dsh-vibe-math 2.7.2 → 2.7.3

package/scripts/update-doc-counts.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/**
+ * Regenerate the count sentences quoted by shipped docs FROM THE TREE (D1: derive, don't type).
+ *
+ *   node scripts/update-doc-counts.mjs          # rewrite in place
+ *   node scripts/update-doc-counts.mjs --check  # exit 1 if anything would change (converges: whole-line rewrites)
+ *
+ * Authority: `node tests/run-tests.mjs --counts` (the gate's own JOB list) + `package.json#files`
+ * (shipped FILE counts). Shapes come from tests/helpers/doc-counts-format.mjs, shared with the guard
+ * (tests/audit-readme-counts.mjs) and its mutant harness. Adding a test file reddens the guard; the fix
+ * is to run this script. Whole lines are rebuilt (no partial regex edits), so a corrupted previous
+ * shape is repaired rather than half-matched.
+ *
+ * Grep anchors: update-doc-counts, doc-counts-format.
+ */
+import { readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+import { claims, MARKERS } from '../tests/helpers/doc-counts-format.mjs'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const checkOnly = process.argv.includes('--check')
+
+const derived = JSON.parse(spawnSync(process.execPath, [join(REPO, 'tests', 'run-tests.mjs'), '--counts'], { cwd: REPO, encoding: 'utf8' }).stdout.trim())
+const pkg = JSON.parse(readFileSync(join(REPO, 'package.json'), 'utf8'))
+const shippedFiles = pkg.files.filter((f) => f.startsWith('tests/') && f.endsWith('.mjs'))
+const shipped = { total: shippedFiles.length, suites: shippedFiles.filter((f) => f.endsWith('.test.mjs')).length }
+shipped.probes = shipped.total - shipped.suites
+const c = claims(derived, shipped)
+
+function replaceLine(text, marker, canonical) {
+  const lines = text.split(/\r?\n/)
+  const i = lines.findIndex((l) => l.indexOf(marker) !== -1)
+  if (i === -1) return null
+  if (lines[i] === canonical) return text
+  lines[i] = canonical
+  return lines.join(text.includes('\r\n') ? '\r\n' : '\n')
+}
+
+const log = []
+let changed = 0
+const apply = (file, fn) => {
+  const p = join(REPO, file)
+  const before = readFileSync(p, 'utf8')
+  const after = fn(before)
+  if (after === null) { log.push('MARKER MISS: ' + file); return }
+  if (after !== before) {
+    changed++
+    if (checkOnly) log.push('WOULD CHANGE ' + file)
+    else { writeFileSync(p, after); log.push('updated ' + file) }
+  }
+}
+
+apply('README.md', (s) => replaceLine(s, MARKERS.zhBullet, c.zhBullet))
+apply('README.en.md', (s) => replaceLine(s, MARKERS.enBullet, c.enBullet))
+apply('docs/test-timing.md', (s) => replaceLine(s, MARKERS.ttRow, c.ttRow))
+apply('docs/AUDIT-CHECKLIST.md', (s) => {
+  let out = replaceLine(s, MARKERS.d1Row, c.d1Row)
+  if (out === null) return null
+  out = out.replace(/\d+ 项作业（job count）= \d+ 套件 \+ \d+ 探针\/变体/, c.ckClaim)
+  out = out.replace(/只发 `tests\/` 的 .*?（[^）]*）/, c.ckShipped)
+  return out
+})
+
+log.push((checkOnly ? 'check: ' : '') + 'derived JOBS total=' + derived.total + ' suites=' + derived.suites + ' probes=' + derived.probes
+  + ' | shipped FILES tests/*.mjs=' + shipped.total + ' (' + shipped.suites + ' suites + ' + shipped.probes + ' probes/scripts)'
+  + ' | files changed=' + changed)
+console.log(log.join('\n'))
+process.exit(checkOnly && changed ? 1 : 0)

package/tests/audit-artifact-docs.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * ARTIFACT DOCS vs CODE — the READMEs and the contract doc must not name an artifact a preset does not
+ * write, and must name the ones it does.
+ *
+ * DEFECT CLASS (D2): `Paper/<id>/paper.lock.json` was listed in the README's v4 section as "the directory's
+ * write lock, serialising concurrent rewrites/recompiles" — while v4 writes NO such file and
+ * `vibe-math-v4.js` says the shared-file lock is **NOT IMPLEMENTED** ("nothing is reserved, nothing is
+ * serialized"). The README promised a mechanism the code explicitly disclaims. The inverse direction
+ * matters too: v2/v3 DO write it (vibe-math-v2.js:3725/3732, vibe-math-v3.js:4318/4325) and their
+ * sections must list it.
+ *
+ * Run: node tests/audit-artifact-docs.mjs
+ * Env (mutant harness): ARTIFACT_README / ARTIFACT_README_EN / ARTIFACT_DOC / ARTIFACT_V2_JS /
+ * ARTIFACT_V3_JS / ARTIFACT_V4_JS / ARTIFACT_V5_JS (absolute or repo-relative).
+ */
+import { readFileSync } from 'node:fs'
+import { dirname, isAbsolute, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const ARTIFACT = 'paper.lock.json'
+let passed = 0, failed = 0
+const failures = []
+const ok = (cond, label, detail) => { if (cond) passed++; else { failed++; failures.push(label + (detail ? ' — ' + detail : '')) } }
+
+const read = (envName, rel) => {
+  const v = process.env[envName]
+  return readFileSync(v ? (isAbsolute(v) ? v : join(REPO, v)) : join(REPO, rel), 'utf8')
+}
+const count = (text, needle) => text.split(needle).length - 1
+
+// 1) CODE TRUTH: which presets write the artifact?
+const presets = {
+  v2: read('ARTIFACT_V2_JS', 'vibe-math-v2/vibe-math-v2.js'),
+  v3: read('ARTIFACT_V3_JS', 'vibe-math-v3/vibe-math-v3.js'),
+  v4: read('ARTIFACT_V4_JS', 'vibe-math-v4/vibe-math-v4.js'),
+  v5: read('ARTIFACT_V5_JS', 'vibe-math-v5/vibe-math-v5.js'),
+}
+const writers = Object.keys(presets).filter((k) => count(presets[k], ARTIFACT) > 0)
+const nonWriters = Object.keys(presets).filter((k) => count(presets[k], ARTIFACT) === 0)
+ok(writers.length > 0, 'at least one preset writes ' + ARTIFACT + ' (else the doc expectation is empty)', JSON.stringify(writers))
+ok(writers.join(',') === 'v2,v3', 'the writing presets are exactly v2,v3 (derived from code)', JSON.stringify({ writers, nonWriters }))
+
+// 2) every README mention must sit in a writer's context OR be an explicit denial
+const DENY = /(不写|未实现|无此锁|not implemented|does NOT write|no such|not write)/i
+for (const [name, envName, rel] of [['README.md', 'ARTIFACT_README', 'README.md'], ['README.en.md', 'ARTIFACT_README_EN', 'README.en.md']]) {
+  const lines = read(envName, rel).split(/\r?\n/)
+  const mentions = lines.map((l, i) => ({ n: i + 1, l })).filter((x) => x.l.indexOf(ARTIFACT) !== -1)
+  ok(mentions.length > 0, name + ' mentions ' + ARTIFACT + ' somewhere (it is a real artifact for v2/v3)')
+  const bad = mentions.filter((m) => !/v2|v3/.test(m.l) && !DENY.test(m.l))
+  ok(bad.length === 0, '★ ' + name + ': every ' + ARTIFACT + ' mention names a WRITING preset or denies the claim', JSON.stringify(bad.map((b) => b.n)))
+  const listed = mentions.filter((m) => /Paper\/<[^>]*>\/\{[^}]*paper\.lock\.json/.test(m.l))
+  ok(listed.length >= 2, '★ ' + name + ' lists ' + ARTIFACT + ' inside the v2/v3 artifact braces', 'brace mentions=' + listed.length)
+}
+
+// 3) the contract doc must state the scope (v2/v3 write it; v4/v5 do not)
+const doc = read('ARTIFACT_DOC', 'docs/final-paper.md')
+const docLines = doc.split(/\r?\n/).filter((l) => l.indexOf(ARTIFACT) !== -1)
+ok(docLines.length > 0, 'docs/final-paper.md documents ' + ARTIFACT)
+const docScope = docLines.some((l) => /v2\/v3/.test(l) && DENY.test(l))
+ok(docScope, '★ docs/final-paper.md scopes ' + ARTIFACT + ' to v2/v3 AND states that v4/v5 do not write it', docLines[0] ? docLines[0].slice(0, 80) : '(no line)')
+
+// 4) the non-writer's own disclaimer must exist in code (so the doc denial is backed by the source)
+ok(/NOT IMPLEMENTED/.test(presets.v4) && /claim_write/.test(presets.v4),
+  'vibe-math-v4.js still carries the explicit NOT-IMPLEMENTED shared-lock disclaimer (the source of the doc denial)')
+
+console.log('')
+console.log('=== ARTIFACT DOCS: ' + passed + ' passed, ' + failed + ' failed ===')
+for (const f of failures) console.error('  - ' + f)
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-artifact-docs.mutants.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+/**
+ * Mutant harness for tests/audit-artifact-docs.mjs (ships: `tests/*.mutants.mjs`).
+ *
+ * Two single-site mutations, ONE PER DIRECTION (the guard must bite both ways):
+ *   A) a COPY of README.md whose v2/v3 brace list loses `paper.lock.json`  -> the listing assertion reddens
+ *   B) a COPY of vibe-math-v4.js that mentions `paper.lock.json`           -> the "writers are exactly v2,v3"
+ *      assertion reddens (i.e. if v4 ever gains the artifact, the docs expectation moves with the code)
+ *
+ * Run: node tests/audit-artifact-docs.mutants.mjs
+ */
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+const REPO = join(HERE, '..')
+const GUARD = join(HERE, 'audit-artifact-docs.mjs')
+const ARTIFACT = 'paper.lock.json'
+let passed = 0, failed = 0
+const ok = (c, l, d) => { if (c) { passed++; console.log('  ok   ' + l) } else { failed++; console.log('  FAIL ' + l + (d ? ' — ' + d : '')) } }
+
+const run = (env) => {
+  const r = spawnSync(process.execPath, [GUARD], { cwd: REPO, encoding: 'utf8', env: Object.assign({}, process.env, env || {}) })
+  const out = String(r.stdout || '') + String(r.stderr || '')
+  return { status: r.status, out, failLines: out.split('\n').filter((l) => /^  - /.test(l)) }
+}
+const baseline = run(null)
+ok(baseline.status === 0, 'baseline: the artifact-docs guard is green',
+  (baseline.out.trim().split('\n').filter(Boolean).slice(-1)[0] || '').slice(0, 80))
+
+const dir = mkdtempSync(join(tmpdir(), 'artifact-mut-'))
+// A) README loses the v2/v3 brace listing
+const zh = readFileSync(join(REPO, 'README.md'), 'utf8')
+const braces = zh.match(/Paper\/<[^>]*>\/\{[^}]*paper\.lock\.json[^}]*\}/g) || []
+if (!braces.length) ok(false, 'A: the README v2/v3 brace listing exists (harness and guard agree on the shape)', 'ANCHOR MISS')
+else {
+  const tampered = zh.split(braces[0]).join(braces[0].replace(',' + ARTIFACT, ''))
+  writeFileSync(join(dir, 'README.md'), tampered)
+  const a = run({ ARTIFACT_README: join(dir, 'README.md') })
+  const named = a.failLines.some((l) => l.indexOf('lists ' + ARTIFACT + ' inside the v2/v3 artifact braces') !== -1)
+  ok(a.status !== 0 && named, '★ A: dropping the artifact from the v2/v3 brace list reddens the guard by name', 'exit=' + a.status)
+  if (!named) for (const l of a.failLines.slice(0, 3)) console.log('      guard failure: ' + l.trim().slice(0, 130))
+}
+// B) v4 "gains" the artifact
+const v4 = readFileSync(join(REPO, 'vibe-math-v4/vibe-math-v4.js'), 'utf8')
+writeFileSync(join(dir, 'vibe-math-v4.js'), v4 + '\n// mutant: pretend v4 writes ' + ARTIFACT + '\n')
+const b = run({ ARTIFACT_V4_JS: join(dir, 'vibe-math-v4.js') })
+const namedB = b.failLines.some((l) => l.indexOf('the writing presets are exactly v2,v3') !== -1)
+ok(b.status !== 0 && namedB, '★ B: a v4 that mentions the artifact reddens the "writers are exactly v2,v3" assertion', 'exit=' + b.status)
+if (!namedB) for (const l of b.failLines.slice(0, 3)) console.log('      guard failure: ' + l.trim().slice(0, 130))
+
+rmSync(dir, { recursive: true, force: true })
+console.log('')
+console.log('=== ARTIFACT DOCS MUTANTS: ' + passed + ' passed, ' + failed + ' failed ===')
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-installer-assertions.mutants.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * Mutant harness for the installer ASSERTION-QUALITY work (ships: `tests/*.mutants.mjs`).
+ *
+ * It replaces the dev-only scratch proofs (`_oneoff/auditR2/a78-mutants.mjs`, `a8-mutant.mjs`) so a package
+ * reader can reproduce them from the tarball. Every case is a SINGLE-SITE edit to a COPY of installer.js,
+ * injected through the guards' `INSTALLER_JS` env seam, and must redden the NAMED assertion:
+ *
+ *   A7-version    perturb the structured version the probe returns   -> compat: "STRUCTURED field: version"
+ *   A7-source     make the structured source stop naming the service -> compat: "structured field naming the service"
+ *   A8-failure    inject one failure line in the backup path         -> policy: "NOT reported as a failure (report-level"
+ *   DL-label      revert one label to English-only                  -> policy: "English-only label"
+ *   DL-duplicate  report the cleanup action a second time            -> policy: "reported EXACTLY ONCE"
+ *
+ * Run: node tests/audit-installer-assertions.mutants.mjs
+ */
+import { mkdtempSync, copyFileSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const HERE = fileURLToPath(new URL('./', import.meta.url))
+const REPO = join(HERE, '..')
+const SRC = join(REPO, 'installer.js')
+const COMPAT = join(HERE, 'audit-installer-compat.test.mjs')
+const POLICY = join(HERE, 'audit-installer-policy.test.mjs')
+let passed = 0, failed = 0
+const ok = (c, l, d) => { if (c) { passed++; console.log('  ok   ' + l) } else { failed++; console.log('  FAIL ' + l + (d ? ' — ' + d : '')) } }
+
+const ORIGIN = readFileSync(SRC, 'utf8')
+const OUT_LINE = 'const out = { version: first.version, source: first.source, probes: probes.slice() }'
+const CLEANUP_IF = 'if (removedFiles > 0 || removedDirs.length > 0 || cleanupNotes.length > 0) {'
+const CASES = [
+  { name: 'A7-version: the structured version is perturbed', guard: COMPAT, expect: 'STRUCTURED field: version',
+    edit: (s) => s.replace(OUT_LINE, "const out = { version: String(first.version) + '-mutated', source: first.source, probes: probes.slice() }") },
+  { name: 'A7-source: the structured source stops naming the service', guard: COMPAT, expect: 'structured field naming the service',
+    edit: (s) => s.replace(OUT_LINE, "const out = { version: first.version, source: 'pm', probes: probes.slice() }") },
+  { name: 'A8-failure: a failure line is injected in the backup path', guard: POLICY, expect: 'NOT reported as a failure (report-level',
+    edit: (s) => s.replace('const backupFailures = []', "const backupFailures = []\n    logger?.warn?.('[dsh-vibe-math] 预设安装/更新失败：mutant injected failure line')") },
+  { name: 'DL-label: one label is reverted to English-only', guard: POLICY, expect: 'English-only label',
+    edit: (s) => s.replace("'[dsh-vibe-math] 预设清理：", "'[dsh-vibe-math] preset cleanup: ") },
+  { name: 'DL-duplicate: the cleanup action is reported twice', guard: POLICY, expect: 'reported EXACTLY ONCE',
+    edit: (s) => s.replace(CLEANUP_IF, CLEANUP_IF + "\n      logger?.info?.('[dsh-vibe-math] 预设清理：再次报告（删除 ' + removedFiles + ' 个文件）')") },
+]
+for (const c of CASES) {
+  const mutated = c.edit(ORIGIN)
+  if (mutated === ORIGIN) { ok(false, c.name + ' — the single-site anchor applies', 'ANCHOR MISS'); continue }
+  const dir = mkdtempSync(join(tmpdir(), 'installer-assert-mut-'))
+  copyFileSync(SRC, join(dir, 'installer.js'))
+  writeFileSync(join(dir, 'installer.js'), mutated)
+  const r = spawnSync(process.execPath, [c.guard], { cwd: REPO, encoding: 'utf8', maxBuffer: 1 << 26, env: Object.assign({}, process.env, { INSTALLER_JS: join(dir, 'installer.js') }) })
+  const o = String(r.stdout || '') + String(r.stderr || '')
+  const failLines = o.split('\n').filter((l) => /^  - /.test(l))
+  const named = failLines.some((l) => l.indexOf(c.expect) !== -1)
+  const sum = (o.split('\n').filter((l) => /passed, \d+ failed/.test(l)).slice(-1)[0] || '').trim()
+  ok(r.status !== 0 && named, '★ ' + c.name + ' -> ' + sum, r.status === 0 ? 'the guard stayed GREEN' : (named ? '' : 'named red not found'))
+  if (!named) for (const l of failLines.slice(0, 3)) console.log('        ' + l.trim().slice(0, 140))
+  rmSync(dir, { recursive: true, force: true })
+}
+console.log('')
+console.log('=== INSTALLER ASSERTION MUTANTS: ' + passed + ' red as required, ' + failed + ' problem(s) ===')
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-installer-compat.test.mjs

@@ -19,7 +19,7 @@ import { readFileSync, mkdtempSync, mkdirSync, writeFileSync, existsSync, rmSync
 import { tmpdir } from 'node:os'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import { join, resolve } from 'node:path'
-import { satisfiesDshRange, dshVersionVerdict, PRESETS } from '../installer.js'
+import { satisfiesDshRange, dshVersionVerdict, detectDshVersion, PRESETS } from '../installer.js'
 
 const HERE = fileURLToPath(new URL('../', import.meta.url))
 const pkg = JSON.parse(readFileSync(join(HERE, 'package.json'), 'utf8'))
@@ -196,13 +196,61 @@ console.log('=== 4. a pluginManager that never answers must not hold the row ===
   // the timeout must NOT replace a working probe: a prompt service still supplies the version
   const quick = run({ listBundles: async () => [{ name: '@deepseek-ai/dsh-base', version: '0.2.0-rc.2' }] })
   await mod.apply(quick.ctx)
-  ok(quick.logs.some((l) => l.includes('0.2.0-rc.2')),
-    'a prompt listBundles() still supplies the version (the timeout is a fallback, not a replacement)',
-    quick.logs.filter((l) => l.includes('source')).join(' | ').slice(0, 160))
+  // A7 (assertion quality): the version+source claim is asserted on the STRUCTURED result - a bare
+  // `logs.some(l => l.includes('0.2.0-rc.2'))` would also pass if the string appeared anywhere for any
+  // reason, and `l.includes('source')` would pass on the English word alone. The log keeps ONE
+  // shape-anchored check.
+  const probeQuick = (await import(pathToFileURL(INSTALLER_SRC).href + '?t=' + Date.now())).detectDshVersion || detectDshVersion
+  const detQuick = await probeQuick(quick.ctx)
+  ok(detQuick && detQuick.version === '0.2.0-rc.2',
+    '★ a prompt listBundles() still supplies the version (STRUCTURED field: version)', JSON.stringify(detQuick && { version: detQuick.version, source: detQuick.source }))
+  ok(!!detQuick && typeof detQuick.source === 'string' && detQuick.source.indexOf('pluginManager') === 0,
+    '★ ...and the winning SOURCE is a structured field naming the service (not the word "source" in a log line)', JSON.stringify(detQuick && detQuick.source))
+  ok(quick.logs.some((l) => /v?0\.2\.0-rc\.2/.test(l)),
+    '...and a log line SHAPE carries that version (shape-anchored, not a bare substring)')
   rmSync(tmp, { recursive: true, force: true })
 }
 
+// Installer review (finding): several sources can report the host's version and "first available wins"
+// hid a conflicting host state. The probe records EVERY value+source, keeps the first available
+// authoritative (priority unchanged), and assembles `disagreement` ONLY when one exists.
+{
+  const prev = process.env.DSH_VERSION
+  try {
+    // Import through INSTALLER_SRC (env-overridable) so a single-site mutant on a COPY of installer.js
+    // reaches these assertions - that is what makes the mutant below able to bite.
+    const mod = await import(pathToFileURL(INSTALLER_SRC).href + '?t=' + Date.now())
+    const probe = mod.detectDshVersion || detectDshVersion
+    process.env.DSH_VERSION = '9.9.9'
+    const disagreeing = { get: (n) => (n === 'pluginManager' ? { listBundles: async () => [{ name: '@deepseek-ai/dsh', version: '8.8.8' }] } : undefined) }
+    const d1 = await probe(disagreeing)
+    ok(d1 && d1.version === '9.9.9' && d1.source === 'DSH_VERSION', 'the FIRST available source stays authoritative (which version wins is unchanged)', JSON.stringify(d1))
+    ok(d1 && Array.isArray(d1.probes) && d1.probes.length >= 2 && d1.probes.some((p) => p.source.indexOf('pluginManager') === 0 && p.version === '8.8.8'),
+      '★ every probe value+source is recorded (nothing is silently dropped)', JSON.stringify(d1 && d1.probes))
+    ok(!!(d1 && d1.disagreement) && d1.disagreement.primary === 'DSH_VERSION' && d1.disagreement.conflicts.some((c) => c.version === '8.8.8'),
+      '★ DISAGREEING probes surface a disagreement slot naming the conflict', JSON.stringify(d1 && d1.disagreement))
+    const agreeing = { get: (n) => (n === 'pluginManager' ? { listBundles: async () => [{ name: '@deepseek-ai/dsh', version: '9.9.9' }] } : undefined) }
+    const d2 = await probe(agreeing)
+    ok(d2 && d2.version === '9.9.9' && !('disagreement' in d2), '★ AGREEING probes print NO disagreement slot (assemble-only-on-conflict)', JSON.stringify(d2))
+    // The `%s` placeholder that could reach the user: every installer log line must pre-concatenate.
+    const isrc = readFileSync(INSTALLER_SRC, 'utf8')
+    const printf = isrc.split('\n').filter((l) => /logger|console/.test(l) && /%[sd]/.test(l))
+    ok(printf.length === 0, '★ no installer log line carries a bare printf placeholder (%s/%d)', JSON.stringify(printf.slice(0, 2)))
+  } finally {
+    if (prev === undefined) delete process.env.DSH_VERSION; else process.env.DSH_VERSION = prev
+  }
+}
+
 console.log('')
+// The self-check proves service/API SHAPE only - never runtime SEMANTICS. The caveat must be on the
+// USER-VISIBLE pass line, so a passing self-check is not read as a compatibility claim.
+{
+  const src = readFileSync(INSTALLER_SRC, 'utf8')
+  const line = src.split(/\r?\n/).find((l) => l.indexOf('自检通过') !== -1 && l.indexOf('logger') !== -1) || ''
+  ok(line.length > 0, 'the installer reports a passing host self-check')
+  ok(line.indexOf('形状') !== -1 && line.indexOf('行为') !== -1, '★ self-check caveat: the PASS line states that SHAPE is proven and BEHAVIOUR is not', JSON.stringify(line.slice(0, 90)))
+}
+
 console.log('=== INSTALLER COMPAT: ' + passed + ' passed, ' + failed + ' failed ===')
 if (failed) { for (const f of failures) console.error('  - ' + f); process.exit(1) }
 console.log('ALL GREEN')

package/tests/audit-installer-policy.test.mjs

@@ -79,7 +79,10 @@ async function applyFrom(pkgDir, home, logs) {
   return logs
 }
 const sha = (buf) => createHash('sha256').update(buf).digest('hex')
-const failedLog = (logs) => logs.filter((l) => l.includes('preset install/update failed'))
+// Label-tolerant on purpose: the installer's user-facing failure line is emitted by the logger helper
+// (not console.*) and its label is localised; the FACT asserted here is that a failure line exists.
+const FAILURE_LINE = /预设安装\/更新失败|preset install\/update failed/
+const failedLog = (logs) => logs.filter((l) => FAILURE_LINE.test(l))
 
 const tmp = mkdtempSync(join(tmpdir(), 'vibe-installer-policy-'))
 const home = join(tmp, 'dshhome')
@@ -153,7 +156,9 @@ let userJsBytes = null
   const state = JSON.parse(readFileSync(stateFile, 'utf8'))
   ok(state.version === '2.0.0', 'the state records the new version', String(state.version))
   ok(logs.some((l) => l.includes('.vibe-math-backup')), 'the log names the backup location')
-  ok(logs.some((l) => l.includes('复制一份')), 'the log tells the user how to customize a preset properly')
+  // A8: the FACT (a version change backs up the user's edit) is asserted structurally above (backup path
+  // + byte equality). What remains is guidance wording, so this is the ONE labelled wording smoke check.
+  ok(logs.some((l) => /复制一份/.test(l)), '[wording smoke check — the ONE allowed] the log tells the user how to customize a preset properly')
   ok(failedLog(logs).length === 0, 'apply() swallowed no failure', failedLog(logs)[0])
 }
 
@@ -164,7 +169,13 @@ console.log('=== 4. a deleted file at the SAME version: restored, nothing backed
   ok(existsSync(at(PRESETS[2], 'agent.cordis.yml')), 'a deleted managed file is restored')
   ok(isCopyOf(PRESETS[2], 'agent.cordis.yml'), 'the restored file is byte-identical to the shipped one')
   ok(!existsSync(join(backupRoot, '2.0.0')), 'a run that replaced nothing creates no backup directory')
-  ok(logs.some((l) => l.includes('restored')), 'the restore is reported')
+  // Guard-sync: the installer's user-visible stream is Chinese by convention (one language, see the
+  // comment at the cleanup line), so these assert the FACT (an action keyword + the count) rather than
+  // an English word.
+  // "one action, one line": the restore must be reported, and reported EXACTLY ONCE (a second report of the
+  // same action is the defect the duplicate-log review was about).
+  const restoreLines = logs.filter((l) => /\u8fd8\u539f\u4e86\s*\d+\s*\u4e2a\u7f3a\u5931\u7684\u9884\u8bbe\u6587\u4ef6/.test(l))
+  ok(restoreLines.length === 1, '★ the restore is reported EXACTLY ONCE (one action, one line)', JSON.stringify(restoreLines.map((l) => l.slice(0, 60))))
   ok(failedLog(logs).length === 0, 'apply() swallowed no failure', failedLog(logs)[0])
 }
 
@@ -182,7 +193,8 @@ console.log('=== 5. a preset this bundle no longer ships ===')
   ok(!existsSync(join(presetRoot, 'vibe-math-v1', 'legacy.js')), 'a package-owned file of a dropped preset is removed')
   ok(!existsSync(join(presetRoot, 'vibe-math-v1')), 'the dropped preset directory is removed once empty')
   ok(existsSync(join(presetRoot, 'vibe-math-v0', 'mine.js')), 'a file recorded as user-owned in a dropped preset is kept')
-  ok(logs.some((l) => l.includes('cleanup')), 'the cleanup is reported')
+  const cleanupLines = logs.filter((l) => /\u9884\u8bbe\u6e05\u7406/.test(l) && /\u5220\u9664\s*\d+\s*\u4e2a\u6587\u4ef6/.test(l))
+  ok(cleanupLines.length === 1, '★ the cleanup is reported EXACTLY ONCE (one action, one line)', JSON.stringify(cleanupLines.map((l) => l.slice(0, 60))))
   ok(failedLog(logs).length === 0, 'apply() swallowed no failure', failedLog(logs)[0])
 }
 
@@ -224,7 +236,9 @@ console.log('=== 7. an unreadable package manifest replaces nothing (and self-he
   ok(readFileSync(at(PRESETS[1], 'preset.yml')).equals(readFileSync(shipped(PRESETS[1], 'preset.yml', pkgC))),
     'the next readable run replaces the drift as a normal version change')
   ok(readFileSync(earlier, 'utf8') === 'EARLIER COPY\n', 'a backup that already exists for that version is kept byte-for-byte (the earliest copy wins)')
-  ok(logs2.every((l) => !l.includes('备份失败')), 'a pre-existing backup for the same version is NOT reported as a failure')
+  // A8: report-level, not wording-level - a pre-existing backup must not be counted as a failure by the
+  // guard's own failure-line helper (which matches the localised failure label, either spelling).
+  ok(failedLog(logs2).length === 0, '★ a pre-existing backup for the same version is NOT reported as a failure (report-level check, not a wording check)', failedLog(logs2)[0])
   ok(JSON.parse(readFileSync(stateFile, 'utf8')).version === '3.0.0', 'the state records the new version')
 
   // the backup directory must never be readable as a preset: DSH only accepts [a-z0-9][a-z0-9-]* ids
@@ -255,7 +269,7 @@ console.log('=== 9. a recorded version NEWER than this package (a downgrade) say
   const backup = join(backupRoot, '3.0.0', PRESETS[0].dst, 'preset.yml')
   ok(existsSync(backup) && readFileSync(backup).equals(newerBytes), 'the replaced newer bytes are backed up under the version they came from')
   ok(JSON.parse(readFileSync(stateFile, 'utf8')).version === '2.0.0', 'the state records the version that is actually installed now')
-  ok(!logs.some((l) => l.includes('preset install/update failed')), 'apply() swallowed no failure')
+  ok(failedLog(logs).length === 0, 'apply() swallowed no failure')
 }
 
 // ============================================================================================
@@ -302,7 +316,7 @@ console.log('=== 10. preset writes are ATOMIC: a failed write cannot touch the d
   const logs = await applyFrom(pkgB, H.home, [])
   ok(readText(H.at(target.p, target.f)) === userBytes.toString(),
     'a failed preset write leaves the destination byte-for-byte intact (tmp+rename, never in place)')
-  ok(logs.some((l) => l.includes('preset install/update failed')),
+  ok(failedLog(logs).length > 0,
     '...and the failure is reported instead of being swallowed', logs.filter((l) => l.includes('failed')).join(' | ').slice(0, 200))
   ok((readJson(H.state) || {}).version === '1.0.0',
     'the state still describes the bytes that are actually on disk, so the next boot self-heals')
@@ -414,7 +428,7 @@ console.log('=== 15. a failed state write is reported (not swallowed), and does
   const logs = await applyFrom(pkgA, H.home, [])
   ok(logs.some((l) => l.includes('状态文件写入失败')),
     'a failed state write is REPORTED (it used to fail silently)', logs.filter((l) => l.includes('写入失败')).join(' | ').slice(0, 160))
-  ok(!logs.some((l) => l.includes('preset install/update failed')), '...without aborting the preset step')
+  ok(failedLog(logs).length === 0, '...without aborting the preset step')
   ok((readJson(H.state) || {}).version === '1.0.0',
     'the previous state file is still parseable (tmp+rename left no half-written file)')
   rmSync(H.state + '.' + process.pid + '.0.tmp', { recursive: true, force: true })
@@ -478,6 +492,25 @@ console.log('=== 16b. a stale file whose BACKUP FAILS is kept, not deleted unbac
   rmSync(join(H.root, '.vibe-math-backup'), { force: true })
 }
 
+console.log('=== 16. one action, one language: no user-facing line carries an English-only label ===')
+{
+  // The convention (docs/AUDIT-CHECKLIST.md): installer user-facing output is Chinese; an English-only
+  // LABEL is a defect (an English domain word inside a Chinese label, like `preset 声明方式`, is fine).
+  // This is a CONVENTION sweep, not a wording pin: any CJK-bearing label passes.
+  const src = readFileSync(INSTALLER_SRC, 'utf8')
+  const labelOf = (l) => { const m = /\[dsh-vibe-math\]\s*([^:：]*)/.exec(l); return m ? m[1].trim() : '' }
+  const asciiOnly = (lab) => lab.length > 0 && /^[\x20-\x7e]+$/.test(lab)
+  const sites = src.split(/\r?\n/).filter((l) => /logger\?\.(info|warn|error)\?\.\(/.test(l))
+  ok(sites.length > 0, 'the installer has user-facing log sites to sweep (found ' + sites.length + ')')
+  const badSites = sites.filter((l) => asciiOnly(labelOf(l)))
+  ok(badSites.length === 0, '★ no user-facing log SITE carries an English-only label (installer output is Chinese)',
+    JSON.stringify(badSites.map((l) => l.trim().slice(0, 70))))
+  const runtimeLogs = await applyFrom(pkgB, home, [])
+  const badRuntime = runtimeLogs.filter((l) => asciiOnly(labelOf(l)))
+  ok(badRuntime.length === 0, '★ ...and no CAPTURED line does either (code and convention agree at runtime)',
+    JSON.stringify(badRuntime.slice(0, 2)))
+}
+
 rmSync(tmp, { recursive: true, force: true })
 
 console.log('')

package/tests/audit-math-computation-contract.mjs

@@ -108,14 +108,48 @@ for (const P of PRESETS) {
     ? "registerTool('vibe_math_set_params'"
     : (P.dir === 'vibe-math-v4' ? "registerTool('vibe_v4_set'" : "registerTool('vibe_v5_set'")
   {
-    const i = js.indexOf(SET_TOOL)
-    const callText = i === -1 ? '' : js.slice(i, js.indexOf('registerTool(', i + 1) === -1 ? i + 4000 : js.indexOf('registerTool(', i + 1))
-    const oi = callText.lastIndexOf('objParams(')
-    const setSchema = oi === -1 ? '' : callText.slice(oi)
-    ok(setSchema.length > 0, tag + 'set tool takes an objParams({...}) schema argument')
-    for (const k of SIX) {
-      ok(new RegExp('(^|[{,\\s])' + k + '\\s*:').test(setSchema), tag + 'set schema has the property ' + k + ' (property-level, not prose)', 'schema len ' + setSchema.length)
-    }
+    // §9.7 ㉓/㉜: EVERY registration site is checked, not just the first. This preset class is defined by
+    // having TWO independent registration layers (session `makeSession` + `apply`, each with its own
+    // `objParams`), so an audit that inspects only the first cannot see the second diverge — the F-B defect
+    // class. If a site ever legitimately carries a narrower schema, record that difference ON THAT SITE
+    // explicitly instead of narrowing the loop back to "first site only".
+    const sites = []
+    for (let at = js.indexOf(SET_TOOL); at !== -1; at = js.indexOf(SET_TOOL, at + 1)) sites.push(at)
+    ok(sites.length >= 1, tag + 'the set tool is registered', 'sites=' + sites.length)
+    // F-B (docs/parameter-schema.md): a schema argument has two shapes —
+    //   objParams({ ...literal... })   the historical hand-written table
+    //   objParams(paramProps())        derived from the SINGLE source PARAM_SCHEMA; the machine key set is
+    //                                  pinned by PARAM_PROPS_KEYS (+ PARAM_PROPS_EXTRA)
+    // The derived form has NO `{` after `objParams(`, so a naive slice grabbed unrelated text (331-char
+    // fragment). Resolve it to the single-source key list, searched FILE-WIDE (that table is module scope).
+    const derivedKeys = (() => {
+      const km = /const PARAM_PROPS_KEYS = \[([^\]]*)\]/.exec(js)
+      if (!km) return null
+      const keys = km[1].split(',').map((s) => s.trim().replace(/^['"]|['"]$/g, '')).filter(Boolean)
+      const em = /const PARAM_PROPS_EXTRA = \{([\s\S]*?)\n\s*\}/.exec(js)
+      const extra = em ? [...em[1].matchAll(/^\s*([A-Za-z_$][\w$]*)\s*:/gm)].map((m) => m[1]) : []
+      return [...new Set(keys.concat(extra))]
+    })()
+    sites.forEach((idx, n) => {
+      const next = js.indexOf('registerTool(', idx + 1)
+      const callText = js.slice(idx, next === -1 ? idx + 4000 : next)
+      const oi = callText.lastIndexOf('objParams(')
+      const setSchema = oi === -1 ? '' : callText.slice(oi)
+      const at = oi === -1 ? -1 : oi + 'objParams('.length
+      const open = at === -1 ? -1 : callText.indexOf('{', at)
+      const close = at === -1 ? -1 : callText.indexOf(')', at)
+      const literalForm = open !== -1 && (close === -1 || open < close)
+      ok(literalForm ? setSchema.length > 0 : !!derivedKeys,
+        tag + 'site#' + n + ' takes an objParams(...) schema argument (literal table or single-source derivation)',
+        literalForm ? 'schema len ' + setSchema.length : 'derived keys ' + (derivedKeys ? derivedKeys.length : 0))
+      for (const k of SIX) {
+        const present = literalForm
+          ? new RegExp('(^|[{,\\s])' + k + '\\s*:').test(setSchema)
+          : !!derivedKeys && derivedKeys.includes(k)
+        ok(present, tag + 'site#' + n + ' set schema has the property ' + k + ' (property-level, not prose)',
+          literalForm ? 'schema len ' + setSchema.length : 'derived keys ' + (derivedKeys ? derivedKeys.length : 0))
+      }
+    })
   }
   if (P.dir === 'vibe-math-v2' || P.dir === 'vibe-math-v3') {
     const schema = arrayBlock(js, 'const PARAM_SCHEMA')
@@ -238,6 +272,28 @@ for (const f of ['README.md', 'README.en.md']) {
   ok(doc.indexOf('Octave / Julia 未安装') !== -1 && doc.indexOf('VERIFY') !== -1 && doc.indexOf('无法强制禁网') !== -1, 'docs §6 keeps the still-unverified set (no Octave/Julia, commercial VERIFY, no network/write enforcement)')
   ok(doc.indexOf('只通过假 subprocess seam 验证') === -1, 'docs §6 no longer claims engine execution was verified ONLY through the fake seam (stale claim removed)')
   ok(doc.indexOf('串行') !== -1 && doc.indexOf('跨进程') !== -1, 'docs §6 states the in-process serialisation and the cross-process limitation')
+  // ── P1/6.1: the v4 frozen participant set is documented as the ATOMIC triple, and the deprecated
+  // alias is described as an alias - both in the doc AND verifiable in the preset source.
+  {
+    const v4 = existsSync(join(ROOT, 'vibe-math-v4/vibe-math-v4.js')) ? read('vibe-math-v4/vibe-math-v4.js') : ''
+    const atomic = /frozen:\s*\(function\(sn\)\{\s*return \{version: sn\?sn\.rosterVersion:null, participants: sn\?sn\.rosterSnapshot:null, kind:/.test(v4)
+    ok(atomic, 'v4 exposes the frozen participant set as ONE atomic object {version, participants, kind}')
+    const alias = /frozenParticipants:\s*\(activeRosterSnapshot\(\)\|\|\{\}\)\.rosterSnapshot\|\|null/.test(v4) && /deprecated/.test(v4)
+    ok(alias, 'v4 keeps `frozenParticipants` only as a deprecated alias of frozen.participants')
+    ok(doc.indexOf('frozen') !== -1 && doc.indexOf('deprecated') !== -1 && doc.indexOf('原子') !== -1,
+      'docs document the atomic `frozen{version,participants,kind}` and mark the alias deprecated')
+  }
+  // ── P1/6.2: the evidence-field list cannot drift from the code again - every timeout evidence field
+  // the module produces must be named in the doc, and vice versa for the two receipt-only ones.
+  {
+    const mod = readFileSync(join(ROOT, 'vibe-math-v2/math-computation.js'), 'utf8')
+    const timeoutFields = ['partialStdout', 'partialStderr', 'stdout', 'stderr', 'exit', 'timedOut']
+    const docMissing = timeoutFields.filter((f) => doc.indexOf(f) === -1)
+    ok(docMissing.length === 0, 'docs name every MATH_TIMEOUT evidence field', 'missing in doc: ' + JSON.stringify(docMissing))
+    const codeMissing = ['partialStdout', 'partialStderr'].filter((f) => mod.indexOf(f) === -1)
+    ok(codeMissing.length === 0, 'the doc-sync check is anchored in the code too (partialStdout/partialStderr exist in the module)',
+      'missing in code: ' + JSON.stringify(codeMissing))
+  }
 }
 
 console.log('')