@thincoder/core 0.10.4 → 0.10.5

package/config-presets.mjs

@@ -8,52 +8,56 @@
  *  - `presetToEntry` = 取 VSC 侧独有导出（CLI 侧对应实现在
  *    `cli/setup-wizard.mjs`，同字节语义）。
  *
- * 预先声明（MODEL-SELECTION v2，2026-09-10）：每个预设恰好携带一个默认模型（`model` ——
- * 新装启动种子 / 槽位空兜底；候选清单字段不再预置——运行期从 provider 拉取）。
+ * 预先声明（2026-10-09 清除批：渠道单值 `model` 退场——PROVIDER.md §6.16 M3）：预置**不携带**
+ * 默认模型（新装种子 = 零播种）；模型身份唯二 = 顶层 `defaultModel` 复合串 ∥ 会话槽选定；
+ * 候选清单字段亦不预置——运行期从 provider 拉取（`GET /models`）。
  */
 
 /** Built-in provider presets: shared by /provider add <preset> and first-run wizard. */
 export const PROVIDER_PRESETS = {
-  deepseek: { baseURL: "https://api.deepseek.com", model: "deepseek-flash", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 384_000, desc: "DeepSeek" },
-  kimi:     { baseURL: "https://api.moonshot.cn/v1", model: "kimi-k3", thinking: null, reasoningEffort: "max", maxTokens: 131072, desc: "Kimi / Moonshot" },
-  "kimi-code": { baseURL: "https://api.kimi.com/coding/v1", model: "k3", thinking: null, reasoningEffort: "max", maxTokens: 131072, desc: "Kimi For Coding (platform.kimi.com — sk-kimi- keys; NOT interchangeable with Moonshot)" },
-  glm:      { baseURL: "https://open.bigmodel.cn/api/paas/v4", model: "glm-5.2", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 128000, desc: "Zhipu GLM" },
-  "glm-code": { baseURL: "https://open.bigmodel.cn/api/coding/paas/v4", model: "glm-5.2", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 128000, desc: "Zhipu GLM Coding Plan (coding endpoint — same key as GLM; server-forced thinking)" },
-  qwen:     { baseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1", model: "qwen3.7-max", reasoningEffort: "high", maxTokens: 131072, desc: "Qwen / Alibaba" },
-  qwenplan: { baseURL: "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1", model: "qwen3.7-max", reasoningEffort: "high", maxTokens: 131072, desc: "Qwen Token Plan (百炼套餐)" },
-  mimo:     { baseURL: "https://api.xiaomimimo.com/v1", model: "mimo-v2.6-pro", thinking: { type: "enabled" }, maxTokens: 131072, desc: "MiMo (Xiaomi)" },
-  mimoplan: { baseURL: "https://token-plan-cn.xiaomimimo.com/v1", model: "mimo-v2.6-pro", thinking: { type: "enabled" }, maxTokens: 131072, desc: "MiMo Token Plan (小米套餐 — tp- keys; 与按量付费 sk- 密钥不通用)" },
-  minimax:  { baseURL: "https://api.minimaxi.com/v1", model: "MiniMax-M3", thinking: { type: "adaptive" }, maxTokens: 128000, chatPath: "/text/chatcompletion_v2", desc: "MiniMax" },
-  openai:   { baseURL: "https://api.openai.com/v1", model: "gpt-4o", desc: "OpenAI" },
-  claude:   { baseURL: "https://api.anthropic.com/v1", model: "claude-sonnet-4", format: "anthropic", maxTokens: 8192, desc: "Claude (Anthropic)" },
-  gemini:   { baseURL: "https://generativelanguage.googleapis.com/v1beta", model: "gemini-2.5-flash", format: "google", maxTokens: 8192, desc: "Gemini (Google)" },
-  grok:     { baseURL: "https://api.x.ai/v1", model: "grok-4.5", maxTokens: 64_000, desc: "Grok (xAI)" },
-  mistral:  { baseURL: "https://api.mistral.ai/v1", model: "mistral-large", maxTokens: 32_000, desc: "Mistral" },
-  volcengine: { baseURL: "https://ark.cn-beijing.volces.com/api/v3", model: "doubao-seed-2-0-code-preview-260215", maxTokens: 131072, desc: "Volcengine Ark (豆包)" },
-  hunyuan:  { baseURL: "https://api.hunyuan.cloud.tencent.com/v1", model: "hunyuan-pro", maxTokens: 32_000, desc: "Hunyuan (腾讯混元)" },
+  deepseek: { baseURL: "https://api.deepseek.com", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 384_000, desc: "DeepSeek" },
+  kimi:     { baseURL: "https://api.moonshot.cn/v1", thinking: null, reasoningEffort: "max", maxTokens: 131072, desc: "Kimi / Moonshot" },
+  "kimi-code": { baseURL: "https://api.kimi.com/coding/v1", thinking: null, reasoningEffort: "max", maxTokens: 131072, desc: "Kimi For Coding (platform.kimi.com — sk-kimi- keys; NOT interchangeable with Moonshot)" },
+  glm:      { baseURL: "https://open.bigmodel.cn/api/paas/v4", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 128000, desc: "Zhipu GLM" },
+  "glm-code": { baseURL: "https://open.bigmodel.cn/api/coding/paas/v4", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 128000, desc: "Zhipu GLM Coding Plan (coding endpoint — same key as GLM; server-forced thinking)" },
+  qwen:     { baseURL: "https://dashscope.aliyuncs.com/compatible-mode/v1", reasoningEffort: "high", maxTokens: 131072, desc: "Qwen / Alibaba" },
+  qwenplan: { baseURL: "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1", reasoningEffort: "high", maxTokens: 131072, desc: "Qwen Token Plan (百炼套餐)" },
+  mimo:     { baseURL: "https://api.xiaomimimo.com/v1", thinking: { type: "enabled" }, maxTokens: 131072, desc: "MiMo (Xiaomi)" },
+  mimoplan: { baseURL: "https://token-plan-cn.xiaomimimo.com/v1", thinking: { type: "enabled" }, maxTokens: 131072, desc: "MiMo Token Plan (小米套餐 — tp- keys; 与按量付费 sk- 密钥不通用)" },
+  minimax:  { baseURL: "https://api.minimaxi.com/v1", thinking: { type: "adaptive" }, maxTokens: 128000, chatPath: "/text/chatcompletion_v2", desc: "MiniMax" },
+  openai:   { baseURL: "https://api.openai.com/v1", desc: "OpenAI" },
+  claude:   { baseURL: "https://api.anthropic.com/v1", format: "anthropic", maxTokens: 8192, desc: "Claude (Anthropic)" },
+  gemini:   { baseURL: "https://generativelanguage.googleapis.com/v1beta", format: "google", maxTokens: 8192, desc: "Gemini (Google)" },
+  // Gemini OpenAI 兼容端点（Google 官方——2026-10-09 server 预设批 · 台账 #1128）：与 `gemini`（原生
+  // `format:"google"`）同 key、两形态并存——本键 = OpenAI `/chat/completions` 侧（PROVIDER.md §6.11）。
+  // **待验（无 key——未实拉 `/models`；接入后按实拉复核）**；`thinking` / `reasoningEffort` / `maxTokens` 不设 = 不发（载荷面未测——D-13）。
+  "gemini-openai": { baseURL: "https://generativelanguage.googleapis.com/v1beta/openai", desc: "Gemini (Google) — OpenAI-compatible side (same key as gemini)" },
+  grok:     { baseURL: "https://api.x.ai/v1", maxTokens: 64_000, desc: "Grok (xAI)" },
+  mistral:  { baseURL: "https://api.mistral.ai/v1", maxTokens: 32_000, desc: "Mistral" },
+  volcengine: { baseURL: "https://ark.cn-beijing.volces.com/api/v3", maxTokens: 131072, desc: "Volcengine Ark (豆包)" },
+  hunyuan:  { baseURL: "https://api.hunyuan.cloud.tencent.com/v1", maxTokens: 32_000, desc: "Hunyuan (腾讯混元)" },
   // TokenHub = Tencent MaaS 聚合网关（另一主机；`hy3` 在本规格表有行）。`thinking` / `reasoningEffort` /
   // `maxTokens` 一律**不设 = 不发**（两新渠道的 thinking 载荷与 max_tokens 行为未测 —— MODEL-SPECS §9.6 D-13）。
-  tokenhub: { baseURL: "https://tokenhub.tencentmaas.com/v1", model: "hy3", desc: "Tencent TokenHub (腾讯混元网关)" },
+  tokenhub: { baseURL: "https://tokenhub.tencentmaas.com/v1", desc: "Tencent TokenHub (腾讯混元网关)" },
   // Huawei Cloud MaaS（ModelArts Studio）——OpenAI 兼容 `…/openai/v1`（区域端点变体走自定义渠道
-  // 自助路径——PROVIDER.md §6.21）。默认模型 `glm-5.3` = 官方口径（MaaS 最佳实践 ∕ 快速体验页的
-  // QS 示例模型 · 官方 API 样例 `model` 逐字）· **待验（无 key——未实拉 /models；接入后按实拉取值复核）**；
+  // 自助路径——PROVIDER.md §6.21）。**待验（无 key——未实拉 /models；接入后按实拉取值复核）**；
   // `thinking` / `reasoningEffort` / `maxTokens` 不设 = 不发（载荷面未测——D-13）。
-  huawei: { baseURL: "https://api.modelarts-maas.com/openai/v1", model: "glm-5.3", desc: "Huawei Cloud ModelArts Studio (华为云 MaaS)" },
-  siliconflow: { baseURL: "https://api.siliconflow.cn/v1", model: "deepseek-ai/DeepSeek-V3", maxTokens: 32_000, desc: "SiliconFlow (硅基流动)" },
-  openrouter: { baseURL: "https://openrouter.ai/api/v1", model: "anthropic/claude-sonnet-4", maxTokens: 32_000, desc: "OpenRouter" },
-  groq:     { baseURL: "https://api.groq.com/openai/v1", model: "llama-3.3-70b-versatile", maxTokens: 32_000, desc: "Groq" },
+  huawei: { baseURL: "https://api.modelarts-maas.com/openai/v1", desc: "Huawei Cloud ModelArts Studio (华为云 MaaS)" },
+  siliconflow: { baseURL: "https://api.siliconflow.cn/v1", maxTokens: 32_000, desc: "SiliconFlow (硅基流动)" },
+  openrouter: { baseURL: "https://openrouter.ai/api/v1", maxTokens: 32_000, desc: "OpenRouter" },
+  groq:     { baseURL: "https://api.groq.com/openai/v1", maxTokens: 32_000, desc: "Groq" },
   // OpenCode Go 订阅网关（opencode.ai/zen 取 sk- key ∥ 无 OAuth）——官方档（go.mdx）双协议混装 ⇒ 拆双预设
   // （PROVIDER.md §6.11）：本键 = OpenAI 兼容 `/chat/completions` 侧；`opencode-go-anthropic` = Anthropic
   // `/messages` 侧（同 key——模型按侧选）。字段集 = 最小面：`thinking` / `reasoningEffort` 不设 = 不发
   // （D-13 同口径）；`maxTokens` 仅 anthropic 侧设 `65536`（该 transport `max_tokens` 必发——不设即落规格
   // 行值 131072，超渠道口径）。**待验（无 key——未实拉 `/models` ∕ 载荷未实测；接入后按实拉复核）**；
   // `x-opencode-session` 头 = 可选遥测——**不发**（亦不动 `providers[].headers` 面）。
-  "opencode-go": { baseURL: "https://opencode.ai/zen/go/v1", model: "glm-5.2", desc: "OpenCode Go subscription (sk- key from opencode.ai/zen; OpenAI-compatible models — MiniMax/Qwen via opencode-go-anthropic)" },
-  "opencode-go-anthropic": { baseURL: "https://opencode.ai/zen/go/v1", model: "qwen3.7-max", format: "anthropic", maxTokens: 65536, desc: "OpenCode Go — Anthropic Messages side (same sk- key as opencode-go; MiniMax/Qwen models)" },
+  "opencode-go": { baseURL: "https://opencode.ai/zen/go/v1", desc: "OpenCode Go subscription (sk- key from opencode.ai/zen; OpenAI-compatible models — MiniMax/Qwen via opencode-go-anthropic)" },
+  "opencode-go-anthropic": { baseURL: "https://opencode.ai/zen/go/v1", format: "anthropic", maxTokens: 65536, desc: "OpenCode Go — Anthropic Messages side (same sk- key as opencode-go; MiniMax/Qwen models)" },
 }
 
 /** Build the stored provider entry from a preset — strip the display field, keep the rest
- *  （含单值 `model`——候选清单不再由预设播种）。 */
+ *  （2026-10-09 清除批：不产 `model` 键——渠道不携模型；候选清单不再由预设播种）。 */
 export function presetToEntry(name) {
   const preset = PROVIDER_PRESETS[name]
   if (!preset) return null

package/config.mjs

@@ -1,9 +1,9 @@
 /**
  * config.mjs — configuration loading and saving
- * Model-merge schema v2 (2026-09-10 MODEL-SELECTION): providers[] carry ONE default model
- * per channel (`providers[].model` — the new-install seed / empty-slot fallback); the
- * candidates list field models[] is gone — the available-model list is fetched from the
- * provider at runtime (`GET /models`, PROVIDER.md §16). config.defaultModel (top level,
+ * Model-merge schema v2 (2026-09-10 MODEL-SELECTION; 2026-10-09 清除批：渠道单值模型退场):
+ * providers[] carry NO channel default model (`providers[].model` retired — 渠道不是模型选择
+ * 单位); the candidates list field models[] is gone — the available-model list is fetched from
+ * the provider at runtime (`GET /models`, PROVIDER.md §16). config.defaultModel (top level,
  * "provider:model" composite) is the new-session starting point; activeProvider/activeModel
  * are gone from config (session slots keep their own double fields). Legacy fields migrate
  * on load (write-back failure never blocks startup).
@@ -35,7 +35,7 @@ export const DEFAULTS = {
   agent: {
     maxTurns: 200,
     subagentTurns: 100,
-    subagentModel: null,  // default subagent model: "provider:model" | provider name | model name (parent provider); null = inherit parent provider
+    subagentModel: null,  // default subagent model: "provider:model" | model name (parent provider); null = inherit parent provider
     subagentModels: {},   // per-type override: { explore, plan, coder, "eng-coder" } — priority: subagent tool model arg > this[role] > subagentModel > parent provider
     goalTurns: 200,
     compactThreshold: 100000,
@@ -69,6 +69,8 @@ export const DEFAULTS = {
     dbPath: join(configDir, "memory.db"),
     projectDir: ".thincoder/memory",
     team: null,
+    // 索引自维护（§6.14 面⑤ · 台账 #1096）：维护型备份保留枚数（轮转保最新 N——引擎钳 ≥ 1）
+    maintain: { backupKeep: 2 },
   },
   shell: null,            // bash tool shell executable (e.g. "C:\\Program Files\\Git\\bin\\bash.exe" or "pwsh"); null = system default (cmd on Windows, /bin/sh elsewhere)
   embedding: {
@@ -82,11 +84,14 @@ export const DEFAULTS = {
     // Structured search via Tavily when a key is set — empty apiKey → Bing RSS/HTML fallback (zero-config).
     apiKey: "",          // Tavily key (tvly-...) — optional
   },
+  // 浏览器工具（BROWSER-TOOL.md §3.2）：非空 ⇒ navigate 目标 host ∥ click/evaluate/type 的当前页 host 须命中
+  //（全等（大小写不敏感）∥ `*.` 前缀 = 子域通配）——收束面非沙箱；缺省空 = 不设限。
+  browser: { allowDomains: [] },
   traces: {
     enabled: false,  // §18.6 D-TR6 修订（2026-09-05 用户裁定——发布隐私："不希望用户那边也采集"）：轨迹存档默认 OFF——新用户零采集；本地调试分析可显式开（~/.thincoder/config.json traces.enabled:true）
     retentionHours: 24, // D-TR10：轨迹文件保留小时数——CLI 启动时删除超过该时长的文件（默认 24h）
   },
-  // 诊断开关（用户面 ① 配置键——CONFIG.md §6.2 名录）：`heapWatch` 默认开（设 false 关闭）——自愈臂
+  // 诊断开关（用户面 ① 配置键——CONFIG.md §6.2 名录）：`heapWatch` 默认开（设 false 关闭）——自愈分支
   // 遥测；`heapSnapshot` 默认关——采集 opt-in（堆转储敏感度 ≥ traces ⇒ 对齐发布隐私先例 D-TR6；
   // 2026-09-30 采集收网批；桌面端运行期热读 ∥ CLI 本进程下次启动）
   diagnostics: { heapWatch: true, heapSnapshot: false },
@@ -99,11 +104,34 @@ import { specForModel, providerSpec, specMatch, assistantToolCallMessage } from
 export { specForModel, providerSpec, specMatch, assistantToolCallMessage }
 
 
-// Window utilization threshold: compacts at 60% context, reserving 40% headroom
-// for injected context (directory tree, git context, outline, project instructions,
-// memory/doc search results) which can consume 30-50K tokens each turn.
+// Window utilization threshold: compacts at 60% of the USABLE window (window − output
+// reservation — providers require input + max_tokens ≤ window; 2026-10-06 user ruling:
+// the reservation folds into the budget so compaction fires first, never a provider
+// rejection), the remaining 40% stays as headroom for injected context (directory tree,
+// git context, outline, project instructions, memory/doc search results — 30-50K tokens
+// per turn).
 const COMPACT_RATIO = 0.6
 
+/** Output reservation the request counts against the window: explicit `provider.maxTokens`
+ *  (the value actually sent — `provider/core.mjs`) when set, else the spec `maxOutput`, else 0. */
+export function outputReserve(provider, spec) {
+  const explicit = provider?.maxTokens
+  if (Number.isFinite(explicit) && explicit > 0) return explicit
+  return spec?.maxOutput ?? 0
+}
+
+/** Usable input window = window − output reservation. Degenerate guard: a reservation
+ *  ≥ the window is non-physical (no input could ever fit — e.g. the doubao spec
+ *  `maxOutput` 524_288 > `context` 256_000 ∥ the test harness's 1K window vs the default
+ *  spec); collapsing the budget to 0 would be instant `context_limit` death — the very
+ *  failure the reservation fold exists to prevent. Fall back to half the window.
+ *  (2026-10-06——收口核验捕获：advisor-loop-split B5a 红。） */
+export function usableWindow(context, reserve) {
+  const ctx = context ?? 0
+  const usable = ctx - reserve
+  return usable > 0 ? usable : Math.floor(ctx / 2)
+}
+
 /** Derive compaction threshold; explicit is the value explicitly set in config file (takes priority), otherwise auto-computed from model.
  *  Second param accepts EITHER a model name string (pure spec lookup — legacy caller:
  *  first-run wizard) OR a provider object (providerSpec — the providers[].context
@@ -112,7 +140,8 @@ export function resolveCompactThreshold(explicit, modelOrProvider) {
   if (explicit != null) return { value: explicit, auto: false }
   const provider = typeof modelOrProvider === "string" ? { model: modelOrProvider } : (modelOrProvider ?? {})
   const spec = providerSpec(provider)
-  const value = Math.floor(spec.context * COMPACT_RATIO)
+  const usable = usableWindow(spec.context, outputReserve(provider, spec))
+  const value = Math.floor(usable * COMPACT_RATIO)
   return { value, auto: true }
 }
 
@@ -191,7 +220,7 @@ function warnConsultModelsFiltered(dropped, path) {
 /** #861（AGENT-LOOP-SUBAGENT.md §6.7.1）：subagent 模型覆盖加载期清洗——单源纯函数（核 loadConfig ∥ VSC 端壳 raw 读点同消费）；非法形态不 throw（`subagentModel` 非法 ⇒ null、`subagentModels` 非对象 ⇒ {}、值非法 ⇒ 剔除该键）。 */
 export function sanitizeSubagentModel(v) {
   const ok = typeof v === "string" && v.trim()
-  const dropped = ok || v == null ? [] : [`agent.subagentModel must be a non-empty string ("provider:model" | provider | model) — got ${Array.isArray(v) ? "array" : typeof v} — ignored (inherits the parent provider)`]
+  const dropped = ok || v == null ? [] : [`agent.subagentModel must be a non-empty string ("provider:model" | model) — got ${Array.isArray(v) ? "array" : typeof v} — ignored (inherits the parent provider)`]
   return { value: ok ? v : null, dropped }
 }
 export function sanitizeSubagentModels(v) {
@@ -200,7 +229,7 @@ export function sanitizeSubagentModels(v) {
   const value = {}, dropped = []
   for (const [role, val] of Object.entries(v)) {
     if (typeof val === "string" && val.trim()) { value[role] = val; continue }
-    dropped.push(`agent.subagentModels.${role} must be a non-empty string ("provider:model" | provider | model) — got ${Array.isArray(val) ? "array" : typeof val} — dropped`)
+    dropped.push(`agent.subagentModels.${role} must be a non-empty string ("provider:model" | model) — got ${Array.isArray(val) ? "array" : typeof val} — dropped`)
   }
   return { value, dropped }
 }
@@ -210,12 +239,12 @@ function warnSubagentModelsFiltered(dropped, path) {
   if (warnedSubagentModels || dropped.length === 0) return
   warnedSubagentModels = true
   console.warn(`[config] agent.subagentModel/subagentModels: ${dropped.length} invalid entr${dropped.length === 1 ? "y ignored" : "ies ignored"} (filtered — startup continues; no crash):\n` +
-    `${dropped.map((d) => `  - ${d}`).join("\n")}\n  Fix: clean it in ${path} — "provider:model" | provider | model.`)
+    `${dropped.map((d) => `  - ${d}`).join("\n")}\n  Fix: clean it in ${path} — "provider:model" | model.`)
 }
 
 /**
  * Find provider by name in providers[].
- * Throws if name is non-empty but not found — a typo in activeProvider silently falling to the first provider would use the wrong key on the wrong endpoint.
+ * Throws if name is non-empty but not found — a typo in the caller-supplied name (e.g. `defaultModel`) silently falling to the first provider would use the wrong key on the wrong endpoint.
  * Returns the first provider when name is empty.
  */
 export function findProvider(providers, name) {
@@ -223,24 +252,35 @@ export function findProvider(providers, name) {
     const found = providers.find((p) => p.name === name)
     if (found) return found
     const available = providers.map((p) => p.name).join(", ") || "(empty)"
-    throw new Error(`activeProvider "${name}" not in providers list (available: ${available}); check for a typo in: ${configPath}`)
+    throw new Error(`provider "${name}" not in providers list (available: ${available}); check for a typo in: ${configPath}`)
   }
-  return providers[0] ?? { name: "default", baseURL: "", model: "" }
+  return providers[0] ?? { name: "default", baseURL: "" }
 }
 
-/** Normalize proxy config to { uri, web, model } or undefined (uri/url both accepted; invalid types dropped) */
+/** Normalize proxy config to { uri, web } or undefined (uri/url both accepted; invalid types dropped) */
 export function normalizeProxy(proxy) {
-  if (typeof proxy === "string") return proxy ? { uri: proxy, web: true, model: false } : undefined
+  if (typeof proxy === "string") return proxy ? { uri: proxy, web: true } : undefined
   if (!proxy || typeof proxy !== "object" || Array.isArray(proxy)) return undefined
   const uri = proxy.uri || proxy.url || ""
   if (typeof uri !== "string" || !uri) return undefined
-  return { uri, web: proxy.web !== false, model: proxy.model === true }
+  return { uri, web: proxy.web !== false }
+}
+
+/** 团队登录段加载归一（B1 批——`docs/core/design/TEAM.md` §2.1 ∥ CONFIG.md §6.4）：非对象 ⇒ null（软失败
+ *  不阻启动——沿 proxy 段先例）；键级 = trim 非空字符串（非串 ∥ 空 ⇒ null）；`member` 浅形 `{ username, name }`。
+ *  **不入 `DEFAULTS`**（settings 工具面零涉——agent 不可写；`team.token` 经读面到达 = 敏感段词表遮罩）。 */
+export function normalizeTeamSection(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null
+  const str = (v) => (typeof v === "string" && v.trim() !== "" ? v.trim() : null)
+  const raw = value.member
+  const member = raw !== null && typeof raw === "object" && !Array.isArray(raw) ? { username: str(raw.username), name: str(raw.name) } : null
+  return { server: str(value.server), member, label: str(value.label), token: str(value.token) }
 }
 
 /**
  * Load configuration.
  * No env-var overrides — config.json is the single source of truth
- * (API keys, baseURL, model, activeProvider all come from the file).
+ * (API keys, baseURL, defaultModel all come from the file).
  */
 /** Keep only { header: "string value" } pairs from a provider's headers field — anything
  *  else (null, arrays, nested objects) is dropped so it can never reach a fetch call.
@@ -289,6 +329,7 @@ export function loadConfig() {
     agent: { ...DEFAULTS.agent, ...config.agent },
     memory: { ...DEFAULTS.memory, ...config.memory },
     embedding: { ...DEFAULTS.embedding, ...config.embedding },
+    browser: { ...DEFAULTS.browser, ...config.browser },
     traces: { ...DEFAULTS.traces, ...config.traces },
     diagnostics: { ...DEFAULTS.diagnostics },
   }
@@ -306,10 +347,9 @@ export function loadConfig() {
   const _diagRaw = config.diagnostics && typeof config.diagnostics === "object" && !Array.isArray(config.diagnostics) ? config.diagnostics : {}
   for (const key of ["heapWatch", "heapSnapshot"]) if (typeof _diagRaw[key] === "boolean") merged.diagnostics[key] = _diagRaw[key]
 
-  // providers[].model 内存归一（v2 M3：非空字符串保留；非字符串/空串归一删除）——渠道默认模型
-  // 单值；无默认模型合法（模型选择经 /models 拉取候选——准入判据见 M8/M9）。
+  // providers[].model 一律删除（2026-10-09 清除批——渠道单值模型退场：渠道不携模型，不落任何
+  // 回退；模型身份唯二 = 顶层 defaultModel 复合串 ∥ 会话槽选定——PROVIDER.md §6.16 M3）。
   for (const p of merged.providers) {
-    if (typeof p.model === "string" && p.model.trim()) continue
     if (p.model !== undefined) delete p.model
   }
 
@@ -351,10 +391,13 @@ export function loadConfig() {
     if (p.baseURL) p.baseURL = p.baseURL.replace(/\/+$/, "")
   }
 
-  // Normalize proxy: string → { uri, web:true, model:false }; object 补默认值；非法类型丢弃。
+  // Normalize proxy: string → { uri, web:true }; object 补默认值；非法类型丢弃。
   // 保证 agent.config.proxy 永远是规范形态或 undefined
   merged.proxy = normalizeProxy(merged.proxy)
 
+  // 团队登录段（B1 批——TEAM.md §2.1）：加载归一（形不符 ⇒ null——软失败不阻启动）；不入 DEFAULTS
+  merged.team = normalizeTeamSection(merged.team)
+
   // Runtime provider = 统一解析（#841——resolveProviderPlan 单源：回退序 + 三态；PROVIDER.md §6.22）。
   // 不可运行（渠表空 ∥ 全表无 key）⇒ {} + providerInvalidReason（D-S1 处置不 throw——make-agent 打
   // _providerInvalid 标记 → TUI 首帧弹选择 / headless 报可读错误；同 2026-09-02 Q1 语义——不复用
@@ -387,7 +430,7 @@ export function loadConfig() {
 /**
  * MCP.md §5 D-3 (2026-09-01): re-read config.json and replace ONLY the agent's mcp section
  * — the agent 代配 closed loop (agent edits config.json with its edit tool, /mcp picks it
- * up). Never touches other config sections (providers/activeProvider stay as loaded).
+ * up). Never touches other config sections (providers/defaultModel stay as loaded).
  *
  * Malformed disk config → memory state kept, { ok:false, error } returned (the /mcp menu
  * shows "⚠ disk config unreadable"). Never throws.

package/context-degrade.mjs

@@ -2,7 +2,7 @@
  * context-degrade.mjs — 确定性降级面（无 LLM 的有损收缩 · 自 `context.mjs` 迁出 · 2026-10-01 core 拆分批 #755 ∥ #786）。
  * 内容 = `pruneStub` ∥ `pruneStaleToolOutputs`（F-CC3 陈旧工具输出清理）∥ `OVERSIZE_CONTENT_LIMIT` ∥
  * `shrinkOversized`（splitHistory 无中间段时的单条超限收缩）——迁出块逐字。
- * 原档 `context.mjs` 经 `export { … } from` 转口保名（消费面 / 批内件 import 面零改）；
+ * 原档 `context.mjs` 经 `export { … } from` 转口保名（消费面 / 单元测试档 import 面零改）；
  * 跨档被引的原私有面（`shrinkOversized`）补 `export` 关键字。
  */
 import { collectStaleToolOutputs } from "./token-window.mjs"

package/context-echo.mjs

@@ -2,7 +2,7 @@
  * context-echo.mjs — 回声安全面（D-CC18 ∥ D-CC19 恢复面归并 · 自 `context.mjs` 迁出 · 2026-10-01 core 拆分批 #755 ∥ #786）。
  * 内容 = `COMPACTION_PLACEHOLDER` ∥ 前缀器族（`prefixContent` / `withPlaceholderPrefix`）∥ 回声对归并
  * （`isAssistantEchoPair` / `contentTextOf` / `absorbEchoContent` / `mergeAdjacentAssistantEchoes`）——迁出块逐字。
- * 原档 `context.mjs` 经 `export { … } from` 转口保名（消费面 / 批内件 import 面零改）；
+ * 原档 `context.mjs` 经 `export { … } from` 转口保名（消费面 / 单元测试档 import 面零改）；
  * 跨档被引的原私有面（`COMPACTION_PLACEHOLDER` ∥ `withPlaceholderPrefix`）补 `export` 关键字。
  */
 

package/context-push.mjs

@@ -2,7 +2,7 @@
  * context-push.mjs — 消息双线写入单点（写缝面 · 自 `context.mjs` 迁出 · 2026-10-01 core 拆分批 #755 ∥ #786）。
  * `pushReal` = 真实消息写缝（机器线 `agent.history` + 人读线 `agent._fullHistory` 同源双写）；
  * `pushRecord` = 人读线留档记录单点（机器线零触）。迁出块逐字；原档 `context.mjs` 经
- * `export { … } from` 转口保名（消费面 / 批内件 import 面零改）。
+ * `export { … } from` 转口保名（消费面 / 单元测试档 import 面零改）。
  */
 
 /**
@@ -40,7 +40,7 @@ export function pushReal(agent, msg) {
  * pushRecord — 人读线留档记录单点（消化生命周期面 · #726；形 ∥ 写缝 ∥ 判据单源 = SESSION.md §6.26）。
  * `pushReal` 双胞（直复用——零算法副本）：`ts` 打点 ∥ 记录存储追加（`_recordStore?.append`——§6.14）∥
  * 尾窗驱逐三面同源；**机器线零触** = `history` 以一次性弃数组承接 ⇒ 记录不入 `agent.history` /
- * `contextHistory`（不喂模型）。未绑定（`_recordStore` 缺）⇒ 人读线追加照常 ∥ 存储腿空转（零抛——模式 F
+ * `contextHistory`（不喂模型）。未绑定（`_recordStore` 缺）⇒ 人读线追加照常 ∥ 存储分支空转（零抛——模式 F
  * 零回归）；载体缺位（无活跃会话）⇒ 零动作（零抛——日志归端侧）。
  */
 export function pushRecord(agent, record) {

package/context.mjs

@@ -250,7 +250,7 @@ export function compressFallback(agent) {
 
 // ─── 迁出面（import 面保持：TUI / verify-compress / VSC 对拍经本档取——先例 = 下方 explore-distill 再导出）──
 export { estimateTokens }
-// ─── 拆分转口（2026-10-01 拆分批 · #755 ∥ #786）：写缝 ∥ 回声 ∥ 降级三面外提——消费面 / 批内件 import 面零改 ───
+// ─── 拆分转口（2026-10-01 拆分批 · #755 ∥ #786）：写缝 ∥ 回声 ∥ 降级三面外提——消费面 / 单元测试档 import 面零改 ───
 export { pushReal, pushRecord } from "./context-push.mjs"
 export { isAssistantEchoPair, mergeAdjacentAssistantEchoes } from "./context-echo.mjs"
 export { pruneStaleToolOutputs } from "./context-degrade.mjs"

package/conventions.mjs

@@ -187,6 +187,6 @@ export function isStatePath(p, conv) {
 
 // ─────────────────────────────────────────────────────────────────────────────
 // 迁出面（2026-10-01 拆分批 · #755 ∥ #786）：声明装载面外提 `declaration.mjs`——本档经
-// 转口保名（消费面 / 批内件 import 面零改；`DEFAULT_DECLARATION` 另供本档分类裁判缺省取用）。
+// 转口保名（消费面 / 单元测试档 import 面零改；`DEFAULT_DECLARATION` 另供本档分类裁判缺省取用）。
 // ─────────────────────────────────────────────────────────────────────────────
-export { loadProjectDeclaration, DEFAULT_DECLARATION, isExcludedRelPath, declaredPublicRoots, clearDeclarationCache } from "./declaration.mjs"
+export { loadProjectDeclaration, declarationForTarget, DEFAULT_DECLARATION, isExcludedRelPath, declaredPublicRoots, clearDeclarationCache } from "./declaration.mjs"

package/declaration.mjs

@@ -3,11 +3,11 @@
  * · 自 `conventions.mjs` 迁出 · 2026-10-01 core 拆分批 #755 ∥ #786。
  * 投影单源 = `manifest.mjs`（ONE reader / ONE root resolution——`readManifest` + `manifestFilePath`；
  * name / shape / defaults = schema 面 `docs/core/design/MANIFEST.md` §2.2）。迁出块逐字；
- * 原档 `conventions.mjs` 经 `export { … } from` 转口保名（消费面 / 批内件 import 面零改）。
+ * 原档 `conventions.mjs` 经 `export { … } from` 转口保名（消费面 / 单元测试档 import 面零改）。
  */
 import { existsSync, statSync } from "node:fs"
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path"
-import { DEFAULT_MANIFEST, manifestFilePath, readManifest } from "./manifest.mjs"
+import { DEFAULT_MANIFEST, manifestFilePath, owningProject, readManifest } from "./manifest.mjs"
 import { logEvent } from "./log.mjs"
 
 /** Retired declaration carrier (project-root relative). Its EXISTENCE is checked, its
@@ -216,3 +216,19 @@ export function loadProjectDeclaration(cwd) {
   _cache.set(file, decl)
   return decl
 }
+
+/**
+ * 辖域单点（F11 · 2026-10-08 · #1104 · PORTABILITY §3.2 行 8 / §3.9 / D20）：目标**绝对路径**
+ * ⇒ 沿祖先链取**最近**带档目录（`owningProject` 归属形——nearest wins ∕ 纯 fs）⇒ 该项目的声明
+ * 对象（`loadProjectDeclaration` 本体零改——按档路径缓存）；祖先链无档 ⇒ `null` = **出辖**
+ * （不在任何 manifest 树内——父侧门不判不拦）。
+ * **发现梯（`discoverProjects`）不参与**——无候选 ∥ 歧义均出辖（不在无档面凭空落脚）。
+ * 相对形由消费面按会话 cwd 先解析（判据 = 目标所属项目，非会话 cwd）。
+ * @param {string} targetAbs 目标绝对路径（目录 / 文件）
+ * @returns {Readonly<object>|null} 所属项目的声明对象 / null = 出辖
+ */
+export function declarationForTarget(targetAbs) {
+  const root = owningProject(targetAbs)
+  if (!root) return null
+  return loadProjectDeclaration(root)
+}

package/file-links.mjs

@@ -22,7 +22,7 @@ export const MAX_LINKS = 50
 /**
  * 工具结果文本 ⇒ 验存文件链接（去重 + 封顶）。`cwd` = 项目根（相对 token 的解析基）；缺 ∕ 空 ⇒ 相对 token
  * 一律不检（禁假链接）；绝对 token 与 cwd 无关，照检。`probe` = 盘面探针注入缝（`{ existsSync(p), statSync(p) }`——
- * `node:fs` 同名面；桌面端侧注入）。零文本（`""` ∕ 非串）先于探针校验早退（零判据面 —— 探针不检）。
+ * `node:fs` 同名面；桌面端侧注入）。零文本（`""` ∕ 非串）先于探针校验早退（零判据 —— 探针不检）。
  */
 export function extractFileLinks(cwd, text, probe) {
   if (typeof text !== "string" || text === "") return []

package/file-refs.mjs

@@ -26,7 +26,7 @@ function probeOf(probe) {
 }
 
 /** Scan text for @path references and replace with inline file content.
- *  零文本（非串 ∥ 空串）先于探针校验早退（零判据面——探针不检，同序沿核 `file-links.mjs:28`）。 */
+ *  零文本（非串 ∥ 空串）先于探针校验早退（零判据——探针不检，同序沿核 `file-links.mjs:28`）。 */
 export function injectAtRefs(text, cwd, probe) {
   if (typeof text !== "string" || text === "") return text
   const io = probeOf(probe)

package/history-window.mjs

@@ -112,7 +112,7 @@ function pairToolEntries(history) {
  * `opts.records === true`（opt-in —— 留档批 · #719）⇒ `digest` ∕ `subagent` 两型
  * 记录原样入窗（`{ ...record, idx }`，字段零改名）并占条目位（游标按条目推进）；
  * 记录不参与 turn ∕ 可见性谓词（`visible` 面语义不动）。**默认关** ⇒ 输出与改前
- * 逐字等价（负控腿）；缺 `opts` ∕ 非 `true` ⇒ 同默认径。
+ * 逐字等价（负控分支）；缺 `opts` ∕ 非 `true` ⇒ 同默认径。
  */
 export function historyWindow(history, before, pageSize = HISTORY_PAGE_SIZE, opts = {}) {
   const total = Array.isArray(history) ? history.length : 0

package/i18n.mjs

@@ -70,6 +70,8 @@ export const CORE_MESSAGES = Object.freeze({
   "status.stopped": { en: "[stopped]", zh: "[已停止]" },
   "status.thinking": { en: "Thinking", zh: "思考中" },
   "status.turn": { en: "turn ${n}/${m}", zh: "轮次 ${n}/${m}" },
+  // ── 团队登录态（登录面补全批 · 2026-10-10 · 台账 #1231——TEAM.md §2.6：已失效段 ∥ 面板失效行；图形端经核字典投影直取）──
+  "status.team.invalid": { en: "Session expired — log in again", zh: "已失效——重新登录" },
   "tool.running": { en: "running…", zh: "执行中…" },
   "tool.done": { en: "done", zh: "完成" },
   // ── 台账（ledger）· F-LX3 变体键库首跑提示（批 2026-10-05-ledger-variant-db-notice · 台账 #935 · LEDGER.md §12.2 逐字；消费面 = CLI TUI 启动行）

package/ledger-cmd.mjs

@@ -11,13 +11,26 @@
  * 消费侧静态 import 会破 W8 契约②）。
  */
 import { resolve } from "node:path"
-import { ALLOWED_MIGRATIONS, nowIso, openLedger, PENDING_STATUSES } from "./ledger-db.mjs"
+import { ALLOWED_MIGRATIONS, nowIso, openLedger, PENDING_STATUSES, AGING_DAYS } from "./ledger-db.mjs"
 import { resolveProjectRoot } from "./manifest.mjs"
 import { resolveDeclaredRef } from "./declaration.mjs"
 
-/** 查询（只读，全角色）：SELECT 行集（status/kind/board 过滤，缺省 = 全部行；id 升序）。库不在 = 空账。
- *  只读开库（readOnly 句柄 + 零 DDL/ALTER——read-data-interface 批 FR2③）；库档非台账库 ⇒ 空账。 */
-export function ledgerQuery({ cwd, status = null, kind = null, board = null } = {}) {
+/** 逐行老化判真（LEDGER.md §13.4 · 2026-10-07 批 ledger-tool）：未决四态（`PENDING_STATUSES`）∧
+ *  行龄 > `AGING_DAYS` 天；行龄源 = `updated_at ?? created_at`（§5 同源）；时间戳缺 / 不可解析
+ *  ⇒ `false`（零假阳降级——与 `buildScan` 行龄口径同源）。 */
+function isRowAged(row, now) {
+  if (!PENDING_STATUSES.includes(row.status)) return false
+  const t = row.updated_at ?? row.created_at
+  if (t == null) return false
+  const ms = Date.parse(String(t))
+  return Number.isFinite(ms) && (now - ms) / 86400000 > AGING_DAYS
+}
+
+/** 查询（只读，全角色）：SELECT 行集（status / kind / board / trigger 等值过滤并取，缺省 = 全部行；id 升序）。
+ *  库不在 = 空账。只读开库（readOnly 句柄 + 零 DDL/ALTER——read-data-interface 批 FR2③）；库档非台账库 ⇒ 空账。
+ *  逐行携计算字段 `aged: boolean`（§13.4——不入库、不入导出白名单 DATA_COLUMNS）；`trigger` 过滤
+ *  仅三枚举等值（`NULL` 不过滤——批面未列，§13.2）；`now` = 注入缝（确定性用例）。 */
+export function ledgerQuery({ cwd, status = null, kind = null, board = null, trigger = null, now = Date.now() } = {}) {
   const db = openLedger(cwd, { readOnly: true })
   if (!db) return []
   try {
@@ -25,7 +38,9 @@ export function ledgerQuery({ cwd, status = null, kind = null, board = null } =
     if (status) { where.push("status = ?"); args.push(status) }
     if (kind) { where.push("kind = ?"); args.push(kind) }
     if (board) { where.push("board = ?"); args.push(board) }
-    return db.prepare(`SELECT * FROM items${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY id`).all(...args)
+    if (trigger) { where.push("trigger = ?"); args.push(trigger) }
+    const rows = db.prepare(`SELECT * FROM items${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY id`).all(...args)
+    return rows.map((r) => ({ ...r, aged: isRowAged(r, now) }))
   } finally { db.close() }
 }
 
@@ -75,9 +90,11 @@ export function ledgerAdd({ cwd, row }) {
 }
 
 /** executor 目标值计算（设计档 docs/core/design/LEDGER.md §3.1——判位在 ledgerUpdate 体内：迁移表判 → 本语义 → 写门 → UPDATE）。
- *  优先级 = patch 显式 > 自动语义（进在途 = executorSessionId / 出在途 = NULL）> 行现值兜底 > NULL。 */
+ *  优先级 = patch 显式 > 自动语义（进边 = executorSessionId / 出边 = NULL）> 行现值兜底 > NULL。
+ *  进边集（2026-10-07 批 ledger-tool 扩面——§13.3 / KD-LT1）：`待讨论 → 待设计`（批点火边）∥
+ *  `待设计 → 在途`（实施入边）——两枚同式。 */
 function resolveExecutorTarget(row, to, patch, executorSessionId) {
-  if (row.status === "待设计" && to === "在途") {
+  if ((row.status === "待讨论" && to === "待设计") || (row.status === "待设计" && to === "在途")) {
     return patch.executor ?? executorSessionId ?? row.executor ?? null
   }
   if (row.status === "在途" && (to === "待核销" || to === "已废弃")) {
@@ -86,9 +103,29 @@ function resolveExecutorTarget(row, to, patch, executorSessionId) {
   return patch.executor ?? row.executor ?? null
 }
 
+/** `evidence` 值计算（设计档 LEDGER.md §13.9——update / close 两函数同源一处落）：追加缺省（旧值非空 ⇒
+ *  `旧 + "｜" + 新`——「｜」两侧零空格直接相接；旧空（`null` ∥ 空串 ∥ 全空白）⇒ 直写，零分隔符残留）；
+ *  `evidenceReplace === true` 与值同传 ⇒ 整段替换（旧文零保留）；`evidence` 缺 / `null` ≡ 略去（零变）。
+ *  拒面①（旗独传——无新文可算）判于本阶段（close 侧先于追认门）；核内旗判只认 `=== true`（类型严判在
+ *  工具层）。两值逐字落行（不裁 / 不判内容）。 */
+function evidenceValue(fnName, oldValue, evidence, evidenceReplace) {
+  if (evidenceReplace === true && evidence == null) throw new Error(`${fnName}：evidenceReplace 须与 evidence 同传（缺新文）`)
+  if (evidence == null) return oldValue
+  const old = oldValue == null || String(oldValue).trim() === "" ? "" : String(oldValue)
+  return evidenceReplace === true || old === "" ? evidence : `${old}｜${evidence}`
+}
+
+/** 拒面②（新值全空白——追加 ∥ 覆盖两径同判）判点（§13.9 判序）：update 随值计算同拍 ∥ close 落
+ *  追认门之后；`evidence` 未传（`null` / 略去）⇒ 不判。 */
+function assertEvidenceValue(fnName, evidence) {
+  if (evidence != null && String(evidence).trim() === "") throw new Error(`${fnName}：evidence 为空（非空字符串）`)
+}
+
 /** 更新（写命令，仅主 agent）：UPDATE——状态迁移前判允许迁移表（不在表内 → 拒，行不变）。
  *  executor 目标值随同一 UPDATE 落列（LEDGER.md §3.1）；executorSessionId = 调用会话（函数参数注入——K-LX1
- *  纯函数可测；工具层动态 import getSessionId() 供值，零新静态边）。 */
+ *  纯函数可测；工具层动态 import getSessionId() 供值，零新静态边）。
+ *  `evidence` 传值 = 追加缺省、`patch.evidenceReplace` = 布尔覆盖旗（§13.9——值计算 / 两拒面 = `evidenceValue`
+ *  / `assertEvidenceValue`；判位 = 本语义段，随 executor 目标值同拍）。 */
 export function ledgerUpdate({ cwd, id, patch, executorSessionId }) {
   const db = openLedger(cwd, { create: true })
   try {
@@ -98,20 +135,27 @@ export function ledgerUpdate({ cwd, id, patch, executorSessionId }) {
     if (to !== row.status && !(ALLOWED_MIGRATIONS[row.status] ?? []).includes(to)) {
       throw new Error(`ledgerUpdate：迁移 ${row.status} → ${to} 不在允许迁移表`)
     }
-    const nextTaskBook = patch.task_book ?? row.task_book
-    assertTaskBookGate(cwd, "ledgerUpdate", to, nextTaskBook) // 判序：迁移表判 → 本门 → UPDATE
+    // 判序（§13.9）：迁移表判 → 本语义（executor 目标值 + evidence 值计算——含两拒面）→ 写门 → UPDATE
     const nextExecutor = resolveExecutorTarget(row, to, patch, executorSessionId)
+    const nextEvidence = evidenceValue("ledgerUpdate", row.evidence, patch.evidence, patch.evidenceReplace)
+    assertEvidenceValue("ledgerUpdate", patch.evidence)
+    const nextTaskBook = patch.task_book ?? row.task_book
+    assertTaskBookGate(cwd, "ledgerUpdate", to, nextTaskBook) // → 写门 → UPDATE
     const now = nowIso()
     db.prepare(`UPDATE items SET status = ?, title = ?, board = ?, req_doc = ?, task_book = ?, evidence = ?, trigger = ?, executor = ?, updated_at = ? WHERE id = ?`)
-      .run(to, patch.title ?? row.title, patch.board ?? row.board, patch.req_doc ?? row.req_doc, nextTaskBook, patch.evidence ?? row.evidence, patch.trigger ?? row.trigger, nextExecutor, now, id)
+      .run(to, patch.title ?? row.title, patch.board ?? row.board, patch.req_doc ?? row.req_doc, nextTaskBook, nextEvidence, patch.trigger ?? row.trigger, nextExecutor, now, id)
     return { id }
   } finally { db.close() }
 }
 
 /** 收口（写命令，仅主 agent）：核销两源（勾销：待核销 → 已核销；追认核销：待讨论 / 待设计 → 已核销，
  *  行 `evidence` 非空，缺 / 全空白 ⇒ 拒）/ 撤回（任意态 → 已废弃），事务包裹；归档 = 软删除。
- *  判序（同函数体同层）：目标集判 → 行取 → 源态判 → `evidence` 门 → UPDATE（LEDGER.md §3 收口两源）。 */
-export function ledgerClose({ cwd, id, status }) {
+ *  可选 `evidence` 参：传值 = 追加缺省（§13.9——旧空直写 / 旧非空拼 `旧｜新`）、`evidenceReplace: true`
+ *  同传 = 整段替换；勾销 / 追认 / 撤回三径同携（写值落行，内容不判）；两拒面（旗独传 @值计算 ∥
+ *  新值空白 @追认门后）见 `evidenceValue` / `assertEvidenceValue`。
+ *  判序（同函数体同层，§13.9）：目标集判 → 行取 → 源态判 → 值计算 → 追认门（原样——判**结果值**缺 /
+ *  全空白 ⇒ 拒，文案逐字不变）→ 拒面②（新值空白）→ UPDATE（LEDGER.md §3 收口两源）。 */
+export function ledgerClose({ cwd, id, status, evidence, evidenceReplace }) {
   if (status !== "已核销" && status !== "已废弃") throw new Error(`ledgerClose：目标态 ${status} ∉ {已核销, 已废弃}`)
   const db = openLedger(cwd, { create: true })
   try {
@@ -119,12 +163,14 @@ export function ledgerClose({ cwd, id, status }) {
     try {
       const row = db.prepare("SELECT * FROM items WHERE id = ?").get(id)
       if (!row) throw new Error(`ledgerClose：行 ${id} 不存在`)
-      // 判序：源态判（核销仅三源——在途不可跳）→ 追认口 `evidence` 门（行字段非空，缺 / 全空白 ⇒ 拒）
+      // 判序（§13.9）：源态判（核销仅三源——在途不可跳）→ 值计算（拒面① 旗独传判于此）→ 追认口 `evidence` 门
       if (status === "已核销" && !["待讨论", "待设计", "待核销"].includes(row.status)) throw new Error(`ledgerClose：核销仅限 待讨论 / 待设计 / 待核销（现态 ${row.status}）`)
-      if (status === "已核销" && ["待讨论", "待设计"].includes(row.status) && (row.evidence == null || String(row.evidence).trim() === "")) throw new Error(`ledgerClose：追认核销须带 evidence（现态 ${row.status}）`)
+      const nextEvidence = evidenceValue("ledgerClose", row.evidence, evidence, evidenceReplace)
+      if (status === "已核销" && ["待讨论", "待设计"].includes(row.status) && (nextEvidence == null || String(nextEvidence).trim() === "")) throw new Error(`ledgerClose：追认核销须带 evidence（现态 ${row.status}）`)
+      assertEvidenceValue("ledgerClose", evidence) // 判序：拒面②（新值空白）落追认门之后 → UPDATE
       const now = nowIso()
       // 撤回（任意态 → 已废弃——含在途直撤）同步 executor = NULL（LEDGER.md §3.1 ④）；核销两源（勾销 / 追认）executor 零触碰（非在途出边）
-      db.prepare("UPDATE items SET status = ?, closed_at = ?, updated_at = ?, executor = ? WHERE id = ?").run(status, now, now, status === "已废弃" ? null : row.executor, id)
+      db.prepare("UPDATE items SET status = ?, closed_at = ?, updated_at = ?, executor = ?, evidence = ? WHERE id = ?").run(status, now, now, status === "已废弃" ? null : row.executor, nextEvidence, id)
       db.exec("COMMIT")
       return { id, status }
     } catch (e) { db.exec("ROLLBACK"); throw e }

package/ledger-db.mjs

@@ -55,6 +55,12 @@ export function ledgerDbPath(cwd) {
 /** 未决四态（「活条目」口径 = 计数单源 WHERE 集；已核销 / 已废弃 = 归档态）。 */
 export const PENDING_STATUSES = ["待讨论", "待设计", "在途", "待核销"]
 
+/** 老化阈值（天——口径 = 需求档；消费面 = `buildScan`（展示，`days` 可覆盖）+ `ledgerQuery` 逐行
+ *  `aged`（查询面，`now` 可注入））。2026-10-07 批 ledger-tool：自 `ledger.mjs` 迁入（枚举常量档单源
+ *  ——`ledgerQuery` 计算面直引本档，消 `ledger-cmd ↔ ledger.mjs` 新环；`ledger.mjs` 同名 re-export
+ *  保公共面零变——LEDGER.md §13.4）。 */
+export const AGING_DAYS = 30
+
 /** 台账库结构版本（N2 标记**单源**——`PRAGMA user_version` 落标：写面开库 `v < 本值 ⇒ 置`；
  *  读面如实回读（旧库未标 = 0）；结构变更（新列 / 新表）同步升号——2026-10-03 read-data-interface 批）。 */
 export const LEDGER_SCHEMA_VERSION = 1