@thincoder/core 0.10.1 → 0.10.3

package/agent-tools/design-token.mjs

@@ -5,8 +5,10 @@
  *
  * 沿革：初由 agent-tools/advisor.mjs 迁至 advisor-async.mjs（sync wrapper 与 async
  * settle 共享一套实现——无 wrapper↔runner 环），再由 advisor-async.mjs 迁入本文件。
- * 既有 import 面不变：advisor-async.mjs re-export 全部 7 个导出（advisor.mjs 与测试
- * 的 import 路径原样保留——advisor.mjs 再转发 validateDesignToken 给 spawn 门禁）。
+ * 既有 import 面不变：advisor-async.mjs re-export 原 7 个导出（advisor.mjs 与测试
+ * 的 import 路径原样保留——advisor.mjs 再转发 validateDesignToken 给 spawn 门禁）；
+ * 本批 §5.1 新助手（stripDesignTokenEcho / makeDesignTokenPrefixRegex）为新增直连面
+ * （设计档 ENG-TOKEN-BINDING.md §5.1——不经 advisor-async re-export）。
  */
 
 import { randomUUID } from "node:crypto"
@@ -64,15 +66,46 @@ export function makeDesignTokenRegex(token, flags = "") {
   )
 }
 
+/** Build a [DESIGN-TOKEN:...] regex matching the token's uuid PREFIX form — the
+ *  truncated echo (tail missing/inexact, §5.1③; same boundary discipline as the full regex). */
+export function makeDesignTokenPrefixRegex(token, flags = "") {
+  const uuid = String(token).split(":")[0]
+  const escaped = uuid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  return new RegExp(
+    `(?:^|\\s|\`|\\*)\\[DESIGN-TOKEN:\\s*${escaped}[^\\]\\s]*\\s*\\](?:\\s|$|\`|\\*)`,
+    flags + "ms"
+  )
+}
+
+/** §5.1③ stripping single source: strip every echo form of THIS token — the full
+ *  [DESIGN-TOKEN:uuid:expiresAt] form, the truncated prefix form, and the bare
+ *  uuid value (token-unique random ⇒ zero collateral; empty uuid → bare pass
+ *  skipped — defensive). Other tokens / other uuids pass through untouched. */
+export function stripDesignTokenEcho(text, designToken) {
+  if (typeof text !== "string" || !designToken) return text
+  const uuid = String(designToken).split(":")[0]
+  let out = text.replace(makeDesignTokenRegex(designToken, "g"), "")
+  out = out.replace(makeDesignTokenPrefixRegex(designToken, "g"), "")
+  if (uuid) out = out.split(uuid).join("")
+  return out
+}
+
+/** §5.1② constant settlement markers (verbatim — machine-greppable; M1 is
+ *  emitted even when the review body is empty). */
+const NO_VALID_ECHO_MARK = "未回显有效 token——未签发 (no valid token echo — no design token was issued)"
+const TRUNCATED_ECHO_MARK = "注：回显被截断（uuid 之后缺失或不符）——已按批准结算；全串 token 已签发 (note: truncated echo — the part after the uuid was missing or inexact; settled as approved; the full token was issued)"
+
 /**
  * Shared design-review settlement (sync wrapper + async settle): the token echo
- * IS the verdict — the advisor echoes it only on approval. On echo: slot the
- * token under designId (+ eng-coder gate flag; single-value mirror retired per
- * DESIGN-TOKEN-SETTLEMENT D3) and return
- * the clean output with the Approved suffix; the review instance CLOSES (a
- * later review of the same doc-set starts a fresh full review). On non-echo:
- * strip every dead token occurrence and return the findings text — slots stay
- * untouched (方案 ②: a failed re-review revokes nothing).
+ * IS the verdict — the advisor echoes it only on approval. On echo (full string
+ * OR truncated — uuid present; §5.1①): slot the token under designId (always the
+ * FULL token; + eng-coder gate flag; single-value mirror retired per
+ * DESIGN-TOKEN-SETTLEMENT D3) and return the clean output with the Approved
+ * suffix (truncated echo: the M2 marker sits before the suffix); the review
+ * instance CLOSES (a later review of the same doc-set starts a fresh full
+ * review). On non-echo: strip every echo form (single source §5.1③) and return
+ * the findings text + the constant M1 marker — slots stay untouched
+ * (方案 ②: a failed re-review revokes nothing).
  * @param {Object} [opts] — 第 11 批（A/F11）：`opts.incomplete` = 宿主尾族判定 kind
  *   （单谓词 `advisorIncompleteMarker`——结算方透传）。非空 ⇒ **一律不签发**（无论评审文本
  *   是否回显 token）：剥除全部 token 回显 + 追加未签发提示（原因 + 恢复指引），不写槽、
@@ -86,16 +119,20 @@ export function settleDesignReview(agent, run, designToken, rawResult, opts = {}
   // A（F11/ADVISOR-GUARDS.md §1 消费点 1）：未完成即不签发——判据与 code 完成守卫同源（单谓词）。
   const incomplete = opts?.incomplete ?? null
   if (incomplete) {
-    const stripped = rawResult.replace(makeDesignTokenRegex(designToken, "g"), "").trim()
+    const stripped = stripDesignTokenEcho(rawResult, designToken).trim()
     return {
       passed: false,
       output: `${stripped}\n\n评审未完成——token 未签发 (review incomplete — no design token issued; reason: ${incomplete})\n以更小范围重跑设计评审（逐档 / 逐节拆分，或拆到两次评审），或调大 agent.advisor.timeoutMs 后重试；补充检查未完成的部分不得按已核处理。`.trim(),
     }
   }
-  const tokenPattern = makeDesignTokenRegex(designToken)
-  if (!tokenPattern.test(rawResult)) {
-    const stripped = rawResult.replace(makeDesignTokenRegex(designToken, "g"), "").trim()
-    return { passed: false, output: stripped || "Advisor: design review did not pass." }
+  // §5.1① 截断容忍：全串匹配 ∨ 截断形（本 token 的 uuid 值出现——空 uuid 不构成「值」）
+  // ⇒ 认 pass；两者皆无 ⇒ fail + 恒定 M1（含正文为空——N7 零静默）。
+  const uuid = String(designToken).split(":")[0]
+  const fullEcho = makeDesignTokenRegex(designToken).test(rawResult)
+  const truncatedEcho = !fullEcho && uuid.length > 0 && rawResult.includes(uuid)
+  if (!fullEcho && !truncatedEcho) {
+    const stripped = stripDesignTokenEcho(rawResult, designToken).trim()
+    return { passed: false, output: [stripped, NO_VALID_ECHO_MARK].filter(Boolean).join("\n\n") }
   }
   // Echoed the token → review passed. Issue it to the parent for eng-coder.
   agent._engDesignTokens ??= new Map()
@@ -106,12 +143,15 @@ export function settleDesignReview(agent, run, designToken, rawResult, opts = {}
   // see the sync wrapper's note: unreachable today, kept for parity).
   if (agent._role === "eng-coder") agent._engDesignReviewed = true
   run.open = false // approval closes this doc-set instance — next review is fresh
-  const clean = rawResult.replace(makeDesignTokenRegex(designToken, "g"), "").trim()
+  run.priorOutput = null // #863 关闭点轻量化：审批关同拍释放（closed 实例零消费面——续跑仅取 open）
+  const clean = stripDesignTokenEcho(rawResult, designToken).trim()
   // F2c: id echo + omission guidance + point-in-time slot snapshot — the
   // same suffix the F2e prior stores strip with (stored for the exact truncation).
   run.approvedSuffix = buildApprovedSuffix(designToken, run.designId, agent._engDesignTokens.size)
   return {
     passed: true,
-    output: `${clean}\n\n${run.approvedSuffix}`,
+    // §5.1② 标记位置不变式：M2 恒居 approvedSuffix 之前、suffix 恒居文末
+    // （stripApprovedSuffix 的精确截断依赖此形——尾部追加改动不得破坏）。
+    output: [clean, truncatedEcho ? TRUNCATED_ECHO_MARK : null, run.approvedSuffix].filter(Boolean).join("\n\n"),
   }
 }

package/agent-tools/subagent-async.mjs

@@ -139,7 +139,12 @@ export function runningPoolCount(parent, pool) {
  * API keys come from config.json only (env vars are not a key source).
  */
 export function resolveChildProvider(parent, modelArg) {
-  if (!modelArg) return { ...parent.provider }
+  if (modelArg == null || modelArg === "") return { ...parent.provider } // null ∕ undefined ∕ 空串 = 不覆盖（既有等价语义）
+  // #861（AGENT-LOOP-SUBAGENT.md §6.7.1 ②）运行期防御——四消费链汇点（config ∥ tool model 参数 ∥
+  // consult ∥ vision-reader）：其余非字符串（对象 ∕ 数组 ∕ 数字 ∕ 布尔）明确报错（不裸 TypeError——可自纠）。
+  if (typeof modelArg !== "string") {
+    throw new Error(`subagent model override must be a string ("provider:model" | provider | model); got ${Array.isArray(modelArg) ? "array" : typeof modelArg}`)
+  }
   // "default" alias (2026-09-05 user ruling — ARCHITECTURE.md 子 agent 模型指定):
   // the literal "default", matched case-insensitively, declares "no override →
   // inherit the default model" — equivalent to null/omission (parent provider

package/agent-tools/subagent-panel.mjs

@@ -9,6 +9,11 @@
  * computePanelBlocks(ctx.state)（ctx.state = agent._tuiState——TUI 装配处接线——单账本）；
  * 未挂载（headless/VSC/子代理）→ 现算返 null → 降级/报不可用照旧
  * （T-P5 语义零变）。门控语义零动（F-4）——仅数据源从镜像换现算。
+ * **子代理面板批（2026-10-04 · `docs/desktop/design/PANEL-READBACK.md`）——回读源链**：数据源不再单源现算——
+ * `readPanelSource(ctx)` = `ctx.readout()`（桌面渲染面实况快照——上报缓存读面）优先 ⇒ `ctx.state` 现算 ⇒
+ * 二者皆空报不可用；视图面快照非空 ⇒ `{ source:"renderer", asOf, ageMs, panel[] }`（awaitingDigest 条读时
+ * 交叉核池/pending 标 `digested`——与 CLI 面同判据）；freeze 门控两源同判（桌面块 `awaitingDigest`/`region` 为
+ * 独立字段），键统一规范化（`sub:` 前缀剥除——**有意放宽且两端同宽**；发射键 = 规范化键，relay 文法不吃 `:`）。
  * subagent-actions.mjs 尾部 re-export executePanelAction 保 subagent.mjs 既有 import 面。
  */
 import { getAsyncPool } from "./async-settle.mjs"
@@ -41,67 +46,129 @@ function consultChildUndigested(agent, key) {
   return false
 }
 
+/**
+ * 回读源链（子代理面板批 · 2026-10-04 · `PANEL-READBACK.md` §2.1/§2.3）：渲染面快照
+ * （`ctx.readout()`——桌面实况回读上报；`{ blocks, receivedAt }`，块形 = 判别六键 + `role`/`id` 随行）优先
+ * ∥ CLI 现算（`computePanelBlocks(ctx.state)`——F-3 单账本）∥ 二者皆空 ⇒ `null`（拒因照旧）。
+ * 返回 `{ blocks, readout }`：`readout` 非空 = 桌面快照源（`awaitingDigest` / `region` 为块独立字段）。
+ */
+function readPanelSource(ctx) {
+  const snapshot = typeof ctx.readout === "function" ? ctx.readout() : null
+  if (snapshot && Array.isArray(snapshot.blocks)) return { blocks: snapshot.blocks, readout: snapshot }
+  const snap = computePanelBlocks(ctx.state)
+  return Array.isArray(snap) ? { blocks: snap, readout: null } : null
+}
+
+/** 键归一（**有意放宽且两端同宽**——§2.3）：`sub:` 前缀剥除后比对（桌面块键 `sub:role#id` ∥ CLI 块键
+ *  `role#id` 两写法皆接受）；命中后比对与发射全用规范化键（relay 前缀文法 `^\w-+#\d+/` 不吃 `:`）。 */
+function normalizePanelKey(key) {
+  const k = String(key ?? "")
+  return k.startsWith("sub:") ? k.slice("sub:".length) : k
+}
+
+/** 两源同判——等待消化：CLI 块 = 现算 status 位；桌面块 = 判别键 `awaitingDigest`。 */
+function awaitingOf(src, block) {
+  return src.readout ? block.awaitingDigest === true : block.status === "awaitingDigest"
+}
+
+/** 活态标签（live 列表 ∥ 拒因文案共用）：桌面块把 awaiting 态折进 status 位（与 CLI 现算同形）。 */
+function liveStatusOf(src, block) {
+  return awaitingOf(src, block) ? "awaitingDigest" : String(block.status ?? "unknown")
+}
+
+/** 桌面回读条目（视图面——判别六键 + `role`/`id` 随行；awaitingDigest 条读时交叉核池/pending 标 `digested`
+ *  —— 判据与 CLI 面同源；consult 子块按消费判据——键经归一后入判）。 */
+function readoutPanelEntry(agent, block) {
+  const key = normalizePanelKey(block.key)
+  const out = {
+    key: block.key,
+    role: block.role ?? null,
+    id: block.id ?? null,
+    status: block.status ?? null,
+    frozen: block.frozen === true,
+    awaitingDigest: block.awaitingDigest === true,
+    region: block.region === "flow" ? "flow" : "activity",
+    dom: block.dom === true,
+  }
+  if (out.awaitingDigest) {
+    out.digested = consultChildKey(key)
+      ? !consultChildUndigested(agent, key)
+      : !blockKeyIn(agent._pendingAsyncResults, key)
+        && !blockKeyIn(getAsyncPool(agent, "subagent"), key) && !blockKeyIn(getAsyncPool(agent, "advisor"), key)
+  }
+  return out
+}
+
 /**
  * AGENT-LOOP-SUBAGENT.md §6.7.2 D-P3 冻结门控（安全）：仅允许冻结 awaitingDigest 且池（_asyncSubagents/
  * _asyncAdvisors——经 getAsyncPool accessor——D1）无对应运行条目 + pending 单容器
  * （_pendingAsyncResults——D2）无对应条目的块（= 已消化驻留块——报告已入模型上下文
  * ——pending 已消费——状态滞后——补发冻结不破坏任何顺序）。
+ * - 数据源 = **回读源链**（子代理面板批 · 2026-10-04）：`ctx.readout`（桌面渲染面快照——块判别键
+ *   `awaitingDigest`/`region` 独立字段）优先 ∥ `ctx.state` 现算；命中后比对与发射全用**规范化键**
+ *   （`sub:` 前缀剥除——有意放宽且两端同宽，§2.3）。
  * - pending 仍有对应（报告未达模型）→ 拒绝（提前回收破坏消化顺序——T-P3）
  * - 不存在的 key / 仍 running / done 的块 → 拒绝（T-P4——running 块 settle 时自冻）
- * - 无面板（现算返 null）→ 拒绝（headless/VS Code——freeze 不可用——T-P5）
+ * - 无面板（两源皆空）→ 拒绝（headless/VS Code——freeze 不可用——T-P5）
+ * - 已入流（桌面快照 `region:"flow"`——已归档）→ 追加拒因（无卡可收；CLI 源无该字段 ⇒ 零改）
  * - consult 子块（#748）：会话在跑 ∥ 会话条目在 pending（`childIds` 携该号）→ 拒绝（同判据——与回收 ∥ 补发同源）
- * 错误信息明确（模型可解释 + 自助修正）。返回 { ok:true } 或 { err }。
+ * 错误信息明确（模型可解释 + 自助修正）。返回 `{ ok:true, renderer }` 或 `{ err }`。
  */
 function panelFreezeGate(ctx, key) {
-  // F-3（2026-09-10）：镜像退役——经 ctx.state 读时现算（CLI-ACTIVITY-DEBLOAT）。
-  // 门控语义零动（F-4）：awaitingDigest 限定/池归属查/pending 查逐字保留——仅数据源换现算。
-  const snap = computePanelBlocks(ctx.state)
-  if (!Array.isArray(snap)) {
+  const src = readPanelSource(ctx)
+  if (src === null) {
     return { err: "panel unavailable — no CLI TUI panel in this session (headless / VS Code / subagent contexts — freeze unavailable; panel is CLI-TUI-only, AC-P4)" }
   }
-  const block = snap.find((b) => b.key === key)
+  const want = normalizePanelKey(key)
+  const block = src.blocks.find((b) => normalizePanelKey(b.key) === want)
   if (!block) {
-    const live = snap.map((b) => `${b.key}(${b.status})`).join(", ")
+    const live = src.blocks.map((b) => `${b.key}(${liveStatusOf(src, b)})`).join(", ")
     return { err: `unknown panel block key: ${key} — the live panel holds: ${live || "(no blocks)"}` }
   }
-  if (block.status !== "awaitingDigest") {
-    if (block.status === "done") {
-      return { err: `block ${key} is already done — nothing to freeze; it was (or is about to be) reclaimed into the conversation by the freeze sweep at the turn end / settle (only digested-stuck awaitingDigest blocks need a manual freeze)` }
+  // 已入流 = 已归档（桌面快照判别键）——无卡可收（CLI 源无 region 字段 ⇒ 零改）。
+  if (src.readout && block.region === "flow") {
+    return { err: `block ${want} is already in the conversation flow (region "flow") — it has been archived; there is nothing left to freeze` }
+  }
+  if (!awaitingOf(src, block)) {
+    const status = String(block.status ?? "unknown")
+    if (status === "done") {
+      return { err: `block ${want} is already done — nothing to freeze; it was (or is about to be) reclaimed into the conversation by the freeze sweep at the turn end / settle (only digested-stuck awaitingDigest blocks need a manual freeze)` }
     }
-    if (block.status === "running") {
-      return { err: `block ${key} is still running — freeze only reclaims awaitingDigest blocks whose report is already digested; a running block freezes on its own settle (or stop it with action:'cancel' if it is a background async child)` }
+    if (status === "running") {
+      return { err: `block ${want} is still running — freeze only reclaims awaitingDigest blocks whose report is already digested; a running block freezes on its own settle (or stop it with action:'cancel' if it is a background async child)` }
     }
-    return { err: `block ${key} is in state ${block.status} — freeze only reclaims awaitingDigest blocks whose report is already digested` }
+    return { err: `block ${want} is in state ${status} — freeze only reclaims awaitingDigest blocks whose report is already digested` }
   }
-  if (blockKeyIn(getAsyncPool(ctx.agent, "subagent"), key) || blockKeyIn(getAsyncPool(ctx.agent, "advisor"), key)) {
-    return { err: `block ${key} still has a live pool entry — it is NOT a digested-stuck block (freeze refused; status action shows the pool)` }
+  if (blockKeyIn(getAsyncPool(ctx.agent, "subagent"), want) || blockKeyIn(getAsyncPool(ctx.agent, "advisor"), want)) {
+    return { err: `block ${want} still has a live pool entry — it is NOT a digested-stuck block (freeze refused; status action shows the pool)` }
   }
   // ASYNC-RESULT-CONTAINER.md D2：pending 单容器（四族统一——原 escalate/consult
   // 独立族退役）。#748：consult 子块键不经裸键比对（会话条目键 `consult#<sessionId>` 与
   // 子块键可数字撞键）——改判消费判据（会话在跑 ∥ 会话条目在 pending——与回收 ∥ 补发同源）。
-  if (!consultChildKey(key) && blockKeyIn(ctx.agent._pendingAsyncResults, key)) {
-    return { err: `block ${key} is still genuinely awaiting digestion — its report is still pending and has NOT reached the model yet; freezing now would break the digestion order (wait for the digest run, which reclaims it automatically)` }
+  if (!consultChildKey(want) && blockKeyIn(ctx.agent._pendingAsyncResults, want)) {
+    return { err: `block ${want} is still genuinely awaiting digestion — its report is still pending and has NOT reached the model yet; freezing now would break the digestion order (wait for the digest run, which reclaims it automatically)` }
   }
-  if (consultChildUndigested(ctx.agent, key)) {
-    return { err: `block ${key} belongs to a consultation whose digest has not been consumed — the session is still running, or its session entry is still pending (freeze refused; the block is reclaimed at the consumption window)` }
+  if (consultChildUndigested(ctx.agent, want)) {
+    return { err: `block ${want} belongs to a consultation whose digest has not been consumed — the session is still running, or its session entry is still pending (freeze refused; the block is reclaimed at the consumption window)` }
   }
-  return { ok: true }
+  return { ok: true, renderer: src.readout !== null }
 }
 
 /**
  * AGENT-LOOP-SUBAGENT.md §6.7.2 subagent action:"panel"（D-P2——readonly 视图面 + 门控干预面——单动作双参，
  * freeze 优先）：
- * - view（缺省——返回面板块列表）：ctx.state（= agent._tuiState——CLI TUI 装配）经
- *   computePanelBlocks **读时现算**（F-3 单账本——与用户所见一致）。awaitingDigest 条目
- *   **读时交叉**
- *   _pendingAsyncResults/池 标注 digested（round1 #3——digested:true
- *   = 报告已消化但块仍驻留——异常块——freeze 候选；模型可定位解释 UI 怪相）。
- * - freeze:key（D-P3 门控通过 → 发 key + "/" + ⟦ev⟧done 哨兵字面 token——
- *   onToken——TUI routeSubToken 冻结回收——落位复用 sub._freezeAt settle 锚点
- *   splice，无锚点尾推兜底——AGENT-LOOP-ASYNC-POOL.md §6.8 同口径——round1 #2）。
- * 无 TUI state（headless/VS Code——D-P2 round1 #1：webview 无 state.subTasks 对应物——
- * 7.2.3.2 #8 先例）→ view 恒降级池视图（双池经 getAsyncPool + pending 单容器
- * 合成）+ no panel 注；freeze 报不可用。CLI-only 完整能力（AC-P4）。
+ * - view（缺省——返回面板块列表）：**回读源链**（子代理面板批 · 2026-10-04）：渲染面快照非空 ⇒
+ *   `{ source:"renderer", asOf, ageMs, panel[] }`（判别六键 + role/id 随行；awaitingDigest 条读时交叉
+ *   核池/pending 标 `digested`）∥ 快照空 ⇒ 现链回落——ctx.state（= agent._tuiState——CLI TUI 装配）经
+ *   computePanelBlocks **读时现算**（F-3 单账本——与用户所见一致），awaitingDigest 条目**读时交叉**
+ *   _pendingAsyncResults/池 标注 digested（round1 #3——digested:true = 报告已消化但块仍驻留——异常块——
+ *   freeze 候选；模型可定位解释 UI 怪相）。
+ * - freeze:key（D-P3 门控通过 → 发 key + "/" + ⟦ev⟧done 哨兵字面 token——onToken——TUI routeSubToken
+ *   冻结回收 ∥ 桌面经桥 relay ⇒ 渲染面归档机入流 + record——同字面、零新消费者；发射 = 规范化键。
+ *   落位复用 sub._freezeAt settle 锚点 splice，无锚点尾推兜底——AGENT-LOOP-ASYNC-POOL.md §6.8 同口径——round1 #2）。
+ * 两源皆空（headless/VS Code——D-P2 round1 #1：webview 无 state.subTasks 对应物——7.2.3.2 #8 先例）
+ * → view 恒降级池视图（双池经 getAsyncPool + pending 单容器合成）+ no panel 注；freeze 报不可用。
+ * CLI-only 完整能力（AC-P4）。
  */
 export function executePanelAction(args, ctx) {
   const agent = ctx.agent
@@ -115,17 +182,22 @@ export function executePanelAction(args, ctx) {
     }
     const gate = panelFreezeGate(ctx, freezeKey)
     if (gate.err) return JSON.stringify({ status: "error", error: gate.err })
+    const panelKey = normalizePanelKey(freezeKey)
     if (!ctx.callbacks?.onToken) {
-      return JSON.stringify({ status: "error", error: `panel present but no token relay in this context — the freeze of ${freezeKey} cannot reach the TUI` })
+      return JSON.stringify({ status: "error", error: `panel present but no token relay in this context — the freeze of ${panelKey} cannot reach the TUI` })
     }
     // 门控通过 → 发 done 冻结事件（settle 同机制字面格式——TUI routeSubToken done
     // 分支冻结回收——落位 _freezeAt settle 锚点 splice；无锚点（旧会话残留）时
     // freezeSubTaskLines 尾推兜底——注明两种落位，模型不被误导（advisor 🟡1）。
-    ctx.callbacks.onToken(`${freezeKey}/⟦ev⟧done\x1e0\x1e0\x1edone\x1e`)
+    // 桌面（回读源）：同字面经桥 relay 分流 ⇒ 渲染面归档机（归档入流 + record）——零新消费者；
+    // 发射键 = 规范化键（`sub:` 前缀不入 relay 文法——§2.3）。
+    ctx.callbacks.onToken(`${panelKey}/⟦ev⟧done\x1e0\x1e0\x1edone\x1e`)
     return JSON.stringify({
-      key: freezeKey,
+      key: panelKey,
       status: "frozen",
-      note: "done freeze event issued — the TUI reclaimed the block into the conversation (spliced at its settle anchor when one is recorded, else appended at the current stream end — same-rule position)",
+      note: gate.renderer
+        ? "done freeze event issued — the desktop renderer reclaimed the block into the conversation flow (archived there, record appended)"
+        : "done freeze event issued — the TUI reclaimed the block into the conversation (spliced at its settle anchor when one is recorded, else appended at the current stream end — same-rule position)",
     })
   }
   // ── view 面（缺省——readonly）──
@@ -133,6 +205,17 @@ export function executePanelAction(args, ctx) {
   if (args?.view === false) {
     return JSON.stringify({ status: "error", error: "panel has nothing to do — view:false with no freeze key; pass freeze:'role#N' to reclaim a digested-stuck block, or omit view (defaults to true)" })
   }
+  // 回读源链（子代理面板批 · 2026-10-04 · `PANEL-READBACK.md` §2.1）：渲染面快照非空 ⇒ 实况回读面
+  // （判别六键 + role/id 随行 + awaitingDigest 读时交叉；asOf/ageMs 携龄——不设截断，卡留块状态恒定）。
+  const readout = typeof ctx.readout === "function" ? ctx.readout() : null
+  if (readout && Array.isArray(readout.blocks)) {
+    return JSON.stringify({
+      source: "renderer",
+      asOf: readout.receivedAt ?? null,
+      ageMs: typeof readout.receivedAt === "number" ? Math.max(0, Date.now() - readout.receivedAt) : null,
+      panel: readout.blocks.map((b) => readoutPanelEntry(agent, b)),
+    })
+  }
   const snap = computePanelBlocks(ctx.state)
   if (!Array.isArray(snap)) {
     // F-P3 降级：无 TUI state（headless/VS Code/子代理上下文——CLI TUI-only 完整能力）→

package/agent-tools/subagent.mjs

@@ -132,7 +132,7 @@ export const subagentTool = {
     properties: {
       action: { type: "string", enum: ["spawn", "status", "escalate", "cancel", "panel", "consume-design", "observe", "send"], description: "Which action — spawn (default) / status / observe / send / escalate / cancel / panel / consume-design; semantics per action in the tool description." },
       view: { type: "boolean", description: "action:'panel' only: true (default) = the live panel blocks as the user sees them; false without freeze = error. Mutually exclusive with freeze (freeze wins)." },
-      freeze: { type: "string", description: "action:'panel' only: block key of a digested-stuck block — reclaims it into the conversation; refused for running/done/unknown blocks or a still-pending report; requires the CLI TUI panel mirror." },
+      freeze: { type: "string", description: "action:'panel' only: block key of a digested-stuck block — reclaims it into the conversation; refused for running/done/unknown blocks or a still-pending report; works on the CLI TUI panel and on the desktop renderer panel (live readback of the blocks as the user sees them)." },
       task: { type: "string", description: "Required for action:'spawn' (the self-contained task brief) and action:'escalate' (goal, constraints, entry files, acceptance criteria)." },
       context: { type: "string", description: "Optional background the sub-agent needs (it cannot see this conversation); action:'spawn' only." },
       role: { type: "string", enum: ["explore", "plan", "coder", "eng-coder", "eng-designer"], description: "The sub-agent role — see the role matrix in the tool description. Exact spelling required. action:'spawn' only (escalate spawns its own expert internally)." },
@@ -188,7 +188,9 @@ export const subagentTool = {
       // CLI-ACTIVITY-DEBLOAT F-3（2026-09-10）接线：executePanelAction 经 ctx.state
       // （= agent._tuiState——startTUI 反向挂载）读时现算面板块（computePanelBlocks）——
       // 手工面板镜像已退役。headless/VSC 无挂载 → 现算返 null → 降级照旧。
-      if (action === "panel") return executePanelAction(args, { ...ctx, state: ctx.agent?._tuiState })
+      // 子代理面板批（2026-10-04）：另携 ctx.readout（= agent._panelReadout——桌面渲染面实况回读
+      // 上报缓存读面；agent-host 装配挂）——核内读源链 readout → state → 降级（PANEL-READBACK.md §2.1）。
+      if (action === "panel") return executePanelAction(args, { ...ctx, state: ctx.agent?._tuiState, readout: ctx.agent?._panelReadout })
       // SUBAGENT-OBSERVE-SEND：observe = readonly 查询（同 status——digest/planMode 放行）；
       // send = 控制类豁免（同 cancel——父回合内显式调用即授权）。深度门在各自执行器内。
       if (action === "observe") return executeObserveAction(args, ctx)

package/agent-tools/verify.mjs

@@ -87,6 +87,7 @@ export const verifyTool = {
           status: { type: "string", enum: ["passed", "failed", "skipped"], description: "The verification outcome you declare: 'passed' → allowed; 'failed' → blocked; 'skipped' → allowed but requires a summary reason." },
           command: { type: "string", description: "Optional: the verification command you ran (self-reported)." },
           summary: { type: "string", description: "Optional: the result. Required when status='skipped' — a concrete reason (e.g. \"project has no automated tests — verified by manual review\")." },
+          basis: { type: "string", description: "Optional: what the conclusion stands on — a judgment source, a read file:line coordinate, or an explicit \"unverified\" (declaration-only: no format is enforced or machine-checked). A passed/skipped declaration without it gets one advisory hint line in the report — never blocking, never changing the gate." },
         },
         required: ["status"],
       },
@@ -239,12 +240,16 @@ export const verifyTool = {
         lines.push("Verification declared passed.")
         if (v.command) lines.push(`  command: ${v.command}`)
         if (v.summary) lines.push(`  summary: ${v.summary}`)
+        if (v.basis) lines.push(`  basis: ${v.basis}`)
+        else lines.push("  basis: not declared (advisory — does not affect the gate) — note what the conclusion stands on: a judgment source, a read file:line, or an explicit \"unverified\".")
         ctx.agent._verifyPassed = true
       } else if (status === "skipped") {
         const reason = (v.summary ?? "").trim()
         if (reason) {
           lines.push("")
           lines.push(`Verification skipped with reason: ${reason}`)
+          if (v.basis) lines.push(`  basis: ${v.basis}`)
+          else lines.push("  basis: not declared (advisory — does not affect the gate) — note what the conclusion stands on: a judgment source, a read file:line, or an explicit \"unverified\".")
           ctx.agent._verifyPassed = true
         } else {
           lines.push("")

package/auto-think.mjs

@@ -16,6 +16,8 @@
  */
 import { chat } from "./provider/core.mjs"
 import { specForModel } from "./config.mjs"
+// #860（AGENT-LOOP.md §6.1 ∥ §7 D-AL26）：off 形族的单一实现源（写面取形 + 有效 off 路径判据）
+import { thinkOffPath, thinkOffShape } from "./think-off.mjs"
 
 const CLASSIFY_PROMPT = `Classify this coding task's difficulty: low, medium, or high.
 
@@ -31,6 +33,10 @@ const EFFORT_MAP = {
   high: ["max", "max", "xhigh", "max"],
 }
 
+/** #860（D-AL26）：不可关思考的跳过警示 ∕ 分类失败——进程级一次性（按 model ∕ 错误签名去重，防逐轮刷屏）。 */
+const warnedThinkGuard = new Set()
+const warnedClassifyFailure = new Set()
+
 /**
  * Build classifier input from history: the latest real user message (reminders and
  * interrupt injections excluded), plus the previous user message as context when the
@@ -67,13 +73,25 @@ export async function classifyAndApply(agent, turn) {
   const validEfforts = spec.reasoningEffortEnum
   if (!validEfforts) return null // Model doesn't support reasoning effort
 
+  // #860 守卫（D-AL26）：无法关思考的模型（thinkAlwaysOn ∕ 枚举无 none）⇒ 分类调用必然失败
+  //（思考吃光小预算 ∕ 400）——不调用；一次可见警示（按 model 去重），语义回退 null。
+  if (!thinkOffPath(spec)) {
+    if (!warnedThinkGuard.has(agent.provider.model)) {
+      warnedThinkGuard.add(agent.provider.model)
+      console.warn(`[auto-think] model "${agent.provider.model}" cannot disable thinking — difficulty classification skipped (reasoning effort unchanged)`)
+    }
+    return null
+  }
+
   const prompt = buildClassifierInput(agent.history)
   if (prompt == null) return null
 
   // Classification call: use same provider, minimal tokens, no tools, no streaming
   let level
   try {
-    const classifierProvider = { ...agent.provider, maxTokens: 10 }
+    // #860：关思考形（族别 off 形）+ 小预算 32（原 10 token 被思考吃光）+ reasoningEffort 清空
+    //（防父档外溢；effort 族 off 形由载荷门补发 reasoning_effort:"none"）。
+    const classifierProvider = { ...agent.provider, maxTokens: 32, thinking: thinkOffShape(spec), reasoningEffort: null }
     const response = await chat(classifierProvider, {
       messages: [
         { role: "system", content: CLASSIFY_PROMPT },
@@ -101,7 +119,13 @@ export async function classifyAndApply(agent, turn) {
     else if (word.startsWith("medium") || word.startsWith("med")) level = "medium"
     else if (word.startsWith("high")) level = "high"
     else return null // Unparseable
-  } catch {
+  } catch (e) {
+    // #860（D-AL26）：失败一次可见（按错误签名进程级去重——不再静默）；回退 null 语义不变。
+    const sig = e?.message ?? String(e)
+    if (!warnedClassifyFailure.has(sig)) {
+      warnedClassifyFailure.add(sig)
+      console.warn(`[auto-think] classification failed: ${sig}`)
+    }
     return null // Classification failure → fall back to current setting
   }
 

package/config-presets.mjs

@@ -42,6 +42,14 @@ export const PROVIDER_PRESETS = {
   siliconflow: { baseURL: "https://api.siliconflow.cn/v1", model: "deepseek-ai/DeepSeek-V3", maxTokens: 32_000, desc: "SiliconFlow (硅基流动)" },
   openrouter: { baseURL: "https://openrouter.ai/api/v1", model: "anthropic/claude-sonnet-4", maxTokens: 32_000, desc: "OpenRouter" },
   groq:     { baseURL: "https://api.groq.com/openai/v1", model: "llama-3.3-70b-versatile", maxTokens: 32_000, desc: "Groq" },
+  // OpenCode Go 订阅网关（opencode.ai/zen 取 sk- key ∥ 无 OAuth）——官方档（go.mdx）双协议混装 ⇒ 拆双预设
+  // （PROVIDER.md §6.11）：本键 = OpenAI 兼容 `/chat/completions` 侧；`opencode-go-anthropic` = Anthropic
+  // `/messages` 侧（同 key——模型按侧选）。字段集 = 最小面：`thinking` / `reasoningEffort` 不设 = 不发
+  // （D-13 同口径）；`maxTokens` 仅 anthropic 侧设 `65536`（该 transport `max_tokens` 必发——不设即落规格
+  // 行值 131072，超渠道口径）。**待验（无 key——未实拉 `/models` ∕ 载荷未实测；接入后按实拉复核）**；
+  // `x-opencode-session` 头 = 可选遥测——**不发**（亦不动 `providers[].headers` 面）。
+  "opencode-go": { baseURL: "https://opencode.ai/zen/go/v1", model: "glm-5.2", desc: "OpenCode Go subscription (sk- key from opencode.ai/zen; OpenAI-compatible models — MiniMax/Qwen via opencode-go-anthropic)" },
+  "opencode-go-anthropic": { baseURL: "https://opencode.ai/zen/go/v1", model: "qwen3.7-max", format: "anthropic", maxTokens: 65536, desc: "OpenCode Go — Anthropic Messages side (same sk- key as opencode-go; MiniMax/Qwen models)" },
 }
 
 /** Build the stored provider entry from a preset — strip the display field, keep the rest

package/config.mjs

@@ -13,7 +13,7 @@
 
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs"
 import { dirname, join } from "node:path"
-import { parseModelRef, resolveRuntimeProvider, defaultModelReason } from "./model-ref.mjs"
+import { parseModelRef, resolveChannelModel, resolveProviderPlan, resolveRuntimeProvider, defaultModelReason } from "./model-ref.mjs"
 // 老形态迁移核（M7 v2——纯函数零依赖——本文件超 500 行硬限拆分，VSC 同构文件）
 import { migrateLegacyModelFields } from "./config-migrate.mjs"
 import { expandHome } from "./expand-home.mjs"
@@ -23,7 +23,7 @@ import {
   _configPath, writeConfigAtomic,
 } from "./config-io.mjs"
 
-export { parseModelRef, resolveRuntimeProvider, defaultModelReason, migrateLegacyModelFields }
+export { parseModelRef, resolveChannelModel, resolveProviderPlan, resolveRuntimeProvider, defaultModelReason, migrateLegacyModelFields }
 export { PROVIDER_PRESETS, presetToEntry, configDir, configPath, _setConfigPathForTest, _resetConfigPathForTest }
 // 核内单一写盘执行体（已迁 `config-io.mjs`）——本档 re-export 保持既有导入面（§2.5 #131）。
 export { writeConfigAtomic }
@@ -188,6 +188,31 @@ function warnConsultModelsFiltered(dropped, path) {
     `\n  Fix: clean agent.consultModels in ${path} or use /config → consult/escalate pool menu.`)
 }
 
+/** #861（AGENT-LOOP-SUBAGENT.md §6.7.1）：subagent 模型覆盖加载期清洗——单源纯函数（核 loadConfig ∥ VSC 端壳 raw 读点同消费）；非法形态不 throw（`subagentModel` 非法 ⇒ null、`subagentModels` 非对象 ⇒ {}、值非法 ⇒ 剔除该键）。 */
+export function sanitizeSubagentModel(v) {
+  const ok = typeof v === "string" && v.trim()
+  const dropped = ok || v == null ? [] : [`agent.subagentModel must be a non-empty string ("provider:model" | provider | model) — got ${Array.isArray(v) ? "array" : typeof v} — ignored (inherits the parent provider)`]
+  return { value: ok ? v : null, dropped }
+}
+export function sanitizeSubagentModels(v) {
+  if (v == null) return { value: {}, dropped: [] }
+  if (typeof v !== "object" || Array.isArray(v)) return { value: {}, dropped: [`agent.subagentModels must be an object mapping role → model override — got ${Array.isArray(v) ? "array" : typeof v} — ignored`] }
+  const value = {}, dropped = []
+  for (const [role, val] of Object.entries(v)) {
+    if (typeof val === "string" && val.trim()) { value[role] = val; continue }
+    dropped.push(`agent.subagentModels.${role} must be a non-empty string ("provider:model" | provider | model) — got ${Array.isArray(val) ? "array" : typeof val} — dropped`)
+  }
+  return { value, dropped }
+}
+
+let warnedSubagentModels = false // #861：清洗警告——进程级一次性（同 consultModels 先例）
+function warnSubagentModelsFiltered(dropped, path) {
+  if (warnedSubagentModels || dropped.length === 0) return
+  warnedSubagentModels = true
+  console.warn(`[config] agent.subagentModel/subagentModels: ${dropped.length} invalid entr${dropped.length === 1 ? "y ignored" : "ies ignored"} (filtered — startup continues; no crash):\n` +
+    `${dropped.map((d) => `  - ${d}`).join("\n")}\n  Fix: clean it in ${path} — "provider:model" | provider | model.`)
+}
+
 /**
  * Find provider by name in providers[].
  * Throws if name is non-empty but not found — a typo in activeProvider silently falling to the first provider would use the wrong key on the wrong endpoint.
@@ -311,6 +336,11 @@ export function loadConfig() {
   merged.agent.consultModels = cmClean.keep
   if (cmClean.dropped.length) merged.agent.consultModelsFiltered = cmClean.dropped
 
+  const smClean = sanitizeSubagentModel(merged.agent.subagentModel), smsClean = sanitizeSubagentModels(merged.agent.subagentModels) // #861（§6.7.1）：加载期清洗——非法形态不采纳 + 一次性警告（不 throw——同 F-4 范式）
+  warnSubagentModelsFiltered([...smClean.dropped, ...smsClean.dropped], path)
+  merged.agent.subagentModel = smClean.value
+  merged.agent.subagentModels = smsClean.value
+
   // Backward compatibility: promote root-level config fields to agent sub-object
   if (config.verifyGuard !== undefined) {
     merged.agent.verifyGuard = config.verifyGuard
@@ -325,14 +355,18 @@ export function loadConfig() {
   // 保证 agent.config.proxy 永远是规范形态或 undefined
   merged.proxy = normalizeProxy(merged.proxy)
 
-  // Runtime provider = config.defaultModel 复合解析（F-2——resolveRuntimeProvider）。
-  // 无效/未设 → {} + providerInvalidReason（D-S1 处置不 throw——make-agent 打 _providerInvalid
-  // 标记 → TUI 首帧弹选择 / headless 报可读错误；同 2026-09-02 Q1 语义——不复用 findProvider
-  // throw 契约——findProvider 保留给 advisor/run.mjs 等直接调用方）。
-  merged.provider = resolveRuntimeProvider(merged.providers, merged.defaultModel)
+  // Runtime provider = 统一解析（#841——resolveProviderPlan 单源：回退序 + 三态；PROVIDER.md §6.22）。
+  // 不可运行（渠表空 ∥ 全表无 key）⇒ {} + providerInvalidReason（D-S1 处置不 throw——make-agent 打
+  // _providerInvalid 标记 → TUI 首帧弹选择 / headless 报可读错误；同 2026-09-02 Q1 语义——不复用
+  // findProvider throw 契约——findProvider 保留给 advisor/run.mjs 等直接调用方）。
+  const plan = resolveProviderPlan({ providers: merged.providers, defaultModel: merged.defaultModel })
+  merged.provider = plan.provider
+  merged.providerState = plan.state // ok ∥ fallback ∥ invalid（三值闭集——KD-841-3 config 级）
+  merged.providerStateReason = plan.reason // state≠ok 时非空（语义源；消费者按 state 出词——禁串嗅探）
+  // providerInvalidReason 语义不变（provider 不完整时非空——装配校验 validateProvider 消费面照旧）
   merged.providerInvalidReason = merged.provider.name
     ? null
-    : defaultModelReason(merged.providers, merged.defaultModel)
+    : plan.reason ?? defaultModelReason(merged.providers, merged.defaultModel)
 
   // Compaction threshold follows the model (provider-level context override honored — providerSpec)
   const explicitThreshold = config.agent?.compactThreshold

package/declaration.mjs

@@ -5,8 +5,8 @@
  * name / shape / defaults = schema 面 `docs/core/design/MANIFEST.md` §2.2）。迁出块逐字；
  * 原档 `conventions.mjs` 经 `export { … } from` 转口保名（消费面 / 批内件 import 面零改）。
  */
-import { existsSync } from "node:fs"
-import { dirname, isAbsolute, join, relative, resolve } from "node:path"
+import { existsSync, statSync } from "node:fs"
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path"
 import { DEFAULT_MANIFEST, manifestFilePath, readManifest } from "./manifest.mjs"
 import { logEvent } from "./log.mjs"
 
@@ -140,6 +140,30 @@ export function declaredPublicRoots(cwd) {
   return out
 }
 
+/** 引用解析单点（§6.1 口径 4/5——写门 ∥ 迁移旗同消费，不得二写）：① 仓根解析 `resolve(base, part)`
+ *  为存在的档 ⇒ 命中；② 声明源前缀解析序：首段命中声明公共仓目录名（消费既有 `declaredPublicRoots`
+ *  ——同名多仓 ⇒ 声明序首者）⇒ 于该声明根解析余段；未声明 ∥ 声明根缺位 ∥ 目标档缺 ⇒ `{ ok: false, abs }`。
+ *  @param {string} base 仓根基准（写门口径 2 同一子表达式）
+ *  @param {string} part task_book 文件部分（首个 `§` 前子串，trim——调用面已判缺位）
+ *  @returns {{ok: boolean, abs: string}}
+ */
+export function resolveDeclaredRef(base, part) {
+  const abs = resolve(base, part)
+  if (isFile(abs)) return { ok: true, abs }
+  const segs = String(part).replace(/\\/g, "/").split("/").filter(Boolean)
+  for (const root of declaredPublicRoots(base)) {
+    if (segs[0] !== basename(root)) continue
+    if (segs.length > 1) {
+      const hit = resolve(root, segs.slice(1).join("/"))
+      if (isFile(hit)) return { ok: true, abs: hit }
+    }
+    break
+  }
+  return { ok: false, abs }
+}
+
+const isFile = (p) => { try { return statSync(p).isFile() } catch { return false } }
+
 const _cache = new Map()
 
 /** Drop the per-data-file-path cache (test seam — declarations are read once per path). */