@thincoder/core 0.10.8 → 0.10.10

package/config.mjs

@@ -11,8 +11,7 @@
  * API key comes from providers[].apiKey only — environment variables are not a key source.
  */
 
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs"
-import { dirname, join } from "node:path"
+import { existsSync, readFileSync } from "node:fs"
 import { parseModelRef, resolveChannelModel, resolveProviderPlan, resolveRuntimeProvider, defaultModelReason } from "./model-ref.mjs"
 // 老形态迁移核（M7 v2——纯函数零依赖——本文件超 500 行硬限拆分，VSC 同构文件）
 import { migrateLegacyModelFields } from "./config-migrate.mjs"
@@ -30,79 +29,10 @@ export { writeConfigAtomic }
 
 function cfgPath() { return _configPath() }
 
-export const DEFAULTS = {
-  defaultModel: null, // top-level "provider:model" composite — new-session starting point (F-1)
-  agent: {
-    maxTurns: 200,
-    subagentTurns: 100,
-    subagentModel: null,  // default subagent model: "provider:model" | model name (parent provider); null = inherit parent provider
-    subagentModels: {},   // per-type override: { explore, plan, coder, "eng-coder" } — priority: subagent tool model arg > this[role] > subagentModel > parent provider
-    goalTurns: 200,
-    compactThreshold: 100000,
-    verifyGuard: false,  // push model back to verify when files were mutated but verify not run (opt-in)
-    // Multi-model consultation ("会诊") + escalate ("飞刀") — CLI parity with the VS Code plugin.
-    // consultModels: candidate pool for BOTH consult and escalate ({ provider, model, effort? }, up to 5).
-    consultModels: [],
-    consultTurns: 40,      // per-consultant tool-turn budget (diagnosis tasks)
-    consultTimeoutMs: 600000, // wall-clock ceiling per consultant (10min)
-    streamRules: [],      // time-traveling stream rules: [{ pattern: "regex", message: "reminder", action: "abort"|"warn", repeat: "always"|"once" }]
-    advisor: { guard: false },  // code review is always available; guard: true pushes completion back until reviewed (opt-in). Also accepts provider/model/thinking/reasoningEffort/timeoutMs overrides. Deprecated: enabled (2026-08-21)
-    autoThink: false,     // auto-classify task difficulty and set reasoning effort per-turn
-    engineering: false,   // initial default only — the runtime value is the session authority (MANIFEST.md §2.2 / ENGINEERING-MODE-V2.md §2.3 E5.1). Strict methodology enforcement — design-before-code (design review + user approval before code)
-    // Async pool limits (AGENT-LOOP-ASYNC-POOL.md §6.10 D-24a/R14 + R13 — POOL-CONFIG-
-    // UNIFIED 2026-09-09): { engCoder, other, advisor } — eng-coder pool / other-role
-    // pool / advisor-review pool, defaults 4/4/4 (user ruling "eng-coder 四路，其他
-    // 4 路" + advisor 评审池并入同一可配体系——三池统一默认 4)。engCoder/other
-    // runtime-validated at every subagent pool admission (subagent-async
-    // resolvePoolLimits); advisor runtime-validated at every advisor launch
-    // (advisor-async advisorPoolLimitFor——F-2——两域读取器独立不共享)——非法/缺省
-    // 回退 4——settings tool 与 /config 并发池菜单写此键——变更下个 spawn/launch 生效。
-    // ⚠ 与 subagent-async.mjs ASYNC_POOL_LIMITS（两键）/advisor-async.mjs
-    // ADVISOR_POOL_LIMIT 逐键同值（运行时回退常量）——耦合锚 T-24a4 断言锁住——
-    // 勿单侧改默认。
-    poolLimits: { engCoder: 4, other: 4, advisor: 4 },
-    // §6.30.3 门三件③（D-TW5）：timer 空闲自唤醒开关——默认开（工具描述面已承诺到点提醒）；
-    // false ⇒ 端侧不武装闩（回既有回合边界投递——零调度器面）。键面随 DEFAULTS 派生进 settings 类型表。
-    timerWake: true,
-    // 注入开关（PROMPT-SYSTEM.md §6.24 · 台账 #1420）：文档类 ∥ 记忆类自动注入——默认开；
-    // 判据 `!== false`（缺省 = 现行为零变）。消费点 = 核 `agent/setup.mjs` 判点（逐 run 现读）。
-    // 2026-10-15（§6.27 · 台账 #1465）：① 项目指令块独立成键——`injectDocs` 收窄为只管 ② 相关文档块；
-    // 两键完全正交（关任一方另一方照常）。`injectProjectRules` 判点 = 核 `agent/setup.mjs`（`prepareRun` 项目指令段）。
-    injectDocs: true,
-    injectProjectRules: true,
-    injectMemories: true,
-  },
-  memory: {
-    dbPath: join(configDir, "memory.db"),
-    projectDir: ".thincoder/memory",
-    team: null,
-    // 索引自维护（§6.14 面⑤ · 台账 #1096）：维护型备份保留枚数（轮转保最新 N——引擎钳 ≥ 1）
-    maintain: { backupKeep: 2 },
-  },
-  shell: null,            // bash tool shell executable (e.g. "C:\\Program Files\\Git\\bin\\bash.exe" or "pwsh"); null = system default (cmd on Windows, /bin/sh elsewhere)
-  embedding: {
-    baseURL: "https://api.siliconflow.cn/v1",
-    model: "BAAI/bge-m3",
-  },
-  mcp: {
-    servers: [],
-  },
-  websearch: {
-    // Structured search via Tavily when a key is set — empty apiKey → Bing RSS/HTML fallback (zero-config).
-    apiKey: "",          // Tavily key (tvly-...) — optional
-  },
-  // 浏览器工具（BROWSER-TOOL.md §3.2）：非空 ⇒ navigate 目标 host ∥ click/evaluate/type 的当前页 host 须命中
-  //（全等（大小写不敏感）∥ `*.` 前缀 = 子域通配）——收束面非沙箱；缺省空 = 不设限。
-  browser: { allowDomains: [] },
-  traces: {
-    enabled: false,  // §18.6 D-TR6 修订（2026-09-05 用户裁定——发布隐私："不希望用户那边也采集"）：轨迹存档默认 OFF——新用户零采集；本地调试分析可显式开（~/.thincoder/config.json traces.enabled:true）
-    retentionHours: 24, // D-TR10：轨迹文件保留小时数——CLI 启动时删除超过该时长的文件（默认 24h）
-  },
-  // 诊断开关（用户面 ① 配置键——CONFIG.md §6.2 名录）：`heapWatch` 默认开（设 false 关闭）——自愈分支
-  // 遥测；`heapSnapshot` 默认关——采集 opt-in（堆转储敏感度 ≥ traces ⇒ 对齐发布隐私先例 D-TR6；
-  // 2026-09-30 采集收网批；桌面端运行期热读 ∥ CLI 本进程下次启动）
-  diagnostics: { heapWatch: true, heapSnapshot: false },
-}
+// 配置默认值表本体已迁 `config-defaults.mjs`（CONTEXT-COMPACTION.md §6.16.9 —— C1：默认值数据 /
+// 加载期归一逻辑 / 请求预算算式三件分家）；本档 re-export 保持既有导入面（34 档零改）。
+import { DEFAULTS } from "./config-defaults.mjs"
+export { DEFAULTS }
 
 // Model capability table + spec lookup live in model-specs.mjs (2026-08-31
 // extract — config.mjs had grown past the 300-line advisory). Re-exported here
@@ -111,20 +41,24 @@ import { specForModel, providerSpec, specMatch, assistantToolCallMessage } from
 export { specForModel, providerSpec, specMatch, assistantToolCallMessage }
 
 
-// Window utilization threshold: compacts at 60% of the USABLE window (window − output
-// reservation — providers require input + max_tokens ≤ window; 2026-10-06 user ruling:
-// the reservation folds into the budget so compaction fires first, never a provider
-// rejection), the remaining 40% stays as headroom for injected context (directory tree,
-// git context, outline, project instructions, memory/doc search results — 30-50K tokens
-// per turn).
-const COMPACT_RATIO = 0.6
-
-/** Output reservation the request counts against the window: explicit `provider.maxTokens`
- *  (the value actually sent — `provider/core.mjs`) when set, else the spec `maxOutput`, else 0. */
+// Window utilization ratio (CONTEXT-COMPACTION.md §6.2 / D-CC30 / §6.17 / D-CC32): auto threshold =
+// min(usableWindow(window, reserve), ⌊window × COMPACT_RATIO⌋) — reserve is the output budget
+// ACTUALLY sent as max_tokens (uncapped; §6.17 requestBudget is the single source). Rows with
+// reserve ≤ 20% of the window land on the ratio term; larger reservations pull the line down to
+// window − reserve — overflow-free outranks the 75–80% band (mathematically exclusive there, §6.2).
+// Headroom above the line absorbs injected context (directory tree, git context, outline, project
+// instructions, memory/doc search results — 30–50K tokens per turn).
+const COMPACT_RATIO = 0.8
+
+/** Output reservation counted against the window: the value ACTUALLY sent as max_tokens —
+ *  explicit `provider.maxTokens` when set (the transport faces send it verbatim), else the spec
+ *  `maxOutput`, else 0. NOT capped: the old 25% cap reopened a residual band between the counted
+ *  reservation and the real output budget — messages could cross the true window while still below
+ *  the compaction line (2026-10-18 overflow 400: budget counted 250_000, 393_216 actually sent).
+ *  Single source = §6.17 requestBudget; this is its reserve face (advisor budget reuses it). */
 export function outputReserve(provider, spec) {
   const explicit = provider?.maxTokens
-  if (Number.isFinite(explicit) && explicit > 0) return explicit
-  return spec?.maxOutput ?? 0
+  return Number.isFinite(explicit) && explicit > 0 ? explicit : spec?.maxOutput ?? 0
 }
 
 /** Usable input window = window − output reservation. Degenerate guard: a reservation
@@ -139,17 +73,50 @@ export function usableWindow(context, reserve) {
   return usable > 0 ? usable : Math.floor(ctx / 2)
 }
 
-/** Derive compaction threshold; explicit is the value explicitly set in config file (takes priority), otherwise auto-computed from model.
- *  Second param accepts EITHER a model name string (pure spec lookup — legacy caller:
- *  first-run wizard) OR a provider object (providerSpec — the providers[].context
+/** Request budget — single source for window ∥ actually-sent max_tokens ∥ compaction threshold ∥
+ *  overflow guard (CONTEXT-COMPACTION.md §6.17 / D-CC32). One formula, four consumer faces:
+ *  threshold (resolveCompactThreshold / per-run setup), the four transport faces (read ONLY
+ *  maxTokens), the stats budget line (agent-tools/context.mjs), the pre-send guard
+ *  (agent/run-stages.mjs). transport derives from provider.format ("anthropic" | "google" |
+ *  "responses" | default = OpenAI-compatible). Fields:
+ *  - window / windowSource: spec.context (providers[].context K override already merged by
+ *    providerSpec); source = "provider-override" when the override is present, else "spec".
+ *  - maxTokens / maxTokensSource: the value THIS transport writes into the request body —
+ *    anthropic always sends it (explicit ?? spec.maxOutput); the other three faces send only an
+ *    explicit provider.maxTokens, absent ⇒ undefined / "absent". Never a guard criterion
+ *    (undefined ⇒ NaN — §6.17 guard); the guard reads limit instead.
+ *  - reserve: maxTokens ?? spec.maxOutput — uncapped, always a number.
+ *  - usable: usableWindow(window, reserve) (degenerate half-window guard).
+ *  - threshold: min(usable, ⌊window × COMPACT_RATIO⌋) — the compaction trigger line.
+ *  - limit: window − reserve — hard prompt ceiling; the guard's ONLY numeric criterion field
+ *    (always a number; negative = any prompt overflows). */
+export function requestBudget(provider, spec = providerSpec(provider)) {
+  const window = spec?.context ?? 0
+  const k = Number(provider?.context)
+  const windowSource = Number.isInteger(k) && k > 0 ? "provider-override" : "spec"
+  const explicitRaw = Number(provider?.maxTokens)
+  const explicit = Number.isFinite(explicitRaw) && explicitRaw > 0 ? explicitRaw : undefined
+  const anthropicAlwaysSends = provider?.format === "anthropic"
+  const maxTokens = explicit ?? (anthropicAlwaysSends ? spec?.maxOutput ?? 0 : undefined)
+  const maxTokensSource = explicit != null ? "explicit" : anthropicAlwaysSends ? "spec" : "absent"
+  const reserve = maxTokens ?? spec?.maxOutput ?? 0
+  const usable = usableWindow(window, reserve)
+  return {
+    window, windowSource, maxTokens, maxTokensSource, reserve, usable,
+    threshold: Math.min(usable, Math.floor(window * COMPACT_RATIO)),
+    limit: window - reserve,
+  }
+}
+
+/** Derive compaction threshold; explicit is the value explicitly set in config file (takes priority),
+ *  otherwise auto = requestBudget().threshold (§6.17 single source — min(usable, ⌊window × 0.8⌋),
+ *  reserve uncapped). Second param accepts EITHER a model name string (pure spec lookup — compat shape,
+ *  no caller passes a string today) OR a provider object (providerSpec — the providers[].context
  *  override in K units is honored, PROVIDER.md §15 T-C2). */
 export function resolveCompactThreshold(explicit, modelOrProvider) {
   if (explicit != null) return { value: explicit, auto: false }
   const provider = typeof modelOrProvider === "string" ? { model: modelOrProvider } : (modelOrProvider ?? {})
-  const spec = providerSpec(provider)
-  const usable = usableWindow(spec.context, outputReserve(provider, spec))
-  const value = Math.floor(usable * COMPACT_RATIO)
-  return { value, auto: true }
+  return { value: requestBudget(provider).threshold, auto: true }
 }
 
 /**
@@ -178,77 +145,28 @@ export function resolveEnableThinking(provider, spec) {
   const model = (typeof raw === "string" ? raw : "").toLowerCase()
   if (!model.startsWith("qwen") || model.startsWith("qwen3-coder")) return undefined
   if (!isBailianHost(provider?.baseURL)) return undefined
+  // 一致性分支（#1659）：effort 档位有值且非 "none" ⇒ effort 赢（thinking on）。
+  // 百炼约束：enable_thinking:false 时 reasoning_effort 必须为 "none"，互斥即 400。
+  // 压缩下行（context.mjs:203）显式 thinking:null 但继承 effort（v3 同源裁定）——
+  // 无此分支则发出 {enable_thinking:false, reasoning_effort:"medium"} ⇒ 400 ⇒ 压缩三连败。
+  if (provider.reasoningEffort && provider.reasoningEffort !== "none") return true
   if (provider.thinking === null) return false
   if (provider.reasoningEffort) return true
   return undefined
 }
 
+// 加载期归一 / 清洗纯函数族已迁 `config-normalize.mjs`（§6.16.9 —— C1）——四个公共函数经本档
+// re-export 保持既有导入面；其余四个（sanitizeProviderHeaders ∥ sanitizeConsultModels ∥ 两枚
+// 一次性警告旗）只由 loadConfig 消费。
+import {
+  sanitizeConsultModels, warnConsultModelsFiltered, sanitizeSubagentModel, sanitizeSubagentModels,
+  warnSubagentModelsFiltered, sanitizeProviderHeaders, normalizeProxy, normalizeTeamSection,
+} from "./config-normalize.mjs"
+export { sanitizeSubagentModel, sanitizeSubagentModels, normalizeProxy, normalizeTeamSection }
+
 /** Module-level one-time warn dedupe for invalid providers[].context (PROVIDER.md §15 D-C1). */
 const warnedContextProviders = new Set()
 
-/** F-4 (IKCDMR) 软失败清洗（D-S1 范式——loadConfig 是 CLI 启动砖点）：consultModels 非法
- *  条目过滤不 throw——非数组 → []、形状非法/未知渠道丢弃、超 5 截断（keep 前 5）。
- *  返回 { keep, dropped }——dropped 供一次性警告；merged.agent.consultModelsFiltered 挂载
- *  供后续首帧引导消费（数据层——本批文件面无消费方——同 providerInvalidReason 载体先例）。 */
-function sanitizeConsultModels(cm, providerNames) {
-  if (cm === undefined || cm === null) return { keep: [], dropped: [] }
-  if (!Array.isArray(cm)) {
-    return { keep: [], dropped: [`agent.consultModels must be an array of { provider, model } entries (got ${typeof cm})`] }
-  }
-  const names = new Set(providerNames)
-  const keep = []
-  const dropped = []
-  for (const entry of cm) {
-    if (keep.length >= 5) { dropped.push(`over the 5-entry cap — dropped ${JSON.stringify(entry)}`); continue }
-    if (!entry || typeof entry !== "object" || typeof entry.provider !== "string" || !entry.provider.trim()
-        || typeof entry.model !== "string" || !entry.model.trim()) {
-      dropped.push(`invalid entry (expected { provider: string, model: string }) — got ${JSON.stringify(entry)}`)
-      continue
-    }
-    if (!names.has(entry.provider)) {
-      dropped.push(`entry "${entry.provider}:${entry.model}" references unknown provider "${entry.provider}" (available: ${[...names].join(", ") || "none"})`)
-      continue
-    }
-    keep.push(entry)
-  }
-  return { keep, dropped }
-}
-
-/** F-4：过滤警告——进程级一次性（loadConfig 同进程可多次调用：TUI 启动 + reloadConfig）。 */
-let warnedConsultModels = false
-function warnConsultModelsFiltered(dropped, path) {
-  if (warnedConsultModels || dropped.length === 0) return
-  warnedConsultModels = true
-  console.warn(`[config] agent.consultModels: ${dropped.length} invalid entr${dropped.length === 1 ? "y ignored" : "ies ignored"} (filtered — startup continues; no crash):\n` +
-    dropped.map((d) => `  - ${d}`).join("\n") +
-    `\n  Fix: clean agent.consultModels in ${path} or use /config → consult/escalate pool menu.`)
-}
-
-/** #861（AGENT-LOOP-SUBAGENT.md §6.7.1）：subagent 模型覆盖加载期清洗——单源纯函数（核 loadConfig ∥ VSC 端壳 raw 读点同消费）；非法形态不 throw（`subagentModel` 非法 ⇒ null、`subagentModels` 非对象 ⇒ {}、值非法 ⇒ 剔除该键）。 */
-export function sanitizeSubagentModel(v) {
-  const ok = typeof v === "string" && v.trim()
-  const dropped = ok || v == null ? [] : [`agent.subagentModel must be a non-empty string ("provider:model" | model) — got ${Array.isArray(v) ? "array" : typeof v} — ignored (inherits the parent provider)`]
-  return { value: ok ? v : null, dropped }
-}
-export function sanitizeSubagentModels(v) {
-  if (v == null) return { value: {}, dropped: [] }
-  if (typeof v !== "object" || Array.isArray(v)) return { value: {}, dropped: [`agent.subagentModels must be an object mapping role → model override — got ${Array.isArray(v) ? "array" : typeof v} — ignored`] }
-  const value = {}, dropped = []
-  for (const [role, val] of Object.entries(v)) {
-    if (typeof val === "string" && val.trim()) { value[role] = val; continue }
-    dropped.push(`agent.subagentModels.${role} must be a non-empty string ("provider:model" | model) — got ${Array.isArray(val) ? "array" : typeof val} — dropped`)
-  }
-  return { value, dropped }
-}
-
-let warnedSubagentModels = false // #861：清洗警告——进程级一次性（同 consultModels 先例）
-function warnSubagentModelsFiltered(dropped, path) {
-  if (warnedSubagentModels || dropped.length === 0) return
-  warnedSubagentModels = true
-  console.warn(`[config] agent.subagentModel/subagentModels: ${dropped.length} invalid entr${dropped.length === 1 ? "y ignored" : "ies ignored"} (filtered — startup continues; no crash):\n` +
-    `${dropped.map((d) => `  - ${d}`).join("\n")}\n  Fix: clean it in ${path} — "provider:model" | model.`)
-}
-
 /**
  * Find provider by name in providers[].
  * Throws if name is non-empty but not found — a typo in the caller-supplied name (e.g. `defaultModel`) silently falling to the first provider would use the wrong key on the wrong endpoint.
@@ -264,47 +182,13 @@ export function findProvider(providers, name) {
   return providers[0] ?? { name: "default", baseURL: "" }
 }
 
-/** Normalize proxy config to { uri, web } or undefined (uri/url both accepted; invalid types dropped) */
-export function normalizeProxy(proxy) {
-  if (typeof proxy === "string") return proxy ? { uri: proxy, web: true } : undefined
-  if (!proxy || typeof proxy !== "object" || Array.isArray(proxy)) return undefined
-  const uri = proxy.uri || proxy.url || ""
-  if (typeof uri !== "string" || !uri) return undefined
-  return { uri, web: proxy.web !== false }
-}
-
-/** 团队登录段加载归一（B1 批——`docs/core/design/TEAM.md` §2.1 ∥ CONFIG.md §6.4）：非对象 ⇒ null（软失败
- *  不阻启动——沿 proxy 段先例）；键级 = trim 非空字符串（非串 ∥ 空 ⇒ null）；`member` 浅形 `{ username, name }`。
- *  **不入 `DEFAULTS`**（settings 工具面零涉——agent 不可写；`team.token` 经读面到达 = 敏感段词表遮罩）。 */
-export function normalizeTeamSection(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return null
-  const str = (v) => (typeof v === "string" && v.trim() !== "" ? v.trim() : null)
-  const raw = value.member
-  const member = raw !== null && typeof raw === "object" && !Array.isArray(raw) ? { username: str(raw.username), name: str(raw.name) } : null
-  return { server: str(value.server), member, label: str(value.label), token: str(value.token) }
-}
-
 /**
  * Load configuration.
  * No env-var overrides — config.json is the single source of truth
  * (API keys, baseURL, defaultModel all come from the file).
+ * loadConfig 内联迁移核已迁 config-migrate.mjs（500 行硬限拆分——VSC 同构）——
+ * migrateLegacyModelFields 纯函数 + 本文件 import/写回编排（折中 C 见其头注释）。
  */
-/** Keep only { header: "string value" } pairs from a provider's headers field — anything
- *  else (null, arrays, nested objects) is dropped so it can never reach a fetch call.
- *  Authorization is built-in and cannot be overridden from headers (core.mjs spreads first). */
-function sanitizeProviderHeaders(p) {
-  if (p.headers == null || typeof p.headers !== "object" || Array.isArray(p.headers)) { delete p.headers; return p }
-  const clean = {}
-  for (const [k, v] of Object.entries(p.headers)) {
-    if (typeof v === "string" && k.toLowerCase() !== "authorization") clean[k] = v
-  }
-  if (Object.keys(clean).length > 0) p.headers = clean
-  else delete p.headers
-  return p
-}
-
-/** loadConfig 内联迁移核已迁 config-migrate.mjs（500 行硬限拆分——VSC 同构）——
- *  migrateLegacyModelFields 纯函数 + 本文件 import/写回编排（折中 C 见其头注释）。 */
 export function loadConfig() {
   let config = {}
   const path = cfgPath()
@@ -418,11 +302,18 @@ export function loadConfig() {
     ? null
     : plan.reason ?? defaultModelReason(merged.providers, merged.defaultModel)
 
-  // Compaction threshold follows the model (provider-level context override honored — providerSpec)
+  // Compaction threshold 三档落值（CONTEXT-COMPACTION.md §6.17）：数值在场 = 显式（原样，不猜来源）；
+  // 不在场 = auto——派生值只进 compactThresholdResolved，永不写 agent.compactThreshold、不落盘。
   const explicitThreshold = config.agent?.compactThreshold
-  const { value, auto } = resolveCompactThreshold(explicitThreshold, merged.provider)
-  merged.agent.compactThreshold = value
-  merged.agent.compactThresholdAuto = auto
+  if (explicitThreshold != null) {
+    merged.agent.compactThreshold = explicitThreshold
+    merged.agent.compactThresholdResolved = explicitThreshold
+    merged.agent.compactThresholdAuto = false
+  } else {
+    merged.agent.compactThreshold = undefined
+    merged.agent.compactThresholdResolved = resolveCompactThreshold(null, merged.provider).value
+    merged.agent.compactThresholdAuto = true
+  }
 
   // Write back to merged for convenient access by upper layers
   // fetch 超时可配置（2026-09-01：agent.fetchTimeoutMs——provider/core.mjs effectiveFetchTimeoutMs 消费）

package/declaration.mjs

@@ -1,5 +1,5 @@
 /**
- * declaration.mjs — 声明装载面（PROJECT-MANIFEST.json 三族 `codePaths` / `index.*` / `advisor.*`）
+ * declaration.mjs — 声明装载面（PROJECT-MANIFEST.json 两族 `codePaths` / `index.*`）
  * · 自 `conventions.mjs` 迁出 · 2026-10-01 core 拆分批 #755 ∥ #786。
  * 投影单源 = `manifest.mjs`（ONE reader / ONE root resolution——`readManifest` + `manifestFilePath`；
  * name / shape / defaults = schema 面 `docs/core/design/MANIFEST.md` §2.2）。迁出块逐字；
@@ -62,11 +62,7 @@ function normalizePathList(v) {
   return out
 }
 
-function normalizeString(v) {
-  return typeof v === "string" && v.trim() ? v.trim() : ""
-}
-
-/** Project the manifest three families into the frozen declaration object.
+/** Project the manifest two families into the frozen declaration object.
  *  `declared` = VALUE comparison against the defaults — at least one family deviates
  *  (a key written with its default value still counts as NOT declared; the design-gate
  *  hint reads it to decide whether to point at the manifest, PORTABILITY §3.1).
@@ -80,11 +76,9 @@ function buildDeclaration(m, root = null) {
   const excludePaths = normalizePathList(m?.index?.excludePaths)
   const publicRepos = normalizePathList(m?.index?.publicRepos)
   const batchRecords = batchSegments(m?.docRoot?.batches) // §6.14 面⑥ 声明值投影（`declared` 旗不涉——docRoot 族现状零改）
-  const docMap = normalizeString(m?.advisor?.docMap)
-  const standardsDoc = normalizeString(m?.advisor?.standardsDoc)
   const defaults = normalizeCodePaths(DEFAULT_MANIFEST.codePaths) ?? []
   const pathsDiffer = codePaths.length !== defaults.length || codePaths.some((p, i) => p !== defaults[i])
-  const declared = pathsDiffer || codeExtensions.length > 0 || docExtensions.length > 0 || excludePaths.length > 0 || publicRepos.length > 0 || Boolean(docMap) || Boolean(standardsDoc)
+  const declared = pathsDiffer || codeExtensions.length > 0 || docExtensions.length > 0 || excludePaths.length > 0 || publicRepos.length > 0
   return Object.freeze({
     declared,
     codePaths: Object.freeze(codePaths),
@@ -95,7 +89,6 @@ function buildDeclaration(m, root = null) {
       excludePaths: Object.freeze(excludePaths),
       publicRepos: Object.freeze(publicRepos),
     }),
-    advisor: Object.freeze({ docMap, standardsDoc }),
     root,
   })
 }
@@ -317,7 +310,7 @@ onManifestInit(clearDeclarationCache)
 
 /** Retired-carrier warning (existence check only — zero content parsing, zero fallback). */
 function warnRetiredCarrier(root) {
-  console.warn(`[declaration] ${RETIRED_REL_PATH} is retired and no longer read — move codePaths / index.*Extensions / advisor.{docMap,standardsDoc} into PROJECT-MANIFEST.json`)
+  console.warn(`[declaration] ${RETIRED_REL_PATH} is retired and no longer read — move codePaths / index.*Extensions into PROJECT-MANIFEST.json`)
   logEvent("declaration:retired-file", { cwd: root })
 }
 
@@ -334,7 +327,7 @@ function warnRetiredCarrier(root) {
  * @param {string} cwd — project dir / anchor (root resolved by manifest.mjs)
  * @returns {Readonly<{declared: boolean, codePaths: readonly string[], batchRecords: readonly (readonly string[])[],
  *   index: {codeExtensions: string[], docExtensions: string[], excludePaths: string[], publicRepos: string[]},
- *   advisor: {docMap: string, standardsDoc: string}, root: string|null}>}
+ *   root: string|null}>}
  */
 export function loadProjectDeclaration(cwd) {
   const file = manifestFilePath(cwd) // data-file path (single source — manifest.mjs KD-M1-18)

package/doc-check/anchors.mjs

@@ -6,12 +6,14 @@
  *   **行号坐标（`:N`）不作节指示**——行号不作引用；
  * · 档不在盘 ⇒ `档缺`；带节指示 ∧ 节不在盘 ⇒ `节缺`。
  *
- * 抽取面：逐行扫；fenced 块整块跳过；可执行行（`isExecutableLine`）整行跳过（命令保字面）。
- * 解析序：① 仓根相对 → ② 域根相对（`scanDirs` 逐根）→ ③ 引用方档所在目录相对 →
- *   ④ 域内唯一 basename 索引；同名 ≥2 ⇒ **不判**（列报告面）。
- * 节在盘：目标档内存在标题行，其标题编号（标题文本去 `^#{1,6}\s` 后的首个 `\d+(?:\.\d+)*`）= 指针节号。
- * 残余登记（fail-open 方向——归评审核验面）：裸档名在域内多义 ⇒ 不判；未闭合围栏 ⇒ 至档尾免；
- *   指针行的坐标尾不入判、同行的档 token 照判。
+ * 抽取面：逐行扫；fenced 块整块跳过；可执行行（`isExecutableLine`）整行跳过（命令保字面）；
+ *   提示词面另剥 CANON 操作数（面判据 = 本档 `OPERAND_FACE`——六名整串删除后再抽，见 `CANON_OPERANDS`）。
+ * 解析序**两级**：① 仓根相对全路径 → ② 引用方档所在目录相对。零命中 ⇒ `档缺`。
+ *   **裸名不跨目录解析**：跨目录解析须先建全域目录索引——为认出一个裸名而重建索引，等于把全仓扫描请回来；
+ *   写全路径后解析零索引，逐档判就是全部（与 D4 实现坐标口径一致）。
+ * 节在盘：**只读解析命中的那一档**（点查，不遍历）——目标档内存在标题行，其标题编号
+ *   （标题文本去 `^#{1,6}\s` 后的首个 `\d+(?:\.\d+)*`）= 指针节号。
+ * 残余登记（fail-open 方向——归评审核验面）：未闭合围栏 ⇒ 至档尾免；指针行的坐标尾不入判、同行的档 token 照判。
  */
 import { readFileSync, statSync } from "node:fs"
 import { basename, dirname, resolve } from "node:path"
@@ -19,7 +21,44 @@ import { fenceMark, isExecutableLine } from "./width.mjs"
 
 /** 文档指针 token：`(目录段/)*名.md` + 可选行号坐标尾 + 可选节指示（`§` + 编号）。
  *  左界守卫排除更长 token 的尾段；右界排除后续字母数字（`.md` 之后紧邻 `[\w]` ⇒ 非完整 token）。 */
-const ANCHOR_RE = /(?<![A-Za-z0-9_.\-\\/@])((?:[A-Za-z0-9_.\-]+\/)*[A-Za-z0-9_.\-]+\.md)(?::\d+(?:-\d+)?)?(?:\s*§\s*(\d+(?:\.\d+)*))?(?![\w])/g
+const ANCHOR_RE = /(?<![A-Za-z0-9_.\-\\/@<>])((?:[A-Za-z0-9_.\-]+\/)*[A-Za-z0-9_.\-]+\.md)(?::\d+(?:-\d+)?)?(?:\s*§\s*(\d+(?:\.\d+)*))?(?![\w])/g
+
+/** 约定文件名（**类名**——文档在描述「会读哪些文件」、黑名单名字、`files` 字段值、测试数据）：不抽。
+ *  依据 = 这些名字在仓根 / 兄弟目录不一定存在，它们指的不是「某个仓内档」。 */
+const FILENAME_CLASSES = new Set([
+  "agents.md", "claude.md", "skill.md", "project_rules.md",
+  "changelog.md", "agent.md", "advisor.md", "todo.md", "todo-archive.md",
+])
+
+/** 占位符词干（示例写法 / 反例样本——`X.md` / `file.md` / `docs/batches/x.md` 类）：不抽。 */
+const PLACEHOLDER_STEMS = new Set([
+  "x", "a", "b", "file", "out", "foo", "bar", "example", "sample", "name", "path",
+])
+
+/** CANON 操作数族（**规范豁免串** · 判据单源 = `docs/core/design/PROMPT-SYSTEM.md` §6.6「判保留面」）：
+ *  六个名字在模型面是**模型要写出来 / 读写的文件名**（行为操作数 · 路径操作数），不是「去读这个档」的指针——
+ *  换个目录解析必然 `档缺`。**只对提示词面剥**（面判据 = 下方 `OPERAND_FACE`）：`docs/` 面不会因本条多放行一个名——
+ *  `README.md` / `MANIFEST.md` 在那里仍按指针判（其余四名早已走 `FILENAME_CLASSES` 类名免，非本条引入）。
+ *  **一处定义、两处消费**：`scripts/prompt-refs-check.mjs` 的 J3 豁免从本档 import 本表与剥除函数（不复制）；
+ *  反方向零 import——判据链自持 = `docs/core/design/DOC-DISCIPLINE.md` A-DD29 ⑤（`thincoder-core/**` 对
+ *  `scripts/**` 的 import 点 = 0）。闭集外的同形 token（非操作数）照报。 */
+export const CANON_OPERANDS = [
+  "AGENTS.md", "SKILL.md", "README.md", "MANIFEST.md",
+  ".thincoder/advisor.md", "project_rules.md",
+]
+
+/** 操作数剥除：逐行先整串删除六名 CANON 操作数再抽（与 `scripts/prompt-refs-check.mjs` 的 J3 豁免同式）。 */
+export function stripCanonOperands(line) {
+  let out = line
+  for (const s of CANON_OPERANDS) out = out.split(s).join("")
+  return out
+}
+
+/** 操作数豁免的**作用面** = 提示词面（`thincoder-core/prompts/**`）——**只此一面**：`docs/` 面同名 token 仍按指针判
+ *  （`README.md` / `MANIFEST.md` 在那里照报 `档缺`；其余四名走既有的 `FILENAME_CLASSES` 类名免，非本条引入）。
+ *  这是锚判自己的面判据——与行宽判据零共享开关：行宽按传入档全量判（提示词面照判，无面级豁免）。 */
+const OPERAND_FACE = /(?:^|\/)thincoder-core\/prompts\//i
+const isOperandFace = (abs) => OPERAND_FACE.test(String(abs).replace(/\\/g, "/"))
 
 /** 文件存在性（目录 / 读错 ⇒ false）。 */
 function isFile(p) { try { return statSync(p).isFile() } catch { return false } }
@@ -40,41 +79,32 @@ function sectionOnDisk(path, num) {
   return false
 }
 
-/** 档解析（判据 ① 的解析序 ①–④）：命中 ⇒ `{ ok, path }`；同名 ≥2 ⇒ `{ ambiguous, candidates }`；零命中 ⇒ `{ ok:false }`。
- *  行号坐标尾（`:N`）不参与档解析——token 只取 `.md` 段（抽取面已剥离坐标尾与节指示）。 */
-function resolveDoc(token, refFile, base, scanDirs, index) {
+/** 档解析（判据 ① 的解析序两级）：命中 ⇒ `{ ok, path }`；零命中 ⇒ `{ ok:false }`。
+ *  行号坐标尾（`:N`）不参与档解析——token 只取 `.md` 段（抽取面已剥离坐标尾与节指示）。
+ *  `num` = 指针节号（`§` 后编号；无节指示 ⇒ null）——仅用于判定节在盘，不参与档解析。 */
+function resolveDoc(token, refFile, base) {
   const p1 = resolve(base, token)
-  if (isFile(p1)) return { ok: true, path: p1 } // ① 仓根相对
-  for (const d of scanDirs) { const p = resolve(base, d, token); if (isFile(p)) return { ok: true, path: p } } // ② 域根相对
-  const p3 = resolve(dirname(refFile), token)
-  if (isFile(p3)) return { ok: true, path: p3 } // ③ 引用方档所在目录相对
-  const cands = index.get(basename(token)) ?? [] // ④ 域内唯一 basename 索引
-  if (cands.length === 1) return { ok: true, path: cands[0] }
-  if (cands.length > 1) return { ambiguous: true, candidates: cands }
+  if (isFile(p1)) return { ok: true, path: p1 } // ① 仓根相对全路径
+  const p2 = resolve(dirname(refFile), token)
+  if (isFile(p2)) return { ok: true, path: p2 } // ② 引用方档所在目录相对
   return { ok: false }
 }
 
 /**
- * 锚判据主行程：域内逐档逐行抽取 + 解析 + 节在盘判定。
- * @param {string} root 项目根（判据参数已由调用方自 `checkConfig` 读出）
- * @param {{scanDirs?:string[], files?:string[]}} o `files` = 域内 `.md` 全集（单源 = `scanDomain`）
- * @returns {{hits:Array, reports:Array}} hits = 命中（`档缺` / `节缺`）；reports = 报告面（多义——不作判）
+ * 锚判据主行程：传入档逐档逐行抽取 + 解析 + 节在盘判定。
+ * @param {string} root 项目根（解析序 ① 的基准）
+ * @param {{files?:string[]}} o `files` = **判定集兼解析集**（调用方传入的档清单——判定范围 = 解析范围，
+ *   无目录遍历、无全域索引：清单外的档既不判也不参与解析）
+ * @returns {{hits:Array}} hits = 命中（`档缺` / `节缺`）
  */
-export function checkAnchors(root, { scanDirs = [], files = [] } = {}) {
+export function checkAnchors(root, { files = [] } = {}) {
   const base = resolve(root)
-  const dirs = Array.isArray(scanDirs) ? scanDirs : []
-  const index = new Map()
-  for (const f of files) {
-    const k = basename(f)
-    if (!index.has(k)) index.set(k, [])
-    index.get(k).push(f)
-  }
   const hits = []
-  const reports = []
   for (const f of files) {
     let text = ""
     try { text = readFileSync(f, "utf8") } catch { continue }
     const re = new RegExp(ANCHOR_RE.source, "g") // 每档一份实例（零共享 lastIndex 状态）
+    const stripOperands = isOperandFace(f) // 只有提示词面剥（见 `OPERAND_FACE`）
     let fence = null // 围栏标记（` ∥ ~）；null = 不在块内
     text.split("\n").forEach((l, i) => {
       const mark = fenceMark(l)
@@ -85,16 +115,20 @@ export function checkAnchors(root, { scanDirs = [], files = [] } = {}) {
       }
       if (fence !== null) return
       if (isExecutableLine(l)) return // 可执行行整行跳过
+      const scan = stripOperands ? stripCanonOperands(l) : l // 提示词面：操作数先剥再抽；文档面 = 原行
       let m
-      while ((m = re.exec(l)) !== null) {
+      while ((m = re.exec(scan)) !== null) {
         const token = m[1]
         const num = m[2] ?? null
-        const r = resolveDoc(token, f, base, dirs, index)
-        if (r.ambiguous) { reports.push({ file: f, line: i + 1, token, candidates: r.candidates }); continue }
+        const bn = basename(token).toLowerCase()
+        const stem = bn.replace(/\.md$/, "")
+        // 类名 ∥ 占位符两免：抽取面不把它们当指针（判据 = DOC-DISCIPLINE §3.20 ① 的「档 token」定义面）
+        if (FILENAME_CLASSES.has(bn) || stem.length <= 1 || PLACEHOLDER_STEMS.has(stem)) continue
+        const r = resolveDoc(token, f, base)
         if (!r.ok) { hits.push({ file: f, line: i + 1, token, clazz: "档缺" }); continue }
         if (num !== null && !sectionOnDisk(r.path, num)) hits.push({ file: f, line: i + 1, token, clazz: "节缺", section: num, target: r.path })
       }
     })
   }
-  return { hits, reports }
+  return { hits }
 }