       try { await refreshMathLine() } catch (e) { console.error('vibe-math-v5: math probe: ' + String((e && e.message) || e)) }
+      // The member-library path contract (documented root == the root the framework writes/reads).
+      // A broken contract is recorded in `diagnostics` so `report()` shows it instead of leaving a
+      // silent "members write where nothing reads" state.
+      try { if (!memberPathContractOk()) noteLoadProblem('member library path contract broken (documented root != framework root)') } catch (e) { /* never break ready() */ }
+      try { if (!leanPathContractOk()) noteLoadProblem('Lean path contract broken (a documented Lean path is not resolvable by the tool that consumes it)') } catch (e) { /* never break ready() */ }
       return true
     }
     // Load the CURRENT state path before its first read. `state()` is synchronous by design
@@ -838,6 +1121,9 @@ export function apply(ctx) {
       // not been folded in yet (the 2.4.1 audit's H1: a read-less `state()` was half of the
       // overwrite). `ready()`/`commit()` await the same load; here it only has to START.
       ensureLoaded()
+      // MEDIUM 8: a read that lands before the first successful load is counted (and reported),
+      // instead of silently answering from the empty/previous snapshot.
+      if (!loadSettled) prematureReads += 1
       stateCache = backend.read()
       return stateCache
     }
@@ -863,8 +1149,28 @@ export function apply(ctx) {
       if (t && pendingLoadNotes.indexOf(t) === -1) pendingLoadNotes.push(t)
       if (pendingLoadNotes.length > 5) pendingLoadNotes = pendingLoadNotes.slice(-5)
     }
+    // MEDIUM 7 (deep review): a FAILED state write cannot be rolled back (the fold already
+    // advanced the in-memory state), so it must at least be impossible to miss. Counted for
+    // `status()`/`report()` AND queued for the next allowed commit's diagnostics.
+    let stateWriteFailures = 0
+    // S2: the ACTIONABLE reason a state file that exists was rejected (empty while everything is
+    // fine). Surfaced by `status()`/`report()` on the read path, not only after a refused write.
+    let lastLoadProblem = ''
+    // F1 (status/report review): a SESSION-LEVEL log of load/write problems. `drainLoadNotes` used to
+    // write them into `stateCache` only — which the very next `state()` read replaced with the
+    // backend's `mem` — so they could vanish between commits and, worse, they were never the array
+    // `report()` printed (`report()` read the INSTITUTE-level diagnostics). Keeping a session log is
+    // what lets the diagnostics section show the sources its heading advertises.
+    let loadProblemLog = []
+    function noteWriteProblem(p) {
+      stateWriteFailures += 1
+      noteLoadProblem('state write FAILED (the file is STALE): ' + String(p || '?'))
+    }
     function drainLoadNotes() {
-      if (!pendingLoadNotes.length || !stateCache) return
+      if (!pendingLoadNotes.length) return
+      loadProblemLog = loadProblemLog.concat(pendingLoadNotes.map((t) => ({ at: now(), type: 'vibe5/load', error: t })))
+      if (loadProblemLog.length > 10) loadProblemLog = loadProblemLog.slice(-10)
+      if (!stateCache) { pendingLoadNotes = []; return }
       const list = (stateCache.diagnostics || []).concat(pendingLoadNotes.map((t) => ({ at: now(), type: 'vibe5/load', error: t })))
       pendingLoadNotes = []
       stateCache = Object.assign({}, stateCache, { diagnostics: list.slice(-50) })
@@ -888,6 +1194,12 @@ export function apply(ctx) {
       const cur = stateCache.institutes[key]
       if (cur) {
         phase = cur.phase || phase
+        // S1 (deep-review 4 / repro: `_oneoff/s1-solved-reload.mjs`): the CONCLUDED marker is
+        // durable state, not a session memory. `autoDone` used to live only in memory, so a fresh
+        // session over a `phase:'solved'` file had `autoDone=false` and `/v5 start` re-founded the
+        // concluded institute (new runId, new members on top of the old roster). Mirroring the
+        // persisted phase makes every existing `autoDone` guard correct again on reload.
+        autoDone = String(phase) === 'solved'
         // Restored params must go through the SAME normalisation as `vibe_v5_set`: a hand-edited
         // or foreign-shaped state file (e.g. mathEngines as a comma STRING, a bogus enum, a
         // sub-1000 timeout) would otherwise reach `visibleParams()` and v5's own
@@ -905,15 +1217,22 @@ export function apply(ctx) {
     const patchInstitute = (patch) => commit(EV.institute, { patch })
     const putMember = (member) => commit(EV.member, { member })
     const putTask = (task) => commit(EV.task, { task })
-    const putMessage = (message) => commit(EV.message, { message })
+    // HIGH 1: creation goes through an in-fold allocator — the callback runs INSIDE the fold, so
+    // the id it hands out and the object it returns are committed in one step (makeIdAllocator).
+    // The old whole-object creation setters (`putMessage`/`putMeeting`/`putCounters`) are GONE on
+    // purpose: reusing one would mint an id from a read taken outside the fold and reintroduce the
+    // silent-loss race this fix removes. Updates use `putMember`/`putTask` (already-identified
+    // objects) and, for messages, the same allocator.
+    const putMessageMake = (make) => commit(EV.message, { make })
+    // HIGH 3: the "is it solved?" tally is durable state, not an in-memory Map.
+    const putSolve = (patch) => commit(EV.solve, patch || {})
     const ackDelivered = (ids) => commit(EV.delivered, { ids })
-    const putMeeting = (index) => commit(EV.meeting, { index })
     const putDebate = (index) => commit(EV.debate, { index })
     const putVerdict = (target, record) => commit(EV.verdict, { target, record })
     // The verify queue has NO whole-array setter any more: both of its mutations go through
     // `appendToQueue`/`takeQueueHead` below, which hand a FUNCTION to the event fold so the
-    // read-modify-write is atomic (the lost-proposal race).
-    const putCounters = (counters) => commit(EV.counters, { counters })
+    // read-modify-write is atomic (the lost-proposal race). Counters are bumped by the object
+    // folds themselves (`makeIdAllocator`), so there is no `counters` setter either.
     const markProgress = async () => {
       lastProgressAt = now()
       await commit(EV.progress, { at: lastProgressAt, artifactCount: inst().artifactCount })
@@ -924,9 +1243,95 @@ export function apply(ctx) {
     const memberById = (id) => inst().members.find((m) => m.id === id)
     const voters = () => activeMembers().filter((m) => m.kind === 'academician' || m.kind === 'researcher')
     const voterCount = () => voters().length
-    function quorumM() {
+    function quorumMFrom(vc) {
       const cap = Math.max(1, Math.floor(Number(params.quorumCap) || 3))
-      return Math.max(1, Math.min(cap, voterCount()))
+      return Math.max(1, Math.min(cap, vc))
+    }
+    function quorumM() { return quorumMFrom(voterCount()) }
+    // DEFECT B (3rd self-test): the office's digest showed `m=2` while `status`/`acad` showed
+    // `m=3` in the SAME window — two views had computed the voter set at different moments
+    // (roster-snapshot timing). Every quorum-bearing view now reads ONE live snapshot and carries
+    // its `rosterVersion`, so all views at one point in time are provably identical and a stale
+    // reader can be DETECTED instead of silently disagreeing.
+    function rosterVersion() {
+      const ids = voters().map((m) => String(m.id) + ':' + String(m.phase)).sort()
+      return 'r' + String((inst().members || []).length) + ':' + ids.join(',')
+    }
+    function rosterSnapshot() {
+      const vs = voters()
+      const vc = vs.length
+      const started = vc > 0
+      return {
+        version: rosterVersion(),
+        m: started ? quorumMFrom(vc) : 0,
+        voters: vs.map((m) => m.id),
+        voterCount: vc,
+        started: started,
+      }
+    }
+    // DEFECT 2 (v5 self-test §18): before `start` there are no voters, yet the reported quorum
+    // was `m=1` with `voters=0` — it read like "a quorum of 1 is already there". The REPORTED
+    // quorum is therefore coherent and explicit: `started:false`, `m:0`, `voterCount:0` and the
+    // next step. `quorumM()` itself stays >=1 so the consensus arithmetic is unchanged, and
+    // `judgeVerdict` refuses to conclude at all when there are no voters.
+    function quorumView() {
+      const snap = rosterSnapshot()
+      const started = snap.started
+      const view = {
+        m: snap.m,
+        mode: params.quorumMode,
+        voters: snap.voters,
+        voterCount: snap.voterCount,
+        started: started,
+        phase: started ? 'voting' : 'not-started',
+        rosterVersion: snap.version,
+      }
+      if (!started) {
+        view.next = {
+          kind: 'start', tool: 'vibe_v5_start',
+          hint: '研究所尚未启动：有表决权者 0 人，因此 m 记为 0（不是"已满足 1 票门槛"）。先 vibe_v5_start（或 /v5 start）建立名册，m 才有意义。',
+        }
+      }
+      return view
+    }
+    // DEFECT 1 (v5 self-test §18): a member-scoped tool called before the institute exists — or
+    // by nobody identifiable — answered a BARE `V5_MEMBER_NOT_FOUND`, so an operator (or the
+    // model) could not tell WHY it failed or WHAT TO DO FIRST. The error CODE is unchanged (all
+    // existing gates keep matching on it); the answer now names the state and the next step, in
+    // the same `next`-hint shape the `math_computation` tool uses.
+    function memberDiagnosis(what, memberId) {
+      const total = (inst().members || []).length
+      const active = activeMembers().length
+      const who = String(memberId || '')
+      if (active === 0 && !running) {
+        return {
+          ok: false, code: 'V5_MEMBER_NOT_FOUND',
+          message: what + '失败：研究所尚未启动（在册 ' + total + ' 名、有表决权者 0 人），没有可归属的成员身份。',
+          next: {
+            kind: 'start', tool: 'vibe_v5_start',
+            hint: '先启动研究所（vibe_v5_start 或 /v5 start）让框架派出常驻成员，再由**成员子代理**调用该工具；所办（会话根）本身不是成员。',
+          },
+        }
+      }
+      if (active === 0) {
+        return {
+          ok: false, code: 'V5_MEMBER_NOT_FOUND',
+          message: what + '失败：研究所当前没有在册（active）成员。',
+          next: { kind: 'staff', tool: 'vibe_v5_add_researcher', hint: '先用 vibe_v5_add_researcher / vibe_v5_hire 补充成员，再调用该工具。' },
+        }
+      }
+      if (!who) {
+        return {
+          ok: false, code: 'V5_MEMBER_NOT_FOUND',
+          message: what + '失败：无法识别调用者（这是成员工具，所办/会话根没有成员身份）。',
+          next: { kind: 'member-call', tool: 'vibe_v5_members', hint: '请由成员子代理调用；所办可用 vibe_v5_message 转达，或直接用所办工具（vibe_v5_report / vibe_v5_status）。' },
+        }
+      }
+      return {
+        ok: false, code: 'V5_MEMBER_NOT_FOUND',
+        message: what + '失败：名册中没有成员 "' + who + '"（可能已被解雇或尚未就位）。',
+        next: { kind: 'roster', tool: 'vibe_v5_members', hint: '先用 vibe_v5_members 查看当前名册与阶段（active / provisioning / dismissed）。' },
+      }
     }
     function byChild(childId) { return inst().members.find((m) => m.childId === childId) }
     // The live academician's id, or '' when the office founded the institute with
@@ -969,7 +1374,7 @@ export function apply(ctx) {
       ].join('\n')
     }
     const LIB_SPEC = [
-      '  · Progress/<你>/progress.md —— **你的研究日志**（叙述体，可追加）。',
+      '  · Members/<你>/Progress/progress.md —— **你的研究日志**（叙述体，可追加）。',
       '    主要内容是：尝试过的各方法、路线、历程、进度；当前研究进展/进度；将来的计划与打算；',
       '    及各路线、过程中遇到的障碍及其原因；对各路线、方法的看法、可行性评估；自己研究过程',
       '    中的一些有价值看法、感想、猜想、理解。以及其它各种你认为有价值的值得记录的事物、',
@@ -983,20 +1388,20 @@ export function apply(ctx) {
       '    ▸ 写法建议：按时间追加，每次记一小节；把"结论/进展"与"理由/证据"分开写；',
       '      悬而未决的问题明确标出。',
       '',
-      '  · Propos/<你>/<id>.md —— **你的命题/引理**。格式：',
+      '  · Members/<你>/Propos/<id>.md —— **你的命题/引理**。格式：',
       '      - ID: p-<id>; - 状态: 未定论; - 概率: <0-1>; - 价值程度: <0-1>; - 动机用途计划: <为何重要/打算怎么用>',
       '      然后 ## 陈述 <完整陈述>；## 证明尝试；## 证伪尝试。',
-      '  · Methods/<你>/<id>.md —— **你的理论/方法/工具**。格式：',
+      '  · Members/<你>/Methods/<id>.md —— **你的理论/方法/工具**。格式：',
       '      - ID: m-<id>; - 状态: 经验; - 可信断言: []; - 价值程度: <0-1>; - 动机用途计划: ...',
       '      然后 ## 核心内容；## 定义与记号；## 应用记录；## 改进历史。',
-      '  · Subproblems/<你>/<id>.md —— **你的子问题**。格式：',
+      '  · Members/<你>/Subproblems/<id>.md —— **你的子问题**。格式：',
       '      - ID: s-<id>; - 状态: 求解中; - 价值程度: <0-1>; - 动机用途计划: ...',
       '      然后 ## 陈述；## 进度。',
       '',
       '  三条硬要求：',
       '   ① 凡入库必须写明 **价值程度 / 动机用途计划 / 你对该对象为真的概率估计**（缺一不可）；',
       '   ② **只写自己的库**；读别人的库是允许且被鼓励的；',
-      '   ③ 推荐**直接用 fs 写你自己的文件**；vibe_v5_record_* 只是便捷记录器，不是必需。',
+      '   ③ 推荐**直接用 fs 写你自己的文件**（路径必须带成员库根，见上：Members/<你>/…）；vibe_v5_record_* 只是便捷记录器，不是必需。',
     ].join('\n')
 
     // Computed per hire (a FUNCTION, not a frozen const): the text names the live
@@ -1149,7 +1554,7 @@ export function apply(ctx) {
       L.push('  2. 只有 Verified/ 目录下的结论（以及成果卡中标注"已验证·真/假"的条目）绝对可信。')
       L.push('     其余一切——他人的推测、你自己的未验结论、Progress/、Methods/ 里的未验证断言——')
       L.push('     都只是经验性参考，引用时必须注明"未验证"。')
-      L.push('  3. 任何人可以读任何人的成果库；你只能写自己的库（Members/<你>/）。')
+      L.push('  3. 任何人可以读任何人的成果库；你只能写自己的库（' + instRel('Members/<你>/') + '）。')
       L.push('  4. 你写下的有价值内容由你自己判断是否入库，但入库必须写明三项：')
       L.push('     价值程度、动机用途计划、你自己对"该对象为真"的概率估计。')
       L.push('  5. 你随时可以在群聊里说话；要单独找人可以私信。需要集体决策就提议开会。')
@@ -1164,8 +1569,10 @@ export function apply(ctx) {
       L.push('')
       // ── 三、libraries ───────────────────────────────────────────────────
       L.push('【三、你的资料库、progress 与卡片格式】')
-      L.push('  你的资料库根目录：Members/' + member.id + '/')
-      L.push('  （以下路径都相对该目录。你**只写这里**，但可以读任何人的对应目录。）')
+      L.push('  你的资料库根目录（**相对会话工作目录**）：' + instRel('Members/' + member.id + '/'))
+      L.push('  （`<你>` = 你自己的成员 id：下面每条都已带完整库根，可直接照抄。你**只写自己的库**，但可以读任何人的对应目录。）')
+      L.push('  ⚠ 路径基准：你自己的文件工具的**相对路径以会话工作目录为基准**，所以直接读写文件时必须用**带库根的完整路径**（把下面每条里的 `Members/<你>/` 展开成你自己的 id，例如 Members/acad/Progress/progress.md）；')
+      L.push('    若只想记录成果，直接用 vibe_v5_record_progress / vibe_v5_record_proposition / vibe_v5_record_method / vibe_v5_record_subproblem，框架会写到正确位置。')
       L.push('')
       L.push(LIB_SPEC)
       L.push('')
@@ -1296,14 +1703,18 @@ export function apply(ctx) {
     // only AFTER the subagent had already been started, every member's induction brief
     // named the PREVIOUSLY founded member (the academician was told it was "?"). The
     // model's whole self-model, its library path and its vote were therefore wrong.
-    function briefBlock(member) {
+    // `roundNo` is an explicit override for the round this block is being built FOR. The founding
+    // prompt needs it: `spawnMember` now counts the round only after `startContinuable` succeeds, so
+    // without the override the very first prompt would announce 轮次 0 instead of 轮次 1 (spawnMember/
+    // G2-class: a failed start must not consume a round, but the first prompt must still show round 1).
+    function briefBlock(member, roundNo) {
       if (!member || typeof member.id !== 'string' || !member.id) {
         throw v5err('V5_INTERNAL', 'briefBlock: a member is required (a status block must never be built for an unknown identity)')
       }
       const ms = activeMembers()
       const b = []
-      b.push('[状态] 你是 ' + member.id + '（' + kindLabel(member.kind) + '）｜轮次 ' + (rounds.get(member.id) || 0) +
-        '｜法定票数 m=' + quorumM() + '｜有表决权者 ' + voterCount() + ' 人')
+      b.push('[状态] 你是 ' + member.id + '（' + kindLabel(member.kind) + '）｜轮次 ' + (roundNo !== undefined ? roundNo : (rounds.get(member.id) || 0)) +
+        '｜法定票数 m=' + (voterCount() > 0 ? quorumM() : '未启动') + '｜有表决权者 ' + voterCount() + ' 人')
       b.push('[在册] ' + (ms.length ? ms.map((x) => x.id).join('、') : '（无）'))
       // Members that are on the books but NOT on the floor. Silently omitting them made a
       // failed provision invisible to the whole institute.
@@ -1335,7 +1746,7 @@ export function apply(ctx) {
           if (t.description) b.push('    ' + String(t.description).split('\n')[0])
         }
       }
-      const pending = pendingFor(member.id)
+      const pending = inboxSuppressed.has(member.id) ? [] : pendingFor(member.id)
       if (pending.length) {
         b.push('[新到的消息/通知]')
         for (const p of pending) b.push('  ' + p.line)
@@ -1459,22 +1870,28 @@ export function apply(ctx) {
       let targets
       if (to === 'all' || to === '') targets = activeMembers().filter((m) => m.id !== from)
       else if (to === 'voters') targets = voters().filter((m) => m.id !== from)
-      else {
+      else if (to === OFFICE_INBOX) {
+        // MEDIUM 4: an office-addressed request. The office has no member id and is never woken,
+        // so this is a durable note the office reads from `status()`/`report()` on its next turn.
+        targets = [{ id: OFFICE_INBOX }]
+      } else {
         const t = memberById(to)
         if (!t || t.phase !== 'active') return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'active member "' + to + '" not found' }
         if (t.id === from) return { ok: false, code: 'V5_SELF_MESSAGE', message: 'cannot message yourself' }
         targets = [t]
       }
       if (!targets.length) return { ok: true, delivered: 0, note: 'no other active member' }
-      const counters = Object.assign({}, inst().counters)
-      let n = Math.max(Number(counters.message) || 0, 0)
       const at = now()
-      for (const t of targets) {
-        n += 1
-        await putMessage({ id: 'msg-' + n, from, to: t.id, kind, text, at })
-      }
-      counters.message = n
-      await putCounters(counters)
+      // HIGH 1 (deep review): the ids are allocated INSIDE the fold and all recipients go into ONE
+      // commit. The old shape read `counters` here, minted `msg-N` locally and awaited one
+      // `putMessage` per recipient: a second same-tick `say` minted the SAME ids, and the
+      // `EV.message` fold deduped them away — the message vanished while this function still
+      // returned `ok:true`.
+      const made = []
+      await putMessageMake((alloc) => {
+        for (const t of targets) made.push({ id: alloc.next('message'), from, to: t.id, kind, text, at })
+        return made
+      })
       // The office talking to the institute is HALF of the `paperEditor='office'` consultation
       // requirement; counting it here (the one place a message really is queued) means the gate
       // cannot be satisfied by merely intending to consult (docs/final-paper.md §7).
@@ -1484,7 +1901,7 @@ export function apply(ctx) {
       // recipient promptly instead of waiting for the digest window. Plain chat stays
       // batched because deliveryDecision gates it — the kick only starts the pass.
       scheduleNext().catch(() => {})
-      return { ok: true, delivered: targets.length, to: targets.map((t) => t.id).join(',') }
+      return { ok: true, delivered: targets.length, to: targets.map((t) => t.id).join(','), ids: made.map((m) => m.id) }
     }
     // A framework NOTICE to one member. This must NOT be sent as the member itself:
     // `say()` refuses a self-addressed message (V5_SELF_MESSAGE), so the previous
@@ -1558,14 +1975,11 @@ export function apply(ctx) {
     // DSH's "names are immortal" rule) so a re-hired temp can never inherit a
     // dismissed member's archives or task ownership.
     async function newMember(kind, opts) {
-      const counters = Object.assign({}, inst().counters)
-      let id
-      if (kind === 'academician') { counters.academician = Math.max(1, Number(counters.academician) || 0); id = 'acad' }
-      else if (kind === 'researcher') { counters.researcher = (Number(counters.researcher) || 0) + 1; id = 'r-' + counters.researcher }
-      else { counters.temp = (Number(counters.temp) || 0) + 1; id = 't-' + counters.temp }
-      await putCounters(counters)
       const member = {
-        id, kind,
+        // HIGH 1: the id is EMPTY here on purpose — the fold's allocator fills it (and bumps
+        // `counters.<kind>`) inside the same commit, so two concurrent hires cannot mint the same
+        // `r-N`/`t-N` and silently overwrite each other's roster entry.
+        id: '', kind,
         childId: '',
         phase: 'provisioning',
         direction: String((opts && opts.direction) || ''),
@@ -1573,17 +1987,21 @@ export function apply(ctx) {
         term: (opts && opts.term) || '',
         provider: String((opts && opts.provider) || 'spawn'),
         // The charter is FROZEN at hire time — it says "你入职时的在册编制（这是一份**快照**）".
-        // It therefore has to be CAPTURED here, not at the first successful spawn: a member
+        // It therefore has to be CAPTURED inside the fold, right after the id is known: a member
         // the host's live-child cap refused is recorded `failed` and only spawned later by
         // `resume`, and rebuilding the charter then would describe the resume-time roster
         // (`memberPersona(member)` would also silently drop any `staffPersona` change).
-        persona: memberPersona({ id, kind, direction: String((opts && opts.direction) || ''), hiredBy: (opts && opts.hiredBy) || '' }),
+        persona: '',
         error: '',
         createdAt: now(),
         dismissedAt: 0,
         dismissReason: '',
       }
-      await putMember(member)
+      await commit(EV.member, { make: (alloc) => {
+        member.id = alloc.next(kind)
+        member.persona = memberPersona(member)
+        return member
+      } })
       return member
     }
     function memberPersona(member) {
@@ -1677,15 +2095,18 @@ export function apply(ctx) {
       wakeKind.set(member.id, kind)
       currentMember = member.id
       lastActiveAt.set(member.id, now())
-      rounds.set(member.id, (rounds.get(member.id) || 0) + 1)
-      roundsSinceCompact.set(member.id, (roundsSinceCompact.get(member.id) || 0) + 1)
+      // G2-class (spawnMember): the counters are COMPUTED here but applied only after `startContinuable`
+      // succeeds (see below). `startRound` is also passed into `initialPrompt` explicitly, so the founding
+      // prompt announces the round it is actually starting instead of 0.
+      const startRound = (rounds.get(member.id) || 0) + 1
+      const startRoundsSinceCompact = (roundsSinceCompact.get(member.id) || 0) + 1
       // The charter is FROZEN at hire time (it is the durable "seal" record and it says
       // "你入职时的在册编制"). Rebuilding it on resume would silently rewrite that
       // hire-time snapshot into a resume-time one and make the sentence untrue. `newMember`
       // captures it, so every member has one by the time it can be spawned.
       const persona = member.persona || memberPersona(member)
       member.persona = persona
-      const prompt = initialPrompt(member, initialTask, mode)
+      const prompt = initialPrompt(member, initialTask, mode, startRound)
       await putMember(member)
       await mkdirs()
       await writeRosterMirror()
@@ -1707,10 +2128,11 @@ export function apply(ctx) {
         // Roll the in-memory marks back so a failed provisioning leaves no phantom
         // "busy, round 1" member behind; the member record itself goes to `failed` and
         // the caller's catch reports it.
+        // The counters are NOT touched: they were never applied on this attempt (they are set only
+        // after a successful start), and the previous rollback used `rounds.delete(...)`, which also
+        // ERASED the count of a member being RESUMED — a failed resume then restarted its numbering.
         busy.delete(member.id)
         wakeKind.delete(member.id)
-        rounds.delete(member.id)
-        roundsSinceCompact.delete(member.id)
         // The host's live-child cap is a HOST limit (maxActiveSubagents on the `subagent` row), not
         // a defect in this member: remember the ceiling, report it BY NAME instead of relaying the
         // opaque host string, and throw the TYPED error so the founding loop / hire / addResearcher
@@ -1718,12 +2140,16 @@ export function apply(ctx) {
         const limitHit = isActivationLimitReached(e)
         if (limitHit) { noteChildLimit(e); noteSpawnLimitOnce(member) }
         const message = limitHit ? activationLimitText(hostChildLimit) : String((e && e.message) || e)
-        await putMember(Object.assign({}, memberById(member.id) || member, { phase: 'failed', error: message }))
+        await putMember(Object.assign({}, memberById(member.id) || member, { phase: 'failed', error: message, failReason: limitHit ? 'activation-limit' : 'other' }))
         if (limitHit) throw v5err('ACTIVATION_LIMIT_REACHED', message)
         throw e
       }
       member.childId = started.childId
       childOwner.set(started.childId, sessionId)
+      // G2-class (spawnMember): the child really exists now, so THIS is the point where the round counts.
+      // A failed/invalid start above left both counters untouched (and no longer erased a resume's count).
+      rounds.set(member.id, startRound)
+      roundsSinceCompact.set(member.id, startRoundsSinceCompact)
       // Register the FOUNDING turn as in-flight, exactly like a normal wake does.
       // Without this the child's first `subagent/end` has no token to match, so
       // onMemberEnd would ignore it: the founding round would never be processed and
@@ -1748,8 +2174,11 @@ export function apply(ctx) {
       wakeKind.set(member.id, kind || 'normal')
       currentMember = member.id
       lastActiveAt.set(member.id, now())
-      rounds.set(member.id, (rounds.get(member.id) || 0) + 1)
-      roundsSinceCompact.set(member.id, (roundsSinceCompact.get(member.id) || 0) + 1)
+      // G2 (F10, ported from v4:1930-1931 — "a failed send must not consume a round"): the two counters
+      // are applied AFTER the successful send (below), not here. The values the soft-compact comparison
+      // would have seen under the old ordering are computed here so the trigger boundary is unchanged.
+      const nextRound = (rounds.get(member.id) || 0) + 1
+      const nextRoundsSinceCompact = (roundsSinceCompact.get(member.id) || 0) + 1
       // Context directives. TWO distinct needs, and confusing them is what made
       // '[核心规则重申]+[CONTEXT COMPACT]' repeat at the head of nearly every prompt
       // (v4 §24.1-③):
@@ -1766,25 +2195,31 @@ export function apply(ctx) {
       // are excluded because their replies are a different shape, and a directive there
       // could never be acknowledged.
       const wake = kind || 'normal'
+      let softInjected = false
       if (wake === 'normal' || wake === 'checkpoint') {
         const soft = (contextPct.get(member.id) || 0) >= Number(params.compactThreshold) ||
-          (roundsSinceCompact.get(member.id) || 0) >= Number(params.compactAfterRounds)
+          nextRoundsSinceCompact >= Number(params.compactAfterRounds)
         if (soft) {
-          prompt = CORE_RULES + '\n[CONTEXT COMPACT — 你的对话已接近上限。不要重新推导历史。\n' +
+          prompt = coreRules() + '\n[CONTEXT COMPACT — 你的对话已接近上限。不要重新推导历史。\n' +
             '请把当前工作状态浓缩成一段自述（已有发现、当前方向、已记录的关键成果、下一步具体动作、未决问题），' +
             '然后照常以 JSON 回答本轮。请在回复里填 "contextPct": 15 与 "compacted": true。]\n\n' + prompt
-          // Reset the counter WITH the injection so the directive cannot repeat on the
-          // very next round even if the member forgets to report `compacted`.
-          roundsSinceCompact.set(member.id, 0)
+          // G2: the reset is applied only AFTER the send succeeds (below). A directive that never
+          // reached the member must not clear the trigger it was asking the member to answer.
+          softInjected = true
         }
       }
       if (needReanchor.has(member.id)) {
-        prompt = CORE_RULES + '\n' + prompt
+        prompt = coreRules() + '\n' + prompt
         needReanchor.delete(member.id)
       }
       try {
         if (typeof subagents.sendMessage !== 'function') throw new Error('no subagents.sendMessage continuation API')
         await subagents.sendMessage(rootAgent, member.childId, [textBlock(prompt)], { signal: makeSignal(params.activityTimeoutMs) })
+        // G2 (F10): the turn is really in flight NOW — only count it here, so a failed/invalid send
+        // leaves both counters untouched (the old code counted before the send AND cleared the
+        // soft-compact trigger on a send that never happened).
+        rounds.set(member.id, nextRound)
+        roundsSinceCompact.set(member.id, softInjected ? 0 : nextRoundsSinceCompact)
         return true
       } catch (e) {
         console.error('vibe-math-v5: wake ' + member.id + ' failed: ' + String((e && e.message) || e))
@@ -1841,6 +2276,12 @@ export function apply(ctx) {
     function replySpec(kind) {
       const L = []
       L.push('结束时请**只**输出一个 JSON 对象（放在 ```json 围栏内，围栏外不要有文字）。支持以下字段，除特别说明外都可省略：')
+      // F2 (deep-review 5): the block below is a FIELD CATALOGUE — it carries `←` explanations and
+      // `|`/`或` value hints, so it is deliberately NOT parseable JSON, while the sentence above
+      // demands "only a JSON object". Saying that out loud (and giving a strictly valid template at
+      // the end of the catalogue) removes the contradiction instead of leaving a model to guess.
+      L.push('（下面是**字段目录**：`←` 后是说明，`|`/`或` 是取值提示，因此这一段并非合法 JSON；'
+        + '**你真正要输出的对象必须严格合法**，最小形态见目录末尾的样例。）')
       L.push('{')
       L.push('  "say": "你想对全所说的话（群聊）"  或  {"to":"r-2","text":"…"}（私信）  或  {"to":"voters","text":"…"}（只对表决者），')
       L.push('  "progress": "本轮进展叙述（会被追加到你的 Progress/progress.md）",')
@@ -1861,7 +2302,7 @@ export function apply(ctx) {
         L.push('  "prioritize": {"order":[{"task_id":"t-1","priority":2}],"why":"…"}   ← 设定全所优先级，')
         L.push('  "nudge": {"to":"r-2","why":"为何督办","next_step":"建议的具体下一步"}，')
       }
-      L.push('  "task_create": {"subject":"…","description":"…","blocked_by":["t-1"],"write_scopes":["Members/r-1/Propos"]},')
+      L.push('  "task_create": {"subject":"…","description":"…","blocked_by":["t-1"],"write_scopes":["' + instRel('Members/r-1/Propos') + '"]},')
       L.push('  "task_claim": "t-3",')
       L.push('  "task_done": "t-3",')
       L.push('  "task_update": {"task_id":"t-3","expected_revision":2,"action":"complete|release|reopen|edit|set_dependencies|delete"},')
@@ -1876,22 +2317,37 @@ export function apply(ctx) {
       L.push('             全体表决者（任务仍会执行，但你的理由不会被埋掉），')
       if (kind !== 'temp') {
         L.push('  "hire": {"purpose":"…","initial_task":"…","direction":"…"}   ← 雇佣一名临时工（说明用途与初始任务），')
-        L.push('  "fire": {"id":"t-2","reason":"…"}                             ← 解雇（雇主/院士；你只能解雇你雇的），')
-      }
-      L.push('  "vote_solved": true|false,   ← 你是否认为**原问题已解决**（会议/结题表决用；必须诚实）')
+        // MEDIUM 5 (deep review): the hint must match the authority matrix EXACTLY. It used to say
+      // "雇主/院士" without the `academicianLeads` precondition, and implied the academician could
+      // dismiss a PERMANENT researcher (only the office can — `fire` refuses otherwise).
+      L.push('  "fire": {"id":"t-2","reason":"…"}                             ← 解雇临时工（仅三种人：雇它的雇主本人、所办、以及 academicianLeads=true 时的院士；**常驻研究员只能由所办解聘**，成员只能向所办提议），')
+      }
+      // P1a (deep-review 4, re-scoped after the lead's correction): the unanimity rule DOES live
+      // in the delivered charter (【十、停止】) and in the meeting frame (:2268), but NOT next to
+      // this per-round field description — a member reading only the reply spec can misjudge what
+      // a partial yes does. One truthful clause, right where the field is described.
+      L.push('  "vote_solved": true|false,   ← 你是否认为**原问题已解决**（会议/结题表决用；必须诚实）。'
+        + '**只要有一位有表决权者没有填 true（漏填或填 false）就不会结题**——本所继续推进；'
+        + '只有全体有表决权者都 true 时才会停止。')
       L.push('  "solved": false,           ← 你这一轮的个人判断（框架据此了解全所收敛度）')
       L.push('  "contextPct": 40,          ← 你当前上下文的占用百分比（0-100）')
       L.push('  "compacted": false          ← 若框架要求你压缩，填 true 并在 progress 里写下浓缩后的工作状态')
       L.push('}')
+      // F2: a strictly valid template, so "only a JSON object" has a concrete, parseable shape even
+      // though the catalogue above is not JSON. Keep it minimal and legal (no comments, no unions).
+      L.push('最小合法样例（可直接照抄，字段可增删）：')
+      L.push('```json')
+      L.push('{"say":"…","progress":"…","solved":false,"contextPct":40}')
+      L.push('```')
       return L.join('\n')
     }
     // Every prompt builder below passes the member it is addressing. There is
     // deliberately NO fallback to "the last member we happened to touch": guessing the
     // identity is what produced the wrong-identity briefs in the first place.
-    function stateBlock(member) {
-      return briefBlock(member)
+    function stateBlock(member, roundNo) {
+      return briefBlock(member, roundNo)
     }
-    function initialPrompt(member, initialTask, mode) {
+    function initialPrompt(member, initialTask, mode, roundNo) {
       const L = []
       const resume = mode === 'resume'
       L.push(resume
@@ -1912,7 +2368,7 @@ export function apply(ctx) {
       if (member.direction && !resume) { L.push('给你的起点方向：' + member.direction); L.push('') }
       mathPushLine(L)
       L.push('------------')
-      L.push(stateBlock(member))
+      L.push(stateBlock(member, roundNo))
       L.push('------------')
       L.push(replySpec(member.kind))
       return L.join('\n')
@@ -1967,6 +2423,14 @@ export function apply(ctx) {
         L.push('')
       } else {
         L.push('（你是本次会议的第一位发言者，目前还没有别人发言。）')
+        // F3 (deep-review 5; v4's counterpart states this): "first speaker" alone left two things
+        // unsaid — when the others' opinions arrive, and how the meeting ends. Both statements below
+        // match the code: `askMeetingRound` wakes up to `maxParallel` members per round and
+        // `continueMeetingRound` keeps collecting until nobody is missing (the stall watchdog
+        // handles a member that never answers), then `finalizeMeeting` writes the minutes.
+        L.push('（流程：框架**每轮最多同时征询 maxParallel 名成员**（默认 3），把**已经收集到的**发言'
+          + '附在唤醒提示里，直到所有在册成员都发过言；卡住的成员由会议看门狗处理。'
+          + '收束时纪要与结论写入 Shared/Meetings/<会议id>.md 并同步到群聊。）')
         L.push('')
       }
       L.push('请就议程发表你的意见。分工、优先级、下一步做什么、是否认为原问题已解决，都可以说。')
@@ -2124,6 +2588,11 @@ export function apply(ctx) {
     const leanInitiative = () => (['off', 'normal', 'eager'].indexOf(String(params.leanInitiative)) !== -1 ? String(params.leanInitiative) : 'normal')
     const leanDailyOn = () => leanInitiative() !== 'off' && (formalOn() || leanInitiative() === 'eager')
     const formalRoot = () => instRoot() + '/Formal'
+    // L1 (deep-review 5): the CWD-RELATIVE spelling of the institute's Lean work directory — the
+    // one a member can actually produce with their own file tools (which resolve against the
+    // session cwd). The prompts advertise THIS, and `leanAbsPath` accepts it as well as the
+    // institute-relative short form (`Formal/x.lean`).
+    const formalRootRel = () => instRootRel() + '/Formal'
     const formalLibRoot = () => vibeRoot() + '/Formal/Lib'
     const formalProvedRoot = () => vibeRoot() + '/Formal/Proved'
     const verifiedLeanRoot = () => instRoot() + '/Verified/Lean'
@@ -2168,7 +2637,14 @@ export function apply(ctx) {
     function leanAbsPath(rel) {
       const raw = String(rel == null ? '' : rel).trim()
       if (!raw) return null
-      const abs = (raw.charAt(0) === '/' || /^[a-z]:/i.test(raw)) ? raw : instRoot() + '/' + raw.replace(/^\.\//, '')
+      // L1 (deep-review 5): BOTH accepted spellings must name the SAME file, because the member
+      // text documents the CWD-relative complete path (what a member's own file tools produce)
+      // while the tools' own short form is institute-relative. Stripping the documented prefix here
+      // is what makes the prompt's path resolvable by the tool that consumes it.
+      const documentedPrefix = instRootRel() + '/'
+      let body = raw.replace(/^\.\//, '')
+      if (body.indexOf(documentedPrefix) === 0) body = body.slice(documentedPrefix.length)
+      const abs = (body.charAt(0) === '/' || /^[a-z]:/i.test(body)) ? body : instRoot() + '/' + body
       const norm = normalizeAbsPath(abs)
       const root = normalizeAbsPath(vibeRoot())
       if (norm !== root && norm.indexOf(root + '/') !== 0) return null
@@ -2273,18 +2749,24 @@ export function apply(ctx) {
     async function formalSetRun(target, run) {
       const t = idSafe(String(target || ''))
       if (!t) return
-      const prev = formalOf(t)
+      // MEDIUM 6 (deep review): the record is built INSIDE the fold (`record` as a function), so a
+      // concurrent writer for the SAME target (e.g. the async Lean queue completing while a sync
+      // run reports) can no longer overwrite it from a stale read.
+      //
       // Running a file NEVER changes an already-decided status: a green run does not by
       // itself make an object `passed` (only archiving a proof does), and a failing scratch
       // run must not silently erase a recorded `passed`/`blocked` decision. Everything else
       // becomes `attempted`, which is the honest "we tried, see the compiler output" state.
-      const keep = (prev.status === 'passed' || prev.status === 'blocked') ? prev.status : 'attempted'
-      await putFormal(t, Object.assign({}, prev, {
-        status: keep,
-        file: run.file || prev.file || '',
-        run: { at: now(), ok: !!run.ok, exitCode: run.exitCode === undefined ? null : run.exitCode, ms: run.ms || 0, stdoutTail: tail(run.stdout, 800), stderrTail: tail(run.stderr, 800) },
-        updatedAt: now(),
-      }))
+      await putFormal(t, (prev0) => {
+        const prev = prev0 || { status: 'none' }
+        const keep = (prev.status === 'passed' || prev.status === 'blocked') ? prev.status : 'attempted'
+        return Object.assign({}, prev, {
+          status: keep,
+          file: run.file || prev.file || '',
+          run: { at: now(), ok: !!run.ok, exitCode: run.exitCode === undefined ? null : run.exitCode, ms: run.ms || 0, stdoutTail: tail(run.stdout, 800), stderrTail: tail(run.stderr, 800) },
+          updatedAt: now(),
+        })
+      })
     }
     // Withdrawing an archived proof means the file must stop looking like the object's proof.
     // The POLICY-COMPLIANT route is an overwrite through the injected `fs` service (it carries
@@ -2321,16 +2803,25 @@ export function apply(ctx) {
       const why = String(note || '').trim()
       if (!t) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'target is required' }
       if (!why) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: "decision='defect' 必须写明 note（具体偏差）" }
-      const prev = formalOf(t)
-      const proofRel = String(prev.proof || ('Verified/Lean/' + t + '.lean'))
-      await putFormal(t, Object.assign({}, prev, {
+      // MEDIUM 6 (deep review): BOTH halves are mutations applied inside the fold — the record
+      // (built from the record the fold sees) and the TODO list (the old shape read
+      // `formalTodo()`, pushed and wrote the array back, so a concurrent writer for another
+      // target lost an entry).
+      const proofRel = String(formalOf(t).proof || ('Verified/Lean/' + t + '.lean'))
+      // Adv-verify S3 (found by `tests/audit-v5-lean-abstention.mjs`): this used to REPLACE the
+      // whole `fidelity` object, so a SECOND member reporting a defect in the same round wiped the
+      // first member's enforced-abstention marker (the audit's "marker length 2" assertion caught
+      // it). The defect fields are updated, the marker history is preserved.
+      await putFormal(t, (prev0) => Object.assign({}, prev0 || { status: 'none' }, {
         status: 'attempted', proof: '', decision: 'defect', note: why,
-        fidelity: { at: now(), by: String(memberId || ''), note: why }, updatedAt: now(),
-      }))
+        fidelity: Object.assign({}, (prev0 && prev0.fidelity) || {}, { at: now(), by: String(memberId || ''), note: why }),
+        updatedAt: now(),
+      }), (todo0) => {
+        const list = (todo0 || []).filter((x) => x.id !== t)
+        list.push({ id: t, at: now(), why: '形式化不合格（忠实性缺陷）：' + why })
+        return list
+      })
       const removed = await removeArchivedProof(proofRel)
-      const list = formalTodo().filter((x) => x.id !== t)
-      list.push({ id: t, at: now(), why: '形式化不合格（忠实性缺陷）：' + why })
-      await putFormal(t, formalOf(t), list)
       await writeFormalTodo()
       await writeFormalIndex()
       // `removeArchivedProof` can fail on a host whose shell cannot delete AND whose
@@ -2560,6 +3051,12 @@ export function apply(ctx) {
           file: job.rel,
           proof: settledOk ? 'Verified/Lean/' + target + '.lean' : '',
           decision: 'used',
+          // L7 (deep-review 5): `decision:'used'` is written by BOTH the member's reply and this
+          // settle path; `decisionSource` says which one. Fallout #4 (F1d): it used to be
+          // WRITE-ONLY — nothing read or asserted it — so it is now part of the readable surfaces
+          // (`status().formal.objects[]`, `vibe_v5_lean_lib.objects`, the report's 形式化决定 line)
+          // and it is asserted by `_oneoff/decision-source.mjs`.
+          decisionSource: 'job-settle',
           note: (String(prev.note || '') + stale).trim(),
           run: job.run, async: asyncRec, updatedAt: now(),
         })
@@ -2603,6 +3100,14 @@ export function apply(ctx) {
     // (the "announcement point is the next prompt" discipline).
     function takeLeanNoticesFor(memberId) {
       if (!leanNotices.length) return []
+      // L8 (deep-review 5): a notice whose member is no longer active can NEVER be delivered — it
+      // used to sit in the 20-slot queue until a newer result evicted it. Prune those first; their
+      // content stays reachable through `status().leanNotices`, `Formal/Jobs/<jobId>.json` and
+      // `vibe_v5_lean_job {jobId}` (see L4), so nothing is lost, only the slot is freed.
+      for (let i = leanNotices.length - 1; i >= 0; i--) {
+        const m = memberById(leanNotices[i].member)
+        if (!m || m.phase !== 'active') leanNotices.splice(i, 1)
+      }
       const mine = leanNotices.filter((n) => n.member === memberId)
       if (!mine.length) return []
       for (const n of mine) { const i = leanNotices.indexOf(n); if (i !== -1) leanNotices.splice(i, 1) }
@@ -2994,7 +3499,12 @@ export function apply(ctx) {
         L.push('  · 形式化只写你有把握的版本；没把握就记 blocked 并写清难点——不要用形式化掩盖不确定。')
         L.push('  · 该对象若已有后台编译在队列中，**不得**在它落地前声称已通过或走忠实性审查；等 vibe_v5_lean_lib 显示 passed 再审。')
         L.push('  · 工具：vibe_v5_lean_run（执行）· vibe_v5_lean_archive（归档）· vibe_v5_lean_lib（查已有可复用库）')
-        L.push('  · 工作目录：Formal/（相对研究所根）；可复用定义放 ' + formalLibRoot().replace(/\\/g, '/') + '/，')
+        // L1 (deep-review 5): the work directory is documented as the CWD-RELATIVE complete path
+        // (what the member's own file tools produce), and the tools accept it as well as the short
+        // `Formal/…` form — the two name the same file (`leanAbsPath` strips the prefix).
+        L.push('  · 工作目录（**相对会话工作目录**，你自己的文件工具按这个基准解析）：' + formalRootRel() + '/')
+        L.push('    （= 研究所根下的 Formal/；v5 工具的 file 参数两种写法都接受：上面这条完整路径，或短的 Formal/xxx.lean。）')
+        L.push('    可复用定义放 ' + formalLibRoot().replace(/\\/g, '/') + '/，')
         L.push('    已证引理放 ' + formalProvedRoot().replace(/\\/g, '/') + '/；写之前先 vibe_v5_lean_lib 查重。')
         L.push('  · **一旦 Lean 通过，你唯一需要确认的就是忠实性**：定义 / 对象 / 条件 / 假设 / 结论是否与')
         L.push('    命题原文逐条一致。请把注意力放在这种核对上，而不是重新做一遍推导。')
@@ -3129,7 +3639,9 @@ export function apply(ctx) {
         return {
           ok: true, async: { jobId: job.jobId, state: 'queued' }, jobId: job.jobId,
           file: pre.rel, target: target || undefined,
-          message: '已入队后台编译；你可以继续工作。结果会写入 Formal/ 与索引，并在下一轮提示里公告；也可用 vibe_v5_lean_lib 的 jobs 字段随时查看。',
+          message: '已入队后台编译；你可以继续工作。结果会写入 Formal/ 与索引，并在**你**下一轮提示里公告一次；'
+            + '长期查询用 vibe_v5_lean_job {jobId} 或 Formal/Jobs/<jobId>.json（vibe_v5_lean_lib 的 jobs 字段也会列出）。'
+            + '注意：公告只投给发起者、且重启后不再补发，所以别的成员（或重启后的你）请用上面两条长期路径查看。',
         }
       }
       const run = await leanRunFile(rel, args.timeout_ms)
@@ -3255,7 +3767,7 @@ export function apply(ctx) {
         // Dedupe (§5.3): the object is already `passed` AND the work file still holds EXACTLY
         // this content ⇒ the compile result is already known: skip rewrite + recompile.
         if (prev.status === 'passed' && (await leanHashFile(workRel)) === sha) {
-          return { ok: true, deduped: true, kind, target, file: workRel, sha256: sha, proof: prev.proof || ('Verified/Lean/' + target + '.lean'), note: '内容与已归档版本一致，跳过重写与重编译' }
+          return { ok: true, deduped: true, kind, target, file: workRel, sha256: sha, proof: prev.proof || ('Verified/Lean/' + target + '.lean'), fidelity: prev.fidelity || null, abstainedCount: Number((prev.fidelity || {}).abstainedCount || 0), note: '内容与已归档版本一致，跳过重写与重编译' }
         }
         if (!await writeTextRel(workRel, body)) return { ok: false, code: 'V5_WRITE_FAILED', message: 'could not write ' + workRel }
         if (params.leanAsync !== false) {
@@ -3280,7 +3792,7 @@ export function apply(ctx) {
             await rebuildLeanLibIndexes()
             await saveChatLine('【形式化】' + memberId + ' 为 ' + target + ' 归档形式化证明 ' + workRel
               + '（已入队后台编译；落地为“通过”之前**不会**写 Verified/Lean/、也不会转为忠实性审查）')
-            return { ok: true, kind, target, file: workRel, sha256: sha, async: { jobId: job.jobId, state: 'queued' }, jobId: job.jobId, status: rec0.status, note: '已入队后台编译；只有作业落地为“通过”才会写 Verified/Lean/ 并转为忠实性审查' }
+            return { ok: true, kind, target, file: workRel, sha256: sha, async: { jobId: job.jobId, state: 'queued' }, jobId: job.jobId, status: rec0.status, fidelity: rec0.fidelity || prev.fidelity || null, abstainedCount: Number(((rec0.fidelity || prev.fidelity) || {}).abstainedCount || 0), note: '已入队后台编译；只有作业落地为“通过”才会写 Verified/Lean/ 并转为忠实性审查' }
           }
           // No toolchain: fall through to the synchronous path (honest NO_SUBPROCESS record).
         }
@@ -3306,7 +3818,7 @@ export function apply(ctx) {
         await rebuildLeanLibIndexes()
         await saveChatLine('【形式化】' + memberId + ' 为 ' + target + ' 归档形式化证明 ' + workRel
           + '（运行 ' + (passed ? '**通过**，已归档到 ' + rec.proof + '，验证转为忠实性审查' : '**未通过**：' + tail(run.stderr || run.message, 160)) + '）')
-        return { ok: true, kind, target, file: workRel, sha256: sha, proof: rec.proof, passed, run, status: rec.status, async: null }
+        return { ok: true, kind, target, file: workRel, sha256: sha, proof: rec.proof, passed, run, status: rec.status, async: null, fidelity: rec.fidelity || prev.fidelity || null, abstainedCount: Number(((rec.fidelity || prev.fidelity) || {}).abstainedCount || 0) }
       }
       if (kind === 'blocked') {
         const target = idSafe(String(args.target || ''))
@@ -3328,9 +3840,12 @@ export function apply(ctx) {
     // A SHORT core-rules recap, injected ONLY (a) right after a REAL compaction, or
     // (b) in the same wake as a soft-compact directive — never on every round. The
     // charter itself lives in `persona` and needs no reinforcement otherwise.
-    const CORE_RULES = '[核心规则] 只有 Verified/（及标记"已验证·真/假"的卡片）算已确立；' +
+    // A function, not a frozen string: the member-facing library path must reflect the LIVE
+    // project/institute (DEFECT A) — a path captured at session creation could point at the
+    // default project after a `configure`.
+    const coreRules = () => '[核心规则] 只有 Verified/（及标记"已验证·真/假"的卡片）算已确立；' +
       '任何对象要进 Verified/，必须至少有 m 名有表决权者投出布尔值（恰好 1 或恰好 0）**且没有任何一张反向票**，否则留库附平均概率；' +
-      '你只写自己的库（Members/<你>/），可只读任何人的库；组织与分派由院士负责，但判断属于你自己；' +
+      '你只写自己的库（' + instRel('Members/<你>/') + '——相对**会话工作目录**），可只读任何人的库；组织与分派由院士负责，但判断属于你自己；' +
       '退出时只输出一个 JSON 对象。'
 
     // ONE place accounts for context usage on EVERY reply (normal, meeting, verify,
@@ -3377,7 +3892,7 @@ export function apply(ctx) {
       return n
     }
     async function publishProgress(memberId, text) {
-      if (!memberId || !memberById(memberId)) return { ok: false, code: 'V5_MEMBER_NOT_FOUND' }
+      if (!memberId || !memberById(memberId)) return memberDiagnosis('记录研究进度（vibe_v5_record_progress）', memberId)
       if (!String(text || '').trim()) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'empty progress' }
       const rel = 'Members/' + memberId + '/Progress/progress.md'
       const prev = (await readTextRel(rel)) || ''
@@ -3390,7 +3905,7 @@ export function apply(ctx) {
     // hard requirements. Missing fields are refused rather than silently defaulted,
     // so the libraries keep their meaning.
     async function recordCard(memberId, kind, o) {
-      if (!memberId || !memberById(memberId)) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no such member' }
+      if (!memberId || !memberById(memberId)) return memberDiagnosis('记录成果卡片（vibe_v5_record_proposition/method/subproblem）', memberId)
       const args = o || {}
       const missing = []
       if (args.value === undefined || args.value === null) missing.push('value（价值程度）')
@@ -3465,10 +3980,9 @@ export function apply(ctx) {
     }
 
     // ---- task board (compare-and-set DAG, ported from DSH agent-teams) ----
-    function nextTaskId() {
-      const c = Number(inst().counters.task) || 0
-      return { id: 't-' + (c + 1), n: c + 1 }
-    }
+    // `t-N` ids are minted by the fold's allocator inside `taskCreate` (HIGH 1); there is no
+    // read-side id preview any more, because an id read outside the fold is exactly what allowed
+    // two concurrent creates to mint the same one.
     // DAG validation: self-reference, duplicates, and missing/deleted blockers are
     // refused up front; a cycle is detected over the WHOLE candidate graph, exactly
     // like the DSH original, so a bad dependency can never be stored.
@@ -3516,11 +4030,8 @@ export function apply(ctx) {
         if (scopes.indexOf(n) === -1) scopes.push(n)
       }
       const blockedBy = (args.blocked_by || args.blockedBy || []).map(String)
-      const { id, n } = nextTaskId()
-      validateDeps(id, blockedBy)
-      const counters = Object.assign({}, inst().counters); counters.task = n
       const task = {
-        id, revision: 1, subject, description,
+        id: '', revision: 1, subject, description,
         status: 'pending', ownerId: '',
         blockedBy, writeScopes: scopes,
         priority: Number.isFinite(Number(args.priority)) ? Number(args.priority) : 0,
@@ -3528,8 +4039,17 @@ export function apply(ctx) {
         assignedBy: '', why: '', acceptance: '',
         createdAt: now(), updatedAt: now(),
       }
-      await putCounters(counters)
-      await putTask(task)
+      // HIGH 1: the id and the `counters.task` bump happen INSIDE the fold. The dependency check
+      // runs there too, against the FINAL id; a rejection returns null so the fold writes nothing
+      // (an earlier shape allocated the id here and committed the bumped counter separately, so
+      // two same-tick creates could mint the same `t-N` and the fold's upsert overwrote one).
+      const got = { err: null }
+      await commit(EV.task, { make: (alloc) => {
+        task.id = alloc.next('task')
+        try { validateDeps(task.id, blockedBy) } catch (e) { got.err = e; return null }
+        return task
+      } })
+      if (got.err) throw got.err
       await writeTaskboardMirror()
       await markProgress()
       notifyActivity()
@@ -3549,11 +4069,14 @@ export function apply(ctx) {
       if (!t) throw v5err('V5_TASK_NOT_FOUND', 'task ' + id + ' not found')
       return taskView(t)
     }
-    async function taskUpdate(memberId, o) {
+    // `meta` is an INTERNAL positional argument (not part of the tool's `args`, so the advertised key
+    // surface of `vibe_v5_task_update` is unchanged): it lets an in-product caller fold extra fields into
+    // the SAME compare-and-set write instead of issuing a second, unprotected one.
+    async function taskUpdate(memberId, o, meta) {
       // An unknown caller must be refused HERE as well: `owner = task.ownerId === memberId` is true
       // for an UNOWNED task (ownerId '') when memberId is '', so without this guard an
       // unidentifiable caller would count as the owner of every unclaimed task (audit L6 follow-up).
-      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
+      if (!memberId) return memberDiagnosis('修改任务（vibe_v5_task_update）', memberId)
       const args = o || {}
       const id = String(args.task_id || args.taskId || '')
       const task = inst().tasks.find((x) => x.id === id)
@@ -3562,7 +4085,10 @@ export function apply(ctx) {
       const expected = Number(args.expected_revision !== undefined ? args.expected_revision : args.expectedRevision)
       if (!Number.isFinite(expected)) return { ok: false, code: 'V5_INVALID_ARGUMENT', message: 'expected_revision is required' }
       if (expected !== task.revision) {
-        return { ok: false, code: 'V5_TASK_STALE_REVISION', message: 'task ' + id + ' is at revision ' + task.revision + ', not ' + expected + ' — re-read it with vibe_v5_task_get' }
+        // F6 (deep-review 5): this message is routed into Chinese frames (`【框架提示】…`), where a
+        // raw English diagnostic reads as noise. The CODE stays (`V5_TASK_STALE_REVISION`) and the
+        // revision numbers stay, but the sentence is Chinese now for the member reading it.
+        return { ok: false, code: 'V5_TASK_STALE_REVISION', message: '任务 ' + id + ' 当前 revision 是 ' + task.revision + '，不是 ' + expected + ' —— 请先用 vibe_v5_task_get 重新读取（code: V5_TASK_STALE_REVISION）' }
       }
       const action = String(args.action || '')
       const office = isOffice(memberId)
@@ -3637,6 +4163,15 @@ export function apply(ctx) {
       } catch (e) {
         return { ok: false, code: e.code || 'V5_INVALID_ARGUMENT', message: String((e && e.message) || e) }
       }
+      // G4: assignment metadata travels INSIDE this CAS-protected write. The old shape wrote the task a
+      // second time afterwards (`putTask(withMeta)`), reusing the revision it had just read and never
+      // bumping it — a concurrent `task_update` landing in that window was silently swallowed and left no
+      // revision trace. Gated to `reassign` so no other action can be given out-of-band fields.
+      if (meta && action === 'reassign') {
+        if (meta.assignedBy !== undefined) next.assignedBy = String(meta.assignedBy)
+        if (meta.why !== undefined) next.why = String(meta.why)
+        if (meta.acceptance !== undefined) next.acceptance = String(meta.acceptance)
+      }
       next.revision = task.revision + 1
       next.updatedAt = now()
       await putTask(next)
@@ -3650,7 +4185,7 @@ export function apply(ctx) {
     // it can never make any statement true, and the assignee may object with reasons
     // (the objection is broadcast, not silently swallowed).
     async function taskAssign(memberId, o) {
-      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
+      if (!memberId) return memberDiagnosis('分派任务（vibe_v5_assign）', memberId)
       if (!isOffice(memberId) && !(isAcademician(memberId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can assign tasks' }
       }
@@ -3677,12 +4212,12 @@ export function apply(ctx) {
       if (cur && (cur.blockedBy || []).length && !taskReady(cur)) {
         return { ok: false, code: 'V5_TASK_BLOCKED', message: 'task ' + taskId + ' still has incomplete blockers' }
       }
-      const r = await taskUpdate(memberId, { task_id: taskId, expected_revision: (cur ? cur.revision : 1), action: 'reassign', owner: to })
+      const r = await taskUpdate(memberId, { task_id: taskId, expected_revision: (cur ? cur.revision : 1), action: 'reassign', owner: to },
+        { assignedBy: isOffice(memberId) ? 'office' : memberId, why, acceptance })
       if (!r.ok) return r
-      const after = inst().tasks.find((t) => t.id === taskId)
-      const withMeta = Object.assign({}, after, { assignedBy: isOffice(memberId) ? 'office' : memberId, why, acceptance })
-      await putTask(withMeta)
-      await writeTaskboardMirror()
+      // G4: NO second write here — the metadata went into the CAS write above (one task commit, so an
+      // interleaved task_update can neither be swallowed nor silently lose its revision).
+      const withMeta = inst().tasks.find((t) => t.id === taskId) || cur
       const assignerIsOffice = isOffice(memberId)
       await say(assignerIsOffice ? 'office' : memberId, {
         to, kind: 'assign',
@@ -3694,7 +4229,7 @@ export function apply(ctx) {
       return { ok: true, task: taskView(withMeta) }
     }
     async function taskPrioritize(memberId, o) {
-      if (!memberId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
+      if (!memberId) return memberDiagnosis('设置任务优先级（vibe_v5_task_prioritize）', memberId)
       if (!isOffice(memberId) && !(isAcademician(memberId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can set priorities' }
       }
@@ -3746,8 +4281,8 @@ export function apply(ctx) {
       const s = inst()
       const lines = ['# 研究所编制表（人读镜像）｜' + instituteName + '｜' + fmtTime(), '',
         '> 权威状态在 State/<研究所>.v5state.json 里；本文件只是快照，勿手改。', '']
-      lines.push('- 求真门槛：m = ' + quorumM() + '（模式 ' + params.quorumMode + '）｜有表决权者 ' + voterCount() + ' 人')
-      lines.push('- 阶段：' + phase + '｜运行中：' + running + '｜已结题：' + autoDone)
+      lines.push('- 求真门槛：' + (voterCount() > 0 ? 'm = ' + quorumM() : '未启动（有表决权者 0 人，m 未定义）') + '（模式 ' + params.quorumMode + '）｜有表决权者 ' + voterCount() + ' 人')
+      lines.push('- ' + phaseFactLine())
       lines.push('')
       lines.push('| 代号 | 职位 | 状态 | 雇主 | 方向/用途 | 轮次 | 上下文% |')
       lines.push('|---|---|---|---|---|---|---|')
@@ -3873,6 +4408,9 @@ export function apply(ctx) {
       }
       const mean = all.length ? all.reduce((a, x) => a + x, 0) / all.length : 0.5
       const base = { m, P, bTrue, bFalse, abstain, mean, votedCount: all.length, voters: E }
+      // DEFECT 2 hardening: with NO voters there is nothing to conclude — every `>= m` test
+      // below would be trivially satisfiable if m were ever 0. Consensus needs voters.
+      if (P === 0) return Object.assign(base, { outcome: 'undecided', reason: 'no voters: the institute has no voting members yet' })
       if (params.quorumMode === 'all-unanimous') {
         const allVoted = E.length > 0 && E.every((id) => votes[id])
         if (!allVoted) return Object.assign(base, { outcome: 'undecided', reason: 'not every voter has voted' })
@@ -4068,16 +4606,27 @@ export function apply(ctx) {
     // reason, put the object on the formalization TODO, and say so in the group chat. The
     // object keeps its mean probability and its debate record, so nothing is lost.
     async function deferForFormal(vs, j, isTrue) {
-      const rec = formalOf(vs.target)
-      const why = 'formal-required：尚未取得 Lean 形式化通过，也没有显式阻塞记录（当前状态 ' + (rec.status || 'none') + '）'
+      // MEDIUM 6 (deep review): both the record and the TODO list are built INSIDE the fold, so a
+      // concurrent writer (a Lean run finishing for another target while this verdict settles)
+      // cannot lose the other's entry.
+      const why = 'formal-required：尚未取得 Lean 形式化通过，也没有显式阻塞记录（当前状态 '
+        + String((formalOf(vs.target).status) || 'none') + '）'
       await writeDebateDoc(vs, false, j)
       await putVerdict(vs.target, Object.assign({}, vs, {
         closed: true, outcome: 'undecided', reason: why, mean: j.mean, formalDeferred: true,
         m: j.m, P: j.P, bTrue: j.bTrue, bFalse: j.bFalse, abstain: j.abstain, closedAt: now(),
+        // LOW (deep review): record the ELECTORATE too. judgeVerdict had it (ase.voters) and
+        // the closed record used to drop it, so a completed decision could not be audited for who
+        // was counted once the roster changed.
+        voters: j.voters,
       }))
-      const list = formalTodo().filter((t) => t.id !== vs.target)
-      list.push({ id: vs.target, at: now(), why, verdict: isTrue ? 1 : 0 })
-      await putFormal(vs.target, rec.status === 'none' ? { status: 'none', deferredAt: now() } : rec, list)
+      await putFormal(vs.target,
+        (prev0) => ((prev0 && prev0.status && prev0.status !== 'none') ? prev0 : { status: 'none', deferredAt: now() }),
+        (todo0) => {
+          const list = (todo0 || []).filter((t) => t.id !== vs.target)
+          list.push({ id: vs.target, at: now(), why, verdict: isTrue ? 1 : 0 })
+          return list
+        })
       await writeFormalTodo()
       await writeFormalIndex()
       await saveChatLine('【形式化】' + vs.target + ' 的表决结果为 ' + (isTrue ? '真' : '假')
@@ -4095,6 +4644,10 @@ export function apply(ctx) {
       await putVerdict(vs.target, Object.assign({}, vs, {
         closed: true, outcome: 'undecided', reason: j.reason, mean: j.mean,
         m: j.m, P: j.P, bTrue: j.bTrue, bFalse: j.bFalse, abstain: j.abstain, closedAt: now(),
+        // LOW (deep review): record the ELECTORATE too. judgeVerdict had it (ase.voters) and
+        // the closed record used to drop it, so a completed decision could not be audited for who
+        // was counted once the roster changed.
+        voters: j.voters,
       }))
       await putDebate({ target: vs.target, at: now(), file: 'Shared/Debates/' + vs.target + '.md', outcome: 'undecided' })
       await saveChatLine('【求真表决】' + vs.target + ' 未达门槛（' + j.reason + '）；留库为未定论，平均概率 ' +
@@ -4112,6 +4665,10 @@ export function apply(ctx) {
       await putVerdict(vs.target, Object.assign({}, vs, {
         closed: true, outcome: isTrue ? 'true' : 'false', mean: isTrue ? 1 : 0,
         m: j.m, P: j.P, bTrue: j.bTrue, bFalse: j.bFalse, abstain: j.abstain, closedAt: now(),
+        // LOW (deep review): record the ELECTORATE too. judgeVerdict had it (ase.voters) and
+        // the closed record used to drop it, so a completed decision could not be audited for who
+        // was counted once the roster changed.
+        voters: j.voters,
       }))
       await putDebate({ target: vs.target, at: now(), file: 'Shared/Debates/' + vs.target + '.md', outcome: isTrue ? 'true' : 'false' })
       await saveChatLine('【求真结论】' + vs.target + ' 经 ' + (isTrue ? j.bTrue : j.bFalse) + ' 名有表决权者一致判' +
@@ -4219,7 +4776,7 @@ export function apply(ctx) {
     // Record one vote and, when every voter has answered, settle the round.
     async function castVerdict(memberId, target, verdict, reason) {
       const member = memberById(memberId)
-      if (!member) return { ok: false, code: 'V5_MEMBER_NOT_FOUND' }
+      if (!member) return memberDiagnosis('投票（vibe_v5_verdict）', memberId)
       if (member.kind === 'temp') {
         // Temp workers have no vote — but their judgement still matters, so it is
         // relayed to the group instead of being silently dropped.
@@ -4245,13 +4802,22 @@ export function apply(ctx) {
     }
 
     // ---- chat log / meeting plumbing --------------------------------------
+    // LOW (deep review): the day's chat MIRROR was an unsynchronized read-modify-write — two lines
+    // produced in the same tick both read `prev`, and the second write dropped the first. Appends
+    // are now serialized through one promise chain (the authoritative record is `inst().messages`;
+    // this file is the human-readable mirror, which is why this is a LOW).
+    let chatChain = Promise.resolve(true)
     async function saveChatLine(text) {
       const line = String(text || '').trim()
       if (!line) return false
       const day = fmtTime().slice(0, 10)
       const rel = 'Shared/Chat/' + day + '.md'
-      const prev = (await readTextRel(rel)) || ('# 研究所群聊记录｜' + instituteName + '｜' + day + '\n\n')
-      return await writeTextRel(rel, prev + '- ' + fmtTime().slice(11) + '｜' + line + '\n')
+      const run = async () => {
+        const prev = (await readTextRel(rel)) || ('# 研究所群聊记录｜' + instituteName + '｜' + day + '\n\n')
+        return await writeTextRel(rel, prev + '- ' + fmtTime().slice(11) + '｜' + line + '\n')
+      }
+      chatChain = chatChain.then(run, run)
+      return await chatChain
     }
     // Wake a member only when it is not already running. Never called while paused
     // (a paused institute must not be nudged into new work — v4 §29-T36).
@@ -4266,7 +4832,12 @@ export function apply(ctx) {
     // meeting request is PARKED (first one wins; later requests do not overwrite it)
     // and resumed once the verification clears. The watchdog clock starts only when
     // the meeting ACTUALLY begins (v4 §26/§27).
-    const solveVotes = new Map()   // memberId -> boolean, for the current solve question
+    // HIGH 3 (deep review): the "is the original problem solved?" tally is DURABLE state
+    // (`inst().solve`), not an in-memory Map. It gates 结题 and is published by status/report, so a
+    // restart or a second session must see the same answers; the old Map made cross-session
+    // unanimity impossible and let the published view disagree with the durable one.
+    const solveVotesOf = () => inst().solve || {}
+    const solveVotesList = () => Object.entries(solveVotesOf()).map(([k, v]) => k + '=' + v)
     async function startMeeting(callerId, opts) {
       const o = opts || {}
       const agenda = String(o.agenda || '').trim()
@@ -4283,8 +4854,11 @@ export function apply(ctx) {
         // r-2 and the voters replied to the wrong person.
         if (callerId) {
           await say(callerId, { to: 'voters', kind: 'voters', text: '提议开会：「' + agenda + '」（' + kind + '）' })
+          // MEDIUM 4: the office is the only other actor allowed to convene, so the proposal is
+          // ALSO addressed to it (voters alone never reached it).
+          await say(callerId, { to: OFFICE_INBOX, kind: 'office-request', text: '请所办裁定：是否召开会议「' + agenda + '」（类型：' + kind + '｜提议人：' + callerId + '）' })
         }
-        return { ok: true, proposed: true, message: '已向院士/所办提议开会（只有院士或所办可以直接召开）' }
+        return { ok: true, proposed: true, message: '已向院士/所办提议开会（只有院士或所办可以直接召开；所办会在 status/report 的 officeRequests 里看到该提议）' }
       }
       if (autoDone) return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'the institute has already concluded; start a new run to convene again' }
       if (!running) return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'the institute is not running' }
@@ -4297,21 +4871,39 @@ export function apply(ctx) {
       }
       return await beginMeeting({ agenda, kind, target: String(o.target || ''), by: office ? 'office' : callerId })
     }
+    // F13 (status/report review): ONE composition for the phase/running/concluded facts, used by
+    // both `report()` and `State/README.md` (`writeStateReadme`) — the two documents used to print
+    // the same three facts with different wording, so a reader had to compare them by hand.
+    function phaseFactLine() {
+      return '阶段：' + phase + '｜运行中：' + (running ? '是' : '否') + '｜已结题：' + (autoDone ? '是' : '否')
+    }
     async function beginMeeting(opts) {
-      const counters = Object.assign({}, inst().counters)
-      counters.meeting = (Number(counters.meeting) || 0) + 1
-      await putCounters(counters)
-      const id = 'mt-' + counters.meeting
       const order = activeMembers().map((m) => m.id)
       // Rotate who speaks first: with a fixed order the same member always speaks
       // before it can see the others (v4 §24.1-④).
       for (let i = order.length - 1; i > 0; i--) { const j = Math.floor(Math.random() * (i + 1)); const t = order[i]; order[i] = order[j]; order[j] = t }
+      const idx = { id: '', agenda: opts.agenda, kind: opts.kind || 'sync', at: 0, file: '' }
+      // HIGH 1: `mt-N` and the `counters.meeting` bump are allocated inside the fold (the old
+      // shape read the counter here and committed it separately, so two concurrent convenings
+      // could both become `mt-3` and the fold's dedupe dropped the second one).
+      await commit(EV.meeting, { make: (alloc) => {
+        idx.id = alloc.next('meeting')
+        idx.at = now()
+        idx.file = 'Shared/Meetings/' + idx.id + '.md'
+        return idx
+      } })
+      const id = idx.id
       meeting = {
         id, agenda: opts.agenda, kind: opts.kind || 'sync', target: opts.target || '',
         by: opts.by || 'office', order, inputs: {}, extras: {}, lastInputAt: now(), startedAt: now(),
       }
-      solveVotes.clear()
-      await putMeeting({ id, agenda: meeting.agenda, kind: meeting.kind, at: now(), file: 'Shared/Meetings/' + id + '.md' })
+      // F6 (status/report review): mark the meeting OPEN durably. `finalizeMeeting` clears it, so a
+      // meeting that never finished (crash/restart/stop) stays visible as "未收束" instead of
+      // silently counting as history with no minutes.
+      await patchInstitute({ meetingOpen: { id, at: now(), agenda: meeting.agenda } })
+      // HIGH 3: a NEW solve question starts with an empty DURABLE tally (a clear has to be
+      // persisted too, otherwise a reload would resurrect the previous question's answers).
+      await putSolve({ clear: true })
       await saveChatLine('【会议 ' + id + '】召开：' + meeting.agenda + '（类型：' + meeting.kind + '｜召集人：' + meeting.by + '）')
       // A meeting that ACTUALLY begins and was convened by the office is the other half of the
       // `paperEditor='office'` consultation requirement (docs/final-paper.md §7). Counted here, not at the
@@ -4395,6 +4987,8 @@ export function apply(ctx) {
     }
     async function finalizeMeeting(mn) {
       meeting = null
+      // F6: the meeting is closed ⇒ clear the durable OPEN marker (see `beginMeeting`).
+      try { await patchInstitute({ meetingOpen: null }) } catch (e) { /* the minutes below matter more */ }
       const lines = []
       for (const id of mn.order) {
         const text = mn.inputs[id]
@@ -4439,7 +5033,8 @@ export function apply(ctx) {
       if (autoDone) return true
       const vs = voters().map((m) => m.id)
       if (!vs.length) return false
-      if (!vs.every((id) => solveVotes.get(id) === true)) return false
+      const sv = solveVotesOf()
+      if (!vs.every((id) => sv[id] === true)) return false
       // ── THE FINAL PAPER PHASE COMES FIRST (docs/final-paper.md §3) ────────────────────────────────
       // `finishRun` flips phase='solved' / autoDone / running=false, after which the machinery
       // REFUSES: `wakeIfIdle` returns false, `startMeeting` rejects a concluded institute and
@@ -4461,7 +5056,9 @@ export function apply(ctx) {
       const m = memberById(memberId)
       if (!m) return
       if (m.kind === 'temp') return   // no vote
-      solveVotes.set(memberId, val === true)
+      // HIGH 3: the answer is committed to the durable tally (it survives a reload and is visible
+      // to a second session), not to a process-local Map.
+      await putSolve({ member: memberId, value: val === true })
       // Evaluate the stop condition on EVERY solve vote, not only when a meeting
       // finalizes. A vote that lands after the meeting closed — a late reply, or an
       // ordinary round carrying vote_solved — would otherwise be recorded and never
@@ -4528,13 +5125,23 @@ export function apply(ctx) {
       await patchInstitute({ paper: (cur) => { const next = fn(cur === undefined ? null : cur); return next === undefined ? (cur === undefined ? null : cur) : next } })
       return paper()
     }
+    // F6 (v4-G3's v5 cousin): ONE named warning per failed REQUIRED artifact write. `files` stays the
+    // honest list of what actually landed, and the recovery path is the idempotent refill
+    // (`refillPaperArtifacts`, reached by re-triggering the paper) which only writes what is missing.
+    function paperWriteFailureWarning(names) {
+      return '产物写入失败（未落盘）：' + names.join('、') + ' —— 它们不在本次定稿的 files 产物清单里；' +
+        '重跑同一篇论文（/v5 paper，幂等）会由 refillPaperArtifacts 只补写缺失产物。'
+    }
     async function paperLog(title, body) {
       const p = paper()
       const id = (p && p.id) || paperIdFromState()
       const rel = PAPER_FILE(id, 'paper.log.md')
       const prev = (await readTextRel(rel)) || ('# 最终论文流程日志｜' + id + '\n\n')
-      await writeTextRel(rel, prev + '## ' + title + '\n\n' + String(body || '') + '\n\n')
-      return rel
+      // F6: the outcome is RETURNED so the finalisation can turn a failure into a named warning. It used
+      // to be discarded, which is how a "finalized" paper could be announced without its log and with no
+      // trace in `warnings`. No caller read the old `rel` return value.
+      const ok = await writeTextRel(rel, prev + '## ' + title + '\n\n' + String(body || '') + '\n\n')
+      return { rel, ok }
     }
     function paperAskEvery() { return posMs(params.activityTimeoutMs, 120000) }
     function paperNextStep(p) {
@@ -4578,7 +5185,7 @@ export function apply(ctx) {
       L.push('【最终论文·撰写 —— ' + kindLabel(member.kind) + ' ' + member.id + '】')
       L.push('本所对原问题的一致结论已经达成，现在撰写**最终论文**（第 ' + p.round + '/' + PAPER_MAX_ROUNDS + ' 轮）。')
       L.push('请你**只写你自己库里已有证据支撑**的内容：')
-      L.push('- 直接引用你的卡片（Members/' + member.id + '/Propos|Methods|Subproblems/）、Members/' + member.id + '/Progress/progress.md、你参与的表决记录；')
+      L.push('- 直接引用你的卡片（' + instRel('Members/' + member.id + '/Propos|Methods|Subproblems/') + '）、' + instRel('Members/' + member.id + '/Progress/progress.md') + '、你参与的表决记录；')
       L.push('- **不得编造**：没有证据的推测不要写成结论；未决 / 被否证的条目必须显式标注“未定论 / 已被否证”；')
       L.push('- 在 evidence 里写清证据路径，附录会逐条索引。')
       if (p.round > 1) {
@@ -4598,7 +5205,7 @@ export function apply(ctx) {
       L.push('    "methods": "你创造/发现的方法、理论、思想、有价值经验、数学理解",')
       L.push('    "rules": "你从这些工作中归纳出的可复用规律",')
       L.push('    "limits": "局限、未决、被否证之处（必须诚实、显式）",')
-      L.push('    "evidence": ["Members/' + member.id + '/Propos/p-x.md"] } }')
+      L.push('    "evidence": ["' + instRel('Members/' + member.id + '/Propos/p-x.md') + '"] } }')
       return L.join('\n')
     }
     function paperReviewPrompt(member, p, ofId) {
@@ -5024,8 +5631,10 @@ export function apply(ctx) {
       }
       if (ev.formalKeys.length) out.push('Formal/Index.md', 'Formal/TODO.md')
       for (const m of ev.members) {
-        out.push('Members/' + m.id + '/Progress/progress.md（' + m.id + ' 的研究日志）')
-        out.push('Members/' + m.id + '/{Propos,Methods,Subproblems}/（' + m.id + ' 的卡片）')
+        // Member-facing evidence paths are CWD-relative (DEFECT A): a member copying one of these
+        // into its own file tool must not create a stray `<cwd>/Members/…` tree.
+        out.push(instRel('Members/' + m.id + '/Progress/progress.md') + '（' + m.id + ' 的研究日志）')
+        out.push(instRel('Members/' + m.id + '/{Propos,Methods,Subproblems}/') + '（' + m.id + ' 的卡片）')
       }
       out.push('Institutes.md（编制镜像）', 'Shared/TaskBoard.md（任务板镜像）')
       out.push('Paper/' + p.id + '/paper.log.md（本论文流程往来）')
@@ -5351,13 +5960,18 @@ export function apply(ctx) {
       const finalizedAt = now()
       const S = paperSections(p, active, skipped, ev, { final: p.final, conclusionText })
       const files = []
+      // F6: every REQUIRED artifact write is checked. A failure does NOT block finalisation (the paper
+      // is still delivered from whatever landed) but it must be NAMED, not silently dropped from `files`.
+      const writeFailures = []
       if (p.format !== 'tex') {
         if (await writeTextRel(PAPER_FILE(id, 'paper.md'), renderPaperMd(p, S))) files.push('paper.md')
+        else writeFailures.push('paper.md')
       }
       let tex = ''
       if (p.format !== 'md') {
         tex = renderPaperTex(p, S)
         if (await writeTextRel(PAPER_FILE(id, 'paper.tex'), tex)) files.push('paper.tex')
+        else writeFailures.push('paper.tex')
       }
       // `paperFormat=md` with `paperCompilePdf=true` must NOT warn about a missing tex: no tex
       // was produced, so compilation is skipped silently (docs/final-paper.md §8).
@@ -5373,11 +5987,17 @@ export function apply(ctx) {
       const warnings = (p.warnings || []).slice()
       if (compile.status === 'failed') warnings.push('LaTeX 编译失败（已保留 paper.tex 与 paper.md，不阻塞定稿）：' + (compile.attempts || []).map((a) => a.engine + '/' + a.label + ' exit=' + a.exitCode + (a.message ? '(' + a.message + ')' : '')).join('；'))
       if (compile.status === 'not-detected') warnings.push('未检测到 LaTeX 引擎（' + (compile.reason || '') + '）：只交付 paper.tex 与 paper.md。')
+      // F6: the failed REQUIRED writes are named ONCE (for this finalisation), before the meta is built,
+      // so the warning lands in `meta.warnings`, in the flow log, in the state and in the return value.
+      if (writeFailures.length) warnings.push(paperWriteFailureWarning(writeFailures))
       const meta = paperMeta(Object.assign({}, p, { finalizedAt, compile: compile.status, engine: compile.engine || '' }), {
         finalizedAt, warnings, compile: { status: compile.status, engine: compile.engine || '', reason: compile.reason || '', attempts: compile.attempts || [] }, files,
       })
       if (await writeTextRel(PAPER_FILE(id, 'paper.meta.json'), JSON.stringify(meta, null, 2) + '\n')) files.push('paper.meta.json')
-      await paperLog('定稿（' + reason + '）', [
+      // `meta.warnings` is the SAME array, so a meta write failure still reaches the state, the log and
+      // the tool's return value even though the file that should have carried it is the one missing.
+      else warnings.push(paperWriteFailureWarning(['paper.meta.json']))
+      const logRes = await paperLog('定稿（' + reason + '）', [
         '- 目录：Paper/' + id + '/',
         '- 产物：' + files.join('、'),
         '- 编译：' + compile.status + (compile.engine ? '（' + compile.engine + '）' : '') + '｜尝试 ' + (compile.attempts || []).length + ' 次',
@@ -5386,6 +6006,14 @@ export function apply(ctx) {
         (p.final && p.final.note ? '- 定稿说明：' + p.final.note : ''),
         (warnings.length ? '- 警告：\n  - ' + warnings.join('\n  - ') : ''),
       ].filter(Boolean).join('\n'))
+      // F6: a failed flow-log write is named too — the log is a required artifact of the paper flow. The
+      // meta is REWRITTEN here because it was serialised BEFORE this attempt: without the rewrite the
+      // durable meta would be the one artifact whose `warnings` does not mention the missing log. (If the
+      // meta path is refused as well the rewrite fails silently — its own warning is already recorded.)
+      if (!logRes.ok) {
+        warnings.push(paperWriteFailureWarning(['paper.log.md']))
+        await writeTextRel(PAPER_FILE(id, 'paper.meta.json'), JSON.stringify(meta, null, 2) + '\n')
+      }
       await mutatePaper((cur) => (cur ? Object.assign({}, cur, {
         status: 'finalized', stage: 'finalized', finalizedAt, compile: compile.status,
         engine: compile.engine || '', warnings, artifacts: files, updatedAt: now(),
@@ -5402,6 +6030,10 @@ export function apply(ctx) {
     }
 
     // ---- hire / fire -------------------------------------------------------
+    // INVARIANT (HIGH 2): an ACTIVE temp always has an ACTIVE employer — `fire` dismisses a
+    // member's temps with it (`dismissTempsOf`), and the office idempotently catches up on state
+    // written before that cascade existed. `maxTempTotal` is therefore counted exactly over the
+    // temps a running institute can still use.
     function employedTemps() { return activeMembers().filter((m) => m.kind === 'temp') }
     // ANY academician or permanently-employed researcher may hire its own temp
     // workers, and may fire the ones it hired. This is the requirement the official
@@ -5431,11 +6063,12 @@ export function apply(ctx) {
       try {
         await spawnMember(member, initialTask)
       } catch (e) {
-        await putMember(Object.assign({}, memberById(member.id) || member, { phase: 'failed', error: String((e && e.message) || e) }))
+        await putMember(Object.assign({}, memberById(member.id) || member, { phase: 'failed', error: String((e && e.message) || e), failReason: isActivationLimitReached(e) ? 'activation-limit' : 'other' }))
         // Name the host's live-child cap (maxActiveSubagents) instead of relaying its opaque
         // "subagent limit reached (active child limit: N)" string, and use the typed code so the
-        // hirer can tell a HOST ceiling from a broken provider.
-        if (isActivationLimitReached(e)) { noteChildLimit(e); return { ok: false, code: 'ACTIVATION_LIMIT_REACHED', message: '临时工创建失败：' + activationLimitText(hostChildLimit) } }
+        // hirer can tell a HOST ceiling from a broken provider. The durable `failReason` above is
+        // what `retryPendingSpawns()` (G-6) reads to re-create this temp when capacity frees up.
+        if (isActivationLimitReached(e)) { noteChildLimit(e); return { ok: false, code: 'ACTIVATION_LIMIT_REACHED', message: '临时工创建失败：' + activationLimitText(hostChildLimit) + '（已登记为待补建：容量释放后框架会在下一次调度轮次自动重试）' } }
         return { ok: false, code: 'V5_PROVISIONING_CONFLICT', message: '临时工创建失败：' + String((e && e.message) || e) }
       }
       await saveChatLine('【雇佣】' + (office ? '所办' : callerId) + ' 雇入临时工 ' + member.id + '，用途：' + purpose)
@@ -5443,26 +6076,55 @@ export function apply(ctx) {
       notifyActivity()
       return { ok: true, id: member.id, kind: 'temp', purpose, note: '现在可以用 vibe_v5_say {to:"' + member.id + '"} 或 vibe_v5_assign 给它派活' }
     }
+    // HIGH 2 (deep review): a dismissed member's TEMP WORKERS are dismissed WITH IT. They carry
+    // `hiredBy: <employer id>`, so once the employer is dismissed the employer check
+    // (`target.hiredBy === callerId`) can never match again — only the office could ever clear
+    // them — while `employedTemps()` kept counting them against `maxTempTotal` and the scheduler
+    // kept waking them (a dismissed member's team quietly burning budget). The rule is explicit:
+    // **a member's temps belong to that member's tenure**. The cascade is one level deep because
+    // temps may not hire (`hire` refuses a temp caller), so no deeper recursion is possible.
+    async function dismissTempsOf(employerId, callerId, note) {
+      const mine = inst().members.filter((m) => m.kind === 'temp' && m.phase === 'active' && m.hiredBy === employerId)
+      const done = []
+      for (const t of mine) {
+        const r = await fire(callerId, { id: t.id, reason: note })
+        if (r && r.ok) done.push(t.id)
+      }
+      return done
+    }
     // Firing is REAL: the current turn is cancelled, the resident continuable child is
-    // released, its tasks are reclaimed, its queued mail is dropped and it is marked
-    // dismissed. Its id is never reused, so a re-hire can never inherit its archives.
+    // released, its tasks are reclaimed, its queued mail is dropped, its own temp workers are
+    // dismissed with it, and it is marked dismissed. Its id is never reused, so a re-hire can
+    // never inherit its archives.
     async function fire(callerId, o) {
       const args = o || {}
       const id = String(args.id || args.member || '').trim()
       const target = memberById(id)
       if (!target) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no such member ' + id }
-      if (target.phase === 'dismissed') return { ok: true, already: true, message: id + ' 已被解雇' }
+      if (target.phase === 'dismissed') {
+        // Idempotent cleanup for state written before the cascade existed (or a hand-edited
+        // file): only the office may act here, because a dismissed non-temp target skips the
+        // permission check below.
+        const cleaned = isOffice(callerId) ? await dismissTempsOf(id, callerId, '雇主已被解雇（补做级联）') : []
+        return { ok: true, already: true, cascadedTemps: cleaned, message: id + ' 已被解雇' }
+      }
       const office = isOffice(callerId)
       const acad = isAcademician(callerId)
       const allowed = office || (acad && params.academicianLeads && target.kind === 'temp') || (target.kind === 'temp' && target.hiredBy === callerId)
       if (!allowed) {
-        return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: '你只能解雇你雇的临时工；解雇他人雇的或常驻研究员需由院士/所办执行' }
+        // MEDIUM 5 (deep review): the refusal names the ACTUAL matrix. The old text promised the
+        // academician a power it only has when `academicianLeads` is on, and implied it could
+        // dismiss a permanent researcher (it cannot — see the next guard).
+        return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: '拒绝：能解雇它的只有 ①所办 ②该临时工的雇主本人 ③academicianLeads=true 时的院士（且仅限临时工）；常驻研究员只能由所办解聘，成员只能向所办提议' }
       }
       if (target.kind !== 'temp' && !office) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: '解聘常驻研究员只能向所办提议，由所办批准（成员不能直接执行）' }
       }
       const reason = String(args.reason || '').trim()
       const reclaimed = await releaseTasksOf(id, 'dismissed: ' + reason)
+      // Cascade BEFORE the employer is marked dismissed: the temps are still reachable and the
+      // caller's authority (office / leading academician) is the same one that dismissed them.
+      const cascaded = target.kind === 'temp' ? [] : await dismissTempsOf(id, callerId, '雇主 ' + id + ' 被解雇（级联）')
       if (target.childId) {
         try { if (typeof subagents.interrupt === 'function') subagents.interrupt(target.childId, { kind: 'ancestor', agent: rootAgent }) } catch (e) { /* fire-and-return */ }
         try {
@@ -5473,7 +6135,9 @@ export function apply(ctx) {
         liveAgents.delete(target.childId)
       }
       busy.delete(id)
-      solveVotes.delete(id)
+      // HIGH 3: withdraw the dismissed member's durable solve answer, exactly like its ballot is
+      // dropped from every open verdict below (an answer from a former member must not carry).
+      await putSolve({ member: id, value: null })
       rounds.delete(id)
       roundsSinceCompact.delete(id)
       contextPct.delete(id)
@@ -5501,14 +6165,15 @@ export function apply(ctx) {
       }))
       await writeRosterMirror()
       await saveChatLine('【解雇】' + id + ' 已由 ' + (office ? '所办' : callerId) + ' 解雇（原因：' + (reason || '未说明') +
-        '）。代号永不复用；其未完成任务已收回' + (reclaimed.length ? '（' + reclaimed.join('、') + '）' : '') + '。')
+        '）。代号永不复用；其未完成任务已收回' + (reclaimed.length ? '（' + reclaimed.join('、') + '）' : '') +
+        (cascaded.length ? '；随其解雇的临时工 ' + cascaded.join('、') + '（雇主离场 ⇒ 其临时工一并解雇）' : '') + '。')
       await markProgress()
       notifyActivity()
       await scheduleNext()
-      return { ok: true, dismissed: id, reclaimedTasks: reclaimed, reason }
+      return { ok: true, dismissed: id, reclaimedTasks: reclaimed, cascadedTemps: cascaded, reason }
     }
     async function nudge(callerId, o) {
-      if (!callerId) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
+      if (!callerId) return memberDiagnosis('督办（vibe_v5_nudge）', callerId)
       if (!isOffice(callerId) && !(isAcademician(callerId) && params.academicianLeads)) {
         return { ok: false, code: 'V5_NOT_ACADEMICIAN', message: 'only the academician (or the office) can nudge members' }
       }
@@ -5539,13 +6204,36 @@ export function apply(ctx) {
     // prepended inbox block and once inside its own [状态] block.
     async function promptFor(member, baseFn) {
       const pending = pendingFor(member.id)
-      const inbox = pending.length ? composeInbox(pending) : ''
-      if (pending.length) await ackPending(pending)
-      const base = typeof baseFn === 'function' ? baseFn() : baseFn
-      return (inbox ? inbox + '\n\n' : '') + base
+      // G1: only NEWLY pending messages are prepended. A second build before the wake must not repeat the
+      // inbox block (the duplicate-read defect), and the mark is what makes that true while the ack is
+      // deferred to the wake.
+      const seen = inboxInjected.get(member.id) || new Set()
+      const fresh = pending.filter((p) => !seen.has(p.id))
+      const inbox = fresh.length ? composeInbox(fresh) : ''
+      if (fresh.length) { for (const p of fresh) seen.add(p.id); inboxInjected.set(member.id, seen) }
+      // While a block IS being prepended, the base build must not embed the same mail a second time
+      // (briefBlock's `[新到的消息/通知]`). When nothing is prepended the base block still shows whatever
+      // is pending — so a member reads each message exactly once either way.
+      if (inbox) inboxSuppressed.add(member.id)
+      let base
+      try { base = typeof baseFn === 'function' ? baseFn() : baseFn }
+      finally { inboxSuppressed.delete(member.id) }
+      // G1 (mailbox): the pending list is RETURNED, not acked here — the ack moved to wakeWithInbox,
+      // after the send actually succeeded. Acking at prompt-build time removed the messages from
+      // `messages` (EV.delivered) BEFORE the send, so a failed/invalid wake lost them silently.
+      return { text: (inbox ? inbox + '\n\n' : '') + base, pending }
     }
     async function wakeWithInbox(member, baseFn, kind) {
-      return await wakeMember(member, await promptFor(member, baseFn), kind)
+      // G1 (mailbox) invariant: "not acked => still redeliverable". `wakeMember` returns false when it
+      // never sent (no childId / member not active) or when `sendMessage` threw, so acking only on
+      // `ok` keeps the message in the durable queue for the next successful wake.
+      const prompt = await promptFor(member, baseFn)
+      const ok = await wakeMember(member, prompt.text, kind)
+      // The attempt is concluded either way: drop the injection mark so the NEXT attempt re-prepends
+      // whatever is still pending (a failed wake must not leave the message suppressed for ever).
+      inboxInjected.delete(member.id)
+      if (ok && prompt.pending.length) await ackPending(prompt.pending)
+      return ok
     }
 
     // ---- scheduling / graded keep-alive (ported and upgraded from v4 §25) ---
@@ -5564,7 +6252,13 @@ export function apply(ctx) {
       }
       if (cur && cur.project) project = cur.project
       if (cur && cur.institute) instituteName = cur.institute
-      if (cur) phase = cur.phase || phase
+      if (cur) {
+        phase = cur.phase || phase
+        // S1: keep the concluded marker in sync with the persisted phase on EVERY sync (this is
+        // the path `status()`/`report()`/`configure()` go through), so no view can show a
+        // concluded institute as ongoing, or vice versa.
+        autoDone = String(phase) === 'solved'
+      }
     }
     // Scheduling TRAMPOLINE. The consensus finalizers call `scheduleNext()` themselves
     // (a settled verification should immediately drive whatever comes next), so a
@@ -5590,8 +6284,78 @@ export function apply(ctx) {
         scheduling = false
       }
     }
+    // ---- G-6 (installer review): refused member spawns are DEFERRED, not lost ----------------
+    // v4 queued a cap-refused spawn in `pendingSpawns` and retried it on the next heartbeat; v5 had
+    // no such queue (only the manual `resume` path retried cap-class failures), so a refusal whose
+    // capacity later freed up produced "nothing happens". The queue here is DERIVED from durable
+    // state instead of being a second source of truth: a refused member is already persisted as
+    // `phase:'failed'` with `failReason:'activation-limit'`, so a restart cannot lose the intent and
+    // a successful retry clears it by construction (the member becomes `active`). Only the bounded
+    // attempt counter is session memory.
+    // Only the attempt counter is session memory; the queue itself derives from durable state. The
+    // retry is bounded by the STOPPING RULE, not by a session counter (v4's shape): a still-capped
+    // member IS retried on the next pass — that attempt is free, because `spawnMember` answers from
+    // the recorded ceiling without asking the host (v5:2037) — while any NON-capacity provisioning
+    // error stops the auto-retry for that member (a broken provider must not be resurrected).
+    const spawnRetryAttempts = new Map()
+    // ONE predicate for "this member was refused by the host's live-child CAP" — used by the
+    // automatic retry here AND by `resume`'s rebuild path, so the two can never disagree about
+    // which failures are deferred work (an ordinary broken-provider failure must never be
+    // resurrected). The explicit durable `failReason` is checked first; the recorded error text is
+    // the fallback for records written before it existed / by paths that only had the message.
+    function isCapRefusedMember(m) {
+      if (!m || m.phase !== 'failed') return false
+      if (m.failReason === 'activation-limit') return true
+      // TEST SEAM (documented; NOT a product surface): with the text fallback disabled, ONLY the
+      // durable reason counts — running the same scenario with `V5_SPAWN_RETRY_STRICT=1` proves that
+      // every cap-refusal path records `failReason` and that no behaviour depends on error-string
+      // matching. Read per call so a suite can toggle it around one scenario.
+      if (String(process.env.V5_SPAWN_RETRY_STRICT || '') === '1') return false
+      return /active child limit|maxActiveSubagents/.test(String(m.error || ''))
+    }
+    function pendingSpawnMembers() {
+      return inst().members.filter((m) => isCapRefusedMember(m) && !m.childId)
+    }
+    async function retryPendingSpawns() {
+      // TEST SEAM (documented; NOT a product surface): `V5_SPAWN_RETRY=manual` disables the
+      // automatic retry for this process, so a suite can pin the MANUAL `resume` rebuild path
+      // without racing the scheduler. Read per call, so a test can toggle it around one section.
+      if (String(process.env.V5_SPAWN_RETRY || '').toLowerCase() === 'manual') return 0
+      if (!running || autoDone) return 0
+      const pending = pendingSpawnMembers()
+      if (!pending.length) return 0
+      let spawned = 0
+      for (const m of pending) {
+        const n = spawnRetryAttempts.get(m.id) || 0
+        spawnRetryAttempts.set(m.id, n + 1)
+        try {
+          await spawnMember(m, null)
+          spawnRetryAttempts.delete(m.id)
+          spawned += 1
+          await saveChatLine('【编制】容量已释放：重试创建成员 ' + m.id + ' 成功（第 ' + (n + 1) + ' 次尝试）。')
+          await markProgress()
+        } catch (e) {
+          // Still capped: keep it queued and re-check on the next pass. Any OTHER provisioning error
+          // is not a capacity problem — stop auto-retrying it (the operator gets a notice instead).
+          if (!isActivationLimitReached(e)) {
+            spawnRetryAttempts.delete(m.id)
+            await notice('office', '成员 ' + m.id + ' 的自动重试已停止（非容量类失败）：' + String((e && e.message) || e))
+          }
+        }
+      }
+      return spawned
+    }
     async function schedulePass() {
       dbg.passes += 1
+      // MEDIUM 8 (deep review): EVERY scheduling pass reads state, and a pass can be armed by a
+      // timer or an event callback that never went through a tool wrapper. Awaiting the load here
+      // is what makes the internal paths safe by construction instead of by convention (a pass
+      // fired before the state file was folded in would otherwise see an empty roster and could
+      // schedule against it).
+      if (!loadSettled) { try { await ready() } catch (e) { /* the pass still runs; status reports it */ } }
+      // G-6: deferred spawns are retried BEFORE anything else is scheduled, so freed capacity is
+      // spent on the work the cap previously refused (v4's `retryPendingSpawns()` position).
+      try { await retryPendingSpawns() } catch (e) { console.error('vibe-math-v5: pending-spawn retry failed: ' + String((e && e.message) || e)) }
       clearHeartbeat()
       syncParamsFromState()
       // A verification that is ALREADY in flight is served first: the two coordination
@@ -5720,6 +6484,10 @@ export function apply(ctx) {
     // one path and silently dropped on another.
     async function handleReply(member, parsed, kind) {
       const p = parsed || {}
+      // L2 option A (user decision): objects for which THIS reply recorded a fidelity defect. The
+      // ballot for such an object counts as an abstention (see the verdict branch below). Scoped to
+      // one reply on purpose — no cross-round state.
+      const defectTargetsThisReply = new Set()
       postmark(member, p)
       // (1) speech  (named `speech`, not `s`: `s` is the session API in this scope)
       const speech = p.say
@@ -5773,17 +6541,51 @@ export function apply(ctx) {
       // `formalOn()` gates it: off mode is a TRUE no-op, and the field is not even offered in the
       // reply contract there, so a stray / stale / hallucinated reply must not create Lean state.
       // (The TOOLS stay usable in off mode on purpose — a tool call is deliberate.)
-      if (formalOn() && p.formal && typeof p.formal === 'object') {
-        const f = p.formal
-        const target = idSafe(String(f.target || ''))
-        if (target) {
-          const decision = String(f.decision || '').trim()
+      // Adv-verify F2 (LOW): `formal` may be an ARRAY of entries (a member recording defects for two
+      // objects in one reply). The old code read `p.formal.target` only, so an array was silently
+      // ignored — no notice, no enforced abstention, and the same reply's `1` counted (exactly the
+      // hole L2 closed). The array form is now SUPPORTED entry by entry; a non-object entry is
+      // refused loudly instead of being dropped in silence.
+      // NOTE: the gate below keeps its literal two-term shape on purpose — `audit-prompt-invariants`
+      // I8 matches that EXACT source text ("off must be a TRUE no-op"), and the first version of this
+      // fix (a ternary on `formalOn()`) broke the invariant while behaving identically. The array
+      // normalisation therefore lives INSIDE the guarded block, after the gate.
+      // (This comment deliberately does NOT spell the pattern out: I8 reads the RAW source, so a
+      // comment quoting the gate would satisfy the invariant even with the gate removed — the mutant
+      // `M1` in `tests/audit-v5-lean-abstention.mutants.mjs` is what keeps this honest.)
+      if (formalOn() && p.formal) {
+        const formalEntries = Array.isArray(p.formal) ? p.formal : (typeof p.formal === 'object' ? [p.formal] : [])
+        for (const f of formalEntries) {
+          if (!f || typeof f !== 'object') {
+            await notice(member.id, 'formal 的每个条目都必须是对象（收到 ' + JSON.stringify(f) + '）——本条已忽略。')
+            continue
+          }
+          const target = idSafe(String(f.target || ''))
+          if (!target) {
+            await notice(member.id, 'formal 条目缺少 target（对象 id）——本条已忽略。')
+            continue
+          }
+          {
+            const decision = String(f.decision || '').trim()
           const note = String(f.note || '').trim()
           if (decision === 'blocked' || decision === 'defect') {
             if (!note) await notice(member.id, "formal.decision='" + decision + "' 必须写明 note（难度判断/阻塞原因/具体偏差）——本次未记录。")
             else if (decision === 'defect') {
               const r = await recordFidelityDefect(member.id, target, note)
               if (r.ok === false) await notice(member.id, '记录忠实性缺陷失败（' + (r.code || '') + '）：' + (r.message || ''))
+              else {
+                // L2 option A (user decision): a reply that RECORDS a fidelity defect for an object
+                // must not also assert that object true in the same round. The framework therefore
+                // counts THIS member's verdict for THIS object as an ABSTENTION (the verdict branch
+                // below reads `defectTargetsThisReply`). Only the declaring member and only this
+                // round are affected: no cross-round state, no gate change, other ballots untouched.
+                defectTargetsThisReply.add(target)
+                // Observable note (the member must not be silently overridden): member notice + a
+                // durable marker in the formal record, which `lean_lib`/`report()` surface via `note`.
+                await notice(member.id, '框架规则：同一条回复里记录了忠实性缺陷（对象 ' + target + '），'
+                  + '你**对该对象的 verdict 已按弃权计入**（不投真也不投假）；缺陷本身照常撤回证明。'
+                  + '若你确认命题为假，请在**下一轮**用独立理由投 0。')
+              }
             } else {
               const r = await leanArchive(member.id, { kind: 'blocked', target, note })
               if (r.ok === false) await notice(member.id, '记录形式化阻塞失败（' + (r.code || '') + '）：' + (r.message || ''))
@@ -5793,7 +6595,7 @@ export function apply(ctx) {
             const prev = formalOf(target)
             await putFormal(target, Object.assign({}, prev, {
               status: prev.status === 'passed' || prev.status === 'blocked' ? prev.status : 'attempted',
-              file, decision: 'used', note: String(f.note || prev.note || ''), updatedAt: now(),
+              file, decision: 'used', decisionSource: 'member-reply', note: String(f.note || prev.note || ''), updatedAt: now(),
             }))
             await writeFormalIndex()
           } else if (decision) {
@@ -5801,6 +6603,7 @@ export function apply(ctx) {
           }
         }
       }
+      }
       if (p.propose_verify) {
         const pv = typeof p.propose_verify === 'string' ? { target: p.propose_verify } : p.propose_verify
         if (pv && pv.target) {
@@ -5809,10 +6612,42 @@ export function apply(ctx) {
         }
       }
       if (p.verdict && typeof p.verdict === 'object') {
-        const n = normVerdictNumber(p.verdict.verdict)
-        if (n === undefined) await notice(member.id, 'verdict 必须是 0-1 的数值；本轮的票未被记录。')
+        const declared = normVerdictNumber(p.verdict.verdict)
+        if (declared === undefined) await notice(member.id, 'verdict 必须是 0-1 的数值；本轮的票未被记录。')
         else {
-          const r = await castVerdict(member.id, String(p.verdict.target || ''), n, p.verdict.reason)
+          const vTarget = idSafe(String(p.verdict.target || ''))
+          // L2 option A: the same reply declared a fidelity defect for this object ⇒ this member's
+          // ballot counts as an ABSTENTION (0.5) instead of a boolean assertion. A value that is
+          // ALREADY a proper abstention stays exactly as sent (no double counting); the durable
+          // note is attached to the formal record so the override is visible in the receipt.
+          // Adv-verify S7: only an ACTUAL voter has a boolean ballot to abstain from — a temp
+          // worker's opinion is relayed, never counted, so it must NOT get an "abstention" marker
+          // (that would claim the framework changed a vote that never existed).
+          const isVoterHere = voters().some((m) => m.id === member.id)
+          const enforced = isVoterHere && defectTargetsThisReply.has(vTarget) && (declared === 0 || declared === 1)
+          const n = enforced ? 0.5 : declared
+          if (enforced) {
+            try {
+              await putFormal(vTarget, (prev0) => {
+                const fid = Object.assign({}, (prev0 && prev0.fidelity) || {})
+                // Adv-verify F1 (MED): the marker used to be a SINGLE value, so two members
+                // recording a defect in the same round overwrote each other and only the last was
+                // auditable. It is an ARRAY now (old object-shaped records are folded in), with a
+                // matching `abstainedCount`.
+                const prevList = Array.isArray(fid.voteAbstainedByFramework)
+                  ? fid.voteAbstainedByFramework
+                  : (fid.voteAbstainedByFramework ? [fid.voteAbstainedByFramework] : [])
+                const list = prevList.concat([{ at: now(), by: member.id, declared }])
+                fid.voteAbstainedByFramework = list
+                fid.abstainedCount = list.length
+                return Object.assign({}, prev0 || { status: 'none' }, {
+                  fidelity: fid,
+                  note: (String((prev0 && prev0.note) || '') + '；本轮同回复的 verdict=' + declared + ' 已由框架按弃权计入').trim(),
+                })
+              })
+            } catch (e) { /* the vote still counts as an abstention even if the note cannot be stored */ }
+          }
+          const r = await castVerdict(member.id, vTarget, n, p.verdict.reason)
           if (r && r.ok === false) await notice(member.id, '本轮的票未被记录（' + (r.code || '') + '）：' + (r.message || ''))
         }
       }
@@ -5872,7 +6707,7 @@ export function apply(ctx) {
           '- 时间: ' + fmtTime(),
           '- 记录者: ' + member.id,
           '- 该成员认为原问题已解决: ' + (p.solved === true),
-          '- 有表决权的解决票: ' + Array.from(solveVotes.entries()).map(([k, v]) => k + '=' + v).join('、'),
+          '- 有表决权的解决票: ' + (solveVotesList().join('、') || '（无）'),
           '',
         ].join('\n'))
       }
@@ -6075,7 +6910,15 @@ export function apply(ctx) {
         // round-4 item 4: only a NEWLY recorded entry warns, and the record goes through the same
         // retention as every other diagnostics writer in this preset (slice(-50)).
         if (duplicate) return keys
-        target.diagnostics.push({ kind: 'state-dropped-keys', where: where, keys: keys })
+        // F1 (status/report review): the entry carries the SAME field names as every other
+        // diagnostics record (`at`/`type`/`error`) plus its own `kind`/`where`/`keys`. It used to be
+        // `{kind, where, keys}` only, so `report()` printed `undefined｜undefined` for a record it
+        // was supposed to explain.
+        target.diagnostics.push({
+          at: now(), type: 'vibe5/dropped-keys',
+          error: '忽略未知参数键（未写入状态）：' + keys.join(', ') + '（来源：' + where + '）',
+          kind: 'state-dropped-keys', where: where, keys: keys,
+        })
         while (target.diagnostics.length > 50) target.diagnostics.shift()
       }
       console.warn('vibe-math-v5: 忽略未知参数键（不静默丢失，已记入 diagnostics）：' + keys.join(', ') + '（来源：' + where + '）')
@@ -6103,7 +6946,7 @@ export function apply(ctx) {
         memberMayRejectAssign: params.memberMayRejectAssign,
         researcherCount: params.researcherCount,
         quorumCap: params.quorumCap, quorumMode: params.quorumMode,
-        m: quorumM(), voterCount: voterCount(),
+        m: quorumView().m, voterCount: voterCount(), started: voterCount() > 0,
         verdictMaxRounds: params.verdictMaxRounds,
         maxTempPerMember: params.maxTempPerMember, maxTempTotal: params.maxTempTotal,
         compactThreshold: params.compactThreshold, compactAfterRounds: params.compactAfterRounds,
@@ -6142,10 +6985,23 @@ export function apply(ctx) {
         return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'cannot reconfigure while the institute is running (pause/stop first; use vibe_v5_set to tune params)' }
       }
       const patch = {}
+      let identitySwitched = false
       if (a.project !== undefined && String(a.project).trim()) patch.project = String(a.project).trim()
       if (a.institute !== undefined && String(a.institute).trim()) patch.institute = String(a.institute).trim()
       if (a.problem !== undefined) patch.problem = { id: slugify(String(a.problem).slice(0, 40)) || 'problem', statement: String(a.problem) }
       if (a.params && typeof a.params === 'object') patch.params = Object.assign({}, params, normalizeParams(a.params))
+      // C1 (deep-review 4): a configure with NOTHING to apply used to still commit
+      // `patch.phase = 'idle'` below — a no-arg `/v5 configure` silently regressed a CONCLUDED
+      // institute (`report()` then showed 已结题 false). A no-op configure is now a true no-op:
+      // no commit, no phase change, and the answer says exactly that + the usage.
+      if (patch.project === undefined && patch.institute === undefined && patch.problem === undefined && patch.params === undefined) {
+        return {
+          ok: true, noop: true, project, institute: instituteName,
+          phase: String(inst().phase || phase),
+          note: 'configure 没有收到任何参数：未改动任何状态（当前研究所 ' + instituteName + '，phase=' + String(inst().phase || phase) + '）。'
+            + '用法：/v5 configure <研究所名> <问题…>（可在同一行里带 problem；切换研究所名会用一个新的所）。',
+        }
+      }
       if (patch.project !== undefined || patch.institute !== undefined) {
         const np = patch.project !== undefined ? patch.project : project
         const ni = patch.institute !== undefined ? patch.institute : instituteName
@@ -6160,18 +7016,29 @@ export function apply(ctx) {
             instituteName = ni
             patch.project = np
             patch.institute = ni
+            identitySwitched = true
           } else if (!inst().members.length) {
             key = nkey
             project = np
             instituteName = ni
             patch.project = np
             patch.institute = ni
+            identitySwitched = true
           } else {
             return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'this session already holds an institute; use a new session to found another' }
           }
         }
       }
-      patch.phase = 'idle'
+      // F5 (status/report review, S1 class): `phase='idle'` belongs to FOUNDING THE SETUP, not to
+      // every configure. A partial configure (`problem`-only / `params`-only / institute-only with
+      // the SAME name) may still apply its patch, but it must never rewrite the phase of an
+      // institute that already has a life of its own — that is what made a concluded institute read
+      // "阶段：idle｜已结题：false". The phase is reset only when this call is actually (re)founding:
+      // a REAL identity switch (`nkey !== key`), or a session that holds no institute yet.
+      // (`institute-only` with an unchanged name is therefore also a no-phase-change: `patch.institute`
+      // being present is not the same as the identity having moved.)
+      const holdsInstitute = inst().members.length > 0 || String(inst().phase || '') !== 'idle'
+      if (identitySwitched || !holdsInstitute) patch.phase = 'idle'
       await patchInstitute(patch)
       syncParamsFromState()
       await mkdirs()
@@ -6216,7 +7083,17 @@ export function apply(ctx) {
     async function doStart(args) {
       const a = args || {}
       if (running && !autoDone) return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'already running' }
-      if (autoDone) return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'this institute already concluded; configure a new one in a new session' }
+      // S1 (repro `_oneoff/s1-solved-reload.mjs`): the concluded state is durable (`phase:'solved'`
+      // in the state file), so the guard checks the PERSISTED phase as well as the in-memory flag.
+      // The refusal names the concrete next step instead of only the code.
+      if (autoDone || String(phase) === 'solved') {
+        return {
+          ok: false, code: 'V5_INSTITUTE_STATE',
+          message: '本所已结题（状态文件里的 phase = solved，runId = ' + String(inst().runId || '') + '），不能再 start：'
+            + '结题运行的结论/论文/成员都已归档在这个所里。要继续工作请二选一 —— ①在新会话里 `/v5 configure <新研究所名> <问题>` 再 `/v5 start`（推荐）；'
+            + '②同一会话里也要先 `/v5 configure <新研究所名> <问题>`（本所已有成员，故 configure 只接受切换到一个**新的**研究所名）。',
+        }
+      }
       const patch = {}
       if (a.problem !== undefined && String(a.problem).trim()) patch.problem = { id: slugify(String(a.problem).slice(0, 40)) || 'problem', statement: String(a.problem) }
       const p = Object.assign({}, params, normalizeParams(a.params || {}))
@@ -6266,7 +7143,11 @@ export function apply(ctx) {
           spawned.push(m.id)
         } catch (e) {
           if (isActivationLimitReached(e)) limitRefused = true
-          await putMember(Object.assign({}, memberById(m.id) || m, { phase: 'failed', error: String((e && e.message) || e) }))
+          // G-6b (installer follow-up): the founding catch RE-writes the record that `spawnMember`'s
+          // own catch already wrote — it must not drop the durable cap marker, otherwise the queue
+          // would depend on matching the error TEXT for this path (the exact divergence the shared
+          // predicate exists to prevent).
+          await putMember(Object.assign({}, memberById(m.id) || m, { phase: 'failed', error: String((e && e.message) || e), failReason: isActivationLimitReached(e) ? 'activation-limit' : 'other' }))
         }
       }
       for (let i = 0; i < params.researcherCount; i++) {
@@ -6277,7 +7158,7 @@ export function apply(ctx) {
           spawned.push(m.id)
         } catch (e) {
           if (isActivationLimitReached(e)) limitRefused = true
-          await putMember(Object.assign({}, memberById(m.id) || m, { phase: 'failed', error: String((e && e.message) || e) }))
+          await putMember(Object.assign({}, memberById(m.id) || m, { phase: 'failed', error: String((e && e.message) || e), failReason: isActivationLimitReached(e) ? 'activation-limit' : 'other' }))
         }
       }
       if (!spawned.length) {
@@ -6332,7 +7213,7 @@ export function apply(ctx) {
       // "queued" half of the cap handling, retried in this round — gated on the RECORDED cap error
       // so an ordinary failed member (broken provider, rejected tool filter) is never resurrected
       // by a resume. `members` keeps its meaning for the return value below.
-      const queued = inst().members.filter((m) => m.phase === 'failed' && /active child limit|maxActiveSubagents/.test(String(m.error || '')))
+      const queued = inst().members.filter((m) => isCapRefusedMember(m))
       if (!members.length && !queued.length) return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'no active member to resume' }
       let respawned = 0
       beginSpawnRound()   // the whole re-spawn loop is ONE round for the cap notice
@@ -6395,7 +7276,9 @@ export function apply(ctx) {
       // (v4 §30-T38).
       meeting = null
       pendingMeeting = null
-      solveVotes.clear()
+      // HIGH 3: a NEW solve question starts with an empty DURABLE tally (a clear has to be
+      // persisted too, otherwise a reload would resurrect the previous question's answers).
+      await putSolve({ clear: true })
       busy.clear()
       wakeKind.clear()
       currentMember = ''
@@ -6414,33 +7297,95 @@ export function apply(ctx) {
         ok: true,
         institute: instituteName, project, key, phase,
         running, autoDone, runId: s.runId,
+        // L4 (deep-review 5): the `【形式化结果】` announcements are delivered ONCE, to the job's
+        // initiator, and live in memory. F2 (status/report review): the field is therefore labelled
+        // as SESSION-scoped, because after a restart it is empty although the durable per-job
+        // records in Formal/Jobs/<jobId>.json are still there.
+        leanNotices: leanNotices.map((n) => ({ member: n.member, jobId: n.jobId, line: n.line })),
+        leanNoticesScope: 'session-memory（重启后为空；耐久事实在 Formal/Jobs/<jobId>.json 与 vibe_v5_lean_job）',
+        // F2/F3 (status/report review): one place that names the SESSION-scoped fields inside this
+        // payload, so a reader (or an operator comparing two sessions) cannot mistake them for
+        // durable state. Durable = derived from the state file; session = rebuilt on load.
+        fieldScopes: {
+          session: ['running', 'autoDone(session mirror of phase)', 'leanNotices', 'debug', 'members[].rounds', 'members[].busy', 'members[].contextPct', 'members[].childId', 'meeting', 'parkedMeeting', 'persistence.writeFailures', 'persistence.prematureReads', 'persistence.loadProblem', 'pendingSpawns[].attempts'],
+          durable: ['phase', 'runId', 'quorum', 'members[] (except the three session fields)', 'members[].failReason', 'tasks', 'failedMembers', 'pendingSpawns[] (derived from durable failed members)', 'chat', 'officeRequests', 'verify', 'verifyQueue', 'verified', 'undecided', 'solveVotes', 'formal', 'paper', 'lastProgressAt', 'params'],
+        },
         backend: backend ? backend.kind : 'uninitialized',
         // Skipped/malformed events AND state-file load problems. Without this the two
         // failure modes that silently drop state were invisible in the operator's view.
         diagnostics: s.diagnostics || [],
         debug: Object.assign({ scheduling, reschedule }, dbg),
-        quorum: { m: quorumM(), mode: params.quorumMode, voters: voters().map((m) => m.id), voterCount: voterCount() },
+        quorum: quorumView(),
         members: s.members.map((m) => ({
           id: m.id, kind: m.kind, phase: m.phase, direction: m.direction, hiredBy: m.hiredBy,
           rounds: rounds.get(m.id) || 0, busy: busy.has(m.id), contextPct: contextPct.get(m.id) || 0,
           childId: m.childId ? m.childId.slice(0, 12) : '', error: m.error || '',
+          // G-6b: the durable reason a failed member is deferred work (`activation-limit` = the host
+          // cap refused it, and the framework will retry it) — needed to audit the queue without
+          // re-deriving it from the error text.
+          failReason: m.failReason || '',
         })),
         tasks: listTasks(),
+        // LOW (deep review): a member whose provisioning failed stays on the roster forever (ids
+        // are never reused, so the entry must stay) — but `resume` only retries the ones refused by
+        // the HOST's live-child cap. Everything else is surfaced here with the remedy, instead of
+        // being a silent, permanent `phase:'failed'` row an operator has to notice by luck.
+        failedMembers: s.members.filter((m) => m.phase === 'failed').map((m) => ({ id: m.id, kind: m.kind, failReason: m.failReason || '', error: String(m.error || '').slice(0, 200) })),
+        failedMembersNote: 'resume 只重试「live-child 上限」类失败；其它 provisioning 失败请由所办重新招聘（新 id，旧 id 永不复用）',
+        // G-6 (installer review): the DEFERRED spawns — refused by the host's live-child cap, queued
+        // by construction (durable `phase:'failed'` + `failReason:'activation-limit'`) and retried on
+        // every scheduling pass until capacity frees up or the session's attempt budget runs out.
+        // v4 exposed the same fact as `pendingSpawns`; without it a refusal was invisible work.
+        pendingSpawns: pendingSpawnMembers().map((m) => ({
+          id: m.id, kind: m.kind, attempts: spawnRetryAttempts.get(m.id) || 0,
+          error: String(m.error || '').slice(0, 200),
+        })),
+        pendingSpawnsNote: '容量（宿主 live-child 上限）拒绝的成员：已登记为待补建，框架在每次调度轮次自动重试（容量未释放时该次重试不询问宿主，零成本）；成功后该成员转为 active，本列表自动清空。非容量类的 provisioning 失败不会自动重试（会通知所办）。',
+        // F8 (status/report review): the two counts have different scopes — `pending` is the
+        // INSTITUTE-WIDE number of not-yet-acknowledged messages (not "my unread"), and `delivered`
+        // is a CAPPED acknowledgement ledger. Both are named accordingly here.
         chat: { pending: s.messages.length, delivered: s.delivered.length },
+        chatScope: 'pending = 全所未确认投递的消息数（非"我的未读"）；delivered = 封顶账本（DELIVERED_CAP，到顶后不再增长）',
+        // MEDIUM 4 (deep review): the requests only the OFFICE can approve. `to:'voters'` never
+        // reaches the office (it is not a member), so an unapproved proposal used to be invisible
+        // to the one actor able to act on it.
+        officeRequests: s.messages.filter((m) => m.to === OFFICE_INBOX).map((m) => ({ id: m.id, from: m.from, text: String(m.text || ''), at: m.at })),
+        // F4 (status/report review): the list above is truncated at OFFICE_REQUEST_CAP, so the
+        // truncation is published instead of pretending the list is complete.
+        officeRequestsShown: s.messages.filter((m) => m.to === OFFICE_INBOX).length,
+        officeRequestsCap: OFFICE_REQUEST_CAP,
+        officeRequestsDropped: Number(s.officeRequestsDropped || 0),
+        officeRequestsTruncated: s.messages.filter((m) => m.to === OFFICE_INBOX).length >= OFFICE_REQUEST_CAP,
+        // MEDIUM 7/8 (deep review): persistence health is part of the status. `stateWriteFailures`
+        // > 0 means the in-memory state is AHEAD of the file; `prematureReads` > 0 means some
+        // consumer read state before the first load settled (see the note on `state()`).
+        // F2/F9 (status/report review): both counters are SESSION-scoped (a restart resets them), so
+        // the scope is stated here too, not only in the report line.
+        persistence: { writeFailures: stateWriteFailures, prematureReads: prematureReads, loadSettled: loadSettled, loadProblem: lastLoadProblem, scope: 'session（重启后归零）', sandboxPolicyMismatch: sandboxPolicyMismatch },
         meeting: meeting ? { id: meeting.id, agenda: meeting.agenda, kind: meeting.kind, spoke: Object.keys(meeting.inputs), order: meeting.order } : null,
         parkedMeeting: pendingMeeting ? { agenda: pendingMeeting.agenda, kind: pendingMeeting.kind } : null,
         verify: cv ? { target: cv.target, kind: cv.kind, stage: cv.stage, round: cv.round, voted: Object.keys(cv.votes), m: quorumM(), P: voterCount() } : null,
         verifyQueue: s.queue.map((q) => q.target),
+        // F7 (status/report review): the old `verified` meant "concluded (真 OR 假)" while its name
+        // said "verified". It is kept for compatibility but the honest split is published next to it.
         verified: Object.keys(s.verdicts).filter((k) => s.verdicts[k] && s.verdicts[k].closed && s.verdicts[k].outcome !== 'undecided'),
+        verifiedTrue: Object.keys(s.verdicts).filter((k) => { const v = s.verdicts[k]; return v && v.closed && v.outcome === 'true' }),
+        concludedFalse: Object.keys(s.verdicts).filter((k) => { const v = s.verdicts[k]; return v && v.closed && v.outcome === 'false' }),
+        verifiedNote: 'verified = 已定论（真或假，历史名，保留兼容）；请用 verifiedTrue / concludedFalse / undecided 三个精确字段',
         undecided: Object.keys(s.verdicts).filter((k) => { const v = s.verdicts[k]; return v && v.closed && v.outcome === 'undecided' }),
-        solveVotes: Array.from(solveVotes.entries()).map(([k, v]) => k + '=' + v),
+        solveVotes: solveVotesList(),
         // Lean formal verification: mode + per-object status + the formalization TODO. This
         // is how an office/human audits "did we really get strict proofs, or only consensus?"
         formal: {
           mode: formalMode(),
           objects: Object.keys(formalRecords()).map((k) => {
             const r = formalRecords()[k] || {}
-            return { target: k, status: r.status, file: r.file || '', proof: r.proof || '', note: r.note || '', run: r.run ? { ok: r.run.ok, exitCode: r.run.exitCode, ms: r.run.ms } : null, async: r.async || null }
+            // F1d (fallout #4): `decision`/`decisionSource` are READ here (member-reply vs
+            // job-settle) instead of being a write-only field justified by a comment.
+            // Adv-verify F3: `fidelity` (the defect record + the enforced-abstention marker) is
+            // exposed too — before this it lived only in the state file, so a tool-surface audit
+            // could not see WHY a ballot was counted as an abstention.
+            return { target: k, status: r.status, decision: r.decision || '', decisionSource: r.decisionSource || '', fidelity: r.fidelity || null, abstainedCount: Number((r.fidelity || {}).abstainedCount || 0) || (Array.isArray((r.fidelity || {}).voteAbstainedByFramework) ? (r.fidelity.voteAbstainedByFramework.length) : ((r.fidelity || {}).voteAbstainedByFramework ? 1 : 0)), file: r.file || '', proof: r.proof || '', note: r.note || '', run: r.run ? { ok: r.run.ok, exitCode: r.run.exitCode, ms: r.run.ms } : null, async: r.async || null }
           }),
           passed: Object.keys(formalRecords()).filter((k) => (formalRecords()[k] || {}).status === 'passed'),
           blocked: Object.keys(formalRecords()).filter((k) => (formalRecords()[k] || {}).status === 'blocked'),
@@ -6456,12 +7401,15 @@ export function apply(ctx) {
     function report() {
       syncParamsFromState()
       const s = inst()
+      // ONE snapshot for the whole report: the text line and the returned `quorum` object can
+      // never disagree (DEFECT B), and `rosterVersion` lets a reader detect a stale copy.
+      const qv = quorumView()
       const L = []
       L.push('# 「' + instituteName + '」研究所汇报')
       L.push('')
-      L.push('- 项目：' + project + '｜阶段：' + phase + '｜运行中：' + running + '｜已结题：' + autoDone)
+      L.push('- 项目：' + project + '｜' + phaseFactLine())
       L.push('- 研究对象：' + (s.problem.statement ? s.problem.statement.slice(0, 200) : '（未设定）'))
-      L.push('- 求真门槛：m = ' + quorumM() + '（模式 ' + params.quorumMode + '）｜有表决权者 ' + voterCount() + ' 人')
+      L.push('- 求真门槛：' + (qv.started ? 'm = ' + qv.m : '未启动（有表决权者 0 人，m 未定义）') + '（模式 ' + params.quorumMode + '）｜有表决权者 ' + qv.voterCount + ' 人｜rosterVersion（名册版本，多个视图不一致时用它判断谁过期）' + qv.rosterVersion)
       L.push('')
       L.push('## 编制')
       if (!s.members.length) L.push('（暂无成员）')
@@ -6469,7 +7417,7 @@ export function apply(ctx) {
         L.push('- ' + m.id + '｜' + kindLabel(m.kind) + '｜' + m.phase +
           (m.hiredBy ? '｜雇主 ' + m.hiredBy : '') +
           (m.direction ? '｜方向：' + m.direction : '') +
-          '｜轮次 ' + (rounds.get(m.id) || 0) +
+          '｜轮次 ' + (rounds.get(m.id) || 0) + '（本会话计数，重启归零）' +
           (m.error ? '｜⚠ ' + m.error : ''))
       }
       L.push('')
@@ -6491,19 +7439,63 @@ export function apply(ctx) {
           '｜平均概率 ' + Number(v.mean || 0).toFixed(2) + '｜' + (v.reason || '') + '）')
       }
       const cv = currentVerify()
-      if (cv) L.push('- 进行中：' + cv.target + '｜' + cv.stage + ' 第 ' + cv.round + ' 轮｜已投 ' + Object.keys(cv.votes).join('、'))
+      if (cv) L.push('- 进行中：' + cv.target + '｜' + cv.stage + ' 第 ' + cv.round + ' 轮' + (Object.keys(cv.votes).length ? '｜已投 ' + Object.keys(cv.votes).join('、') : '｜尚无人投票'))
       if (s.queue.length) L.push('- 队列：' + s.queue.map((q) => q.target).join('、'))
       L.push('')
       L.push('## 群聊 / 会议')
-      L.push('- 未读消息：' + s.messages.length + '｜已投递：' + s.delivered.length)
-      if (meeting) L.push('- 进行中会议：' + meeting.id + '｜' + meeting.agenda + '｜已发言 ' + Object.keys(meeting.inputs).join('、'))
+      L.push('- 未投递消息（全所）：' + s.messages.length + '｜已确认投递（封顶账本）：' + s.delivered.length)
+      // MEDIUM 4 + F4: the office's own inbox — requests that only the office can approve, with the
+      // truncation published (the list is capped at OFFICE_REQUEST_CAP).
+      {
+        const reqs = s.messages.filter((m) => m.to === OFFICE_INBOX)
+        const dropped = Number(s.officeRequestsDropped || 0)
+        L.push('- 待所办裁定：' + (reqs.length
+          ? '显示最新 ' + reqs.length + ' 条' + (dropped ? '（上限 ' + OFFICE_REQUEST_CAP + '，累计已丢弃最旧 ' + dropped + ' 条）' : '') + '；最新：' + String(reqs[reqs.length - 1].text || '').slice(0, 120)
+          : '（无）'))
+      }
+      if (meeting) L.push('- 进行中会议：' + meeting.id + '｜' + meeting.agenda + (Object.keys(meeting.inputs).length ? '｜已发言 ' + Object.keys(meeting.inputs).join('、') : '｜尚无人发言'))
       if (pendingMeeting) L.push('- 暂存会议：' + pendingMeeting.agenda)
-      L.push('- 历史会议：' + s.meetings.length + ' 次｜辩论录：' + s.debates.length + ' 份')
-      L.push('- 解决票：' + (solveVotes.size ? Array.from(solveVotes.entries()).map(([k, v]) => k + '=' + v).join('、') : '（无）'))
-      if ((s.diagnostics || []).length) {
-        L.push('')
-        L.push('## ⚠ 状态诊断（被跳过的事件 / 状态文件读取问题）')
-        for (const d of s.diagnostics.slice(-10)) L.push('- ' + fmtTime(d.at) + '｜' + d.type + '｜' + d.error)
+      // F6 (status/report review): a meeting whose index entry exists but which never FINALIZED is
+      // not history. `meetingOpen` is durable (set in `beginMeeting`, cleared in `finalizeMeeting`),
+      // so a restart cannot silently drop the minutes while the count still looks normal.
+      {
+        const open = s.meetingOpen || null
+        const finalized = (s.meetings || []).filter((x) => !open || x.id !== open.id)
+        L.push('- 历史会议：' + finalized.length + ' 次｜辩论录：' + s.debates.length + ' 份'
+          + (open ? '｜⚠ 有 1 场会议未收束：' + open.id + '（开始于 ' + fmtTime(open.at) + '；本会话未恢复它的发言，纪要可能缺失）' : ''))
+      }
+      // G-6: deferred spawns (host live-child cap refused them; the framework retries each pass).
+      {
+        const pend = pendingSpawnMembers()
+        if (pend.length) {
+          L.push('- 待补建成员：' + pend.map((m) => m.id + '(' + kindLabel(m.kind) + '，已重试 ' + (spawnRetryAttempts.get(m.id) || 0) + ' 次)').join('、')
+            + '｜容量释放后框架会在下一次调度轮次自动重试（容量未释放时该次重试不询问宿主）；成功后该成员转为 active 并从本行消失')
+        }
+      }
+      L.push('- 解决票：' + (solveVotesList().length ? solveVotesList().join('、') : '（无）'))
+      // F1 (status/report review, HIGH): the section must read the sources its heading advertises —
+      // (a) skipped/malformed EVENTS (top-level `state.diagnostics`, written by `applyV5Event`'s
+      // catch), (b) state-FILE problems (the session log `loadProblemLog` / `lastLoadProblem`), and
+      // (c) ignored keys (institute-level `s.diagnostics`, written by `reportDroppedStateKeys`).
+      // Every field is printed with an explicit fallback, so the literal `undefined` can never
+      // appear. The section is omitted entirely when there is nothing to report (the
+      // "assemble only when a value exists" rule).
+      const topDiag = (() => { try { return (state().diagnostics || []) } catch (e) { return [] } })()
+      const droppedDiag = (s.diagnostics || []).filter((d) => d && d.kind === 'state-dropped-keys')
+      const eventDiag = topDiag.filter((d) => d && d.type !== 'vibe5/load')
+      const loadDiag = topDiag.filter((d) => d && d.type === 'vibe5/load').concat(loadProblemLog)
+      {
+        const fmtDiag = (d) => fmtTime(d.at) + '｜' + String(d.type || '(无 type)') + '｜' + String(d.error || '(无 error)')
+        const lines = []
+        for (const d of eventDiag.slice(-10)) lines.push('- [被跳过的事件] ' + fmtDiag(d))
+        for (const d of loadDiag.slice(-10)) lines.push('- [状态文件] ' + fmtDiag(d))
+        for (const d of droppedDiag.slice(-10)) lines.push('- [忽略的键] ' + fmtDiag(d))
+        if (lastLoadProblem && !loadDiag.some((d) => String(d.error || '') === lastLoadProblem)) lines.push('- [状态文件] ' + lastLoadProblem)
+        if (lines.length) {
+          L.push('')
+          L.push('## ⚠ 状态诊断（被跳过的事件 / 状态文件读取问题 / 忽略的键）')
+          for (const ln of lines) L.push(ln)
+        }
       }
       L.push('')
       L.push('## Lean 形式化')
@@ -6513,6 +7505,23 @@ export function apply(ctx) {
         L.push('- 已通过：' + (Object.keys(s.formal || {}).filter((k) => (s.formal || {})[k].status === 'passed').join('、') || '（无）'))
         L.push('- 已记录阻塞：' + (Object.keys(s.formal || {}).filter((k) => (s.formal || {})[k].status === 'blocked').join('、') || '（无）'))
         L.push('- 形式化待办：' + ((s.todo || []).map((t) => t.id).join('、') || '（无）'))
+        // F1d (fallout #4): the member-reported vs job-settled distinction, readable.
+        {
+          const dec = Object.keys(s.formal || {}).filter((k) => (s.formal[k] || {}).decision).map((k) => k + '=' + s.formal[k].decision + '(' + (s.formal[k].decisionSource || '来源未记录') + ')')
+          if (dec.length) L.push('- 形式化决定：' + dec.join('、') + '（来源 member-reply=成员自述，job-settle=后台作业落地）')
+          // Adv-verify F3: the enforced-abstention marker is readable here too (how many ballots the
+          // framework turned into abstentions because the same reply recorded a fidelity defect).
+          const enforced = Object.keys(s.formal || {}).filter((k) => {
+            const fid = (s.formal[k] || {}).fidelity || {}
+            return Number(fid.abstainedCount || 0) > 0 || (Array.isArray(fid.voteAbstainedByFramework) && fid.voteAbstainedByFramework.length) || fid.voteAbstainedByFramework
+          }).map((k) => {
+            const fid = (s.formal[k] || {}).fidelity || {}
+            const n = Number(fid.abstainedCount || 0) || (Array.isArray(fid.voteAbstainedByFramework) ? fid.voteAbstainedByFramework.length : 1)
+            const who = (Array.isArray(fid.voteAbstainedByFramework) ? fid.voteAbstainedByFramework : [fid.voteAbstainedByFramework]).filter(Boolean).map((x) => x.by || '?').join('/')
+            return k + '×' + n + (who ? '(' + who + ')' : '')
+          })
+          if (enforced.length) L.push('- 框架强制弃权：' + enforced.join('、') + '（同回复记录忠实性缺陷 ⇒ 该成员对该对象的布尔票按弃权计入）')
+        }
         L.push('- 可复用库：VibeMath/Formal/{Lib,Proved}/（跨项目）｜本所形式化：Formal/｜归档证明：Verified/Lean/')
       }
       L.push('')
@@ -6533,23 +7542,34 @@ export function apply(ctx) {
       L.push('')
       L.push('## 文件位置')
       L.push('- 根目录：' + instRoot())
-      L.push('- 已确立：Verified/｜成员库：Members/<id>/｜群聊：Shared/Chat/｜会议：Shared/Meetings/｜辩论：Shared/Debates/')
-      return { ok: true, report: L.join('\n') }
+      L.push('- 工作目录相对路径（你的文件工具的基准）：' + instRootRel() + '/｜已确立：Verified/｜成员库：Members/<id>/（成员的库文件路径 = Members/<id>/Progress/progress.md 等；文件工具按会话 cwd 解析 ⇒ 请用完整路径）｜群聊：Shared/Chat/｜会议：Shared/Meetings/｜辩论：Shared/Debates/')
+      // MEDIUM 7/8 + F9: the two persistence facts an operator must not have to guess — with the
+      // SESSION scope stated (a restart resets both counters) and no raw boolean in the sentence.
+      L.push('- 持久化（本会话计数）：写失败 ' + stateWriteFailures + ' 次｜首次载入前被读取 ' + prematureReads + ' 次｜状态文件已载入：' + (loadSettled ? '是' : '否'))
+      if (lastLoadProblem) L.push('- ⚠ 状态文件问题：' + lastLoadProblem)
+      // G-7 (installer ROUND2): the sandbox fence's root vs the session workspace. A named warning,
+      // not a refusal: v5 cannot change the host's fence, and refusing would stop persisting work.
+      if (sandboxPolicyMismatch) L.push('- ⚠ 沙箱策略根与会话工作目录不一致：策略=' + sandboxPolicyMismatch.policyRoot + '｜会话=' + sandboxPolicyMismatch.expected
+        + '（v5 用会话工作目录拼所有路径；若宿主按策略根解析写操作，产物可能落在预期之外的那棵树——请核对 sandbox 策略的 workspaceRoot）')
+      return { ok: true, report: L.join('\n'), quorum: qv }
     }
     // Adding/removing a PERMANENT researcher is a change to the institute's public
     // structure, so members may only propose it; the office decides and executes.
     async function addResearcher(callerId, direction) {
       if (!isOffice(callerId)) {
         await say(callerId, { to: 'voters', kind: 'voters', text: '提议增聘一名常驻研究员（方向：' + String(direction || '未指定') + '）' })
-        return { ok: true, proposed: true, message: '已向所办提议增聘常驻研究员（编制变更需所办批准）' }
+        // MEDIUM 4: the office is the ONLY actor that can execute this, and `to:'voters'` never
+        // reaches it — the proposal is now addressed to the office as well.
+        await say(callerId, { to: OFFICE_INBOX, kind: 'office-request', text: '请所办裁定：增聘一名常驻研究员（方向：' + String(direction || '未指定') + '｜提议人：' + callerId + '）' })
+        return { ok: true, proposed: true, message: '已向所办提议增聘常驻研究员（编制变更需所办批准；所办会在 status/report 的 officeRequests 里看到该提议）' }
       }
       if (!running || autoDone) return { ok: false, code: 'V5_INSTITUTE_STATE', message: 'the institute is not running' }
       const m = await newMember('researcher', { direction: String(direction || '') })
       try {
         await spawnMember(m, null)
       } catch (e) {
-        await putMember(Object.assign({}, memberById(m.id) || m, { phase: 'failed', error: String((e && e.message) || e) }))
-        if (isActivationLimitReached(e)) { noteChildLimit(e); return { ok: false, code: 'ACTIVATION_LIMIT_REACHED', message: activationLimitText(hostChildLimit) } }
+        await putMember(Object.assign({}, memberById(m.id) || m, { phase: 'failed', error: String((e && e.message) || e), failReason: isActivationLimitReached(e) ? 'activation-limit' : 'other' }))
+        if (isActivationLimitReached(e)) { noteChildLimit(e); return { ok: false, code: 'ACTIVATION_LIMIT_REACHED', message: activationLimitText(hostChildLimit) + '（已登记为待补建：容量释放后框架会在下一次调度轮次自动重试）' } }
         return { ok: false, code: 'V5_PROVISIONING_CONFLICT', message: String((e && e.message) || e) }
       }
       await saveChatLine('【编制】所办增聘常驻研究员 ' + m.id + (direction ? '（方向：' + direction + '）' : '') +
@@ -6591,6 +7611,9 @@ export function apply(ctx) {
       taskCreate, taskList: listTasks, getTask, taskUpdate, taskAssign, taskPrioritize,
       // libraries
       publishProgress, recordCard, readLibrary,
+      // path helpers: the tool face advertises the CWD-relative spellings (L1), so they must be
+      // reachable from the registration block too.
+      instRel, instRootRel, formalRootRel,
       // Lean formal verification (docs/formal-verification.md)
       formalMode, formalOn, formalRecords, formalTodo, formalOf, rebuildLeanLibIndexes,
       leanArchive, leanRunTool, writeFormalIndex, writeFormalTodo, recordFidelityDefect,
@@ -6606,6 +7629,8 @@ export function apply(ctx) {
       startPaper, paperStatus: paperSummary, finalizePaperByOffice,
       // authorization helpers (used by tool handlers)
       memberIdOfAgent, isOffice, isAcademician, isProvablyOffice, officeCaller, memberById, activeMembers,
+      // diagnosis helpers (defects 1/2 of the architecture self-test)
+      memberDiagnosis, quorumM, quorumView, voterCount,
     }
   }
 
@@ -6643,7 +7668,7 @@ export function apply(ctx) {
    */
   function withCaller(s, x, what, fn) {
     const caller = s.officeCaller(x)
-    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: ' + what + ' needs a resolved member id or the office (the session root)' }
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: ' + what + ' needs a resolved member id or the office (the session root)', next: { kind: 'member-call', tool: 'vibe_v5_members', hint: 'call this tool from a member subagent; the office (the session root) can read state with vibe_v5_report / vibe_v5_status' } }
     return fn(caller)
   }
 
@@ -6751,30 +7776,30 @@ export function apply(ctx) {
     // not the office either — without this check ANY caller's text was delivered as the office
     // (audit L6 follow-up; the tool's own description says "from the office/human").
     const caller = s.officeCaller(x)
-    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: relaying a message as the office needs the office (the session root)' }
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: relaying a message as the office needs the office (the session root)', next: { kind: 'member-call', tool: 'vibe_v5_members', hint: 'call this tool from a member subagent; the office (the session root) can read state with vibe_v5_report / vibe_v5_status' } }
     if (caller !== 'office') return { ok: false, code: 'V5_NOT_OFFICE', message: 'vibe_v5_message relays the OFFICE voice; a member speaks with vibe_v5_say' }
     const to = String(a.to || 'all')
     return s.say('office', { to, text: String(a.content), kind: to === 'all' || to === 'voters' ? 'office' : 'dm' })
   })
   registerTool('vibe_v5_meeting', 'Convene a meeting (office/academician) or propose one (any other member — relayed to the academician/office). Parked automatically while a verification is in flight. kind picks the meeting type: "sync" = routine coordination (default), "division" = split the work, "verify-request" = ask the group to verify an object, "solve-vote" = put "is the original problem solved?" to a vote; target names the object for verify-request/solve-vote.', objParams({ agenda: S, kind: { type: 'string', enum: ['sync', 'division', 'verify-request', 'solve-vote'] }, target: S }, ['agenda']), (s, a, x) => {
     const caller = s.officeCaller(x)
-    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may convene/propose a meeting' }
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may convene/propose a meeting', next: { kind: 'member-call', tool: 'vibe_v5_members', hint: 'call this tool from a member subagent; the office (the session root) can read state with vibe_v5_report / vibe_v5_status' } }
     return s.startMeeting(caller, a)
   })
   registerTool('vibe_v5_members', 'List the institute roster (office, employer, phase, direction, rounds).', objParams({}), (s) => ({ ok: true, members: s.status().members, quorum: s.status().quorum }))
   registerTool('vibe_v5_hire', 'Hire one temp worker (office; the academician and every permanent researcher may also hire their own). Requires purpose and initial_task. term (optional) is the task deadline/period text the worker is told at onboarding; direction (optional) states what it should work on.', objParams({ purpose: S, initial_task: S, direction: S, term: S, to: S }, ['purpose', 'initial_task']), (s, a, x) => {
     const caller = a.to ? String(a.to) : s.officeCaller(x)
-    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may hire' }
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or a member may hire', next: { kind: 'member-call', tool: 'vibe_v5_members', hint: 'call this tool from a member subagent; the office (the session root) can read state with vibe_v5_report / vibe_v5_status' } }
     return s.hire(caller, a)
   })
   registerTool('vibe_v5_fire', 'Dismiss a temp worker for real: cancel its turn, release its resident child, reclaim its tasks, drop its mail, and mark it dismissed (its id is never reused).', objParams({ id: S, reason: S }, ['id']), (s, a, x) => {
     const caller = s.officeCaller(x)
-    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or the employer may fire' }
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: only the office (the session root), the academician or the employer may fire', next: { kind: 'member-call', tool: 'vibe_v5_members', hint: 'call this tool from a member subagent; the office (the session root) can read state with vibe_v5_report / vibe_v5_status' } }
     return s.fire(caller, a)
   })
   registerTool('vibe_v5_add_researcher', 'Office only: hire another PERMANENT researcher (members may only propose this).', objParams({ direction: S }), (s, a, x) => {
     const caller = s.officeCaller(x)
-    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: adding a permanent researcher is the office\'s decision (the session root)' }
+    if (!caller) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member: adding a permanent researcher is the office\'s decision (the session root)', next: { kind: 'member-call', tool: 'vibe_v5_members', hint: 'call this tool from a member subagent; the office (the session root) can read state with vibe_v5_report / vibe_v5_status' } }
     return s.addResearcher(caller, a && a.direction)
   })
   // "Office only" (the tool's own description) must be ENFORCED, not just documented: the handler
@@ -6800,7 +7825,7 @@ export function apply(ctx) {
   // ── member-facing controls ────────────────────────────────────────────────
   registerTool('vibe_v5_say', '(member) Speak in the group chat (omit "to"), send a private message ("to":"r-2"), or address only the voters ("to":"voters").', objParams({ text: S, to: S }, ['text']), (s, a, x) => {
     const from = s.memberIdOfAgent(x)
-    if (!from) return { ok: false, code: 'V5_MEMBER_NOT_FOUND', message: 'no calling member' }
+    if (!from) return s.memberDiagnosis('发言（vibe_v5_say）', from)
     const to = a.to || 'all'
     return s.say(from, { to, text: a.text, kind: to === 'voters' ? 'voters' : (a.to ? 'dm' : 'chat') })
   })
@@ -6866,26 +7891,36 @@ export function apply(ctx) {
     parts.push('- 距上次实质进展：' + Math.round(idleFor / 1000) + ' 秒')
     return { ok: true, overview: parts.join('\n') }
   })
-  registerTool('vibe_v5_assign', '(academician) ASSIGN work: create or pick a task and give it to a specific member (including temp workers), stating WHY and the acceptance criteria. The assignee executes by default and may object with reasons (which are broadcast).', objParams({ task_id: S, subject: S, description: S, to: S, why: S, acceptance: S, priority: I, write_scopes: SA }, ['to', 'why', 'acceptance']), (s, a, x) => withCaller(s, x, 'an assignment', (caller) => s.taskAssign(caller, a)))
-  registerTool('vibe_v5_prioritize', '(academician) Set institute-wide priorities: an ordered list of {task_id, priority} plus WHY. This orders work only — it never changes what is true.', objParams({ order: { type: 'array', items: { type: 'object' } }, why: S }), (s, a, x) => withCaller(s, x, 'setting priorities', (caller) => s.taskPrioritize(caller, a)))
-  registerTool('vibe_v5_nudge', '(academician) Supervise: wake one member with a stated reason and a concrete suggested next step. Prefer a specific next step over a bare "hurry up".', objParams({ to: S, why: S, next_step: S }, ['to', 'why']), (s, a, x) => withCaller(s, x, 'a nudge', (caller) => s.nudge(caller, a)))
+  registerTool('vibe_v5_assign', '(office, or the academician when academicianLeads) ASSIGN work: create or pick a task and give it to a specific member (including temp workers), stating WHY and the acceptance criteria. The assignee executes by default and may object with reasons (which are broadcast).', objParams({ task_id: S, subject: S, description: S, to: S, why: S, acceptance: S, priority: I, write_scopes: SA }, ['to', 'why', 'acceptance']), (s, a, x) => withCaller(s, x, 'an assignment', (caller) => s.taskAssign(caller, a)))
+  registerTool('vibe_v5_prioritize', '(office, or the academician when academicianLeads) Set institute-wide priorities: an ordered list of {task_id, priority} plus WHY. This orders work only — it never changes what is true.', objParams({ order: { type: 'array', items: { type: 'object' } }, why: S }), (s, a, x) => withCaller(s, x, 'setting priorities', (caller) => s.taskPrioritize(caller, a)))
+  registerTool('vibe_v5_nudge', '(office, or the academician when academicianLeads) Supervise: wake one member with a stated reason and a concrete suggested next step. Prefer a specific next step over a bare "hurry up".', objParams({ to: S, why: S, next_step: S }, ['to', 'why']), (s, a, x) => withCaller(s, x, 'a nudge', (caller) => s.nudge(caller, a)))
 
   // ── Lean formal verification (docs/formal-verification.md) ────────────────
   // These three tools are registered UNCONDITIONALLY: tool registration is static (a
   // dynamic registration would depend on a runtime knob and break the effect discipline),
   // while the MODE only decides whether the framework TELLS members about them. In 'off'
   // mode they still work if a human or agent calls them deliberately.
-  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. With leanAsync (default true) the compile is ENQUEUED and this returns immediately with async:{jobId,state} — nothing is compiled yet; inspect it via vibe_v5_lean_lib.jobs or wait for the next round\'s 【形式化结果】 line. With leanAsync=false it blocks and returns the compiler output (exitCode/stdout/stderr). Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT. Pass target=<object id> to also record the run against that object. The framework appends `--search-path <VibeMath root>` before the file name (unless leanArgs already sets a search root).', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => withCaller(s, x, 'a Lean run', (caller) => s.leanRunTool(caller, a)))
-  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (only once the queued compile settles ok) also Verified/Lean/<target>.lean, marking the object Lean-passed. Re-archiving IDENTICAL content is de-duplicated (deduped:true, no rewrite/recompile). kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => withCaller(s, x, 'a Lean archive', (caller) => s.leanArchive(caller, a)))
+  registerTool('vibe_v5_lean_run', '(member) Execute the Lean toolchain on one .lean file inside the workspace and report the result. Parameters: file (required; `Formal/x.lean` or the full CWD-relative path — both name the same file), target (optional object id to record the run against), timeout_ms (optional per-run budget). There is NO run/run=false switch here — run-vs-archive are separate tools; use vibe_v5_lean_archive {run:false} to archive WITHOUT compiling. With leanAsync (default true) the compile is ENQUEUED and this returns immediately with async:{jobId,state} — nothing is compiled yet; the result is durable at Formal/Jobs/<jobId>.json (vibe_v5_lean_job {jobId} reads it), is listed by vibe_v5_lean_lib.jobs, and the initiator also gets ONE 【形式化结果】 announcement in its next round. With leanAsync=false it blocks and returns the compiler output (exitCode/stdout/stderr). Never throws: a host with no subprocess service returns NO_SUBPROCESS and a missing toolchain returns LEAN_NOT_FOUND (in both cases the code can still be written down with vibe_v5_lean_archive), a timeout terminates the process and returns LEAN_TIMEOUT. The framework appends `--search-path <VibeMath root>` before the file name (unless leanArgs already sets a search root).', objParams({ file: S, target: S, timeout_ms: I }, ['file']), (s, a, x) => withCaller(s, x, 'a Lean run', (caller) => s.leanRunTool(caller, a)))
+  registerTool('vibe_v5_lean_archive', '(member) Archive Lean code. kind="def": a REUSABLE definition/object/assumption → the global cross-project library (Formal/Lib). kind="lemma": a machine-checked lemma → Formal/Proved. kind="proof": the formal proof of a project object → Formal/<target>.lean, and (only once the queued compile settles ok) also Verified/Lean/<target>.lean, marking the object Lean-passed. Re-archiving IDENTICAL content is de-duplicated (deduped:true, no rewrite/recompile). kind="blocked": record an explicit, reasoned "cannot/not worth formalizing" decision (note required). Optional `run` (default true): whether to COMPILE after writing — `run:false` archives the text only (useful when this host has no toolchain; the object then stays `attempted`/unset until something compiles it).', objParams({ kind: { type: 'string', enum: ['def', 'lemma', 'proof', 'blocked'] }, name: S, target: S, content: S, from: S, note: S, run: B }, ['kind']), (s, a, x) => withCaller(s, x, 'a Lean archive', (caller) => s.leanArchive(caller, a)))
   registerTool('vibe_v5_lean_lib', '(member) List (and by default rebuild) the Lean reuse library: your institute\'s Formal/Index.md (with an import-dependency column), plus the global cross-project Formal/Lib and Formal/Proved indexes, the background-compile jobs (jobs) and the injected search path (paths.searchPath). Look here BEFORE writing a new definition so you reuse instead of redefining.', objParams({ refresh: B }), async (s, a) => {
     const r = a && a.refresh === false ? { lib: null, proved: null, objects: Object.keys(s.formalRecords()).length } : await s.rebuildLeanLibIndexes()
     const st = s.status()
     return {
       ok: true, mode: s.formalMode(), rebuilt: !(a && a.refresh === false),
       counts: r, todo: s.formalTodo(), jobs: s.leanJobsView(),
-      objects: Object.keys(s.formalRecords()).map((k) => ({ target: k, status: (s.formalRecords()[k] || {}).status, file: (s.formalRecords()[k] || {}).file, proof: (s.formalRecords()[k] || {}).proof, note: (s.formalRecords()[k] || {}).note, async: (s.formalRecords()[k] || {}).async || null })),
-      paths: { project: 'Formal/（相对研究所根）', lib: 'VibeMath/Formal/Lib/', proved: 'VibeMath/Formal/Proved/', proofs: 'Verified/Lean/', searchPath: s.leanSearchRootView() },
-      hint: '复用优先：先在 Lib/ 里找现成定义；新定义用 vibe_v5_lean_archive kind=\'def\' 归档，已证引理用 kind=\'lemma\'。复用已归档内容：import Formal.Lib.<name> / import Formal.Proved.<name>，或用 vibe_v5_lean_read {name} 取原文逐字复制。同内容重复归档会自动去重。',
+      objects: Object.keys(s.formalRecords()).map((k) => ({ target: k, status: (s.formalRecords()[k] || {}).status, decision: (s.formalRecords()[k] || {}).decision || '', decisionSource: (s.formalRecords()[k] || {}).decisionSource || '', fidelity: (s.formalRecords()[k] || {}).fidelity || null, abstainedCount: Number(((s.formalRecords()[k] || {}).fidelity || {}).abstainedCount || 0), file: (s.formalRecords()[k] || {}).file, proof: (s.formalRecords()[k] || {}).proof, note: (s.formalRecords()[k] || {}).note, async: (s.formalRecords()[k] || {}).async || null })),
+      // L1/L5/L6 (deep-review 5): ONE basis for every entry (cwd-relative, i.e. what a member's own
+      // file tools resolve), an explicit `toolShortForm` for the institute-relative spelling the
+      // tools also accept, and the bare `Lib/` hint replaced by the real library root.
+      paths: {
+        basis: 'all paths below are relative to the SESSION CWD (what your own file tools use)',
+        project: s.instRel('Formal') + '/', toolShortForm: 'Formal/',
+        lib: 'VibeMath/Formal/Lib/', proved: 'VibeMath/Formal/Proved/',
+        proofs: s.instRel('Verified/Lean') + '/', searchPath: s.leanSearchRootView(),
+      },
+      hint: '复用优先：先在 ' + s.instRel('Formal/Lib') + '/ 里找现成定义（vibe_v5_lean_read {name} 取原文）；'
+        + '新定义用 vibe_v5_lean_archive kind=\'def\' 归档，已证引理用 kind=\'lemma\'。'
+        + '复用已归档内容：import Formal.Lib.<name> / import Formal.Proved.<name>。同内容重复归档会自动去重。',
       verify: st.verify ? st.verify.target : null,
     }
   })
@@ -6901,7 +7936,7 @@ export function apply(ctx) {
   // ── /v5 slash command ────────────────────────────────────────────────────
   ctx.effect(() => commands.register({
     name: 'v5', description: 'control the Vibe Math V5 research institute',
-    input: { hint: '[configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set|paper [lang=en] [format=tex] [editor=office] [force]]' },
+    input: { hint: '[configure <研究所名> <问题…>|start|resume|pause|stop|status|report|members|message <收件人|all> <正文…>|meeting <议程…>|hire <用途> <初始任务…>|fire <成员id> [理由…]|add [方向…]|remove <成员id>|set <键>=<值> …|paper [lang=zh|en] [format=both|md|tex] [editor=office|academician] [force]]' },
     handler: async function (inv) {
       const s = getSession(inv && inv.agent)
       if (!s) return { kind: 'error', text: JSON.stringify({ ok: false, error: 'no session' }) }
@@ -6933,7 +7968,20 @@ export function apply(ctx) {
       else if (cmd === 'members') r = { ok: true, members: s.status().members }
       else if (cmd === 'message') r = await s.say('office', { to: rest[0] || 'all', text: rest.slice(1).join(' '), kind: 'office' })
       else if (cmd === 'meeting') r = await s.startMeeting('office', { agenda: rest.join(' '), kind: 'sync' })
-      else if (cmd === 'hire') r = await s.hire('office', { purpose: rest[0] || '', initial_task: rest.slice(1).join(' ') || rest[0] || '' })
+      // C3 (deep-review 4): `/v5 hire X` used to FABRICATE `initial_task` from the purpose, while
+      // the tool path requires both (`hire 必须写明 purpose/initial_task`). The CLI now requires
+      // both too, so the member can never receive a meaningless initial task behind an `ok:true`.
+      else if (cmd === 'hire') {
+        if (!rest.length || !rest.slice(1).join(' ').trim()) {
+          r = {
+            ok: false, code: 'V5_INVALID_ARGUMENT',
+            message: '用法：/v5 hire <用途 purpose> <初始任务 initial_task…>（两者都必填，与 vibe_v5_hire 一致）。'
+              + '例如：/v5 hire 验算大整数分解的边界情形 用 30 分钟写出 50 位以内合数的试除脚本并归档回执。',
+          }
+        } else {
+          r = await s.hire('office', { purpose: rest[0], initial_task: rest.slice(1).join(' ') })
+        }
+      }
       else if (cmd === 'fire') r = await s.fire('office', { id: rest[0] || '', reason: rest.slice(1).join(' ') })
       else if (cmd === 'add') r = await s.addResearcher('office', rest.join(' '))
       else if (cmd === 'remove') r = await s.removeResearcher(rest[0] || '')
@@ -6960,15 +8008,31 @@ export function apply(ctx) {
         r = await s.startPaper('manual', { lang: o.lang, format: o.format, editor: o.editor, force })
       } else if (cmd === 'set') {
         const upd = {}
+        // C2 (deep-review 4): a token WITHOUT `=` used to be skipped silently, so
+        // `/v5 set mathMode typed` answered `ok:true` and changed NOTHING. Every malformed token
+        // is now refused with the accepted shape, instead of a success that lies.
+        const badTokens = []
         for (const tok of rest) {
           const eq = tok.indexOf('=')
-          if (eq <= 0) continue
+          if (eq <= 0) { badTokens.push(tok); continue }
           const k = tok.slice(0, eq), v = tok.slice(eq + 1)
           const n = Number(v)
           upd[k] = Number.isFinite(n) && v !== '' ? n : (v === 'true' ? true : v === 'false' ? false : v)
         }
-        r = await s.setParams(upd)
-      } else r = { ok: false, usage: 'configure|start|resume|pause|stop|status|report|members|message|meeting|hire|fire|add|remove|set|paper [lang=zh|en] [format=both|md|tex] [editor=office|academician] [force]' }
+        if (badTokens.length) {
+          r = {
+            ok: false, code: 'V5_INVALID_ARGUMENT',
+            message: '这些参数缺少 "="（未被解析）：' + badTokens.join('、') + '。正确写法：/v5 set <键>=<值> …（例如 mathMode=typed quorumCap=3 formalVerify=require）',
+          }
+        } else if (!Object.keys(upd).length) {
+          r = {
+            ok: false, code: 'V5_INVALID_ARGUMENT',
+            message: '/v5 set 需要至少一个 <键>=<值>（例如 mathMode=typed）。可用键见 vibe_v5_set 的描述与 /v5 status 的 params。',
+          }
+        } else {
+          r = await s.setParams(upd)
+        }
+      } else r = { ok: false, usage: 'configure <研究所名> <问题…>|start|resume|pause|stop|status|report|members|message <收件人|all> <正文…>|meeting <议程…>|hire <用途> <初始任务…>|fire <成员id> [理由…]|add [方向…]|remove <成员id>|set <键>=<值> …|paper [lang=zh|en] [format=both|md|tex] [editor=office|academician] [force]' }
       // A business failure (the dispatch result's own ok:false) is a FAILED command: the host's
       // CommandResult union distinguishes success from error, and returning 'success' made a rejected
       // invocation look identical to a successful one (same fix as v2/v3).