dsh-vibe-math 2.7.2 → 2.8.0

package/tests/math-computation-shared.test.mjs

@@ -15,7 +15,8 @@
 // Usage: node tests/math-computation-shared.test.mjs
 // ============================================================================================
 import { makeFakeHost } from './helpers/math-computation-fake-seam.mjs'
-import { pathToFileURL } from 'node:url'
+import { pathToFileURL, fileURLToPath } from 'node:url'
+import { readFileSync } from 'node:fs'
 
 // The sensitivity probe (tests/audit-math-computation-sensitivity.mjs) points this at a MUTATED copy
 // of the module pair; the default is the shipped copy in vibe-math-v2/.
@@ -24,6 +25,172 @@ const MODULE = process.env.MATH_COMPUTATION_MODULE
   : new URL('../vibe-math-v2/math-computation.js', import.meta.url).href
 const M = await import(MODULE)
 
+// §30 predicates — used by the §30 assertions AND by `--self-probe` case 3, so the shipped proof and the
+// audit cannot drift ("same predicate, broken input"). Unit: descriptor entries carrying the reason.
+const carriesVerifyProvenance = (v) => !!v && v.verify === true && typeof v.verifyReason === 'string' && v.verifyReason.length > 0
+const hasNoVerifySlot = (v) => !!v && !('verify' in v) && !('verifyReason' in v)
+
+// ── --self-probe (shipped): prove the §32 evidence assertion can REDDEN, from the tarball alone.
+// It copies the module, removes ONE `fail()` whitelist line, and requires the named §32 assertion
+// to fail in the child. Usage: node tests/math-computation-shared.test.mjs --self-probe
+if (process.argv.includes('--self-probe')) {
+  const { mkdtempSync, copyFileSync, readFileSync: rf, writeFileSync: wf, rmSync } = await import('node:fs')
+  const { tmpdir } = await import('node:os')
+  const { join, dirname } = await import('node:path')
+  const { spawnSync } = await import('node:child_process')
+  const modPath = process.env.MATH_COMPUTATION_MODULE || fileURLToPath(new URL('../vibe-math-v2/math-computation.js', import.meta.url))
+  const dir = mkdtempSync(join(tmpdir(), 'mc-shared-selfprobe-'))
+  const enginesSrc = join(dirname(modPath), 'math-engines.js')
+  try { copyFileSync(enginesSrc, join(dir, 'math-engines.js')) } catch (e) { /* engines may be resolved elsewhere */ }
+  const src = rf(modPath, 'utf8').replace(/\r\n/g, '\n')
+  const whitelist = '  if (extra && Array.isArray(extra.absent)) out.absent = extra.absent\n'
+  if (src.indexOf(whitelist) === -1) {
+    console.log('SELF-PROBE FAIL: the fail() whitelist line for absent[] was not found (the probe cannot mutate what it cannot see)')
+    rmSync(dir, { recursive: true, force: true })
+    process.exit(1)
+  }
+  wf(join(dir, 'math-computation.js'), src.replace(whitelist, ''))
+  const child = spawnSync(process.execPath, [fileURLToPath(import.meta.url)], { encoding: 'utf8', maxBuffer: 1 << 26, env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: join(dir, 'math-computation.js') }) })
+  const out = String(child.stdout || '') + String(child.stderr || '')
+  const failLines = out.split('\n').filter((l) => /^\s*FAIL\b/.test(l))
+  const named = failLines.some((l) => l.indexOf('S2 absence evidence: the failure carries an absent[] list') !== -1)
+  const sum = (out.split('\n').filter((l) => /passed, \d+ failed/.test(l)).slice(-1)[0] || '').trim()
+  console.log((child.status !== 0 && named ? 'SELF-PROBE PASS' : 'SELF-PROBE FAIL') + ': removing ONE fail() whitelist line reddens the named §32 assertion (' + sum + ')')
+  if (!named) for (const l of failLines.slice(0, 4)) console.log('      child FAIL line: ' + l.trim().slice(0, 140))
+  rmSync(dir, { recursive: true, force: true })
+  // case 2 (S4/S5): remove the single `out.installedSoFar = …` assignment and require the NAMED §33
+  // assertion in the child's FAIL line (a label found anywhere in the output is NOT a red).
+  const s45line = '      out.installedSoFar = results.filter((x) => x.exit === 0).map((x) => x.argv)\n'
+  const dir2 = mkdtempSync(join(tmpdir(), 'mc-shared-selfprobe2-'))
+  const src2 = rf(modPath, 'utf8').replace(/\r\n/g, '\n')
+  let ok2 = false
+  if (src2.indexOf(s45line) === -1) {
+    console.log('SELF-PROBE FAIL: the installedSoFar assignment was not found (cannot mutate what it cannot see)')
+  } else {
+    try { copyFileSync(join(dirname(modPath), 'math-engines.js'), join(dir2, 'math-engines.js')) } catch (e) { /* optional */ }
+    wf(join(dir2, 'math-computation.js'), src2.replace(s45line, ''))
+    const child2 = spawnSync(process.execPath, [fileURLToPath(import.meta.url)], { encoding: 'utf8', maxBuffer: 1 << 26, env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: join(dir2, 'math-computation.js') }) })
+    const out2 = String(child2.stdout || '') + String(child2.stderr || '')
+    const failLines2 = out2.split('\n').filter((l) => /^\s*FAIL\b/.test(l))
+    ok2 = child2.status !== 0 && failLines2.some((l) => l.indexOf('reports what already succeeded (installedSoFar)') !== -1)
+    const sum2 = (out2.split('\n').filter((l) => /passed, \d+ failed/.test(l)).slice(-1)[0] || '').trim()
+    console.log((ok2 ? 'SELF-PROBE PASS' : 'SELF-PROBE FAIL') + ': removing ONE installedSoFar assignment reddens the named §33 assertion (' + sum2 + ')')
+    if (!ok2) for (const l of failLines2.slice(0, 4)) console.log('      child FAIL line: ' + l.trim().slice(0, 140))
+  }
+  rmSync(dir2, { recursive: true, force: true })
+  // case 3 (§30, verify provenance): the SAME predicates the §30 assertions use, fed a broken helper.
+  // The real `verifyFields(engine)` helper is extracted from the module under test and run against a stub
+  // descriptor table; dropping its single reason line (or the no-empty-slot guard) must flip its predicate.
+  const src3 = rf(modPath, 'utf8').replace(/\r\n/g, '\n')
+  const hStart = src3.indexOf('function verifyFields(engine) {')
+  let helper = ''
+  if (hStart !== -1) {
+    let d = 0, end = hStart
+    for (let i = hStart; i < src3.length; i++) { if (src3[i] === '{') d++; else if (src3[i] === '}') { d--; if (d === 0) { end = i + 1; break } } }
+    helper = src3.slice(hStart, end)
+  }
+  const REASON_LINE = "  if (typeof d.verifyReason === 'string' && d.verifyReason) out.verifyReason = d.verifyReason\n"
+  const GUARD_LINE = '  if (!d.verify) return {}\n'
+  let ok3 = false
+  if (helper.indexOf(REASON_LINE) === -1 || helper.indexOf(GUARD_LINE) === -1) {
+    console.log('SELF-PROBE FAIL: the §30 helper anchors were not found (the probe cannot mutate what it cannot see)')
+  } else {
+    const stub = { maple: { verify: true, verifyReason: 'CLI spelling varies by Maple version - confirm on a licensed machine' }, python: { license: 'free' } }
+    const make = (s) => new Function('MATH_ENGINES', s + '\nreturn verifyFields;')(stub)
+    const good = make(helper)
+    const broken = make(helper.replace(REASON_LINE, ''))
+    const brokenGuard = make(helper.replace(GUARD_LINE, ''))
+    const cases3 = [
+      ['§30 probe carries WHY (shared predicate carriesVerifyProvenance)', carriesVerifyProvenance(good('maple')), carriesVerifyProvenance(broken('maple'))],
+      ['§30 no empty slot without a declared reason (hasNoVerifySlot)', hasNoVerifySlot(good('python')), hasNoVerifySlot(brokenGuard('python'))],
+    ]
+    let bad3 = 0
+    for (const [name, greenNow, redWhenBroken] of cases3) {
+      const okc = greenNow === true && redWhenBroken === false
+      if (!okc) bad3++
+      console.log((okc ? '  ok   ' : '  FAIL ') + name + ' :: green-now=' + greenNow + ' broken-goes-red=' + !redWhenBroken)
+    }
+    ok3 = bad3 === 0
+    console.log('  --- §30 verify-provenance predicates: ' + (cases3.length - bad3) + '/' + cases3.length + ' as required')
+  }
+  // case 4 (task-1): mislabel the bundled-runtime stage -> the named foundVia assertion must redden.
+  // NOTE: the self-probe's fs imports are ALIASED at the top of this block (`rf` = readFileSync,
+  // `wf` = writeFileSync); using the unaliased names here is a ReferenceError, not a probe failure.
+  let ok4 = false
+  {
+    const dir4 = mkdtempSync(join(tmpdir(), 'mc-shared-selfprobe4-'))
+    try {
+      copyFileSync(join(dirname(modPath), 'math-engines.js'), join(dir4, 'math-engines.js'))
+      const src4 = rf(modPath, 'utf8').replace(/\r\n/g, '\n')
+      const FROM4 = "via: 'host-runtime'"
+      const n4 = src4.split(FROM4).length - 1
+      if (n4 !== 1) {
+        console.log('SELF-PROBE FAIL: the stage-2 via anchor occurs ' + n4 + ' times (expected exactly 1)')
+      } else {
+        wf(join(dir4, 'math-computation.js'), src4.split(FROM4).join("via: 'path'"), 'utf8')
+        const child4 = spawnSync(process.execPath, [fileURLToPath(import.meta.url)], { encoding: 'utf8', maxBuffer: 1 << 26,
+          env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: join(dir4, 'math-computation.js') }) })
+        const out4 = String(child4.stdout || '') + String(child4.stderr || '')
+        const failLines4 = out4.split('\n').filter((l) => /^\s*FAIL\b/.test(l))
+        const named4 = failLines4.some((l) => l.indexOf('a bundled runtime tree is reported as host-runtime') !== -1)
+        const summary4 = out4.split('\n').filter((l) => /passed,/.test(l)).slice(-1)[0] || 'no summary'
+        ok4 = child4.status !== 0 && named4
+        console.log((ok4 ? 'SELF-PROBE PASS' : 'SELF-PROBE FAIL') + ': mislabelling the bundled-runtime stage reddens the named foundVia assertion (' + summary4 + ')')
+        if (!ok4) for (const l of failLines4.slice(0, 4)) console.log('      child FAIL line: ' + l.trim().slice(0, 140))
+      }
+    } finally { rmSync(dir4, { recursive: true, force: true }) }
+  }
+  // case 5 (task-2 item 3): restore the old `injected || …` form -> the named empty-injection
+  // assertion must redden (a JS empty array is truthy, so the per-OS table was suppressed).
+  let ok5 = false
+  {
+    const dir5 = mkdtempSync(join(tmpdir(), 'mc-shared-selfprobe5-'))
+    try {
+      copyFileSync(join(dirname(modPath), 'math-engines.js'), join(dir5, 'math-engines.js'))
+      const src5 = rf(modPath, 'utf8').replace(/\r\n/g, '\n')
+      const FIXED5 = 'const roots = (Array.isArray(injected) && injected.length) ? injected : mathInstallRoots(engineName, env, win)'
+      const n5 = src5.split(FIXED5).length - 1
+      if (n5 !== 1) console.log('SELF-PROBE FAIL: the empty-array guard occurs ' + n5 + ' times (expected exactly 1)')
+      else {
+        wf(join(dir5, 'math-computation.js'), src5.split(FIXED5).join('const roots = injected || mathInstallRoots(engineName, env, win)'), 'utf8')
+        const child5 = spawnSync(process.execPath, [fileURLToPath(import.meta.url)], { encoding: 'utf8', maxBuffer: 1 << 26,
+          env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: join(dir5, 'math-computation.js') }) })
+        const out5 = String(child5.stdout || '') + String(child5.stderr || '')
+        const failLines5 = out5.split('\n').filter((l) => /^\s*FAIL\b/.test(l))
+        ok5 = child5.status !== 0 && failLines5.some((l) => l.indexOf('task-2 empty-injection') !== -1)
+        const sum5 = (out5.split('\n').filter((l) => /passed,/.test(l)).slice(-1)[0] || 'no summary').trim()
+        console.log((ok5 ? 'SELF-PROBE PASS' : 'SELF-PROBE FAIL') + ': restoring the old injected-truthiness form reddens the named empty-injection assertion (' + sum5 + ')')
+        if (!ok5) for (const l of failLines5.slice(0, 4)) console.log('      child FAIL line: ' + l.trim().slice(0, 140))
+      }
+    } finally { rmSync(dir5, { recursive: true, force: true }) }
+  }
+  // case 6 (task-2 built-in route): empty the built-in root table -> the named built-in-route assertion
+  // must redden (§23c injects NO roots, so the built-in table is the only stage that can find it).
+  let ok6 = false
+  {
+    const dir6 = mkdtempSync(join(tmpdir(), 'mc-shared-selfprobe6-'))
+    try {
+      copyFileSync(join(dirname(modPath), 'math-engines.js'), join(dir6, 'math-engines.js'))
+      const src6 = rf(modPath, 'utf8').replace(/\r\n/g, '\n')
+      const TABLE6 = 'return (table[engineName] || []).filter((x) => typeof x === \'string\' && x)'
+      const n6 = src6.split(TABLE6).length - 1
+      if (n6 !== 1) console.log('SELF-PROBE FAIL: the built-in root-table return occurs ' + n6 + ' times (expected exactly 1)')
+      else {
+        wf(join(dir6, 'math-computation.js'), src6.split(TABLE6).join('return []'), 'utf8')
+        const child6 = spawnSync(process.execPath, [fileURLToPath(import.meta.url)], { encoding: 'utf8', maxBuffer: 1 << 26,
+          env: Object.assign({}, process.env, { MATH_COMPUTATION_MODULE: join(dir6, 'math-computation.js') }) })
+        const out6 = String(child6.stdout || '') + String(child6.stderr || '')
+        const failLines6 = out6.split('\n').filter((l) => /^\s*FAIL\b/.test(l))
+        ok6 = child6.status !== 0 && failLines6.some((l) => l.indexOf('task-2 built-in route') !== -1)
+        const sum6 = (out6.split('\n').filter((l) => /passed,/.test(l)).slice(-1)[0] || 'no summary').trim()
+        console.log((ok6 ? 'SELF-PROBE PASS' : 'SELF-PROBE FAIL') + ': emptying the built-in root table reddens the named built-in-route assertion (' + sum6 + ')')
+        if (!ok6) for (const l of failLines6.slice(0, 4)) console.log('      child FAIL line: ' + l.trim().slice(0, 140))
+      }
+    } finally { rmSync(dir6, { recursive: true, force: true }) }
+  }
+    process.exit(child.status !== 0 && named && ok2 && ok3 && ok4 && ok5 && ok6 ? 0 : 1)
+}
+
 let passed = 0, failed = 0
 const failures = []
 function ok(cond, label, detail) {
@@ -186,7 +353,7 @@ console.log('-- math_computation shared contract --')
     ok(r.cliScriptAppended === true, 'the return shell flags cliScriptAppended')
     ok(r.engine === 'cli:/fake/bin/mytool' && r.engineInfo.name === 'cli:/fake/bin/mytool', 'cli is labelled cli:<command> in the shell and engineInfo')
     const rj = JSON.parse(state.file(r.receipt.json))
-    ok(rj.engine.name === 'cli:/fake/bin/mytool' && rj.engine.source === 'cli' && rj.cli && rj.cli.argv.length === 2, 'cli receipt records cli:<command>, source=cli and the USER argv')
+    ok(rj.engine.name === 'cli:/fake/bin/mytool' && rj.engine.source === 'cli' && rj.engine.foundVia === 'cli' && rj.cli && rj.cli.argv.length === 2, 'cli receipt records cli:<command>, source=cli, foundVia=cli and the USER argv')
     ok(rj.cli.scriptAppended === true && rj.argv[rj.argv.length - 1] === r.argv[3], 'the receipt records scriptAppended and the executed argv')
   })
   await withHost({ params: { mathMode: 'typed' } }, async (state) => {
@@ -613,6 +780,7 @@ console.log('-- math_computation shared contract --')
     const p = await hb.call({ op: 'probe', engine: 'python' })
     ok(p.ok === true && p.engine === 'python' && p.engineInfo.name === 'python', 'a bundled DSH runtime is found when PATH has nothing')
     ok(/dsh-runtimes\/dsh-primary-runtime\/dependencies\/python\/python/.test(p.engineInfo.path), 'the discovered path comes from the generically globbed runtime tree')
+      ok(p.engineInfo.foundVia === 'host-runtime', '★ a bundled runtime tree is reported as host-runtime (foundVia, not the coarse source)')
     const r = await hb.call({ op: 'run', engine: 'python', mode: 'code', code: 'print(1)\n' })
     ok(r.ok === true && !!r.engineInfo.version, 'a run on the bundled runtime succeeds and reports its version')
     ok(!r.next, 'a found bundled runtime emits NO install guidance')
@@ -826,15 +994,84 @@ console.log('-- math_computation shared contract --')
 // R 4.6.1 went to `C:\Program Files\R\R-4.6.1\bin` without touching PATH, so `probe` used to say R
 // was missing even though it was installed.
 {
+  // round-B (F4): the candidate roots are INJECTED through the host seam, so this fixture cannot depend
+  // on the ambient machine's ProgramFiles/LOCALAPPDATA (which made it a false red on other layouts).
+  const RROOT = 'X:/installs/R'
   const absTree = {
-    'C:/Program Files/R': [{ name: 'R-4.6.1', type: 'directory' }],
-    'C:/Program Files/R/R-4.6.1/bin': [{ name: 'Rscript.exe', type: 'file' }, { name: 'R.exe', type: 'file' }],
+    [RROOT]: [{ name: 'R-4.6.1', type: 'directory' }],
+    [RROOT + '/R-4.6.1/bin']: [{ name: 'Rscript.exe', type: 'file' }, { name: 'R.exe', type: 'file' }],
   }
-  const h = makeFakeHost({ installed: [], absTree: absTree, runtimeRoots: [] })
+  const h = makeFakeHost({ installed: [], absTree: absTree, runtimeRoots: [], installRoots: { r: [RROOT] } })
   M.registerMathComputation(h.host)
   const p = await h.call({ op: 'probe', engine: 'r' })
   ok(p.ok === true && p.engine === 'r', '★ a Rscript that exists ONLY in the default install dir is discovered (not on PATH)')
-  ok(!!p.engineInfo && /Program Files\/R\/R-4\.6\.1\/bin\/Rscript/.test(String(p.engineInfo.path)), 'the discovered path is the versioned install dir (' + String(p.engineInfo && p.engineInfo.path).slice(0, 60) + ')')
+  ok(!!p.engineInfo && /installs\/R\/R-4\.6\.1\/bin\/Rscript/.test(String(p.engineInfo.path)), 'the discovered path is the versioned install dir (' + String(p.engineInfo && p.engineInfo.path).slice(0, 60) + ')')
+      ok(p.engineInfo.foundVia === 'known-install', '★ a known install dir is reported as known-install (foundVia)')
+}
+// ── 23b. round-B (F3): the SAME walker covers Octave and Julia default dirs (both layout shapes)
+{
+  const OROOT = 'X:/installs/GNU Octave'
+  const JROOT = 'X:/home/.juliaup/bin'
+  const absTree = {
+    [OROOT]: [{ name: 'Octave-9.2.0', type: 'directory' }],
+    [OROOT + '/Octave-9.2.0']: [{ name: 'mingw64', type: 'directory' }],
+    [OROOT + '/Octave-9.2.0/mingw64/bin']: [{ name: 'octave-cli.exe', type: 'file' }],
+    [JROOT]: [{ name: 'julia.exe', type: 'file' }],
+  }
+  const h = makeFakeHost({ installed: [], absTree: absTree, runtimeRoots: [], installRoots: { octave: [OROOT], julia: [JROOT] } })
+  M.registerMathComputation(h.host)
+  const po = await h.call({ op: 'probe', engine: 'octave' })
+  ok(po.ok === true && /Octave-9\.2\.0\/mingw64\/bin\/octave-cli/.test(String(po.engineInfo && po.engineInfo.path)), '★ an Octave installed in its default dir (no PATH) is discovered (versioned + mingw64/bin layout)')
+  const pj = await h.call({ op: 'probe', engine: 'julia' })
+  ok(pj.ok === true && /\.juliaup\/bin\/julia/.test(String(pj.engineInfo && pj.engineInfo.path)), '★ a juliaup-managed Julia (flat bin dir, no PATH) is discovered by the same walker')
+  const pr = await h.call({ op: 'probe' })
+  ok((pr.absent || []).some((a) => a.engine === 'r' && a.why === 'not-found-on-this-machine'), 'an engine with no injected roots and no PATH entry is still honestly listed as absent')
+  // F3: the per-engine default roots are part of the contract (the release notes claim "installed but not
+  // on PATH is found"), so their coverage is asserted directly - not only via an injected fixture.
+  for (const e of ['r', 'python', 'octave', 'julia', 'matlab']) {
+    ok(typeof M.mathInstallRoots === 'function' && M.mathInstallRoots(e, {}, true).length > 0 && M.mathInstallRoots(e, {}, false).length > 0,
+      '★ every engine with a well-defined default install dir declares per-OS roots: ' + e)
+  }
+}
+// ── 23c (task-2): the route a REAL machine takes — the BUILT-IN per-OS table + a REAL filesystem
+// listing. §23/§23b above both INJECT the candidate roots; this section has NO `installRoots` at all
+// and uses a real absolute temp dir laid out like <tmp>/R/<version>/bin. `knownInstallCandidates`
+// reads process.env at CALL time, so pointing `ProgramFiles` at the temp dir is enough (no seam).
+async function task2ProbeBuiltInRoots(opts) {
+  const { mkdtempSync, mkdirSync, writeFileSync, readdirSync, rmSync } = await import('node:fs')
+  const { tmpdir } = await import('node:os')
+  const { join } = await import('node:path')
+  const tmp = mkdtempSync(join(tmpdir(), 'mc-known-install-'))
+  const prevPF = process.env.ProgramFiles
+  try {
+    mkdirSync(join(tmp, 'R', 'R-4.6.1', 'bin'), { recursive: true })
+    writeFileSync(join(tmp, 'R', 'R-4.6.1', 'bin', 'Rscript.exe'), '')
+    process.env.ProgramFiles = tmp
+    const h = makeFakeHost(Object.assign({ installed: [], runtimeRoots: [] }, opts || {}))
+    h.host.listDirAbs = async (abs) => {
+      try { return readdirSync(abs, { withFileTypes: true }).map((e) => ({ name: e.name, type: e.isDirectory() ? 'directory' : 'file' })) } catch (e) { return [] }
+    }
+    M.registerMathComputation(h.host)
+    const p = await h.call({ op: 'probe', engine: 'r' })
+    return { p, tmp }
+  } finally {
+    if (prevPF === undefined) delete process.env.ProgramFiles; else process.env.ProgramFiles = prevPF
+    rmSync(tmp, { recursive: true, force: true })
+  }
+}
+{
+  const { p, tmp } = await task2ProbeBuiltInRoots(null)
+  ok(p.ok === true && p.engine === 'r', '★ task-2 built-in route: an engine under the BUILT-IN per-OS root is discovered with a REAL fs listing (no installRoots injection)')
+  ok(!!p.engineInfo && /R-4\.6\.1\/bin\/Rscript/.test(String(p.engineInfo.path)) && String(p.engineInfo.path).replace(/\\/g, '/').indexOf(tmp.replace(/\\/g, '/')) !== -1,
+    '★ task-2 built-in route: the discovered path is the versioned install dir inside the temp root (' + String(p.engineInfo && p.engineInfo.path) + ')')
+  ok(!!p.engineInfo && p.engineInfo.foundVia === 'known-install', '★ task-2 built-in route: foundVia names the known-install stage (' + String(p.engineInfo && p.engineInfo.foundVia) + ')')
+}
+// ── 23d (task-2 item 3): an EMPTY injected array must not suppress the built-in table. A JS empty array
+// is TRUTHY, so `injected || mathInstallRoots(...)` silently disabled the whole per-OS stage.
+{
+  const { p } = await task2ProbeBuiltInRoots({ installRoots: { r: [] } })
+  ok(p.ok === true && !!p.engineInfo && p.engineInfo.foundVia === 'known-install',
+    '★ task-2 empty-injection: a host that answers [] still falls back to the BUILT-IN roots (a JS empty array is truthy)')
 }
 // ── 24. round-9 (real-engine): never suggest an install command that cannot run on this machine
 {
@@ -894,6 +1131,9 @@ console.log('-- math_computation shared contract --')
   ok(r1.ok === true && r1.attempt === 1 && r1.scriptChanged === false, 'first run of a source file: attempt 1, no change')
   const rj1 = JSON.parse(h.files.get(String(r1.receipt.json).replace(/\\/g, '/')))
   ok(typeof r1.runId === 'string' && rj1.runId === r1.runId, '★ the run response exposes its archive id (matches the durable receipt.runId) - needed to check "same archive id"')
+  // round-B (F6): the DURABLE receipt must record the constraint policy too (not just the response).
+  ok(typeof rj1.versionPolicy === 'string' && /existence-only/.test(rj1.versionPolicy) && Array.isArray(rj1.constraintsNotEnforced),
+    '★ the durable receipt records versionPolicy + constraintsNotEnforced (the promise is auditable evidence)')
   h.files.set('Problems/x.py', 'print(2)\n')
   const r2 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: 'Problems/x.py' })
   ok(r2.ok === true && r2.runId === r1.runId, '★ editing the ORIGINAL source and re-running lands on the SAME archive id')
@@ -913,6 +1153,18 @@ console.log('-- math_computation shared contract --')
   ok(r3.scriptChanged === false, '★ …and reports scriptChanged:false (no history FOR THIS id)')
   ok(r3.previousReceipt === null || r3.previousReceipt === undefined, '★ …and has no previousReceipt (expected, not broken change detection)')
   ok(h.files.get(String(r1.scriptPath).replace(/\\/g, '/')) === 'print(1)\n', 'the earlier attempt is still untouched after that run')
+  // Review round A (F1/F2): the ARCHIVED copy is REACHABLE (projectRel() is purely lexical - it rejects
+  // absolute paths and escaping `..` only). The shipped guidance must therefore say the truth: pointing
+  // mode:'file' at the archived copy yields a NEW archive (new id, attempt 1, no history), flagged by
+  // fileIsArchivedScript + ARCHIVED_SCRIPT_RERUN - it is NOT "a new attempt of the same archive".
+  const archivedPath = String(r1.scriptPath).replace(/\\/g, '/')
+  const r4 = await h.call({ op: 'run', engine: 'python', mode: 'file', file: archivedPath })
+  ok(r4.ok === true, '★ pointing mode:file at the ARCHIVED copy succeeds (the guard is lexical, it does not refuse Computation/)')
+  ok(r4.fileIsArchivedScript === true, '★ the response flags fileIsArchivedScript for an archived source')
+  ok((r4.warnings || []).some((w) => w.code === 'ARCHIVED_SCRIPT_RERUN'), '★ the response warns ARCHIVED_SCRIPT_RERUN (so it cannot read as broken change detection)')
+  ok(r4.runId !== r1.runId && r4.attempt === 1 && r4.scriptChanged === false && (r4.previousReceipt === null || r4.previousReceipt === undefined),
+    '★ …and it really is a NEW archive (new id, attempt 1, no history) - NOT a new attempt of the same archive')
+  ok(h.files.get(archivedPath) === 'print(1)\n', 'the archived original is still byte-identical after that run')
 }
 // ── 27. round-9 (N2): a TIMEOUT carries its partial output in BOTH the response and the receipt
 {
@@ -925,7 +1177,141 @@ console.log('-- math_computation shared contract --')
   ok(typeof rj.partialStdout === 'string' && typeof rj.partialStderr === 'string', '★ the TIMEOUT receipt JSON carries the capped partial output (as strings)')
 }
 
+// ── 28. descriptor sweep: NO spawn may ever carry an unsubstituted argv placeholder
+// Sweep finding (HIGH, fixed): matlab's scriptArgv EMBEDS the placeholder (`run('<script>')`) while the
+// module substituted by EXACT element equality, so the literal `run('<script>')` reached the engine and
+// the archived script never ran. This section walks the whole descriptor table.
+{
+  const PLACEHOLDER = /<script>|<expr>|<pkgs>|<pkgs\.\.\.>|<probeCode>|<exe>|<pkg>|<cliArgv/
+  for (const name of (M.MATH_PARAM_DEFAULTS.mathEngines || [])) {
+    if (name === 'cli') continue
+    const h = makeFakeHost({ installed: [name], files: {}, licence: true })
+    M.registerMathComputation(h.host)
+    const r = await h.call({ op: 'run', engine: name, mode: 'code', code: 'x=1\n' })
+    const bad = (h.spawns || []).map((s) => (s && s.argv) || []).flat().filter((a) => typeof a === 'string' && PLACEHOLDER.test(a))
+    ok(bad.length === 0, '★ ' + name + ': no spawn carries a literal argv placeholder', JSON.stringify(bad.slice(0, 2)))
+    if (name === 'matlab' && r.ok === true) {
+      const runs = (h.spawns || []).map((s) => s.argv).filter((a) => a.join(' ').indexOf('-batch') !== -1 && a.join(' ').indexOf('disp(version)') === -1)
+      const run = runs.pop() || []
+      ok(run.some((a) => /run\('.*script\.m'\)/.test(a)), '★ matlab: the EMBEDDED placeholder is substituted (run(\'<abs script.m>\'))', JSON.stringify(run))
+    }
+  }
+}
+
+// ── 29. cli policy is SINGLE-SOURCED (descriptor), not hard-coded in the module
+// Sweep ruling: `cli.policy.requiresMathMode` / `requiresEngineInList` were declared but never consumed
+// (the same rule was hard-coded twice), so descriptor and behaviour could drift. The refusals now carry
+// the DESCRIPTOR value, which is exactly what makes a hard-coded revert observable.
+{
+  const h = makeFakeHost({ installed: ['python3'], params: { mathMode: 'typed' }, cliCommands: ['python3'] })
+  M.registerMathComputation(h.host)
+  const r = await h.call({ op: 'run', engine: 'cli', mode: 'code', code: 'print(1)\n', cli: { command: 'python3' } })
+  ok(r.ok === false && r.code === 'MATH_REFUSED', 'cli under mathMode=typed is refused')
+  ok(r.next && r.next.reason === 'policy' && r.next.requiresMathMode === 'typed+shell',
+    '★ the refusal carries the DESCRIPTOR policy value (next.requiresMathMode === typed+shell)', JSON.stringify(r.next))
+  const h2 = makeFakeHost({ installed: ['python3'], params: { mathMode: 'typed+shell', mathEngines: ['python', 'r'] }, cliCommands: ['python3'] })
+  M.registerMathComputation(h2.host)
+  const r2 = await h2.call({ op: 'run', engine: 'cli', mode: 'code', code: 'print(1)\n', cli: { command: 'python3' } })
+  ok(r2.ok === false && r2.next && r2.next.reason === 'engine-not-allowed' && r2.next.requiresEngineInList === true,
+    '★ when cli is not in mathEngines the refusal surfaces requiresEngineInList from the descriptor', JSON.stringify(r2.next))
+}
+
+// ── 30. a commercial template's VERIFY provenance REACHES the user (item 2)
+// `maple.verify`/`verifyReason` were declared but never reached any response, so a user told "commercial
+// template needs confirmation" could not see WHY. It is surfaced on the probe result (per-engine entry +
+// engineInfo) and on the vendor-guidance payloads; engines without a declared reason print no empty slot.
+{
+  const h = makeFakeHost({ installed: ['maple'], licence: true, files: {} })
+  M.registerMathComputation(h.host)
+  const p = await h.call({ op: 'probe', engine: 'maple' })
+  ok(p.ok === true && !!p.engineInfo && p.engineInfo.verify === true, 'probe reports the verify flag for a commercial template')
+  ok(!!p.engineInfo && typeof p.engineInfo.verifyReason === 'string' && p.engineInfo.verifyReason.length > 0 && /version/i.test(p.engineInfo.verifyReason),
+    '★ probe carries WHY the template needs confirmation (engineInfo.verifyReason)', JSON.stringify(p.engineInfo && p.engineInfo.verifyReason))
+  const entry = (p.engines || []).find((e) => e.name === 'maple')
+  ok(carriesVerifyProvenance(entry), 'the per-engine probe entry carries the same provenance')
+  const hp = makeFakeHost({ installed: ['python3'], files: {} })
+  M.registerMathComputation(hp.host)
+  const pp = await hp.call({ op: 'probe', engine: 'python' })
+  ok(hasNoVerifySlot(pp.engineInfo),
+    '★ an engine without a declared reason prints NO empty slot (assemble-only-when-present)')
+  const hm = makeFakeHost({ installed: [], files: {} })
+  M.registerMathComputation(hm.host)
+  const pm = await hm.call({ op: 'probe', engine: 'maple' })
+  ok(pm.ok === false && !!pm.next && typeof pm.next.verifyReason === 'string' && /version/i.test(pm.next.verifyReason),
+    '★ the not-found guidance also says why the commercial template needs confirmation', JSON.stringify(pm.next && pm.next.verifyReason))
+}
+
+// ── 31. S3 symmetry: EVERY failure kind surfaces partial stdout AND stderr (like the timeout)
+{
+  const h1 = makeFakeHost({ installed: ['python3'], exit: 2, stdoutBytes: 16 })
+  M.registerMathComputation(h1.host)
+  const r1 = await h1.call({ op: 'run', engine: 'python', mode: 'code', code: 'x=1\n' })
+  ok(r1.ok === false && r1.code === 'MATH_NONZERO_EXIT', 'a non-zero exit reports MATH_NONZERO_EXIT')
+  ok('stdout' in r1 && 'stderr' in r1, '★ S3 symmetry: MATH_NONZERO_EXIT carries BOTH partial stdout and stderr', JSON.stringify({ so: 'stdout' in r1, se: 'stderr' in r1 }))
+  const h2 = makeFakeHost({ installed: ['python3'], argError: 'unknown option', stdoutBytes: 16 })
+  M.registerMathComputation(h2.host)
+  const r2 = await h2.call({ op: 'run', engine: 'python', mode: 'code', code: 'x=1\n' })
+  ok(r2.ok === false && r2.code === 'MATH_ENGINE_BAD_ARGV', 'a usage error reports MATH_ENGINE_BAD_ARGV')
+  ok('stdout' in r2 && 'stderr' in r2, '★ S3 symmetry: MATH_ENGINE_BAD_ARGV carries BOTH partial stdout and stderr')
+}
+// ── 32. S2: the failure a user actually hits carries the SAME absence evidence as the success shape
+{
+  const h = makeFakeHost({ installed: [] })
+  M.registerMathComputation(h.host)
+  const r = await h.call({ op: 'probe' })
+  ok(r.ok === false && r.code === 'MATH_ENGINE_NOT_FOUND', 'no resolvable engine reports MATH_ENGINE_NOT_FOUND')
+  ok(Array.isArray(r.configured) && r.configured.length > 0, '★ S2 absence evidence: the failure names the CONFIGURED engines', JSON.stringify(r.configured ?? null))
+  const absent = Array.isArray(r.absent) ? r.absent : []
+  ok(absent.length > 0, '★ S2 absence evidence: the failure carries an absent[] list (not a silent partial)', JSON.stringify(r.absent ?? null))
+  ok(absent.every((a) => a && typeof a.why === 'string' && a.why.length > 0), 'every absent[] entry carries a why', JSON.stringify(absent))
+}
 console.log('')
+// ── 33. S4/S5: install failures are discriminated WITHOUT a new code (frozen interface). Reads the
+// ENV-RESOLVED module (MATH_COMPUTATION_MODULE), so the --self-probe case 2 above can reach exactly
+// what these assertions read (the parity-located version could not be reddened by any mutant).
+{
+  const src = readFileSync(fileURLToPath(new URL(MODULE)), 'utf8')
+  ok(src.indexOf("out.op = 'install'") !== -1, '★ S4/S5 install discrimination: a failed install sets op=install')
+  ok(/out\.timedOut = !!/.test(src), '★ S4/S5 install discrimination: a failed install carries timedOut')
+  ok(/out\.installedSoFar = results\.filter/.test(src), '★ S4/S5 install discrimination: a failed install reports what already succeeded (installedSoFar)')
+  ok(/installedSoFar: commands\.map/.test(src), 'the success path reports installedSoFar too (no special-casing by the caller)')
+  ok(src.indexOf('MATH_INSTALL_FAILED') === -1, 'no 12th failure code was added (MATH_FAILURE_CODES stays frozen)')
+}
+
+// ── 34. S6: the install plan, the run path and the missing-package failure state ONE policy the
+// same way (behavioural: read from the responses, not from the source text).
+{
+  const PREFIX = 'version-constraints-are-existence-only: '
+  const h = makeFakeHost({ installed: ['python3'] })
+  M.registerMathComputation(h.host)
+  const plan = await h.call({ op: 'install', packages: ['numpy==1.2.3'] })
+  const planPolicy = String((plan && plan.plan && plan.plan.versionPolicy) || '')
+  ok(plan.ok === true && !!plan.plan, 'S6: an install dry-run returns a plan', JSON.stringify(plan && plan.code))
+  ok(planPolicy.indexOf(PREFIX) === 0, '★ S6: the install plan uses the SAME policy wording as the run path', planPolicy.slice(0, 70))
+  ok(planPolicy.indexOf('numpy==1.2.3') !== -1, '★ S6: the plan names the pinned spec it does not enforce', planPolicy.slice(0, 90))
+  const miss = await h.call({ op: 'run', engine: 'python', mode: 'code', packages: ['numpy==1.2.3'], code: 'x=1\n' })
+  ok(miss.ok === false && miss.code === 'MATH_MISSING_PACKAGES', 'S6: a pinned-but-missing package fails as MATH_MISSING_PACKAGES', JSON.stringify(miss.code))
+  ok(String(miss.versionPolicy || '').indexOf(PREFIX) === 0, '★ S6: the failure path uses the same wording', String(miss.versionPolicy || '').slice(0, 70))
+  ok(String(miss.versionPolicy || '') === planPolicy, '★ S6: plan and failure wording are byte-identical for the same spec', JSON.stringify([planPolicy.slice(0, 40), String(miss.versionPolicy || '').slice(0, 40)]))
+  ok(String(miss.message || '').indexOf('只检查是否存在；版本求解交给包管理器') !== -1, '★ S6: the MATH_MISSING_PACKAGES detail derives the same clause', String(miss.message || '').slice(0, 70))
+  const badSpec = M.parsePackageSpec('numpy@1.2')
+  ok(badSpec && badSpec.ok === false && String(badSpec.problem || '').indexOf('只检查是否存在；版本求解交给包管理器') !== -1, '★ S6: the unsupported-version-syntax message derives the same clause', String((badSpec && badSpec.problem) || '').slice(0, 80))
+  ok(String(planPolicy || '').indexOf('只检查是否存在；版本求解交给包管理器') !== -1, '★ S6: the policy FIELD itself contains that clause (one literal, three surfaces)', planPolicy.slice(0, 80))
+}
+
+// ── 35. S6 derivation is LOAD-BEARING (found by mutant case 2): "the message contains the clause" also
+// passes when the message RE-INLINES the same words, so the real checks are (a) the clause exists as
+// exactly ONE literal in the module and (b) the two human messages are built from the constant.
+{
+  const src = readFileSync(fileURLToPath(new URL(MODULE)), 'utf8')
+  const clause = '只检查是否存在；版本求解交给包管理器'
+  const occurrences = src.split(clause).length - 1
+  ok(occurrences === 1, '★ S6: the policy clause exists as exactly ONE literal in the module (a re-inlined message is caught)', 'occurrences=' + occurrences)
+  ok(/MATH_MISSING_PACKAGES[\s\S]{0,160}MATH_VERSION_POLICY_CLAUSE/.test(src), '★ S6: the missing-package detail is built from the clause constant', 'MATH_MISSING_PACKAGES … MATH_VERSION_POLICY_CLAUSE')
+  ok(/unsupported version syntax[\s\S]{0,160}MATH_VERSION_POLICY_CLAUSE/.test(src), '★ S6: the unsupported-version-syntax message is built from the clause constant')
+  ok(/const MATH_VERSION_POLICY = .*MATH_VERSION_POLICY_CLAUSE/.test(src), '★ S6: the long policy sentence is derived from the clause')
+}
+
 console.log('=== MATH COMPUTATION SHARED: ' + passed + ' passed, ' + failed + ' failed ===')
 if (failures.length) for (const f of failures) console.error('  - ' + f)
 process.exit(failed === 0 ? 0 : 1)