dsh-vibe-math 2.7.2 → 2.7.3

package/vibe-math-v2//345/256/236/347/216/260/346/226/271/346/241/210.md

@@ -484,4 +484,8 @@ v2 **没有会话投影**，所以记录与待办一起持久化在 v2 自己的
   `require` 档**必须**出现（那里门禁真的会搁置裁定）。
 - `kind='def'/'lemma'` 运行未通过时，工具返回值**不得**声称"可直接 import 复用"。
 
-套件支持 `V2_PLUGIN` 环境变量指向变异副本，供灵敏度探针使用。
+套件支持 `V2_PLUGIN` 环境变量指向变异副本，供灵敏度探针使用。
+
+## 状态 / 报告字段：`verifyTasksView`（单一来源）
+
+v2 的 **status 与 report 两个视图**里出现的验证任务列表由**同一个** helper `verifyTasksView(tasks)` 产出（`vibe-math-v2.js:2995`；调用点 `:2046` 与 `:4039`），因此两处字段必须**逐个字段一致**；任何"在某一侧顺手补一个字段"的改动都会让两个视图分叉。该一致性由 `tests/formal-verify-v2.test.mjs:1694-1698` 钉住（两侧取自同一 helper 且字段集合相等）。

package/vibe-math-v3/agent.cordis.yml

@@ -56,6 +56,7 @@
       - vibe_math_index — rebuild State/index.json from the Markdown knowledge base.
       - vibe_math_method_add / vibe_math_method_list — manually add / list method cards (Methods/ + global).
       - vibe_math_lock_status — project lock occupancy (the lock is a renewed lease: while a session is running it never expires; taking it over needs override=true, or happens automatically once the owner's lease has clearly expired after a crash).
+      - vibe_math_claim_write / vibe_math_release_write — (member) 写共用 Markdown（含 Progress/<qid>/<dirId>.md）前先取该文件的写锁、写完立刻释放；锁被别的成员持有时报出持有者，不要硬写。
         Only ONE session may run a project: a second session is refused with PROJECT_LOCKED instead of silently writing the same knowledge base in parallel.
       - vibe_math_new_project / vibe_math_set_project / vibe_math_list_projects — per-project folders.
       - vibe_math_list_decisions / vibe_math_decide {id, action: approve|reject|override, verdict?} — resolve manual decisions.
@@ -69,7 +70,7 @@
 
       - math_computation {op: probe|run|receipt|install, engine, mode: code|file|expr, …} — 先 probe 预检引擎/包/许可，再调引擎计算并把脚本与输出归档成可复核回执；缺引擎/缺包只报告与给安装指引/计划；shell 兜底不算归档。
       - 替代必须声明（诚实性）：当替代方案改变了**精确性或结论强度**时（精确符号解 → 数值近似、闭式解 → 采样/求积、改了精度/容差/假设、换了算法类），结论里**必须写明**，不得读起来像得到了原本（精确/所要求的）结果；拿不到精确结果就直说。
-      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>，**相对项目根**）；**成员的文件工具是按会话 cwd 解析的**，所以打开它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）；编辑后用 mode:'file' 指向它重跑，会写出一份**新回执/新 attempt**（含新的 scriptHash）。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
+      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>，**相对项目根**）；**成员的文件工具是按会话 cwd 解析的**，所以读它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）。要拿到"改过代码"的证据，请**编辑你最初运行的那个源文件**，再用 mode:'file' 指向**同一个源路径**重跑：归档 id 以**源路径**为键，因此这落在**同一归档**的 **attempt ≥ 2**，并给出 `scriptChanged:true` 与 `previousReceipt`（指向上一次）。**指向归档副本本身**（`receipt.scriptAbs` 那个路径）按设计是**另一份新归档**：新 id、attempt 1、没有 `previousReceipt`、`scriptChanged:false`；旧 attempt 绝不会被覆盖，但它**不是**"同一归档的新 attempt"——工具会用 `fileIsArchivedScript` 与 `ARCHIVED_SCRIPT_RERUN` 警告明确说明。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
 
       A /vibe slash command mirrors the main controls (/vibe start [override]|resume [override]|pause|abort|status|report|mode
       <auto|manual>|setup|save|template [global|project]|add <id> <desc>|add-proposition <id> <概述>|list-propositions|methods|index|plan|lock|project [list|new <name>|<name>]|decisions|agents|paper [lang=zh|en] [format=both|md|tex] [force]).
@@ -95,8 +96,15 @@
           match the proposition as stated) | 'require' (same, plus a gate: a true/false verdict is
           withheld as 未定论 with reason formal-required until the object is Lean-passed or carries an
           explicit, reasoned blocker record; the scheduler is never wedged by it).
-        - Paths: work file Formal/<id>.lean; archived proof Verified/Lean/<id>.lean; reusable
-          definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.
+        - Paths (every path here is resolved against the SESSION WORKING DIRECTORY, i.e. the cwd
+          printed at the end of this prompt; the project root is the `Data lives under …`
+          directory above):
+          institute work file `<project root>/Formal/<id>.lean`;
+          archived proof `<project root>/Verified/Lean/<id>.lean`;
+          reusable definitions `VibeMath/Formal/Lib/` (workspace-root relative);
+          proved lemmas `VibeMath/Formal/Proved/` (workspace-root relative);
+          short form `Formal/<id>.lean` (project-root relative) names the SAME file as
+          `<project root>/Formal/<id>.lean`.
         - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs / leanAsync / leanInitiative / leanSearchPaths / leanJobsMaxParallel are tunable as well
           (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is
           reported as LEAN_NOT_FOUND and still lets the code be written and archived.
@@ -104,6 +112,31 @@
           formalization TODO (Formal/TODO.md). The framework never installs Lean and never judges
           fidelity for you.
       When the user asks about progress, call vibe_math_report and summarize in plain language.
+
+      DISCLOSURES (existing behaviour, not rules to follow):
+        - DISCLOSURE (existing behaviour): the FINAL PAPER flow can finish without you — when it hits
+          its round/token cap the framework force-finalises the paper (`forcedAfterCap`) and reaps an
+          in-flight writer that never came back; the activity log says so. You do not lose the paper,
+          you lose the chance to keep iterating on it.
+        - DISCLOSURE (existing behaviour): switching the mode to `auto` immediately resolves EVERY
+          pending decision as auto-decided (the activity log records "auto-resolved N pending
+          decision(s)"). Anything you leave pending will not wait for you.
+        - DISCLOSURE (existing behaviour): the framework itself pushes a progress update to the office
+          (reportMode / reportIntervalMs) — a summary you did not ask for can arrive at a round
+          boundary; it is a report, not a new instruction.
+        - DISCLOSURE (existing behaviour): a second session can TAKE OVER the project lock
+          (the activity log records "project lock taken over from session …") — another office may
+          resume the same project while you are away; the state file stays authoritative and is not
+          merged.
+        - DISCLOSURE (existing behaviour): the framework can adjust problem/proposition priorities
+          itself (priorityAdjust / proposPriorityAdjust) — the activity log records "priorities
+          auto-adjusted (…)"; a problem you deprioritised can come back on its own.
+        - DISCLOSURE (existing behaviour): when mathMode is `typed`, the shell fallback is refused
+          (the math tool returns REFUSED with reason=policy) instead of silently falling back.
+        - math_computation policy: mathComputation = off | auto | on (off = the math surface is
+          not mentioned in prompts at all); mathMode = typed | typed+shell (typed refuses the shell
+          fallback); mathEngines (cli / python / …); mathTimeoutMs; mathPackages + mathInstallScope
+          for preflight package installs (missing packages are reported with an install plan only).
     suffix: Your working directory is {{cwd}}.
     text: |-
       You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
@@ -148,6 +181,7 @@
       - vibe_math_index — rebuild State/index.json from the Markdown knowledge base.
       - vibe_math_method_add / vibe_math_method_list — manually add / list method cards (Methods/ + global).
       - vibe_math_lock_status — project lock occupancy (the lock is a renewed lease: while a session is running it never expires; taking it over needs override=true, or happens automatically once the owner's lease has clearly expired after a crash).
+      - vibe_math_claim_write / vibe_math_release_write — (member) 写共用 Markdown（含 Progress/<qid>/<dirId>.md）前先取该文件的写锁、写完立刻释放；锁被别的成员持有时报出持有者，不要硬写。
         Only ONE session may run a project: a second session is refused with PROJECT_LOCKED instead of silently writing the same knowledge base in parallel.
       - vibe_math_new_project / vibe_math_set_project / vibe_math_list_projects — per-project folders.
       - vibe_math_list_decisions / vibe_math_decide {id, action: approve|reject|override, verdict?} — resolve manual decisions.
@@ -161,7 +195,7 @@
 
       - math_computation {op: probe|run|receipt|install, engine, mode: code|file|expr, …} — 先 probe 预检引擎/包/许可，再调引擎计算并把脚本与输出归档成可复核回执；缺引擎/缺包只报告与给安装指引/计划；shell 兜底不算归档。
       - 替代必须声明（诚实性）：当替代方案改变了**精确性或结论强度**时（精确符号解 → 数值近似、闭式解 → 采样/求积、改了精度/容差/假设、换了算法类），结论里**必须写明**，不得读起来像得到了原本（精确/所要求的）结果；拿不到精确结果就直说。
-      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>，**相对项目根**）；**成员的文件工具是按会话 cwd 解析的**，所以打开它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）；编辑后用 mode:'file' 指向它重跑，会写出一份**新回执/新 attempt**（含新的 scriptHash）。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
+      - 归档→编辑→重跑：mode:'code' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>，**相对项目根**）；**成员的文件工具是按会话 cwd 解析的**，所以读它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）。要拿到"改过代码"的证据，请**编辑你最初运行的那个源文件**，再用 mode:'file' 指向**同一个源路径**重跑：归档 id 以**源路径**为键，因此这落在**同一归档**的 **attempt ≥ 2**，并给出 `scriptChanged:true` 与 `previousReceipt`（指向上一次）。**指向归档副本本身**（`receipt.scriptAbs` 那个路径）按设计是**另一份新归档**：新 id、attempt 1、没有 `previousReceipt`、`scriptChanged:false`；旧 attempt 绝不会被覆盖，但它**不是**"同一归档的新 attempt"——工具会用 `fileIsArchivedScript` 与 `ARCHIVED_SCRIPT_RERUN` 警告明确说明。**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。
 
       A /vibe slash command mirrors the main controls (/vibe start [override]|resume [override]|pause|abort|status|report|mode
       <auto|manual>|setup|save|template [global|project]|add <id> <desc>|add-proposition <id> <概述>|list-propositions|methods|index|plan|lock|project [list|new <name>|<name>]|decisions|agents|paper [lang=zh|en] [format=both|md|tex] [force]).
@@ -187,8 +221,15 @@
           match the proposition as stated) | 'require' (same, plus a gate: a true/false verdict is
           withheld as 未定论 with reason formal-required until the object is Lean-passed or carries an
           explicit, reasoned blocker record; the scheduler is never wedged by it).
-        - Paths: work file Formal/<id>.lean; archived proof Verified/Lean/<id>.lean; reusable
-          definitions VibeMath/Formal/Lib/; proved lemmas VibeMath/Formal/Proved/.
+        - Paths (every path here is resolved against the SESSION WORKING DIRECTORY, i.e. the cwd
+          printed at the end of this prompt; the project root is the `Data lives under …`
+          directory above):
+          institute work file `<project root>/Formal/<id>.lean`;
+          archived proof `<project root>/Verified/Lean/<id>.lean`;
+          reusable definitions `VibeMath/Formal/Lib/` (workspace-root relative);
+          proved lemmas `VibeMath/Formal/Proved/` (workspace-root relative);
+          short form `Formal/<id>.lean` (project-root relative) names the SAME file as
+          `<project root>/Formal/<id>.lean`.
         - The toolchain knobs leanCommand / leanArgs / leanTimeoutMs / leanAsync / leanInitiative / leanSearchPaths / leanJobsMaxParallel are tunable as well
           (e.g. leanCommand='lake' with leanArgs=['env','lean']); a missing Lean binary is
           reported as LEAN_NOT_FOUND and still lets the code be written and archived.
@@ -197,6 +238,31 @@
           fidelity for you.
       When the user asks about progress, call vibe_math_report and summarize in plain language.
 
+      DISCLOSURES (existing behaviour, not rules to follow):
+        - DISCLOSURE (existing behaviour): the FINAL PAPER flow can finish without you — when it hits
+          its round/token cap the framework force-finalises the paper (`forcedAfterCap`) and reaps an
+          in-flight writer that never came back; the activity log says so. You do not lose the paper,
+          you lose the chance to keep iterating on it.
+        - DISCLOSURE (existing behaviour): switching the mode to `auto` immediately resolves EVERY
+          pending decision as auto-decided (the activity log records "auto-resolved N pending
+          decision(s)"). Anything you leave pending will not wait for you.
+        - DISCLOSURE (existing behaviour): the framework itself pushes a progress update to the office
+          (reportMode / reportIntervalMs) — a summary you did not ask for can arrive at a round
+          boundary; it is a report, not a new instruction.
+        - DISCLOSURE (existing behaviour): a second session can TAKE OVER the project lock
+          (the activity log records "project lock taken over from session …") — another office may
+          resume the same project while you are away; the state file stays authoritative and is not
+          merged.
+        - DISCLOSURE (existing behaviour): the framework can adjust problem/proposition priorities
+          itself (priorityAdjust / proposPriorityAdjust) — the activity log records "priorities
+          auto-adjusted (…)"; a problem you deprioritised can come back on its own.
+        - DISCLOSURE (existing behaviour): when mathMode is `typed`, the shell fallback is refused
+          (the math tool returns REFUSED with reason=policy) instead of silently falling back.
+        - math_computation policy: mathComputation = off | auto | on (off = the math surface is
+          not mentioned in prompts at all); mathMode = typed | typed+shell (typed refuses the shell
+          fallback); mathEngines (cli / python / …); mathTimeoutMs; mathPackages + mathInstallScope
+          for preflight package installs (missing packages are reported with an install plan only).
+
 # ── agent-instructions ──────────────────────────────────────────────────────
 
 - id: agent-instructions

package/vibe-math-v3/math-computation.js

@@ -12,6 +12,21 @@ import { MATH_ENGINES, MATH_ENGINE_ORDER, mathEngineCandidates, mathEngineArgErr
 
 export const MATH_TOOL_NAME = 'math_computation'
 
+// Sweep ruling: the cli policy is declared ONCE, in the descriptor (math-engines.js `cli.policy`).
+// These two readers are the only place the rule is applied, so descriptor and behaviour cannot drift.
+const CLI_POLICY = (MATH_ENGINES.cli && MATH_ENGINES.cli.policy) || {}
+
+// Item-2 ruling: a commercial template's "VERIFY" provenance must REACH the user, and it is declared
+// ONCE (descriptor `verify` + `verifyReason`). Assemble the fields ONLY when a reason exists, so an
+// engine that declares nothing prints no empty slot.
+function verifyFields(engine) {
+  const d = MATH_ENGINES[engine] || {}
+  if (!d.verify) return {}
+  const out = { verify: true }
+  if (typeof d.verifyReason === 'string' && d.verifyReason) out.verifyReason = d.verifyReason
+  return out
+}
+
 export const MATH_PARAM_NAMES = Object.freeze([
   'mathComputation', 'mathMode', 'mathEngines', 'mathTimeoutMs', 'mathPackages', 'mathInstallScope',
 ])
@@ -73,11 +88,12 @@ export const MATH_PERSONA_TOOL_LINE = '- math_computation {op: probe|run|receipt
 // to both persona blocks) so an agent cannot miss that (a) the script is archived, (b) it may edit
 // it, and (c) re-running is what produces evidence for the edited code.
 export const MATH_ARCHIVE_WORKFLOW_LINE = '- 归档→编辑→重跑：mode:\'code\' 的脚本原件在回执的 scriptPath（Computation/<id>/script.<ext>，**相对项目根**）；'
-  + '**成员的文件工具是按会话 cwd 解析的**，所以打开它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）；'
-  + '编辑后用 mode:\'file\' 指向它重跑，会写出一份**新回执/新 attempt**（含新的 scriptHash）。**旧回执对修改后的代码无效**——'
-  + '报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。'
+  + '**成员的文件工具是按会话 cwd 解析的**，所以读它要用**绝对路径** `receipt.scriptAbs`，或把 `receipt.cwd` 与 `receipt.scriptPath` 拼起来（回执两个字段都有）。'
+  + '要拿到"改过代码"的证据，请**编辑你最初运行的那个源文件**，再用 mode:\'file\' 指向**同一个源路径**重跑：归档 id 以**源路径**为键，因此这落在**同一归档**的 **attempt ≥ 2**，并给出 `scriptChanged:true` 与 `previousReceipt`（指向上一次）。'
+  + '**指向归档副本本身**（`receipt.scriptAbs` 那个路径）按设计是**另一份新归档**：新 id、attempt 1、没有 `previousReceipt`、`scriptChanged:false`；旧 attempt 绝不会被覆盖，但它**不是**"同一归档的新 attempt"——工具会用 `fileIsArchivedScript` 与 `ARCHIVED_SCRIPT_RERUN` 警告明确说明。'
+  + '**旧回执对修改后的代码无效**——报告里必须引用与当前代码哈希一致的那份回执；工具会在 scriptChanged / scriptChangedDuringRun 为 true 时显式告警。'
 
-export const MATH_ARCHIVE_WORKFLOW_LINE_EN = '- Archive -> edit -> re-run: for mode:\'code\' the script original is at the receipt\'s scriptPath (Computation/<id>/script.<ext>, **relative to the project root**); member file tools resolve paths against the SESSION CWD, so open it via the ABSOLUTE `receipt.scriptAbs`, or join `receipt.cwd` with `receipt.scriptPath` (both are in the receipt); after editing, re-run it with mode:\'file\' to write a NEW receipt/attempt with a NEW scriptHash. **An old receipt is NOT evidence for edited code** - cite the receipt whose scriptHash matches the current code; the tool warns explicitly via scriptChanged / scriptChangedDuringRun.'
+export const MATH_ARCHIVE_WORKFLOW_LINE_EN = '- Archive -> edit -> re-run: for mode:\'code\' the script original is at the receipt\'s scriptPath (Computation/<id>/script.<ext>, **relative to the project root**); member file tools resolve paths against the SESSION CWD, so READ it via the ABSOLUTE `receipt.scriptAbs`, or join `receipt.cwd` with `receipt.scriptPath` (both are in the receipt). To produce evidence for EDITED code, edit the SOURCE FILE you originally ran and re-run mode:\'file\' pointing at THAT SAME PATH: the archive id is keyed by the SOURCE PATH, so this lands on the SAME archive as attempt >= 2, with `scriptChanged:true` and `previousReceipt` pointing at the previous attempt. Pointing mode:\'file\' at the ARCHIVED COPY itself (the `receipt.scriptAbs` path) is a DIFFERENT archive BY DESIGN - a new id, attempt 1, no `previousReceipt`, `scriptChanged:false`: the earlier attempt is never overwritten, but it is NOT "a new attempt of the same archive", and the tool says so via `fileIsArchivedScript` and the `ARCHIVED_SCRIPT_RERUN` warning. **An old receipt is NOT evidence for edited code** - cite the receipt whose scriptHash matches the current code; the tool warns explicitly via scriptChanged / scriptChangedDuringRun.'
 
 // Round-6 (A): honesty about SUBSTITUTIONS. An alternative that weakens exactness or conclusion
 // strength must be declared, and the conclusion must never read as if the requested (exact) result
@@ -255,8 +271,10 @@ export function validateMathArgs(args, params) {
     if (mode !== 'code' && mode !== 'file' && mode !== 'expr') return bad('mode must be code|file|expr for op=run')
     const engine = args.engine || 'auto'
     if (engine === 'cli') {
-      if (p.mathMode !== 'typed+shell') return bad('engine=cli is disabled while mathMode=' + p.mathMode, 'MATH_REFUSED', next('reason', { reason: 'policy' }))
-      if (p.mathEngines.indexOf('cli') === -1) return bad('engine=cli is not in mathEngines', 'MATH_REFUSED', next('reason', { reason: 'engine-not-allowed' }))
+      // Sweep ruling (single source): the cli policy lives in the DESCRIPTOR; the code reads it here
+      // rather than hard-coding 'typed+shell', so the two can no longer drift apart.
+      if (CLI_POLICY.requiresMathMode && p.mathMode !== CLI_POLICY.requiresMathMode) return bad('engine=cli is disabled while mathMode=' + p.mathMode + ' (requires ' + CLI_POLICY.requiresMathMode + ')', 'MATH_REFUSED', next('reason', { reason: 'policy', requiresMathMode: CLI_POLICY.requiresMathMode }))
+      if (CLI_POLICY.requiresEngineInList && p.mathEngines.indexOf('cli') === -1) return bad('engine=cli is not in mathEngines', 'MATH_REFUSED', next('reason', { reason: 'engine-not-allowed', requiresEngineInList: true }))
       if (!isObj(args.cli)) return bad('engine=cli requires cli:{command,argv}', 'MATH_REFUSED', next('reason', { reason: 'missing-cli-command' }))
       if (mode === 'expr') return bad('cli does not support mode=expr', 'MATH_REFUSED', next('reason', { reason: 'expr-not-supported' }))
     }
@@ -277,6 +295,19 @@ export function validateMathArgs(args, params) {
 
 // ── failure / return shells ─────────────────────────────────────────────────────────────────────
 function next(kind, extra) { return Object.assign({ kind: kind }, extra || {}) }
+/**
+ * S6: ONE wording for the version policy, so the install plan, the run path and the missing-package
+ * failure cannot drift into different sentences describing the same rule. Grep anchor:
+ * MATH_VERSION_POLICY (and its single call site family mathVersionPolicy).
+ */
+/** S6: the ONE short clause that states the policy; the long sentence and the two human messages
+ * below are all built from it, so the semantics cannot drift. Grep anchor: MATH_VERSION_POLICY_CLAUSE. */
+const MATH_VERSION_POLICY_CLAUSE = '只检查是否存在；版本求解交给包管理器'
+const MATH_VERSION_POLICY = 'version-constraints-are-existence-only: 只按 base name 检查是否存在，约束本身从不校验（' + MATH_VERSION_POLICY_CLAUSE + '）'
+function mathVersionPolicy(pinned) {
+  return MATH_VERSION_POLICY + ((pinned && pinned.length) ? '；本次未校验的约束：' + pinned.join(', ') : '；本次没有版本约束')
+}
+
 function fail(code, engine, message, extra) {
   const out = { ok: false, op: null, engine: engine || null, code: code, message: message }
   if (extra && extra.next) out.next = extra.next
@@ -285,6 +316,8 @@ function fail(code, engine, message, extra) {
   if (extra && extra.missing) out.missing = extra.missing
   if (extra && extra.engines) out.engines = extra.engines
   if (extra && extra.available !== undefined) out.available = extra.available
+  if (extra && extra.configured) out.configured = extra.configured
+  if (extra && Array.isArray(extra.absent)) out.absent = extra.absent
   if (extra && extra.packages) out.packages = extra.packages
   // round-7 (live-session fix): the probe diagnostic must survive into the response, otherwise
   // "存在但不可用" is opaque (a real session showed exactly that).
@@ -318,6 +351,8 @@ async function userInstallNext(H, engine) {
     packageManager: mgr,
     packageManagerAvailable: mgr ? available : null,
     vendorUrl: d.vendor || null,
+    // Item-2: the not-found guidance carries the same provenance when the descriptor declares it.
+    ...verifyFields(engine),
     note: (mgr && !available)
       ? ('本机没有检测到包管理器 ' + mgr + '：建议命令无法运行，请按上面的官方地址手动安装（或先自行安装一个包管理器）。')
       : null,
@@ -345,6 +380,9 @@ function adaptHost(host) {
     // round-7 (fix 2): optional bundled-runtime discovery (absolute roots + absolute listing).
     runtimeRoots: typeof h.runtimeRoots === 'function' ? h.runtimeRoots : null,
     listDirAbs: typeof h.listDirAbs === 'function' ? h.listDirAbs : null,
+    // round-B (F4): an OPTIONAL host field - a host (or a test) that knows its own install layout can
+    // supply the per-engine candidate roots, so discovery never has to trust this process's environment.
+    installRoots: typeof h.installRoots === 'function' ? h.installRoots : null,
     log: typeof h.log === 'function' ? h.log : function () {},
   }
   adapted.__mathHost = true
@@ -372,7 +410,7 @@ export async function probeMathEngines(host, opts) {
       if (d.license === 'commercial') continue // installed but not usable: reported by op=run as LICENSE_REQUIRED
       continue
     }
-    engines.push({ name: name, version: v.version, path: hit, license: d.license })
+    engines.push(Object.assign({ name: name, version: v.version, path: hit, license: d.license }, verifyFields(name)))
   }
   const result = { ok: true, engines: engines, available: engines.length > 0 }
   PROBE_CACHE.set(H, result)
@@ -383,34 +421,66 @@ export async function probeMathEngines(host, opts) {
 // looked at the server process's PATH (R 4.6.1 landed in C:\Program Files\R\R-4.6.1\bin and was NOT
 // added to PATH). Add the known per-OS INSTALL locations, globbed by version, still AFTER PATH and
 // after the bundled runtime; existence is always proven by LISTING, never assumed.
+// round-B (F4/F3): the candidate roots come from the HOST when it can supply them (`H.installRoots`),
+// and only otherwise from this process's environment - so a test (or a host with its own layout) never
+// depends on the ambient machine. ONE generic walker serves every engine: adding an engine is a table
+// entry (roots + descriptor candidates), never a new code path. Existence is always proven by LISTING.
+export function mathInstallRoots(engineName, env, win) {
+  const pf = String(env.ProgramFiles || 'C:/Program Files')
+  const pf86 = String(env['ProgramFiles(x86)'] || 'C:/Program Files (x86)')
+  const local = env.LOCALAPPDATA ? String(env.LOCALAPPDATA) : null
+  const home = env.USERPROFILE || env.HOME || null
+  const table = {
+    r: win
+      ? [pf + '/R', pf86 + '/R', local ? local + '/Programs/R' : null]
+      : ['/usr/lib/R', '/usr/lib64/R', '/Library/Frameworks/R.framework/Resources', '/usr/local/lib/R', '/opt/R'],
+    python: win
+      ? [local ? local + '/Programs/Python' : null, pf]
+      : ['/usr/local', '/usr', '/opt/python', '/opt/homebrew'],
+    octave: win
+      ? [pf + '/GNU Octave', local ? local + '/Programs/GNU Octave' : null]
+      : ['/usr/lib/octave', '/usr/local/octave', '/opt/octave', '/usr/share/octave'],
+    julia: win
+      ? [local ? local + '/Programs' : null, pf, home ? home + '/.juliaup/bin' : null]
+      : ['/opt', '/usr/local', home ? home + '/.juliaup/bin' : null],
+    matlab: win ? [pf + '/MATLAB'] : ['/usr/local/MATLAB', '/Applications'],
+  }
+  return (table[engineName] || []).filter((x) => typeof x === 'string' && x)
+}
+
 async function knownInstallCandidates(H, engineName) {
   if (typeof H.listDirAbs !== 'function') return []
   const cands = mathEngineCandidates(engineName)
   if (!cands) return []
   const env = (typeof process !== 'undefined' && process.env) || {}
   const win = !!(typeof process !== 'undefined' && process.platform === 'win32')
+  let injected = null
+  if (typeof H.installRoots === 'function') {
+    try {
+      const r = await H.installRoots(engineName)
+      if (Array.isArray(r)) injected = r.filter((x) => typeof x === 'string' && x)
+    } catch (e) { injected = null }
+  }
+  const roots = injected || mathInstallRoots(engineName, env, win)
   const exts = win ? ['', '.exe', '.cmd'] : ['']
   const out = []
-  const listDirs = async (dir) => { try { return ((await H.listDirAbs(dir)) || []).filter((e) => e && e.type === 'directory').map((e) => e.name) } catch (e) { return [] } }
-  const listFiles = async (dir) => { try { return ((await H.listDirAbs(dir)) || []).filter((e) => e && e.type === 'file').map((e) => e.name) } catch (e) { return [] } }
+  const listNames = async (dir, kind) => {
+    try { return ((await H.listDirAbs(dir)) || []).filter((e) => e && e.type === kind).map((e) => e.name) } catch (e) { return [] }
+  }
   const match = async (dir) => {
-    const files = await listFiles(dir)
+    const files = await listNames(dir, 'file')
     for (const c of cands) for (const x of exts) if (files.indexOf(c + x) !== -1) out.push(dir + '/' + c + x)
   }
-  if (engineName === 'r') {
-    const roots = win
-      ? [String(env.ProgramFiles || 'C:/Program Files') + '/R', String(env['ProgramFiles(x86)'] || 'C:/Program Files (x86)') + '/R', env.LOCALAPPDATA ? String(env.LOCALAPPDATA) + '/Programs/R' : null]
-      : ['/usr/lib/R', '/Library/Frameworks/R.framework/Resources', '/usr/local/lib/R', '/opt/R', '/usr/lib64/R']
-    for (const root of roots) {
-      if (!root) continue
-      for (const d of await listDirs(root)) await match(root + '/' + d + '/bin') // windows versioned dirs
-      await match(root + '/bin')                                                 // unix / framework layout
+  for (const root of roots) {
+    await match(root)                                                      // flat layout (juliaup, /usr/local)
+    await match(root + '/bin')                                             // unix / framework layout
+    for (const d of await listNames(root, 'directory')) {
+      await match(root + '/' + d)                                          // versioned flat (Python312, Julia-1.10)
+      await match(root + '/' + d + '/bin')                                 // versioned install (R-4.6.1/bin)
+      for (const s of await listNames(root + '/' + d, 'directory')) {
+        await match(root + '/' + d + '/' + s + '/bin')                     // nested layout (Octave-9.2.0/mingw64/bin)
+      }
     }
-  } else if (engineName === 'python' && win) {
-    const local = env.LOCALAPPDATA ? String(env.LOCALAPPDATA) + '/Programs/Python' : null
-    for (const d of (local ? await listDirs(local) : [])) await match(local + '/' + d)
-    const pf = String(env.ProgramFiles || 'C:/Program Files')
-    for (const d of await listDirs(pf)) if (/^Python[0-9]/i.test(d)) await match(pf + '/' + d)
   }
   return Array.from(new Set(out))
 }
@@ -576,7 +646,7 @@ async function resolveEngine(H, requested, params, args) {
     const d = applyOverride({ name: name, desc: d0 }, params, args)
     if (params.mathEngines.indexOf(name) === -1) return fail('MATH_REFUSED', name, '引擎 ' + name + ' 不在 mathEngines 允许列表内', { next: next('reason', { reason: 'engine-not-allowed' }) })
     if (name === 'cli') {
-      if (params.mathMode !== 'typed+shell') return fail('MATH_REFUSED', name, 'cli 被策略禁用（mathMode=' + params.mathMode + '）', { next: next('reason', { reason: 'policy' }) })
+      if (CLI_POLICY.requiresMathMode && params.mathMode !== CLI_POLICY.requiresMathMode) return fail('MATH_REFUSED', name, 'cli 被策略禁用（需要 mathMode=' + CLI_POLICY.requiresMathMode + '，当前 ' + params.mathMode + '）', { next: next('reason', { reason: 'policy', requiresMathMode: CLI_POLICY.requiresMathMode }) })
       let exe = null
       try { exe = await H.resolveExecutable(args.cli.command) } catch (e) { exe = null }
       if (!exe) return fail('MATH_ENGINE_NOT_FOUND', name, 'cli 命令无法解析：' + args.cli.command, { next: await userInstallNext(H, 'cli') })
@@ -598,7 +668,7 @@ async function resolveEngine(H, requested, params, args) {
     if (!v.ok) {
       if (d.license === 'commercial' || d.versionOptional) {
         const lic = await checkLicence(H, d, hit)
-        if (!lic.ok) return fail('MATH_ENGINE_LICENSE_REQUIRED', name, name + ' 已安装但许可不可用（仅厂商可激活）', { next: next('vendor', { engine: name, url: d.vendor || '' }) })
+        if (!lic.ok) return fail('MATH_ENGINE_LICENSE_REQUIRED', name, name + ' 已安装但许可不可用（仅厂商可激活）', { next: next('vendor', Object.assign({ engine: name, url: d.vendor || '' }, verifyFields(name))) })
         return { ok: true, name: name, desc: d, exe: hit, version: 'unknown' }
       }
       // round-7 (live-session fix): the engine WAS found - so an install guide would be misleading
@@ -610,7 +680,7 @@ async function resolveEngine(H, requested, params, args) {
       })
     }
     const lic = await checkLicence(H, d, hit)
-    if (!lic.ok) return fail('MATH_ENGINE_LICENSE_REQUIRED', name, name + ' 已安装但许可不可用（仅厂商可激活）', { next: next('vendor', { engine: name, url: d.vendor || '' }) })
+    if (!lic.ok) return fail('MATH_ENGINE_LICENSE_REQUIRED', name, name + ' 已安装但许可不可用（仅厂商可激活）', { next: next('vendor', Object.assign({ engine: name, url: d.vendor || '' }, verifyFields(name))) })
     return { ok: true, name: name, desc: d, exe: hit, version: v.version }
   }
   const first = requested === 'auto' ? (params.mathEngines[0] || 'python') : requested
@@ -709,11 +779,14 @@ function assembleArgv(det, mode, payload) {
     }
   }
   if (mode === 'code' || mode === 'file') {
-    return { argv: [det.exe].concat((d.scriptArgv || []).map((a) => a === '<script>' ? payload.scriptAbs : a)) }
+    // Sweep finding (HIGH): substitution must be STRING-level, not exact-element equality - matlab's
+    // descriptor embeds the placeholder (`run('<script>')`), so an exact match let the literal
+    // `run('<script>')` reach the engine and the archived script never ran.
+    return { argv: [det.exe].concat((d.scriptArgv || []).map((a) => String(a).split('<script>').join(payload.scriptAbs))) }
   }
   if (mode === 'expr') {
     if (!d.evalArgv) return { refused: 'engine does not support mode=expr' }
-    return { argv: [det.exe].concat(d.evalArgv.map((a) => a === '<expr>' ? payload.expr : a)) }
+    return { argv: [det.exe].concat(d.evalArgv.map((a) => String(a).split('<expr>').join(payload.expr))) }
   }
   return { refused: 'unknown mode' }
 }
@@ -865,6 +938,14 @@ async function opProbe(H, args, params) {
   const probeDet = familyProbeDet(chosen)
   if (want.length && probeDet) packages = await probePackages(H, probeDet, want)
   else if (want.length && chosen && chosen.ok && chosen.name === 'cli') packages = { requested: want.map((s) => parsePackageSpec(s).name || s), found: {}, precheckSkipped: 'engine=cli：无法从命令名判断引擎族（不阻塞）' }
+  // S2 + round-9 F3: the absence list must exist BEFORE the early failure return, because the
+  // failure a user actually hits must carry the same evidence as the success shape.
+  const absentFor = (names) => params.mathEngines
+    .filter((e) => names.indexOf(e) === -1)
+    .map((e) => ((MATH_ENGINES[e] && MATH_ENGINES[e].resolveFrom === 'cli.command')
+      ? { engine: e, why: 'needs-a-caller-supplied-command' }
+      : { engine: e, why: 'not-found-on-this-machine' }))
+
   if (requested && chosen && !chosen.ok) {
     // Policy/absence refusal for the REQUESTED engine, with its own guidance.
     const out = Object.assign({}, chosen)
@@ -876,7 +957,7 @@ async function opProbe(H, args, params) {
   }
   if (!probe.available && !(chosen && chosen.ok)) {
     const first = requested || params.mathEngines[0] || 'python'
-    const out = fail('MATH_ENGINE_NOT_FOUND', first, '本机没有可用的计算引擎（请求：' + first + '）', { next: await userInstallNext(H, first), engines: [], available: false, packages: packages })
+    const out = fail('MATH_ENGINE_NOT_FOUND', first, '本机没有可用的计算引擎（请求：' + first + '）', { next: await userInstallNext(H, first), engines: [], available: false, configured: params.mathEngines.slice(), absent: absentFor(probe.engines.map((e) => e.name)), packages: packages })
     out.op = 'probe'
     return out
   }
@@ -884,18 +965,15 @@ async function opProbe(H, args, params) {
   // available even when auto-detection found nothing - otherwise probe denied what run would do.
   const engines = probe.engines.slice()
   if (chosen && chosen.ok && !engines.some((e) => e.name === chosen.name)) {
-    engines.push({ name: chosen.name, path: chosen.exe, version: chosen.version, license: (MATH_ENGINES[chosen.name] || {}).license })
+    engines.push(Object.assign({ name: chosen.name, path: chosen.exe, version: chosen.version, license: (MATH_ENGINES[chosen.name] || {}).license }, verifyFields(chosen.name)))
   }
-  const engineInfo = (chosen && chosen.ok) ? { name: chosen.name, path: chosen.exe, version: chosen.version } : null
+  const engineInfo = (chosen && chosen.ok) ? Object.assign({ name: chosen.name, path: chosen.exe, version: chosen.version }, verifyFields(chosen.name)) : null
   // round-9 (F3): the availability line must never be silently partial - name the CONFIGURED engines
   // that were not found (and why), instead of just listing the ones that happened to resolve.
   const foundNames = engines.map((e) => e.name)
   // Per-engine absence explanation. The key is `why` (NOT the reserved machine-readable vocabulary
   // key), so the parity guard's exhaustive `next.reason` set stays exactly the refusal vocabulary.
-  const absent = params.mathEngines.filter((e) => foundNames.indexOf(e) === -1).map((e) => {
-    if (MATH_ENGINES[e] && MATH_ENGINES[e].resolveFrom === 'cli.command') return { engine: e, why: 'needs-a-caller-supplied-command' }
-    return { engine: e, why: 'not-found-on-this-machine' }
-  })
+  const absent = absentFor(foundNames)
   return {
     ok: true, op: 'probe', engine: engineInfo ? engineInfo.name : null, engineInfo: engineInfo,
     engines: engines, available: true, packages: packages,
@@ -931,7 +1009,7 @@ async function opRun(H, args, params) {
   const want = (args.packages && args.packages.length) ? args.packages : params.mathPackages
   // round-9 (F7): version constraints are NOT enforced - we only check existence by base name.
   const pinnedSpecs = want.filter((sp) => parsePackageSpec(sp).pinned)
-  const versionPolicy = 'version-constraints-are-existence-only: 只按 base name 检查是否存在，约束本身从不校验（版本求解交给包管理器）' + (pinnedSpecs.length ? '；本次未校验的约束：' + pinnedSpecs.join(', ') : '；本次没有版本约束')
+  const versionPolicy = mathVersionPolicy(pinnedSpecs)
   // round-7 (finding 3): for cli the precheck runs against the FAMILY of `cli.command` (same
   // discovery-shaped logic); an unrecognisable command SKIPS the precheck instead of reporting a
   // false "missing" that would block the escape hatch.
@@ -942,7 +1020,7 @@ async function opRun(H, args, params) {
   // timeout) must not be read as "missing" - that misled a real session.
   const missing = (probeDet && !pk.probeFailed) ? want.map((s) => parsePackageSpec(s).name || s).filter((p) => Object.prototype.hasOwnProperty.call(pk.found, p) && !pk.found[p]) : []
   if (missing.length) {
-    return fail('MATH_MISSING_PACKAGES', det.name, '需要的包未安装：' + missing.join(', ') + '（只检查是否存在；版本求解交给包管理器）', {
+    return fail('MATH_MISSING_PACKAGES', det.name, '需要的包未安装：' + missing.join(', ') + '（' + MATH_VERSION_POLICY_CLAUSE + '）', {
       missing: missing,
       next: next('agent-install', { engine: det.name, packages: missing, specs: want.slice(), dryRun: true }),
       packages: pk,
@@ -1058,6 +1136,9 @@ async function opRun(H, args, params) {
     argv: assembled.argv.slice(),
     cwd: root,
     packages: { requested: want.slice(), found: pk.found },
+    // round-B (F6): the constraint policy is durable evidence too - a receipt read months later must
+    // show that constraints were existence-only and WHICH ones were not checked.
+    versionPolicy: versionPolicy, constraintsNotEnforced: pinnedSpecs.slice(),
     exit: r.timedOut ? null : (r.exit === undefined ? null : r.exit),
     timedOut: !!r.timedOut,
     ms: Number(r.ms || 0),
@@ -1119,11 +1200,13 @@ async function opRun(H, args, params) {
         next: next('engine-override', { engine: det.name, argv: assembled.argv.slice(), hint: MATH_BAD_ARGV_HINT }),
       })
       out.exit = r.exit
+      out.stdout = fullOut.slice(0, MATH_CAPS.stdout)
       out.stderr = fullErr.slice(0, MATH_CAPS.stderr)
       return Object.assign(out, archiveFields())
     }
     const out = fail('MATH_NONZERO_EXIT', engineLabel, '引擎以非零退出码结束：' + r.exit, { argv: assembled.argv.slice(), receipt: receiptRef })
     out.exit = r.exit
+    out.stdout = fullOut.slice(0, MATH_CAPS.stdout)
     out.stderr = fullErr.slice(0, MATH_CAPS.stderr)
     return Object.assign(out, archiveFields())
   }
@@ -1212,7 +1295,7 @@ async function opInstall(H, args, params) {
   if (!d) return fail('MATH_INVALID_ARGUMENT', engineName, 'unknown engine: ' + engineName)
   if (d.license === 'commercial' || !d.install) {
     return fail('MATH_REFUSED', engineName, engineName + ' 永不代装（商业引擎只给厂商指引）', {
-      next: next('vendor', { engine: engineName, url: d.vendor || '' }),
+      next: next('vendor', Object.assign({ engine: engineName, url: d.vendor || '' }, verifyFields(engineName))),
     })
   }
   const scope = args.scope || params.mathInstallScope || 'user' // per-call only; never persisted anywhere
@@ -1248,7 +1331,7 @@ async function opInstall(H, args, params) {
   const plan = {
     engine: engineName, scope: scope, manager: activeManager, commands: commands,
     managerAssumed: !!(managerInfo && managerInfo.assumed), managerWhy: managerInfo ? managerInfo.why : '',
-    versionPolicy: '版本求解交给包管理器（本工具只检查是否已安装，并把 pkg<op>version 原样透传）',
+    versionPolicy: mathVersionPolicy(args.packages || []),
     note: scope === 'user' ? '将安装到用户级目录' : '仅本次系统作用域（不会被记住）',
   }
   const planToken = sha256(JSON.stringify({ engine: engineName, packages: args.packages, scope: scope, commands: commands }) + '|planVersion=1').slice(0, 32)
@@ -1269,12 +1352,18 @@ async function opInstall(H, args, params) {
       const code = (r && r.timedOut) ? 'MATH_TIMEOUT' : 'MATH_NONZERO_EXIT'
       const out = fail(code, engineName, '安装失败（' + c.argv.join(' ') + '）：' + (r ? ('exit=' + r.exit) : 'no subprocess'), { next: next('note', { audit: 'Computation/installs/' + planToken + '.json' }) })
       out.audit = 'Computation/installs/' + planToken + '.json'
+      // S4/S5 (non-breaking): install failures are discriminated by op + installedSoFar + timedOut,
+      // NOT by a new failure code (MATH_FAILURE_CODES is frozen). Mirrors the `out.audit`
+      // post-assignment and needs nothing from fail()'s key whitelist.
+      out.op = 'install'
+      out.timedOut = !!(r && r.timedOut)
+      out.installedSoFar = results.filter((x) => x.exit === 0).map((x) => x.argv)
       return out
     }
   }
   const audit = { schema: 'vibe-math/math-computation-install@1', planToken: planToken, scope: scope, manager: activeManager, commands: commands, results: results, exit: 0, timedOut: false, installed: args.packages, before: {}, after: {}, rollback: rollbackFor(d, exe, args.packages, uninstallTmpl), network: 'not-enforced-by-plugin' }
   await H.writeText('Computation/installs/' + planToken + '.json', JSON.stringify(audit, null, 2))
-  return { ok: true, op: 'install', engine: engineName, executed: true, scope: scope, audit: 'Computation/installs/' + planToken + '.json', message: '已安装：' + args.packages.join(', ') + '（审计：Computation/installs/' + planToken + '.json）' }
+  return { ok: true, op: 'install', engine: engineName, executed: true, scope: scope, installedSoFar: commands.map((c) => c.argv), audit: 'Computation/installs/' + planToken + '.json', message: '已安装：' + args.packages.join(', ') + '（审计：Computation/installs/' + planToken + '.json）' }
 }
 
 // ── round-6 (B/D): package specs + Python package-manager dispatch ──────────────────────────────
@@ -1287,7 +1376,7 @@ export function parsePackageSpec(spec) {
   const raw = String(spec == null ? '' : spec).trim()
   if (!raw) return { ok: false, problem: 'empty package spec' }
   if (!PKG_SPEC_RE.test(raw)) {
-    return { ok: false, problem: 'unsupported version syntax: "' + raw + '"（版本求解交给包管理器：请用它能理解的形式，例如 pip 的 pkg==1.2 或 conda 的 pkg=1.2；本工具只检查是否已安装）' }
+    return { ok: false, problem: 'unsupported version syntax: "' + raw + '"（' + MATH_VERSION_POLICY_CLAUSE + '：请用它能理解的形式，例如 pip 的 pkg==1.2 或 conda 的 pkg=1.2）' }
   }
   const name = raw.replace(/(?:==|>=|<=|~=|!=|>|<|=).*$/, '').replace(/\[.*$/, '')
   return { ok: true, name: name, spec: raw, pinned: raw !== name }