dsh-vibe-math 2.7.2 → 2.8.0

package/tests/formal-verify-v2.test.mjs

@@ -1,1641 +1,1678 @@
-// ============================================================
-// V2 LEAN FORMAL VERIFICATION SUITE  (docs/formal-verification.md)
-//
-// Asserts the whole contract of the v2 `formalVerify` knob:
-//   · 'off'       is a TRUE no-op: no Lean text in ANY prompt it builds, no formal record,
-//                 no gate — while the three tools stay registered (registration is static)
-//   · 'encourage' injects the Lean section into BOTH the review and the debate prompt and the
-//                 "顺手形式化" line into the solver/explorer prompts, and — the actual point of
-//                 the feature — turns the review into a FIDELITY check once a Lean run passed
-//   · 'require'   withholds a true/false verdict (未定论 + Formal/TODO.md + announcement) until
-//                 the object is Lean-passed or carries an explicit, reasoned blocker; then the
-//                 same verdict DOES write the card, and the card records the formal status
-//   · the three tools (run / archive / lib) write the right things to the right paths
-//   · the REPLY CHANNEL is real, not dead code (contract §4 / §6.3 / §10.8): a verifier's
-//     `formal:{decision:'blocked'|'defect', note}` reply is actually absorbed into the durable
-//     record for BOTH id spaces, a missing note is refused, and `defect` (a fidelity defect,
-//     i.e. the Lean code does not say what the proposition says) downgrades the proof, deletes
-//     the archived file, writes the TODO and defers the verdict — it is NEVER recorded as
-//     "the proposition is false" (contract §4.1)
-//
-// The Lean toolchain is mocked through the subprocess SERVICE (a fake Lean: exit 0 unless the
-// file still contains `sorry` or the marker `-- FAIL`), so these tests exercise the REAL code
-// path (resolveExecutable → spawn → collected stdout → exit code) without Lean installed.
-//
-// The plugin path honours V2_PLUGIN so a sensitivity probe can point this suite at a mutated
-// copy of the plugin (a suite that ignored the override would make every probe vacuous —
-// AUDIT-CHECKLIST §2.5).
-//
-// Run: node tests/formal-verify-v2.test.mjs
-// ============================================================
-import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, writeFileSync, statSync, mkdirSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join, dirname, isAbsolute, resolve as pathResolve } from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-// V2_PLUGIN may be a REPO-RELATIVE path or an ABSOLUTE one (a mutant copy outside the repo, e.g. a
-// temp dir). The previous `new URL('file:///' + path)` form only worked for drive-qualified Windows
-// paths and made out-of-repo variants impossible; this is the same isAbsolute-aware resolution the
-// `math-computation-v*` suites use. Default behaviour (env var unset) is unchanged.
-const PLUGIN = process.env.V2_PLUGIN
-  ? pathToFileURL(isAbsolute(process.env.V2_PLUGIN) ? process.env.V2_PLUGIN : join(dirname(fileURLToPath(import.meta.url)), '..', process.env.V2_PLUGIN))
-  : new URL('../vibe-math-v2/vibe-math-v2.js', import.meta.url)
-// 纯函数测试面（__testHelpers）：参数归一化/搜索路径计划/哈希/指纹都从这里守卫。
-const MOD = await import(PLUGIN.href)
-const HERE = dirname(fileURLToPath(import.meta.url))
-// Human-reviewable corpus (contract §10.10). A sensitivity probe runs THIS suite against a
-// MUTATED plugin copy: writing the repository corpus from such a run would replace the
-// reviewed text with mutated text, so a mutated run goes to a scratch directory instead
-// (and V2_CORPUS_DIR overrides both, exactly like the v3 suite's V3_CORPUS_DIR).
-const CORPUS_DIR = process.env.V2_CORPUS_DIR
-  ? pathResolve(process.env.V2_CORPUS_DIR)
-  : (process.env.V2_PLUGIN ? join(tmpdir(), 'vibe-v2-prompt-corpus') : join(HERE, '..', 'prompt-corpus-v2'))
-
-let passed = 0, failed = 0
-const failures = []
-const assert = (c, m) => { if (c) { passed++; console.log('  ok - ' + m) } else { failed++; failures.push(m); console.error('  FAIL - ' + m) } }
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
-const section = (t) => console.log('\n[' + t + ']')
-
-// ---------------------------------------------------------------
-// the fake Lean toolchain (mocked at the SERVICE boundary)
-// ---------------------------------------------------------------
-let toolchainAvailable = true
-const leanRuns = []
-const terminations = []
-const subprocess = {
-  async resolveExecutable(cmd) {
-    if (!toolchainAvailable) throw new Error('spawn lean ENOENT')
-    if (String(cmd) !== 'lean') throw new Error('unknown executable ' + cmd)
-    return 'lean'
-  },
-  spawn(spec) {
-    const last = spec.argv[spec.argv.length - 1]
-    const script = String(last || '')
-    // v2 creates its directory tree through this SAME subprocess service
-    // (`powershell … New-Item -Force -ItemType Directory -Path 'a','b'`). Without honouring
-    // it, the Formal/ and Verified/Lean/ assertions would be vacuous: they would fail for the
-    // wrong reason (a mocked no-op) instead of a real defect.
-    if (/New-Item/.test(script)) {
-      const m = /-Path\s+(.+?)\s*(\||$)/.exec(script)
-      if (m) m[1].split(',').forEach((p) => { const q = p.trim().replace(/^'|'$/g, '').replace(/''/g, "'"); if (q) mkdirSync(q, { recursive: true }) })
-      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
-    }
-    if (/mkdir -p /.test(script)) {
-      const m = /mkdir -p (.+)$/.exec(script)
-      if (m) m[1].split(/\s+/).forEach((p) => { const q = p.trim().replace(/^'|'$/g, ''); if (q) mkdirSync(q, { recursive: true }) })
-      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
-    }
-    // v2 ALSO deletes files through this same service (`powershell … Remove-Item -LiteralPath 'x'`,
-    // POSIX `rm -f 'x'`). Without honouring it, the `defect` assertion "the archived proof is
-    // gone" would pass vacuously (nothing was ever deleted) instead of testing the real code path.
-    if (/Remove-Item/.test(script)) {
-      const m = /-LiteralPath\s+'((?:[^']|'')*)'/.exec(script)
-      if (m) { try { rmSync(m[1].replace(/''/g, "'"), { force: true }) } catch (e) { /* best effort */ } }
-      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
-    }
-    if (/^\s*rm -f /.test(script)) {
-      const re = /'((?:[^']|'\\'')*)'/g
-      let m
-      while ((m = re.exec(script)) !== null) { try { rmSync(m[1].replace(/'\\''/g, "'"), { force: true }) } catch (e) { /* best effort */ } }
-      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
-    }
-    const text = existsSync(last) ? readFileSync(last, 'utf8') : ''
-    const bad = /sorry|-- FAIL/.test(text)
-    leanRuns.push({ argv: spec.argv.slice(0, -1), file: last, cwd: spec.cwd, graceMs: spec.graceMs, stdio: spec.stdio })
-    const stdout = bad ? '' : 'ok\n'
-    const stderr = bad ? 'error: declaration uses sorry\n' : ''
-    if (/-- HANG/.test(text)) {
-      // A run that never finishes by itself. It settles ONLY when the plugin actively terminates it
-      // (contract §7: "对超时调用 handle.terminate()"), with a bounded 2.5 s fallback so a plugin
-      // that FORGETS to terminate FAILS the terminate/speed assertions instead of hanging this suite.
-      let settled = false
-      let finish
-      const done = new Promise((resolve) => { finish = resolve })
-      const fallback = REAL_SET_TIMEOUT(() => { if (!settled) { settled = true; finish({ exitCode: null, signal: 'SIGKILL' }) } }, 2500)
-      return {
-        done,
-        collected: {
-          stdout: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) },
-          stderr: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) },
-        },
-        terminate() {
-          if (settled) return
-          settled = true
-          REAL_CLEAR_TIMEOUT(fallback)
-          terminations.push({ file: last })
-          finish({ exitCode: null, signal: 'SIGTERM' })
-        },
-      }
-    }
-    return {
-      done: Promise.resolve({ exitCode: bad ? 1 : 0, signal: null }),
-      collected: {
-        stdout: { readFrom: () => ({ text: stdout, nextOffset: stdout.length, lossy: false }) },
-        stderr: { readFrom: () => ({ text: stderr, nextOffset: stderr.length, lossy: false }) },
-      },
-      terminate() {},
-    }
-  },
-}
-
-// ---------------------------------------------------------------
-// mock host (v2 standing-mount shape: one plugin instance, many sessions)
-// ---------------------------------------------------------------
-function makeHost(WS, opts = {}) {
-  const listeners = {}
-  const toolRegs = []
-  const cmdRegs = []
-  const spawns = []
-  const followups = []
-  const interrupts = []
-  const disposers = []
-  const ctx = {
-    get(name) {
-      if (name === 'subprocess') return opts.noSubprocess ? undefined : subprocess
-      if (name === 'sandboxPolicy') return { workspaceRoot: WS, resolve: () => ({ workspaceRoot: WS }) }
-      return undefined
-    },
-    on(event, fn) { (listeners[event] = listeners[event] || []).push(fn) },
-    effect(fn) { const d = fn(); const off = () => { if (typeof d === 'function') d() }; disposers.push(off); return off },
-    logger: { info() {}, warn() {}, error() {} },
-    tools: { register(spec) { toolRegs.push(spec); return () => {} } },
-    commands: { register(spec) { cmdRegs.push(spec); return () => {} } },
-    timeout(cb, ms) { const h = setTimeout(cb, ms); return () => clearTimeout(h) },
-    subagents: {
-      list() { return ['spawn'] },
-      async startContinuable({ label, request }) {
-        const childId = 'child-' + (spawns.length + 1) + '-' + Math.random().toString(36).slice(2, 6)
-        spawns.push({ label, childId, rootId: (request && request.parent && request.parent.id) || 'root', prompt: request && request.prompt && request.prompt[0] && request.prompt[0].text })
-        return { childId }
-      },
-      async followup(parent, childId, blocks) { followups.push({ childId, prompt: (blocks && blocks[0] && blocks[0].text) || '' }) },
-      async sendMessage(parent, childId, blocks) { followups.push({ childId, prompt: (blocks && blocks[0] && blocks[0].text) || '' }) },
-      interrupt(childId) { interrupts.push(childId) },
-    },
-    agents: { roots() { return [] }, get() { return undefined } },
-    fs: {
-      async resolve(rel, o) {
-        const raw = String(rel)
-        const p = isAbsolute(raw) ? raw : join((o && o.cwd) || WS, ...raw.split('/'))
-        return p.replace(/\\/g, '/')
-      },
-      async stat(t) { if (!existsSync(t)) return undefined; return { type: statSync(t).isDirectory() ? 'directory' : 'file' } },
-      async readText(t) { return readFileSync(t, 'utf8') },
-      async writeText(t, c) { mkdirSync(dirname(t), { recursive: true }); writeFileSync(t, c, 'utf8') },
-      async listDir(t) { if (!existsSync(t)) return []; return readdirSync(t, { withFileTypes: true }).map((e) => ({ name: e.name, type: e.isDirectory() ? 'directory' : 'file' })) },
-    },
-  }
-  const fireEnd = (info) => { for (const h of (listeners['subagent/end'] || [])) h(info) }
-  return { ctx, toolRegs, cmdRegs, spawns, followups, interrupts, disposers, unmount: () => { for (const d of disposers) { try { d() } catch (e) { /* ignore */ } } }, fireEnd, WS }
-}
-
-function makeRoot(id, WS) {
-  // `pushed` records the framework's OWN messages to the main agent (`rootAgent.followup`), i.e. the
-  // reportMode=push progress report. It used to be a no-op, which is why that channel had no corpus
-  // entry at all (AUDIT §2.4 "框架→人 的反馈与推送类提示").
-  const pushed = []
-  return { id, options: { provider: 'mock', model: 'mock' }, session: { id, header: { cwd: WS, parentSession: undefined } }, pushed, followup(m) { const c = (m && m.content) || []; pushed.push(c.map((b) => (b && b.text) || '').join('')) } }
-}
-
-const hosts = []
-/**
- * Build an INDEPENDENT plugin instance + workspace for one test case.
- * AUDIT-CHECKLIST §2.3: cases must not share a session root/workspace, or a leftover
- * heartbeat/verification from one case pollutes the next.
- */
-async function makeCase(label, opts = {}) {
-  const WS = mkdtempSync(join(tmpdir(), 'vibe-v2-lean-' + label + '-'))
-  const h = makeHost(WS, opts)
-  const mod = await import(PLUGIN.href + '?t=' + Date.now() + '-' + Math.random().toString(36).slice(2, 8))
-  ;(mod.default || mod).apply(h.ctx)
-  const root = makeRoot('sess-' + label, WS)
-  const call = async (name, args, agent) => {
-    const spec = h.toolRegs.find((s) => s.name === name)
-    if (!spec) throw new Error('no tool ' + name)
-    return JSON.parse(await spec.execute(args || {}, { agent: agent || root }))
-  }
-  await call('vibe_math_new_project', { name: 'proj' })
-  // 200ms is the sanitizer floor; verifierCount=2 (the sanitizer floor too) keeps each
-  // verification exactly two children, so a round settles predictably.
-  await call('vibe_math_set_params', { tickIntervalMs: 200, verifierCount: 2 })
-  // leanAsync defaults to TRUE (background queue). This suite's Lean sections guard the
-  // **synchronous** path verbatim, so every case pins leanAsync=false here; the async state
-  // machine (default档) is guarded by its own section, which flips it back on explicitly.
-  await call('vibe_math_set_params', { leanAsync: false })
-  const c = Object.assign(h, { WS, root, call, label })
-  hosts.push(c)
-  return c
-}
-// The scheduler only picks objects up while it is RUNNING (scheduleTick early-returns).
-async function startScheduler(h) { await h.call('vibe_math_start', {}) }
-
-// ── test speed: fast-forward the SCHEDULER POLL (test-only, no production impact) ─────────
-// The plugin registers its scheduler poll as `setInterval(..., 1000)` at apply() time, so every
-// suite-side `tick()` had to wait a full wall-clock second. With ~9 verification rounds × ~17
-// ticks that alone accounted for ~99% of this suite's 186 s (its v3/v4/v5 siblings take seconds).
-// Patching ONLY setInterval (the suite's own `sleep` uses setTimeout) makes a poll cost ~25 ms,
-// while the plugin's due-ness logic still uses the real 200 ms `tickIntervalMs` floor — no
-// scheduler behaviour depends on the poll period, and `tickTheScheduler` below stays above it.
-const REAL_SET_INTERVAL = globalThis.setInterval
-globalThis.setInterval = function (fn, ms, ...rest) {
-  return REAL_SET_INTERVAL(fn, Math.min(Number(ms) || 0, 25), ...rest)
-}
-// ── test speed / leak check: track OUTSTANDING setTimeout handles (test-only) ──────────────
-// `leanRunFile` races `handle.done` against its own `cap`-ms timer; forgetting to clear that timer on
-// the normal path leaves one pending multi-minute timer PER RUN — a leak no output assertion can see.
-// The plugin resolves the global at call time, so wrapping it here covers it. The mock's own bounded
-// fallback uses the REAL functions, so it never pollutes the count.
-const REAL_SET_TIMEOUT = globalThis.setTimeout
-const REAL_CLEAR_TIMEOUT = globalThis.clearTimeout
-const liveTimers = new Set()
-globalThis.setTimeout = function (fn, ms, ...rest) {
-  let h
-  h = REAL_SET_TIMEOUT(function (...a) { liveTimers.delete(h); return fn.apply(this, a) }, ms, ...rest)
-  liveTimers.add(h)
-  return h
-}
-globalThis.clearTimeout = function (h) { liveTimers.delete(h); return REAL_CLEAR_TIMEOUT(h) }
-
-const projRoot = (h) => join(h.WS, 'VibeMath', 'Projects', 'proj')
-const vibeRoot = (h) => join(h.WS, 'VibeMath')
-const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '')
-const formalStateOf = (h) => JSON.parse(readIf(join(projRoot(h), 'VibeMath_State', 'formal.json')) || '{}')
-// One scheduler pass. With the poll fast-forwarded above, the poll fires every ~25 ms and a tick
-// runs whenever the plugin's own 200 ms `tickIntervalMs` floor has elapsed, so 260 ms is one pass.
-const tick = (ms = 260) => sleep(ms)
-async function waitFor(pred, tries = 80, ms = 60) {
-  for (let i = 0; i < tries; i++) { const v = pred(); if (v) return v; await sleep(ms) }
-  return undefined
-}
-const verifiersOf = (h, rKind, exclude) => h.spawns.filter((s) => s.label.startsWith('verifier:' + rKind) && !(exclude || []).some((o) => o.childId === s.childId))
-/** A reply exactly as an agent would emit it (a fenced JSON block) — the framework's real input. */
-const fence = (obj) => '```json\n' + JSON.stringify(obj) + '\n```'
-/** Feed ONE agent reply (a fresh turn's end) to the framework through the real dispatch path. */
-const replyFrom = (h, childId, obj) => h.fireEnd({
-  id: childId, runId: 'r-' + childId, provider: 'spawn', local: true, stopReason: 'completed',
-  lastAssistantMessage: [{ type: 'text', text: fence(obj) }],
-})
-const fireVerdicts = (h, kids, vale) => {
-  for (let i = 0; i < kids.length; i++) {
-    h.fireEnd({ id: kids[i].childId, runId: 'v' + i, provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n' + JSON.stringify({ Result: vale, Reason: 'review ' + i }) + '\n```' }] })
-  }
-}
-/**
- * Verify one object and DRIVE IT TO A SETTLEMENT.
- *
- * Important: v2's `processVerify` starts at most ONE verification and skips every candidate
- * while a task is live, so leaving an object mid-debate would silently block the NEXT case's
- * verification. The first `firstRounds` rounds are answered with `vale` (a non-unanimous value
- * forces a real debate round, which is exactly what the debate-prompt assertions need), and any
- * later round is answered with `settle` so the object actually closes.
- */
-async function verifyWithDebate(h, rKind, vale, firstRounds = 1, settle = 1) {
-  // v2 re-wakes the SAME verifier children for every debate round (it does not spawn new
-  // ones), so a new round is detected by counting the followups written to those children.
-  const kids = new Set()
-  // Early exit: a settled object stops producing followups. Without this the loop always spent
-  // its FULL 16 passes (~21 s at the old 1.3 s/pass), which is what made this suite take 3
-  // minutes: the debate is over, but the helper kept ticking at nothing. Three consecutive
-  // passes with no new followup = the framework has nothing left to ask.
-  let lastN = -1
-  let quiet = 0
-  for (let i = 0; i < 16; i++) {
-    // The scheduler may need a whole pass before it notices the object and another before it
-    // fills the verifier quota, so each wait must span several timer ticks.
-    const cand = await waitFor(() => {
-      const x = verifiersOf(h, rKind)
-      return x.length >= 2 ? x : undefined
-    }, 40, 250)
-    if (!cand) break
-    cand.forEach((s) => kids.add(s.childId))
-    const rounds = 1 + h.followups.filter((f) => kids.has(f.childId)).length
-    // `fireEnd` is a NO-OP for a child with no in-flight turn, so answering the whole current
-    // verifier set each pass is safe; the extra answers land before the next round's wakes.
-    fireVerdicts(h, cand, rounds <= firstRounds ? vale : settle)
-    await sleep(200)
-    await tick()
-    if (h.followups.length === lastN) { if (++quiet >= 3) break } else { quiet = 0; lastN = h.followups.length }
-  }
-  const rounds = 1 + h.followups.filter((f) => kids.has(f.childId)).length
-  return { first: h.spawns.filter((s) => s.label.startsWith('verifier:' + rKind)), rounds: kids.size ? rounds : 0 }
-}
-
-// ===============================================================
-console.log('-- V2 Lean formal verification --')
-
-// ---------- 1. 'off' is a true no-op ----------
-section("1 'off' (default) is a true no-op")
-{
-  const h = await makeCase('off')
-  const st = await h.call('vibe_math_status', {})
-  assert(st.params.formalVerify === 'off', "the default mode is 'off' (got " + st.params.formalVerify + ')')
-  assert(st.formal.mode === 'off' && st.formal.required === false, 'status exposes the formal mode and gate flag')
-  assert(st.params.leanCommand === 'lean' && Array.isArray(st.params.leanArgs), 'the Lean knobs are readable in status.params')
-  assert(st.params.leanTimeoutMs === 120000, 'leanTimeoutMs defaults to 120000 (got ' + st.params.leanTimeoutMs + ')')
-  assert(!!h.toolRegs.find((t) => t.name === 'vibe_math_lean_run') && !!h.toolRegs.find((t) => t.name === 'vibe_math_lean_archive') && !!h.toolRegs.find((t) => t.name === 'vibe_math_lean_lib'),
-    'the three Lean tools are registered in every mode (registration is static)')
-// ★ The mode switch must be REACHABLE THROUGH THE TOOL SCHEMA (2.3.2 defect D1) ──────────────
-// Every tool schema here is closed (`additionalProperties:false`), so a key the schema does not
-// advertise is REJECTED by any schema-validating provider. v3 shipped 2.3.0/2.3.1 with all four Lean
-// parameters missing from the set-params schema while every assertion in this file stayed green —
-// because the suite calls the handler DIRECTLY and never inspects the registered schema. The feature
-// could not be switched on at all through the tool interface.
-{
-  const setSpec = h.toolRegs.find((t) => t.name === 'vibe_math_set_params')
-  assert(!!setSpec, "vibe_math_set_params is registered")
-  assert(setSpec.parameters && setSpec.parameters.type === 'object' && setSpec.parameters.additionalProperties === false,
-    '★ vibe_math_set_params publishes a CLOSED object schema (an unlisted key is rejected, so the schema IS the contract)')
-  for (const k of ['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs']) {
-    assert(Object.prototype.hasOwnProperty.call(setSpec.parameters.properties, k),
-      '★ the registered schema advertises ' + k + ' (every other surface documents it; a schema that omits it makes the switch unreachable)')
-  }
-  assert(JSON.stringify(setSpec.parameters.properties.formalVerify.enum) === JSON.stringify(['off', 'encourage', 'require']),
-    'the schema narrows formalVerify to the three real modes (a typo must not be a fourth)')
-}
-
-  assert(existsSync(join(vibeRoot(h), 'Formal', 'Lib')) && existsSync(join(vibeRoot(h), 'Formal', 'Proved')), 'the GLOBAL Formal/Lib + Formal/Proved dirs are created outside the project')
-  assert(existsSync(join(projRoot(h), 'Formal')) && existsSync(join(projRoot(h), 'Verified', 'Lean')), 'the project Formal/ and Verified/Lean/ dirs are created')
-  await h.call('vibe_math_add_problem', { id: 'q1', description: 'off 模式无操作测试' })
-  await startScheduler(h)
-  await tick(2000)
-  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:q1')), 60, 200)
-  assert(!!ex, 'the explorer was spawned (the scheduler really is running)')
-  assert(!!ex && !/Lean|形式化/.test(ex.prompt || ''), 'the explorer prompt contains no Lean/形式化 text in off mode')
-  if (ex) h.fireEnd({ id: ex.childId, runId: 'r1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n{"directions":[{"id":"d1","title":"D","method":"m","core_assumption":"c","feasibility":0.6}]}\n```' }] })
-  await sleep(300)
-  const so = await waitFor(() => h.spawns.find((s) => s.label.startsWith('solver:q1')), 40, 200)
-  assert(!!so, 'the solver was spawned after the explorer returned directions')
-  assert(!!so && !/Lean|形式化/.test(so.prompt || ''), 'the solver prompt contains no Lean/形式化 text in off mode')
-  if (so) h.fireEnd({ id: so.childId, runId: 'r2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n{"status":"success","solution":"complete solution","solution_probability":0.8,"lemmas":[],"routes":[],"lessons":[],"survival_probability":0.9,"dead_end_reason":null,"sub_questions":[]}\n```' }] })
-  const vs = await verifyWithDebate(h, 'r-q1-s0', 1)
-  assert(!!vs.first && vs.first.length >= 2, 'verifiers were spawned for the solution (' + (vs.first ? vs.first.length : 0) + ')')
-  const vp = vs.first ? (h.spawns.find((s) => s.label === 'verifier:r-q1-s0:0').prompt || '') : ''
-  assert(!/Lean|形式化/.test(vp), 'the review prompt contains no Lean/形式化 text in off mode')
-  const debateText = h.followups.map((f) => f.prompt || '').join('\n')
-  assert(!/Lean|形式化/.test(debateText), 'no debate/followup prompt mentions Lean in off mode')
-  const qs = JSON.parse(readIf(join(projRoot(h), 'qs', 'qs.json')) || '[]')
-  const q = qs.find((x) => x.id === 'q1')
-  assert(!!q && q.已解决 === true, "'off' still finalizes: the problem is marked solved with NO Lean artifact")
-  assert(!!q && q.解法列表 && q.解法列表[0].正确概率 === 1, 'the solution probability is 1 in off mode')
-  assert(existsSync(join(projRoot(h), 'Verified', '问题_Verified.json')), 'the Verified card was written in off mode')
-  assert(!/形式化/.test(readIf(join(projRoot(h), 'Verified', '问题_Verified.json'))), 'the card carries no formal line in off mode')
-  assert(!existsSync(join(projRoot(h), 'Formal', 'TODO.md')), 'no Formal/TODO.md is produced in off mode')
-  const fs0 = formalStateOf(h)
-  assert(!fs0.records || Object.keys(fs0.records).length === 0, 'off mode records no formal object state')
-}
-
-// ---------- 2. parameter validation + runtime switching ----------
-section('2 parameter validation and runtime switching')
-{
-  const h = await makeCase('params')
-  const bad = await h.call('vibe_math_set_params', { formalVerify: 'banana' })
-  assert(bad.params.formalVerify === 'off', "an unknown mode degrades to 'off', never to a stronger mode (got " + bad.params.formalVerify + ')')
-  const enc = await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
-  assert(enc.params.formalVerify === 'encourage', "'encourage' is accepted")
-  const req = await h.call('vibe_math_set_params', { formalVerify: 'require', leanTimeoutMs: -5, leanCommand: '   ' })
-  assert(req.params.formalVerify === 'require', "'require' is accepted")
-  assert(req.params.leanTimeoutMs === 120000, 'a non-positive leanTimeoutMs falls back to the default (' + req.params.leanTimeoutMs + ')')
-  assert(req.params.leanCommand === 'lean', 'a blank leanCommand falls back to "lean"')
-  const lake = await h.call('vibe_math_set_params', { leanCommand: 'lake', leanArgs: ['env', 'lean'] })
-  assert(lake.params.leanCommand === 'lake' && lake.params.leanArgs.join(' ') === 'env lean', 'leanCommand/leanArgs are settable (lake env lean)')
-  const st = await h.call('vibe_math_status', {})
-  assert(st.formal.leanCommand === 'lake' && st.formal.leanArgs.join(' ') === 'env lean', 'the Lean knobs round-trip through status')
-  const setup = await h.call('vibe_math_setup', {})
-  const names = setup.parameters.map((p) => p.name)
-  assert(['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs'].every((n) => names.indexOf(n) !== -1), 'vibe_math_setup schema lists all four Lean knobs')
-  const fv = setup.parameters.find((p) => p.name === 'formalVerify')
-  assert(!!fv && fv.current === 'require' && fv.default === 'off', 'the schema reports the current and default formalVerify')
-  const tpl = await h.call('vibe_math_template', { where: 'global' })
-  const tplText = readIf(tpl.path)
-  assert(/formalVerify/.test(tplText) && /leanCommand/.test(tplText) && /leanTimeoutMs/.test(tplText), 'the settings template documents the Lean knobs')
-  assert(/leanArgs/.test(tplText), 'the settings template also documents leanArgs')
-  assert(!/:\s*undefined/.test(tplText), 'the template has no bare undefined token (settings round-trip safety)')
-  const saved = await h.call('vibe_math_save_settings', {})
-  assert(saved.ok === true, 'save_settings still round-trips with the new knobs')
-  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
-  await h.call('vibe_math_add_problem', { id: 'q2', description: '模式切换测试' })
-  await startScheduler(h)
-  await tick(2000)
-  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:q2')), 60, 200)
-  assert(!!ex && /【顺手形式化（鼓励[^）]*）】/.test(ex.prompt || ''), '★ switching to encourage changes the NEXT prompt immediately')
-  if (ex) h.fireEnd({ id: ex.childId, runId: 'r', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n{"directions":[{"id":"d1","title":"D","method":"m","core_assumption":"c","feasibility":0.5}]}\n```' }] })
-  await h.call('vibe_math_set_params', { formalVerify: 'off' })
-  await sleep(400)
-  const so = await waitFor(() => h.spawns.find((s) => s.label.startsWith('solver:q2')), 40, 200)
-  assert(!!so, 'the solver was spawned after the mode was switched back to off')
-  assert(!!so && !/形式化|Lean/.test(so.prompt || ''), '★ switching back to off removes the Lean text from the next prompt')
-}
-
-// ---------- 3. 'encourage' injection ----------
-section("3 'encourage' injects the Lean section into review AND debate prompts")
-{
-  const h = await makeCase('enc')
-  await h.call('vibe_math_set_params', { formalVerify: 'encourage', maxParallelThreshold: 8 })
-  // Keep the scheduler alive: v2 STOPS itself when there is no unsolved problem, no agent and
-  // no task, and a stopped scheduler never starts a verification (nor spawns an explorer).
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  await h.call('vibe_math_add_proposition', { id: 'pEnc', 概述: '鼓励模式下的忠实性审查', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await verifyWithDebate(h, 'r-pEnc', 0.5, 1) // 0.5 -> no consensus -> a REAL debate round
-  assert(!!vs.first, 'verifiers spawned for the bare proposition')
-  assert(vs.rounds >= 2, 'the object really went through a debate round (' + vs.rounds + ' rounds)')
-  const review = h.spawns.find((s) => s.label === 'verifier:r-pEnc:0')
-  assert(!!review, 'the first review prompt was captured')
-  const reviewText = review ? review.prompt : ''
-  assert(/【Lean 形式化验证（鼓励模式）】/.test(reviewText), '★ the REVIEW prompt carries the Lean section')
-  assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(reviewText), 'the review prompt states that a passing Lean run shrinks the question to fidelity')
-  assert(/实现难度/.test(reviewText), 'the review prompt asks for the implementation-difficulty judgement')
-  // NOTE: this assertion is only the WORDING half. Which is exactly the trap the first version
-  // of this feature fell into (a green suite guarding a dead channel). The behaviour — the reply
-  // really landing in the durable record — is asserted in section 11.
-  assert(/可以不做，但请在回执的 formal 字段写明难度判断/.test(reviewText), "'encourage' explicitly allows skipping (with a recorded judgement)")
-  assert(/"decision":"used\|blocked\|defect"/.test(reviewText), '★ the review contract lists the real decision enum (incl. defect)')
-  assert(/vibe_math_lean_run（执行）· vibe_math_lean_archive（归档）· vibe_math_lean_lib（查已有可复用库\/jobs）· vibe_math_lean_read（取回归档原文）/.test(reviewText), 'the review prompt names all four v2 tools (incl. the new read-only one)')
-  assert(/归档可复用定义\/引理前先跑通（vibe_math_lean_archive run=true 或先 vibe_math_lean_run）/.test(reviewText), '★ the review prompt says a reusable artifact must run green BEFORE it is archived')
-  assert(/LEAN_NOT_FOUND/.test(reviewText) && /宿主无 Lean 工具链/.test(reviewText), '★ the review prompt writes out the missing-toolchain escape hatch (a host without Lean must not deadlock the agent)')
-  const debate = h.followups.map((f) => f.prompt || '').filter((p) => /DEBATE/.test(p)).join('\n')
-  assert(/DEBATE/.test(debate), 'the debate round actually happened (a followup with the debate prompt was issued)')
-  assert(/【Lean 形式化验证（鼓励模式）】/.test(debate), '★ the DEBATE prompt carries the Lean section too')
-  assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(debate), 'the debate prompt states the fidelity shift')
-  await h.call('vibe_math_add_problem', { id: 'qW', description: '顺手形式化测试' })
-  await tick(2000)
-  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:qW')), 60, 200)
-  assert(!!ex && /【顺手形式化（鼓励[^）]*）】/.test(ex.prompt || ''), '★ the explorer work prompt carries the 顺手形式化 line')
-  assert(!!ex && /vibe_math_lean_archive kind='def'/.test(ex.prompt || ''), 'the work line points at the archive tool for reusable definitions')
-  assert(!!ex && /vibe_math_lean_lib 查重/.test(ex.prompt || ''), 'the work line tells members to check the reuse library first')
-  assert(!!ex && /归档前先跑通（vibe_math_lean_run 或 run=true）；跑不通的定义不要进可复用库。/.test(ex.prompt || ''), '★ the work line forbids archiving a definition that has not run green')
-  assert(!!ex && /"formal":\{"target":"<对象id>","decision":"used\|blocked\|defect"/.test(ex.prompt || ''), '★ the WORK-round contract advertises the formal reply field too (otherwise a working agent has nowhere to write its judgement)')
-  // Every agent-facing string must name the REGISTERED tools: an abbreviated `lean_archive`
-  // is not a tool that exists, and agents copy these literals verbatim (contract §6 hard req. 1).
-  const workText = (ex.prompt || '') + '\n' + reviewText + '\n' + debate
-  assert(!/(^|[^a-z_])lean_(run|archive|lib)/.test(workText), '★ no injected prompt names an abbreviated tool (every occurrence is prefixed)')
-  const offHost = await makeCase('enc-off')
-  await offHost.call('vibe_math_add_problem', { id: 'qN', description: 'x' })
-  await startScheduler(offHost)
-  await tick(2000)
-  const exN = await waitFor(() => offHost.spawns.find((s) => s.label.startsWith('explorer:qN')), 60, 200)
-  assert(!!exN && !/形式化|Lean/.test(exN.prompt || ''), 'the same prompt in off mode is free of Lean text (injection is mode-computed, not frozen)')
-}
-
-// ---------- 4. the run tool ----------
-section('4 lean_run executes through the subprocess service and reports honestly')
-{
-  const h = await makeCase('run')
-  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
-  // 这一节把 leanAsync 固定为 false：它逐字守卫**同步路径**（旧的 await 语义）。
-  // 异步（默认档）的接口与状态机由后面的「Lean async」小节守卫——两条路径都要有绿灯。
-  await h.call('vibe_math_set_params', { leanAsync: false })
-  assert((await h.call('vibe_math_status', {})).params.leanAsync === false, 'the sync section pins leanAsync=false explicitly')
-  const proj = projRoot(h)
-  mkdirSync(join(proj, 'Formal'), { recursive: true })
-  writeFileSync(join(proj, 'Formal', 'good.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
-  writeFileSync(join(proj, 'Formal', 'bad.lean'), 'theorem t : 1 = 2 := by sorry\n', 'utf8')
-  const before = leanRuns.length
-  const runGood = await h.call('vibe_math_lean_run', { file: 'Formal/good.lean', target: 'pRun' })
-  assert(runGood.ok === true && runGood.exitCode === 0, 'a file with no sorry runs green (' + JSON.stringify({ ok: runGood.ok, exitCode: runGood.exitCode }) + ')')
-  assert(leanRuns.length > before, 'the run really went through the mocked subprocess service')
-  const spec = leanRuns[leanRuns.length - 1]
-  assert(spec.cwd.replace(/\\/g, '/') === proj.replace(/\\/g, '/'), 'the toolchain runs with the PROJECT root as cwd (got ' + spec.cwd + ')')
-  assert(!!spec.stdio && spec.stdio.stdin === 'ignore' && spec.stdio.stdout.maxBytes === 64 * 1024 && spec.stdio.stderr.maxBytes === 64 * 1024, 'stdio is stdin=ignore with a 64KB output cap')
-  assert(typeof spec.graceMs === 'number' && spec.graceMs >= 1000, 'the configured timeout is passed as graceMs (' + spec.graceMs + ')')
-  assert(typeof runGood.command === 'string' && runGood.command.indexOf('good.lean') !== -1, 'the result reports the exact command line')
-  const runBad = await h.call('vibe_math_lean_run', { file: 'Formal/bad.lean' })
-  assert(runBad.ok === false && runBad.exitCode === 1, 'a file that still uses sorry reports a red run')
-  assert(/sorry/.test(runBad.stderr), 'the compiler output is returned verbatim (' + JSON.stringify(runBad.stderr).slice(0, 60) + ')')
-  assert(/修复后重跑/.test(runBad.hint || ''), 'a red run tells the member to fix and rerun')
-  const runMissing = await h.call('vibe_math_lean_run', { file: 'Formal/nope.lean' })
-  assert(runMissing.ok === false && runMissing.code === 'V2_NOT_FOUND', 'a missing file is refused with a typed code (' + runMissing.code + ')')
-  const runNoFile = await h.call('vibe_math_lean_run', {})
-  assert(runNoFile.ok === false && runNoFile.code === 'V2_INVALID_ARGUMENT', 'a run without `file` is refused')
-  // The guard's boundary is the VibeMath ROOT, not the project: the global reuse library
-  // deliberately lives at <VibeMath>/Formal/{Lib,Proved}, so climbing out of the project but
-  // staying inside VibeMath is legal (it just fails as a missing file).
-  const runOutOfProject = await h.call('vibe_math_lean_run', { file: '../../Formal/Lib/x.lean' })
-  assert(runOutOfProject.ok === false && runOutOfProject.code === 'V2_NOT_FOUND',
-    'climbing out of the project but staying inside the VibeMath root is ALLOWED (got ' + runOutOfProject.code + ')')
-  const runEscape = await h.call('vibe_math_lean_run', { file: '../../../../etc/evil.lean' })
-  assert(runEscape.ok === false && runEscape.code === 'V2_INVALID_ARGUMENT', '★ a traversal that climbs ABOVE the VibeMath root is refused')
-  const runEscape2 = await h.call('vibe_math_lean_run', { file: 'Formal/../../../../../evil.lean' })
-  assert(runEscape2.ok === false && runEscape2.code === 'V2_INVALID_ARGUMENT', 'a deeper traversal is refused too')
-  const runEscape3 = await h.call('vibe_math_lean_run', { file: '/etc/evil.lean' })
-  assert(runEscape3.ok === false && runEscape3.code === 'V2_INVALID_ARGUMENT', 'an unrelated absolute path is refused')
-  const runEscape4 = await h.call('vibe_math_lean_run', { file: 'C:/Windows/evil.lean' })
-  assert(runEscape4.ok === false && runEscape4.code === 'V2_INVALID_ARGUMENT', 'an unrelated Windows absolute path is refused')
-  const runNotLean = await h.call('vibe_math_lean_run', { file: 'Formal/good.txt' })
-  assert(runNotLean.ok === false && runNotLean.code === 'V2_INVALID_ARGUMENT', 'only .lean files can be executed')
-  assert(/VibeMath/.test(runEscape.message || ''), 'the refusal names the boundary it enforced')
-  mkdirSync(join(vibeRoot(h), 'Formal', 'Lib'), { recursive: true })
-  writeFileSync(join(vibeRoot(h), 'Formal', 'Lib', 'abs.lean'), 'def absTest := 1\n', 'utf8')
-  const runAbs = await h.call('vibe_math_lean_run', { file: join(vibeRoot(h), 'Formal', 'Lib', 'abs.lean').replace(/\\/g, '/') })
-  assert(runAbs.ok === true, 'an absolute path inside the VibeMath root is accepted')
-  const rec = formalStateOf(h)
-  assert(!!rec.records && !!rec.records.pRun && rec.records.pRun.status === 'attempted', 'a green lean_run records the object as attempted (stored, not promoted)')
-  assert(!!rec.records.pRun.run && rec.records.pRun.run.ok === true && rec.records.pRun.run.exitCode === 0, 'the run record keeps ok/exitCode')
-  assert(rec.records.pRun.run.stdoutTail !== undefined && rec.records.pRun.run.stderrTail !== undefined, 'the run record keeps truncated output tails')
-  toolchainAvailable = false
-  const runNoTc = await h.call('vibe_math_lean_run', { file: 'Formal/good.lean' })
-  assert(runNoTc.ok === false && runNoTc.code === 'LEAN_NOT_FOUND', 'a missing toolchain returns LEAN_NOT_FOUND instead of crashing')
-  assert(/仍可把形式化代码写下来归档/.test(runNoTc.message), 'the failure explains the graceful degradation')
-  toolchainAvailable = true
-  const noSub = await makeCase('nosub', { noSubprocess: true })
-  mkdirSync(join(projRoot(noSub), 'Formal'), { recursive: true })
-  writeFileSync(join(projRoot(noSub), 'Formal', 'x.lean'), 'theorem x : 1 = 1 := rfl\n', 'utf8')
-  const noSubRun = await noSub.call('vibe_math_lean_run', { file: 'Formal/x.lean' })
-  assert(noSubRun.ok === false && noSubRun.code === 'NO_SUBPROCESS', 'a host without the subprocess service returns NO_SUBPROCESS and does not crash (got ' + noSubRun.code + ')')
-  const noSubStatus = await noSub.call('vibe_math_status', {})
-  assert(noSubStatus.ok === true, 'the scheduler still answers status after that (nothing was thrown into the loop)')
-}
-
-// ---------- 4b. the timeout must STOP the process, not just report it ----------
-// Contract §7: "必须给 cwd…，并对超时调用 handle.terminate()". Reporting LEAN_TIMEOUT while the Lean
-// process keeps running is a silent resource leak, and the framework's own contract says otherwise.
-section('4b lean_run ACTIVELY terminates on timeout (contract §7)')
-{
-  const h = await makeCase('timeout')
-  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
-  const proj = projRoot(h)
-  mkdirSync(join(proj, 'Formal'), { recursive: true })
-  writeFileSync(join(proj, 'Formal', 'hang.lean'), 'theorem t : 1 = 1 := rfl -- HANG\n', 'utf8')
-  writeFileSync(join(proj, 'Formal', 'fast.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
-  const before = terminations.length
-  const t0 = Date.now()
-  const run = await h.call('vibe_math_lean_run', { file: 'Formal/hang.lean', timeout_ms: 1000 })
-  const elapsed = Date.now() - t0
-  assert(run.ok === false && run.code === 'LEAN_TIMEOUT', '★ a run that outlives its timeout is reported as LEAN_TIMEOUT (got ' + run.code + ')')
-  assert(run.timedOut === true, 'the result carries timedOut=true')
-  assert(terminations.length === before + 1 && /hang\.lean/.test(terminations[terminations.length - 1].file),
-    '★★ the timeout ACTIVELY called handle.terminate() (graceMs alone does not stop a lingering Lean process)')
-  assert(elapsed < 2400, 'the call returned AT its timeout instead of waiting the process out (took ' + elapsed + 'ms)')
-  const fast = await h.call('vibe_math_lean_run', { file: 'Formal/fast.lean' })
-  assert(fast.ok === true && fast.timedOut === false, 'a normal run still reports success')
-  assert(terminations.length === before + 1, 'a normal run terminates nothing')
-  await sleep(60)
-  assert(liveTimers.size === 0, '★ no timeout timer is left pending after either run (it is cleared as soon as `done` wins)')
-}
-
-// ---------- 5. archive: def / lemma / proof / blocked ----------
-section('5 lean_archive writes the contract paths and indexes')
-{
-  const h = await makeCase('arc')
-  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
-  const proj = projRoot(h)
-  const libPath = join(vibeRoot(h), 'Formal', 'Lib')
-  const provedPath = join(vibeRoot(h), 'Formal', 'Proved')
-  const defRes = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'ZMod5', content: 'def ZMod5 := Fin 5\n' })
-  assert(defRes.ok === true && defRes.file === 'Formal/Lib/ZMod5.lean', 'a reusable definition is archived to the global lib (' + defRes.file + ')')
-  assert(existsSync(join(libPath, 'ZMod5.lean')), '★ the definition exists under <VibeMath>/Formal/Lib/ (cross-project, NOT inside the project)')
-  assert(!existsSync(join(proj, 'Formal', 'Lib', 'ZMod5.lean')), 'it is NOT duplicated inside the project tree')
-  assert(!!defRes.run && defRes.run.ok === true, 'the archived definition was executed (kind=def runs by default)')
-  const lemmaRes = await h.call('vibe_math_lean_archive', { kind: 'lemma', name: 'sq_odd', content: 'theorem sq_odd (n : Nat) : Odd (n*n) → Odd n := by omega\n' })
-  assert(lemmaRes.ok === true && lemmaRes.file === 'Formal/Proved/sq_odd.lean', 'a lemma is archived to the global Proved/ (' + lemmaRes.file + ')')
-  assert(existsSync(join(provedPath, 'sq_odd.lean')), 'the lemma exists under <VibeMath>/Formal/Proved/')
-  const defNoRun = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'quiet', content: 'def quiet := 2\n', run: false })
-  assert(defNoRun.ok === true && defNoRun.run === undefined, 'run:false archives without executing (still indexed)')
-  assert(/ZMod5/.test(readIf(join(libPath, 'Index.md'))), 'Lib/Index.md lists the new definition')
-  assert(/quiet/.test(readIf(join(libPath, 'Index.md'))), 'Lib/Index.md lists the run:false definition too')
-  assert(/sq_odd/.test(readIf(join(provedPath, 'Index.md'))), 'Proved/Index.md lists the new lemma')
-  writeFileSync(join(proj, 'Formal', 'src.lean'), 'def copied := 3\n', 'utf8')
-  const defFrom = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'copied', from: 'Formal/src.lean' })
-  assert(defFrom.ok === true && existsSync(join(libPath, 'copied.lean')), 'kind=def can archive from an existing .lean file')
-  // The tool RESULT is agent-facing text too: a definition whose run just failed must not be advertised
-  // as "directly importable" (contract §6 hard req. 3 / 实现方案 §9.4 — a red file must not be presented
-  // as usable, whatever the framework decides to do with the file itself).
-  const defRed = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'polluted', content: 'def polluted := 1 -- FAIL\n' })
-  assert(defRed.ok === true && !!defRed.run && defRed.run.ok === false, 'a definition that does not compile is reported as a red run')
-  assert(!/可直接 import 复用/.test(defRed.note || ''), '★ a red definition must NOT be advertised as directly reusable')
-  assert(/运行未通过/.test(defRed.note || ''), '…and the note says what to do instead')
-  const fromOutside = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'escape', from: '../../../../etc/passwd' })
-  assert(fromOutside.ok === false && fromOutside.code === 'V2_INVALID_ARGUMENT', 'from=<path outside the VibeMath root> is refused')
-  const noName = await h.call('vibe_math_lean_archive', { kind: 'def', content: 'def x := 1\n' })
-  assert(noName.ok === false && noName.code === 'V2_INVALID_ARGUMENT', 'archiving a definition without a name is refused')
-  const noBody = await h.call('vibe_math_lean_archive', { kind: 'lemma', name: 'xb' })
-  assert(noBody.ok === false && noBody.code === 'V2_INVALID_ARGUMENT', 'archiving a lemma with neither content nor from is refused')
-  const badKind = await h.call('vibe_math_lean_archive', { kind: 'nonsense' })
-  assert(badKind.ok === false && badKind.code === 'V2_INVALID_ARGUMENT', 'an unknown archive kind is refused')
-  const noTarget = await h.call('vibe_math_lean_archive', { kind: 'proof', content: 'theorem x : 1 = 1 := rfl\n' })
-  assert(noTarget.ok === false && noTarget.code === 'V2_INVALID_ARGUMENT', 'kind=proof without a target is refused')
-  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pProof', content: 'theorem p_proof : 3 * 1 ^ 2 - 2 = (1:Nat) ^ 2 := by decide\n' })
-  assert(proof.ok === true && proof.passed === true, 'a passing proof is archived (' + JSON.stringify({ ok: proof.ok, passed: proof.passed }) + ')')
-  assert(proof.file === 'Formal/pProof.lean', 'the working file is Formal/<target>.lean')
-  assert(proof.proof === 'Verified/Lean/pProof.lean', 'the archived proof path is Verified/Lean/<target>.lean')
-  assert(existsSync(join(proj, 'Formal', 'pProof.lean')), 'the working file exists on disk')
-  assert(existsSync(join(proj, 'Verified', 'Lean', 'pProof.lean')), '★ the proof is archived under Verified/Lean/')
-  assert(proof.status === 'passed', 'the object status becomes passed')
-  const proofBad = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pRed', content: 'theorem p_red : 1 = 2 := by sorry\n' })
-  assert(proofBad.ok === true && proofBad.passed === false && proofBad.status === 'attempted', 'a red proof is recorded as attempted (not passed)')
-  assert(!existsSync(join(proj, 'Verified', 'Lean', 'pRed.lean')), 'a red proof is NOT archived under Verified/Lean/')
-  assert(/sorry/.test((proofBad.run && proofBad.run.stderr) || ''), 'the red run keeps the compiler output for the member to fix')
-  const st = await h.call('vibe_math_status', {})
-  assert(st.formal.objects.some((o) => o.target === 'pProof' && o.status === 'passed'), 'status lists the passed object')
-  const idx = readIf(join(proj, 'Formal', 'Index.md'))
-  assert(/pProof/.test(idx) && /passed/.test(idx) && /Verified\/Lean\/pProof\.lean/.test(idx), 'Formal/Index.md indexes the object, its status and its archived proof')
-  assert(/pRed/.test(idx) && /attempted/.test(idx), 'Formal/Index.md also records the failed attempt')
-  const blkNoNote = await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'pBlk' })
-  assert(blkNoNote.ok === false && blkNoNote.code === 'V2_INVALID_ARGUMENT', 'blocked without a note is refused')
-  const blk = await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'pBlk', note: '需要外层解析数论框架，本轮工作量不可接受' })
-  assert(blk.ok === true && blk.status === 'blocked', 'a reasoned blocker is recorded')
-  assert(/需要外层解析数论框架/.test(readIf(join(proj, 'Formal', 'Index.md'))), 'the blocker reason reaches the index')
-  const stBlk = await h.call('vibe_math_status', {})
-  assert(stBlk.formal.objects.some((o) => o.target === 'pBlk' && o.status === 'blocked'), 'status lists the blocked object')
-  const lib = await h.call('vibe_math_lean_lib', {})
-  assert(lib.ok === true && lib.counts.lib >= 3 && lib.counts.proved >= 1, 'lean_lib reports the reuse library sizes (' + JSON.stringify(lib.counts) + ')')
-  assert(lib.objects.some((o) => o.target === 'pProof' && o.status === 'passed'), 'lean_lib lists the per-object formal status')
-  assert(/复用优先/.test(lib.hint || ''), 'lean_lib tells agents to reuse before redefining')
-  assert(lib.mode === 'encourage', 'lean_lib reports the active mode')
-  const noRefresh = await h.call('vibe_math_lean_lib', { refresh: false })
-  assert(noRefresh.rebuilt === false && noRefresh.counts.lib === null, 'refresh:false lists without rebuilding')
-  assert(existsSync(join(proj, 'Formal', 'Index.md')), 'the project Formal/Index.md exists')
-  assert(existsSync(join(libPath, 'Index.md')) && existsSync(join(provedPath, 'Index.md')), 'the two GLOBAL indexes exist')
-}
-
-// ---------- 6. a passing proof flips the review to FIDELITY ----------
-section('6 a passing proof flips the review subject to fidelity')
-{
-  const h = await makeCase('fid')
-  await h.call('vibe_math_set_params', { formalVerify: 'encourage', maxParallelThreshold: 8 })
-  // v2's scheduler STOPS itself when there is no unsolved problem, no agent and no task; a
-  // case that only wants to verify a proposition therefore needs one live problem to keep
-  // the tick loop alive (otherwise no verification would ever be started).
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'r-pFid', content: 'theorem p_fid : 2 + 2 = 4 := by decide\n' })
-  await h.call('vibe_math_add_proposition', { id: 'pFid', 概述: '2+2=4（已有 Lean 证明）', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  // 0.5 in round 1 forces a debate round whose prompt must ALSO carry the fidelity wording
-  const vs = await verifyWithDebate(h, 'r-pFid', 0.5, 1)
-  assert(!!vs.first, 'a verifier was spawned for the Lean-passed object')
-  const vp = h.spawns.find((s) => s.label === 'verifier:r-pFid:0')
-  const vpText = vp ? vp.prompt : ''
-  assert(/该对象已有\*\*通过的 Lean 形式化证明\*\*/.test(vpText), 'the review prompt announces the passing proof')
-  assert(/你不需要重新检查推导/.test(vpText), '★ it tells reviewers NOT to re-derive')
-  assert(/忠实性审查/.test(vpText), '★ it tells reviewers the review subject is now fidelity')
-  assert(/定义 \/ 对象 \/ 条件 \/ 假设 \/ 结论是否与命题原文\*\*完全一致\*\*/.test(vpText), 'it enumerates exactly what fidelity means')
-  assert(/Verified\/Lean\/r-pFid\.lean/.test(vpText), 'it points at the archived proof')
-  assert(/一致 → Result = 1/.test(vpText), '★ the fidelity guidance names the REAL field (v2\'s contract field is Result)')
-  assert(!/verdict/.test(vpText), '★ the fidelity guidance never names a `verdict` field (that vote would be silently dropped)')
-  assert(/发现任何偏差，不要投 0/.test(vpText), '★ a fidelity defect is explicitly NOT to be voted as 0 (it is not a refutation)')
-  assert(/formal:\{decision:'defect'/.test(vpText), '★ the reviewers are given the defect reply channel that withdraws the proof')
-  assert(!/偏离 → 0/.test(vpText), '★ the "any deviation → 0" instruction is gone (it would fabricate a false conclusion)')
-  assert(!/请先判断该对象的\*\*实现难度\*\*/.test(vpText), 'the "judge the difficulty first" wording is gone when a proof already exists')
-  // The withdrawal sentence must match the MODE's real strength (contract §4.1 pt.3 / §6.1; this case is
-  // 'encourage'): encouraging mode has NO gate, so the framework cannot hold the verdict — promising a
-  // hold there is a lie the voter would rely on (AUDIT-CHECKLIST §1.7, "提示词承诺的强度档位").
-  assert(/本档没有门禁/.test(vpText), '★ encourage fidelity text says THIS MODE HAS NO GATE (the framework cannot hold the verdict)')
-  assert(!/本次裁定\*\*不定论\*\*/.test(vpText), '★ encourage must NOT promise a hold the framework cannot enforce')
-  const debate = h.followups.map((f) => f.prompt || '').filter((p) => /DEBATE/.test(p)).join('\n')
-  assert(/你不需要重新检查推导/.test(debate), '★ the debate prompt for a Lean-passed object also asks for fidelity, not re-derivation')
-  assert(/发现任何偏差，不要投 0/.test(debate), '★ and it carries the same no-zero rule in the debate round')
-  assert(/本档没有门禁/.test(debate), '★ the debate round carries the same mode-qualified withdrawal wording')
-  await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'r-pBlk2', note: '涉及未形式化的分析学前置' })
-  await h.call('vibe_math_add_proposition', { id: 'pBlk2', 概述: '已记录阻塞的命题', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs2 = await verifyWithDebate(h, 'r-pBlk2', 0.5, 1)
-  assert(!!vs2.first, 'verifiers spawned for the blocked object')
-  const vp2 = h.spawns.find((s) => s.label === 'verifier:r-pBlk2:0')
-  const vp2Text = vp2 ? vp2.prompt : ''
-  assert(/该对象已被记录为\*\*形式化阻塞\*\*/.test(vp2Text), 'a blocked object is announced as such')
-  assert(/涉及未形式化的分析学前置/.test(vp2Text), 'the blocker reason is shown to the reviewers')
-  assert(/这个阻塞判断是否成立/.test(vp2Text), 'the verdict guidance asks whether the blocker is justified')
-}
-
-// ---------- 7. the 'require' gate (proposition) ----------
-section("7 'require' withholds a verdict until the formal record exists")
-{
-  const h = await makeCase('gate')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  // a live problem keeps the scheduler from stopping itself (see the comment in case 6)
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  await h.call('vibe_math_add_proposition', { id: 'pGate', 概述: '必须形式化的命题', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pGate'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs, 'verifiers were spawned under require mode')
-  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pGate:0') || {}).prompt || ''
-  assert(/【Lean 形式化验证（强制模式）】/.test(vp), 'the review prompt says 强制模式')
-  assert(/必须产出 Lean 形式化/.test(vp), "'require' states the formalization is mandatory")
-  assert(/本次裁定不会生效/.test(vp), 'the prompt warns that the verdict will not take effect without it')
-  assert(/formal-required/.test(vp), 'the prompt names the machine-readable reason')
-  assert(/vibe_math_lean_archive kind='blocked' note=… 或回执 formal\.note/.test(vp), '★ the require wording names BOTH blocking routes with the FULL tool name')
-  assert(/"formal":\{"target":"r-pGate","decision":"used\|blocked\|defect"/.test(vp), '★ the require review contract carries the formal reply field keyed by the verification id')
-  assert(!/(^|[^a-z_])lean_(run|archive|lib)/.test(vp), '★ the require prompt contains no abbreviated tool name either')
-  fireVerdicts(h, vs, 1)
-  // The deferral writes Formal/TODO.md from INSIDE the settle path; waiting for that file is
-  // the observable proof that the round settled (the task is dropped right after).
-  const todoSettled = await waitFor(() => /pGate/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 40, 150)
-  assert(!!todoSettled, 'the deferred round settled (Formal/TODO.md recorded the object)')
-  await tick(600)
-  const propFile = join(proj, 'Propos', '数论_Propos.json')
-  const props = JSON.parse(readIf(propFile) || '[]')
-  const pGate = props.find((x) => x.id === 'pGate') || {}
-  assert(pGate.布尔估计 === 0.5, "★ the verdict did NOT take effect: the proposition's 布尔估计 is unchanged (got " + pGate.布尔估计 + ')')
-  assert(!(pGate.证明列表 || []).some((x) => x.正确概率 === 1), 'no probability-1 proof entry was recorded')
-  assert(pGate.优先级 !== 'never', 'the priority was not pinned to never')
-  assert(!existsSync(join(proj, 'Verified', '数论_Verified.json')), '★ no Verified card was written')
-  const todo = readIf(join(proj, 'Formal', 'TODO.md'))
-  assert(existsSync(join(proj, 'Formal', 'TODO.md')), 'Formal/TODO.md was created')
-  assert(/pGate/.test(todo) && /formal-required/.test(todo), '★ the object is on the formalization TODO with the machine-readable reason')
-  const recAfterGate = formalStateOf(h)
-  // record key = the verification object id (rId), which is what lean_archive target= also uses
-  assert(!!recAfterGate.records && !!recAfterGate.records['r-pGate'] && !!recAfterGate.records['r-pGate'].deferredAt, 'the deferral is persisted in the durable formal state (survives resume)')
-  assert(!!recAfterGate.records['r-pGate'] && recAfterGate.records['r-pGate'].status === 'none', 'the object stays at status none (nothing was formalized)')
-  const vlogs = existsSync(join(proj, 'Verification_logs')) ? readdirSync(join(proj, 'Verification_logs')) : []
-  assert(vlogs.some((f) => f.startsWith('r-pGate')), '★ the verification round DID complete (its debate log exists) — the gate withheld the conclusion, it did not stall the round')
-  const st1 = await h.call('vibe_math_status', {})
-  assert(/require 模式搁置/.test(JSON.stringify(st1.recentActivity)), 'the withholding is announced on v2-readable channel (activity log; v2 has no Shared/Chat/)')
-  assert(st1.formal.todo.some((t) => t.id === 'r-pGate'), 'status exposes the formalization TODO')
-  const rep = await h.call('vibe_math_report', {})
-  assert(!!rep.formal && rep.formal.required === true && rep.formal.mode === 'require', 'the report exposes the formal mode and gate flag')
-  assert(rep.recentActivity.some((a) => /formal-gate/.test(a.event)), 'the deferral also lands in the report log')
-  // The deferral leaves this project with no agent, task or solved problem, and v2's strict
-  // termination stops the scheduler there — so a case that wants to RE-verify the object after
-  // formalizing it must (re)start the scheduler, exactly as a human would.
-  await startScheduler(h)
-  const proofNow = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pGate', content: 'theorem p_gate : 2 + 2 = 4 := by decide\n' })
-  assert(proofNow.ok === true && proofNow.passed === true, 'the object is now Lean-passed')
-  const spawned2 = await verifyWithDebate(h, 'r-pGate', 1, 0)
-  assert(!!spawned2.first, 'the object was re-verified after the proof was archived')
-  const props2 = JSON.parse(readIf(propFile) || '[]')
-  const pGateNow = props2.find((x) => x.id === 'pGate') || {}
-  assert(pGateNow.布尔估计 === 1, '★ with a passing Lean artifact the same unanimous verdict DOES take effect (布尔估计=1)')
-  const cardFile = join(proj, 'Verified', '数论_Verified.json')
-  const cards = JSON.parse(readIf(cardFile) || '[]')
-  const card = cards.find((c) => c.id === 'pGate')
-  assert(!!card, '★ the Verified card was written after the proof passed')
-  assert(!!card && /Lean 通过/.test(card['形式化'] || ''), '★ the card records how strong the result is (Lean 通过)')
-  assert(!!card && /Verified\/Lean\/pGate\.lean/.test(card['形式化'] || ''), 'the card points at the archived proof')
-  await h.call('vibe_math_add_proposition', { id: 'pBlkOk', 概述: '记录阻塞后可定论', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const sp3 = await waitFor(() => { const x = verifiersOf(h, 'r-pBlkOk'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!sp3, 'verifiers spawned for the blocker-escape case')
-  await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'r-pBlkOk', note: '命题涉及未形式化的分析学，本轮不做' })
-  fireVerdicts(h, sp3 || [], 1)
-  await waitFor(() => { const c = JSON.parse(readIf(cardFile) || '[]').find((x) => x.id === 'pBlkOk'); return c ? c : undefined }, 40, 150)
-  await tick(400)
-  const cards3 = JSON.parse(readIf(cardFile) || '[]')
-  const card3 = cards3.find((c) => c.id === 'pBlkOk')
-  assert(!!card3, '★ an explicit reasoned blocker also lets the verdict through (decide by difficulty, but decide out loud)')
-  assert(!!card3 && /阻塞（/.test(card3['形式化'] || ''), 'the card records the blocker')
-  assert(!!card3 && /未形式化的分析学/.test(card3['形式化'] || ''), 'the card records the blocker REASON, not just the fact')
-}
-
-// ---------- 8. the gate covers the qs (problem) choke point ----------
-section('8 the gate also covers a problem-solution verdict')
-{
-  const h = await makeCase('gq')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  // a live problem keeps the scheduler from stopping itself (see the comment in case 3)
-  await h.call('vibe_math_add_problem', { id: 'qStay', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  await h.call('vibe_math_add_problem', { id: 'qG', description: '带解法的 require 门禁问题', priority: 1 })
-  const qsFile = join(proj, 'qs', 'qs.json')
-  const qs0 = JSON.parse(readIf(qsFile) || '[]')
-  qs0.find((q) => q.id === 'qG').解法列表 = [{ 完整解法: 'closing argument', 正确概率: 0.8, 已验: false }]
-  writeFileSync(qsFile, JSON.stringify(qs0, null, 2), 'utf8')
-  await tick(2000)
-  const sp = await waitFor(() => { const x = verifiersOf(h, 'r-qG-s0'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!sp, 'verifiers spawned for the problem solution')
-  fireVerdicts(h, sp || [], 1)
-  const todoG = await waitFor(() => /qG/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 40, 150)
-  assert(!!todoG, 'the deferred problem round settled (Formal/TODO.md recorded it)')
-  await tick(600)
-  const qs1 = JSON.parse(readIf(qsFile) || '[]')
-  const qG = qs1.find((q) => q.id === 'qG')
-  assert(!!qG && qG.已解决 !== true, '★ the problem was NOT marked solved (the require gate blocked the promotion)')
-  assert(!!qG && qG.解法列表[0].正确概率 !== 1, "the solution's probability was left as it was")
-  assert(!existsSync(join(proj, 'Verified', '问题_Verified.json')), 'no problem Verified card was written')
-  assert(/qG/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 'the problem is on the formalization TODO')
-  await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'qG', note: '问题的形式化超出本轮工作量' })
-  await startScheduler(h) // see case 7: the deferral may have stopped the scheduler
-  const sp2 = await verifyWithDebate(h, 'r-qG-s0', 1, 0)
-  assert(!!sp2.first, 'the problem solution was re-verified after the blocker was recorded')
-  const qs2 = JSON.parse(readIf(qsFile) || '[]')
-  const qG2 = qs2.find((q) => q.id === 'qG')
-  assert(!!qG2 && qG2.已解决 === true, 'with a reasoned blocker the problem DOES close')
-  assert(!!qG2 && qG2.解法列表[0].正确概率 === 1, 'the solution probability becomes 1 after the gate opened')
-  const cards = JSON.parse(readIf(join(proj, 'Verified', '问题_Verified.json')) || '[]')
-  const card = cards.find((c) => c.id === 'qG')
-  assert(!!card && /阻塞（/.test(card['形式化'] || ''), 'the problem card records the formal status')
-  assert(!existsSync(join(vibeRoot(h), 'Formal', 'Lib', 'qG.lean')), 'a blocked record does not fabricate a library file')
-}
-
-// ---------- 9. persistence across resume ----------
-section('9 the formal state survives resume (v2 has no session projection)')
-{
-  const h = await makeCase('persist')
-  await h.call('vibe_math_set_params', { formalVerify: 'require' })
-  await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pPersist', content: 'theorem p_persist : 1 + 1 = 2 := by decide\n' })
-  const before = await h.call('vibe_math_status', {})
-  assert(before.formal.objects.some((o) => o.target === 'pPersist' && o.status === 'passed'), 'the object is passed before the restart')
-  const proj = projRoot(h)
-  writeFileSync(join(proj, 'VibeMath_State', 'process_epoch.json'), JSON.stringify('OLD-PROCESS-EPOCH'), 'utf8')
-  const res = await h.call('vibe_math_resume', {})
-  assert(res.ok === true, 'resume succeeded')
-  const after = await h.call('vibe_math_status', {})
-  assert(after.formal.objects.some((o) => o.target === 'pPersist' && o.status === 'passed'),
-    '★ the Lean-passed object is still passed after resume (the gate does not forget)')
-  assert(/pPersist/.test(readIf(join(proj, 'Formal', 'Index.md'))), 'Formal/Index.md still indexes it (the files are the readable mirror)')
-}
-
-// ---------- 10. the gate is a no-op unless require ----------
-section("10 'encourage' never gates (a verdict still lands with no Lean artifact)")
-{
-  const h = await makeCase('nogate')
-  await h.call('vibe_math_set_params', { formalVerify: 'encourage', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  await h.call('vibe_math_add_proposition', { id: 'pFree', 概述: '鼓励模式不设门禁', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await verifyWithDebate(h, 'r-pFree', 1, 0)
-  assert(!!vs.first, 'verifiers spawned under encourage mode')
-  const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
-  const p = props.find((x) => x.id === 'pFree') || {}
-  assert(p.布尔估计 === 1, "'encourage' finalizes normally with NO Lean artifact (布尔估计=1)")
-  const cards = JSON.parse(readIf(join(proj, 'Verified', '数论_Verified.json')) || '[]')
-  assert(!!cards.find((c) => c.id === 'pFree'), "'encourage' writes the Verified card")
-  assert(!existsSync(join(proj, 'Formal', 'TODO.md')) || !/pFree/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 'no formalization TODO is created in encourage mode')
-}
-
-// ---------- 11. the reply channel is REAL (contract §4 / §6.3 / §10.8) ----------
-// The first version of this feature only WROTE "请在回执的 formal 字段写明难度判断" into the prompt
-// and never parsed it: 177 green assertions guarded a dead channel (AUDIT-CHECKLIST §2.2). These
-// cases feed a genuine agent reply through the framework's own dispatch path (subagent/end →
-// handleVerifier → absorb) and assert the DURABLE record, not the wording.
-section('11 the reply channel really lands in the record (blocked / note validation)')
-{
-  const h = await makeCase('reply')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  await h.call('vibe_math_add_proposition', { id: 'pReply', 概述: '用回执记录阻塞', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pReply'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs, 'verifiers were spawned for the reply-channel proposition')
-  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pReply:0') || {}).prompt || ''
-  assert(/"formal":\{"target":"r-pReply","decision":"used\|blocked\|defect"/.test(vp), '★ the review contract itself advertises the formal field, keyed by the verification id')
-  if (vs) {
-    // ① `blocked` WITH a note, named by the VERIFICATION id → the OBJECT record must be synced too.
-    replyFrom(h, vs[0].childId, { Result: 0.5, Reason: '我判断形式化不划算', formal: { target: 'r-pReply', decision: 'blocked', note: '需要大量未形式化的实分析前置知识' } })
-    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['r-pReply'] && r['r-pReply'].status === 'blocked') ? r : undefined }, 40, 150)
-    assert(!!rec, '★ a `formal.decision=blocked` reply is really absorbed — the channel is not dead code')
-    assert(!!rec && rec['r-pReply'].decision === 'blocked' && /实分析前置知识/.test(rec['r-pReply'].note || ''), 'the record keeps the decision AND the reason')
-    assert(!!rec && !!rec['pReply'] && rec['pReply'].status === 'blocked' && /实分析前置知识/.test(rec['pReply'].note || ''), '★ the OBJECT-id record is synced too (the two id spaces must not drift)')
-    assert(/实分析前置知识/.test(readIf(join(projRoot(h), 'Formal', 'Index.md'))), 'the reply-recorded blocker reaches Formal/Index.md')
-    // ② `blocked` WITHOUT a note (a different target) → refused with V2_INVALID_ARGUMENT, no record.
-    replyFrom(h, vs[1].childId, { Result: 0.5, Reason: '不想做', formal: { target: 'r-pNoNote', decision: 'blocked' } })
-    let acts = ''
-    for (let i = 0; i < 25; i++) {
-      const st = await h.call('vibe_math_status', {})
-      acts = (st.recentActivity || []).map((a) => a.detail).join('\n')
-      if (/V2_INVALID_ARGUMENT/.test(acts)) break
-      await sleep(120)
-    }
-    assert(/V2_INVALID_ARGUMENT/.test(acts), '★ a blocked/defect judgement without a note is REJECTED with V2_INVALID_ARGUMENT')
-    assert(/没有写明 note/.test(acts), 'the refusal says why (an explicit decision is required, never a silent skip)')
-    const recN = formalStateOf(h)
-    assert(!(recN.records || {})['r-pNoNote'] && !(recN.records || {})['pNoNote'], 'no record is invented for the refused judgement')
-    assert(!/pNoNote/.test(readIf(join(projRoot(h), 'Formal', 'Index.md'))), 'the refused judgement does not reach the index either')
-    // ③ a reply with NO target must not invent an object (safeId('') would fall back to 'anon').
-    // The 0.5/0.5 round has no consensus, so the debate round re-woke both children — that is the
-    // observable proof that these children are registered and can answer again.
-    const woke = await waitFor(() => (h.followups.filter((f) => /DEBATE/.test(f.prompt || '')).length >= 2 ? true : undefined), 40, 150)
-    assert(!!woke, 'the debate round re-woke the verifiers (round-2 replies reach the framework again)')
-    replyFrom(h, vs[0].childId, { Result: 0.5, Reason: '漏写 target', formal: { decision: 'blocked', note: '没有写 target' } })
-    let acts2 = ''
-    for (let i = 0; i < 25; i++) {
-      const st = await h.call('vibe_math_status', {})
-      acts2 = (st.recentActivity || []).map((a) => a.detail).join('\n')
-      if (/没有 target/.test(acts2)) break
-      await sleep(120)
-    }
-    assert(/没有 target/.test(acts2), '★ a `formal` reply without a target is refused, not guessed')
-    const recT = formalStateOf(h)
-    assert(!(recT.records || {}).anon, '★ a `formal` reply without a target cannot invent a record (no "anon" object)')
-  }
-}
-
-// ---------- 12. `defect`: a fidelity defect is NOT "the proposition is false" (§4.1) ----------
-section('12 a defect reply withdraws the proof, writes the TODO and defers the verdict')
-{
-  const h = await makeCase('defect')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  // A PASSING Lean proof exists for the object — archived under the OBJECT id, the realistic path.
-  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pDefect', content: 'theorem p_defect : 2 + 2 = 4 := by decide\n' })
-  assert(proof.ok === true && proof.passed === true, 'precondition: the object starts Lean-passed')
-  const proofFile = join(proj, 'Verified', 'Lean', 'pDefect.lean')
-  assert(existsSync(proofFile), 'the archived proof exists before the defect is reported')
-  await h.call('vibe_math_add_proposition', { id: 'pDefect', 概述: '形式化写窄了的命题', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pDefect'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs, 'verifiers were spawned for the Lean-passed object')
-  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pDefect:0') || {}).prompt || ''
-  assert(/忠实性审查/.test(vp) && /不要投 0/.test(vp), 'the reviewers were told to audit fidelity and NOT to vote 0 on a defect')
-  // In REQUIRE mode the framework really does hold the verdict, so THAT promise is the correct one here.
-  assert(/本次裁定\*\*不定论\*\*/.test(vp), '★ require fidelity text does promise the hold (the gate really enforces it)')
-  assert(!/本档没有门禁/.test(vp), 'require must not claim it has no gate')
-  const DEFECT = 'Lean 只证了 n>0 的情形，命题原文是 n≥0'
-  if (vs) {
-    // A fidelity defect: the voter ABSTAINS (0.3) and records it through the reply channel.
-    replyFrom(h, vs[0].childId, { Result: 0.3, Reason: '形式化写窄了（弃权）', formal: { target: 'pDefect', decision: 'defect', note: DEFECT } })
-    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pDefect'] && r['pDefect'].decision === 'defect') ? r : undefined }, 40, 150)
-    assert(!!rec, '★ the defect reply is absorbed')
-    assert(!!rec && rec['pDefect'].status === 'attempted', '★ the object is DOWNGRADED to attempted (the "passed" status is withdrawn)')
-    assert(!!rec && rec['pDefect'].proof === '', '★ the proof pointer is cleared')
-    assert(!!rec && rec['pDefect'].note === DEFECT, 'the concrete deviation is recorded on the object record')
-    assert(!!rec && !!rec['r-pDefect'] && rec['r-pDefect'].status === 'attempted' && rec['r-pDefect'].decision === 'defect', '★ the verification-id record is downgraded too (both id spaces)')
-    assert(!existsSync(proofFile), '★ the archived proof Verified/Lean/pDefect.lean is DELETED')
-    assert(existsSync(join(proj, 'Formal', 'pDefect.lean')), 'the working file Formal/pDefect.lean is kept (the code is not lost)')
-    const todo = readIf(join(proj, 'Formal', 'TODO.md'))
-    assert(/pDefect/.test(todo) && /defect/.test(todo), '★ the object is listed in Formal/TODO.md with the defect reason')
-    assert(/只证了 n>0 的情形/.test(todo), 'the TODO carries the concrete deviation, not just a flag')
-    let acts = ''
-    for (let i = 0; i < 25; i++) {
-      const st = await h.call('vibe_math_status', {})
-      acts = (st.recentActivity || []).map((a) => a.detail).join('\n')
-      if (/忠实性缺陷/.test(acts)) break
-      await sleep(120)
-    }
-    assert(/忠实性缺陷/.test(acts), 'the downgrade is announced on the v2-readable channel (activity log)')
-    assert(/撤回「已通过」状态/.test(acts), 'the announcement says the passed status was withdrawn')
-    assert(/本次裁定不定论/.test(acts), 'and that the verdict is undecided — a defect withdraws a proof, it does not refute the proposition')
-    // Now drive the same round to a UNANIMOUS "true": without the defect it would conclude.
-    const settled = await verifyWithDebate(h, 'r-pDefect', 1, 0)
-    assert(!!settled.first, 'the round was driven to a verdict after the defect')
-    const todo2 = await waitFor(() => { const t = readIf(join(proj, 'Formal', 'TODO.md')); return /formal-required/.test(t) ? t : undefined }, 40, 150)
-    assert(!!todo2 && /r-pDefect/.test(todo2), '★ require mode DEFERS after a defect (the object enters the formalization TODO as formal-required)')
-    await tick(400)
-    const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
-    const p = props.find((x) => x.id === 'pDefect') || {}
-    assert(p.布尔估计 === 0.5, '★★ the proposition is NOT recorded as false — 布尔估计 unchanged (got ' + p.布尔估计 + ')')
-    assert(!(p.证明列表 || []).some((x) => x.正确概率 === 1), 'no probability-1 proof entry was written')
-    assert(p.优先级 !== 'never', 'the priority was not pinned to never')
-    assert(!existsSync(join(proj, 'Verified', '数论_Verified.json')), '★ no Verified card: the verdict is UNDECIDED, not "false"')
-  }
-  // The reverse direction: a defect named by the VERIFICATION id must still downgrade the OBJECT
-  // record that actually holds the proof (this is the pair that silently drifts when only one side
-  // is written — formalGateRecord would read `passed` from the other side).
-  const h2 = await makeCase('defect-rid')
-  await h2.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h2.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h2)
-  const proj2 = projRoot(h2)
-  await h2.call('vibe_math_lean_archive', { kind: 'proof', target: 'pDefect2', content: 'theorem p_defect2 : 2 + 2 = 4 := by decide\n' })
-  await h2.call('vibe_math_add_proposition', { id: 'pDefect2', 概述: '回执用验证 id 命名的缺陷', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs2 = await waitFor(() => { const x = verifiersOf(h2, 'r-pDefect2'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs2, 'verifiers were spawned for the reverse-direction case')
-  if (vs2) {
-    replyFrom(h2, vs2[0].childId, { Result: 0.3, Reason: '写宽了', formal: { target: 'r-pDefect2', decision: 'defect', note: 'Lean 版本没有假设 n≥1，比原文更宽' } })
-    const rec2 = await waitFor(() => { const r = (formalStateOf(h2).records || {}); return (r['r-pDefect2'] && r['r-pDefect2'].decision === 'defect') ? r : undefined }, 40, 150)
-    assert(!!rec2, '★ a defect named by the verification id is absorbed')
-    assert(!!rec2 && !!rec2['pDefect2'] && rec2['pDefect2'].status === 'attempted', '★ and the OBJECT record that held `passed` is downgraded as well')
-    assert(!!rec2 && rec2['pDefect2'].proof === '', 'its proof pointer is cleared too')
-    assert(!existsSync(join(proj2, 'Verified', 'Lean', 'pDefect2.lean')), '★ the archived proof is deleted even though the reply named the other id')
-    assert(/pDefect2/.test(readIf(join(proj2, 'Formal', 'TODO.md'))), 'the object is on the formalization TODO')
-  }
-}
-
-// ---------- 13. the gate must read BOTH id spaces ----------
-// v2 has two id spaces that name the same object: the verification id (rId, `r-pX`, `r-pX-s0`) that the
-// verification prompts and the gate use, and the OBJECT id (`pX`) that the agent reads in the target
-// block and normally archives under. `lean_archive` can only ADD a record for the id it was given, and
-// `syncVerificationTarget` merely UPDATES aliases that already exist — so "archived under the object id,
-// rId record does not exist yet" is a real first-time state. A gate that reads only its own side calls
-// that object un-formalized (a false negative), and because the deferral itself materialises the rId
-// record as `status:'none'`, the object can then NEVER conclude: every round re-defers and re-debates
-// (AUDIT-CHECKLIST §3: "成对关系只做一半").
-section('13 the require gate reads BOTH id spaces (archiving under the OBJECT id must not wedge)')
-{
-  const h = await makeCase('gate-objid')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pObjId', content: 'theorem p_objid : 2 + 2 = 4 := by decide\n' })
-  assert(proof.ok === true && proof.passed === true, 'precondition: the object is Lean-passed under its OBJECT id')
-  const rec0 = formalStateOf(h)
-  assert(!!rec0.records && !!rec0.records.pObjId && rec0.records.pObjId.status === 'passed', 'the passed record lives under the object id')
-  assert(!(rec0.records || {})['r-pObjId'], 'precondition: no rId record exists yet (this is the state that used to fool the gate)')
-  await h.call('vibe_math_add_proposition', { id: 'pObjId', 概述: '用对象 id 归档后必须能定论', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pObjId'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs, 'verifiers were spawned for the object-id case')
-  fireVerdicts(h, vs || [], 1)
-  await tick(600)
-  const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
-  const p = props.find((x) => x.id === 'pObjId') || {}
-  assert(p.布尔估计 === 1, "★ a Lean-passed object DOES conclude when the proof was archived under the object id (got " + p.布尔估计 + ')')
-  const cards = JSON.parse(readIf(join(proj, 'Verified', '数论_Verified.json')) || '[]')
-  assert(!!cards.find((c) => c.id === 'pObjId'), 'the Verified card was written')
-  const todo = readIf(join(proj, 'Formal', 'TODO.md'))
-  assert(!/pObjId/.test(todo), '★ the already-formalized object is NOT put on the formalization TODO')
-  const todo2 = await h.call('vibe_math_status', {})
-  assert(!(todo2.formal.todo || []).some((t) => String(t.id).indexOf('pObjId') !== -1), 'and the status TODO is empty for it too')
-}
-
-// ---------- 14. withdrawing a proof must reach EVERY archived copy ----------
-// Contract §4.1 requires the withdrawal, not a best-effort delete: after a `defect` the archived proof
-// must be gone from `Verified/Lean/` — the one place everyone looks for "the proof of this object".
-// Two independent ways that fails silently:
-//   (1) the proof was archived under a DIFFERENT id than the one the reply names (`Verified/Lean/<rId>.lean`
-//       while the reply names the object id) — scanning only the two named ids misses it, and the record's
-//       `proof` pointer is cleared anyway, so nothing ever points at the orphan again;
-//   (2) the host cannot delete at all (no subprocess service) — the delete fails and the stale proof stays.
-section('14 defect withdrawal covers every id alias AND a host that cannot delete')
-{
-  // (a) archived under the VERIFICATION id, defect named by the OBJECT id.
-  const h = await makeCase('defect-alias')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  const pr = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'r-pAlias', content: 'theorem p_alias : 2 + 2 = 4 := by decide\n' })
-  assert(pr.ok === true && pr.passed === true, 'precondition: the proof is archived under the VERIFICATION id')
-  const aliasProof = join(proj, 'Verified', 'Lean', 'r-pAlias.lean')
-  assert(existsSync(aliasProof), 'the archived proof sits at Verified/Lean/<rId>.lean')
-  await h.call('vibe_math_add_proposition', { id: 'pAlias', 概述: '归档写在验证 id 上', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pAlias'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs, 'verifiers were spawned for the alias case')
-  if (vs) {
-    replyFrom(h, vs[0].childId, { Result: 0.3, Reason: '写宽了（弃权）', formal: { target: 'pAlias', decision: 'defect', note: '原文还有 n≥1 的假设' } })
-    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pAlias'] && r['pAlias'].decision === 'defect') ? r : undefined }, 40, 150)
-    assert(!!rec, '★ the defect named by the object id is absorbed')
-    assert(!existsSync(aliasProof), '★★ the proof archived under the VERIFICATION id is withdrawn too (every id alias, not just the two named ones)')
-    assert(!!rec && (!rec['r-pAlias'] || rec['r-pAlias'].proof === ''), 'the rId record no longer points at a proof')
-    assert(!rec['r-pAlias'] || !rec['r-pAlias'].objectId || rec['r-pAlias'].objectId === 'pAlias', '★★ the rId record owner stamp is the OBJECT id (pAlias), never an r-shaped poisoned anchor (got ' + JSON.stringify(rec['r-pAlias'] && rec['r-pAlias'].objectId) + ')')
-  }
-
-  // (b) a host whose deletion cannot work: the archived path must not keep reading as the proof.
-  const h2 = await makeCase('defect-nosub', { noSubprocess: true })
-  await h2.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  const proj2 = projRoot(h2)
-  mkdirSync(join(proj2, 'Verified', 'Lean'), { recursive: true })
-  mkdirSync(join(proj2, 'Formal'), { recursive: true })
-  const WORK = 'theorem p_stale : 2 + 2 = 4 := by decide\n'
-  writeFileSync(join(proj2, 'Formal', 'pStale.lean'), WORK, 'utf8')
-  writeFileSync(join(proj2, 'Verified', 'Lean', 'pStale.lean'), WORK, 'utf8')
-  // The record is written directly (this host has no subprocess, so the LEAN tools cannot run at all):
-  // what is under test is the WITHDRAWAL path, not the archiving path.
-  writeFileSync(join(proj2, 'VibeMath_State', 'formal.json'), JSON.stringify({ records: { pStale: { status: 'passed', file: 'Formal/pStale.lean', proof: 'Verified/Lean/pStale.lean', decision: 'used', updatedAt: 1 } }, todo: [] }), 'utf8')
-  await h2.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await h2.call('vibe_math_add_proposition', { id: 'pStale', 概述: '宿主删不掉归档证明时的撤回', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  await startScheduler(h2)
-  const st0 = await h2.call('vibe_math_status', {})
-  assert(st0.formal.objects.some((o) => o.target === 'pStale' && o.status === 'passed'), 'precondition: the passed record with an archived proof survives resume on the no-subprocess host')
-  const vs2 = await waitFor(() => { const x = verifiersOf(h2, 'r-pStale'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs2, 'verifiers were spawned on the no-subprocess host')
-  if (vs2) {
-    replyFrom(h2, vs2[0].childId, { Result: 0.3, Reason: '不忠实（弃权）', formal: { target: 'pStale', decision: 'defect', note: 'Lean 少了 n≥1' } })
-    const rec2 = await waitFor(() => { const r = (formalStateOf(h2).records || {}); return (r['pStale'] && r['pStale'].decision === 'defect') ? r : undefined }, 40, 150)
-    assert(!!rec2, '★ the defect is absorbed even though this host cannot run a delete')
-    assert(!!rec2 && rec2['pStale'].status === 'attempted' && rec2['pStale'].proof === '', 'the record is downgraded and its proof pointer cleared')
-    const stalePath = join(proj2, 'Verified', 'Lean', 'pStale.lean')
-    assert(existsSync(stalePath), 'the archived file could NOT be deleted here (no subprocess) — so the fallback has to handle it')
-    const body = readIf(stalePath)
-    assert(!/theorem p_stale/.test(body), '★★ the original proof text is GONE from the archived path (it can no longer be read as the proof)')
-    assert(/已撤回/.test(body), '★★ …and that path carries an explicit withdrawal notice instead')
-    assert(/Formal\/pStale\.lean/.test(body), 'the notice points at the working file that is kept')
-    const acts = (await h2.call('vibe_math_status', {})).recentActivity.map((a) => a.detail).join('\n')
-    assert(/覆写/.test(acts), '★ the announcement says WHAT actually happened (overwritten, not deleted)')
-    assert(/撤回「已通过」状态/.test(acts), 'the announcement still says the passed status was withdrawn')
-  }
-}
-
-// ---------- 15. the「判断命题」transfer is a verdict on the SOURCE proposition ----------
-// When a solver's solution for a "判断下述命题是否成立：X" problem is verified, the result is TRANSFERRED
-// onto the source proposition: `布尔估计 = v`, `已验证 = true`, a probability-1 proof/refutation entry,
-// and `优先级 = 'never'` for a boolean v. That IS a boolean verdict on X, so require mode must gate it —
-// otherwise a proposition nobody formalized is silently concluded (and permanently de-scheduled).
-// (c) an OBJECT ID that itself ends in `-sN` / `-pfN` / `-rfN` — exactly the shapes the rId suffix
-// parser strips. `formalObjectIdOf` used to strip such a suffix unconditionally, so the verification id
-// `r-pAmb-s1` resolved to object `pAmb`: a DIFFERENT object. A defect about the former would then
-// downgrade the latter and even retract ITS archived proof, while the real owner stayed `passed`.
-// The verification task knows its owner (r.pId / r.qid), so that is the authoritative source.
-{
-  const h = await makeCase('defect-ambig')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  const innocent = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pAmb', content: 'theorem p_amb : 2 + 2 = 4 := by decide\n' })
-  assert(innocent.ok === true && innocent.passed === true, 'ambiguity: the neighbour pAmb has its own passing proof')
-  const innocentProof = join(proj, 'Verified', 'Lean', 'pAmb.lean')
-  const prone = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pAmb-s1', content: 'theorem p_amb_s1 : 3 + 3 = 6 := by decide\n' })
-  assert(prone.ok === true && prone.passed === true, 'ambiguity: pAmb-s1 (id ending in -s1) has its own passing proof')
-  const proneProof = join(proj, 'Verified', 'Lean', 'pAmb-s1.lean')
-  assert(existsSync(innocentProof) && existsSync(proneProof), 'ambiguity: both archived proofs exist')
-  await h.call('vibe_math_add_proposition', { id: 'pAmb', 概述: '同前缀的邻居对象', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  await h.call('vibe_math_add_proposition', { id: 'pAmb-s1', 概述: '对象 id 本身以 -s1 结尾', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pAmb-s1'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs, 'ambiguity: verifiers were spawned for r-pAmb-s1')
-  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pAmb-s1:0') || {}).prompt || ''
-  assert(/忠实性审查/.test(vp), 'ambiguity: the review subject is the Lean-passed object')
-  assert(/Verified\/Lean\/pAmb-s1\.lean/.test(vp), '★★ and the fidelity prompt points at pAmb-s1 OWN proof, not at a same-prefix neighbour (got ' + (vp.match(/Verified\/Lean\/[^\s）)]+/) || ['none'])[0] + ')')
-  if (vs) {
-    replyFrom(h, vs[0].childId, { Result: 0.3, Reason: '结论写窄了（弃权）', formal: { target: 'r-pAmb-s1', decision: 'defect', note: 'Lean 只证了 n>0 的情形' } })
-    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pAmb-s1'] && r['pAmb-s1'].decision === 'defect') ? r : undefined }, 40, 150)
-    assert(!!rec, '★★ a defect named by r-pAmb-s1 downgrades its REAL owner (pAmb-s1)')
-    assert(!existsSync(proneProof) || /已撤回/.test(readIf(proneProof)), '★★ and retracts pAmb-s1 own archived proof')
-    const recs = formalStateOf(h).records || {}
-    assert(!!recs['pAmb'] && recs['pAmb'].status === 'passed', '★★ the same-prefix NEIGHBOUR pAmb keeps its passed status (got ' + (recs['pAmb'] ? recs['pAmb'].status : 'no record') + ')')
-    assert(existsSync(innocentProof) && !/已撤回/.test(readIf(innocentProof)), '★★ and its archived proof file is untouched — a defect must never retract another object\'s proof')
-    assert(/pAmb-s1/.test(readIf(join(proj, 'Formal', 'TODO.md')) || ''), 'the TODO names the real owner')
-    // The record carries the authoritative owner, so the mapping survives a resume even when the
-    // in-memory verification task is gone (the fallback string parse would pick the neighbour again).
-    assert(!!recs['r-pAmb-s1'] && recs['r-pAmb-s1'].objectId === 'pAmb-s1',
-      '★★ the verification record remembers its object id (authoritative, not re-parsed from the name) — got ' + JSON.stringify(recs['r-pAmb-s1'] && recs['r-pAmb-s1'].objectId))
-    assert(!!recs['pAmb'] && !recs['pAmb'].objectId, 'the neighbour record carries no bogus owner stamp')
-  }
-}
-
-// (d) THE RECORD-OWNER FALLBACK must not be hijacked by a hand-edited state file. The state file is
-// user-editable, and a record whose `objectId` is itself r-shaped is not a usable owner: it would make
-// the verification id map to ITSELF, so a defect named by that rId would never reach the object side.
-// This case uses a WORK-ROUND (explorer) reply, which also carries `formal` and runs with NO verification
-// task in memory — i.e. it is the path that actually reads the owner from the record (a verifier reply
-// would take the task-registry path instead, which is authoritative and already covered above).
-{
-  const h = await makeCase('anchor-poison', { noSubprocess: true })
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  const proj = projRoot(h)
-  mkdirSync(join(proj, 'Verified', 'Lean'), { recursive: true })
-  mkdirSync(join(proj, 'Formal'), { recursive: true })
-  const WORK = 'theorem p_x : 2 + 2 = 4 := by decide\n'
-  writeFileSync(join(proj, 'Formal', 'pX.lean'), WORK, 'utf8')
-  writeFileSync(join(proj, 'Verified', 'Lean', 'pX.lean'), WORK, 'utf8')
-  const base = { status: 'passed', file: 'Formal/pX.lean', proof: 'Verified/Lean/pX.lean', decision: 'used', updatedAt: 1 }
-  writeFileSync(join(proj, 'VibeMath_State', 'formal.json'), JSON.stringify({ records: {
-    pX: Object.assign({}, base),
-    'r-pX': Object.assign({}, base, { objectId: 'r-pX' }),   // ← the r-shaped anchor a hand edit could leave
-  }, todo: [] }), 'utf8')
-  await h.call('vibe_math_add_problem', { id: 'qA', description: '锚点污染用例', priority: 1 })
-  await startScheduler(h)
-  await tick(2000)
-  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:qA')), 60, 200)
-  assert(!!ex, 'anchor-poison: the explorer was spawned (the scheduler is running)')
-  if (ex) {
-    const reply = { directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.6 }], formal: { target: 'r-pX', decision: 'defect', note: 'Lean 少了 n≥1' } }
-    h.fireEnd({ id: ex.childId, runId: 'rp', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n' + JSON.stringify(reply) + '\n```' }] })
-    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pX'] && r['pX'].decision === 'defect') ? r : undefined }, 40, 150)
-    assert(!!rec, '★★ a work-round defect named by an rId still reaches the OBJECT side when the record carries an r-shaped anchor (the anchor is rejected, not trusted)')
-    const all = formalStateOf(h).records || {}
-    assert(!!all['r-pX'] && all['r-pX'].status === 'attempted', '★★ and the rId record is downgraded as well (both id spaces stay in step)')
-  }
-}
-
-section('15 the require gate also covers the judge-problem transfer')
-{
-  const h = await makeCase('judge-gate')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  const proj = projRoot(h)
-  await h.call('vibe_math_add_proposition', { id: 'pJudgeSrc', 概述: '被判断的源命题（未形式化）', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  await h.call('vibe_math_add_problem', { id: 'qJudge', description: '判断下述命题是否成立：pJudgeSrc', priority: 1 })
-  const qsFile = join(proj, 'qs', 'qs.json')
-  const qs0 = JSON.parse(readIf(qsFile) || '[]')
-  const qj = qs0.find((q) => q.id === 'qJudge')
-  qj.判断命题 = 'pJudgeSrc'
-  // A solver-produced solution carries no 来源列表 — that is exactly the branch that transfers to the source.
-  qj.解法列表 = [{ 完整解法: '该命题不成立的论证', 正确概率: 0.8, 已验: false }]
-  writeFileSync(qsFile, JSON.stringify(qs0, null, 2), 'utf8')
-  await startScheduler(h)
-  const sp = await waitFor(() => { const x = verifiersOf(h, 'r-qJudge-s0'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!sp, 'verifiers were spawned for the judge problem solution')
-  fireVerdicts(h, sp || [], 0)
-  await tick(600)
-  const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
-  const ap = props.find((x) => x.id === 'pJudgeSrc') || {}
-  assert(ap.布尔估计 === 0.5, "★★ the source proposition's 布尔估计 is UNCHANGED (require mode must not conclude 假 through the transfer; got " + ap.布尔估计 + ')')
-  assert(!(ap.证伪列表 || []).some((x) => x.正确概率 === 1), 'no probability-1 refutation was written onto the source proposition')
-  assert(ap.优先级 !== 'never', 'the source proposition was not pinned to never')
-  assert(ap.已验证 !== true, '★ it stays re-verifiable (the ungated path also marked it 已验证, removing it from every future candidate set)')
-  assert(/pJudgeSrc/.test(readIf(join(proj, 'Formal', 'TODO.md'))), '★ the deferred source proposition is on the formalization TODO')
-  assert(!existsSync(join(proj, 'Verified', '数论_Verified.json')), 'no Verified card for the source proposition')
-}
-
-// ---------- 16. the prompt corpus (contract §10.10) ----------
-// A HUMAN must be able to re-read every prompt the framework emitted, not just the assertions
-// about them. Paths are normalised so the dump is deterministic, diffable and machine-free.
-section("15b a \`used\` reply must NOT downgrade an already-passed object")
-{
-  // Contract §4: a fidelity defect WITHDRAWS a proof; a plain `used` judgement merely says "this round
-  // touched the formalization". Letting `used` downgrade an established proof would silently remove the
-  // fidelity branch from every later review prompt and re-close the require gate — the exact class that
-  // was already fixed once for v4's formalSetRun. v3/v4/v5 preserve passed/blocked here; v2 did not.
-  const h = await makeCase('used-keep')
-  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
-  await startScheduler(h)
-  const proj = projRoot(h)
-  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pUsedKeep', content: 'theorem p_used_keep : 2 + 2 = 4 := by decide\n' })
-  assert(proof.ok === true && proof.passed === true, 'used-keep: the object starts Lean-passed')
-  const proofFile = join(proj, 'Verified', 'Lean', 'pUsedKeep.lean')
-  assert(existsSync(proofFile), 'used-keep: the archived proof exists before the used reply')
-  await h.call('vibe_math_add_proposition', { id: 'pUsedKeep', 概述: '已有通过证明后再写一次 used 回执', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pUsedKeep'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!vs, 'used-keep: verifiers were spawned for the Lean-passed object')
-  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pUsedKeep:0') || {}).prompt || ''
-  assert(/忠实性审查/.test(vp), 'used-keep: the reviewers were told to audit FIDELITY (the Lean code is the subject)')
-  if (vs) {
-    replyFrom(h, vs[0].childId, { Result: 0.5, Reason: '这一轮只是又写了一遍草稿', formal: { target: 'pUsedKeep', decision: 'used', file: 'Formal/pUsedKeep.lean' } })
-    // The reply is what materialises the canonical verification alias r-<objectId>, so waiting for
-    // THAT is a signal only the reply can produce (the archive already wrote decision:'used').
-    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['r-pUsedKeep'] && r['pUsedKeep']) ? r : undefined }, 40, 150)
-    assert(!!rec, 'used-keep: the `used` reply is absorbed (the canonical verification alias was materialised)')
-    assert(!!rec && rec['pUsedKeep'].status === 'passed', '★★ a `used` reply does NOT downgrade an already-passed object (got ' + (rec && rec['pUsedKeep'] ? rec['pUsedKeep'].status : 'no record') + ')')
-    assert(!!rec && rec['pUsedKeep'].proof === 'Verified/Lean/pUsedKeep.lean', '★★ and its proof pointer survives the reply')
-    assert(!!rec && !!rec['r-pUsedKeep'] && rec['r-pUsedKeep'].status === 'passed', '★★ the verification-id alias keeps passed too (both id spaces)')
-    assert(existsSync(proofFile), '★★ the archived proof is still on disk')
-    const st = await h.call('vibe_math_status', {})
-    const obj = (st.formal.objects || []).find((o) => o.target === 'pUsedKeep')
-    assert(!!obj && obj.status === 'passed', '★★ status still reports the object as Lean-passed (v2 exposes status.formal.objects, not a "passed" array)')
-    // The consequence that actually matters: with 'passed' preserved the require gate stays OPEN, so
-    // driving the round to a unanimous "true" still concludes (a wrongly downgraded object is deferred).
-    const settled = await verifyWithDebate(h, 'r-pUsedKeep', 1, 0)
-    assert(!!settled.first, 'used-keep: the round can still be driven to a verdict')
-    assert(!/pUsedKeep/.test(readIf(join(proj, 'Formal', 'TODO.md')) || ''), '★★ no formal-required TODO was created: the surviving passed status still opens the require gate')
-    // The same rule covers the RUN path (docs §4): a run attributed to the object may not downgrade it.
-    const rerun = await h.call('vibe_math_lean_run', { file: 'Formal/pUsedKeep.lean', target: 'pUsedKeep' })
-    assert(rerun.ok === true, 'used-keep: the object work file runs green (the record assertion below is the point)')
-    const obj2 = ((await h.call('vibe_math_status', {})).formal.objects || []).find((o) => o.target === 'pUsedKeep')
-    assert(!!obj2 && obj2.status === 'passed', '★★ and the record is still passed (a scratch run may not withdraw a proof)')
-  }
-}
-
-// ---------- 15c. the framework's OWN feedback channels (push report + gate notice) ----------
-// Every corpus entry so far was a child prompt (spawn/wake). The framework also speaks to the main
-// agent/human on two other channels — the `reportMode=push` progress report and the activity log's
-// formal-gate notice — and neither had any reviewable artefact (AUDIT §2.4 "框架→人 的反馈与推送类
-// 提示"). Both are captured DETERMINISTICALLY (no wall-clock, no timing-dependent counts):
-//   · push   = the forced push of the strict-termination branch on an EMPTY project (fixed counters);
-//   · feedback = the FIRST formal-gate activity line of one controlled require-mode deferral.
-section('15c the framework push report and the gate notice are captured')
-{
-  const h = await makeCase('push-report')
-  await h.call('vibe_math_set_params', { reportMode: 'push', tickIntervalMs: 200 })
-  await h.call('vibe_math_start', {})
-  const pushed = await waitFor(() => (h.root.pushed && h.root.pushed.length > 0 ? h.root.pushed : undefined), 80, 100)
-  assert(!!pushed, 'push-report: the scheduler pushed a progress report to the main agent')
-  assert(!!pushed && /\[Vibe Math V2\] 进度更新/.test(pushed[0]), '★★ the push text is the real framework→main-agent prompt (reportMode=push)')
-  assert(!!pushed && /vibe_math_report/.test(pushed[0]), 'and it names the FULL tool the main agent must call')
-  await h.call('vibe_math_pause', {})
-
-  const g = await makeCase('gate-feedback')
-  await g.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
-  await g.call('vibe_math_add_proposition', { id: 'pFeed', 概述: '门禁反馈语料', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  await startScheduler(g)
-  const gvs = await waitFor(() => { const x = verifiersOf(g, 'r-pFeed'); return x.length >= 2 ? x : undefined }, 60, 250)
-  assert(!!gvs, 'gate-feedback: verifiers were spawned for the proposition')
-  if (gvs) for (let i = 0; i < gvs.length && i < 2; i++) replyFrom(g, gvs[i].childId, { Result: 1, Reason: '门禁反馈用例' })
-  let gline
-  for (let i = 0; i < 60 && !gline; i++) {
-    const acts = (await g.call('vibe_math_status', {})).recentActivity || []
-    const hit = acts.find((a) => /formal-gate/.test(String(a.event)))
-    if (hit) gline = String(hit.event) + ': ' + String(hit.detail)
-    else await sleep(150)
-  }
-  assert(!!gline && /require 模式搁置/.test(gline), '★★ the require-gate withholding reaches the human-readable channel (captured verbatim)')
-  assert(!!gline && /Formal\/TODO\.md/.test(gline), 'and the notice says where the withholding was recorded')
-  g.feedbackLine = gline || ''
-  await g.call('vibe_math_pause', {})
-}
-
-section('15d Lean 增量 + 异步（spec §1–§4 + 修订 §1–§5）：参数、argv、队列、去重、只读面、提示词')
-{
-  const H = MOD.__testHelpers
-  const slash = (s) => String(s == null ? '' : s).replace(/\\/g, '/')   // 插件内部用 '/'，测试用 path.join ⇒ 比较前统一
-  const SAME = (a, b) => slash(a) === slash(b)
-  // ── 参数：默认值 + 归一化（字符串 'false' 绝不能滑过去） ────────────────────────────
-  const a = await makeCase('lean-params')
-  const st0 = await a.call('vibe_math_status', {})
-  assert(st0.params.leanAsync === false, 'the suite pins leanAsync=false by default (sync-path guard)')
-  await a.call('vibe_math_set_params', { leanAsync: true })
-  assert((await a.call('vibe_math_status', {})).params.leanAsync === true, 'leanAsync=true is accepted (the async档)')
-  const bad = await a.call('vibe_math_set_params', { leanAsync: 'false' })
-  assert(bad.ok === true, 'set_params accepts a (badly typed) leanAsync')
-  assert((await a.call('vibe_math_status', {})).params.leanAsync === true, '★★★ leanAsync="false" (a STRING) does not slip through the `else out[k]=v` tail: it falls back to the boolean default (true) — a truthy string must never be read as a boolean')
-  const defs = (await a.call('vibe_math_status', {})).params
-  assert(defs.leanJobsMaxParallel === 1 && defs.leanInitiative === 'normal' && Array.isArray(defs.leanSearchPaths) && defs.leanSearchPaths.length === 0, 'the amendment defaults are leanJobsMaxParallel=1 / leanInitiative=normal / leanSearchPaths=[]')
-  await a.call('vibe_math_set_params', { leanInitiative: 'banana', leanJobsMaxParallel: 0, leanSearchPaths: 'not-an-array' })
-  const p1 = (await a.call('vibe_math_status', {})).params
-  assert(p1.leanInitiative === 'normal', 'leanInitiative rejects an unknown mode back to normal')
-  assert(p1.leanJobsMaxParallel === 1, 'leanJobsMaxParallel is floored at 1 (never 0/unbounded)')
-  assert(Array.isArray(p1.leanSearchPaths) && p1.leanSearchPaths.length === 0, 'leanSearchPaths rejects a non-array back to []')
-  await a.call('vibe_math_set_params', { leanSearchPaths: ['  /opt/lean-lib  ', '/opt/lean-lib', ''] })
-  assert(JSON.stringify((await a.call('vibe_math_status', {})).params.leanSearchPaths) === JSON.stringify(['/opt/lean-lib']), 'leanSearchPaths trims, drops empties and de-duplicates')
-  // 纯函数：搜索路径计划（修订 §2）
-  const planDefault = H.leanSearchPathPlan([], [], '/root/vm')
-  assert(JSON.stringify(planDefault.paths) === JSON.stringify(['/root/vm']) && planDefault.inject.length === 2, '★ default plan injects exactly the automatic VibeMath root')
-  const planExtra = H.leanSearchPathPlan(['env', 'lean'], ['/a', '/b'], '/root/vm')
-  assert(JSON.stringify(planExtra.paths) === JSON.stringify(['/a', '/b', '/root/vm']), '★★ user leanSearchPaths come FIRST, then the automatic root')
-  assert(JSON.stringify(planExtra.inject) === JSON.stringify(['--search-path', '/a', '--search-path', '/b', '--search-path', '/root/vm']), 'and each path is injected with its own --search-path flag')
-  assert(H.leanSearchPathPlan(['--search-path', '/x'], ['/a'], '/root/vm').inject.length === 0, '★ an explicit --search-path in leanArgs suppresses all injection (user wins)')
-  assert(H.leanSearchPathPlan(['-R', '/x'], ['/a'], '/root/vm').inject.length === 0 && H.leanSearchPathPlan(['--root', '/x'], ['/a'], '/root/vm').inject.length === 0, '★ -R / --root are honoured too')
-
-  // ── argv：注入位置在用户参数之后、文件名之前 ──────────────────────────────────────
-  const b = await makeCase('lean-argv')
-  await b.call('vibe_math_set_params', { leanAsync: false, leanArgs: ['env', 'lean'], leanCommand: 'lean' })
-  const projB = projRoot(b)
-  mkdirSync(join(projB, 'Formal'), { recursive: true })
-  writeFileSync(join(projB, 'Formal', 'srch.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
-  const runsBefore = leanRuns.length
-  await b.call('vibe_math_lean_run', { file: 'Formal/srch.lean' })
-  const argv1 = leanRuns[leanRuns.length - 1].argv
-  assert(leanRuns.length === runsBefore + 1, 'the sync run really reached the compiler')
-  assert(JSON.stringify(argv1.slice(0, 2)) === JSON.stringify(['lean', 'env']), 'the user leanArgs are preserved in order')
-  assert(argv1[argv1.length - 2] === '--search-path' && SAME(argv1[argv1.length - 1], vibeRoot(b)), '★★ --search-path + the VibeMath root are injected AFTER the user args and immediately BEFORE the file (argv=' + JSON.stringify(argv1) + ')')
-  await b.call('vibe_math_set_params', { leanArgs: ['env', 'lean', '--search-path', '/explicit'] })
-  await b.call('vibe_math_lean_run', { file: 'Formal/srch.lean' })
-  const argv2 = leanRuns[leanRuns.length - 1].argv
-  assert(argv2.indexOf('--search-path') === 3 && argv2[4] === '/explicit' && argv2.filter((x) => x === '--search-path').length === 1, '★ an explicit --search-path is respected verbatim (no second injection) — got ' + JSON.stringify(argv2))
-  await b.call('vibe_math_set_params', { leanArgs: ['env', 'lean'], leanSearchPaths: ['/extra1', '/extra2'] })
-  await b.call('vibe_math_lean_run', { file: 'Formal/srch.lean' })
-  const argv3 = leanRuns[leanRuns.length - 1].argv
-  assert(JSON.stringify(argv3.slice(-6)) === JSON.stringify(['--search-path', '/extra1', '--search-path', '/extra2', '--search-path', slash(vibeRoot(b))]), '★★ leanSearchPaths are injected first, then the automatic root (got ' + JSON.stringify(argv3.slice(-6)) + ')')
-
-  // ── 异步状态机：入队立即返回 → 心跳排空 → 只有 settled(ok) 才是通过 ────────────────
-  const c = await makeCase('lean-async')
-  await c.call('vibe_math_set_params', { leanAsync: true, tickIntervalMs: 200 })
-  const projC = projRoot(c)
-  mkdirSync(join(projC, 'Formal'), { recursive: true })
-  writeFileSync(join(projC, 'Formal', 'async-good.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
-  writeFileSync(join(projC, 'Formal', 'async-bad.lean'), 'theorem t : 1 = 2 := by sorry\n', 'utf8')
-  const nBefore = leanRuns.length
-  const q1 = await c.call('vibe_math_lean_run', { file: 'Formal/async-good.lean', target: 'pAsync' })
-  assert(q1.ok === true && !!q1.async && q1.async.state === 'queued' && typeof q1.async.jobId === 'string' && q1.async.jobId.length > 3, '★★ leanAsync=true returns IMMEDIATELY with {async:{jobId,state:queued}} (got ' + JSON.stringify(q1.async) + ')')
-  assert(leanRuns.length === nBefore, '★★ the tool call itself did NOT block on the compiler (it is enqueued, not run)')
-  assert(q1.async.jobId.indexOf('pAsync-') === 0, 'the jobId is <target>-<fingerprint[0:12]> (got ' + q1.async.jobId + ')')
-  const jobFile = join(projC, 'Formal', 'Jobs', q1.async.jobId + '.json')
-  assert(existsSync(jobFile), 'the job record is mirrored to <project>/Formal/Jobs/<jobId>.json')
-  const rec0 = JSON.parse(readIf(jobFile))
-  assert(rec0.state === 'queued' && typeof rec0.sha256 === 'string' && typeof rec0.buildSha256 === 'string' && rec0.buildContext.length > 0, '★ the job record carries state + content hash + build-context hash')
-  assert((formalStateOf(c).records || {}).pAsync === undefined || formalStateOf(c).records.pAsync.status !== 'passed', '★★ a queued job never marks the object passed')
-  const done1 = await waitFor(() => { const r = JSON.parse(readIf(jobFile) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
-  assert(!!done1, 'the apply-level heartbeat drained the queue and settled the job (got ' + JSON.parse(readIf(jobFile) || '{}').state + ')')
-  assert(done1 && done1.exitCode === 0, 'the settled record keeps exitCode 0')
-  const recAfter = formalStateOf(c).records.pAsync
-  assert(!!recAfter && recAfter.status === 'attempted' && recAfter.run && recAfter.run.ok === true, 'a green RUN record lands as attempted (stored, not promoted) with run.ok=true')
-  assert(!!recAfter.async && recAfter.async.state === 'settled' && recAfter.async.jobId === q1.async.jobId, 'the object record carries the async job pointer/state')
-  // 红色作业：attempted + 编译器输出入库，绝不 passed
-  const q2 = await c.call('vibe_math_lean_run', { file: 'Formal/async-bad.lean', target: 'pAsyncBad' })
-  const done2 = await waitFor(() => { const r = JSON.parse(readIf(join(projC, 'Formal', 'Jobs', q2.async.jobId + '.json')) || '{}'); return r.state === 'failed' ? r : undefined }, 80, 60)
-  assert(!!done2 && done2.exitCode === 1, '★ a red async run settles as failed with exitCode 1')
-  const recBad = formalStateOf(c).records.pAsyncBad
-  assert(!!recBad && recBad.status === 'attempted' && recBad.run.ok === false, '★ a red async run is recorded as attempted (never passed)')
-  assert(/sorry/.test(String(recBad.run.stderrTail || '')), 'and the compiler output is kept in the record for the member to fix')
-  // ── 归档证明（异步）：落地前不是 passed；落地 ok 才写 Verified/Lean/ ────────────────
-  await c.call('vibe_math_add_proposition', { id: 'pAsymProof', 概述: '异步归档证明', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
-  mkdirSync(join(projC, 'Formal'), { recursive: true })
-  const q3 = await c.call('vibe_math_lean_archive', { kind: 'proof', target: 'pAsymProof', content: 'theorem pAsymProof : 1 = 1 := rfl\n' })
-  assert(q3.ok === true && q3.async && q3.async.state === 'queued' && q3.status === 'attempted', '★★ kind=proof in async档 returns queued + attempted (NOT passed)')
-  assert(!existsSync(join(projC, 'Verified', 'Lean', 'pAsymProof.lean')), '★★ the archived proof file does NOT exist while the job is still queued')
-  assert((formalStateOf(c).records.pAsymProof || {}).status !== 'passed', 'and the record is not passed yet')
-  const done3 = await waitFor(() => { const r = JSON.parse(readIf(join(projC, 'Formal', 'Jobs', q3.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
-  assert(!!done3, 'the proof job settled green')
-  assert(existsSync(join(projC, 'Verified', 'Lean', 'pAsymProof.lean')), '★★ only after settled(ok) is Verified/Lean/<id>.lean written')
-  assert((formalStateOf(c).records.pAsymProof || {}).status === 'passed', '★★ and only then does the object become passed')
-  assert(/pAsymProof/.test(readIf(join(projC, 'Formal', 'Index.md'))), 'the index reflects the passed object')
-  // ── lean_job（修订 §3）：清单 / 单查 / waitMs ─────────────────────────────────────
-  const listJobs = await c.call('vibe_math_lean_job', {})
-  assert(listJobs.ok === true && Array.isArray(listJobs.jobs) && listJobs.jobs.length >= 3, '★ lean_job without jobId returns the session job list')
-  assert(listJobs.jobs.every((j) => !!j.paths && typeof j.paths.receipt === 'string'), 'every listed job carries its receipt path')
-  const one = await c.call('vibe_math_lean_job', { jobId: q3.async.jobId })
-  assert(one.ok === true && one.state === 'settled' && one.passed === true && one.paths.archive === 'Verified/Lean/pAsymProof.lean', '★ lean_job {jobId} returns state/exitCode/paths and the passed verdict')
-  assert((await c.call('vibe_math_lean_job', { jobId: 'nope-000000000000' })).code === 'V2_NOT_FOUND', 'an unknown jobId is refused with a typed code')
-  const q4 = await c.call('vibe_math_lean_run', { file: 'Formal/async-bad.lean', target: 'pAsyncBad' })
-  const waited = await c.call('vibe_math_lean_job', { jobId: q4.async.jobId, waitMs: 4000 })
-  assert(waited.ok === true && waited.state !== 'queued' && waited.stillRunning === false && waited.waitedMs > 0, '★★ lean_job waitMs>0 waits for the job to leave queued/running (got ' + waited.state + ')')
-  // ── 超时：leanTimeoutMs 是每个作业的预算，主动 terminate，绝不 passed ─────────────
-  const d = await makeCase('lean-timeout')
-  await d.call('vibe_math_set_params', { leanAsync: true, leanTimeoutMs: 1000 })
-  const projD = projRoot(d)
-  mkdirSync(join(projD, 'Formal'), { recursive: true })
-  writeFileSync(join(projD, 'Formal', 'hang.lean'), '-- HANG\ntheorem t : 1 = 1 := rfl\n', 'utf8')
-  const termBefore = terminations.length
-  const q5 = await d.call('vibe_math_lean_run', { file: 'Formal/hang.lean', target: 'pHang' })
-  const done5 = await waitFor(() => { const r = JSON.parse(readIf(join(projD, 'Formal', 'Jobs', q5.async.jobId + '.json')) || '{}'); return r.state === 'timeout' ? r : undefined }, 120, 60)
-  assert(!!done5 && done5.timedOut === true, '★★ a hanging job times out (state=timeout, timedOut=true) with leanTimeoutMs as its budget')
-  assert(terminations.length > termBefore, '★★ the timeout ACTIVELY called handle.terminate()')
-  assert((formalStateOf(d).records.pHang || {}).status !== 'passed', '★ a timed-out job never sets passed')
-  // ── 并发参数（修订 §5）：leanJobsMaxParallel>1 时两个作业同时进入 running ──────────
-  const e = await makeCase('lean-parallel')
-  await e.call('vibe_math_set_params', { leanAsync: true, leanJobsMaxParallel: 2 })
-  const projE = projRoot(e)
-  mkdirSync(join(projE, 'Formal'), { recursive: true })
-  writeFileSync(join(projE, 'Formal', 'h1.lean'), '-- HANG\ntheorem h1 : 1 = 1 := rfl\n', 'utf8')
-  writeFileSync(join(projE, 'Formal', 'h2.lean'), '-- HANG\ntheorem h2 : 1 = 1 := rfl\n', 'utf8')
-  await e.call('vibe_math_set_params', { leanTimeoutMs: 3000 })
-  const j1 = await e.call('vibe_math_lean_run', { file: 'Formal/h1.lean', target: 'pH1' })
-  const j2 = await e.call('vibe_math_lean_run', { file: 'Formal/h2.lean', target: 'pH2' })
-  // Both are HANG jobs: with concurrency 2 they must be in `running` AT THE SAME TIME. A serial
-  // queue can never reach that state, so the probe discriminates the `leanJobsMaxParallel` parameter.
-  const both = await waitFor(() => {
-    const a = JSON.parse(readIf(join(projE, 'Formal', 'Jobs', j1.async.jobId + '.json')) || '{}')
-    const b = JSON.parse(readIf(join(projE, 'Formal', 'Jobs', j2.async.jobId + '.json')) || '{}')
-    return (a.state === 'running' && b.state === 'running') ? { a: a, b: b } : undefined
-  }, 120, 50)
-  assert(!!both, '★★ with leanJobsMaxParallel=2 BOTH queued jobs are in running at the same time (concurrency is a parameter, not a constant)')
-  for (const k of [j1, j2]) { try { await e.call('vibe_math_lean_job', { jobId: k.async.jobId, waitMs: 3500 }) } catch (err) { /* ignore */ } }
-  // ── 卸载（spec §2.5 / §7-6）：terminate + interrupted，绝不 passed、绝不留孤儿 ────────
-  const dz = await makeCase('lean-dispose')
-  await dz.call('vibe_math_set_params', { leanAsync: true, leanTimeoutMs: 60000 })
-  const projZ = projRoot(dz)
-  mkdirSync(join(projZ, 'Formal'), { recursive: true })
-  writeFileSync(join(projZ, 'Formal', 'orphan.lean'), '-- HANG\ntheorem orphan : 1 = 1 := rfl\n', 'utf8')
-  const termZ = terminations.length
-  const qz = await dz.call('vibe_math_lean_run', { file: 'Formal/orphan.lean', target: 'pOrphan' })
-  const startedZ = await waitFor(() => { const r = JSON.parse(readIf(join(projZ, 'Formal', 'Jobs', qz.async.jobId + '.json')) || '{}'); return r.state === 'running' ? r : undefined }, 80, 60)
-  assert(!!startedZ, 'the dispose case got a job into running')
-  dz.unmount()   // ctx.effect disposer ⇒ disposeLeanJobs()
-  assert(terminations.length > termZ, '★★ unmounting the plugin terminated the in-flight compile (no orphan process)')
-  assert((formalStateOf(dz).records.pOrphan || {}).status !== 'passed', '★ dispose never marks the object passed')
-  const afterZ = JSON.parse(readIf(join(projZ, 'Formal', 'Jobs', qz.async.jobId + '.json')) || '{}')
-  assert(afterZ.interrupted === true || afterZ.state === 'interrupted' || afterZ.state === 'running', '★ the disposed job is recorded as interrupted (or left running for the next recovery to mark)')
-  // ── 去重（§4.3）：同内容 + 同构建上下文 ⇒ 第二次不再编译 ──────────────────────────
-  const f = await makeCase('lean-dedupe')
-  await f.call('vibe_math_set_params', { leanAsync: true })
-  const defBody = 'def reusableOne : Nat := 1\n'
-  const r1 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: defBody })
-  assert(r1.ok === true && r1.async && r1.deduped === false, 'the first archive of a definition is enqueued (not deduped)')
-  await waitFor(() => { const r = JSON.parse(readIf(join(projRoot(f), 'Formal', 'Jobs', r1.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
-  const runsAfter1 = leanRuns.length
-  const r2 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: defBody })
-  assert(r2.ok === true && r2.deduped === true && r2.async === undefined, '★★★ re-archiving identical content is DEDUPED (no job, no recompile) — got ' + JSON.stringify({ deduped: r2.deduped, async: r2.async }))
-  assert(leanRuns.length === runsAfter1, '★★ the deduped archive did NOT recompile')
-  // 构建上下文进指纹（修订 §4）：同内容、不同 leanArgs ⇒ 不同 jobId / 不命中"已验证"
-  await f.call('vibe_math_set_params', { leanArgs: ['--threads=2'] })
-  const r5 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: defBody })
-  assert(r5.ok === true && r5.deduped === false && !!r5.async && !!r1.async && r5.async.jobId !== r1.async.jobId, '★★★ the SAME content under a DIFFERENT build context (leanArgs) gets a different jobId — it is not treated as already-verified (got ' + JSON.stringify({ deduped: r5.deduped, async: r5.async }) + ')')
-  if (r5.async) await waitFor(() => { const r = JSON.parse(readIf(join(projRoot(f), 'Formal', 'Jobs', r5.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
-  await f.call('vibe_math_set_params', { leanArgs: [] })
-  const changed = defBody + '\n-- 内容变了\n'
-  const r3 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: changed })
-  assert(r3.ok === true && r3.deduped === false && !!r3.async, 'a changed body is NOT deduped (content hash differs)')
-  if (r3.async) await waitFor(() => { const r = JSON.parse(readIf(join(projRoot(f), 'Formal', 'Jobs', r3.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
-  const r6 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: changed })
-  assert(r6.ok === true && r6.deduped === true, 'and the changed body dedupes on its own (content-based, not "first wins")')
-  // ── 崩溃恢复（§2.6 + 修订 §4）：绝不置 passed ─────────────────────────────────────
-  const g = await makeCase('lean-recover')
-  await g.call('vibe_math_set_params', { leanAsync: true })
-  const projG = projRoot(g)
-  mkdirSync(join(projG, 'Formal', 'Jobs'), { recursive: true })
-  const goodBody = 'theorem recGood : 1 = 1 := rfl\n'
-  writeFileSync(join(projG, 'Formal', 'recGood.lean'), goodBody, 'utf8')
-  const ctxG = H.leanBuildContext('lean', [], [slash(vibeRoot(g))])
-  const fpG = H.leanJobFingerprint(goodBody, ctxG)
-  const jobIdG = H.leanJobId('pRecGood', fpG)
-  writeFileSync(join(projG, 'Formal', 'Jobs', jobIdG + '.json'), JSON.stringify({
-    jobId: jobIdG, kind: 'archive', state: 'running', attempts: 1, target: 'pRecGood', name: 'pRecGood',
-    rel: 'Formal/recGood.lean', scope: 'project', sha256: H.leanContentSha(goodBody), buildSha256: fpG, buildContext: ctxG,
-    engine: 'lean', argv: [], searchPaths: [slash(vibeRoot(g))], archiveKind: 'proof', enqueuedAt: 1, startedAt: 2, settledAt: 0, exitCode: null,
-  }), 'utf8')
-  // 哈希不匹配的遗留作业：只标记，绝不重驱、绝不 passed
-  const otherJob = H.leanJobId('pRecOther', H.leanJobFingerprint('theorem other : 1 = 1 := rfl\n', ctxG))
-  writeFileSync(join(projG, 'Formal', 'Jobs', otherJob + '.json'), JSON.stringify({
-    jobId: otherJob, kind: 'archive', state: 'running', attempts: 3, target: 'pRecOther', name: 'pRecOther',
-    rel: 'Formal/recMissing.lean', scope: 'project', sha256: H.leanContentSha('theorem other : 1 = 1 := rfl\n'), buildSha256: 'ffffffffffff', buildContext: ctxG,
-    engine: 'lean', argv: [], searchPaths: [slash(vibeRoot(g))], archiveKind: 'proof', enqueuedAt: 1, startedAt: 2, settledAt: 0, exitCode: null,
-  }), 'utf8')
-  await g.call('vibe_math_new_project', { name: 'proj' })   // 触发 setProject ⇒ recoverLeanJobs()
-  const recG = formalStateOf(g).records.pRecGood || {}
-  assert(recG.status === 'attempted', '★★ recovery marks a crashed running job as attempted (never passed)')
-  const recOther = formalStateOf(g).records.pRecOther || {}
-  assert(recOther.status === 'attempted', 'recovery marks the hash-mismatched job object as attempted too')
-  assert(!existsSync(join(projG, 'Verified', 'Lean', 'pRecGood.lean')), '★ recovery never writes an archived proof for a crashed job')
-  const recJobG = JSON.parse(readIf(join(projG, 'Formal', 'Jobs', jobIdG + '.json')) || '{}')
-  assert(Number(recJobG.attempts) === 2 && ['queued', 'running', 'settled'].indexOf(recJobG.state) !== -1, '★★ the matching-hash job was re-enqueued with attempts+1 (got ' + JSON.stringify({ state: recJobG.state, attempts: recJobG.attempts }) + ')')
-  const otherAfter = JSON.parse(readIf(join(projG, 'Formal', 'Jobs', otherJob + '.json')) || '{}')
-  assert(otherAfter.state === 'interrupted' && Number(otherAfter.attempts) === 3, '★★ the mismatched job is only marked interrupted (NOT re-driven, attempts unchanged)')
-  const recDone = await waitFor(() => { const r = JSON.parse(readIf(join(projG, 'Formal', 'Jobs', jobIdG + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
-  assert(!!recDone, 'the re-enqueued job then settles normally on the heartbeat (the queue really resumed)')
-  // ── lean_read（§1.2）：只读、路径守卫、64KB 截断 ─────────────────────────────────
-  mkdirSync(join(vibeRoot(g), 'Formal', 'Lib'), { recursive: true })
-  writeFileSync(join(vibeRoot(g), 'Formal', 'Lib', 'recGood.lean'), goodBody, 'utf8')
-  const rd = await g.call('vibe_math_lean_read', { name: 'recGood' })
-  assert(rd.ok === true && rd.kind === 'lib' && rd.sha256 === H.leanContentSha(goodBody) && rd.truncated === false && rd.text === goodBody, '★ lean_read returns the archived text + sha256 + bytes for a Lib file (got ' + JSON.stringify(rd).slice(0, 200) + ')')
-  assert(typeof rd.bytes === 'number' && rd.bytes === Buffer.byteLength(goodBody, 'utf8'), 'lean_read reports the byte length')
-  assert((await g.call('vibe_math_lean_read', { name: 'recGood', kind: 'proved' })).code === 'V2_NOT_FOUND', 'kind=proved looks only in Formal/Proved')
-  for (const badName of ['../etc/passwd', 'a/b', 'C:\\x\\y', '..']) {
-    const rbad = await g.call('vibe_math_lean_read', { name: badName })
-    assert(rbad.ok === false && rbad.code === 'V2_INVALID_ARGUMENT', '★ lean_read rejects the path-escape attempt ' + JSON.stringify(badName))
-  }
-  const bigName = 'bigOne'
-  mkdirSync(join(vibeRoot(g), 'Formal', 'Lib'), { recursive: true })
-  writeFileSync(join(vibeRoot(g), 'Formal', 'Lib', bigName + '.lean'), '-- ' + 'x'.repeat(70 * 1024) + '\n', 'utf8')
-  const rbig = await g.call('vibe_math_lean_read', { name: bigName })
-  assert(rbig.ok === true && rbig.truncated === true && Buffer.byteLength(rbig.text, 'utf8') <= 64 * 1024, '★ lean_read truncates at 64KB and says so (truncated=true)')
-  // ── 索引依赖列（§4.4）与 lean_lib 的 jobs/searchPath ─────────────────────────────
-  writeFileSync(join(vibeRoot(g), 'Formal', 'Lib', 'depUser.lean'), 'import Formal.Lib.bigOne\n\ndef depUser := 1\n', 'utf8')
-  const lib = await g.call('vibe_math_lean_lib', {})
-  assert(!!lib.paths && SAME(lib.paths.searchPath, vibeRoot(g)), '★ lean_lib exposes paths.searchPath = the VibeMath root (got ' + JSON.stringify(lib.paths) + ')')
-  assert(Array.isArray(lib.jobs) && lib.jobs.length >= 1, '★ lean_lib exposes the job list')
-  assert(lib.async === true, 'lean_lib reports the current async mode')
-  const libIdx = readIf(join(vibeRoot(g), 'Formal', 'Lib', 'Index.md'))
-  assert(/依赖（import）/.test(libIdx) && /Formal\.Lib\.bigOne/.test(libIdx), '★★ the Lib index carries the dependency column scanned from `import` lines')
-  // ── 主动性档位（修订 §1）：提示词读 leanInitiative，不是 formalVerify ──────────────
-  const wNormal = await makeCase('lean-init-normal')
-  await wNormal.call('vibe_math_set_params', { formalVerify: 'encourage', leanInitiative: 'normal' })
-  await wNormal.call('vibe_math_add_problem', { id: 'qInit', description: '主动性提示词 normal' })
-  await startScheduler(wNormal)
-  const exN = await waitFor(() => wNormal.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
-  const promptNormal = (exN && exN.prompt) || ''
-  assert(/主动性 normal/.test(promptNormal) && /三条筛选判据/.test(promptNormal), '★ the work prompt names the initiative档位 and the three selection criteria')
-  await wNormal.call('vibe_math_pause', {})
-
-  const wEager = await makeCase('lean-init-eager')
-  await wEager.call('vibe_math_set_params', { formalVerify: 'encourage', leanInitiative: 'eager' })
-  await wEager.call('vibe_math_add_problem', { id: 'qInitE', description: '主动性提示词 eager' })
-  await startScheduler(wEager)
-  const exE = await waitFor(() => wEager.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
-  assert(!!exE && /主动档（leanInitiative=eager）/.test(exE.prompt || ''), '★★ leanInitiative=eager adds the eager line (the prompt reads the initiative parameter)')
-  await wEager.call('vibe_math_pause', {})
-
-  // v5 统一口径：主动性（leanInitiative）与验证要求强度（formalVerify）是两根独立的轴。
-  // （a）leanInitiative:'off' ⇒ 连日线都不注入（真无操作）。
-  const wOff = await makeCase('lean-init-off')
-  await wOff.call('vibe_math_set_params', { formalVerify: 'encourage', leanInitiative: 'off' })
-  await wOff.call('vibe_math_add_problem', { id: 'qInitO', description: '主动性提示词 off' })
-  await startScheduler(wOff)
-  const exO = await waitFor(() => wOff.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
-  assert(!!exO && !/顺手形式化/.test(exO.prompt || ''), '★★ leanInitiative=off drops the daily line entirely (initiative is a separate axis from formalVerify, which is still encourage here)')
-  await wOff.call('vibe_math_pause', {})
-
-  // （b）formalVerify:'off' + leanInitiative:'eager' ⇒ 日线仍必须注入（eager 是独立轴，不许被 off 静默吞掉），
-  //     而**验证阶段**的 Lean 文本仍然关闭。
-  const wOffEager = await makeCase('lean-init-off-eager')
-  await wOffEager.call('vibe_math_set_params', { formalVerify: 'off', leanInitiative: 'eager' })
-  await wOffEager.call('vibe_math_add_problem', { id: 'qInitOE', description: 'off+eager 主动性' })
-  await startScheduler(wOffEager)
-  const exOE = await waitFor(() => wOffEager.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
-  const pOE = (exOE && exOE.prompt) || ''
-  assert(/主动档（leanInitiative=eager）/.test(pOE) && /三条筛选判据/.test(pOE), '★★★ formalVerify:off + leanInitiative:eager STILL injects the full daily line (v5 rule: the initiative axis is independent)')
-  assert(!/【Lean 形式化验证（/.test(pOE) && !wOffEager.spawns.some((s) => /【Lean 形式化验证（/.test(s.prompt || '')), '★★★ …while the verification-phase Lean block stays closed (formalVerify:off) in every captured prompt of that root')
-  const stOE = await wOffEager.call('vibe_math_status', {})
-  assert(stOE.params.formalVerify === 'off' && stOE.params.leanInitiative === 'eager', 'the off+eager case really ran with formalVerify:off + leanInitiative:eager')
-  await wOffEager.call('vibe_math_pause', {})
-}
-
-// ---------- 15e. round-2 lens-1 RUNTIME: the initiative axis is injected at EVERY site ----------
-// Three injection sites with three different shapes (explorer / rederive / solver). The static [sites]
-// check can only see that the producer call is not textually gated; THIS section proves the actual
-// prompt text of each site: (1) formalVerify:'off' + leanInitiative:'eager' must carry the daily line
-// at that site (and keep the verification block closed), (2) leanInitiative:'off' must drop it there
-// while the verification phase still follows formalVerify. Assertion names carry the site name, so a
-// single-site regression names itself instead of hiding behind a sibling site's coverage.
-const SITE_DAILY = /三条筛选判据/
-const SITE_VERIFY = /【Lean 形式化验证（/
-const FENCE = '`'.repeat(3)
-const jsonReply = (obj) => FENCE + 'json\n' + JSON.stringify(obj) + '\n' + FENCE
-/** Drive one problem through explorer -> solver(dead-end) -> re-derive and collect each site's prompt. */
-async function driveSites(h, opts, qid) {
-  const q = qid || 'qSite'
-  await h.call('vibe_math_set_params', Object.assign({ tickIntervalMs: 200, verifierCount: 2, leanAsync: false, maxExplorerRetries: 5, maxParallelThreshold: 4 }, opts))
-  await h.call('vibe_math_add_problem', { id: q, description: '站点级运行时用例' })
-  await startScheduler(h)
-  const label = (n) => h.spawns.filter((s) => s.label.startsWith(n + ':' + q))
-  const ex1 = await waitFor(() => label('explorer')[0], 80, 200)
-  const out = { explorer: (ex1 && ex1.prompt) || '' }
-  if (ex1) h.fireEnd({ id: ex1.childId, runId: 'rS1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.8 }] }) }] })
-  const so = await waitFor(() => label('solver')[0], 80, 200)
-  out.solver = (so && so.prompt) || ''
-  if (so) h.fireEnd({ id: so.childId, runId: 'rS2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ status: 'dead-end', dead_end_reason: '站点用例：本方向不可行', solution: '', solution_probability: 0.1, lemmas: [], routes: [], lessons: [], survival_probability: 0.2, sub_questions: [], new_inventions: [{ 类型: '工具', 标题: '站点工具', 内容描述: 'x', 是否已入库: false }] }) }] })
-  // every direction is now dead-end ⇒ the NEXT explorer for this problem is built by rederivePrompt
-  await waitFor(() => label('explorer').length >= 2 && label('explorer')[1], 80, 200)
-  const exs = label('explorer')
-  out.rederive = (exs[1] && exs[1].prompt) || ''
-  out.distinct = !!out.explorer && !!out.rederive && out.explorer !== out.rederive
-  await h.call('vibe_math_abort', {})
-  return out
-}
-{
-  // (1) eager 在 formalVerify:'off' 下也必须在**每一个**站点注入日线
-  const he = await makeCase('site-eager-off')
-  const A = await driveSites(he, { formalVerify: 'off', leanInitiative: 'eager' })
-  assert(SITE_DAILY.test(A.explorer), '★ [explorer site] formalVerify:off + leanInitiative:eager injects the daily line')
-  assert(SITE_DAILY.test(A.solver), '★ [solver site] formalVerify:off + leanInitiative:eager injects the daily line')
-  assert(SITE_DAILY.test(A.rederive), '★ [rederive site] formalVerify:off + leanInitiative:eager injects the daily line')
-  assert(A.distinct, '★ [rederive site] the re-explore prompt really is the rederive builder (differs from the first explorer wave)')
-  assert(A.explorer.indexOf('【Lean 形式化验证（') === -1 && A.solver.indexOf('【Lean 形式化验证（') === -1 && A.rederive.indexOf('【Lean 形式化验证（') === -1, '★ [all sites] formalVerify:off keeps the verification-phase block closed while eager still injects the daily line')
-
-  // (2) leanInitiative:'off' ⇒ 每个站点都没有日线（同一驱动）
-  const ho = await makeCase('site-init-off')
-  const B = await driveSites(ho, { formalVerify: 'encourage', leanInitiative: 'off' }, 'qSiteOff')
-  assert(!SITE_DAILY.test(B.explorer) && !/【顺手形式化/.test(B.explorer), '★ [explorer site] leanInitiative:off drops the daily line')
-  assert(!SITE_DAILY.test(B.solver) && !/【顺手形式化/.test(B.solver), '★ [solver site] leanInitiative:off drops the daily line')
-  assert(!SITE_DAILY.test(B.rederive) && !/【顺手形式化/.test(B.rederive), '★ [rederive site] leanInitiative:off drops the daily line')
-
-  // (2b) …而验证段仍按 formalVerify 出现（同一参数下的另一个 root，驱动到 verifier）
-  const hv = await makeCase('site-init-off-verify')
-  await hv.call('vibe_math_set_params', { tickIntervalMs: 200, verifierCount: 2, leanAsync: false, formalVerify: 'encourage', leanInitiative: 'off' })
-  await hv.call('vibe_math_add_problem', { id: 'qV', description: '验证段仍在' })
-  await startScheduler(hv)
-  const exv = await waitFor(() => hv.spawns.find((s) => s.label.startsWith('explorer:qV')), 80, 200)
-  assert(!!exv && !SITE_DAILY.test(exv.prompt || ''), '★ [explorer site] 第二个 root：initiative off 时 explorer 仍无日线')
-  if (exv) hv.fireEnd({ id: exv.childId, runId: 'rV1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.8 }] }) }] })
-  const sov = await waitFor(() => hv.spawns.find((s) => s.label.startsWith('solver:qV')), 80, 200)
-  if (sov) hv.fireEnd({ id: sov.childId, runId: 'rV2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ status: 'success', solution: 'complete solution', solution_probability: 0.9, lemmas: [], routes: [], lessons: [], survival_probability: 0.9, dead_end_reason: null, sub_questions: [] }) }] })
-  const vv = await waitFor(() => hv.spawns.find((s) => /^verifier:/.test(s.label)), 100, 250)
-  assert(!!vv && SITE_VERIFY.test(vv.prompt || ''), '★ leanInitiative:off 时验证段仍按 formalVerify 注入（verifier 提示词含【Lean 形式化验证（）')
-  await hv.call('vibe_math_abort', {})
-}
-
+// ============================================================
+// V2 LEAN FORMAL VERIFICATION SUITE  (docs/formal-verification.md)
+//
+// Asserts the whole contract of the v2 `formalVerify` knob:
+//   · 'off'       is a TRUE no-op: no Lean text in ANY prompt it builds, no formal record,
+//                 no gate — while the three tools stay registered (registration is static)
+//   · 'encourage' injects the Lean section into BOTH the review and the debate prompt and the
+//                 "顺手形式化" line into the solver/explorer prompts, and — the actual point of
+//                 the feature — turns the review into a FIDELITY check once a Lean run passed
+//   · 'require'   withholds a true/false verdict (未定论 + Formal/TODO.md + announcement) until
+//                 the object is Lean-passed or carries an explicit, reasoned blocker; then the
+//                 same verdict DOES write the card, and the card records the formal status
+//   · the three tools (run / archive / lib) write the right things to the right paths
+//   · the REPLY CHANNEL is real, not dead code (contract §4 / §6.3 / §10.8): a verifier's
+//     `formal:{decision:'blocked'|'defect', note}` reply is actually absorbed into the durable
+//     record for BOTH id spaces, a missing note is refused, and `defect` (a fidelity defect,
+//     i.e. the Lean code does not say what the proposition says) downgrades the proof, deletes
+//     the archived file, writes the TODO and defers the verdict — it is NEVER recorded as
+//     "the proposition is false" (contract §4.1)
+//
+// The Lean toolchain is mocked through the subprocess SERVICE (a fake Lean: exit 0 unless the
+// file still contains `sorry` or the marker `-- FAIL`), so these tests exercise the REAL code
+// path (resolveExecutable → spawn → collected stdout → exit code) without Lean installed.
+//
+// The plugin path honours V2_PLUGIN so a sensitivity probe can point this suite at a mutated
+// copy of the plugin (a suite that ignored the override would make every probe vacuous —
+// AUDIT-CHECKLIST §2.5).
+//
+// Run: node tests/formal-verify-v2.test.mjs
+// ============================================================
+import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync, writeFileSync, statSync, mkdirSync, renameSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname, isAbsolute, resolve as pathResolve } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+// Concurrency isolation: the shipped corpus is read by other probes (audit-prompt-invariants) while
+// this suite runs under the gate, so the write must be atomic — a reader must never see a truncated file.
+function writeFileAtomic(target, text) {
+  const tmp = target + '.tmp-' + process.pid + '-' + Math.random().toString(36).slice(2, 8)
+  writeFileSync(tmp, text, 'utf8')
+  renameSync(tmp, target)
+}
+
+
+// V2_PLUGIN may be a REPO-RELATIVE path or an ABSOLUTE one (a mutant copy outside the repo, e.g. a
+// temp dir). The previous `new URL('file:///' + path)` form only worked for drive-qualified Windows
+// paths and made out-of-repo variants impossible; this is the same isAbsolute-aware resolution the
+// `math-computation-v*` suites use. Default behaviour (env var unset) is unchanged.
+const PLUGIN = process.env.V2_PLUGIN
+  ? pathToFileURL(isAbsolute(process.env.V2_PLUGIN) ? process.env.V2_PLUGIN : join(dirname(fileURLToPath(import.meta.url)), '..', process.env.V2_PLUGIN))
+  : new URL('../vibe-math-v2/vibe-math-v2.js', import.meta.url)
+// 纯函数测试面（__testHelpers）：参数归一化/搜索路径计划/哈希/指纹都从这里守卫。
+const MOD = await import(PLUGIN.href)
+const HERE = dirname(fileURLToPath(import.meta.url))
+// Human-reviewable corpus (contract §10.10). A sensitivity probe runs THIS suite against a
+// MUTATED plugin copy: writing the repository corpus from such a run would replace the
+// reviewed text with mutated text, so a mutated run goes to a scratch directory instead
+// (and V2_CORPUS_DIR overrides both, exactly like the v3 suite's V3_CORPUS_DIR).
+const CORPUS_DIR = process.env.V2_CORPUS_DIR
+  ? pathResolve(process.env.V2_CORPUS_DIR)
+  : (process.env.V2_PLUGIN ? join(tmpdir(), 'vibe-v2-prompt-corpus') : join(HERE, '..', 'prompt-corpus-v2'))
+
+let passed = 0, failed = 0
+const failures = []
+const assert = (c, m) => { if (c) { passed++; console.log('  ok - ' + m) } else { failed++; failures.push(m); console.error('  FAIL - ' + m) } }
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+const section = (t) => console.log('\n[' + t + ']')
+
+// ---------------------------------------------------------------
+// the fake Lean toolchain (mocked at the SERVICE boundary)
+// ---------------------------------------------------------------
+let toolchainAvailable = true
+const leanRuns = []
+const terminations = []
+const subprocess = {
+  async resolveExecutable(cmd) {
+    if (!toolchainAvailable) throw new Error('spawn lean ENOENT')
+    if (String(cmd) !== 'lean') throw new Error('unknown executable ' + cmd)
+    return 'lean'
+  },
+  spawn(spec) {
+    const last = spec.argv[spec.argv.length - 1]
+    const script = String(last || '')
+    // v2 creates its directory tree through this SAME subprocess service
+    // (`powershell … New-Item -Force -ItemType Directory -Path 'a','b'`). Without honouring
+    // it, the Formal/ and Verified/Lean/ assertions would be vacuous: they would fail for the
+    // wrong reason (a mocked no-op) instead of a real defect.
+    if (/New-Item/.test(script)) {
+      const m = /-Path\s+(.+?)\s*(\||$)/.exec(script)
+      if (m) m[1].split(',').forEach((p) => { const q = p.trim().replace(/^'|'$/g, '').replace(/''/g, "'"); if (q) mkdirSync(q, { recursive: true }) })
+      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
+    }
+    if (/mkdir -p /.test(script)) {
+      const m = /mkdir -p (.+)$/.exec(script)
+      if (m) m[1].split(/\s+/).forEach((p) => { const q = p.trim().replace(/^'|'$/g, ''); if (q) mkdirSync(q, { recursive: true }) })
+      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
+    }
+    // v2 ALSO deletes files through this same service (`powershell … Remove-Item -LiteralPath 'x'`,
+    // POSIX `rm -f 'x'`). Without honouring it, the `defect` assertion "the archived proof is
+    // gone" would pass vacuously (nothing was ever deleted) instead of testing the real code path.
+    if (/Remove-Item/.test(script)) {
+      const m = /-LiteralPath\s+'((?:[^']|'')*)'/.exec(script)
+      if (m) { try { rmSync(m[1].replace(/''/g, "'"), { force: true }) } catch (e) { /* best effort */ } }
+      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
+    }
+    if (/^\s*rm -f /.test(script)) {
+      const re = /'((?:[^']|'\\'')*)'/g
+      let m
+      while ((m = re.exec(script)) !== null) { try { rmSync(m[1].replace(/'\\''/g, "'"), { force: true }) } catch (e) { /* best effort */ } }
+      return { done: Promise.resolve({ exitCode: 0 }), collected: {}, terminate() {} }
+    }
+    const text = existsSync(last) ? readFileSync(last, 'utf8') : ''
+    const bad = /sorry|-- FAIL/.test(text)
+    leanRuns.push({ argv: spec.argv.slice(0, -1), file: last, cwd: spec.cwd, graceMs: spec.graceMs, stdio: spec.stdio })
+    const stdout = bad ? '' : 'ok\n'
+    const stderr = bad ? 'error: declaration uses sorry\n' : ''
+    if (/-- HANG/.test(text)) {
+      // A run that never finishes by itself. It settles ONLY when the plugin actively terminates it
+      // (contract §7: "对超时调用 handle.terminate()"), with a bounded 2.5 s fallback so a plugin
+      // that FORGETS to terminate FAILS the terminate/speed assertions instead of hanging this suite.
+      let settled = false
+      let finish
+      const done = new Promise((resolve) => { finish = resolve })
+      const fallback = REAL_SET_TIMEOUT(() => { if (!settled) { settled = true; finish({ exitCode: null, signal: 'SIGKILL' }) } }, 2500)
+      return {
+        done,
+        collected: {
+          stdout: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) },
+          stderr: { readFrom: () => ({ text: '', nextOffset: 0, lossy: false }) },
+        },
+        terminate() {
+          if (settled) return
+          settled = true
+          REAL_CLEAR_TIMEOUT(fallback)
+          terminations.push({ file: last })
+          finish({ exitCode: null, signal: 'SIGTERM' })
+        },
+      }
+    }
+    return {
+      done: Promise.resolve({ exitCode: bad ? 1 : 0, signal: null }),
+      collected: {
+        stdout: { readFrom: () => ({ text: stdout, nextOffset: stdout.length, lossy: false }) },
+        stderr: { readFrom: () => ({ text: stderr, nextOffset: stderr.length, lossy: false }) },
+      },
+      terminate() {},
+    }
+  },
+}
+
+// ---------------------------------------------------------------
+// mock host (v2 standing-mount shape: one plugin instance, many sessions)
+// ---------------------------------------------------------------
+function makeHost(WS, opts = {}) {
+  const listeners = {}
+  const toolRegs = []
+  const cmdRegs = []
+  const spawns = []
+  const followups = []
+  const interrupts = []
+  const disposers = []
+  const ctx = {
+    get(name) {
+      if (name === 'subprocess') return opts.noSubprocess ? undefined : subprocess
+      if (name === 'sandboxPolicy') return { workspaceRoot: WS, resolve: () => ({ workspaceRoot: WS }) }
+      return undefined
+    },
+    on(event, fn) { (listeners[event] = listeners[event] || []).push(fn) },
+    effect(fn) { const d = fn(); const off = () => { if (typeof d === 'function') d() }; disposers.push(off); return off },
+    logger: { info() {}, warn() {}, error() {} },
+    tools: { register(spec) { toolRegs.push(spec); return () => {} } },
+    commands: { register(spec) { cmdRegs.push(spec); return () => {} } },
+    timeout(cb, ms) { const h = setTimeout(cb, ms); return () => clearTimeout(h) },
+    subagents: {
+      list() { return ['spawn'] },
+      async startContinuable({ label, request }) {
+        const childId = 'child-' + (spawns.length + 1) + '-' + Math.random().toString(36).slice(2, 6)
+        spawns.push({ label, childId, rootId: (request && request.parent && request.parent.id) || 'root', prompt: request && request.prompt && request.prompt[0] && request.prompt[0].text })
+        return { childId }
+      },
+      async followup(parent, childId, blocks) { followups.push({ childId, prompt: (blocks && blocks[0] && blocks[0].text) || '' }) },
+      async sendMessage(parent, childId, blocks) { followups.push({ childId, prompt: (blocks && blocks[0] && blocks[0].text) || '' }) },
+      interrupt(childId) { interrupts.push(childId) },
+    },
+    agents: { roots() { return [] }, get() { return undefined } },
+    fs: {
+      async resolve(rel, o) {
+        const raw = String(rel)
+        const p = isAbsolute(raw) ? raw : join((o && o.cwd) || WS, ...raw.split('/'))
+        return p.replace(/\\/g, '/')
+      },
+      async stat(t) { if (!existsSync(t)) return undefined; return { type: statSync(t).isDirectory() ? 'directory' : 'file' } },
+      async readText(t) { return readFileSync(t, 'utf8') },
+      async writeText(t, c) { mkdirSync(dirname(t), { recursive: true }); writeFileSync(t, c, 'utf8') },
+      async listDir(t) { if (!existsSync(t)) return []; return readdirSync(t, { withFileTypes: true }).map((e) => ({ name: e.name, type: e.isDirectory() ? 'directory' : 'file' })) },
+    },
+  }
+  const fireEnd = (info) => { for (const h of (listeners['subagent/end'] || [])) h(info) }
+  return { ctx, toolRegs, cmdRegs, spawns, followups, interrupts, disposers, unmount: () => { for (const d of disposers) { try { d() } catch (e) { /* ignore */ } } }, fireEnd, WS }
+}
+
+function makeRoot(id, WS) {
+  // `pushed` records the framework's OWN messages to the main agent (`rootAgent.followup`), i.e. the
+  // reportMode=push progress report. It used to be a no-op, which is why that channel had no corpus
+  // entry at all (AUDIT §2.4 "框架→人 的反馈与推送类提示").
+  const pushed = []
+  return { id, options: { provider: 'mock', model: 'mock' }, session: { id, header: { cwd: WS, parentSession: undefined } }, pushed, followup(m) { const c = (m && m.content) || []; pushed.push(c.map((b) => (b && b.text) || '').join('')) } }
+}
+
+const hosts = []
+/**
+ * Build an INDEPENDENT plugin instance + workspace for one test case.
+ * AUDIT-CHECKLIST §2.3: cases must not share a session root/workspace, or a leftover
+ * heartbeat/verification from one case pollutes the next.
+ */
+async function makeCase(label, opts = {}) {
+  const WS = mkdtempSync(join(tmpdir(), 'vibe-v2-lean-' + label + '-'))
+  const h = makeHost(WS, opts)
+  const mod = await import(PLUGIN.href + '?t=' + Date.now() + '-' + Math.random().toString(36).slice(2, 8))
+  ;(mod.default || mod).apply(h.ctx)
+  const root = makeRoot('sess-' + label, WS)
+  const call = async (name, args, agent) => {
+    const spec = h.toolRegs.find((s) => s.name === name)
+    if (!spec) throw new Error('no tool ' + name)
+    return JSON.parse(await spec.execute(args || {}, { agent: agent || root }))
+  }
+  await call('vibe_math_new_project', { name: 'proj' })
+  // 200ms is the sanitizer floor; verifierCount=2 (the sanitizer floor too) keeps each
+  // verification exactly two children, so a round settles predictably.
+  await call('vibe_math_set_params', { tickIntervalMs: 200, verifierCount: 2 })
+  // leanAsync defaults to TRUE (background queue). This suite's Lean sections guard the
+  // **synchronous** path verbatim, so every case pins leanAsync=false here; the async state
+  // machine (default档) is guarded by its own section, which flips it back on explicitly.
+  await call('vibe_math_set_params', { leanAsync: false })
+  const c = Object.assign(h, { WS, root, call, label })
+  hosts.push(c)
+  return c
+}
+// The scheduler only picks objects up while it is RUNNING (scheduleTick early-returns).
+async function startScheduler(h) { await h.call('vibe_math_start', {}) }
+
+// ── test speed: fast-forward the SCHEDULER POLL (test-only, no production impact) ─────────
+// The plugin registers its scheduler poll as `setInterval(..., 1000)` at apply() time, so every
+// suite-side `tick()` had to wait a full wall-clock second. With ~9 verification rounds × ~17
+// ticks that alone accounted for ~99% of this suite's 186 s (its v3/v4/v5 siblings take seconds).
+// Patching ONLY setInterval (the suite's own `sleep` uses setTimeout) makes a poll cost ~25 ms,
+// while the plugin's due-ness logic still uses the real 200 ms `tickIntervalMs` floor — no
+// scheduler behaviour depends on the poll period, and `tickTheScheduler` below stays above it.
+const REAL_SET_INTERVAL = globalThis.setInterval
+globalThis.setInterval = function (fn, ms, ...rest) {
+  return REAL_SET_INTERVAL(fn, Math.min(Number(ms) || 0, 25), ...rest)
+}
+// ── test speed / leak check: track OUTSTANDING setTimeout handles (test-only) ──────────────
+// `leanRunFile` races `handle.done` against its own `cap`-ms timer; forgetting to clear that timer on
+// the normal path leaves one pending multi-minute timer PER RUN — a leak no output assertion can see.
+// The plugin resolves the global at call time, so wrapping it here covers it. The mock's own bounded
+// fallback uses the REAL functions, so it never pollutes the count.
+const REAL_SET_TIMEOUT = globalThis.setTimeout
+const REAL_CLEAR_TIMEOUT = globalThis.clearTimeout
+const liveTimers = new Set()
+globalThis.setTimeout = function (fn, ms, ...rest) {
+  let h
+  h = REAL_SET_TIMEOUT(function (...a) { liveTimers.delete(h); return fn.apply(this, a) }, ms, ...rest)
+  liveTimers.add(h)
+  return h
+}
+globalThis.clearTimeout = function (h) { liveTimers.delete(h); return REAL_CLEAR_TIMEOUT(h) }
+
+const projRoot = (h) => join(h.WS, 'VibeMath', 'Projects', 'proj')
+const vibeRoot = (h) => join(h.WS, 'VibeMath')
+const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '')
+const formalStateOf = (h) => JSON.parse(readIf(join(projRoot(h), 'VibeMath_State', 'formal.json')) || '{}')
+// One scheduler pass. With the poll fast-forwarded above, the poll fires every ~25 ms and a tick
+// runs whenever the plugin's own 200 ms `tickIntervalMs` floor has elapsed, so 260 ms is one pass.
+const tick = (ms = 260) => sleep(ms)
+async function waitFor(pred, tries = 80, ms = 60) {
+  for (let i = 0; i < tries; i++) { const v = pred(); if (v) return v; await sleep(ms) }
+  return undefined
+}
+const verifiersOf = (h, rKind, exclude) => h.spawns.filter((s) => s.label.startsWith('verifier:' + rKind) && !(exclude || []).some((o) => o.childId === s.childId))
+/** A reply exactly as an agent would emit it (a fenced JSON block) — the framework's real input. */
+const fence = (obj) => '```json\n' + JSON.stringify(obj) + '\n```'
+/** Feed ONE agent reply (a fresh turn's end) to the framework through the real dispatch path. */
+const replyFrom = (h, childId, obj) => h.fireEnd({
+  id: childId, runId: 'r-' + childId, provider: 'spawn', local: true, stopReason: 'completed',
+  lastAssistantMessage: [{ type: 'text', text: fence(obj) }],
+})
+const fireVerdicts = (h, kids, vale) => {
+  for (let i = 0; i < kids.length; i++) {
+    h.fireEnd({ id: kids[i].childId, runId: 'v' + i, provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n' + JSON.stringify({ Result: vale, Reason: 'review ' + i }) + '\n```' }] })
+  }
+}
+/**
+ * Verify one object and DRIVE IT TO A SETTLEMENT.
+ *
+ * Important: v2's `processVerify` starts at most ONE verification and skips every candidate
+ * while a task is live, so leaving an object mid-debate would silently block the NEXT case's
+ * verification. The first `firstRounds` rounds are answered with `vale` (a non-unanimous value
+ * forces a real debate round, which is exactly what the debate-prompt assertions need), and any
+ * later round is answered with `settle` so the object actually closes.
+ */
+async function verifyWithDebate(h, rKind, vale, firstRounds = 1, settle = 1) {
+  // v2 re-wakes the SAME verifier children for every debate round (it does not spawn new
+  // ones), so a new round is detected by counting the followups written to those children.
+  const kids = new Set()
+  // Early exit: a settled object stops producing followups. Without this the loop always spent
+  // its FULL 16 passes (~21 s at the old 1.3 s/pass), which is what made this suite take 3
+  // minutes: the debate is over, but the helper kept ticking at nothing. Three consecutive
+  // passes with no new followup = the framework has nothing left to ask.
+  let lastN = -1
+  let quiet = 0
+  for (let i = 0; i < 16; i++) {
+    // The scheduler may need a whole pass before it notices the object and another before it
+    // fills the verifier quota, so each wait must span several timer ticks.
+    const cand = await waitFor(() => {
+      const x = verifiersOf(h, rKind)
+      return x.length >= 2 ? x : undefined
+    }, 40, 250)
+    if (!cand) break
+    cand.forEach((s) => kids.add(s.childId))
+    const rounds = 1 + h.followups.filter((f) => kids.has(f.childId)).length
+    // `fireEnd` is a NO-OP for a child with no in-flight turn, so answering the whole current
+    // verifier set each pass is safe; the extra answers land before the next round's wakes.
+    fireVerdicts(h, cand, rounds <= firstRounds ? vale : settle)
+    await sleep(200)
+    await tick()
+    if (h.followups.length === lastN) { if (++quiet >= 3) break } else { quiet = 0; lastN = h.followups.length }
+  }
+  const rounds = 1 + h.followups.filter((f) => kids.has(f.childId)).length
+  return { first: h.spawns.filter((s) => s.label.startsWith('verifier:' + rKind)), rounds: kids.size ? rounds : 0 }
+}
+
+// ===============================================================
+console.log('-- V2 Lean formal verification --')
+
+// ---------- 1. 'off' is a true no-op ----------
+section("1 'off' (default) is a true no-op")
+{
+  const h = await makeCase('off')
+  const st = await h.call('vibe_math_status', {})
+  assert(st.params.formalVerify === 'off', "the default mode is 'off' (got " + st.params.formalVerify + ')')
+  assert(st.formal.mode === 'off' && st.formal.required === false, 'status exposes the formal mode and gate flag')
+  assert(st.params.leanCommand === 'lean' && Array.isArray(st.params.leanArgs), 'the Lean knobs are readable in status.params')
+  assert(st.params.leanTimeoutMs === 120000, 'leanTimeoutMs defaults to 120000 (got ' + st.params.leanTimeoutMs + ')')
+  assert(!!h.toolRegs.find((t) => t.name === 'vibe_math_lean_run') && !!h.toolRegs.find((t) => t.name === 'vibe_math_lean_archive') && !!h.toolRegs.find((t) => t.name === 'vibe_math_lean_lib'),
+    'the three Lean tools are registered in every mode (registration is static)')
+// ★ The mode switch must be REACHABLE THROUGH THE TOOL SCHEMA (2.3.2 defect D1) ──────────────
+// Every tool schema here is closed (`additionalProperties:false`), so a key the schema does not
+// advertise is REJECTED by any schema-validating provider. v3 shipped 2.3.0/2.3.1 with all four Lean
+// parameters missing from the set-params schema while every assertion in this file stayed green —
+// because the suite calls the handler DIRECTLY and never inspects the registered schema. The feature
+// could not be switched on at all through the tool interface.
+{
+  const setSpec = h.toolRegs.find((t) => t.name === 'vibe_math_set_params')
+  assert(!!setSpec, "vibe_math_set_params is registered")
+  assert(setSpec.parameters && setSpec.parameters.type === 'object' && setSpec.parameters.additionalProperties === false,
+    '★ vibe_math_set_params publishes a CLOSED object schema (an unlisted key is rejected, so the schema IS the contract)')
+  for (const k of ['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs']) {
+    assert(Object.prototype.hasOwnProperty.call(setSpec.parameters.properties, k),
+      '★ the registered schema advertises ' + k + ' (every other surface documents it; a schema that omits it makes the switch unreachable)')
+  }
+  assert(JSON.stringify(setSpec.parameters.properties.formalVerify.enum) === JSON.stringify(['off', 'encourage', 'require']),
+    'the schema narrows formalVerify to the three real modes (a typo must not be a fourth)')
+}
+
+  assert(existsSync(join(vibeRoot(h), 'Formal', 'Lib')) && existsSync(join(vibeRoot(h), 'Formal', 'Proved')), 'the GLOBAL Formal/Lib + Formal/Proved dirs are created outside the project')
+  assert(existsSync(join(projRoot(h), 'Formal')) && existsSync(join(projRoot(h), 'Verified', 'Lean')), 'the project Formal/ and Verified/Lean/ dirs are created')
+  await h.call('vibe_math_add_problem', { id: 'q1', description: 'off 模式无操作测试' })
+  await startScheduler(h)
+  await tick(2000)
+  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:q1')), 60, 200)
+  assert(!!ex, 'the explorer was spawned (the scheduler really is running)')
+  assert(!!ex && !/Lean|形式化/.test(ex.prompt || ''), 'the explorer prompt contains no Lean/形式化 text in off mode')
+  if (ex) h.fireEnd({ id: ex.childId, runId: 'r1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n{"directions":[{"id":"d1","title":"D","method":"m","core_assumption":"c","feasibility":0.6}]}\n```' }] })
+  await sleep(300)
+  const so = await waitFor(() => h.spawns.find((s) => s.label.startsWith('solver:q1')), 40, 200)
+  assert(!!so, 'the solver was spawned after the explorer returned directions')
+  assert(!!so && !/Lean|形式化/.test(so.prompt || ''), 'the solver prompt contains no Lean/形式化 text in off mode')
+  if (so) h.fireEnd({ id: so.childId, runId: 'r2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n{"status":"success","solution":"complete solution","solution_probability":0.8,"lemmas":[],"routes":[],"lessons":[],"survival_probability":0.9,"dead_end_reason":null,"sub_questions":[]}\n```' }] })
+  const vs = await verifyWithDebate(h, 'r-q1-s0', 1)
+  assert(!!vs.first && vs.first.length >= 2, 'verifiers were spawned for the solution (' + (vs.first ? vs.first.length : 0) + ')')
+  const vp = vs.first ? (h.spawns.find((s) => s.label === 'verifier:r-q1-s0:0').prompt || '') : ''
+  assert(!/Lean|形式化/.test(vp), 'the review prompt contains no Lean/形式化 text in off mode')
+  const debateText = h.followups.map((f) => f.prompt || '').join('\n')
+  assert(!/Lean|形式化/.test(debateText), 'no debate/followup prompt mentions Lean in off mode')
+  const qs = JSON.parse(readIf(join(projRoot(h), 'qs', 'qs.json')) || '[]')
+  const q = qs.find((x) => x.id === 'q1')
+  assert(!!q && q.已解决 === true, "'off' still finalizes: the problem is marked solved with NO Lean artifact")
+  assert(!!q && q.解法列表 && q.解法列表[0].正确概率 === 1, 'the solution probability is 1 in off mode')
+  assert(existsSync(join(projRoot(h), 'Verified', '问题_Verified.json')), 'the Verified card was written in off mode')
+  assert(!/形式化/.test(readIf(join(projRoot(h), 'Verified', '问题_Verified.json'))), 'the card carries no formal line in off mode')
+  assert(!existsSync(join(projRoot(h), 'Formal', 'TODO.md')), 'no Formal/TODO.md is produced in off mode')
+  const fs0 = formalStateOf(h)
+  assert(!fs0.records || Object.keys(fs0.records).length === 0, 'off mode records no formal object state')
+}
+
+// ---------- 2. parameter validation + runtime switching ----------
+section('2 parameter validation and runtime switching')
+{
+  const h = await makeCase('params')
+  const bad = await h.call('vibe_math_set_params', { formalVerify: 'banana' })
+  assert(bad.params.formalVerify === 'off', "an unknown mode degrades to 'off', never to a stronger mode (got " + bad.params.formalVerify + ')')
+  const enc = await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
+  assert(enc.params.formalVerify === 'encourage', "'encourage' is accepted")
+  const req = await h.call('vibe_math_set_params', { formalVerify: 'require', leanTimeoutMs: -5, leanCommand: '   ' })
+  assert(req.params.formalVerify === 'require', "'require' is accepted")
+  assert(req.params.leanTimeoutMs === 120000, 'a non-positive leanTimeoutMs falls back to the default (' + req.params.leanTimeoutMs + ')')
+  assert(req.params.leanCommand === 'lean', 'a blank leanCommand falls back to "lean"')
+  const lake = await h.call('vibe_math_set_params', { leanCommand: 'lake', leanArgs: ['env', 'lean'] })
+  assert(lake.params.leanCommand === 'lake' && lake.params.leanArgs.join(' ') === 'env lean', 'leanCommand/leanArgs are settable (lake env lean)')
+  const st = await h.call('vibe_math_status', {})
+  assert(st.formal.leanCommand === 'lake' && st.formal.leanArgs.join(' ') === 'env lean', 'the Lean knobs round-trip through status')
+  const setup = await h.call('vibe_math_setup', {})
+  const names = setup.parameters.map((p) => p.name)
+  assert(['formalVerify', 'leanCommand', 'leanArgs', 'leanTimeoutMs'].every((n) => names.indexOf(n) !== -1), 'vibe_math_setup schema lists all four Lean knobs')
+  const fv = setup.parameters.find((p) => p.name === 'formalVerify')
+  assert(!!fv && fv.current === 'require' && fv.default === 'off', 'the schema reports the current and default formalVerify')
+  const tpl = await h.call('vibe_math_template', { where: 'global' })
+  const tplText = readIf(tpl.path)
+  assert(/formalVerify/.test(tplText) && /leanCommand/.test(tplText) && /leanTimeoutMs/.test(tplText), 'the settings template documents the Lean knobs')
+  assert(/leanArgs/.test(tplText), 'the settings template also documents leanArgs')
+  assert(!/:\s*undefined/.test(tplText), 'the template has no bare undefined token (settings round-trip safety)')
+  const saved = await h.call('vibe_math_save_settings', {})
+  assert(saved.ok === true, 'save_settings still round-trips with the new knobs')
+  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
+  await h.call('vibe_math_add_problem', { id: 'q2', description: '模式切换测试' })
+  await startScheduler(h)
+  await tick(2000)
+  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:q2')), 60, 200)
+  assert(!!ex && /【顺手形式化（鼓励[^）]*）】/.test(ex.prompt || ''), '★ switching to encourage changes the NEXT prompt immediately')
+  if (ex) h.fireEnd({ id: ex.childId, runId: 'r', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n{"directions":[{"id":"d1","title":"D","method":"m","core_assumption":"c","feasibility":0.5}]}\n```' }] })
+  await h.call('vibe_math_set_params', { formalVerify: 'off' })
+  await sleep(400)
+  const so = await waitFor(() => h.spawns.find((s) => s.label.startsWith('solver:q2')), 40, 200)
+  assert(!!so, 'the solver was spawned after the mode was switched back to off')
+  assert(!!so && !/形式化|Lean/.test(so.prompt || ''), '★ switching back to off removes the Lean text from the next prompt')
+}
+
+// ---------- 3. 'encourage' injection ----------
+section("3 'encourage' injects the Lean section into review AND debate prompts")
+{
+  const h = await makeCase('enc')
+  await h.call('vibe_math_set_params', { formalVerify: 'encourage', maxParallelThreshold: 8 })
+  // Keep the scheduler alive: v2 STOPS itself when there is no unsolved problem, no agent and
+  // no task, and a stopped scheduler never starts a verification (nor spawns an explorer).
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  await h.call('vibe_math_add_proposition', { id: 'pEnc', 概述: '鼓励模式下的忠实性审查', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await verifyWithDebate(h, 'r-pEnc', 0.5, 1) // 0.5 -> no consensus -> a REAL debate round
+  assert(!!vs.first, 'verifiers spawned for the bare proposition')
+  assert(vs.rounds >= 2, 'the object really went through a debate round (' + vs.rounds + ' rounds)')
+  const review = h.spawns.find((s) => s.label === 'verifier:r-pEnc:0')
+  assert(!!review, 'the first review prompt was captured')
+  const reviewText = review ? review.prompt : ''
+  assert(/【Lean 形式化验证（鼓励模式）】/.test(reviewText), '★ the REVIEW prompt carries the Lean section')
+  assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(reviewText), 'the review prompt states that a passing Lean run shrinks the question to fidelity')
+  assert(/实现难度/.test(reviewText), 'the review prompt asks for the implementation-difficulty judgement')
+  // NOTE: this assertion is only the WORDING half. Which is exactly the trap the first version
+  // of this feature fell into (a green suite guarding a dead channel). The behaviour — the reply
+  // really landing in the durable record — is asserted in section 11.
+  assert(/可以不做，但请在回执的 formal 字段写明难度判断/.test(reviewText), "'encourage' explicitly allows skipping (with a recorded judgement)")
+  assert(/"decision":"used\|blocked\|defect"/.test(reviewText), '★ the review contract lists the real decision enum (incl. defect)')
+  assert(/vibe_math_lean_run（执行）· vibe_math_lean_archive（归档）· vibe_math_lean_lib（查已有可复用库\/jobs）· vibe_math_lean_read（取回归档原文）/.test(reviewText), 'the review prompt names all four v2 tools (incl. the new read-only one)')
+  assert(/归档可复用定义\/引理前先跑通（vibe_math_lean_archive run=true 或先 vibe_math_lean_run）/.test(reviewText), '★ the review prompt says a reusable artifact must run green BEFORE it is archived')
+  assert(/LEAN_NOT_FOUND/.test(reviewText) && /宿主无 Lean 工具链/.test(reviewText), '★ the review prompt writes out the missing-toolchain escape hatch (a host without Lean must not deadlock the agent)')
+  const debate = h.followups.map((f) => f.prompt || '').filter((p) => /DEBATE/.test(p)).join('\n')
+  assert(/DEBATE/.test(debate), 'the debate round actually happened (a followup with the debate prompt was issued)')
+  assert(/【Lean 形式化验证（鼓励模式）】/.test(debate), '★ the DEBATE prompt carries the Lean section too')
+  assert(/一旦 Lean 通过，你唯一需要确认的就是忠实性/.test(debate), 'the debate prompt states the fidelity shift')
+  await h.call('vibe_math_add_problem', { id: 'qW', description: '顺手形式化测试' })
+  await tick(2000)
+  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:qW')), 60, 200)
+  assert(!!ex && /【顺手形式化（鼓励[^）]*）】/.test(ex.prompt || ''), '★ the explorer work prompt carries the 顺手形式化 line')
+  assert(!!ex && /vibe_math_lean_archive kind='def'/.test(ex.prompt || ''), 'the work line points at the archive tool for reusable definitions')
+  assert(!!ex && /vibe_math_lean_lib 查重/.test(ex.prompt || ''), 'the work line tells members to check the reuse library first')
+  assert(!!ex && /归档前先跑通（vibe_math_lean_run 或 run=true）；跑不通的定义不要进可复用库。/.test(ex.prompt || ''), '★ the work line forbids archiving a definition that has not run green')
+  assert(!!ex && /"formal":\{"target":"<对象id>","decision":"used\|blocked\|defect"/.test(ex.prompt || ''), '★ the WORK-round contract advertises the formal reply field too (otherwise a working agent has nowhere to write its judgement)')
+  // Every agent-facing string must name the REGISTERED tools: an abbreviated `lean_archive`
+  // is not a tool that exists, and agents copy these literals verbatim (contract §6 hard req. 1).
+  const workText = (ex.prompt || '') + '\n' + reviewText + '\n' + debate
+  assert(!/(^|[^a-z_])lean_(run|archive|lib)/.test(workText), '★ no injected prompt names an abbreviated tool (every occurrence is prefixed)')
+  const offHost = await makeCase('enc-off')
+  await offHost.call('vibe_math_add_problem', { id: 'qN', description: 'x' })
+  await startScheduler(offHost)
+  await tick(2000)
+  const exN = await waitFor(() => offHost.spawns.find((s) => s.label.startsWith('explorer:qN')), 60, 200)
+  assert(!!exN && !/形式化|Lean/.test(exN.prompt || ''), 'the same prompt in off mode is free of Lean text (injection is mode-computed, not frozen)')
+}
+
+// ---------- 4. the run tool ----------
+section('4 lean_run executes through the subprocess service and reports honestly')
+{
+  const h = await makeCase('run')
+  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
+  // 这一节把 leanAsync 固定为 false：它逐字守卫**同步路径**（旧的 await 语义）。
+  // 异步（默认档）的接口与状态机由后面的「Lean async」小节守卫——两条路径都要有绿灯。
+  await h.call('vibe_math_set_params', { leanAsync: false })
+  assert((await h.call('vibe_math_status', {})).params.leanAsync === false, 'the sync section pins leanAsync=false explicitly')
+  const proj = projRoot(h)
+  mkdirSync(join(proj, 'Formal'), { recursive: true })
+  writeFileSync(join(proj, 'Formal', 'good.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
+  writeFileSync(join(proj, 'Formal', 'bad.lean'), 'theorem t : 1 = 2 := by sorry\n', 'utf8')
+  const before = leanRuns.length
+  const runGood = await h.call('vibe_math_lean_run', { file: 'Formal/good.lean', target: 'pRun' })
+  assert(runGood.ok === true && runGood.exitCode === 0, 'a file with no sorry runs green (' + JSON.stringify({ ok: runGood.ok, exitCode: runGood.exitCode }) + ')')
+  assert(leanRuns.length > before, 'the run really went through the mocked subprocess service')
+  const spec = leanRuns[leanRuns.length - 1]
+  assert(spec.cwd.replace(/\\/g, '/') === proj.replace(/\\/g, '/'), 'the toolchain runs with the PROJECT root as cwd (got ' + spec.cwd + ')')
+  assert(!!spec.stdio && spec.stdio.stdin === 'ignore' && spec.stdio.stdout.maxBytes === 64 * 1024 && spec.stdio.stderr.maxBytes === 64 * 1024, 'stdio is stdin=ignore with a 64KB output cap')
+  assert(typeof spec.graceMs === 'number' && spec.graceMs >= 1000, 'the configured timeout is passed as graceMs (' + spec.graceMs + ')')
+  assert(typeof runGood.command === 'string' && runGood.command.indexOf('good.lean') !== -1, 'the result reports the exact command line')
+  const runBad = await h.call('vibe_math_lean_run', { file: 'Formal/bad.lean' })
+  assert(runBad.ok === false && runBad.exitCode === 1, 'a file that still uses sorry reports a red run')
+  assert(/sorry/.test(runBad.stderr), 'the compiler output is returned verbatim (' + JSON.stringify(runBad.stderr).slice(0, 60) + ')')
+  assert(/修复后重跑/.test(runBad.hint || ''), 'a red run tells the member to fix and rerun')
+  const runMissing = await h.call('vibe_math_lean_run', { file: 'Formal/nope.lean' })
+  assert(runMissing.ok === false && runMissing.code === 'V2_NOT_FOUND', 'a missing file is refused with a typed code (' + runMissing.code + ')')
+  const runNoFile = await h.call('vibe_math_lean_run', {})
+  assert(runNoFile.ok === false && runNoFile.code === 'V2_INVALID_ARGUMENT', 'a run without `file` is refused')
+  // The guard's boundary is the VibeMath ROOT, not the project: the global reuse library
+  // deliberately lives at <VibeMath>/Formal/{Lib,Proved}, so climbing out of the project but
+  // staying inside VibeMath is legal (it just fails as a missing file).
+  const runOutOfProject = await h.call('vibe_math_lean_run', { file: '../../Formal/Lib/x.lean' })
+  assert(runOutOfProject.ok === false && runOutOfProject.code === 'V2_NOT_FOUND',
+    'climbing out of the project but staying inside the VibeMath root is ALLOWED (got ' + runOutOfProject.code + ')')
+  const runEscape = await h.call('vibe_math_lean_run', { file: '../../../../etc/evil.lean' })
+  assert(runEscape.ok === false && runEscape.code === 'V2_INVALID_ARGUMENT', '★ a traversal that climbs ABOVE the VibeMath root is refused')
+  const runEscape2 = await h.call('vibe_math_lean_run', { file: 'Formal/../../../../../evil.lean' })
+  assert(runEscape2.ok === false && runEscape2.code === 'V2_INVALID_ARGUMENT', 'a deeper traversal is refused too')
+  const runEscape3 = await h.call('vibe_math_lean_run', { file: '/etc/evil.lean' })
+  assert(runEscape3.ok === false && runEscape3.code === 'V2_INVALID_ARGUMENT', 'an unrelated absolute path is refused')
+  const runEscape4 = await h.call('vibe_math_lean_run', { file: 'C:/Windows/evil.lean' })
+  assert(runEscape4.ok === false && runEscape4.code === 'V2_INVALID_ARGUMENT', 'an unrelated Windows absolute path is refused')
+  const runNotLean = await h.call('vibe_math_lean_run', { file: 'Formal/good.txt' })
+  assert(runNotLean.ok === false && runNotLean.code === 'V2_INVALID_ARGUMENT', 'only .lean files can be executed')
+  assert(/VibeMath/.test(runEscape.message || ''), 'the refusal names the boundary it enforced')
+  mkdirSync(join(vibeRoot(h), 'Formal', 'Lib'), { recursive: true })
+  writeFileSync(join(vibeRoot(h), 'Formal', 'Lib', 'abs.lean'), 'def absTest := 1\n', 'utf8')
+  const runAbs = await h.call('vibe_math_lean_run', { file: join(vibeRoot(h), 'Formal', 'Lib', 'abs.lean').replace(/\\/g, '/') })
+  assert(runAbs.ok === true, 'an absolute path inside the VibeMath root is accepted')
+  const rec = formalStateOf(h)
+  assert(!!rec.records && !!rec.records.pRun && rec.records.pRun.status === 'attempted', 'a green lean_run records the object as attempted (stored, not promoted)')
+  assert(!!rec.records.pRun.run && rec.records.pRun.run.ok === true && rec.records.pRun.run.exitCode === 0, 'the run record keeps ok/exitCode')
+  assert(rec.records.pRun.run.stdoutTail !== undefined && rec.records.pRun.run.stderrTail !== undefined, 'the run record keeps truncated output tails')
+  toolchainAvailable = false
+// task-6: the missing-toolchain simulation must deny the KNOWN-LOCATION fallback too (a machine with
+// Lean installed would otherwise resolve it through %ELAN_HOME%/~/.elan and the run would succeed).
+const _tcSaved = {}; for (const _k of ['ELAN_HOME', 'USERPROFILE', 'HOME', 'LOCALAPPDATA']) _tcSaved[_k] = process.env[_k]
+process.env.ELAN_HOME = 'Z:/no-elan'; process.env.USERPROFILE = 'Z:/no-home'; process.env.HOME = 'Z:/no-home'; process.env.LOCALAPPDATA = 'Z:/no-local'
+try {
+  const runNoTc = await h.call('vibe_math_lean_run', { file: 'Formal/good.lean' })
+  assert(runNoTc.ok === false && runNoTc.code === 'LEAN_NOT_FOUND', 'a missing toolchain returns LEAN_NOT_FOUND instead of crashing')
+  assert(/仍可把形式化代码写下来归档/.test(runNoTc.message), 'the failure explains the graceful degradation')
+} finally { for (const _k of Object.keys(_tcSaved)) { if (_tcSaved[_k] === undefined) delete process.env[_k]; else process.env[_k] = _tcSaved[_k] } }
+  toolchainAvailable = true
+  const noSub = await makeCase('nosub', { noSubprocess: true })
+  mkdirSync(join(projRoot(noSub), 'Formal'), { recursive: true })
+  writeFileSync(join(projRoot(noSub), 'Formal', 'x.lean'), 'theorem x : 1 = 1 := rfl\n', 'utf8')
+  const noSubRun = await noSub.call('vibe_math_lean_run', { file: 'Formal/x.lean' })
+  assert(noSubRun.ok === false && noSubRun.code === 'NO_SUBPROCESS', 'a host without the subprocess service returns NO_SUBPROCESS and does not crash (got ' + noSubRun.code + ')')
+  const noSubStatus = await noSub.call('vibe_math_status', {})
+  assert(noSubStatus.ok === true, 'the scheduler still answers status after that (nothing was thrown into the loop)')
+}
+
+// ---------- 4b. the timeout must STOP the process, not just report it ----------
+// Contract §7: "必须给 cwd…，并对超时调用 handle.terminate()". Reporting LEAN_TIMEOUT while the Lean
+// process keeps running is a silent resource leak, and the framework's own contract says otherwise.
+section('4b lean_run ACTIVELY terminates on timeout (contract §7)')
+{
+  const h = await makeCase('timeout')
+  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
+  const proj = projRoot(h)
+  mkdirSync(join(proj, 'Formal'), { recursive: true })
+  writeFileSync(join(proj, 'Formal', 'hang.lean'), 'theorem t : 1 = 1 := rfl -- HANG\n', 'utf8')
+  writeFileSync(join(proj, 'Formal', 'fast.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
+  const before = terminations.length
+  const t0 = Date.now()
+  const run = await h.call('vibe_math_lean_run', { file: 'Formal/hang.lean', timeout_ms: 1000 })
+  const elapsed = Date.now() - t0
+  assert(run.ok === false && run.code === 'LEAN_TIMEOUT', '★ a run that outlives its timeout is reported as LEAN_TIMEOUT (got ' + run.code + ')')
+  assert(run.timedOut === true, 'the result carries timedOut=true')
+  assert(terminations.length === before + 1 && /hang\.lean/.test(terminations[terminations.length - 1].file),
+    '★★ the timeout ACTIVELY called handle.terminate() (graceMs alone does not stop a lingering Lean process)')
+  assert(elapsed < 2400, 'the call returned AT its timeout instead of waiting the process out (took ' + elapsed + 'ms)')
+  const fast = await h.call('vibe_math_lean_run', { file: 'Formal/fast.lean' })
+  assert(fast.ok === true && fast.timedOut === false, 'a normal run still reports success')
+  assert(terminations.length === before + 1, 'a normal run terminates nothing')
+  await sleep(60)
+  assert(liveTimers.size === 0, '★ no timeout timer is left pending after either run (it is cleared as soon as `done` wins)')
+}
+
+// ---------- 5. archive: def / lemma / proof / blocked ----------
+section('5 lean_archive writes the contract paths and indexes')
+{
+  const h = await makeCase('arc')
+  await h.call('vibe_math_set_params', { formalVerify: 'encourage' })
+  const proj = projRoot(h)
+  const libPath = join(vibeRoot(h), 'Formal', 'Lib')
+  const provedPath = join(vibeRoot(h), 'Formal', 'Proved')
+  const defRes = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'ZMod5', content: 'def ZMod5 := Fin 5\n' })
+  assert(defRes.ok === true && defRes.file === 'Formal/Lib/ZMod5.lean', 'a reusable definition is archived to the global lib (' + defRes.file + ')')
+  assert(existsSync(join(libPath, 'ZMod5.lean')), '★ the definition exists under <VibeMath>/Formal/Lib/ (cross-project, NOT inside the project)')
+  assert(!existsSync(join(proj, 'Formal', 'Lib', 'ZMod5.lean')), 'it is NOT duplicated inside the project tree')
+  assert(!!defRes.run && defRes.run.ok === true, 'the archived definition was executed (kind=def runs by default)')
+  const lemmaRes = await h.call('vibe_math_lean_archive', { kind: 'lemma', name: 'sq_odd', content: 'theorem sq_odd (n : Nat) : Odd (n*n) → Odd n := by omega\n' })
+  assert(lemmaRes.ok === true && lemmaRes.file === 'Formal/Proved/sq_odd.lean', 'a lemma is archived to the global Proved/ (' + lemmaRes.file + ')')
+  assert(existsSync(join(provedPath, 'sq_odd.lean')), 'the lemma exists under <VibeMath>/Formal/Proved/')
+  const defNoRun = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'quiet', content: 'def quiet := 2\n', run: false })
+  assert(defNoRun.ok === true && defNoRun.run === undefined, 'run:false archives without executing (still indexed)')
+  assert(/ZMod5/.test(readIf(join(libPath, 'Index.md'))), 'Lib/Index.md lists the new definition')
+  assert(/quiet/.test(readIf(join(libPath, 'Index.md'))), 'Lib/Index.md lists the run:false definition too')
+  assert(/sq_odd/.test(readIf(join(provedPath, 'Index.md'))), 'Proved/Index.md lists the new lemma')
+  writeFileSync(join(proj, 'Formal', 'src.lean'), 'def copied := 3\n', 'utf8')
+  const defFrom = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'copied', from: 'Formal/src.lean' })
+  assert(defFrom.ok === true && existsSync(join(libPath, 'copied.lean')), 'kind=def can archive from an existing .lean file')
+  // The tool RESULT is agent-facing text too: a definition whose run just failed must not be advertised
+  // as "directly importable" (contract §6 hard req. 3 / 实现方案 §9.4 — a red file must not be presented
+  // as usable, whatever the framework decides to do with the file itself).
+  const defRed = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'polluted', content: 'def polluted := 1 -- FAIL\n' })
+  assert(defRed.ok === true && !!defRed.run && defRed.run.ok === false, 'a definition that does not compile is reported as a red run')
+  assert(!/可直接 import 复用/.test(defRed.note || ''), '★ a red definition must NOT be advertised as directly reusable')
+  assert(/运行未通过/.test(defRed.note || ''), '…and the note says what to do instead')
+  const fromOutside = await h.call('vibe_math_lean_archive', { kind: 'def', name: 'escape', from: '../../../../etc/passwd' })
+  assert(fromOutside.ok === false && fromOutside.code === 'V2_INVALID_ARGUMENT', 'from=<path outside the VibeMath root> is refused')
+  const noName = await h.call('vibe_math_lean_archive', { kind: 'def', content: 'def x := 1\n' })
+  assert(noName.ok === false && noName.code === 'V2_INVALID_ARGUMENT', 'archiving a definition without a name is refused')
+  const noBody = await h.call('vibe_math_lean_archive', { kind: 'lemma', name: 'xb' })
+  assert(noBody.ok === false && noBody.code === 'V2_INVALID_ARGUMENT', 'archiving a lemma with neither content nor from is refused')
+  const badKind = await h.call('vibe_math_lean_archive', { kind: 'nonsense' })
+  assert(badKind.ok === false && badKind.code === 'V2_INVALID_ARGUMENT', 'an unknown archive kind is refused')
+  const noTarget = await h.call('vibe_math_lean_archive', { kind: 'proof', content: 'theorem x : 1 = 1 := rfl\n' })
+  assert(noTarget.ok === false && noTarget.code === 'V2_INVALID_ARGUMENT', 'kind=proof without a target is refused')
+  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pProof', content: 'theorem p_proof : 3 * 1 ^ 2 - 2 = (1:Nat) ^ 2 := by decide\n' })
+  assert(proof.ok === true && proof.passed === true, 'a passing proof is archived (' + JSON.stringify({ ok: proof.ok, passed: proof.passed }) + ')')
+  assert(proof.file === 'Formal/pProof.lean', 'the working file is Formal/<target>.lean')
+  assert(proof.proof === 'Verified/Lean/pProof.lean', 'the archived proof path is Verified/Lean/<target>.lean')
+  assert(existsSync(join(proj, 'Formal', 'pProof.lean')), 'the working file exists on disk')
+  assert(existsSync(join(proj, 'Verified', 'Lean', 'pProof.lean')), '★ the proof is archived under Verified/Lean/')
+  assert(proof.status === 'passed', 'the object status becomes passed')
+  const proofBad = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pRed', content: 'theorem p_red : 1 = 2 := by sorry\n' })
+  assert(proofBad.ok === true && proofBad.passed === false && proofBad.status === 'attempted', 'a red proof is recorded as attempted (not passed)')
+  assert(!existsSync(join(proj, 'Verified', 'Lean', 'pRed.lean')), 'a red proof is NOT archived under Verified/Lean/')
+  assert(/sorry/.test((proofBad.run && proofBad.run.stderr) || ''), 'the red run keeps the compiler output for the member to fix')
+  const st = await h.call('vibe_math_status', {})
+  assert(st.formal.objects.some((o) => o.target === 'pProof' && o.status === 'passed'), 'status lists the passed object')
+  const idx = readIf(join(proj, 'Formal', 'Index.md'))
+  assert(/pProof/.test(idx) && /passed/.test(idx) && /Verified\/Lean\/pProof\.lean/.test(idx), 'Formal/Index.md indexes the object, its status and its archived proof')
+  assert(/pRed/.test(idx) && /attempted/.test(idx), 'Formal/Index.md also records the failed attempt')
+  const blkNoNote = await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'pBlk' })
+  assert(blkNoNote.ok === false && blkNoNote.code === 'V2_INVALID_ARGUMENT', 'blocked without a note is refused')
+  const blk = await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'pBlk', note: '需要外层解析数论框架，本轮工作量不可接受' })
+  assert(blk.ok === true && blk.status === 'blocked', 'a reasoned blocker is recorded')
+  assert(/需要外层解析数论框架/.test(readIf(join(proj, 'Formal', 'Index.md'))), 'the blocker reason reaches the index')
+  const stBlk = await h.call('vibe_math_status', {})
+  assert(stBlk.formal.objects.some((o) => o.target === 'pBlk' && o.status === 'blocked'), 'status lists the blocked object')
+  const lib = await h.call('vibe_math_lean_lib', {})
+  assert(lib.ok === true && lib.counts.lib >= 3 && lib.counts.proved >= 1, 'lean_lib reports the reuse library sizes (' + JSON.stringify(lib.counts) + ')')
+  assert(lib.objects.some((o) => o.target === 'pProof' && o.status === 'passed'), 'lean_lib lists the per-object formal status')
+  assert(/复用优先/.test(lib.hint || ''), 'lean_lib tells agents to reuse before redefining')
+  assert(lib.mode === 'encourage', 'lean_lib reports the active mode')
+  const noRefresh = await h.call('vibe_math_lean_lib', { refresh: false })
+  assert(noRefresh.rebuilt === false && noRefresh.counts.lib === null, 'refresh:false lists without rebuilding')
+  assert(existsSync(join(proj, 'Formal', 'Index.md')), 'the project Formal/Index.md exists')
+  assert(existsSync(join(libPath, 'Index.md')) && existsSync(join(provedPath, 'Index.md')), 'the two GLOBAL indexes exist')
+}
+
+// ---------- 6. a passing proof flips the review to FIDELITY ----------
+section('6 a passing proof flips the review subject to fidelity')
+{
+  const h = await makeCase('fid')
+  await h.call('vibe_math_set_params', { formalVerify: 'encourage', maxParallelThreshold: 8 })
+  // v2's scheduler STOPS itself when there is no unsolved problem, no agent and no task; a
+  // case that only wants to verify a proposition therefore needs one live problem to keep
+  // the tick loop alive (otherwise no verification would ever be started).
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'r-pFid', content: 'theorem p_fid : 2 + 2 = 4 := by decide\n' })
+  await h.call('vibe_math_add_proposition', { id: 'pFid', 概述: '2+2=4（已有 Lean 证明）', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  // 0.5 in round 1 forces a debate round whose prompt must ALSO carry the fidelity wording
+  const vs = await verifyWithDebate(h, 'r-pFid', 0.5, 1)
+  assert(!!vs.first, 'a verifier was spawned for the Lean-passed object')
+  const vp = h.spawns.find((s) => s.label === 'verifier:r-pFid:0')
+  const vpText = vp ? vp.prompt : ''
+  assert(/该对象已有\*\*通过的 Lean 形式化证明\*\*/.test(vpText), 'the review prompt announces the passing proof')
+  assert(/你不需要重新检查推导/.test(vpText), '★ it tells reviewers NOT to re-derive')
+  assert(/忠实性审查/.test(vpText), '★ it tells reviewers the review subject is now fidelity')
+  assert(/定义 \/ 对象 \/ 条件 \/ 假设 \/ 结论是否与命题原文\*\*完全一致\*\*/.test(vpText), 'it enumerates exactly what fidelity means')
+  assert(/Verified\/Lean\/r-pFid\.lean/.test(vpText), 'it points at the archived proof')
+  assert(/一致 → Result = 1/.test(vpText), '★ the fidelity guidance names the REAL field (v2\'s contract field is Result)')
+  assert(!/verdict/.test(vpText), '★ the fidelity guidance never names a `verdict` field (that vote would be silently dropped)')
+  assert(/发现任何偏差，不要投 0/.test(vpText), '★ a fidelity defect is explicitly NOT to be voted as 0 (it is not a refutation)')
+  assert(/formal:\{decision:'defect'/.test(vpText), '★ the reviewers are given the defect reply channel that withdraws the proof')
+  assert(!/偏离 → 0/.test(vpText), '★ the "any deviation → 0" instruction is gone (it would fabricate a false conclusion)')
+  assert(!/请先判断该对象的\*\*实现难度\*\*/.test(vpText), 'the "judge the difficulty first" wording is gone when a proof already exists')
+  // The withdrawal sentence must match the MODE's real strength (contract §4.1 pt.3 / §6.1; this case is
+  // 'encourage'): encouraging mode has NO gate, so the framework cannot hold the verdict — promising a
+  // hold there is a lie the voter would rely on (AUDIT-CHECKLIST §1.7, "提示词承诺的强度档位").
+  assert(/本档没有门禁/.test(vpText), '★ encourage fidelity text says THIS MODE HAS NO GATE (the framework cannot hold the verdict)')
+  assert(!/本次裁定\*\*不定论\*\*/.test(vpText), '★ encourage must NOT promise a hold the framework cannot enforce')
+  const debate = h.followups.map((f) => f.prompt || '').filter((p) => /DEBATE/.test(p)).join('\n')
+  assert(/你不需要重新检查推导/.test(debate), '★ the debate prompt for a Lean-passed object also asks for fidelity, not re-derivation')
+  assert(/发现任何偏差，不要投 0/.test(debate), '★ and it carries the same no-zero rule in the debate round')
+  assert(/本档没有门禁/.test(debate), '★ the debate round carries the same mode-qualified withdrawal wording')
+  await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'r-pBlk2', note: '涉及未形式化的分析学前置' })
+  await h.call('vibe_math_add_proposition', { id: 'pBlk2', 概述: '已记录阻塞的命题', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs2 = await verifyWithDebate(h, 'r-pBlk2', 0.5, 1)
+  assert(!!vs2.first, 'verifiers spawned for the blocked object')
+  const vp2 = h.spawns.find((s) => s.label === 'verifier:r-pBlk2:0')
+  const vp2Text = vp2 ? vp2.prompt : ''
+  assert(/该对象已被记录为\*\*形式化阻塞\*\*/.test(vp2Text), 'a blocked object is announced as such')
+  assert(/涉及未形式化的分析学前置/.test(vp2Text), 'the blocker reason is shown to the reviewers')
+  assert(/这个阻塞判断是否成立/.test(vp2Text), 'the verdict guidance asks whether the blocker is justified')
+}
+
+// ---------- 7. the 'require' gate (proposition) ----------
+section("7 'require' withholds a verdict until the formal record exists")
+{
+  const h = await makeCase('gate')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  // a live problem keeps the scheduler from stopping itself (see the comment in case 6)
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  await h.call('vibe_math_add_proposition', { id: 'pGate', 概述: '必须形式化的命题', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pGate'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs, 'verifiers were spawned under require mode')
+  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pGate:0') || {}).prompt || ''
+  assert(/【Lean 形式化验证（强制模式）】/.test(vp), 'the review prompt says 强制模式')
+  assert(/必须产出 Lean 形式化/.test(vp), "'require' states the formalization is mandatory")
+  assert(/本次裁定不会生效/.test(vp), 'the prompt warns that the verdict will not take effect without it')
+  assert(/formal-required/.test(vp), 'the prompt names the machine-readable reason')
+  assert(/vibe_math_lean_archive kind='blocked' note=… 或回执 formal\.note/.test(vp), '★ the require wording names BOTH blocking routes with the FULL tool name')
+  assert(/"formal":\{"target":"r-pGate","decision":"used\|blocked\|defect"/.test(vp), '★ the require review contract carries the formal reply field keyed by the verification id')
+  assert(!/(^|[^a-z_])lean_(run|archive|lib)/.test(vp), '★ the require prompt contains no abbreviated tool name either')
+  fireVerdicts(h, vs, 1)
+  // The deferral writes Formal/TODO.md from INSIDE the settle path; waiting for that file is
+  // the observable proof that the round settled (the task is dropped right after).
+  const todoSettled = await waitFor(() => /pGate/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 40, 150)
+  assert(!!todoSettled, 'the deferred round settled (Formal/TODO.md recorded the object)')
+  await tick(600)
+  const propFile = join(proj, 'Propos', '数论_Propos.json')
+  const props = JSON.parse(readIf(propFile) || '[]')
+  const pGate = props.find((x) => x.id === 'pGate') || {}
+  assert(pGate.布尔估计 === 0.5, "★ the verdict did NOT take effect: the proposition's 布尔估计 is unchanged (got " + pGate.布尔估计 + ')')
+  assert(!(pGate.证明列表 || []).some((x) => x.正确概率 === 1), 'no probability-1 proof entry was recorded')
+  assert(pGate.优先级 !== 'never', 'the priority was not pinned to never')
+  assert(!existsSync(join(proj, 'Verified', '数论_Verified.json')), '★ no Verified card was written')
+  const todo = readIf(join(proj, 'Formal', 'TODO.md'))
+  assert(existsSync(join(proj, 'Formal', 'TODO.md')), 'Formal/TODO.md was created')
+  assert(/pGate/.test(todo) && /formal-required/.test(todo), '★ the object is on the formalization TODO with the machine-readable reason')
+  const recAfterGate = formalStateOf(h)
+  // record key = the verification object id (rId), which is what lean_archive target= also uses
+  assert(!!recAfterGate.records && !!recAfterGate.records['r-pGate'] && !!recAfterGate.records['r-pGate'].deferredAt, 'the deferral is persisted in the durable formal state (survives resume)')
+  assert(!!recAfterGate.records['r-pGate'] && recAfterGate.records['r-pGate'].status === 'none', 'the object stays at status none (nothing was formalized)')
+  const vlogs = existsSync(join(proj, 'Verification_logs')) ? readdirSync(join(proj, 'Verification_logs')) : []
+  assert(vlogs.some((f) => f.startsWith('r-pGate')), '★ the verification round DID complete (its debate log exists) — the gate withheld the conclusion, it did not stall the round')
+  const st1 = await h.call('vibe_math_status', {})
+  assert(/require 模式搁置/.test(JSON.stringify(st1.recentActivity)), 'the withholding is announced on v2-readable channel (activity log; v2 has no Shared/Chat/)')
+  assert(st1.formal.todo.some((t) => t.id === 'r-pGate'), 'status exposes the formalization TODO')
+  const rep = await h.call('vibe_math_report', {})
+  assert(!!rep.formal && rep.formal.required === true && rep.formal.mode === 'require', 'the report exposes the formal mode and gate flag')
+  assert(rep.recentActivity.some((a) => /formal-gate/.test(a.event)), 'the deferral also lands in the report log')
+  // The deferral leaves this project with no agent, task or solved problem, and v2's strict
+  // termination stops the scheduler there — so a case that wants to RE-verify the object after
+  // formalizing it must (re)start the scheduler, exactly as a human would.
+  await startScheduler(h)
+  const proofNow = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pGate', content: 'theorem p_gate : 2 + 2 = 4 := by decide\n' })
+  assert(proofNow.ok === true && proofNow.passed === true, 'the object is now Lean-passed')
+  const spawned2 = await verifyWithDebate(h, 'r-pGate', 1, 0)
+  assert(!!spawned2.first, 'the object was re-verified after the proof was archived')
+  const props2 = JSON.parse(readIf(propFile) || '[]')
+  const pGateNow = props2.find((x) => x.id === 'pGate') || {}
+  assert(pGateNow.布尔估计 === 1, '★ with a passing Lean artifact the same unanimous verdict DOES take effect (布尔估计=1)')
+  const cardFile = join(proj, 'Verified', '数论_Verified.json')
+  const cards = JSON.parse(readIf(cardFile) || '[]')
+  const card = cards.find((c) => c.id === 'pGate')
+  assert(!!card, '★ the Verified card was written after the proof passed')
+  assert(!!card && /Lean 通过/.test(card['形式化'] || ''), '★ the card records how strong the result is (Lean 通过)')
+  assert(!!card && /Verified\/Lean\/pGate\.lean/.test(card['形式化'] || ''), 'the card points at the archived proof')
+  await h.call('vibe_math_add_proposition', { id: 'pBlkOk', 概述: '记录阻塞后可定论', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const sp3 = await waitFor(() => { const x = verifiersOf(h, 'r-pBlkOk'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!sp3, 'verifiers spawned for the blocker-escape case')
+  await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'r-pBlkOk', note: '命题涉及未形式化的分析学，本轮不做' })
+  fireVerdicts(h, sp3 || [], 1)
+  await waitFor(() => { const c = JSON.parse(readIf(cardFile) || '[]').find((x) => x.id === 'pBlkOk'); return c ? c : undefined }, 40, 150)
+  await tick(400)
+  const cards3 = JSON.parse(readIf(cardFile) || '[]')
+  const card3 = cards3.find((c) => c.id === 'pBlkOk')
+  assert(!!card3, '★ an explicit reasoned blocker also lets the verdict through (decide by difficulty, but decide out loud)')
+  assert(!!card3 && /阻塞（/.test(card3['形式化'] || ''), 'the card records the blocker')
+  assert(!!card3 && /未形式化的分析学/.test(card3['形式化'] || ''), 'the card records the blocker REASON, not just the fact')
+}
+
+// ---------- 8. the gate covers the qs (problem) choke point ----------
+section('8 the gate also covers a problem-solution verdict')
+{
+  const h = await makeCase('gq')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  // a live problem keeps the scheduler from stopping itself (see the comment in case 3)
+  await h.call('vibe_math_add_problem', { id: 'qStay', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  await h.call('vibe_math_add_problem', { id: 'qG', description: '带解法的 require 门禁问题', priority: 1 })
+  const qsFile = join(proj, 'qs', 'qs.json')
+  const qs0 = JSON.parse(readIf(qsFile) || '[]')
+  qs0.find((q) => q.id === 'qG').解法列表 = [{ 完整解法: 'closing argument', 正确概率: 0.8, 已验: false }]
+  writeFileSync(qsFile, JSON.stringify(qs0, null, 2), 'utf8')
+  await tick(2000)
+  const sp = await waitFor(() => { const x = verifiersOf(h, 'r-qG-s0'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!sp, 'verifiers spawned for the problem solution')
+  fireVerdicts(h, sp || [], 1)
+  const todoG = await waitFor(() => /qG/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 40, 150)
+  assert(!!todoG, 'the deferred problem round settled (Formal/TODO.md recorded it)')
+  await tick(600)
+  const qs1 = JSON.parse(readIf(qsFile) || '[]')
+  const qG = qs1.find((q) => q.id === 'qG')
+  assert(!!qG && qG.已解决 !== true, '★ the problem was NOT marked solved (the require gate blocked the promotion)')
+  assert(!!qG && qG.解法列表[0].正确概率 !== 1, "the solution's probability was left as it was")
+  assert(!existsSync(join(proj, 'Verified', '问题_Verified.json')), 'no problem Verified card was written')
+  assert(/qG/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 'the problem is on the formalization TODO')
+  await h.call('vibe_math_lean_archive', { kind: 'blocked', target: 'qG', note: '问题的形式化超出本轮工作量' })
+  await startScheduler(h) // see case 7: the deferral may have stopped the scheduler
+  const sp2 = await verifyWithDebate(h, 'r-qG-s0', 1, 0)
+  assert(!!sp2.first, 'the problem solution was re-verified after the blocker was recorded')
+  const qs2 = JSON.parse(readIf(qsFile) || '[]')
+  const qG2 = qs2.find((q) => q.id === 'qG')
+  assert(!!qG2 && qG2.已解决 === true, 'with a reasoned blocker the problem DOES close')
+  assert(!!qG2 && qG2.解法列表[0].正确概率 === 1, 'the solution probability becomes 1 after the gate opened')
+  const cards = JSON.parse(readIf(join(proj, 'Verified', '问题_Verified.json')) || '[]')
+  const card = cards.find((c) => c.id === 'qG')
+  assert(!!card && /阻塞（/.test(card['形式化'] || ''), 'the problem card records the formal status')
+  assert(!existsSync(join(vibeRoot(h), 'Formal', 'Lib', 'qG.lean')), 'a blocked record does not fabricate a library file')
+}
+
+// ---------- 9. persistence across resume ----------
+section('9 the formal state survives resume (v2 has no session projection)')
+{
+  const h = await makeCase('persist')
+  await h.call('vibe_math_set_params', { formalVerify: 'require' })
+  await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pPersist', content: 'theorem p_persist : 1 + 1 = 2 := by decide\n' })
+  const before = await h.call('vibe_math_status', {})
+  assert(before.formal.objects.some((o) => o.target === 'pPersist' && o.status === 'passed'), 'the object is passed before the restart')
+  const proj = projRoot(h)
+  writeFileSync(join(proj, 'VibeMath_State', 'process_epoch.json'), JSON.stringify('OLD-PROCESS-EPOCH'), 'utf8')
+  const res = await h.call('vibe_math_resume', {})
+  assert(res.ok === true, 'resume succeeded')
+  const after = await h.call('vibe_math_status', {})
+  assert(after.formal.objects.some((o) => o.target === 'pPersist' && o.status === 'passed'),
+    '★ the Lean-passed object is still passed after resume (the gate does not forget)')
+  assert(/pPersist/.test(readIf(join(proj, 'Formal', 'Index.md'))), 'Formal/Index.md still indexes it (the files are the readable mirror)')
+}
+
+// ---------- 10. the gate is a no-op unless require ----------
+section("10 'encourage' never gates (a verdict still lands with no Lean artifact)")
+{
+  const h = await makeCase('nogate')
+  await h.call('vibe_math_set_params', { formalVerify: 'encourage', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  await h.call('vibe_math_add_proposition', { id: 'pFree', 概述: '鼓励模式不设门禁', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await verifyWithDebate(h, 'r-pFree', 1, 0)
+  assert(!!vs.first, 'verifiers spawned under encourage mode')
+  const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
+  const p = props.find((x) => x.id === 'pFree') || {}
+  assert(p.布尔估计 === 1, "'encourage' finalizes normally with NO Lean artifact (布尔估计=1)")
+  const cards = JSON.parse(readIf(join(proj, 'Verified', '数论_Verified.json')) || '[]')
+  assert(!!cards.find((c) => c.id === 'pFree'), "'encourage' writes the Verified card")
+  assert(!existsSync(join(proj, 'Formal', 'TODO.md')) || !/pFree/.test(readIf(join(proj, 'Formal', 'TODO.md'))), 'no formalization TODO is created in encourage mode')
+}
+
+// ---------- 11. the reply channel is REAL (contract §4 / §6.3 / §10.8) ----------
+// The first version of this feature only WROTE "请在回执的 formal 字段写明难度判断" into the prompt
+// and never parsed it: 177 green assertions guarded a dead channel (AUDIT-CHECKLIST §2.2). These
+// cases feed a genuine agent reply through the framework's own dispatch path (subagent/end →
+// handleVerifier → absorb) and assert the DURABLE record, not the wording.
+section('11 the reply channel really lands in the record (blocked / note validation)')
+{
+  const h = await makeCase('reply')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  await h.call('vibe_math_add_proposition', { id: 'pReply', 概述: '用回执记录阻塞', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pReply'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs, 'verifiers were spawned for the reply-channel proposition')
+  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pReply:0') || {}).prompt || ''
+  assert(/"formal":\{"target":"r-pReply","decision":"used\|blocked\|defect"/.test(vp), '★ the review contract itself advertises the formal field, keyed by the verification id')
+  if (vs) {
+    // ① `blocked` WITH a note, named by the VERIFICATION id → the OBJECT record must be synced too.
+    replyFrom(h, vs[0].childId, { Result: 0.5, Reason: '我判断形式化不划算', formal: { target: 'r-pReply', decision: 'blocked', note: '需要大量未形式化的实分析前置知识' } })
+    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['r-pReply'] && r['r-pReply'].status === 'blocked') ? r : undefined }, 40, 150)
+    assert(!!rec, '★ a `formal.decision=blocked` reply is really absorbed — the channel is not dead code')
+    assert(!!rec && rec['r-pReply'].decision === 'blocked' && /实分析前置知识/.test(rec['r-pReply'].note || ''), 'the record keeps the decision AND the reason')
+    assert(!!rec && !!rec['pReply'] && rec['pReply'].status === 'blocked' && /实分析前置知识/.test(rec['pReply'].note || ''), '★ the OBJECT-id record is synced too (the two id spaces must not drift)')
+    assert(/实分析前置知识/.test(readIf(join(projRoot(h), 'Formal', 'Index.md'))), 'the reply-recorded blocker reaches Formal/Index.md')
+    // ② `blocked` WITHOUT a note (a different target) → refused with V2_INVALID_ARGUMENT, no record.
+    replyFrom(h, vs[1].childId, { Result: 0.5, Reason: '不想做', formal: { target: 'r-pNoNote', decision: 'blocked' } })
+    let acts = ''
+    for (let i = 0; i < 25; i++) {
+      const st = await h.call('vibe_math_status', {})
+      acts = (st.recentActivity || []).map((a) => a.detail).join('\n')
+      if (/V2_INVALID_ARGUMENT/.test(acts)) break
+      await sleep(120)
+    }
+    assert(/V2_INVALID_ARGUMENT/.test(acts), '★ a blocked/defect judgement without a note is REJECTED with V2_INVALID_ARGUMENT')
+    assert(/没有写明 note/.test(acts), 'the refusal says why (an explicit decision is required, never a silent skip)')
+    const recN = formalStateOf(h)
+    assert(!(recN.records || {})['r-pNoNote'] && !(recN.records || {})['pNoNote'], 'no record is invented for the refused judgement')
+    assert(!/pNoNote/.test(readIf(join(projRoot(h), 'Formal', 'Index.md'))), 'the refused judgement does not reach the index either')
+    // ③ a reply with NO target must not invent an object (safeId('') would fall back to 'anon').
+    // The 0.5/0.5 round has no consensus, so the debate round re-woke both children — that is the
+    // observable proof that these children are registered and can answer again.
+    const woke = await waitFor(() => (h.followups.filter((f) => /DEBATE/.test(f.prompt || '')).length >= 2 ? true : undefined), 40, 150)
+    assert(!!woke, 'the debate round re-woke the verifiers (round-2 replies reach the framework again)')
+    replyFrom(h, vs[0].childId, { Result: 0.5, Reason: '漏写 target', formal: { decision: 'blocked', note: '没有写 target' } })
+    let acts2 = ''
+    for (let i = 0; i < 25; i++) {
+      const st = await h.call('vibe_math_status', {})
+      acts2 = (st.recentActivity || []).map((a) => a.detail).join('\n')
+      if (/没有 target/.test(acts2)) break
+      await sleep(120)
+    }
+    assert(/没有 target/.test(acts2), '★ a `formal` reply without a target is refused, not guessed')
+    const recT = formalStateOf(h)
+    assert(!(recT.records || {}).anon, '★ a `formal` reply without a target cannot invent a record (no "anon" object)')
+  }
+}
+
+// ---------- 12. `defect`: a fidelity defect is NOT "the proposition is false" (§4.1) ----------
+section('12 a defect reply withdraws the proof, writes the TODO and defers the verdict')
+{
+  const h = await makeCase('defect')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  // A PASSING Lean proof exists for the object — archived under the OBJECT id, the realistic path.
+  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pDefect', content: 'theorem p_defect : 2 + 2 = 4 := by decide\n' })
+  assert(proof.ok === true && proof.passed === true, 'precondition: the object starts Lean-passed')
+  const proofFile = join(proj, 'Verified', 'Lean', 'pDefect.lean')
+  assert(existsSync(proofFile), 'the archived proof exists before the defect is reported')
+  await h.call('vibe_math_add_proposition', { id: 'pDefect', 概述: '形式化写窄了的命题', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pDefect'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs, 'verifiers were spawned for the Lean-passed object')
+  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pDefect:0') || {}).prompt || ''
+  assert(/忠实性审查/.test(vp) && /不要投 0/.test(vp), 'the reviewers were told to audit fidelity and NOT to vote 0 on a defect')
+  // In REQUIRE mode the framework really does hold the verdict, so THAT promise is the correct one here.
+  assert(/本次裁定\*\*不定论\*\*/.test(vp), '★ require fidelity text does promise the hold (the gate really enforces it)')
+  assert(!/本档没有门禁/.test(vp), 'require must not claim it has no gate')
+  const DEFECT = 'Lean 只证了 n>0 的情形，命题原文是 n≥0'
+  if (vs) {
+    // A fidelity defect: the voter ABSTAINS (0.3) and records it through the reply channel.
+    replyFrom(h, vs[0].childId, { Result: 0.3, Reason: '形式化写窄了（弃权）', formal: { target: 'pDefect', decision: 'defect', note: DEFECT } })
+    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pDefect'] && r['pDefect'].decision === 'defect') ? r : undefined }, 40, 150)
+    assert(!!rec, '★ the defect reply is absorbed')
+    assert(!!rec && rec['pDefect'].status === 'attempted', '★ the object is DOWNGRADED to attempted (the "passed" status is withdrawn)')
+    assert(!!rec && rec['pDefect'].proof === '', '★ the proof pointer is cleared')
+    assert(!!rec && rec['pDefect'].note === DEFECT, 'the concrete deviation is recorded on the object record')
+    assert(!!rec && !!rec['r-pDefect'] && rec['r-pDefect'].status === 'attempted' && rec['r-pDefect'].decision === 'defect', '★ the verification-id record is downgraded too (both id spaces)')
+    assert(!existsSync(proofFile), '★ the archived proof Verified/Lean/pDefect.lean is DELETED')
+    assert(existsSync(join(proj, 'Formal', 'pDefect.lean')), 'the working file Formal/pDefect.lean is kept (the code is not lost)')
+    const todo = readIf(join(proj, 'Formal', 'TODO.md'))
+    assert(/pDefect/.test(todo) && /defect/.test(todo), '★ the object is listed in Formal/TODO.md with the defect reason')
+    assert(/只证了 n>0 的情形/.test(todo), 'the TODO carries the concrete deviation, not just a flag')
+    let acts = ''
+    for (let i = 0; i < 25; i++) {
+      const st = await h.call('vibe_math_status', {})
+      acts = (st.recentActivity || []).map((a) => a.detail).join('\n')
+      if (/忠实性缺陷/.test(acts)) break
+      await sleep(120)
+    }
+    assert(/忠实性缺陷/.test(acts), 'the downgrade is announced on the v2-readable channel (activity log)')
+    assert(/撤回「已通过」状态/.test(acts), 'the announcement says the passed status was withdrawn')
+    assert(/本次裁定不定论/.test(acts), 'and that the verdict is undecided — a defect withdraws a proof, it does not refute the proposition')
+    // Now drive the same round to a UNANIMOUS "true": without the defect it would conclude.
+    const settled = await verifyWithDebate(h, 'r-pDefect', 1, 0)
+    assert(!!settled.first, 'the round was driven to a verdict after the defect')
+    const todo2 = await waitFor(() => { const t = readIf(join(proj, 'Formal', 'TODO.md')); return /formal-required/.test(t) ? t : undefined }, 40, 150)
+    assert(!!todo2 && /r-pDefect/.test(todo2), '★ require mode DEFERS after a defect (the object enters the formalization TODO as formal-required)')
+    await tick(400)
+    const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
+    const p = props.find((x) => x.id === 'pDefect') || {}
+    assert(p.布尔估计 === 0.5, '★★ the proposition is NOT recorded as false — 布尔估计 unchanged (got ' + p.布尔估计 + ')')
+    assert(!(p.证明列表 || []).some((x) => x.正确概率 === 1), 'no probability-1 proof entry was written')
+    assert(p.优先级 !== 'never', 'the priority was not pinned to never')
+    assert(!existsSync(join(proj, 'Verified', '数论_Verified.json')), '★ no Verified card: the verdict is UNDECIDED, not "false"')
+  }
+  // The reverse direction: a defect named by the VERIFICATION id must still downgrade the OBJECT
+  // record that actually holds the proof (this is the pair that silently drifts when only one side
+  // is written — formalGateRecord would read `passed` from the other side).
+  const h2 = await makeCase('defect-rid')
+  await h2.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h2.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h2)
+  const proj2 = projRoot(h2)
+  await h2.call('vibe_math_lean_archive', { kind: 'proof', target: 'pDefect2', content: 'theorem p_defect2 : 2 + 2 = 4 := by decide\n' })
+  await h2.call('vibe_math_add_proposition', { id: 'pDefect2', 概述: '回执用验证 id 命名的缺陷', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs2 = await waitFor(() => { const x = verifiersOf(h2, 'r-pDefect2'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs2, 'verifiers were spawned for the reverse-direction case')
+  if (vs2) {
+    replyFrom(h2, vs2[0].childId, { Result: 0.3, Reason: '写宽了', formal: { target: 'r-pDefect2', decision: 'defect', note: 'Lean 版本没有假设 n≥1，比原文更宽' } })
+    const rec2 = await waitFor(() => { const r = (formalStateOf(h2).records || {}); return (r['r-pDefect2'] && r['r-pDefect2'].decision === 'defect') ? r : undefined }, 40, 150)
+    assert(!!rec2, '★ a defect named by the verification id is absorbed')
+    assert(!!rec2 && !!rec2['pDefect2'] && rec2['pDefect2'].status === 'attempted', '★ and the OBJECT record that held `passed` is downgraded as well')
+    assert(!!rec2 && rec2['pDefect2'].proof === '', 'its proof pointer is cleared too')
+    assert(!existsSync(join(proj2, 'Verified', 'Lean', 'pDefect2.lean')), '★ the archived proof is deleted even though the reply named the other id')
+    assert(/pDefect2/.test(readIf(join(proj2, 'Formal', 'TODO.md'))), 'the object is on the formalization TODO')
+  }
+}
+
+// ---------- 13. the gate must read BOTH id spaces ----------
+// v2 has two id spaces that name the same object: the verification id (rId, `r-pX`, `r-pX-s0`) that the
+// verification prompts and the gate use, and the OBJECT id (`pX`) that the agent reads in the target
+// block and normally archives under. `lean_archive` can only ADD a record for the id it was given, and
+// `syncVerificationTarget` merely UPDATES aliases that already exist — so "archived under the object id,
+// rId record does not exist yet" is a real first-time state. A gate that reads only its own side calls
+// that object un-formalized (a false negative), and because the deferral itself materialises the rId
+// record as `status:'none'`, the object can then NEVER conclude: every round re-defers and re-debates
+// (AUDIT-CHECKLIST §3: "成对关系只做一半").
+section('13 the require gate reads BOTH id spaces (archiving under the OBJECT id must not wedge)')
+{
+  const h = await makeCase('gate-objid')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pObjId', content: 'theorem p_objid : 2 + 2 = 4 := by decide\n' })
+  assert(proof.ok === true && proof.passed === true, 'precondition: the object is Lean-passed under its OBJECT id')
+  const rec0 = formalStateOf(h)
+  assert(!!rec0.records && !!rec0.records.pObjId && rec0.records.pObjId.status === 'passed', 'the passed record lives under the object id')
+  assert(!(rec0.records || {})['r-pObjId'], 'precondition: no rId record exists yet (this is the state that used to fool the gate)')
+  await h.call('vibe_math_add_proposition', { id: 'pObjId', 概述: '用对象 id 归档后必须能定论', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pObjId'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs, 'verifiers were spawned for the object-id case')
+  fireVerdicts(h, vs || [], 1)
+  await tick(600)
+  const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
+  const p = props.find((x) => x.id === 'pObjId') || {}
+  assert(p.布尔估计 === 1, "★ a Lean-passed object DOES conclude when the proof was archived under the object id (got " + p.布尔估计 + ')')
+  const cards = JSON.parse(readIf(join(proj, 'Verified', '数论_Verified.json')) || '[]')
+  assert(!!cards.find((c) => c.id === 'pObjId'), 'the Verified card was written')
+  const todo = readIf(join(proj, 'Formal', 'TODO.md'))
+  assert(!/pObjId/.test(todo), '★ the already-formalized object is NOT put on the formalization TODO')
+  const todo2 = await h.call('vibe_math_status', {})
+  assert(!(todo2.formal.todo || []).some((t) => String(t.id).indexOf('pObjId') !== -1), 'and the status TODO is empty for it too')
+}
+
+// ---------- 14. withdrawing a proof must reach EVERY archived copy ----------
+// Contract §4.1 requires the withdrawal, not a best-effort delete: after a `defect` the archived proof
+// must be gone from `Verified/Lean/` — the one place everyone looks for "the proof of this object".
+// Two independent ways that fails silently:
+//   (1) the proof was archived under a DIFFERENT id than the one the reply names (`Verified/Lean/<rId>.lean`
+//       while the reply names the object id) — scanning only the two named ids misses it, and the record's
+//       `proof` pointer is cleared anyway, so nothing ever points at the orphan again;
+//   (2) the host cannot delete at all (no subprocess service) — the delete fails and the stale proof stays.
+section('14 defect withdrawal covers every id alias AND a host that cannot delete')
+{
+  // (a) archived under the VERIFICATION id, defect named by the OBJECT id.
+  const h = await makeCase('defect-alias')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  const pr = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'r-pAlias', content: 'theorem p_alias : 2 + 2 = 4 := by decide\n' })
+  assert(pr.ok === true && pr.passed === true, 'precondition: the proof is archived under the VERIFICATION id')
+  const aliasProof = join(proj, 'Verified', 'Lean', 'r-pAlias.lean')
+  assert(existsSync(aliasProof), 'the archived proof sits at Verified/Lean/<rId>.lean')
+  await h.call('vibe_math_add_proposition', { id: 'pAlias', 概述: '归档写在验证 id 上', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pAlias'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs, 'verifiers were spawned for the alias case')
+  if (vs) {
+    replyFrom(h, vs[0].childId, { Result: 0.3, Reason: '写宽了（弃权）', formal: { target: 'pAlias', decision: 'defect', note: '原文还有 n≥1 的假设' } })
+    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pAlias'] && r['pAlias'].decision === 'defect') ? r : undefined }, 40, 150)
+    assert(!!rec, '★ the defect named by the object id is absorbed')
+    assert(!existsSync(aliasProof), '★★ the proof archived under the VERIFICATION id is withdrawn too (every id alias, not just the two named ones)')
+    assert(!!rec && (!rec['r-pAlias'] || rec['r-pAlias'].proof === ''), 'the rId record no longer points at a proof')
+    assert(!rec['r-pAlias'] || !rec['r-pAlias'].objectId || rec['r-pAlias'].objectId === 'pAlias', '★★ the rId record owner stamp is the OBJECT id (pAlias), never an r-shaped poisoned anchor (got ' + JSON.stringify(rec['r-pAlias'] && rec['r-pAlias'].objectId) + ')')
+  }
+
+  // (b) a host whose deletion cannot work: the archived path must not keep reading as the proof.
+  const h2 = await makeCase('defect-nosub', { noSubprocess: true })
+  await h2.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  const proj2 = projRoot(h2)
+  mkdirSync(join(proj2, 'Verified', 'Lean'), { recursive: true })
+  mkdirSync(join(proj2, 'Formal'), { recursive: true })
+  const WORK = 'theorem p_stale : 2 + 2 = 4 := by decide\n'
+  writeFileSync(join(proj2, 'Formal', 'pStale.lean'), WORK, 'utf8')
+  writeFileSync(join(proj2, 'Verified', 'Lean', 'pStale.lean'), WORK, 'utf8')
+  // The record is written directly (this host has no subprocess, so the LEAN tools cannot run at all):
+  // what is under test is the WITHDRAWAL path, not the archiving path.
+  writeFileSync(join(proj2, 'VibeMath_State', 'formal.json'), JSON.stringify({ records: { pStale: { status: 'passed', file: 'Formal/pStale.lean', proof: 'Verified/Lean/pStale.lean', decision: 'used', updatedAt: 1 } }, todo: [] }), 'utf8')
+  await h2.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await h2.call('vibe_math_add_proposition', { id: 'pStale', 概述: '宿主删不掉归档证明时的撤回', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  await startScheduler(h2)
+  const st0 = await h2.call('vibe_math_status', {})
+  assert(st0.formal.objects.some((o) => o.target === 'pStale' && o.status === 'passed'), 'precondition: the passed record with an archived proof survives resume on the no-subprocess host')
+  const vs2 = await waitFor(() => { const x = verifiersOf(h2, 'r-pStale'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs2, 'verifiers were spawned on the no-subprocess host')
+  if (vs2) {
+    replyFrom(h2, vs2[0].childId, { Result: 0.3, Reason: '不忠实（弃权）', formal: { target: 'pStale', decision: 'defect', note: 'Lean 少了 n≥1' } })
+    const rec2 = await waitFor(() => { const r = (formalStateOf(h2).records || {}); return (r['pStale'] && r['pStale'].decision === 'defect') ? r : undefined }, 40, 150)
+    assert(!!rec2, '★ the defect is absorbed even though this host cannot run a delete')
+    assert(!!rec2 && rec2['pStale'].status === 'attempted' && rec2['pStale'].proof === '', 'the record is downgraded and its proof pointer cleared')
+    const stalePath = join(proj2, 'Verified', 'Lean', 'pStale.lean')
+    assert(existsSync(stalePath), 'the archived file could NOT be deleted here (no subprocess) — so the fallback has to handle it')
+    const body = readIf(stalePath)
+    assert(!/theorem p_stale/.test(body), '★★ the original proof text is GONE from the archived path (it can no longer be read as the proof)')
+    assert(/已撤回/.test(body), '★★ …and that path carries an explicit withdrawal notice instead')
+    assert(/Formal\/pStale\.lean/.test(body), 'the notice points at the working file that is kept')
+    const acts = (await h2.call('vibe_math_status', {})).recentActivity.map((a) => a.detail).join('\n')
+    assert(/覆写/.test(acts), '★ the announcement says WHAT actually happened (overwritten, not deleted)')
+    assert(/撤回「已通过」状态/.test(acts), 'the announcement still says the passed status was withdrawn')
+  }
+}
+
+// ---------- 15. the「判断命题」transfer is a verdict on the SOURCE proposition ----------
+// When a solver's solution for a "判断下述命题是否成立：X" problem is verified, the result is TRANSFERRED
+// onto the source proposition: `布尔估计 = v`, `已验证 = true`, a probability-1 proof/refutation entry,
+// and `优先级 = 'never'` for a boolean v. That IS a boolean verdict on X, so require mode must gate it —
+// otherwise a proposition nobody formalized is silently concluded (and permanently de-scheduled).
+// (c) an OBJECT ID that itself ends in `-sN` / `-pfN` / `-rfN` — exactly the shapes the rId suffix
+// parser strips. `formalObjectIdOf` used to strip such a suffix unconditionally, so the verification id
+// `r-pAmb-s1` resolved to object `pAmb`: a DIFFERENT object. A defect about the former would then
+// downgrade the latter and even retract ITS archived proof, while the real owner stayed `passed`.
+// The verification task knows its owner (r.pId / r.qid), so that is the authoritative source.
+{
+  const h = await makeCase('defect-ambig')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  const innocent = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pAmb', content: 'theorem p_amb : 2 + 2 = 4 := by decide\n' })
+  assert(innocent.ok === true && innocent.passed === true, 'ambiguity: the neighbour pAmb has its own passing proof')
+  const innocentProof = join(proj, 'Verified', 'Lean', 'pAmb.lean')
+  const prone = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pAmb-s1', content: 'theorem p_amb_s1 : 3 + 3 = 6 := by decide\n' })
+  assert(prone.ok === true && prone.passed === true, 'ambiguity: pAmb-s1 (id ending in -s1) has its own passing proof')
+  const proneProof = join(proj, 'Verified', 'Lean', 'pAmb-s1.lean')
+  assert(existsSync(innocentProof) && existsSync(proneProof), 'ambiguity: both archived proofs exist')
+  await h.call('vibe_math_add_proposition', { id: 'pAmb', 概述: '同前缀的邻居对象', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  await h.call('vibe_math_add_proposition', { id: 'pAmb-s1', 概述: '对象 id 本身以 -s1 结尾', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pAmb-s1'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs, 'ambiguity: verifiers were spawned for r-pAmb-s1')
+  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pAmb-s1:0') || {}).prompt || ''
+  assert(/忠实性审查/.test(vp), 'ambiguity: the review subject is the Lean-passed object')
+  assert(/Verified\/Lean\/pAmb-s1\.lean/.test(vp), '★★ and the fidelity prompt points at pAmb-s1 OWN proof, not at a same-prefix neighbour (got ' + (vp.match(/Verified\/Lean\/[^\s）)]+/) || ['none'])[0] + ')')
+  if (vs) {
+    replyFrom(h, vs[0].childId, { Result: 0.3, Reason: '结论写窄了（弃权）', formal: { target: 'r-pAmb-s1', decision: 'defect', note: 'Lean 只证了 n>0 的情形' } })
+    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pAmb-s1'] && r['pAmb-s1'].decision === 'defect') ? r : undefined }, 40, 150)
+    assert(!!rec, '★★ a defect named by r-pAmb-s1 downgrades its REAL owner (pAmb-s1)')
+    assert(!existsSync(proneProof) || /已撤回/.test(readIf(proneProof)), '★★ and retracts pAmb-s1 own archived proof')
+    const recs = formalStateOf(h).records || {}
+    assert(!!recs['pAmb'] && recs['pAmb'].status === 'passed', '★★ the same-prefix NEIGHBOUR pAmb keeps its passed status (got ' + (recs['pAmb'] ? recs['pAmb'].status : 'no record') + ')')
+    assert(existsSync(innocentProof) && !/已撤回/.test(readIf(innocentProof)), '★★ and its archived proof file is untouched — a defect must never retract another object\'s proof')
+    assert(/pAmb-s1/.test(readIf(join(proj, 'Formal', 'TODO.md')) || ''), 'the TODO names the real owner')
+    // The record carries the authoritative owner, so the mapping survives a resume even when the
+    // in-memory verification task is gone (the fallback string parse would pick the neighbour again).
+    assert(!!recs['r-pAmb-s1'] && recs['r-pAmb-s1'].objectId === 'pAmb-s1',
+      '★★ the verification record remembers its object id (authoritative, not re-parsed from the name) — got ' + JSON.stringify(recs['r-pAmb-s1'] && recs['r-pAmb-s1'].objectId))
+    assert(!!recs['pAmb'] && !recs['pAmb'].objectId, 'the neighbour record carries no bogus owner stamp')
+  }
+}
+
+// (d) THE RECORD-OWNER FALLBACK must not be hijacked by a hand-edited state file. The state file is
+// user-editable, and a record whose `objectId` is itself r-shaped is not a usable owner: it would make
+// the verification id map to ITSELF, so a defect named by that rId would never reach the object side.
+// This case uses a WORK-ROUND (explorer) reply, which also carries `formal` and runs with NO verification
+// task in memory — i.e. it is the path that actually reads the owner from the record (a verifier reply
+// would take the task-registry path instead, which is authoritative and already covered above).
+{
+  const h = await makeCase('anchor-poison', { noSubprocess: true })
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  const proj = projRoot(h)
+  mkdirSync(join(proj, 'Verified', 'Lean'), { recursive: true })
+  mkdirSync(join(proj, 'Formal'), { recursive: true })
+  const WORK = 'theorem p_x : 2 + 2 = 4 := by decide\n'
+  writeFileSync(join(proj, 'Formal', 'pX.lean'), WORK, 'utf8')
+  writeFileSync(join(proj, 'Verified', 'Lean', 'pX.lean'), WORK, 'utf8')
+  const base = { status: 'passed', file: 'Formal/pX.lean', proof: 'Verified/Lean/pX.lean', decision: 'used', updatedAt: 1 }
+  writeFileSync(join(proj, 'VibeMath_State', 'formal.json'), JSON.stringify({ records: {
+    pX: Object.assign({}, base),
+    'r-pX': Object.assign({}, base, { objectId: 'r-pX' }),   // ← the r-shaped anchor a hand edit could leave
+  }, todo: [] }), 'utf8')
+  await h.call('vibe_math_add_problem', { id: 'qA', description: '锚点污染用例', priority: 1 })
+  await startScheduler(h)
+  await tick(2000)
+  const ex = await waitFor(() => h.spawns.find((s) => s.label.startsWith('explorer:qA')), 60, 200)
+  assert(!!ex, 'anchor-poison: the explorer was spawned (the scheduler is running)')
+  if (ex) {
+    const reply = { directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.6 }], formal: { target: 'r-pX', decision: 'defect', note: 'Lean 少了 n≥1' } }
+    h.fireEnd({ id: ex.childId, runId: 'rp', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: '```json\n' + JSON.stringify(reply) + '\n```' }] })
+    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['pX'] && r['pX'].decision === 'defect') ? r : undefined }, 40, 150)
+    assert(!!rec, '★★ a work-round defect named by an rId still reaches the OBJECT side when the record carries an r-shaped anchor (the anchor is rejected, not trusted)')
+    const all = formalStateOf(h).records || {}
+    assert(!!all['r-pX'] && all['r-pX'].status === 'attempted', '★★ and the rId record is downgraded as well (both id spaces stay in step)')
+  }
+}
+
+section('15 the require gate also covers the judge-problem transfer')
+{
+  const h = await makeCase('judge-gate')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  const proj = projRoot(h)
+  await h.call('vibe_math_add_proposition', { id: 'pJudgeSrc', 概述: '被判断的源命题（未形式化）', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  await h.call('vibe_math_add_problem', { id: 'qJudge', description: '判断下述命题是否成立：pJudgeSrc', priority: 1 })
+  const qsFile = join(proj, 'qs', 'qs.json')
+  const qs0 = JSON.parse(readIf(qsFile) || '[]')
+  const qj = qs0.find((q) => q.id === 'qJudge')
+  qj.判断命题 = 'pJudgeSrc'
+  // A solver-produced solution carries no 来源列表 — that is exactly the branch that transfers to the source.
+  qj.解法列表 = [{ 完整解法: '该命题不成立的论证', 正确概率: 0.8, 已验: false }]
+  writeFileSync(qsFile, JSON.stringify(qs0, null, 2), 'utf8')
+  await startScheduler(h)
+  const sp = await waitFor(() => { const x = verifiersOf(h, 'r-qJudge-s0'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!sp, 'verifiers were spawned for the judge problem solution')
+  fireVerdicts(h, sp || [], 0)
+  await tick(600)
+  const props = JSON.parse(readIf(join(proj, 'Propos', '数论_Propos.json')) || '[]')
+  const ap = props.find((x) => x.id === 'pJudgeSrc') || {}
+  assert(ap.布尔估计 === 0.5, "★★ the source proposition's 布尔估计 is UNCHANGED (require mode must not conclude 假 through the transfer; got " + ap.布尔估计 + ')')
+  assert(!(ap.证伪列表 || []).some((x) => x.正确概率 === 1), 'no probability-1 refutation was written onto the source proposition')
+  assert(ap.优先级 !== 'never', 'the source proposition was not pinned to never')
+  assert(ap.已验证 !== true, '★ it stays re-verifiable (the ungated path also marked it 已验证, removing it from every future candidate set)')
+  assert(/pJudgeSrc/.test(readIf(join(proj, 'Formal', 'TODO.md'))), '★ the deferred source proposition is on the formalization TODO')
+  assert(!existsSync(join(proj, 'Verified', '数论_Verified.json')), 'no Verified card for the source proposition')
+}
+
+// ---------- 15g. P2 #7: the accuracy-sample caps are documented AND announced ----------
+// The caps (8 samples per object, 32 objects) are deliberate bounded retention, but they used to
+// evict SILENTLY — the H4 accuracy statistic then drifted with the object count and nothing said so.
+// This case drives a long debate (2 verifiers × several rounds ⇒ > 8 samples for one object) and
+// requires the eviction to show up in the activity log.
+section('15g P2 #7: accuracy-sample cap eviction is announced, not silent')
+{
+  const h = await makeCase('score-cap-warn')
+  // 一轮就凑够样本：10 个验证器 ⇒ 同一对象一次记 10 条（> 每对象上限 8），无需多轮辩论。
+  await h.call('vibe_math_set_params', { verifierCount: 10, maxParallelThreshold: 20, debateMaxRounds: 1, verdictMode: 'flat' })
+  await h.call('vibe_math_add_proposition', { id: 'p-cap', 概述: '计分上限告警', 概率: 0.6, 分类: '数论' })
+  await startScheduler(h)
+  const cand = await waitFor(() => { const x = verifiersOf(h, 'r-p-cap'); return x.length >= 10 ? x : undefined }, 80, 250)
+  assert(!!cand, '对照：10 个验证器都被派出（实测 verifier spawns=' + h.spawns.filter((s) => s.label.indexOf('verifier') === 0).length + '）')
+  if (cand) { fireVerdicts(h, cand, 0.5); await sleep(400); await tick() }
+  const acts = (await h.call('vibe_math_status', {})).recentActivity.map((a) => a.detail).join('\n')
+  assert(/评审计分样本达上限/.test(acts), '★★ [P2#7] 超过每对象 8 条待计分样本时**写告警**，不再静默丢弃（verifier spawns=' + h.spawns.filter((s) => s.label.indexOf('verifier') === 0).length + ' verifiers=' + verifiersOf(h, 'r-p-cap').length + ' followups=' + h.followups.length + ' acts=' + JSON.stringify(acts.slice(-260)) + '）')
+  await h.call('vibe_math_abort', {})
+}
+
+// ---------- 16. the prompt corpus (contract §10.10) ----------
+// A HUMAN must be able to re-read every prompt the framework emitted, not just the assertions
+// about them. Paths are normalised so the dump is deterministic, diffable and machine-free.
+section("15b a \`used\` reply must NOT downgrade an already-passed object")
+{
+  // Contract §4: a fidelity defect WITHDRAWS a proof; a plain `used` judgement merely says "this round
+  // touched the formalization". Letting `used` downgrade an established proof would silently remove the
+  // fidelity branch from every later review prompt and re-close the require gate — the exact class that
+  // was already fixed once for v4's formalSetRun. v3/v4/v5 preserve passed/blocked here; v2 did not.
+  const h = await makeCase('used-keep')
+  await h.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await h.call('vibe_math_add_problem', { id: 'qKeep', description: '保持调度器运行的占位问题', priority: 9 })
+  await startScheduler(h)
+  const proj = projRoot(h)
+  const proof = await h.call('vibe_math_lean_archive', { kind: 'proof', target: 'pUsedKeep', content: 'theorem p_used_keep : 2 + 2 = 4 := by decide\n' })
+  assert(proof.ok === true && proof.passed === true, 'used-keep: the object starts Lean-passed')
+  const proofFile = join(proj, 'Verified', 'Lean', 'pUsedKeep.lean')
+  assert(existsSync(proofFile), 'used-keep: the archived proof exists before the used reply')
+  await h.call('vibe_math_add_proposition', { id: 'pUsedKeep', 概述: '已有通过证明后再写一次 used 回执', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  const vs = await waitFor(() => { const x = verifiersOf(h, 'r-pUsedKeep'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!vs, 'used-keep: verifiers were spawned for the Lean-passed object')
+  const vp = (h.spawns.find((s) => s.label === 'verifier:r-pUsedKeep:0') || {}).prompt || ''
+  assert(/忠实性审查/.test(vp), 'used-keep: the reviewers were told to audit FIDELITY (the Lean code is the subject)')
+  if (vs) {
+    replyFrom(h, vs[0].childId, { Result: 0.5, Reason: '这一轮只是又写了一遍草稿', formal: { target: 'pUsedKeep', decision: 'used', file: 'Formal/pUsedKeep.lean' } })
+    // The reply is what materialises the canonical verification alias r-<objectId>, so waiting for
+    // THAT is a signal only the reply can produce (the archive already wrote decision:'used').
+    const rec = await waitFor(() => { const r = (formalStateOf(h).records || {}); return (r['r-pUsedKeep'] && r['pUsedKeep']) ? r : undefined }, 40, 150)
+    assert(!!rec, 'used-keep: the `used` reply is absorbed (the canonical verification alias was materialised)')
+    assert(!!rec && rec['pUsedKeep'].status === 'passed', '★★ a `used` reply does NOT downgrade an already-passed object (got ' + (rec && rec['pUsedKeep'] ? rec['pUsedKeep'].status : 'no record') + ')')
+    assert(!!rec && rec['pUsedKeep'].proof === 'Verified/Lean/pUsedKeep.lean', '★★ and its proof pointer survives the reply')
+    assert(!!rec && !!rec['r-pUsedKeep'] && rec['r-pUsedKeep'].status === 'passed', '★★ the verification-id alias keeps passed too (both id spaces)')
+    assert(existsSync(proofFile), '★★ the archived proof is still on disk')
+    const st = await h.call('vibe_math_status', {})
+    const obj = (st.formal.objects || []).find((o) => o.target === 'pUsedKeep')
+    assert(!!obj && obj.status === 'passed', '★★ status still reports the object as Lean-passed (v2 exposes status.formal.objects, not a "passed" array)')
+    // The consequence that actually matters: with 'passed' preserved the require gate stays OPEN, so
+    // driving the round to a unanimous "true" still concludes (a wrongly downgraded object is deferred).
+    const settled = await verifyWithDebate(h, 'r-pUsedKeep', 1, 0)
+    assert(!!settled.first, 'used-keep: the round can still be driven to a verdict')
+    assert(!/pUsedKeep/.test(readIf(join(proj, 'Formal', 'TODO.md')) || ''), '★★ no formal-required TODO was created: the surviving passed status still opens the require gate')
+    // The same rule covers the RUN path (docs §4): a run attributed to the object may not downgrade it.
+    const rerun = await h.call('vibe_math_lean_run', { file: 'Formal/pUsedKeep.lean', target: 'pUsedKeep' })
+    assert(rerun.ok === true, 'used-keep: the object work file runs green (the record assertion below is the point)')
+    const obj2 = ((await h.call('vibe_math_status', {})).formal.objects || []).find((o) => o.target === 'pUsedKeep')
+    assert(!!obj2 && obj2.status === 'passed', '★★ and the record is still passed (a scratch run may not withdraw a proof)')
+  }
+}
+
+// ---------- 15c. the framework's OWN feedback channels (push report + gate notice) ----------
+// Every corpus entry so far was a child prompt (spawn/wake). The framework also speaks to the main
+// agent/human on two other channels — the `reportMode=push` progress report and the activity log's
+// formal-gate notice — and neither had any reviewable artefact (AUDIT §2.4 "框架→人 的反馈与推送类
+// 提示"). Both are captured DETERMINISTICALLY (no wall-clock, no timing-dependent counts):
+//   · push   = the forced push of the strict-termination branch on an EMPTY project (fixed counters);
+//   · feedback = the FIRST formal-gate activity line of one controlled require-mode deferral.
+section('15c the framework push report and the gate notice are captured')
+{
+  const h = await makeCase('push-report')
+  await h.call('vibe_math_set_params', { reportMode: 'push', tickIntervalMs: 200 })
+  await h.call('vibe_math_start', {})
+  const pushed = await waitFor(() => (h.root.pushed && h.root.pushed.length > 0 ? h.root.pushed : undefined), 80, 100)
+  assert(!!pushed, 'push-report: the scheduler pushed a progress report to the main agent')
+  assert(!!pushed && /\[Vibe Math V2\] 进度更新/.test(pushed[0]), '★★ the push text is the real framework→main-agent prompt (reportMode=push)')
+  assert(!!pushed && /vibe_math_report/.test(pushed[0]), 'and it names the FULL tool the main agent must call')
+  await h.call('vibe_math_pause', {})
+
+  const g = await makeCase('gate-feedback')
+  await g.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await g.call('vibe_math_add_proposition', { id: 'pFeed', 概述: '门禁反馈语料', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  await startScheduler(g)
+  const gvs = await waitFor(() => { const x = verifiersOf(g, 'r-pFeed'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!gvs, 'gate-feedback: verifiers were spawned for the proposition')
+  if (gvs) for (let i = 0; i < gvs.length && i < 2; i++) replyFrom(g, gvs[i].childId, { Result: 1, Reason: '门禁反馈用例' })
+  let gline
+  for (let i = 0; i < 60 && !gline; i++) {
+    const acts = (await g.call('vibe_math_status', {})).recentActivity || []
+    const hit = acts.find((a) => /formal-gate/.test(String(a.event)))
+    if (hit) gline = String(hit.event) + ': ' + String(hit.detail)
+    else await sleep(150)
+  }
+  assert(!!gline && /require 模式搁置/.test(gline), '★★ the require-gate withholding reaches the human-readable channel (captured verbatim)')
+  assert(!!gline && /Formal\/TODO\.md/.test(gline), 'and the notice says where the withholding was recorded')
+  assert(/下一步：/.test(String(gline)) && /代码 formal-required/.test(String(gline)) && !/（当前状态 none）/.test(String(gline)),
+    '★★ [A5] require-gate 反馈行给出**下一步**且状态已本地化（代码 token 保留），实测 ' + JSON.stringify(gline))
+  g.feedbackLine = gline || ''
+  await g.call('vibe_math_pause', {})
+}
+
+section('15d Lean 增量 + 异步（spec §1–§4 + 修订 §1–§5）：参数、argv、队列、去重、只读面、提示词')
+{
+  const H = MOD.__testHelpers
+  const slash = (s) => String(s == null ? '' : s).replace(/\\/g, '/')   // 插件内部用 '/'，测试用 path.join ⇒ 比较前统一
+  const SAME = (a, b) => slash(a) === slash(b)
+  // ── 参数：默认值 + 归一化（字符串 'false' 绝不能滑过去） ────────────────────────────
+  const a = await makeCase('lean-params')
+  const st0 = await a.call('vibe_math_status', {})
+  assert(st0.params.leanAsync === false, 'the suite pins leanAsync=false by default (sync-path guard)')
+  await a.call('vibe_math_set_params', { leanAsync: true })
+  assert((await a.call('vibe_math_status', {})).params.leanAsync === true, 'leanAsync=true is accepted (the async档)')
+  const bad = await a.call('vibe_math_set_params', { leanAsync: 'false' })
+  assert(bad.ok === true, 'set_params accepts a (badly typed) leanAsync')
+  assert((await a.call('vibe_math_status', {})).params.leanAsync === true, '★★★ leanAsync="false" (a STRING) does not slip through the `else out[k]=v` tail: it falls back to the boolean default (true) — a truthy string must never be read as a boolean')
+  const defs = (await a.call('vibe_math_status', {})).params
+  assert(defs.leanJobsMaxParallel === 1 && defs.leanInitiative === 'normal' && Array.isArray(defs.leanSearchPaths) && defs.leanSearchPaths.length === 0, 'the amendment defaults are leanJobsMaxParallel=1 / leanInitiative=normal / leanSearchPaths=[]')
+  await a.call('vibe_math_set_params', { leanInitiative: 'banana', leanJobsMaxParallel: 0, leanSearchPaths: 'not-an-array' })
+  const p1 = (await a.call('vibe_math_status', {})).params
+  assert(p1.leanInitiative === 'normal', 'leanInitiative rejects an unknown mode back to normal')
+  assert(p1.leanJobsMaxParallel === 1, 'leanJobsMaxParallel is floored at 1 (never 0/unbounded)')
+  assert(Array.isArray(p1.leanSearchPaths) && p1.leanSearchPaths.length === 0, 'leanSearchPaths rejects a non-array back to []')
+  await a.call('vibe_math_set_params', { leanSearchPaths: ['  /opt/lean-lib  ', '/opt/lean-lib', ''] })
+  assert(JSON.stringify((await a.call('vibe_math_status', {})).params.leanSearchPaths) === JSON.stringify(['/opt/lean-lib']), 'leanSearchPaths trims, drops empties and de-duplicates')
+  // 纯函数：搜索路径计划（修订 §2）
+  const planDefault = H.leanSearchPathPlan([], [], '/root/vm')
+  assert(JSON.stringify(planDefault.paths) === JSON.stringify(['/root/vm']) && planDefault.inject.length === 2, '★ default plan injects exactly the automatic VibeMath root')
+  const planExtra = H.leanSearchPathPlan(['env', 'lean'], ['/a', '/b'], '/root/vm')
+  assert(JSON.stringify(planExtra.paths) === JSON.stringify(['/a', '/b', '/root/vm']), '★★ user leanSearchPaths come FIRST, then the automatic root')
+  assert(JSON.stringify(planExtra.inject) === JSON.stringify(['--search-path', '/a', '--search-path', '/b', '--search-path', '/root/vm']), 'and each path is injected with its own --search-path flag')
+  assert(H.leanSearchPathPlan(['--search-path', '/x'], ['/a'], '/root/vm').inject.length === 0, '★ an explicit --search-path in leanArgs suppresses all injection (user wins)')
+  assert(H.leanSearchPathPlan(['-R', '/x'], ['/a'], '/root/vm').inject.length === 0 && H.leanSearchPathPlan(['--root', '/x'], ['/a'], '/root/vm').inject.length === 0, '★ -R / --root are honoured too')
+
+  // ── argv：注入位置在用户参数之后、文件名之前 ──────────────────────────────────────
+  const b = await makeCase('lean-argv')
+  await b.call('vibe_math_set_params', { leanAsync: false, leanArgs: ['env', 'lean'], leanCommand: 'lean' })
+  const projB = projRoot(b)
+  mkdirSync(join(projB, 'Formal'), { recursive: true })
+  writeFileSync(join(projB, 'Formal', 'srch.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
+  const runsBefore = leanRuns.length
+  await b.call('vibe_math_lean_run', { file: 'Formal/srch.lean' })
+  const argv1 = leanRuns[leanRuns.length - 1].argv
+  assert(leanRuns.length === runsBefore + 1, 'the sync run really reached the compiler')
+  assert(JSON.stringify(argv1.slice(0, 2)) === JSON.stringify(['lean', 'env']), 'the user leanArgs are preserved in order')
+  assert(argv1[argv1.length - 2] === '--search-path' && SAME(argv1[argv1.length - 1], vibeRoot(b)), '★★ --search-path + the VibeMath root are injected AFTER the user args and immediately BEFORE the file (argv=' + JSON.stringify(argv1) + ')')
+  await b.call('vibe_math_set_params', { leanArgs: ['env', 'lean', '--search-path', '/explicit'] })
+  await b.call('vibe_math_lean_run', { file: 'Formal/srch.lean' })
+  const argv2 = leanRuns[leanRuns.length - 1].argv
+  assert(argv2.indexOf('--search-path') === 3 && argv2[4] === '/explicit' && argv2.filter((x) => x === '--search-path').length === 1, '★ an explicit --search-path is respected verbatim (no second injection) — got ' + JSON.stringify(argv2))
+  await b.call('vibe_math_set_params', { leanArgs: ['env', 'lean'], leanSearchPaths: ['/extra1', '/extra2'] })
+  await b.call('vibe_math_lean_run', { file: 'Formal/srch.lean' })
+  const argv3 = leanRuns[leanRuns.length - 1].argv
+  assert(JSON.stringify(argv3.slice(-6)) === JSON.stringify(['--search-path', '/extra1', '--search-path', '/extra2', '--search-path', slash(vibeRoot(b))]), '★★ leanSearchPaths are injected first, then the automatic root (got ' + JSON.stringify(argv3.slice(-6)) + ')')
+
+  // ── 异步状态机：入队立即返回 → 心跳排空 → 只有 settled(ok) 才是通过 ────────────────
+  const c = await makeCase('lean-async')
+  await c.call('vibe_math_set_params', { leanAsync: true, tickIntervalMs: 200 })
+  const projC = projRoot(c)
+  mkdirSync(join(projC, 'Formal'), { recursive: true })
+  writeFileSync(join(projC, 'Formal', 'async-good.lean'), 'theorem t : 1 = 1 := rfl\n', 'utf8')
+  writeFileSync(join(projC, 'Formal', 'async-bad.lean'), 'theorem t : 1 = 2 := by sorry\n', 'utf8')
+  const nBefore = leanRuns.length
+  const q1 = await c.call('vibe_math_lean_run', { file: 'Formal/async-good.lean', target: 'pAsync' })
+  assert(q1.ok === true && !!q1.async && q1.async.state === 'queued' && typeof q1.async.jobId === 'string' && q1.async.jobId.length > 3, '★★ leanAsync=true returns IMMEDIATELY with {async:{jobId,state:queued}} (got ' + JSON.stringify(q1.async) + ')')
+  assert(leanRuns.length === nBefore, '★★ the tool call itself did NOT block on the compiler (it is enqueued, not run)')
+  assert(q1.async.jobId.indexOf('pAsync-') === 0, 'the jobId is <target>-<fingerprint[0:12]> (got ' + q1.async.jobId + ')')
+  const jobFile = join(projC, 'Formal', 'Jobs', q1.async.jobId + '.json')
+  assert(existsSync(jobFile), 'the job record is mirrored to <project>/Formal/Jobs/<jobId>.json')
+  const rec0 = JSON.parse(readIf(jobFile))
+  assert(rec0.state === 'queued' && typeof rec0.sha256 === 'string' && typeof rec0.buildSha256 === 'string' && rec0.buildContext.length > 0, '★ the job record carries state + content hash + build-context hash')
+  assert((formalStateOf(c).records || {}).pAsync === undefined || formalStateOf(c).records.pAsync.status !== 'passed', '★★ a queued job never marks the object passed')
+  const done1 = await waitFor(() => { const r = JSON.parse(readIf(jobFile) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
+  assert(!!done1, 'the apply-level heartbeat drained the queue and settled the job (got ' + JSON.parse(readIf(jobFile) || '{}').state + ')')
+  assert(done1 && done1.exitCode === 0, 'the settled record keeps exitCode 0')
+  const recAfter = formalStateOf(c).records.pAsync
+  assert(!!recAfter && recAfter.status === 'attempted' && recAfter.run && recAfter.run.ok === true, 'a green RUN record lands as attempted (stored, not promoted) with run.ok=true')
+  assert(!!recAfter.async && recAfter.async.state === 'settled' && recAfter.async.jobId === q1.async.jobId, 'the object record carries the async job pointer/state')
+  // 红色作业：attempted + 编译器输出入库，绝不 passed
+  const q2 = await c.call('vibe_math_lean_run', { file: 'Formal/async-bad.lean', target: 'pAsyncBad' })
+  const done2 = await waitFor(() => { const r = JSON.parse(readIf(join(projC, 'Formal', 'Jobs', q2.async.jobId + '.json')) || '{}'); return r.state === 'failed' ? r : undefined }, 80, 60)
+  assert(!!done2 && done2.exitCode === 1, '★ a red async run settles as failed with exitCode 1')
+  const recBad = formalStateOf(c).records.pAsyncBad
+  assert(!!recBad && recBad.status === 'attempted' && recBad.run.ok === false, '★ a red async run is recorded as attempted (never passed)')
+  assert(/sorry/.test(String(recBad.run.stderrTail || '')), 'and the compiler output is kept in the record for the member to fix')
+  // ── 归档证明（异步）：落地前不是 passed；落地 ok 才写 Verified/Lean/ ────────────────
+  await c.call('vibe_math_add_proposition', { id: 'pAsymProof', 概述: '异步归档证明', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  mkdirSync(join(projC, 'Formal'), { recursive: true })
+  const q3 = await c.call('vibe_math_lean_archive', { kind: 'proof', target: 'pAsymProof', content: 'theorem pAsymProof : 1 = 1 := rfl\n' })
+  assert(q3.ok === true && q3.async && q3.async.state === 'queued' && q3.status === 'attempted', '★★ kind=proof in async档 returns queued + attempted (NOT passed)')
+  assert(!existsSync(join(projC, 'Verified', 'Lean', 'pAsymProof.lean')), '★★ the archived proof file does NOT exist while the job is still queued')
+  assert((formalStateOf(c).records.pAsymProof || {}).status !== 'passed', 'and the record is not passed yet')
+  const done3 = await waitFor(() => { const r = JSON.parse(readIf(join(projC, 'Formal', 'Jobs', q3.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
+  assert(!!done3, 'the proof job settled green')
+  assert(existsSync(join(projC, 'Verified', 'Lean', 'pAsymProof.lean')), '★★ only after settled(ok) is Verified/Lean/<id>.lean written')
+  assert((formalStateOf(c).records.pAsymProof || {}).status === 'passed', '★★ and only then does the object become passed')
+  assert(/pAsymProof/.test(readIf(join(projC, 'Formal', 'Index.md'))), 'the index reflects the passed object')
+  // ── lean_job（修订 §3）：清单 / 单查 / waitMs ─────────────────────────────────────
+  const listJobs = await c.call('vibe_math_lean_job', {})
+  assert(listJobs.ok === true && Array.isArray(listJobs.jobs) && listJobs.jobs.length >= 3, '★ lean_job without jobId returns the session job list')
+  assert(listJobs.jobs.every((j) => !!j.paths && typeof j.paths.receipt === 'string'), 'every listed job carries its receipt path')
+  const one = await c.call('vibe_math_lean_job', { jobId: q3.async.jobId })
+  assert(one.ok === true && one.state === 'settled' && one.passed === true && one.paths.archive === 'Verified/Lean/pAsymProof.lean', '★ lean_job {jobId} returns state/exitCode/paths and the passed verdict')
+  assert((await c.call('vibe_math_lean_job', { jobId: 'nope-000000000000' })).code === 'V2_NOT_FOUND', 'an unknown jobId is refused with a typed code')
+  const q4 = await c.call('vibe_math_lean_run', { file: 'Formal/async-bad.lean', target: 'pAsyncBad' })
+  const waited = await c.call('vibe_math_lean_job', { jobId: q4.async.jobId, waitMs: 4000 })
+  assert(waited.ok === true && waited.state !== 'queued' && waited.stillRunning === false && waited.waitedMs > 0, '★★ lean_job waitMs>0 waits for the job to leave queued/running (got ' + waited.state + ')')
+  // ── 超时：leanTimeoutMs 是每个作业的预算，主动 terminate，绝不 passed ─────────────
+  const d = await makeCase('lean-timeout')
+  await d.call('vibe_math_set_params', { leanAsync: true, leanTimeoutMs: 1000 })
+  const projD = projRoot(d)
+  mkdirSync(join(projD, 'Formal'), { recursive: true })
+  writeFileSync(join(projD, 'Formal', 'hang.lean'), '-- HANG\ntheorem t : 1 = 1 := rfl\n', 'utf8')
+  const termBefore = terminations.length
+  const q5 = await d.call('vibe_math_lean_run', { file: 'Formal/hang.lean', target: 'pHang' })
+  const done5 = await waitFor(() => { const r = JSON.parse(readIf(join(projD, 'Formal', 'Jobs', q5.async.jobId + '.json')) || '{}'); return r.state === 'timeout' ? r : undefined }, 120, 60)
+  assert(!!done5 && done5.timedOut === true, '★★ a hanging job times out (state=timeout, timedOut=true) with leanTimeoutMs as its budget')
+  assert(terminations.length > termBefore, '★★ the timeout ACTIVELY called handle.terminate()')
+  assert((formalStateOf(d).records.pHang || {}).status !== 'passed', '★ a timed-out job never sets passed')
+  // ── 并发参数（修订 §5）：leanJobsMaxParallel>1 时两个作业同时进入 running ──────────
+  const e = await makeCase('lean-parallel')
+  await e.call('vibe_math_set_params', { leanAsync: true, leanJobsMaxParallel: 2 })
+  const projE = projRoot(e)
+  mkdirSync(join(projE, 'Formal'), { recursive: true })
+  writeFileSync(join(projE, 'Formal', 'h1.lean'), '-- HANG\ntheorem h1 : 1 = 1 := rfl\n', 'utf8')
+  writeFileSync(join(projE, 'Formal', 'h2.lean'), '-- HANG\ntheorem h2 : 1 = 1 := rfl\n', 'utf8')
+  await e.call('vibe_math_set_params', { leanTimeoutMs: 3000 })
+  const j1 = await e.call('vibe_math_lean_run', { file: 'Formal/h1.lean', target: 'pH1' })
+  const j2 = await e.call('vibe_math_lean_run', { file: 'Formal/h2.lean', target: 'pH2' })
+  // Both are HANG jobs: with concurrency 2 they must be in `running` AT THE SAME TIME. A serial
+  // queue can never reach that state, so the probe discriminates the `leanJobsMaxParallel` parameter.
+  const both = await waitFor(() => {
+    const a = JSON.parse(readIf(join(projE, 'Formal', 'Jobs', j1.async.jobId + '.json')) || '{}')
+    const b = JSON.parse(readIf(join(projE, 'Formal', 'Jobs', j2.async.jobId + '.json')) || '{}')
+    return (a.state === 'running' && b.state === 'running') ? { a: a, b: b } : undefined
+  }, 120, 50)
+  assert(!!both, '★★ with leanJobsMaxParallel=2 BOTH queued jobs are in running at the same time (concurrency is a parameter, not a constant)')
+  for (const k of [j1, j2]) { try { await e.call('vibe_math_lean_job', { jobId: k.async.jobId, waitMs: 3500 }) } catch (err) { /* ignore */ } }
+  // ── 卸载（spec §2.5 / §7-6）：terminate + interrupted，绝不 passed、绝不留孤儿 ────────
+  const dz = await makeCase('lean-dispose')
+  await dz.call('vibe_math_set_params', { leanAsync: true, leanTimeoutMs: 60000 })
+  const projZ = projRoot(dz)
+  mkdirSync(join(projZ, 'Formal'), { recursive: true })
+  writeFileSync(join(projZ, 'Formal', 'orphan.lean'), '-- HANG\ntheorem orphan : 1 = 1 := rfl\n', 'utf8')
+  const termZ = terminations.length
+  const qz = await dz.call('vibe_math_lean_run', { file: 'Formal/orphan.lean', target: 'pOrphan' })
+  const startedZ = await waitFor(() => { const r = JSON.parse(readIf(join(projZ, 'Formal', 'Jobs', qz.async.jobId + '.json')) || '{}'); return r.state === 'running' ? r : undefined }, 80, 60)
+  assert(!!startedZ, 'the dispose case got a job into running')
+  dz.unmount()   // ctx.effect disposer ⇒ disposeLeanJobs()
+  assert(terminations.length > termZ, '★★ unmounting the plugin terminated the in-flight compile (no orphan process)')
+  assert((formalStateOf(dz).records.pOrphan || {}).status !== 'passed', '★ dispose never marks the object passed')
+  const afterZ = JSON.parse(readIf(join(projZ, 'Formal', 'Jobs', qz.async.jobId + '.json')) || '{}')
+  assert(afterZ.interrupted === true || afterZ.state === 'interrupted' || afterZ.state === 'running', '★ the disposed job is recorded as interrupted (or left running for the next recovery to mark)')
+  // ── 去重（§4.3）：同内容 + 同构建上下文 ⇒ 第二次不再编译 ──────────────────────────
+  const f = await makeCase('lean-dedupe')
+  await f.call('vibe_math_set_params', { leanAsync: true })
+  const defBody = 'def reusableOne : Nat := 1\n'
+  const r1 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: defBody })
+  assert(r1.ok === true && r1.async && r1.deduped === false, 'the first archive of a definition is enqueued (not deduped)')
+  await waitFor(() => { const r = JSON.parse(readIf(join(projRoot(f), 'Formal', 'Jobs', r1.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
+  const runsAfter1 = leanRuns.length
+  const r2 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: defBody })
+  assert(r2.ok === true && r2.deduped === true && r2.async === undefined, '★★★ re-archiving identical content is DEDUPED (no job, no recompile) — got ' + JSON.stringify({ deduped: r2.deduped, async: r2.async }))
+  assert(leanRuns.length === runsAfter1, '★★ the deduped archive did NOT recompile')
+  // 构建上下文进指纹（修订 §4）：同内容、不同 leanArgs ⇒ 不同 jobId / 不命中"已验证"
+  await f.call('vibe_math_set_params', { leanArgs: ['--threads=2'] })
+  const r5 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: defBody })
+  assert(r5.ok === true && r5.deduped === false && !!r5.async && !!r1.async && r5.async.jobId !== r1.async.jobId, '★★★ the SAME content under a DIFFERENT build context (leanArgs) gets a different jobId — it is not treated as already-verified (got ' + JSON.stringify({ deduped: r5.deduped, async: r5.async }) + ')')
+  if (r5.async) await waitFor(() => { const r = JSON.parse(readIf(join(projRoot(f), 'Formal', 'Jobs', r5.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
+  await f.call('vibe_math_set_params', { leanArgs: [] })
+  const changed = defBody + '\n-- 内容变了\n'
+  const r3 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: changed })
+  assert(r3.ok === true && r3.deduped === false && !!r3.async, 'a changed body is NOT deduped (content hash differs)')
+  if (r3.async) await waitFor(() => { const r = JSON.parse(readIf(join(projRoot(f), 'Formal', 'Jobs', r3.async.jobId + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
+  const r6 = await f.call('vibe_math_lean_archive', { kind: 'def', name: 'reusableOne', content: changed })
+  assert(r6.ok === true && r6.deduped === true, 'and the changed body dedupes on its own (content-based, not "first wins")')
+  // ── 崩溃恢复（§2.6 + 修订 §4）：绝不置 passed ─────────────────────────────────────
+  const g = await makeCase('lean-recover')
+  await g.call('vibe_math_set_params', { leanAsync: true })
+  const projG = projRoot(g)
+  mkdirSync(join(projG, 'Formal', 'Jobs'), { recursive: true })
+  const goodBody = 'theorem recGood : 1 = 1 := rfl\n'
+  writeFileSync(join(projG, 'Formal', 'recGood.lean'), goodBody, 'utf8')
+  const ctxG = H.leanBuildContext('lean', [], [slash(vibeRoot(g))])
+  const fpG = H.leanJobFingerprint(goodBody, ctxG)
+  const jobIdG = H.leanJobId('pRecGood', fpG)
+  writeFileSync(join(projG, 'Formal', 'Jobs', jobIdG + '.json'), JSON.stringify({
+    jobId: jobIdG, kind: 'archive', state: 'running', attempts: 1, target: 'pRecGood', name: 'pRecGood',
+    rel: 'Formal/recGood.lean', scope: 'project', sha256: H.leanContentSha(goodBody), buildSha256: fpG, buildContext: ctxG,
+    engine: 'lean', argv: [], searchPaths: [slash(vibeRoot(g))], archiveKind: 'proof', enqueuedAt: 1, startedAt: 2, settledAt: 0, exitCode: null,
+  }), 'utf8')
+  // 哈希不匹配的遗留作业：只标记，绝不重驱、绝不 passed
+  const otherJob = H.leanJobId('pRecOther', H.leanJobFingerprint('theorem other : 1 = 1 := rfl\n', ctxG))
+  writeFileSync(join(projG, 'Formal', 'Jobs', otherJob + '.json'), JSON.stringify({
+    jobId: otherJob, kind: 'archive', state: 'running', attempts: 3, target: 'pRecOther', name: 'pRecOther',
+    rel: 'Formal/recMissing.lean', scope: 'project', sha256: H.leanContentSha('theorem other : 1 = 1 := rfl\n'), buildSha256: 'ffffffffffff', buildContext: ctxG,
+    engine: 'lean', argv: [], searchPaths: [slash(vibeRoot(g))], archiveKind: 'proof', enqueuedAt: 1, startedAt: 2, settledAt: 0, exitCode: null,
+  }), 'utf8')
+  await g.call('vibe_math_new_project', { name: 'proj' })   // 触发 setProject ⇒ recoverLeanJobs()
+  const recG = formalStateOf(g).records.pRecGood || {}
+  assert(recG.status === 'attempted', '★★ recovery marks a crashed running job as attempted (never passed)')
+  const recOther = formalStateOf(g).records.pRecOther || {}
+  assert(recOther.status === 'attempted', 'recovery marks the hash-mismatched job object as attempted too')
+  assert(!existsSync(join(projG, 'Verified', 'Lean', 'pRecGood.lean')), '★ recovery never writes an archived proof for a crashed job')
+  const recJobG = JSON.parse(readIf(join(projG, 'Formal', 'Jobs', jobIdG + '.json')) || '{}')
+  assert(Number(recJobG.attempts) === 2 && ['queued', 'running', 'settled'].indexOf(recJobG.state) !== -1, '★★ the matching-hash job was re-enqueued with attempts+1 (got ' + JSON.stringify({ state: recJobG.state, attempts: recJobG.attempts }) + ')')
+  const otherAfter = JSON.parse(readIf(join(projG, 'Formal', 'Jobs', otherJob + '.json')) || '{}')
+  assert(otherAfter.state === 'interrupted' && Number(otherAfter.attempts) === 3, '★★ the mismatched job is only marked interrupted (NOT re-driven, attempts unchanged)')
+  const recDone = await waitFor(() => { const r = JSON.parse(readIf(join(projG, 'Formal', 'Jobs', jobIdG + '.json')) || '{}'); return r.state === 'settled' ? r : undefined }, 80, 60)
+  assert(!!recDone, 'the re-enqueued job then settles normally on the heartbeat (the queue really resumed)')
+  // ── lean_read（§1.2）：只读、路径守卫、64KB 截断 ─────────────────────────────────
+  mkdirSync(join(vibeRoot(g), 'Formal', 'Lib'), { recursive: true })
+  writeFileSync(join(vibeRoot(g), 'Formal', 'Lib', 'recGood.lean'), goodBody, 'utf8')
+  const rd = await g.call('vibe_math_lean_read', { name: 'recGood' })
+  assert(rd.ok === true && rd.kind === 'lib' && rd.sha256 === H.leanContentSha(goodBody) && rd.truncated === false && rd.text === goodBody, '★ lean_read returns the archived text + sha256 + bytes for a Lib file (got ' + JSON.stringify(rd).slice(0, 200) + ')')
+  assert(typeof rd.bytes === 'number' && rd.bytes === Buffer.byteLength(goodBody, 'utf8'), 'lean_read reports the byte length')
+  assert((await g.call('vibe_math_lean_read', { name: 'recGood', kind: 'proved' })).code === 'V2_NOT_FOUND', 'kind=proved looks only in Formal/Proved')
+  for (const badName of ['../etc/passwd', 'a/b', 'C:\\x\\y', '..']) {
+    const rbad = await g.call('vibe_math_lean_read', { name: badName })
+    assert(rbad.ok === false && rbad.code === 'V2_INVALID_ARGUMENT', '★ lean_read rejects the path-escape attempt ' + JSON.stringify(badName))
+  }
+  const bigName = 'bigOne'
+  mkdirSync(join(vibeRoot(g), 'Formal', 'Lib'), { recursive: true })
+  writeFileSync(join(vibeRoot(g), 'Formal', 'Lib', bigName + '.lean'), '-- ' + 'x'.repeat(70 * 1024) + '\n', 'utf8')
+  const rbig = await g.call('vibe_math_lean_read', { name: bigName })
+  assert(rbig.ok === true && rbig.truncated === true && Buffer.byteLength(rbig.text, 'utf8') <= 64 * 1024, '★ lean_read truncates at 64KB and says so (truncated=true)')
+  // ── 索引依赖列（§4.4）与 lean_lib 的 jobs/searchPath ─────────────────────────────
+  writeFileSync(join(vibeRoot(g), 'Formal', 'Lib', 'depUser.lean'), 'import Formal.Lib.bigOne\n\ndef depUser := 1\n', 'utf8')
+  const lib = await g.call('vibe_math_lean_lib', {})
+  assert(!!lib.paths && SAME(lib.paths.searchPath, vibeRoot(g)), '★ lean_lib exposes paths.searchPath = the VibeMath root (got ' + JSON.stringify(lib.paths) + ')')
+  assert(Array.isArray(lib.jobs) && lib.jobs.length >= 1, '★ lean_lib exposes the job list')
+  assert(lib.async === true, 'lean_lib reports the current async mode')
+  const libIdx = readIf(join(vibeRoot(g), 'Formal', 'Lib', 'Index.md'))
+  assert(/依赖（import）/.test(libIdx) && /Formal\.Lib\.bigOne/.test(libIdx), '★★ the Lib index carries the dependency column scanned from `import` lines')
+  // ── 主动性档位（修订 §1）：提示词读 leanInitiative，不是 formalVerify ──────────────
+  const wNormal = await makeCase('lean-init-normal')
+  await wNormal.call('vibe_math_set_params', { formalVerify: 'encourage', leanInitiative: 'normal' })
+  await wNormal.call('vibe_math_add_problem', { id: 'qInit', description: '主动性提示词 normal' })
+  await startScheduler(wNormal)
+  const exN = await waitFor(() => wNormal.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
+  const promptNormal = (exN && exN.prompt) || ''
+  assert(/主动性 normal/.test(promptNormal) && /三条筛选判据/.test(promptNormal), '★ the work prompt names the initiative档位 and the three selection criteria')
+  await wNormal.call('vibe_math_pause', {})
+
+  const wEager = await makeCase('lean-init-eager')
+  await wEager.call('vibe_math_set_params', { formalVerify: 'encourage', leanInitiative: 'eager' })
+  await wEager.call('vibe_math_add_problem', { id: 'qInitE', description: '主动性提示词 eager' })
+  await startScheduler(wEager)
+  const exE = await waitFor(() => wEager.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
+  assert(!!exE && /主动档（leanInitiative=eager）/.test(exE.prompt || ''), '★★ leanInitiative=eager adds the eager line (the prompt reads the initiative parameter)')
+  await wEager.call('vibe_math_pause', {})
+
+  // v5 统一口径：主动性（leanInitiative）与验证要求强度（formalVerify）是两根独立的轴。
+  // （a）leanInitiative:'off' ⇒ 连日线都不注入（真无操作）。
+  const wOff = await makeCase('lean-init-off')
+  await wOff.call('vibe_math_set_params', { formalVerify: 'encourage', leanInitiative: 'off' })
+  await wOff.call('vibe_math_add_problem', { id: 'qInitO', description: '主动性提示词 off' })
+  await startScheduler(wOff)
+  const exO = await waitFor(() => wOff.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
+  assert(!!exO && !/顺手形式化/.test(exO.prompt || ''), '★★ leanInitiative=off drops the daily line entirely (initiative is a separate axis from formalVerify, which is still encourage here)')
+  await wOff.call('vibe_math_pause', {})
+
+  // （b）formalVerify:'off' + leanInitiative:'eager' ⇒ 日线仍必须注入（eager 是独立轴，不许被 off 静默吞掉），
+  //     而**验证阶段**的 Lean 文本仍然关闭。
+  const wOffEager = await makeCase('lean-init-off-eager')
+  await wOffEager.call('vibe_math_set_params', { formalVerify: 'off', leanInitiative: 'eager' })
+  await wOffEager.call('vibe_math_add_problem', { id: 'qInitOE', description: 'off+eager 主动性' })
+  await startScheduler(wOffEager)
+  const exOE = await waitFor(() => wOffEager.spawns.find((s) => s.label.indexOf('explorer') === 0), 60, 60)
+  const pOE = (exOE && exOE.prompt) || ''
+  assert(/主动档（leanInitiative=eager）/.test(pOE) && /三条筛选判据/.test(pOE), '★★★ formalVerify:off + leanInitiative:eager STILL injects the full daily line (v5 rule: the initiative axis is independent)')
+  assert(!/【Lean 形式化验证（/.test(pOE) && !wOffEager.spawns.some((s) => /【Lean 形式化验证（/.test(s.prompt || '')), '★★★ …while the verification-phase Lean block stays closed (formalVerify:off) in every captured prompt of that root')
+  const stOE = await wOffEager.call('vibe_math_status', {})
+  assert(stOE.params.formalVerify === 'off' && stOE.params.leanInitiative === 'eager', 'the off+eager case really ran with formalVerify:off + leanInitiative:eager')
+  await wOffEager.call('vibe_math_pause', {})
+}
+
+// ---------- 15e. round-2 lens-1 RUNTIME: the initiative axis is injected at EVERY site ----------
+// Three injection sites with three different shapes (explorer / rederive / solver). The static [sites]
+// check can only see that the producer call is not textually gated; THIS section proves the actual
+// prompt text of each site: (1) formalVerify:'off' + leanInitiative:'eager' must carry the daily line
+// at that site (and keep the verification block closed), (2) leanInitiative:'off' must drop it there
+// while the verification phase still follows formalVerify. Assertion names carry the site name, so a
+// single-site regression names itself instead of hiding behind a sibling site's coverage.
+const SITE_DAILY = /三条筛选判据/
+const SITE_VERIFY = /【Lean 形式化验证（/
+const FENCE = '`'.repeat(3)
+const jsonReply = (obj) => FENCE + 'json\n' + JSON.stringify(obj) + '\n' + FENCE
+/** Drive one problem through explorer -> solver(dead-end) -> re-derive and collect each site's prompt. */
+async function driveSites(h, opts, qid) {
+  const q = qid || 'qSite'
+  await h.call('vibe_math_set_params', Object.assign({ tickIntervalMs: 200, verifierCount: 2, leanAsync: false, maxExplorerRetries: 5, maxParallelThreshold: 4 }, opts))
+  await h.call('vibe_math_add_problem', { id: q, description: '站点级运行时用例' })
+  await startScheduler(h)
+  const label = (n) => h.spawns.filter((s) => s.label.startsWith(n + ':' + q))
+  const ex1 = await waitFor(() => label('explorer')[0], 80, 200)
+  const out = { explorer: (ex1 && ex1.prompt) || '' }
+  if (ex1) h.fireEnd({ id: ex1.childId, runId: 'rS1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.8 }] }) }] })
+  const so = await waitFor(() => label('solver')[0], 80, 200)
+  out.solver = (so && so.prompt) || ''
+  if (so) h.fireEnd({ id: so.childId, runId: 'rS2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ status: 'dead-end', dead_end_reason: '站点用例：本方向不可行', solution: '', solution_probability: 0.1, lemmas: [], routes: [], lessons: [], survival_probability: 0.2, sub_questions: [], new_inventions: [{ 类型: '工具', 标题: '站点工具', 内容描述: 'x', 是否已入库: false }] }) }] })
+  // every direction is now dead-end ⇒ the NEXT explorer for this problem is built by rederivePrompt
+  await waitFor(() => label('explorer').length >= 2 && label('explorer')[1], 80, 200)
+  const exs = label('explorer')
+  out.rederive = (exs[1] && exs[1].prompt) || ''
+  out.distinct = !!out.explorer && !!out.rederive && out.explorer !== out.rederive
+  await h.call('vibe_math_abort', {})
+  return out
+}
+{
+  // (1) eager 在 formalVerify:'off' 下也必须在**每一个**站点注入日线
+  const he = await makeCase('site-eager-off')
+  const A = await driveSites(he, { formalVerify: 'off', leanInitiative: 'eager' })
+  assert(SITE_DAILY.test(A.explorer), '★ [explorer site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(SITE_DAILY.test(A.solver), '★ [solver site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(SITE_DAILY.test(A.rederive), '★ [rederive site] formalVerify:off + leanInitiative:eager injects the daily line')
+  assert(A.distinct, '★ [rederive site] the re-explore prompt really is the rederive builder (differs from the first explorer wave)')
+  assert(A.explorer.indexOf('【Lean 形式化验证（') === -1 && A.solver.indexOf('【Lean 形式化验证（') === -1 && A.rederive.indexOf('【Lean 形式化验证（') === -1, '★ [all sites] formalVerify:off keeps the verification-phase block closed while eager still injects the daily line')
+
+  // (2) leanInitiative:'off' ⇒ 每个站点都没有日线（同一驱动）
+  const ho = await makeCase('site-init-off')
+  const B = await driveSites(ho, { formalVerify: 'encourage', leanInitiative: 'off' }, 'qSiteOff')
+  assert(!SITE_DAILY.test(B.explorer) && !/【顺手形式化/.test(B.explorer), '★ [explorer site] leanInitiative:off drops the daily line')
+  assert(!SITE_DAILY.test(B.solver) && !/【顺手形式化/.test(B.solver), '★ [solver site] leanInitiative:off drops the daily line')
+  assert(!SITE_DAILY.test(B.rederive) && !/【顺手形式化/.test(B.rederive), '★ [rederive site] leanInitiative:off drops the daily line')
+
+  // (2b) …而验证段仍按 formalVerify 出现（同一参数下的另一个 root，驱动到 verifier）
+  const hv = await makeCase('site-init-off-verify')
+  await hv.call('vibe_math_set_params', { tickIntervalMs: 200, verifierCount: 2, leanAsync: false, formalVerify: 'encourage', leanInitiative: 'off' })
+  await hv.call('vibe_math_add_problem', { id: 'qV', description: '验证段仍在' })
+  await startScheduler(hv)
+  const exv = await waitFor(() => hv.spawns.find((s) => s.label.startsWith('explorer:qV')), 80, 200)
+  assert(!!exv && !SITE_DAILY.test(exv.prompt || ''), '★ [explorer site] 第二个 root：initiative off 时 explorer 仍无日线')
+  if (exv) hv.fireEnd({ id: exv.childId, runId: 'rV1', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ directions: [{ id: 'd1', title: 'D', method: 'm', core_assumption: 'c', feasibility: 0.8 }] }) }] })
+  const sov = await waitFor(() => hv.spawns.find((s) => s.label.startsWith('solver:qV')), 80, 200)
+  if (sov) hv.fireEnd({ id: sov.childId, runId: 'rV2', provider: 'spawn', local: true, stopReason: 'completed', lastAssistantMessage: [{ type: 'text', text: jsonReply({ status: 'success', solution: 'complete solution', solution_probability: 0.9, lemmas: [], routes: [], lessons: [], survival_probability: 0.9, dead_end_reason: null, sub_questions: [] }) }] })
+  const vv = await waitFor(() => hv.spawns.find((s) => /^verifier:/.test(s.label)), 100, 250)
+  assert(!!vv && SITE_VERIFY.test(vv.prompt || ''), '★ leanInitiative:off 时验证段仍按 formalVerify 注入（verifier 提示词含【Lean 形式化验证（）')
+  await hv.call('vibe_math_abort', {})
+}
+
 // ---------- 15f. P2-v2 D4: ONE participant set / ONE count across the two views ----------
 // Pinned definition (must stay in sync with the plugin's voteCount() doc comment):
 //   * participant set of a verify task = `t.children` of the CURRENT round (their `childResults`
@@ -1671,92 +1708,109 @@ section('15f P2-v2 D4: both views read ONE participant set (snapshot + round)')
     '★★★ [D4-v2] 中途调高 verifierCount **不改变**在飞轮次的参与集/需求票数（快照仍是 2；实测 ' + JSON.stringify(after) + '）')
   assert(JSON.stringify(after) === JSON.stringify(afterR),
     '★★ [D4-v2] 调参后两个视图仍然逐字段相同（实测 ' + JSON.stringify({ status: after, report: afterR }) + '）')
+  // 6.5：两条路径（buildReport / getStatus）都必须走同一个 verifyTasksView()，整数组逐字段相同。
+  const stAll = (await h.call('vibe_math_status', {})).verifyTasks || []
+  const rpAll = (await h.call('vibe_math_report', {})).verifyTasks || []
+  assert(stAll.length >= 1 && JSON.stringify(stAll) === JSON.stringify(rpAll),
+    '★★★★ [6.5] status/report 的 verifyTasks 由同一个 verifyTasksView() 产出、逐字段相同（实测 ' + JSON.stringify({ status: stAll, report: rpAll }) + '）')
   await h.call('vibe_math_abort', {})
 }
 
-section('16 the captured prompt corpus is written for human review')
-{
-  // Freeze the scheduler in every case FIRST: a still-running tick loop could emit one more
-  // prompt between two runs and make the corpus non-deterministic.
-  for (const h of hosts) { try { await h.call('vibe_math_pause', {}) } catch (e) { /* ignore */ } }
-  const scrub = (h, s) => {
-    const ws = String(h.WS)
-    const slash = ws.replace(/\\/g, '/')
-    return String(s == null ? '' : s)
-      .split(slash + '/VibeMath').join('<VIBEMATH>')
-      .split(ws + '\\VibeMath').join('<VIBEMATH>')
-      .split(slash).join('<WS>')
-      .split(ws).join('<WS>')
-      // Epoch-ms in a verification-log FILE NAME is run metadata: the final-paper material embeds the
-      // evidence index verbatim, so it must be normalised or the shipped corpus changes every run.
-      .replace(/_[0-9]{10,16}\.json/g, '_<TIME>.json')
-  }
-  const entries = []
-  for (const h of hosts) {
-    for (const s of h.spawns) entries.push({ kind: 'spawn', case: h.label, label: s.label, prompt: scrub(h, s.prompt) })
-    for (const f of h.followups) {
-      const owner = h.spawns.find((s) => s.childId === f.childId)
-      entries.push({ kind: 'wake', case: h.label, label: owner ? owner.label : f.childId, prompt: scrub(h, f.prompt) })
-    }
-    // The framework's own messages to the main agent (reportMode=push). Only the FIRST push per case is
-    // kept: whether a second identical push follows depends on tick/reportDirty timing, and the corpus
-    // must stay byte-identical across runs.
-    if (h.root && Array.isArray(h.root.pushed) && h.root.pushed.length > 0) entries.push({ kind: 'push', case: h.label, label: 'main-agent', prompt: scrub(h, h.root.pushed[0]) })
-    // The framework's human-readable feedback channel: the activity-log line that carries the require
-    // gate's withholding notice. It is captured once, in case 15c, for determinism.
-    if (typeof h.feedbackLine === 'string' && h.feedbackLine) entries.push({ kind: 'feedback', case: h.label, label: 'activity-log', prompt: scrub(h, h.feedbackLine) })
-  }
-  mkdirSync(CORPUS_DIR, { recursive: true })
-  writeFileSync(join(CORPUS_DIR, 'formal-verify-v2.json'), JSON.stringify({ entries: entries }, null, 2), 'utf8')
-  const md = ['# V2 形式化验证交互语料（prompt corpus）', '',
-    '> 由 `formal-verify-v2.test.mjs` 落盘：框架**真正发出**的每一条提示词原文。',
-    '> 工作区路径归一化为 `<WS>`、VibeMath 根归一化为 `<VIBEMATH>`，因此可 diff、不泄露本机路径。',
-    '> 覆盖：off 档（无任何 Lean 文字）、encourage 与 require 的表决初评/辩论、passed 后的忠实性分支、',
-    '> 平时工作轮的「顺手形式化」段落与 formal 回执契约，以及框架自己的两条反馈通道：',
-    '> `reportMode=push` 的推送汇报（kind=push）与 require 门禁搁置的活动日志公告（kind=feedback）。', '']
-  for (let i = 0; i < entries.length; i++) {
-    const e = entries[i]
-    md.push('## [' + i + '] ' + e.kind + ' · ' + e.label + ' · case=' + e.case)
-    md.push('')
-    md.push('```text')
-    md.push(e.prompt)
-    md.push('```')
-    md.push('')
-  }
-  writeFileSync(join(CORPUS_DIR, 'formal-verify-v2.md'), md.join('\n'), 'utf8')
-  assert(existsSync(join(CORPUS_DIR, 'formal-verify-v2.json')) && existsSync(join(CORPUS_DIR, 'formal-verify-v2.md')), 'the prompt corpus was written (JSON + Markdown)')
-  assert(entries.length >= 15, 'the corpus covers the whole run (' + entries.length + ' prompts)')
-  assert(entries.some((e) => /【Lean 形式化验证（鼓励模式）】/.test(e.prompt)), 'the corpus contains the encourage verify prompt')
-  assert(entries.some((e) => /【Lean 形式化验证（强制模式）】/.test(e.prompt)), '★ the corpus contains the REQUIRE verify prompt')
-  assert(entries.some((e) => /你不需要重新检查推导/.test(e.prompt) && /一致 → Result = 1/.test(e.prompt)), 'the corpus contains the passed/fidelity prompt')
-  assert(entries.some((e) => /【顺手形式化（鼓励[^）]*）】/.test(e.prompt)), 'the corpus contains the work-round 顺手形式化 prompt')
-  assert(entries.some((e) => /【顺手形式化/.test(e.prompt) && /"formal":\{"target":"<对象id>","decision":"used\|blocked\|defect"/.test(e.prompt)), 'the corpus contains the formal reply contract line')
-  assert(entries.some((e) => !/Lean|形式化/.test(e.prompt)), 'the corpus contains off-mode prompts with no Lean text at all')
-  assert(entries.some((e) => e.kind === 'wake'), 'the corpus also keeps the continuation prompts (debate rounds)')
-  assert(entries.some((e) => e.kind === 'push' && /\[Vibe Math V2\] 进度更新/.test(e.prompt)), '★ the corpus carries the framework\'s PUSH report (reportMode=push)')
-  assert(entries.some((e) => e.kind === 'feedback' && /require 模式搁置/.test(e.prompt)), '★ and the require-gate withholding notice (the framework→human feedback channel)')
-  // Generic sweeps over EVERY captured prompt, not spot checks (AUDIT §2.1).
-  const joined = entries.map((e) => e.prompt).join('\n')
-  const bare = entries.filter((e) => /(^|[^a-z_])lean_(run|archive|lib)/.test(e.prompt))
-  assert(bare.length === 0, '★ no captured prompt names an abbreviated tool (' + bare.map((b) => b.label).join(',') + ')')
-  const zero = entries.filter((e) => /偏离\s*→\s*0/.test(e.prompt))
-  assert(zero.length === 0, '★ no captured prompt turns a fidelity defect into a 0 vote (' + zero.map((z) => z.label).join(',') + ')')
-  const wrongField = entries.filter((e) => /忠实性/.test(e.prompt) && /verdict/.test(e.prompt))
-  assert(wrongField.length === 0, '★ no fidelity prompt names a `verdict` field (' + wrongField.map((w) => w.label).join(',') + ')')
-  const dirty = entries.filter((e) => /\[object Object\]|\bNaN\b|:\s*undefined|["']undefined["']|undefined\s*[,}\]]/.test(e.prompt))
-  assert(dirty.length === 0, 'no captured prompt contains placeholder garbage (' + dirty.map((d) => d.label).join(',') + ')')
-  assert(joined.indexOf('<VIBEMATH>') !== -1, 'the VibeMath root is normalised to <VIBEMATH>')
-  for (const h of hosts) {
-    const ws = String(h.WS)
-    assert(joined.indexOf(ws) === -1 && joined.indexOf(ws.replace(/\\/g, '/')) === -1, 'no captured prompt leaks a machine path (' + h.label + ')')
-  }
-}
-
-// cleanup
-for (const h of hosts) { try { rmSync(h.WS, { recursive: true, force: true }) } catch (e) { /* ignore */ } }
-
-console.log('')
-console.log('passed=' + passed + ' failed=' + failed)
-if (failed) { console.error('FAILURES:'); for (const f of failures) console.error('  - ' + f); process.exit(1) }
-console.log('ALL GREEN')
-process.exit(0)
+section('16 the captured prompt corpus is written for human review')
+{
+  // Freeze the scheduler in every case FIRST: a still-running tick loop could emit one more
+  // prompt between two runs and make the corpus non-deterministic.
+  for (const h of hosts) { try { await h.call('vibe_math_pause', {}) } catch (e) { /* ignore */ } }
+  const scrub = (h, s) => {
+    const ws = String(h.WS)
+    const slash = ws.replace(/\\/g, '/')
+    return String(s == null ? '' : s)
+      .split(slash + '/VibeMath').join('<VIBEMATH>')
+      .split(ws + '\\VibeMath').join('<VIBEMATH>')
+      .split(slash).join('<WS>')
+      .split(ws).join('<WS>')
+      // Epoch-ms in a verification-log FILE NAME is run metadata: the final-paper material embeds the
+      // evidence index verbatim, so it must be normalised or the shipped corpus changes every run.
+      // 为什么必须保留可选短 id 组（不要"简化"掉）：P7 把裁决日志名改成了
+      // `<rId>_<epochMs>_<shortId>.json`，旧的 `_[0-9]{10,16}\.json` 因此不再匹配，
+      // 于是每次跑动都把自己那次的 时间戳+shortId 写进 shipped 语料（语料非确定性）。
+      // 去掉 `(_[0-9a-f]{8})?` 这个组会静默地重新引入"每次跑都不同"的语料。
+      .replace(/_[0-9]{10,16}(_[0-9a-f]{8})?\.json/g, '_<TIME>.json')
+  }
+  const entries = []
+  for (const h of hosts) {
+    for (const s of h.spawns) entries.push({ kind: 'spawn', case: h.label, label: s.label, prompt: scrub(h, s.prompt) })
+    for (const f of h.followups) {
+      const owner = h.spawns.find((s) => s.childId === f.childId)
+      entries.push({ kind: 'wake', case: h.label, label: owner ? owner.label : f.childId, prompt: scrub(h, f.prompt) })
+    }
+    // The framework's own messages to the main agent (reportMode=push). Only the FIRST push per case is
+    // kept: whether a second identical push follows depends on tick/reportDirty timing, and the corpus
+    // must stay byte-identical across runs.
+    if (h.root && Array.isArray(h.root.pushed) && h.root.pushed.length > 0) entries.push({ kind: 'push', case: h.label, label: 'main-agent', prompt: scrub(h, h.root.pushed[0]) })
+    // The framework's human-readable feedback channel: the activity-log line that carries the require
+    // gate's withholding notice. It is captured once, in case 15c, for determinism.
+    if (typeof h.feedbackLine === 'string' && h.feedbackLine) entries.push({ kind: 'feedback', case: h.label, label: 'activity-log', prompt: scrub(h, h.feedbackLine) })
+  }
+  // F7：v2 各回执的对象类型不同（验证用 Result/Reason 大写；计划/求解/方法卡用小写键），历史上只在示例里
+  // 体现大小写。现在每一条**含 json 契约**的提示词都必须显式写明「键名大小写精确匹配、不接受别名」。
+  const jsonFenced = entries.filter((e) => e.prompt.indexOf('```json') !== -1 || /single JSON object/.test(e.prompt))
+  const missingCaseRule = jsonFenced.filter((e) => e.prompt.indexOf('KEY CASE IS PART OF THE REPLY CONTRACT') === -1)
+  assert(jsonFenced.length >= 4, 'F7: prompts carrying a json contract were captured (' + jsonFenced.length + ')')
+  assert(missingCaseRule.length === 0, '★★ [F7] every json-contract prompt states the canonical key-case rule (offenders=' + JSON.stringify(missingCaseRule.map((e) => e.label)) + ')')
+  const capitalised = entries.filter((e) => /"Result":/.test(e.prompt))
+  assert(capitalised.every((e) => e.prompt.indexOf('KEY CASE IS PART OF THE REPLY CONTRACT') !== -1), '★★ [F7] …including the capitalised Result/Reason contracts (' + capitalised.length + ')')
+  mkdirSync(CORPUS_DIR, { recursive: true })
+  writeFileAtomic(join(CORPUS_DIR, 'formal-verify-v2.json'), JSON.stringify({ entries: entries }, null, 2))
+  const md = ['# V2 形式化验证交互语料（prompt corpus）', '',
+    '> 由 `formal-verify-v2.test.mjs` 落盘：框架**真正发出**的每一条提示词原文。',
+    '> 工作区路径归一化为 `<WS>`、VibeMath 根归一化为 `<VIBEMATH>`，因此可 diff、不泄露本机路径。',
+    '> 覆盖：off 档（无任何 Lean 文字）、encourage 与 require 的表决初评/辩论、passed 后的忠实性分支、',
+    '> 平时工作轮的「顺手形式化」段落与 formal 回执契约，以及框架自己的两条反馈通道：',
+    '> `reportMode=push` 的推送汇报（kind=push）与 require 门禁搁置的活动日志公告（kind=feedback）。', '']
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i]
+    md.push('## [' + i + '] ' + e.kind + ' · ' + e.label + ' · case=' + e.case)
+    md.push('')
+    md.push('```text')
+    md.push(e.prompt)
+    md.push('```')
+    md.push('')
+  }
+  writeFileAtomic(join(CORPUS_DIR, 'formal-verify-v2.md'), md.join('\n'))
+  assert(existsSync(join(CORPUS_DIR, 'formal-verify-v2.json')) && existsSync(join(CORPUS_DIR, 'formal-verify-v2.md')), 'the prompt corpus was written (JSON + Markdown)')
+  assert(entries.length >= 15, 'the corpus covers the whole run (' + entries.length + ' prompts)')
+  assert(entries.some((e) => /【Lean 形式化验证（鼓励模式）】/.test(e.prompt)), 'the corpus contains the encourage verify prompt')
+  assert(entries.some((e) => /【Lean 形式化验证（强制模式）】/.test(e.prompt)), '★ the corpus contains the REQUIRE verify prompt')
+  assert(entries.some((e) => /你不需要重新检查推导/.test(e.prompt) && /一致 → Result = 1/.test(e.prompt)), 'the corpus contains the passed/fidelity prompt')
+  assert(entries.some((e) => /【顺手形式化（鼓励[^）]*）】/.test(e.prompt)), 'the corpus contains the work-round 顺手形式化 prompt')
+  assert(entries.some((e) => /【顺手形式化/.test(e.prompt) && /"formal":\{"target":"<对象id>","decision":"used\|blocked\|defect"/.test(e.prompt)), 'the corpus contains the formal reply contract line')
+  assert(entries.some((e) => !/Lean|形式化/.test(e.prompt)), 'the corpus contains off-mode prompts with no Lean text at all')
+  assert(entries.some((e) => e.kind === 'wake'), 'the corpus also keeps the continuation prompts (debate rounds)')
+  assert(entries.some((e) => e.kind === 'push' && /\[Vibe Math V2\] 进度更新/.test(e.prompt)), '★ the corpus carries the framework\'s PUSH report (reportMode=push)')
+  assert(entries.some((e) => e.kind === 'feedback' && /require 模式搁置/.test(e.prompt)), '★ and the require-gate withholding notice (the framework→human feedback channel)')
+  // Generic sweeps over EVERY captured prompt, not spot checks (AUDIT §2.1).
+  const joined = entries.map((e) => e.prompt).join('\n')
+  const bare = entries.filter((e) => /(^|[^a-z_])lean_(run|archive|lib)/.test(e.prompt))
+  assert(bare.length === 0, '★ no captured prompt names an abbreviated tool (' + bare.map((b) => b.label).join(',') + ')')
+  const zero = entries.filter((e) => /偏离\s*→\s*0/.test(e.prompt))
+  assert(zero.length === 0, '★ no captured prompt turns a fidelity defect into a 0 vote (' + zero.map((z) => z.label).join(',') + ')')
+  const wrongField = entries.filter((e) => /忠实性/.test(e.prompt) && /verdict/.test(e.prompt))
+  assert(wrongField.length === 0, '★ no fidelity prompt names a `verdict` field (' + wrongField.map((w) => w.label).join(',') + ')')
+  const dirty = entries.filter((e) => /\[object Object\]|\bNaN\b|:\s*undefined|["']undefined["']|undefined\s*[,}\]]/.test(e.prompt))
+  assert(dirty.length === 0, 'no captured prompt contains placeholder garbage (' + dirty.map((d) => d.label).join(',') + ')')
+  assert(joined.indexOf('<VIBEMATH>') !== -1, 'the VibeMath root is normalised to <VIBEMATH>')
+  for (const h of hosts) {
+    const ws = String(h.WS)
+    assert(joined.indexOf(ws) === -1 && joined.indexOf(ws.replace(/\\/g, '/')) === -1, 'no captured prompt leaks a machine path (' + h.label + ')')
+  }
+}
+
+// cleanup
+for (const h of hosts) { try { rmSync(h.WS, { recursive: true, force: true }) } catch (e) { /* ignore */ } }
+
+console.log('')
+console.log('passed=' + passed + ' failed=' + failed)
+if (failed) { console.error('FAILURES:'); for (const f of failures) console.error('  - ' + f); process.exit(1) }
+console.log('ALL GREEN')
+process.exit(0)