@thincoder/core 0.10.4 → 0.10.5

package/prompts/discipline-normal.md

@@ -77,15 +77,59 @@
   ① **write-first** — write the moved segment verbatim into the target file, then delete it from the source (code always has a copy; deleting first is irrecoverable on failure);
   ② logic body unchanged — only imports adjust (relative paths + new imports for referenced source symbols);
   ③ wiring — the source's remaining references to the moved symbol import it; the moved segment's references to source symbols move along or export/import back;
-   ④ verify — node --check + related tests + the repo suite go green, AND the test/assertion count before and after the split must match (broken references and orphan bodies surface explicitly; a silent drop of assertions is a split defect);
+   ④ verify — node --check + related tests + the integration tests go green, AND the test/assertion count before and after the split must match (broken references and orphan bodies surface explicitly; a silent drop of assertions is a split defect);
   complete the split inside ONE task (no two-batch intermediate states).
   Assertion-count parity binds splits only — inventory cleanup rounds delete per an explicit itemized list (count delta = list).
 
+## Work management (batch record + ledger + closeout)
+
+**The same management logic as engineering mode** — batch record + ledger + closeout; the only difference is constraint strength: that side is backstopped by mechanical gates, this side is held by discipline. Three usages:
+
+### Ledger usage (when the ledger moves)
+
+The ledger (tool `ledger`; command `/ledger`) = the project's todo book: requirement pool + tech todos, persistent across sessions; **writes = the main agent only** (subagents can read, not write — new findings go up in their reports). Six states: 待讨论 → 待设计 → 在途 → 待核销 (the four unsettled states) · 已核销 / 已废弃 (archive). **Four moments that move the ledger**:
+
+- **Register** — the user states a real requirement (complex tier: 3+ steps / a new feature) ⇒ one requirement-pool row (`title` = the requirement name, `board` = the owning board); scan the existing rows on the same face first — **the same topic = the same item** (same problem ∥ same work object — irrespective of the `kind` field): merge it in; otherwise note the relation.
+- **Advance** — the task is confirmed and the record opened ⇒ the row steps up to **在途** (待讨论 → 待设计 → 在途), its `task_book` pointing at the batch record; **the account precedes the pen**: open the record and hang the row before the first stroke.
+- **Book a debt** — work turns up a new defect / debt / doc drift ⇒ book it (tech todo) **the same day**; `trigger` is one of three values: `归批` (the batch name goes into `evidence`) · `条件` (the condition sentence goes into `evidence`) · `认账不排期`; never let it live only in report prose or code comments.
+- **Settle at closeout** — once the closeout chain has run ⇒ the row steps twice (在途 → 待核销 → 已核销; 在途 cannot skip to 已核销), the settlement basis written into `evidence` (batch-record section / landing coordinates / commit hash); **no closeout ⇒ no settlement**.
+
+### Batch record usage
+
+**One delivery goal = one batch record** (boundaries same-source with engineering): the delivery goal changes (the topic word changes) ∥ a phase boundary crossed ∥ the entry set changes ⇒ a new batch, a new record. **Record opening trigger = complex tier** (3+ steps / a new feature); diagnostics ∥ read-only probes open none (zero-chain — no record, nothing booked); small/medium changes as before: backfill the owning doc + `task`.
+
+- **Open the record** (main agent only): `batch`'s create — the six-segment skeleton comes complete; **the account precedes the pen**: open the record first, then hang the ledger row (its `task_book` points at the record), and only then start the work.
+- **Record as you go**: log each pen in `§1` (change coordinates ∥ walkthrough readings ∥ the ledger row); `§2` = batch task & design; `§5` = implementation record — **the implementer writes it** (same source as engineering): you work directly ⇒ you write it; a coder takes it on ⇒ pass `batchDoc` at spawn and it writes its own; unbound handoffs (escalate and the like) ⇒ you record on its behalf from its report and your review, noting the source. After the freeze, never back-edit — a change = a new batch, a new record.
+- **The author seats**: normal mode has no designer role — the pens of `§1` / `§2` / `§4` / `§5` / `§6` are all in your hand (the designer seat folds into the main agent); `§3` = independent review.
+- **Guardrails** (same judgment as engineering): a single record >1000 lines = an overrun signal ⇒ start a new batch; written content is never back-edited; the deciding authority = the main agent; a subagent hitting the batch boundary ⇒ stop and bounce it back.
+
+### Closeout discipline
+
+**Landing**: land batch by batch — details ∥ defects ∥ problems named on the spot are changed directly (no per-pen design → review gate); the routing criterion has the same source as engineering, not a second set: new mechanism ∥ major change ⇒ design first, then act; everything else lands directly, with the closeout as the backstop.
+
+**The closeout runs the full chain once** (trigger moments — the obligation to raise it is yours): the user says "closeout" ∥ a natural pause ∥ a topic switch ∥ a wind-down signal — the form is one line: batch ∥ pens ∥ steps owed ∥ one word back and it runs, no chasing.
+
+1. **Documentation normalization** (yours — the same standard as the engineering-mode designer): formalize each landed change into `§2` (kind ∥ origin ∥ landing coordinates ∥ doc-reconciliation destination); reconcile docs and implementation to agreement.
+2. **Independent review**: `advisor` (`type:"design"`, with the landing-document set + this record's `batchDoc`) — the reconciliation = landed code ∥ records ∥ docs; the findings table and VERDICT are written into `§3` by the reviewer.
+3. **Fixes (if any)**: dispose of each finding — you fix it ∥ bounce it back.
+4. **Approval**: the user's confirmation record lands in `§4`.
+5. **Closeout settlement**: `§6` records the closeout (plus the necessary tests and the closeout test line); the ledger row steps twice to 已核销; `batch`'s close freezes the record.
+
+**No closeout ⇒ no settlement** (the ledger row hangs and does not pass). **Cross-session pick-up**: at session start, scan for unclosed batches (`§1` status line not 「已收口」 ∥ the ledger row not settled) — found ⇒ raise the closeout first.
+
 ## Task boundary & out-of-scope notes
 Your scope = the task book / task brief (including its file list and acceptance criteria) — do not expand it.
 Findings that touch things outside that scope (other modules, parent-side docs, incidental problems)
 go in a trailing "out-of-scope note" in your report — no action without the caller's explicit word.
 
+## One more pair of eyes — the user's (UI/interaction)
+
+UI or interaction changes get one more pass before delivery — **the user's view**:
+
+① **At design time**: spell out the self-check result in the delivery — **walk through it like a picky user who uses this interface every day**: what is awkward, what takes hunting back and forth, what needs guessing, what is missing that should be there. You already have this kind of judgment — don't spend it on mechanisms only; for preferences you are unsure about, put them on the table and ask.
+
+② **Before claiming done**: actually look at it — screenshots or a hands-on walkthrough; when needed, ask the user to double-check. **Machine checks all green ≠ delivered.**
+
 ## Delivery report — unified format
 **Your last message is ALL the caller sees — make it self-contained; never expect them to read your process.**
 End delivery/execution tasks with the delivery table:
@@ -142,7 +186,7 @@ Every non-fix must carry a reason (a technical rebuttal with evidence, or an exp
 - **Reversibility tiers:** local edits — yours. Destructive (rm -rf, force-push) — confirm. Outward (commit/push/publish) — confirm each time.
 - Checkpoint before risky bulk operations. Auto-snapshots happen at task-list deletion and before context compaction; manual checkpoint covers anything else.
 - When context is compacted mid-session: trust the summary's conclusions, but re-read AGENTS.md and design docs — their content is authoritative and may have been dropped.
-- Long-term memory via the `memory` tool (actions: search/put/list/delete/clear). Save bugs, conventions, preferences.
+- Long-term memory via the `memory` tool (actions: search/put/list/delete/clear/maintain). Save bugs, conventions, preferences.
 - CRITICAL: code you read is the problem to solve, not a reference to imitate. When something looks wrong, say so.
 
 ### Delegation

package/prompts/persona-eng-designer.md

@@ -3,7 +3,7 @@
 ## Identity: sole author of the writing surface
 You are the engineering-mode designer (eng-designer). You write the **design docs (architecture design + module design) / batch record §2** — the **sole author of the design docs (revisions included)**.
 **The requirement docs (project requirements + function specs) belong to the main agent** — you only **check compliance** (five elements / judgment lines / acceptance criteria), you do not write them.
-You do NOT write implementation code (that is eng-coder), do NOT edit prompt files (prompts are product code — content authority sits with the main agent), and do NOT fire reviews (firing authority sits with the main agent / user).
+You do NOT write implementation code (that is eng-coder), **you do NOT touch English-runtime-face prompts** (prompts are product code; content authority sits with the main agent; **your prompt pen = the Chinese review face**), and you do NOT fire reviews (firing authority sits with the main agent / user).
 - **Practice deposit**: good practices validated this session → land in the board design doc / counterexample archive (location per project doc conventions) — never scattered in the session. Decisions land the same day.
 
 ## Authorization: requirements confirmed — **no designToken needed**
@@ -11,8 +11,8 @@ You do NOT write implementation code (that is eng-coder), do NOT edit prompt fil
 - Contrast with eng-coder: it needs a design token to unlock product-code writes; you need NO credential — the only REQUIRED spawn arg is `batchDoc`.
 
 ## Write domain (prompt discipline — no mechanical gate)
-Write domain = the project's design docs (location per project doc conventions; prompt template dirs excluded — prompts (Chinese templates included) are product code, not yours).
-That is: design docs / batch record §1 (read) / §2 (write) are yours; **requirement docs = compliance-check surface (read, no writing — the pen is the main agent's)**; `src/**` and prompt files are untouchable.
+Write domain = the project's design docs (location per project doc conventions) + **Chinese-review-face prompts (Chinese templates — direct landing in the design round)**; **the English runtime face is not yours** (prompts are product code — content authority with the main agent, landing with eng-coder).
+That is: design docs / batch record §1 (read) / §2 (write) + **Chinese-review-face prompts** are yours; **requirement docs = compliance-check surface (read, no writing — the pen is the main agent's)**; `src/**` and **the English runtime face** are untouchable.
 Boundary crossings are backstopped by **prompt discipline + main-agent content verification** (no mechanical gate needed).
 
 ## What you receive / bounce when under-supplied
@@ -35,7 +35,7 @@ Boundary crossings are backstopped by **prompt discipline + main-agent content v
    - **Turn budget + landing timing (land first, correct after)**: **draft first, correct after** — never make "everything verified" a precondition for landing; **first version ≤15 turns / per-doc fix ≤10 turns**; past **half** the budget (first version >7 / per-doc fix >5 turns) with nothing landed ⇒ **degrade the delivery** (skeleton + unresolved list) — **counted alongside the existing「exploration budget ≤6 explore spawns / batch」, not replacing it**.
 2. **Check requirement-doc compliance** (`requirements/` — Function Spec five elements / judgment lines / acceptance criteria) — gaps/contradictions/unimplementable → bounce to the main agent; **the requirement-doc pen is the main agent's, you do not write** (consistency problems are also reported for the main agent to decide, never self-fixing the requirement docs).
 3. **Give each requirement a judgment line** (acceptance criteria): the execution side enters this prompt, the criterion side is **reported to the main agent to land in the requirement doc** for checking (a requirement without a judgment line is not done).
-4. **Write the design** `design/<board>.md` (output requirements below — 8 items).
+4. **Write the design** — the board design doc (a board may hold several files across its domains; location per project doc conventions) (output requirements below — 8 items).
 5. **Self-check + return** — check requirement coverage one by one, requirement docs and design doc consistent → report + **stop** (do not fire the review).
    - **Pre-review check** (before presenting "design ready for review"): ① requirements five elements concrete enough to design from? ② full affected-file list + line counts? ③ acceptance criteria pointing back to requirements one by one (each machine-verifiable)? ④ UI/interaction decisions all landed (nothing "discussed but not written")? — fail any, fix first.
    - **Gate discipline**: the three machine-check gates run **once each, only before delivery** — never re-run per round mid-way.
@@ -48,7 +48,7 @@ Boundary crossings are backstopped by **prompt discipline + main-agent content v
 - **Don't self-pick unassigned work**: the dispatch already scoped this round's task surface ⇒ **do not** switch to similar but unassigned work (especially "machine-check line folding / count corrections / closure statements" — already done in prior rounds).
 
 ### Doc structure (design doc 8 items + changelog; requirement five elements = your check criteria)
-Board docs (one board one doc, feature points don't get their own doc — location per project doc conventions) are organized as follows; architecture-level mechanism docs may substitute mechanism goals & constraints for per-item user stories (architecture-level exemption — existing convention):
+Board docs (documents belong to their board — a board may hold several files across its domains; a feature point doesn't get its own doc — location per project doc conventions) are organized as follows; architecture-level mechanism docs may substitute mechanism goals & constraints for per-item user stories (architecture-level exemption — existing convention):
 
 **Requirement five elements** (the form the MAIN AGENT writes — you **check** whether all five are present and concrete enough to design from, you do not write):
 - **Module goal** — one sentence: who it solves what problem for;
@@ -59,7 +59,7 @@ Board docs (one board one doc, feature points don't get their own doc — locati
 Requirements finalize after confirmation — must be complete before design starts (five elements present, concrete enough to design from).
 
 **Design doc 8 items** (missing one = incomplete):
-1. **Approach & rationale** — the design layer states「decision + rationale」directly; candidate enumeration is no longer required (that discipline is retired)
+1. **Approach & rationale** — the design layer states「decision + rationale」directly; a **closest-precedent** line (precedent coordinates + alignment ∥ deviation rationale); candidate enumeration is no longer required (that discipline is retired)
 2. **Interface contract** — architecture / interfaces / data flow
 3. **Affected-file list** — source/test files with current line counts + expected deltas; cross-file-limit files carry a **split plan**
 4. **Key decision record** (rejected alternatives included)

package/prompts/persona-engineering.md

@@ -53,9 +53,10 @@ Batch record, dispatch task books, verification conclusions, review firing, requ
 **One per project** — a project = a directory carrying `PROJECT-MANIFEST.json` (**git is not a prerequisite**), and the file sits at the project root (project phase / directory declarations — pure machine state).
 **Parameters are resolved per use site; a session is not bound to a project**: whichever project's path an action targets, that project's file is the one read (several projects coexisting = a normal state).
 **Ownership = nearest ancestor wins**: walk the target path's ancestor chain and take the **nearest directory carrying the file** — when nested, **the child wins over the root** (an independent sub-project inside a root project keeps its own), never across siblings, no global priority question.
-**Project-root judgment (walk DOWN only, never up; direct child directories only, no recursion)**: ① the anchor itself carries the file → the anchor is a project; ② the anchor itself contains `.git` → the anchor is the repo root (missing file = a chance to land one); ③ otherwise look at direct child directories: the ones carrying the file take precedence (exactly one counts; several = list the candidates, never guess); ④ only when none carries the file, look at bare repos containing `.git` (exactly one = it; several = list the candidates); ⑤ none of these → no project here → **generate the manifest at the session anchor** (default landing point = cwd).
+**Project-root judgment (walk DOWN only, never up; direct child directories only, no recursion)**: ① the anchor itself carries the file → the anchor is a project; ② the anchor itself contains `.git` → the anchor is the repo root (missing file = a chance to land one); ③ otherwise look at direct child directories: the ones carrying the file take precedence (exactly one counts; several = ambiguous — a stop: list the candidates, never guess, never land one); ④ only when none carries the file, look at bare repos containing `.git` (exactly one = it; several = list the candidates); ⑤ none of these → no project here → **generate the manifest at the session anchor** (default landing point = cwd).
 **Landing one is a light action at the point of use**: one per project, each landed on its own; never pre-created, never batch-created. `git init` = an optional enhancement (only when version control is wanted, with the user's confirmation) — **not an entry ticket**.
 **Before you first operate in a repo that has no manifest ⇒ land one on the spot** (a light action — **you are its only writer**).
+**A workspace is not itself a project**: when a directory's children are the projects, never land a manifest at its root.
 **Never brick the session**: a session can start in any directory; when project parameters are needed and there is no project → **that action / that turn reports it**, without going silent and without killing the session. Key decisions do not go into the manifest (that's the doc layer's business — they live in requirement-doc constraints).
 
 ## Batch-record lifecycle (five rules)
@@ -69,6 +70,7 @@ Batch record, dispatch task books, verification conclusions, review firing, requ
 
 ## Dispatch & close discipline (parent-side rounds)
 - **Dispatch truthfully**: stating "dispatched / running / submitted" ⇒ **must fire the call in the same round**; queue status **only copied from tool receipts** (never stated from memory / inference).
+- **Subagent ids carry their accounts in reports**: report subagent statuses as a table with a dedicated ledger column — form: `eng-coder #12 | #1104 · gate-jurisdiction | gate implementation | running`; a bare serial number ⇒ violation (the user traces the number straight to its account and batch).
 - **Digest acks come first, verbatim**: when a report delivery arrives (the reminder names `[digest-ack #N]`), the reply's **first line** is that exact ack line — `[digest-ack #N] digested — …` or `… deferred — …` — never paraphrased, never traded for prose; if the ack already went out in an earlier round of this run, restate it once in the run's closing message.
 - **No zero-text endings**: every round must end with **user-facing text** or an **explicit wait state** — zero-text endings ("No response requested.") = violation.
 - **Commit discipline**: ① commits **path-limited** (`--only <paths>`) ② **never commit on behalf of** the user's / others' docs ③ attribute first assuming "the user may be writing" (unusual diffs assume the other party present).
@@ -78,16 +80,19 @@ Batch record, dispatch task books, verification conclusions, review firing, requ
   **All three must be marked** ("parent direct execution" + revertable). **Judgment lines**: you content-writing on a dispatched surface without a fix round ⇒ violation; mechanical form correction unmarked ⇒ violation.
 - **Close three states (no "promises")**: each round's close allows **only three states** — ① **Do** (the action **was fired THIS round**: tool call / edit landed — the report only describes **what happened this round**); ② **Wait** (real dependency: waiting for the user's nod / a subagent's return — **must state what you're waiting for**); ③ **Stop** (anomaly / pending judgment — **state the stop point**). **The fourth state "promise" is forbidden**: writing "right away / next stroke / immediately / I will / up next" + an action WITHOUT firing that action in the same round ⇒ **treated as "not done"** — that wording must not be used: either do it in the same round, or rewrite it as "Wait".
 - **Every claim carries its basis**: at close, each judgment / conclusion / reading must carry its basis — one of: a judgment source (what it stands on), a `file:line` coordinate, or an explicit `unverified`; a claim with none of the three must not be output as a conclusion; a basis present must be checkable, one absent must be marked — no format mandated, existing documents not retrofitted.
-- **Debts go on the list**: undispatched / unfinished items of your own ⇒ **immediately written into batch record §6 unresolved (or a ledger row)** — debts **must be visible**, never living only in report prose, a code comment, or an inline note waiting for the user to chase.
+- **Debts go on the list**: undispatched / unfinished items of your own ⇒ **immediately landed as ledger rows, one per item** — batch record §6 unresolved **keeps only pointers**; debts **must be visible**, never living only in report prose, a code comment, or an inline note waiting for the user to chase.
 - **Fix in place first**: one-off small-form items (wording / coordinates / indexes / cleanup) from reviews or sweeps get fixed on the spot — never booked. **Only real debts enter the pool** (needs its own round / conditional / needs design). Triage aged pool entries before disposals: landed ⇒ retro-close; premise gone / duplicate ⇒ withdraw.
 - **Drain first (auto mode)**: while subagents are in flight, **clear your own queue in parallel** (verification / closure / settlement / mechanical corrections) — "waiting" **only holds for real dependencies**; parking doable work on "waiting" ⇒ violation.
-- **Re-check deferred batches first**: at engineering-session start / on a condition-referenced event (a report / delivery filed, a batch closeout, a user ruling), run the deferral scan — each deferred batch against its resume condition: satisfied ⇒ resume; object gone ⇒ close out or withdraw.
+- **Re-check deferred batches first**: at engineering-session start / on a condition-referenced event (a report / delivery filed, a batch closeout, a user ruling), run the deferral scan — each deferred batch against its resume condition: satisfied ⇒ resume; object gone ⇒ close out or withdraw; **frozen-record residue scan** — §6 unresolved items in frozen records not yet landed as ledger rows ⇒ book them on the spot.
+- **Opening self-check**: at each session open (on the same beat as the deferred-batch re-check) self-check the pool surface — the unsettled count ∥ actionable items ∥ the top-N rows untouched for over 7 days (as triage input); rows over 30 days marked「老化」(aged). **Internal only — never re-broadcast** (no extra broadcast line; the user-visible surface stays zero-noise).
 - **Implementation-round role routing (judge the change face first)**: before dispatching an implementation round, **judge the change face first** — **product-code face** (source dirs — per project declaration) → **eng-coder**; **doc face** (`docs/**` requirement/design docs) → **eng-designer**; **engineering-tools face** (`scripts/**` · test dirs `test/**` / `tests/**` · `.thincoder/tmp/**` · CI) → **parent direct edit** (no spawn). Judgment lines: dispatching the doc face to eng-coder = violation (sole author of design/requirement docs is eng-designer); a dispatch that reflex-maps "design passed → implementation" to eng-coder without judging the face = violation.
 - **Light channel (detail-face ∥ convergence-face pens — hit one of the three ⇒ walk)**: before each pen, a one-line disclosure — **disclose-then-go** (minute-level direct edits — a user re-route takes effect immediately); fixed forms:
   - Light pen: "**This pen = light channel** (detail face ∥ convergence face · defect fix ∥ convergence face · performance observation) | change: __ | reach: __ | rollback = revertable"
   - Full-chain pen: "**This pen = full chain** (touching: __) | design → review → approval"
   The disclosure carries the **criterion half-sentence** (which of the three items ①②③ was hit ∥ annotation item · performance observation); **the user re-routes with one word** (light or full chain, either direction); crossing the boundary mid-pen ⇒ **stop and re-disclose** (no smuggling); **diagnostics/probes (zero-chain) produce no pen ∥ need no disclosure** — read-only + temp area, product face unchanged (touching the product face ⇒ judged by the three-item list + the one-sentence boundary).
   **Start-up booking**: at round open (before the first pen) create the round batch record + the round ledger row (the batch record first, then the row — the pointer must target an on-disk record; the row walks to 在途 — settlement blocked until the closeout = the hook) — the account precedes the pen; a pen without an account = not established.
+Light-channel code pens: with the round booked (batch record + 在途 row) on disk ⇒ direct edits pass; no round on disk ⇒ book first, then pen; refused ⇒ stop and report — never silently switch to the full chain.
+The round ledger row's title carries 「收尾链待跑」 — that marker is the code-pen gate credential (missing marker ⇒ code pens stay blocked).
   The round = one batch record: per-pen entries in §1 (disclosure · change · walkthrough · freeze; convergence-face pens also record the source and the red/green pair); ledger rows per pen as usual; **§5 = not applicable** (no eng-coder implementation segment — the implementation face = parent direct edits, recorded in §1).
 **Round boundary = closeout**: new pens before the closeout stay in the round; after the closeout, new pens start a new round and a new record.
   Closeout trigger = the user says "close out" ∥ reminder points (raised by you): a natural pause (the action chain has finished, no next action in flight) ∥ a topic change (the conversation drifts off-topic while unclosed — raise it before the drift) ∥ a closing signal (the user expresses a closing intent — intent is the test, not a word list); one sentence, no chasing (the user signals continue ⇒ ride along — the duty remains, raise it again at the next point); elements: round ∥ pen count ∥ steps owed ∥ one word runs it (reply "close out" ⇒ the full chain runs).
@@ -133,12 +138,13 @@ Every non-fix must carry a reason (a technical rebuttal with evidence, or an exp
   In engineering mode the spawn looks like: `subagent(role="eng-coder", designId=<id>, designToken=<token>, batchDoc=<batch record path>, task=...)`
   ——**`batchDoc` is mandatory** (the batch record path, e.g. `<repo>/docs/batches/<batch>-<topic>.md` — relative paths resolve against the session cwd first, then candidate project roots, or absolute; it IS the task book this spawn implements): **omitted = refused** — a mechanical gate, the criterion is only "param present + path readable", content is never validated.
   Do not implement sized batches yourself just because you can — the isolated context is what breaks the self-review blind spot.
+- **Task books are re-derived, never transcribed**: fill every acceptance line and known fact from THIS batch's own documents (batch record §2 / design doc); transcribing from a sibling batch's report or record is forbidden — transcription drags stale criteria and wrong wording across.
 - Every dispatch carries a task book with:
   **Goal & why**
   **Round** (initial / fix — fix rounds point-fix only, no full exploration)
   **Known facts** (paths you already explored — no re-exploration)
   **Design points & forbidden scope**
-    **Acceptance criteria** (machine-verifiable: commands, thresholds, assertion counts — no vague "do it well"); verification = **targeted unit tests for the changed face (single files) only** — never write suite-green-per-round clauses; the repo-suite run belongs to parent-side closeout
+    **Acceptance criteria** (machine-verifiable: commands, thresholds, assertion counts — no vague "do it well"); verification = **targeted unit tests for the changed face (single files) only** — never write all-green-per-round clauses; the integration-test run belongs to parent-side closeout
   **Delivery report format**.
   Sized dispatch without these fields is a defect — the coder would re-explore what you already know (async default — if your next step depends on the report, end the turn and let it arrive (or declare dependsOn); pass `files` for scheduler serialization).
 - **Dispatch size discipline (pre-flight · one dispatch, one change face)**: an implementation dispatch's `files` declaration is **≤15 files and must not span change faces** — **spanning faces ⇒ split the dispatch by face**.
@@ -160,17 +166,19 @@ The single-point pipeline's fixed cost is ~40 minutes — borne alone by one req
 1. **Pool routing** — ordinary requirement points register into the owning board's requirement doc + the project ledger (requirement-pool group — read/write via the `/ledger` query surface); design does not start until the user says start this batch (or marks it urgent — fast lane).
 2. **Threshold reminder** — same board ≥2 points or pool-wide ≥3: remind once that batch design can start — the user still fires the review and approval.
 3. **Fast lane** — the user saying urgent / do it now skips pooling: single point walks the full flow (design → review → implementation — no step cut). (Urgent points still register, marked urgent.)
-4. **Batch design**: land multiple requirement points at once → one review → user approval → batch implementation.
+4. **Batch design**: before batch ignition (before design starts), scan the ledger for related entries (same board / pool surface) — merge what can be merged (same migration window ∥ same review face ∥ same implementation face); for those not merged, write the reason (condition not met ∥ different face ∥ high risk — into batch record §1); land multiple requirement points at once → one review → user approval → batch implementation.
 5. **Boundary**: the pool takes only **user requirement points** — tech todos still go to the project tech-todo area — no mixing; urgent bugs go through the fast lane.
 
 **Lifecycle (event → action — act on the hit, don't wait for the user to push)**:
 1. **Batch ignition** ⇒ advance the state **待讨论 → 待设计 → 在途**, and write the `task_book` pointer (the batch-record path — the write gate checks that the target file exists).
 2. **Implementation verification passed** ⇒ **在途 → 待核销 → 已核销** (two-step migration; `ledger` (action=close) closes from 待核销 (settlement) or 待讨论 / 待设计 (retro-close — `evidence` required); 在途 never skips 待核销); write the **settlement basis** back into `evidence` (landing coordinates / commit id / batch-record section).
-3. **Batch closeout** ⇒ **settlement cross-check**: verify entries settled, pointers resolve; **prior-batch leftovers** (entry done, anchor batch record unclosed) ⇒ the **fallback settlement path**; **deferred-batch re-check** — run the deferral scan against resume conditions; none ⇒「暂缓批复核：无」in §6.
+3. **Batch closeout** ⇒ **settlement cross-check**: verify entries settled, pointers resolve; **prior-batch leftovers** (entry done, anchor batch record unclosed) ⇒ the **fallback settlement path**; **deferred-batch re-check** — run the deferral scan against resume conditions; none ⇒「暂缓批复核：无」in §6; **Settlement line** — **ensure the settlement line lands** (the settlement sync checklist's mechanical step) + **the settled count goes with the closeout** (reported together with it; never as a separate line).
 4. **New debt found** (review finding / stop-and-report output / doc drift) ⇒ **book it the same day** — a tech todo must carry `trigger` (**bare enum**: `归批` / `条件` / `认账不排期` — the batch name / condition sentence goes into `evidence`, **never into `trigger`**); never leave it in report prose, a code comment, or an 「登记」-shaped note.
 5. **Escalated item** (from a subagent / review / stop-and-report) ⇒ **rule on the spot** — correctable items **get fixed in the same round**; the rest **get booked the same day** (`trigger` + an **expiry condition** → `evidence`); **never leave it in report prose, a code comment, or a "pending-ruling" list only**.
 
 Requirement pool and tech todos share one iron law (pointer-ized, no task-detail expansion), but anchor differently: requirement pool anchors requirement-doc section + task book §2; tech todos anchor owning-doc section + minimal evidence line (file:line + symptom).
+**Dedupe on booking**: when registering, scan existing rows on the same face — the same item (same problem ∥ same work object — irrespective of the `kind` field) ⇒ **merge** (no second row) ∥ otherwise **note the relation** (cross-referencing rows) — upstream/downstream with the pre-ignition merge scan (the batch-design clause).
+**One row = one settlement unit**: a row = one independently closable item — split bundled items into rows (prevents the partial-settlement deadlock).
 
 **Tech-todo specific**: each entry carries **one trigger** — `trigger` (**bare enum**: `归批` (batched) / `条件` (conditional) / `认账不排期` (acknowledged, unscheduled) — the batch name / condition sentence goes into `evidence`, **never into `trigger`**);
   trigger-less entries go into the「待处置」(to-dispose) list, entries older than 30 days get marked「老化」(aging) — report is read-only, disposal is a human judgment (you and the user).

package/prompts/persona-normal.md

@@ -12,6 +12,7 @@ The human decides direction and makes the final call. You own the code — the e
 What you confirm is your contract.
 You are the lead engineer: you see the full picture, you coordinate complex work, and you are ultimately responsible for the result.
 When you delegate to subagents, hold them to the same bar: a subagent that takes shortcuts is your failure, not theirs.
+**Subagent ids carry their accounts in reports**: report subagent statuses as a table with a dedicated ledger column — form: `coder #3 | #938 · <topic> | <task detail> | <status>`; a bare serial number ⇒ violation (the user traces it without asking).
 
 ## 确认与批准门（写文件前先确认）
 - **Before writing files, restate your understanding of the task + the plan points, and wait for explicit user confirmation ("OK / sure / continue" type) before executing.**
@@ -31,6 +32,7 @@ When you delegate to subagents, hold them to the same bar: a subagent that takes
 - **Discipline**: one question at a time (the `question` tool's ONE-question rule) · never re-ask for scope already authorized · default first, never idle.
 
 ## Main-agent role — only the top-level agent has these capabilities. Subagents do not.
+**The management face is yours**: normal mode has no designer role — requirements integration ∥ design text ∥ closeout documentation normalization are your own work (the same standard as the engineering-mode designer), then an independent review; the batch record ∥ ledger ∥ closeout are all yours to write.
 Plan before building — for complex multi-step tasks, enter plan mode first.
 Explore the codebase read-only, design the architecture, present the plan. When approved, exit plan mode and implement.
 For tasks that match the Coding discipline's "complex" tier, plan mode is your design step; for "medium" tasks it's optional but recommended.

package/prompts/subagent-base.md

@@ -12,3 +12,6 @@ It is **not a confirmation gate** (it cannot approve anything, and it may be bus
 - **Decision-grade = four classes**: ① a stated premise the facts contradict; ② two requirements that conflict and you cannot arbitrate
   (two documents describing the same mechanism differently ⇒ **judged the same as a conflict**); ③ whether the action is inside your task domain; ④ a choice that would waste work already done.
 - **The conflict class must be sent, never deferred to the final report**: two requirements in conflict ⇒ send an `ask` at once — never settle it by picking a side, never keep weighing, never park it for the final report.
+- **Markers in your report**: items awaiting the parent's decision (including an ask left unanswered
+  when you finish) head with `[上抛·待裁]`; FYI items (including a note you sent up) — `[上抛·知会]`.
+  The engine marks the delivered message mechanically; in your report, the marker is yours to write.

package/provider/core.mjs

@@ -120,6 +120,11 @@ async function chatImpl(provider, { messages, tools, onToken, onReasoning, onWai
   // （CONFIG.md §6.3）。格式分派之前：四 transport ∕ 续写 ∕ advisor ∕ 子代理 ∕ 压缩同享；
   // 未设 ∕ 空串 ∕ 畸形 ⇒ 此处抛错（点名变量，无回退）。
   provider = resolveProviderSecrets(provider)
+  // #1063（PROVIDER.md §6.23）：缺钥前置守卫——trim 空 ⇒ 可读错误 + **零请求**（先于 rateGate ∥
+  // 全部 fetch）。单点覆盖四 transport（openai ∥ anthropic ∥ google ∥ responses）与续写 ∕ advisor ∕
+  // 子代理 ∕ consult 全链；四档凭据位不各自加守卫（避判据增殖）。
+  const apiKey = typeof provider?.apiKey === "string" ? provider.apiKey.trim() : ""
+  if (!apiKey) throw new Error(`API key missing for provider "${provider?.name ?? provider?.model ?? "unknown"}" — configure it in Settings (Providers) or ~/.thincoder/config.json`)
   // Sanitize BEFORE format dispatch — image poisoning bricks anthropic/google sessions
   // the same way it bricks OpenAI-format ones (all raster-only).
   // providerSpec: spec with the provider-level context override (PROVIDER.md §6.15) — the
@@ -356,6 +361,7 @@ function mergeRetryToolCalls(result, toolCalls) {
     }
     if (tc.id && !s.id) s.id = tc.id
     if (tc.name && !s.name) s.name = tc.name
+    if (tc.extra_content && !s.extra_content) s.extra_content = tc.extra_content // §6.24：签名合并保真（首见胜）
     s.arguments += tc.arguments ?? ""
   }
 }

package/provider/errors.mjs

@@ -88,15 +88,17 @@ export class ProviderError extends Error {
 }
 
 /**
- * F-1 (MODEL-400-FIX) 根因兜底——请求体组装前断言：渠道裸克隆（`{...渠道}`——渠道只带
- * 默认单值 `model`，克隆链未重派生 `.model` 时）provider.model 为 undefined/null——
+ * F-1 (MODEL-400-FIX) 根因兜底——请求体组装前断言：渠道裸克隆（`{...渠道}`——渠道条目不携
+ * 模型，克隆链未重派生 `.model` 时）provider.model 为 undefined/null——
  * JSON.stringify 会丢 undefined 键 → 无 model 请求 → serde 400。
  * fail-fast 报可读错误（带 provider 名 + 修复线索），不发病体。core.mjs chatImpl openai body 组装
  * 前调用（单行——core.mjs 500 行硬限）。
+ * 2026-10-09 清除批（R3）：指引收正——模型身份唯二 = 顶层 `defaultModel` 复合串 ∥ 会话槽选定
+ * （渠道单值模型退场，不再作指引）。
  */
 export function assertProviderModel(provider) {
   if (!provider.model) {
-    throw new ProviderError(provider, "model is undefined — provider cloned without model re-derivation (set providers[].model — the channel default model)")
+    throw new ProviderError(provider, "model is undefined — provider cloned without model re-derivation (set the default model (provider:model) or the session slot model)")
   }
 }
 

package/provider/google.mjs

@@ -193,13 +193,14 @@ async function parseGeminiStream(response, { onToken, onReasoning, signal }) {
         result.content += part.text
         onToken?.(part.text)
       } else if (part.functionCall) {
-        const existing = result.toolCalls.find((tc) => tc.name === part.functionCall.name)
-        if (!existing) {
-          result.toolCalls.push({
-            id: part.functionCall.name + "_" + result.toolCalls.length,
-            name: part.functionCall.name,
-            arguments: JSON.stringify(part.functionCall.args || {}),
-          })
+        let slot = result.toolCalls.find((tc) => tc.name === part.functionCall.name)
+        if (!slot) {
+          slot = { id: part.functionCall.name + "_" + result.toolCalls.length, name: part.functionCall.name, arguments: JSON.stringify(part.functionCall.args || {}) }
+          result.toolCalls.push(slot)
+        }
+        // §6.24 原生路签名捕获（字段名 `thoughtSignature`——官方口径 unverified；在场才建 ⇒ 字段名不符零副作用）
+        if (typeof part.thoughtSignature === "string" && part.thoughtSignature) {
+          slot.extra_content = { google: { thought_signature: part.thoughtSignature } }
         }
       }
     }
@@ -214,7 +215,7 @@ async function parseGeminiStream(response, { onToken, onReasoning, signal }) {
     if (idleTimer) clearTimeout(idleTimer)
     idleTimer = setTimeout(() => {
       // #878：断流单点分流——直连 fetch（web 流）走 `IDLE_ABORT` 内部 abort 通道；
-      // proxy 形回落 destroyBody（原契约）。相位串 = 本腿专属 google-sse-idle。
+      // proxy 形回落 destroyBody（原契约）。相位串 = 本分支专属 google-sse-idle。
       idleError = timeoutError(`SSE idle timeout: no data for ${READ_IDLE_MS / 1000}s`, "provider", "google-sse-idle")
       try { terminateBody(response, idleError) } catch { /* already gone */ }
     }, READ_IDLE_MS)

package/provider/list-models.mjs

@@ -21,7 +21,8 @@ const LIST_TIMEOUT_MS = 15_000
 const MAX_PAGES = 10
 const ANTHROPIC_VERSION = "2023-06-01"
 
-/** 单页 GET + JSON 解析（非 2xx → throw；非 JSON 响应 → throw——§2.5 #115 并入 VSC 明确报错）。 */
+/** 单页 GET + JSON 解析（非 2xx → throw；非 JSON 响应 → throw——§2.5 #115 并入 VSC 明确报错）。
+ *  载荷读取失败（断流 ∥ idle 超时 ∥ 网络）⇒ 原错误直抛（#1068——不吞根因；`non-JSON` 文案只给真非 JSON）。 */
 async function fetchJson(provider, url, headers, signal) {
   const opts = {
     headers,
@@ -36,7 +37,7 @@ async function fetchJson(provider, url, headers, signal) {
     e.status = response.status // 展示面可判「不可用」
     throw e
   }
-  const rawText = await response.text().catch(() => "")
+  const rawText = await response.text()
   try {
     return JSON.parse(rawText)
   } catch {

package/provider/sse.mjs

@@ -53,6 +53,9 @@ function mergeToolCalls(result, delta, { snapshot = false } = {}) {
       existed = !!slot
       if (!slot) { result.droppedToolCalls++; continue }
     }
+    // §6.24 思考签名捕获（Gemini）：白名单构造、在场才建 / 在场覆写（四条槽路径共经）
+    const sig = tc.extra_content?.google?.thought_signature
+    if (typeof sig === "string" && sig) slot.extra_content = { google: { thought_signature: sig } }
     if (tc.id && !slot.id) slot.id = tc.id
     if (tc.function?.name && !slot.name) slot.name = tc.function.name
     const arg = tc.function?.arguments

package/provider-flows.mjs

@@ -21,7 +21,7 @@
  * M9 语义定死：**准入永不阻断写** —— 探针只出读数 ∕ 失败消息（消息本体逐字长句），绝不抛出 ∕
  * 绝不回滚已完成的保存；失败不缓存（下次配置动作重探）。
  *
- * 消费面：桌面 `thincoder-desktop/src/main/providers.mjs`（四通道壳——判据面：`FORMATS` ∕
+ * 消费面：桌面 `thincoder-desktop/src/main/providers.mjs`（四通道壳——判据：`FORMATS` ∕
  * `customFieldsError` ∕ `probeAdmission`；端侧 reason 词法不动）；三流程本体 = 桌面 ∕ VSC（已随本批迁移改指）消费，CLI 待迁。
  */
 import { PROVIDER_PRESETS } from "./config-presets.mjs"
@@ -54,17 +54,16 @@ export function providerNameError(name, existing = new Set()) {
 }
 
 /**
- * 自定形必填字段校验（VSC `addProviderFlow` 自定径输入步步序 = baseURL → model → format；
- * name 步单列见 `providerNameError`）。三拒因串 = 核持久化面**同条件串**逐字（`config-io.mjs`
- * `addProviderEntry`）——VSC 该三步为静默中止位（无消息可搬）⇒ 取同条件核串，保「同条件同词」。
+ * 自定形必填字段校验（VSC `addProviderFlow` 自定径输入步步序 = baseURL → format；
+ * name 步单列见 `providerNameError`。2026-10-09 清除批：model 步退场——渠道不携模型）。
+ * 两拒因串 = 核持久化面**同条件串**逐字（`config-io.mjs`
+ * `addProviderEntry`）——VSC 该两步为静默中止位（无消息可搬）⇒ 取同条件核串，保「同条件同词」。
  * `format` 缺省 = `"openai"`（沿端侧形判同式）。
  * @returns {string|null} 首个失败字段的拒因串；全过 ⇒ `null`
  */
 export function customFieldsError(fields) {
   const baseURL = String(fields?.baseURL ?? "").trim()
   if (!baseURL) return "Base URL is required"
-  const model = String(fields?.model ?? "").trim()
-  if (!model) return "Model is required"
   const format = fields?.format ?? "openai"
   if (!FORMATS.includes(format)) return `Unknown API format: ${format} (expected ${FORMATS.join("/")})`
   return null
@@ -73,19 +72,21 @@ export function customFieldsError(fields) {
 /**
  * M9 探针目标构造（上提源 = VSC `provider-flows.mjs:38` 的实参面 `presets.mjs` `probeTargetFromEntry`——
  * 逐条随迁）：渠道条目 ⇒ `listModels` 可消费的探针目标。代理链与 chat 请求同规则（per-provider `proxy: true`
- * ∧ 全局 `proxy.model === true` ⇒ 探针也走该代理）；apiKey 归一（trim；缺 ⇒ 空串——探针会如实失败 ⇒
- * 渠道标「不可用」——准入判据 M8）。
+ * ∧ `proxy.uri` 在案 ⇒ 探针也走该代理；无全局闸——2026-10-08 批落）；apiKey 归一（trim；缺 ⇒ 空串——探针会
+ * 如实失败 ⇒ 渠道标「不可用」——准入判据 M8）。`headers` 字段面（#1048①）：仅 plain-object 才携；缺 ∥ 非法 ⇒
+ * 零键（同 apiKey 归一律）——来源面 = 盘上条目 ∥ 表单；消费点 = `list-models` 各 format 分支请求头展开。
  */
 export function probeTargetOf(entry) {
   const raw = loadRaw()
   const proxyCfg = normalizeProxy(raw.proxy)
-  const proxyUri = entry?.proxy === true && proxyCfg?.uri && proxyCfg.model === true ? proxyCfg.uri : undefined
+  const proxyUri = entry?.proxy === true && proxyCfg?.uri ? proxyCfg.uri : undefined
   return {
     name: entry?.name,
     baseURL: entry?.baseURL,
     apiKey: typeof entry?.apiKey === "string" ? entry.apiKey.trim() : "",
     format: entry?.format,
     proxyUri,
+    ...(entry?.headers && typeof entry.headers === "object" && !Array.isArray(entry.headers) ? { headers: entry.headers } : {}),
   }
 }
 
@@ -146,8 +147,8 @@ export async function addProviderFlow(ui, refresh, deps = {}) {
 
   const items = Object.entries(PROVIDER_PRESETS)
     .filter(([name]) => !existing.has(name))
-    .map(([name, p]) => ({ label: name, description: p.desc, detail: p.model ?? "", kind: "preset", name }))
-  items.push({ label: "Custom (manual config)", description: "enter baseURL/model/format", kind: "custom" })
+    .map(([name, p]) => ({ label: name, description: p.desc, detail: p.baseURL ?? "", kind: "preset", name }))
+  items.push({ label: "Custom (manual config)", description: "enter baseURL/format", kind: "custom" })
 
   const sel = await host.pick(items, {
     placeHolder: "Add provider — select a preset",
@@ -166,14 +167,12 @@ export async function addProviderFlow(ui, refresh, deps = {}) {
       placeHolder: "https://api.example.com/v1",
     }))?.trim()
     if (!baseURL) return
-    const model = (await host.input({ prompt: `Model name for ${name}` }))?.trim()
-    if (!model) return
     const format = await host.pick(
       FORMATS.map((f) => ({ label: f, description: f === "openai" ? "(default)" : f === "anthropic" ? "Messages API" : "streamGenerateContent" })),
       { placeHolder: "API format" },
     )
     if (!format) return
-    const err = addProviderEntry({ custom: { name, baseURL, model, format: format.label } })
+    const err = addProviderEntry({ custom: { name, baseURL, format: format.label } })
     if (err) { host.error(err); return }
     const key = await host.input({ prompt: `API key for ${name} (leave empty to skip)`, password: true })
     if (key?.trim()) {
@@ -213,7 +212,7 @@ export async function removeProviderFlow(ui, refresh) {
     return
   }
   const sel = await host.pick(
-    candidates.map((p) => ({ label: p.name, description: p.model ?? "" })),
+    candidates.map((p) => ({ label: p.name, description: p.baseURL ?? "" })),
     { placeHolder: "Remove provider" },
   )
   if (!sel) return

package/proxy-chunked.mjs

@@ -0,0 +1,102 @@
+/**
+ * proxy-chunked.mjs — HTTP/1.1 分块传输（`Transfer-Encoding: chunked`）流式剥帧器（#1065）。
+ *
+ * 单出 `createChunkedDecoder`（设计 = `docs/core/design/PROXY.md` §2 ∥ §7 D-PX11）：
+ * - **流式保形**：边收边吐、只保有帧头（块长行上限 1KiB）；块数据到达即吐 `min(可用, 待吐)`；
+ * - 块长 = 十六进制（行长 ≤1KiB、数值须安全整数——越界判畸形）+ 可选 `;扩展`（扩展忽略）；块尾须恰为 CRLF；`0` 块 ⇒ `onEnd`
+ *   （其后 trailer ∥ 余字节读取即弃——`Connection: close` 语义下无复用面）；
+ * - **畸形帧回退 = 透传**：已持有字节原样吐出 + 其后全部字节直通——不报错（不把协议违规
+ *   升级成连接失败）、不截断（零静默丢数据）；
+ * - 纯状态机、无自有 `'error'` 面（#16 契约零变——body 终止守卫族照旧对 body 单点直作）。
+ * 零依赖：Node built-ins only。
+ */
+
+/** 块长行上限（超限判畸形——防无界持有帧头）。 */
+const MAX_SIZE_LINE = 1024
+const CRLF = Buffer.from("\r\n")
+const EMPTY = Buffer.alloc(0)
+
+/** 十六进制字节判定（0-9 ∥ a-f ∥ A-F——大小写不敏感）。 */
+const isHexByte = (b) => (b >= 0x30 && b <= 0x39) || (b >= 0x61 && b <= 0x66) || (b >= 0x41 && b <= 0x46)
+
+/**
+ * 建流式分块解码器（消费单点 = `proxy-transport.mjs` `streamHttpResponse` chunked 径）。
+ * @param {{ onData?: (chunk: Buffer) => void, onEnd?: () => void }} [handlers]
+ *   `onData` 逐段收解码后的块数据（任意分包边界）；`onEnd` 于 `0` 块到达时触发一次。
+ * @returns {{ push: (buf: Buffer) => void, mode: "chunked" | "raw" | "done" }}
+ *   `push` 喂入原始字节；`mode` = `chunked`（解码中）∥ `raw`（畸形回退透传）∥
+ *   `done`（`0` 块已终，其后字节读取即弃）——供测试与诊断。
+ */
+export function createChunkedDecoder({ onData, onEnd } = {}) {
+  let state = "size" // size → data → crlf → size …
+  let mode = "chunked"
+  let buf = EMPTY // 未消费字节（只保有帧头——块数据即到即吐）
+  let need = 0 // data 阶段待吐字节数
+
+  const emit = (chunk) => { if (chunk.length > 0) onData?.(chunk) }
+  /** 畸形回退：已持有字节原样吐出，此后全量直通（不再解析）。 */
+  const fallback = () => {
+    mode = "raw"
+    const held = buf
+    buf = EMPTY
+    emit(held)
+  }
+  /** `0` 块终：body 随 0 块结束。 */
+  const finish = () => { mode = "done"; buf = EMPTY; onEnd?.() }
+
+  /** 帧推进：逐状态消费 buf；块数据即吐（只保有帧头）。 */
+  function step() {
+    for (;;) {
+      if (state === "size") {
+        const idx = buf.indexOf(CRLF)
+        if (idx < 0) {
+          // 未成行：首字节非十六进制 ∥ 超限 ⇒ 畸形；否则等下一包
+          if (buf.length > 0 && !isHexByte(buf[0])) return fallback()
+          if (buf.length > MAX_SIZE_LINE) return fallback()
+          return
+        }
+        const line = buf.subarray(0, idx)
+        const semi = line.indexOf(0x3b) // ";"——块扩展起点（忽略）
+        const hex = semi < 0 ? line : line.subarray(0, semi)
+        // 畸形行（超限 ∥ 空 ∥ 非十六进制）⇒ 整段原样吐出（行 ∥ CRLF 零丢弃——不截断）；行有效才消费
+        if (idx > MAX_SIZE_LINE || hex.length === 0) return fallback()
+        for (const b of hex) if (!isHexByte(b)) return fallback()
+        const size = Number.parseInt(hex.toString("latin1"), 16)
+        if (!Number.isSafeInteger(size)) return fallback() // 数值越界（>2^53——double 溢出可为 Infinity）⇒ 归畸形
+        buf = buf.subarray(idx + 2)
+        if (size === 0) return finish()
+        need = size
+        state = "data"
+        continue
+      }
+      if (state === "data") {
+        if (buf.length === 0) return
+        const take = Math.min(buf.length, need)
+        emit(buf.subarray(0, take))
+        buf = buf.subarray(take)
+        need -= take
+        if (need > 0) return
+        state = "crlf"
+        continue
+      }
+      // state === "crlf"：块尾须恰为 CRLF
+      if (buf.length < 2) {
+        if (buf.length === 1 && buf[0] !== 0x0d) return fallback()
+        return
+      }
+      if (buf[0] !== 0x0d || buf[1] !== 0x0a) return fallback()
+      buf = buf.subarray(2)
+      state = "size"
+    }
+  }
+
+  return {
+    push(d) {
+      if (mode === "done") return // 0 块后余字节（trailer 等）读取即弃
+      if (mode === "raw") { emit(d); return }
+      buf = buf.length > 0 ? Buffer.concat([buf, d]) : d
+      step()
+    },
+    get mode() { return mode },
+  }
+}

package/proxy-target.mjs

@@ -0,0 +1,54 @@
+/**
+ * proxy-target.mjs — 代理目标 ∥ 配置解析面（2026-10-08 拆档——原 `proxy.mjs` 迁出；#1037）。
+ * 逐渠判定 = 渠道旗 `providers[].proxy` ∧ `proxy.uri` 在案（无全局闸——D-PX1，2026-10-08 批落）。
+ * 零依赖：Node built-ins only（net, url）。
+ */
+import { isIP } from "node:net"
+import { URL } from "node:url"
+
+/**
+ * Resolve proxy URI.
+ * New format: { proxy: { uri: "http://host:port", web: true } }
+ * Old format: { proxy: "http://host:port" } — backwards compatible, web=true
+ * Env vars: HTTPS_PROXY, HTTP_PROXY, ALL_PROXY
+ *
+ * @returns {{ uri: string|null, web: boolean }}
+ */
+export function resolveProxyConfig(ctx) {
+  const cfgProxy = ctx?.agent?.config?.proxy
+  if (!cfgProxy) {
+    const uri = process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY || null
+    return { uri, web: !!uri }
+  }
+  if (typeof cfgProxy === "string") {
+    // Backward compat: bare string → web only
+    return { uri: cfgProxy, web: true }
+  }
+  return {
+    uri: cfgProxy.uri || cfgProxy.url || null,
+    web: cfgProxy.web !== false,
+  }
+}
+
+/** Convenience: resolve proxy URI for web tools (websearch/fetch) */
+export function resolveWebProxy(ctx) {
+  const cfg = resolveProxyConfig(ctx)
+  return (cfg.uri && cfg.web) ? cfg.uri : null
+}
+
+/**
+ * Loopback 目标判定（NO_PROXY 语义——#1026，2026-10-07 用户案）：
+ * `localhost` ∥ `*.localhost`（RFC 6761）∥ `127.0.0.0/8` ∥ `::1` —— 此类目标永不经代理。
+ * 解析失败 ⇒ false（未知串不宣称 loopback）；尾点（`localhost.`）先归一。
+ */
+export function isLoopbackTarget(urlStr) {
+  let host
+  try { host = new URL(urlStr).hostname } catch { return false }
+  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1) // IPv6 带括号（URL.hostname 规范形）
+  if (host.endsWith(".")) host = host.slice(0, -1)
+  if (host === "localhost" || host.endsWith(".localhost")) return true
+  const v = isIP(host)
+  if (v === 4) return host.split(".")[0] === "127"
+  if (v === 6) return host === "::1"
+  return false
+}