dsh-vibe-math 2.8.3 → 2.8.5

package/tests/audit-artifact-docs.mjs

@@ -11,8 +11,15 @@
  * sections must list it.
  *
  * Run: node tests/audit-artifact-docs.mjs
- * Env (mutant harness): ARTIFACT_README / ARTIFACT_README_EN / ARTIFACT_DOC / ARTIFACT_V2_JS /
- * ARTIFACT_V3_JS / ARTIFACT_V4_JS / ARTIFACT_V5_JS (absolute or repo-relative).
+ * Env (mutant harness): ARTIFACT_README / ARTIFACT_README_EN / ARTIFACT_DOC / ARTIFACT_INSTALL_DOC /
+ * ARTIFACT_V2_JS / ARTIFACT_V3_JS / ARTIFACT_V4_JS / ARTIFACT_V5_JS (absolute or repo-relative).
+ *
+ * Section 5 (issue #10, plugin-market install failure) guards the INSTALL/UPGRADE docs: DSH forwards
+ * plugin installs to pnpm and does not bundle it (missing pnpm ⇒ `exit 1`), and a bare package name is
+ * resolved through the profile's package.json / pnpm-lock.yaml, so it can stay on an OLD version —
+ * measured: `@latest`, `@^2`, `pnpm update --latest` and `pnpm add …@latest` all failed to upgrade,
+ * only an explicit `@<version>` did. Both are outside this package, but the docs must not send a user
+ * into either trap (and must never claim `@latest` is the upgrade recipe).
  */
 import { readFileSync } from 'node:fs'
 import { dirname, isAbsolute, join } from 'node:path'
@@ -66,6 +73,35 @@ ok(docScope, '★ docs/final-paper.md scopes ' + ARTIFACT + ' to v2/v3 AND state
 ok(/NOT IMPLEMENTED/.test(presets.v4) && /claim_write/.test(presets.v4),
   'vibe-math-v4.js still carries the explicit NOT-IMPLEMENTED shared-lock disclaimer (the source of the doc denial)')
 
+// 5) INSTALL/UPGRADE DOCS (issue #10): the plugin market forwards installs to pnpm (which DSH does not
+// bundle) and resolves a bare package name through the profile's package.json / pnpm-lock.yaml, so the
+// install can stay on an OLD version. Both traps are outside this package — but the docs must not walk a
+// user into either, and must never present `@latest` as the upgrade recipe (measured ineffective).
+const INSTALL_DOC = 'docs/COMPAT-AUDIT-ROUND2.md'
+for (const [name, envName, rel] of [['README.md', 'ARTIFACT_README', 'README.md'], ['README.en.md', 'ARTIFACT_README_EN', 'README.en.md']]) {
+  const text = read(envName, rel)
+  ok(/(\*\*前置\*\*|\*\*Prerequisite\*\*)[^\n]*pnpm/.test(text),
+    '★ ' + name + ': states the `pnpm` prerequisite (DSH forwards plugin installs to pnpm and does not bundle it)')
+  ok(/hub\.log/.test(text),
+    '★ ' + name + ': points at ~/.dsh/profiles/<profile>/hub.log (the failure the market hides)')
+  const bare = count(text, 'add dsh-vibe-math')
+  const pinned = count(text, 'add dsh-vibe-math@')
+  ok(pinned > 0 && bare === pinned,
+    '★ ' + name + ': EVERY `add dsh-vibe-math` pins an explicit version (a bare name can stay on an old version)',
+    'bare=' + (bare - pinned))
+  ok(!/dsh-vibe-math@latest/.test(text),
+    '★★ ' + name + ': never presents `dsh-vibe-math@latest` as the install/upgrade recipe (measured ineffective)')
+  ok(/^### (安装\/升级排查|Install\/upgrade troubleshooting)/m.test(text),
+    '★ ' + name + ': carries an install/upgrade troubleshooting section')
+}
+const idoc = read('ARTIFACT_INSTALL_DOC', INSTALL_DOC)
+ok(/pnpm/.test(idoc) && /hub\.log/.test(idoc),
+  '★ ' + INSTALL_DOC + ' documents the pnpm prerequisite AND the hub.log pointer')
+ok(/add dsh-vibe-math@/.test(idoc) && !/dsh-vibe-math@latest/.test(idoc),
+  '★ ' + INSTALL_DOC + ' shows the explicit-version install/upgrade (and never `@latest`)')
+ok(/pnpm-lock\.yaml|package\.json/.test(idoc),
+  '★ ' + INSTALL_DOC + ' explains WHY a bare name can stay on an old version (profile package.json / pnpm-lock.yaml wins)')
+
 console.log('')
 console.log('=== ARTIFACT DOCS: ' + passed + ' passed, ' + failed + ' failed ===')
 for (const f of failures) console.error('  - ' + f)

package/tests/audit-artifact-docs.mutants.mjs

@@ -52,7 +52,72 @@ const namedB = b.failLines.some((l) => l.indexOf('the writing presets are exactl
 ok(b.status !== 0 && namedB, '★ B: a v4 that mentions the artifact reddens the "writers are exactly v2,v3" assertion', 'exit=' + b.status)
 if (!namedB) for (const l of b.failLines.slice(0, 3)) console.log('      guard failure: ' + l.trim().slice(0, 130))
 
+// ---- issue #10: the install/upgrade docs must keep teaching the pnpm prerequisite and an EXPLICIT
+// version, and must never present `@latest` as the recipe. One single-site mutation per requirement.
+const zhAll = readFileSync(join(REPO, 'README.md'), 'utf8')
+const enAll = readFileSync(join(REPO, 'README.en.md'), 'utf8')
+const probes = [
+  {
+    tag: 'C',
+    file: 'README-c.md',
+    env: { ARTIFACT_README: null },
+    from: /^> \*\*前置\*\*：[^\n]*$/m,
+    to: '> 前置未写明。',
+    expect: 'states the `pnpm` prerequisite',
+    what: 'dropping the pnpm prerequisite',
+  },
+  {
+    tag: 'D',
+    file: 'README-d.md',
+    env: { ARTIFACT_README: null },
+    from: 'add dsh-vibe-math@<版本>',
+    to: 'add dsh-vibe-math@latest',
+    expect: 'never presents `dsh-vibe-math@latest`',
+    what: 'teaching `@latest` as the install/upgrade command',
+  },
+  {
+    tag: 'E',
+    file: 'README-e.md',
+    env: { ARTIFACT_README: null },
+    from: 'hub.log',
+    to: '安装日志',
+    expect: 'points at ~/.dsh/profiles/<profile>/hub.log',
+    what: 'dropping the hub.log pointer',
+  },
+  {
+    tag: 'F',
+    file: 'README-f.md',
+    env: { ARTIFACT_README_EN: null },
+    from: '### Install/upgrade troubleshooting (pnpm and versions)',
+    to: '### Install/upgrade notes',
+    expect: 'carries an install/upgrade troubleshooting section',
+    what: 'dropping the troubleshooting section',
+  },
+  {
+    tag: 'G',
+    file: 'compat-doc.md',
+    env: { ARTIFACT_INSTALL_DOC: null },
+    from: 'add dsh-vibe-math@<版本>',
+    to: 'add dsh-vibe-math',
+    expect: 'shows the explicit-version install/upgrade',
+    what: 'dropping the explicit version from the install/upgrade doc',
+    doc: 'docs/COMPAT-AUDIT-ROUND2.md',
+  },
+]
+for (const p of probes) {
+  const base = p.doc ? readFileSync(join(REPO, p.doc), 'utf8') : (p.tag === 'F' ? enAll : zhAll)
+  const anchor = p.from instanceof RegExp ? (base.match(p.from) || [])[0] : p.from
+  const n = anchor ? base.split(anchor).length - 1 : 0
+  if (!anchor || n < 1) { ok(false, p.tag + ': the anchor for ' + p.what + ' exists (harness and guard agree)', 'ANCHOR MISS'); continue }
+  writeFileSync(join(dir, p.file), base.split(anchor).join(p.to))
+  const envKey = Object.keys(p.env)[0]
+  const r = run({ [envKey]: join(dir, p.file) })
+  const named = r.failLines.some((l) => l.indexOf(p.expect) !== -1)
+  ok(r.status !== 0 && named, '★ ' + p.tag + ': ' + p.what + ' reddens the guard by name', 'exit=' + r.status)
+  if (!named) for (const l of r.failLines.slice(0, 3)) console.log('      guard failure: ' + l.trim().slice(0, 130))
+}
+
 rmSync(dir, { recursive: true, force: true })
 console.log('')
 console.log('=== ARTIFACT DOCS MUTANTS: ' + passed + ' passed, ' + failed + ' failed ===')
-process.exit(failed === 0 ? 0 : 1)
+process.exit(failed === 0 ? 0 : 1)

package/tests/audit-engine-faces.mjs

@@ -250,8 +250,8 @@ if (!XELATEX) {
     ok(bad && typeof bad === 'object' && bad.ok === true && (bad.started === true || bad.code === undefined),
       '★ engine-faces latex: a NONEXISTENT `paperLatexCommand` neither crashes nor raises an error code (entry stays ok:true, code undefined) (' + JSON.stringify({ ok: bad && bad.ok, code: bad && bad.code, note: String(bad && bad.note || '').slice(0, 50) }) + ')')
     console.log('  note: the LaTeX COMPILE (paper writer subagent) is not reachable from this probe; it asserts the ENTRY only — crash-freedom and no error code. The named degradation for an unresolvable command is a COMPILE-time behaviour (docs/final-paper.md) and is deliberately NOT claimed here.')
-    console.log('        This probe runs the REAL xelatex only because it carries its own candidate list')
-    console.log('        (D:\\texlive\\2025\\bin\\windows) - it is NOT evidence that the product discovers a non-standard TeX installation.')
+    console.log('        This probe carries its own candidate list (D:\\texlive\\2025\\bin\\windows); since task-28 the')
+    console.log('        PRODUCT probes that documented TeX Live drive-root position too (audit-prompt-invariants I19).')
   } finally { rmSync(WS, { recursive: true, force: true }) }
 }
 

package/tests/audit-persona-surface.test.mjs

@@ -196,7 +196,7 @@ const PRESETS = [
     dir: 'vibe-math-v5',
     js: 'vibe-math-v5.js',
     prefix: 'vibe_v5_',
-    tools: 40,
+    tools: 41,
     // Member- and academician-facing tools that the v5 persona describes GENERICALLY; the office (main
     // agent) holds only the institute-level controls plus the hiring authority. The final-paper pair is
     // an OFFICE control and IS named in the persona (vibe_v5_paper / vibe_v5_finalize_paper), so it must
@@ -207,6 +207,9 @@ const PRESETS = [
       'vibe_v5_propose_verify', 'vibe_v5_verdict', 'vibe_v5_task_create',
       'vibe_v5_task_list', 'vibe_v5_task_get', 'vibe_v5_task_update',
       'vibe_v5_overview', 'vibe_v5_assign', 'vibe_v5_prioritize', 'vibe_v5_nudge',
+      // task-30: the methodology/collaboration feedback tool is member-facing and described GENERICALLY
+      // by the persona; the plugin's per-round hint names it and explains the three routes.
+      'vibe_v5_feedback',
     ],
     required: [],
     lean: { tools: ['vibe_v5_lean_run', 'vibe_v5_lean_archive', 'vibe_v5_lean_lib', 'vibe_v5_lean_read', 'vibe_v5_lean_job'], extra: [] },

package/tests/audit-prompt-invariants.mjs

@@ -20,6 +20,17 @@
  *   I13 the Lean switch unreachable THROUGH the closed tool schema (v3 2.3.1: all four params
  *       missing from vibe_math_set_params, invisible to every suite because suites call handlers)
  *   I14 a parameter the tool schema advertises but the parameter layer silently drops
+ *   I15 the LaTeX-missing guidance drifting between presets (four steps + three hard boundaries)
+ *   I16 a member prompt demanding an action the member CANNOT perform (direct user contact)
+ *   I17 the Lean-3 `--search-path` spelling surviving in an agent-facing STRING (only exception: the
+ *       guard's explicit legacy-compatibility array)
+ *   I18 the same spelling surviving in the AGENT-FACING preset text (`vibe-math-vN/agent.cordis.yml`,
+ *       checked per preset) or in its generated copy (`cordis.patch.yml`, I18b)
+ *   I19 the paper-engine detection missing TeX Live's documented install positions, or losing its
+ *       explicit BOUND on candidate probes (never a whole-drive scan) — asserted for all four presets
+ *   I20 the env-gated TeX sandbox seam (V2/V3/V4/V5_TEX_ROOTS_SANDBOX): every known-install probe site
+ *       must stay rebased through it (unset = identity), and with it set the stage finds nothing while
+ *       still naming its probes — static (I20) plus behavioural (I20b)
  *
  * Run: node tests/audit-prompt-invariants.mjs        (add --json for a machine-readable report)
  *      node tests/audit-prompt-invariants.mjs --self-probe
@@ -129,6 +140,111 @@ const SELF_PROBE_MUTATIONS = [
     to: ', then continue',
     expect: 'v2 I15: the LaTeX-missing guidance carries the four steps + the three hard boundaries',
   },
+  {
+    name: 'v5: the member prompt sends the TeX approval back to the USER instead of the OFFICE (I16)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: '如实上报所办（或群聊）**，由**所办**向用户确认',
+    to: '向用户问一次',
+    expect: 'v5 I16: a member-visible prompt never demands an action the member cannot perform',
+  },
+  {
+    name: 'v3: the member prompt sends the TeX approval back to the USER instead of the OFFICE (I16)',
+    rel: 'vibe-math-v3/vibe-math-v3.js',
+    from: 'REPORT IT TO THE OFFICE (or the group chat) and let the OFFICE confirm with the user',
+    to: 'ask the user once',
+    expect: 'v3 I16: a member-visible prompt never demands an action the member cannot perform',
+  },
+  {
+    name: 'v5: a tool description teaches the Lean-3 `--search-path` again (I17 must read the string, not the comment)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: 'leanSearchPaths (string[]) adds extra compiler search roots',
+    to: 'leanSearchPaths (string[]) adds extra --search-path roots',
+    expect: 'v5 I17:',
+  },
+  {
+    name: 'v5: the AGENT-FACING preset text reverts to the Lean-3 `--search-path` (I18 — the real-host SLV shape)',
+    rel: 'vibe-math-v5/agent.cordis.yml',
+    from: 'gets `-R <VibeMath root>`, preceded by any leanSearchPaths',
+    to: 'gets `--search-path <VibeMath root>`, preceded by any leanSearchPaths',
+    expect: 'v5 I18:',
+  },
+  {
+    name: 'the generated bundle patch keeps the Lean-3 `--search-path` (I18b: source fixed but not regenerated)',
+    rel: 'cordis.patch.yml',
+    from: '-R <VibeMath root>',
+    to: '--search-path <VibeMath root>',
+    expect: 'I18b:',
+  },
+  {
+    name: 'v5: the DRIVE-ROOT TeX Live candidates are deleted (I19 — the real-host "installed but not on PATH" shape)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: "const TEX_DRIVE_YEAR_ROOTS = ['D:/texlive', 'C:/texlive']",
+    to: 'const TEX_DRIVE_YEAR_ROOTS = []',
+    expect: 'v5 I19:',
+  },
+  {
+    name: 'v5: the TeX probe cap is removed (I19: the known-root stage must stay bounded)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: 'const TEX_CANDIDATE_CAP = 40',
+    to: 'const TEX_CANDIDATE_CAP = 100000',
+    expect: 'v5 I19:',
+  },
+  {
+    name: 'v5: a bare DRIVE ROOT enters the TeX candidates (I19: never a whole-drive scan)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: "const TEX_DRIVE_YEAR_ROOTS = ['D:/texlive', 'C:/texlive']",
+    to: "const TEX_DRIVE_YEAR_ROOTS = ['D:/texlive', 'C:/texlive', 'D:/']",
+    expect: 'v5 I19:',
+  },
+  {
+    name: 'v5: the TeX sandbox gate is ignored (I20 — a suite can no longer pin "no LaTeX on this host")',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: "const texSandbox = kind === 'tex' ? String(env.V5_TEX_ROOTS_SANDBOX || '').trim() : ''",
+    to: "const texSandbox = ''",
+    expect: 'v5 I20:',
+  },
+  {
+    name: 'v5: one known-install TeX probe site stops rebasing into the sandbox (I20)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: "const p = await resolvePath(texProbeBase(base) + '/' + name)",
+    to: "const p = await resolvePath(base + '/' + name)",
+    expect: 'v5 I20:',
+  },
+  {
+    name: 'v4: one known-install TeX probe site stops rebasing into the sandbox (I20, second preset — not a v5-only check)',
+    rel: 'vibe-math-v4/vibe-math-v4.js',
+    from: "const p = await resolvePath(texProbeBase(base) + '/' + name)",
+    to: "const p = await resolvePath(base + '/' + name)",
+    expect: 'v4 I20:',
+  },
+  {
+    name: 'v3: one known-install TeX probe site stops rebasing into the sandbox (I20)',
+    rel: 'vibe-math-v3/vibe-math-v3.js',
+    from: "const p = await resolvePath(texProbeBase(base) + '/' + name)",
+    to: "const p = await resolvePath(base + '/' + name)",
+    expect: 'v3 I20:',
+  },
+  {
+    name: 'v2: one known-install TeX probe site stops rebasing into the sandbox (I20)',
+    rel: 'vibe-math-v2/vibe-math-v2.js',
+    from: "const p = await resolvePath(texProbeBase(base) + '/' + name)",
+    to: "const p = await resolvePath(base + '/' + name)",
+    expect: 'v2 I20:',
+  },
+  {
+    name: 'run-tests: the gate stops sandboxing the TeX install roots (X4 — the sweep becomes host-dependent again)',
+    rel: 'tests/run-tests.mjs',
+    from: 'process.env.V4_TEX_ROOTS_SANDBOX = TEX_ROOTS_SANDBOX_DIR',
+    to: '',
+    expect: 'X4:',
+  },
+  {
+    name: 'v5: a drive-letter absolute path is written back into the agent-facing guidance (I9b — reddens before any corpus regeneration)',
+    rel: 'vibe-math-v5/vibe-math-v5.js',
+    from: 'macOS at `/Library/TeX/texbin`',
+    to: 'macOS at `C:/TeX/texbin`',
+    expect: 'v5 I9b:',
+  },
 ]
 
 if (process.argv.includes('--self-probe')) {
@@ -352,14 +468,92 @@ for (const P of PRESETS) {
   // redden: requiring "either language" would have made the zh mutations no-ops once both exist).
   const I15_LANG = { v4: 'zh', v5: 'zh', v3: 'en', v2: 'en' }
   const I15_MARKERS = {
-    zh: ['检测不到 LaTeX 引擎时', '有界核查', '不要全盘扫描', '并重新检测', '向用户问一次', '照旧降级', '绝不自动安装', '绝不写工作区之外', '当失败'],
-    en: ['When no LaTeX engine is detected', 'never scan whole drives', 're-detect', 'ask the user once', 'degrade exactly as today', 'never auto-install', 'never write outside the workspace'],
+    zh: ['检测不到 LaTeX 引擎时', '有界核查', '不要全盘扫描', '并重新检测', '如实上报所办', '照旧降级', '绝不自动安装', '绝不写工作区之外', '当失败'],
+    en: ['When no LaTeX engine is detected', 'never scan whole drives', 're-detect', 'REPORT IT TO THE OFFICE', 'degrade exactly as today', 'never auto-install', 'never write outside the workspace'],
   }
   if (I15_LANG[P.tag]) {
     check(I15_MARKERS[I15_LANG[P.tag]].every((s) => js.includes(s)),
       P.tag + ' I15: the LaTeX-missing guidance carries the four steps + the three hard boundaries')
   }
 
+  // I16 — a MEMBER-VISIBLE prompt must never demand an action the member cannot perform. A member's
+  // only channels are its own tools (the group chat / private messages): it cannot reach the user
+  // directly, so the TeX-install approval must be REPORTED to the OFFICE, which DOES own that channel.
+  // Reads the CODE stream (a comment may legitimately quote the old wording as history) and requires
+  // the reworded clause POSITIVELY, so putting the old instruction back reddens this invariant BY NAME
+  // (two self-probe mutations below: the zh clause on v5 and the en clause on v3).
+  check(!code.includes('向用户问一次') && !code.includes('ask the user once'),
+    P.tag + ' I16: a member-visible prompt never demands an action the member cannot perform (no direct user contact)')
+  check(code.includes('如实上报所办') || code.includes('let the OFFICE confirm with the user'),
+    P.tag + ' I16: the TeX-approval clause routes the confirmation through the OFFICE (the party that can reach the user)')
+
+  // I17 — the Lean-3 spelling `--search-path` must not survive in ANY agent-facing string. `code` has
+  // comments blanked, so a surviving occurrence is inside a string/template literal; the ONE exception a
+  // preset may keep is its explicit legacy-compatibility array (`ALSO_ACCEPTED`), and only there: that
+  // is what makes an agent-supplied old spelling still suppress injection. Everything else is the
+  // defect class task-27 removed (`lean --search-path <dir> <f>` fails at argument parsing, rc=1).
+  {
+    const hits = code.split(/\r?\n/).map((l, i) => [i + 1, l]).filter(([, l]) => l.includes('--search-path'))
+    const bad = hits.filter(([, l]) => !/ALSO_ACCEPTED/.test(l))
+    check(hits.length === 1 && bad.length === 0,
+      P.tag + ' I17: `--search-path` survives only in the legacy-compat array, never in agent-facing text',
+      bad.length ? 'code-stream lines ' + JSON.stringify(bad.map(([n]) => n))
+        : 'expected exactly 1 occurrence (the ALSO_ACCEPTED guard line), found ' + hits.length)
+  }
+
+  // I18 — the AGENT-FACING preset text is a prompt too. `vibe-math-vN/agent.cordis.yml` is the persona/
+  // instruction surface the MAIN agent actually receives, and the plugin NEVER contains it — so I17
+  // cannot see it. The real-host SLV v5 run (15.2 min, candidate PASS) still showed exactly ONE
+  // `--search-path <VibeMath root>` in the v5 lean_lib "reuse first" paragraph. Guarded at the SOURCE;
+  // I18b below pins the generated copy so "edited the source but forgot to regenerate" also reddens.
+  {
+    const yml = read('vibe-math-' + P.tag + '/agent.cordis.yml')
+    const hits = yml ? yml.split(/\r?\n/).map((l, i) => [i + 1, l]).filter(([, l]) => l.includes('--search-path')) : []
+    check(yml !== null && hits.length === 0,
+      P.tag + ' I18: the agent-facing preset text never teaches the Lean-3 `--search-path`',
+      yml === null ? 'preset text unreadable (' + P.tag + '/agent.cordis.yml)'
+        : 'lines ' + JSON.stringify(hits.map(([n]) => n)))
+  }
+
+  // I19 (all four presets carry the same candidates) — the paper-engine detection must cover TeX Live's
+  // DOCUMENTED install positions. A real-host SLV v5 run (15.2 min, candidate PASS) degraded to
+  // 'not-detected' although D:\texlive\2025\bin\windows\xelatex.exe existed, because only
+  // <ProgramFiles>/texlive was ever probed ("installed but not on PATH"). The stage must stay BOUNDED
+  // (an explicit cap plus a recent-year window) and must never become a whole-drive scan. Static check
+  // on the CODE stream: I15 guards the TEXT of the guidance, this guards the ROOTS it acts on.
+  {
+    const roots = ["'D:/texlive'", "'C:/texlive'", "'/usr/local/texlive'", "'/opt/texlive'", "'/Library/TeX/texbin'"]
+    const missing = roots.filter((s) => !code.includes(s))
+    check(missing.length === 0,
+      P.tag + ' I19: the TeX candidate roots cover the documented TeX Live install positions',
+      missing.length ? 'missing ' + JSON.stringify(missing) : '')
+    const cap = /const TEX_CANDIDATE_CAP = (\d+)/.exec(code)
+    const capEnforced = code.indexOf('texProbes++') >= 0 && code.indexOf('TEX_CANDIDATE_CAP', code.indexOf('texProbes++')) >= 0
+    check(!!cap && Number(cap[1]) >= 1 && Number(cap[1]) <= 40 && capEnforced,
+      P.tag + ' I19: the TeX known-root stage stays BOUNDED by an explicit cap <= 40',
+      (cap ? 'cap=' + cap[1] : 'no TEX_CANDIDATE_CAP declaration') + (capEnforced ? '' : '; declared but never enforced'))
+    const win = /const TEX_YEAR_LOOKBACK = (\d+)/.exec(code)
+    check(!!win && Number(win[1]) >= 1 && Number(win[1]) <= 4 && /Number\(b\) - Number\(a\)/.test(code),
+      P.tag + ' I19: the TeX Live year dirs stay bounded (on-disk newest first, then the recent-year window)',
+      win ? 'lookback=' + win[1] : 'no TEX_YEAR_LOOKBACK declaration')
+    check(!/['"][A-Za-z]:[\\/]['"]/.test(code),
+      P.tag + ' I19: no bare drive root among the candidate roots (never a whole-drive scan)')
+
+    // I20 (all four presets) — the TEST/DIAGNOSTIC sandbox seam must stay a RELOCATION of where the
+    // documented roots are looked for, never a product switch: every known-install TeX probe site goes
+    // through `texProbeBase`, and with the gate unset the helper returns its argument unchanged
+    // (identity = today's behaviour). Each preset uses its OWN gate name (V2/V3/V4/V5_TEX_ROOTS_SANDBOX).
+    // Static here; the behavioural half is I20b. The named-red proof is the probe-site mutations in
+    // SELF_PROBE_MUTATIONS: the audit's mutation mechanism is read-time, so it can redden this check but
+    // cannot reach a dynamically imported module.
+    const sandboxEnv = 'V' + P.tag.slice(1) + '_TEX_ROOTS_SANDBOX'
+    const allRebased = code.includes(sandboxEnv) && /if \(!texSandbox\) return p/.test(code) &&
+      /listDirs\(texProbeBase\(base\)\)/.test(code) && /resolvePath\(texProbeBase\(base\) \+ '\//.test(code) &&
+      !/listDirs\(base\)/.test(code) && !/resolvePath\(base \+ '\//.test(code)
+    check(allRebased,
+      P.tag + ' I20: every known-install TeX probe site is rebased through the ' + sandboxEnv + ' gate (unset = identity)')
+  }
+
   // I3 — the defect rule is in the injected text.
   check(js.includes('不要投 0'), P.tag + ' I3: injected text forbids a 0 vote on a defect')
   check(/'defect'/.test(js) || /"defect"/.test(js), P.tag + ' I3: injected text names decision=\'defect\'')
@@ -411,6 +605,37 @@ for (const P of PRESETS) {
   check(!/\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}/.test(corpus), P.tag + ' I9: corpus carries no timestamp (deterministic)')
   check(!/vibe-v[0-9]-[a-z]+-[A-Za-z0-9]{4,}/.test(corpus), P.tag + ' I9: corpus leaks no temp-dir name')
 
+  // I9b (task-29 follow-up) — the SOURCE-LEVEL early warning that I9 lacks: a drive-letter absolute path
+  // written into AGENT-FACING text must redden HERE, immediately, not only after the corpus is
+  // regenerated (I9 is the later, mirror-level net). It reads the comment-blanked `code` stream, so a
+  // comment may still quote a real host path as evidence (task-28's `D:\texlive\2025\...` line, and v5's
+  // task-17 `Z:/no/such/xelatex.exe` comment): "assertions read code, not comments".
+  // CRITERION — I9's `[A-Za-z]:[\\/]` is a CORPUS-level test (the corpus holds DECODED text). Applied to
+  // SOURCE it false-positives on every escape sequence that merely looks like `<letter>:\`
+  // (`'…:\n'`, `/…limit:\s*/`; measured on this tree: 24 / 27 / 15 / 11 such lines in v2/v3/v4/v5). The
+  // source SPELLING of the same path is `D:/…` or `D:\\…`, so the equivalent criterion is
+  // `/[A-Za-z]:(?:\/|\\\\)/` — a bare `:\n` escape never matches it.
+  // EXCLUSIONS (documented, auditable; PURE CODE constructs that never reach a prompt):
+  //   1. `TEX_DRIVE_YEAR_ROOTS = ['D:/texlive', 'C:/texlive']` — the candidate-root list the detector
+  //      walks; resolveKnownTool reads it, nothing concatenates it into agent text.
+  //   2. resolveKnownTool's PATH-fallback defaults `'C:/Users/Default'`, `'C:/Program Files'`,
+  //      `'C:/Program Files (x86)'` — used only when the host env vars are absent.
+  // Where they live today: v2 L136/146/148/149 · v3 L169/179/181/182 · v4 L57/67/69/70 · v5 L67/77/79/80.
+  // The anti-vacuity check re-derives them on every run, so a refactor that drops them is CAUGHT instead
+  // of silently widening the exclusion.
+  {
+    const DRIVE_ABS = /[A-Za-z]:(?:\/|\\\\)/
+    const CODE_ONLY = /TEX_DRIVE_YEAR_ROOTS|env\.ProgramFiles|ProgramFiles\(x86\)|env\.USERPROFILE/
+    const flagged = [], excluded = []
+    code.split(/\r?\n/).forEach((l, i) => { if (DRIVE_ABS.test(l)) (CODE_ONLY.test(l) ? excluded : flagged).push(i + 1) })
+    check(flagged.length === 0,
+      P.tag + ' I9b: no drive-letter absolute path in agent-facing text (guidance, warnings, tool/param descriptions)',
+      flagged.length ? 'lines ' + JSON.stringify(flagged) + ' — ' + JSON.stringify(code.split(/\r?\n/)[flagged[0] - 1].trim().slice(0, 120)) : '')
+    check(excluded.length >= 3,
+      P.tag + ' I9b: the documented code-only exclusions are still present (the guard is not vacuous)',
+      'excluded lines ' + JSON.stringify(excluded))
+  }
+
   // I10 — the prompt-rule probes exist for this preset (a guard nobody can prove is a guard nobody has).
   const probeSrc = read('tests/audit-formal-sensitivity.mjs') || ''
   for (const kind of ['fidelity-defect-rule-removed', 'abbreviated-tool-name-injected', 'require-wording-removed', 'defect-decision-not-offered']) {
@@ -506,6 +731,48 @@ for (const P of PRESETS) {
   notes.push(P.tag + ': plugin ' + js.length + 'B · suite ' + suite.length + 'B · corpus ' + corpus.length + 'B')
 }
 
+// I20b — the sandbox seam, BEHAVIOURALLY and host-independently (ALL FOUR presets). Point each preset's
+// own gate at a fresh EMPTY directory and require the known-install stage to
+//   (a) find NOTHING                     — a suite can pin "no LaTeX here" on ANY host,
+//   (b) still report a NAMED list         — triedPaths does not go silent (task-9),
+//   (c) probe ONLY inside the sandbox     — no real install is touched, and
+//   (d) stay within the cap               — the relocation does not unbound the stage.
+// Portable by construction: on a host WITH TeX Live (a) is the property under test, on one WITHOUT it
+// is trivially true, and (c) is host-independent either way.
+{
+  const items = PRESETS.map((P) => ({
+    tag: P.tag, file: join(HERE, P.js), env: 'V' + P.tag.slice(1) + '_TEX_ROOTS_SANDBOX', sandbox: '',
+  }))
+  const dir = mkdtempSync(join(tmpdir(), 'prompt-invariants-tex-sandbox-'))
+  try {
+    for (const it of items) it.sandbox = join(dir, it.tag)
+    const probe = join(dir, 'probe.mjs')
+    writeFileSync(probe, [
+      "import { pathToFileURL } from 'node:url'",
+      'const items = JSON.parse(process.argv[2])',
+      'for (const it of items) process.env[it.env] = it.sandbox',
+      'const out = []',
+      'for (const it of items) {',
+      '  const mod = await import(pathToFileURL(it.file).href)',
+      "  const r = await mod.resolveKnownTool({ resolveExecutable: async () => { throw new Error('no PATH') } }, { name: 'xelatex', explicit: '', kind: 'tex' })",
+      '  out.push({ tag: it.tag, exe: r.exe, via: r.via, tried: r.tried })',
+      '}',
+      'console.log(JSON.stringify(out))',
+    ].join('\n'))
+    const r = spawnSync(process.execPath, [probe, JSON.stringify(items)], { encoding: 'utf8' })
+    let rows = null
+    try { rows = JSON.parse(r.stdout) } catch (e) { /* reported below */ }
+    for (const it of items) {
+      const row = rows && rows.find((x) => x.tag === it.tag)
+      const slash = (s) => String(s).split('\\').join('/')
+      const inside = !!row && row.tried.length > 0 && row.tried.every((p) => slash(p).indexOf(slash(it.sandbox)) === 0)
+      check(!!row && row.exe === null && inside && row.tried.length <= 40,
+        'I20b: ' + it.tag + ' — with ' + it.env + ' set the known-install stage finds nothing, probes only inside the sandbox, and names <= 40 paths',
+        row ? JSON.stringify({ exe: row.exe, via: row.via, triedCount: row.tried.length, inside }) : 'probe failed: ' + String(r.stderr || r.stdout || '').slice(0, 160))
+    }
+  } finally { rmSync(dir, { recursive: true, force: true }) }
+}
+
 // Cross-preset: the probe script must refuse to report success on an empty selection (false green).
 {
   const probeSrc = read('tests/audit-formal-sensitivity.mjs') || ''
@@ -513,6 +780,29 @@ for (const P of PRESETS) {
   const runner = read('tests/run-tests.mjs') || ''
   check(/no suites matched/.test(runner), 'X2: the suite runner fails when no suite matches')
   check(/argv\[i \+ 1\]/.test(runner) && /argv\[\+\+i\]/.test(runner), 'X3: the suite runner accepts both --flag=x and --flag x')
+  // X4 (task-29) — the GATE must be independent of whether the HOST has TeX installed: the runner points
+  // every child suite's documented-root sandbox gate at ONE empty scratch dir (children inherit env), and
+  // removes it on exit. Static here; the behavioural proof is the gate itself (the "no LaTeX on this
+  // host" suites pass on a machine that really HAS TeX Live). Named red: the mutation below drops one of
+  // the four assignments.
+  const texGateVars = ['V2_TEX_ROOTS_SANDBOX', 'V3_TEX_ROOTS_SANDBOX', 'V4_TEX_ROOTS_SANDBOX', 'V5_TEX_ROOTS_SANDBOX']
+  const texGateMissing = texGateVars.filter((v) => !runner.includes(v))
+  check(texGateMissing.length === 0 && /mkdtempSync\(/.test(runner) && /rmSync\(/.test(runner) && /process\.on\('exit'/.test(runner),
+    'X4: run-tests.mjs sandboxes the documented TeX install roots for every child suite (host-independent gate)',
+    texGateMissing.length ? 'missing ' + JSON.stringify(texGateMissing) : 'no mkdtemp/exit-cleanup found')
+}
+
+// I18b — the GENERATED bundle patch repeats the preset text (`node scripts/build-preset-rows.mjs`
+// writes cordis.patch.yml from the four agent.cordis.yml). Guarding the copy catches the second failure
+// mode: the preset source is fixed but the patch was never regenerated, so the shipped prompt keeps the
+// Lean-3 spelling. tests/audit-preset-rows.test.mjs already pins byte-identity with the generator; this
+// pins the SEMANTICS (the -R text is really there, and the old spelling is not).
+{
+  const patch = read('cordis.patch.yml')
+  const hits = patch ? patch.split(/\r?\n/).map((l, i) => [i + 1, l]).filter(([, l]) => l.includes('--search-path')) : []
+  check(patch !== null && patch.includes('-R <VibeMath root>') && hits.length === 0,
+    'I18b: the generated cordis.patch.yml teaches no `--search-path` (regenerate: node scripts/build-preset-rows.mjs)',
+    patch === null ? 'cordis.patch.yml unreadable' : 'lines ' + JSON.stringify(hits.map(([n]) => n)))
 }
 
 // X5–X7: guard the guard. I1/I13/I14 trust stripComments(), and all four presets contain a regex