opencode-wiki-historian 0.5.0 → 0.5.2

package/dist/lint.d.ts

@@ -9,9 +9,9 @@
  */
 import type { Locale } from './wiki/pages.read.js';
 /** Machine rule keys; the human report renders zh labels from these. */
-export type GateViolation = 'redirect-stub-no-exit' | 'active-with-unfinished-skeleton';
+export type GateViolation = 'redirect-stub-no-exit' | 'active-with-unfinished-skeleton' | 'status-token-conflict';
 export interface LintFinding {
-    readonly key: 'todo-markers' | 'empty-sections' | 'intro-empty' | 'no-related-pages' | 'no-state-block' | 'h1-mismatch' | 'zh-english-dominant' | 'claims-without-stamp';
+    readonly key: 'todo-markers' | 'empty-sections' | 'intro-empty' | 'no-related-pages' | 'no-state-block' | 'h1-mismatch' | 'zh-english-dominant' | 'claims-without-stamp' | 'status-token-conflict';
     readonly detail: string;
 }
 export interface PageLink {
@@ -32,6 +32,15 @@ export interface BodyLint {
     readonly stubHasLink: boolean;
     readonly hasStateBlock: boolean;
     readonly state: 'active' | 'draft' | 'superseded' | 'deprecated' | null;
+    /** First state token parsed from a `| Status | X |` metadata table row
+     *  (P1); null when the body carries no parseable table token. The colon
+     *  header in `state` stays the AUTHORITY — this is the view, never a fix. */
+    readonly tableState: 'active' | 'draft' | 'superseded' | 'deprecated' | null;
+    /** Every state token found in table rows, document order, deduped. */
+    readonly tableStates: readonly NonNullable<BodyLint['state']>[];
+    /** True when the header token and at least one table token disagree (P1:
+     *  the machine-induced contradiction of live ids 9/92). */
+    readonly statusTokenConflict: boolean;
     readonly todoMarkers: number;
     /** Heading text of sections whose body (before the next heading ≤ level) is empty. */
     readonly emptySections: readonly string[];
@@ -47,6 +56,14 @@ export interface BodyLint {
     /** CJK chars / non-whitespace chars, zh body only meaningful; 0..1. */
     readonly cjkRatio: number;
 }
+/** The one finding kind {@link statusTokenFindings} emits. */
+export type StatusTokenFinding = LintFinding & {
+    readonly key: 'status-token-conflict';
+};
+/** Finding-key emission for status-token integrity (P1): both tokens present
+ *  and disagreeing. The colon header remains the authority — this reports the
+ *  contradiction, it never resolves it. */
+export declare function statusTokenFindings(lint: BodyLint): readonly StatusTokenFinding[];
 export interface HeadingSpan {
     readonly level: number;
     readonly heading: string;

package/dist/lint.js

@@ -47,20 +47,58 @@ function hasClickableExit(visibleNoAnchors) {
 }
 // --- status block -----------------------------------------------------------------
 const STATE_LINE_RE = /(?:^|\n)\s*\*{0,2}\s*(?:状态\s*\/\s*Status|状态|Status)\s*\*{0,2}\s*[:：]\s*([A-Za-z\u4e00-\u9fff][^\n·|<]*)/i;
-function parseState(maskedNoComments) {
-    const m = STATE_LINE_RE.exec(maskedNoComments);
-    if (m === null)
-        return { has: false, state: null };
-    const v = m[1].trim().toLowerCase();
+/** `| Status | X |` metadata-table row (P1). Line-anchored so only the FIRST
+ *  cell is the label — column headers like `| Action | … | Status |` and
+ *  separator rows never match. CJK-tolerant label (状态 / Status / 状态/Status
+ *  in either order), optional bold. Run on fence-masked, comment-stripped
+ *  text, so an injected fake token inside a code fence or HTML comment is
+ *  inert. The value is only a token when classifyState() recognizes it —
+ *  `| Status | — |` and free-form cells carry no token. */
+const TABLE_STATE_RE = /^\s*\|\s*(?:\*\*)?\s*(?:状态|Status)(?:\s*\/\s*(?:状态|Status))?\s*(?:\*\*)?\s*\|\s*([^|\n]+?)\s*\|/i;
+function classifyState(raw) {
+    const v = raw.trim().toLowerCase();
     if (v.startsWith('active'))
-        return { has: true, state: 'active' };
+        return 'active';
     if (v.startsWith('draft'))
-        return { has: true, state: 'draft' };
+        return 'draft';
     if (v.startsWith('superseded'))
-        return { has: true, state: 'superseded' };
+        return 'superseded';
     if (v.startsWith('deprecated'))
-        return { has: true, state: 'deprecated' };
-    return { has: true, state: null };
+        return 'deprecated';
+    return null;
+}
+function parseState(maskedNoComments) {
+    const m = STATE_LINE_RE.exec(maskedNoComments);
+    if (m === null)
+        return { has: false, state: null };
+    return { has: true, state: classifyState(m[1]) };
+}
+/** Deduped state tokens of every `| Status | X |` row, in document order. */
+function parseTableStates(visible) {
+    const out = [];
+    for (const line of visible.split('\n')) {
+        const m = TABLE_STATE_RE.exec(line);
+        if (m === null)
+            continue;
+        const st = classifyState(m[1]);
+        if (st !== null && !out.includes(st))
+            out.push(st);
+    }
+    return out;
+}
+/** Finding-key emission for status-token integrity (P1): both tokens present
+ *  and disagreeing. The colon header remains the authority — this reports the
+ *  contradiction, it never resolves it. */
+export function statusTokenFindings(lint) {
+    if (!lint.statusTokenConflict || lint.state === null)
+        return [];
+    const table = lint.tableStates.filter((s) => s !== lint.state).join(', ');
+    return [
+        {
+            key: 'status-token-conflict',
+            detail: `colon header '${lint.state}' vs table row '${table}' on '${lint.h1 ?? '?'}'`,
+        },
+    ];
 }
 // --- markers, headings, intro -------------------------------------------------------
 const TODO_COMMENT_RE = /(TODO|TBD|PLACEHOLDER|占位)/i;
@@ -217,12 +255,17 @@ export function lintBody(body, opts) {
         commands: distinct(visible, CMD_RE),
     };
     const stateInfo = parseState(visible);
+    const tableStates = parseTableStates(visible);
+    const statusTokenConflict = stateInfo.state !== null && tableStates.some((s) => s !== stateInfo.state);
     return {
         isRedirectStub,
         redirectTarget: target,
         stubHasLink: !isRedirectStub || hasClickableExit(links.length),
         hasStateBlock: stateInfo.has,
         state: stateInfo.state,
+        tableState: tableStates.length > 0 ? tableStates[0] : null,
+        tableStates,
+        statusTokenConflict,
         todoMarkers: countTodoMarkers(masked),
         emptySections: emptySectionsOf(headings),
         introEmpty,
@@ -250,5 +293,8 @@ export function publishGateViolations(lint) {
     if (lint.state === 'active' && (lint.todoMarkers > 0 || lint.emptySections.length > 0)) {
         out.push('active-with-unfinished-skeleton');
     }
+    if (lint.state === 'active' && lint.statusTokenConflict) {
+        out.push('status-token-conflict');
+    }
     return out;
 }

package/dist/maintain.d.ts

@@ -64,6 +64,18 @@ export interface FreshnessScan {
     readonly missingLastVerified: readonly MissingStamp[];
     readonly expiredReviewBy: readonly ExpiredReview[];
 }
+/** One cadence-due page (advisory queue — maintain NEVER auto-writes the stamp). */
+export interface DueForReviewRow {
+    readonly path: string;
+    readonly locale: Locale;
+    /** Whole days from the newest honest stamp date to now (floored; confessional-only
+     *  stamps stamp their own date but never reset the clock — see dueForReviewOf). */
+    readonly stampAge: number;
+    /** Days: metadata 复核周期/Review cadence row when parseable, else genre default. */
+    readonly cadence: number;
+    /** Re-check commands parsed from the ledger's command column (empty when none). */
+    readonly verifyCommands: readonly string[];
+}
 export interface MaintainReport {
     readonly schema: typeof MAINTAIN_SCHEMA;
     readonly generatedAt: string;
@@ -91,7 +103,7 @@ export interface MaintainReport {
             childPath: string;
         }[];
     };
-    readonly rootOrphans: readonly {
+    readonly flatRootPages: readonly {
         section: string;
         paths: readonly string[];
     }[];
@@ -113,10 +125,20 @@ export interface MaintainReport {
         rows: number;
     }[];
     readonly freshness: FreshnessScan | null;
+    /** Deep-only advisory queue (null in light, like freshness). */
+    readonly dueForReview: readonly DueForReviewRow[] | null;
 }
-export declare const MAINTAIN_SCHEMA = "historian.maintain.v1";
+export declare const MAINTAIN_SCHEMA = "historian.maintain.v2";
 /** Trigram-Jaccard bar for calling two (different-path) titles near-duplicates. */
 export declare const DUP_TITLE_THRESHOLD = 0.75;
+/** Stamp label incl. the 上次验证 variant (the set lint.ts STAMP_RE tests) — one
+ *  line-level source of truth for the honesty rule shared by surface + freshness. */
+export declare const STAMP_LINE_RE: RegExp;
+/** A stamp that confesses the review never executed (swarm-A P2 "stamp honesty"):
+ *  it must not exempt the claim ledger (surface) nor reset the cadence clock
+ *  (dueForReview). Matched per stamp line, never page-wide — "baseline" is a
+ *  common GPU-benchmark noun outside a stamp. */
+export declare const CONFESSIONAL_STAMP_RE: RegExp;
 export declare function buildMaintainReport(input: MaintainInput, opts?: MaintainOptions): Promise<MaintainReport>;
 /** Human report + (always) a fenced machine-readable JSON block at the END —
  *  the same MaintainReport object the tool envelope carries. */

package/dist/maintain.js

@@ -17,7 +17,7 @@ import { classifyGenre } from './templates/genres.js';
 import { isInternalPath } from './tools/shared.js';
 import { normalize } from './migrate-score.js';
 // --- Constants --------------------------------------------------------------
-export const MAINTAIN_SCHEMA = 'historian.maintain.v1';
+export const MAINTAIN_SCHEMA = 'historian.maintain.v2';
 /** Trigram-Jaccard bar for calling two (different-path) titles near-duplicates. */
 export const DUP_TITLE_THRESHOLD = 0.75;
 const DAY_MS = 86_400_000;
@@ -28,9 +28,34 @@ const DEFAULT_TOP_N = 10;
 // pre-emptively so the deep sweep lights up when the genre lane lands.
 const FRESHNESS_GENRES = ['G5', 'G6'];
 const STAMP_RE = /上次核实|last verified/i;
+/** Stamp label incl. the 上次验证 variant (the set lint.ts STAMP_RE tests) — one
+ *  line-level source of truth for the honesty rule shared by surface + freshness. */
+export const STAMP_LINE_RE = /上次核实|上次验证|last verified/i;
+/** A stamp that confesses the review never executed (swarm-A P2 "stamp honesty"):
+ *  it must not exempt the claim ledger (surface) nor reset the cadence clock
+ *  (dueForReview). Matched per stamp line, never page-wide — "baseline" is a
+ *  common GPU-benchmark noun outside a stamp. */
+export const CONFESSIONAL_STAMP_RE = /(not re-run|未复跑|未复核|baseline)/i;
 const REVIEW_LABEL_RE = /^(复核周期|复核期限|复核日期|review[-_ ]?by|review[-_ ]?due)$/i;
 const ISO_DATE_RE = /\d{4}-\d{2}-\d{2}/;
 const REDIRECT_RE = /^>\s*Redirect:/i;
+/** Table column headers that carry the per-row last-verified date (G5 ledger card). */
+const STAMP_COL_RE = /^(?:上次核实于?|上次验证于?|last verified)$/i;
+/** Metadata row naming the review cadence — its value is a DURATION, unlike the
+ *  ISO-date 复核期限/review-by row REVIEW_LABEL_RE owns. */
+const CADENCE_LABEL_RE = /^(?:复核周期|复核节奏|review[-_ ]?cadence|cadence)$/i;
+/** Ledger command-column headers: zh 复核命令/验证命令/命令/用法\/命令,
+ *  en Re-check command / Verify command(s) / Command(s) / Usage \/ Command. */
+const COMMAND_COL_RE = /^(?:命令|用法\s*\/\s*命令|复核命令|验证命令|commands?|usage\s*\/\s*commands?|re[-_ ]?check[-_ ]?commands?|verify[-_ ]?commands?)$/i;
+const DASH_CELL_RE = /^:?-{2,}:?$/;
+const NULLISH_CELL_RE = /^(?:—|–|-|n\/?a|待补充|todo|\?)$/i;
+/** Cadence floors when a stamped page carries no parseable metadata row:
+ *  G5 machine-state ledgers 7d (weekly re-run — the round-1 plan supersedes the
+ *  older 30d skeleton hint), G4 concepts and G6 how-tos 90d (the G6 skeleton's
+ *  own 复核周期 example "如每 90 天"); the remaining genres (G1/G2/G3) have no
+ *  cadence guidance anywhere, so the conservative quarterly 90d default applies. */
+const GENRE_CADENCE_DAYS = { G5: 7, G4: 90, G6: 90 };
+const DEFAULT_CADENCE_DAYS = 90;
 // --- Title similarity (trigram core copied from migrate-score.ts:289, where it
 // --- is private with a 0.95 roundtrip bar; maintain needs its own threshold) ---
 function titleGrams(s) {
@@ -58,8 +83,11 @@ function jaccard(a, b) {
 function cmpStr(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;
 }
+// bold-merge deliberately leaves (重定向)/(redirect)-suffixed stubs beside their
+// live twins; clustering those pairs reports non-defects and buries true near-dupes.
+const STUB_TITLE_RE = /[（(]\s*(?:重定向|redirect)\s*[）)]\s*$/i;
 function findDuplicates(rows) {
-    const units = rows.map((r) => ({
+    const units = rows.filter((r) => !STUB_TITLE_RE.test(r.title)).map((r) => ({
         path: r.path,
         title: r.title,
         grams: titleGrams(normalize(r.title).toLowerCase()),
@@ -147,7 +175,7 @@ function singleChildDirs(paths) {
     }
     return out;
 }
-function rootOrphans(paths) {
+function flatRootPages(paths) {
     const bySection = new Map();
     for (const path of paths) {
         if (path.split('/').length !== 2)
@@ -201,6 +229,117 @@ function reviewByOf(body) {
     }
     return null;
 }
+// --- dueForReview (cadence × stamp join; advisory only) --------------------------
+function tableCells(line) {
+    const t = line.trim();
+    return t.startsWith('|') ? t.split('|').map((c) => c.trim()) : null;
+}
+const isSeparatorRow = (cells) => cells.some((c) => c !== '' && DASH_CELL_RE.test(c));
+/** Every (date, confesses-non-execution) attestation in a body, two real shapes:
+ *  a stamp LABEL line carrying its ISO date (metadata rows, quote stamps, struck
+ *  history — the cockpit / 09-08-sweep forms) and each date under a
+ *  上次核实于/Last verified table column (the G5 card's per-row ledger dates). */
+function stampEntriesOf(body) {
+    const out = [];
+    let dateCol = -1;
+    for (const line of body.split('\n')) {
+        const lineDate = STAMP_LINE_RE.test(line) ? line.match(ISO_DATE_RE) : null;
+        if (lineDate !== null)
+            out.push({ ms: Date.parse(lineDate[0]), confessional: CONFESSIONAL_STAMP_RE.test(line) });
+        const cells = tableCells(line);
+        if (cells === null) {
+            dateCol = -1;
+            continue;
+        }
+        if (isSeparatorRow(cells))
+            continue;
+        // A `| 上次核实 | 2026-01-01 |` label row carries its own date (line rule above
+        // owns it) — only a date-less header row arms the column extraction, else the
+        // next value row (any label!) would be mis-read as a ledger date.
+        const h = ISO_DATE_RE.test(line) ? -1 : cells.findIndex((c) => STAMP_COL_RE.test(c));
+        if (h >= 0) {
+            dateCol = h;
+            continue;
+        }
+        const cell = dateCol >= 0 ? cells[dateCol] : undefined;
+        if (cell !== undefined) {
+            const m = cell.match(ISO_DATE_RE);
+            if (m !== null)
+                out.push({ ms: Date.parse(m[0]), confessional: CONFESSIONAL_STAMP_RE.test(cell) });
+        }
+    }
+    return out.filter((e) => !Number.isNaN(e.ms));
+}
+/** '30天' / '每 30 天' / 'every 30 days' / '7d' / '2 weeks' / bare '14' → days.
+ *  Dates, TODOs and prose return null — no cadence is ever fabricated. */
+function parseDays(text) {
+    const t = text.trim();
+    const w = t.match(/(\d{1,3})\s*(?:weeks?|wks?|w\b|周)/i);
+    if (w !== null)
+        return Number(w[1]) * 7;
+    const d = t.match(/(\d{1,4})\s*(?:days?|d\b|天|日)/i);
+    if (d !== null)
+        return Number(d[1]);
+    return /^\d{1,3}$/.test(t) ? Number(t) : null;
+}
+function cadenceDaysOf(body) {
+    for (const line of body.split('\n')) {
+        const cells = tableCells(line);
+        if (cells === null || cells.length < 3 || !CADENCE_LABEL_RE.test(cells[1] ?? ''))
+            continue;
+        for (const cell of cells.slice(2)) {
+            const days = parseDays(cell);
+            if (days !== null)
+                return days;
+        }
+    }
+    return null;
+}
+/** Re-check commands from ledger verification tables (see COMMAND_COL_RE):
+ *  backticks stripped, empty/nullish cells skipped, order kept, duplicates dropped. */
+function verifyCommandsOf(body) {
+    const out = [];
+    let cmdCol = -1;
+    for (const line of body.split('\n')) {
+        const cells = tableCells(line);
+        if (cells === null) {
+            cmdCol = -1;
+            continue;
+        }
+        if (isSeparatorRow(cells))
+            continue;
+        const h = cells.findIndex((c) => COMMAND_COL_RE.test(c));
+        if (h >= 0) {
+            cmdCol = h;
+            continue;
+        }
+        const cell = cmdCol >= 0 ? cells[cmdCol] : undefined;
+        if (cell === undefined)
+            continue;
+        const cmd = cell.replace(/^`([\s\S]*)`$/, '$1').trim();
+        if (cmd !== '' && !NULLISH_CELL_RE.test(cmd) && !out.includes(cmd))
+            out.push(cmd);
+    }
+    return out;
+}
+/** The join (swarm-B P-dueForReview, stamp honesty as its immune system): due
+ *  when the newest HONEST stamp is at or past the cadence (a weekly card is due
+ *  again on day 7), or when every stamp confesses non-execution — a confession
+ *  records intent, not verification, so it never exempts the page. A struck old
+ *  confessional stamp beside a fresh honest one (supersede-keeping-struck-old)
+ *  runs on the honest clock. */
+function dueForReviewOf(body, genre, now) {
+    const entries = stampEntriesOf(body);
+    if (entries.length === 0)
+        return null;
+    const honest = entries.filter((e) => !e.confessional);
+    const clock = honest.length > 0 ? honest : entries;
+    const stampAge = Math.floor((now.getTime() - Math.max(...clock.map((e) => e.ms))) / DAY_MS);
+    const cadence = cadenceDaysOf(body) ?? GENRE_CADENCE_DAYS[genre] ?? DEFAULT_CADENCE_DAYS;
+    if (honest.length > 0 && stampAge < cadence)
+        return null;
+    return { stampAge, cadence, verifyCommands: verifyCommandsOf(body) };
+}
 // --- buildMaintainReport --------------------------------------------------------
 export async function buildMaintainReport(input, opts = {}) {
     const now = opts.now ?? new Date();
@@ -219,11 +358,13 @@ export async function buildMaintainReport(input, opts = {}) {
         localeCount.set(r.path, (localeCount.get(r.path) ?? 0) + 1);
     let redirects = { available: false, count: 0, stubs: [] };
     let freshness = null;
+    let dueForReview = null;
     if (deep && opts.readBody !== undefined) {
         const readBody = opts.readBody;
         const stubs = [];
         const missing = [];
         const expired = [];
+        const due = [];
         let scanned = 0;
         let unreadable = 0;
         for (const r of kept) {
@@ -239,6 +380,9 @@ export async function buildMaintainReport(input, opts = {}) {
                 continue; // stubs are pointers — exempt from the freshness-stamp rule
             }
             const genre = classifyGenre({ title: r.title, body }).genre;
+            const dfr = dueForReviewOf(body, genre, now);
+            if (dfr !== null)
+                due.push({ path: r.path, locale: r.locale, ...dfr });
             if (!FRESHNESS_GENRES.includes(genre))
                 continue;
             if (!STAMP_RE.test(body))
@@ -253,6 +397,7 @@ export async function buildMaintainReport(input, opts = {}) {
         }
         redirects = { available: true, count: stubs.length, stubs };
         freshness = { scanned, unreadable, missingLastVerified: missing, expiredReviewBy: expired };
+        dueForReview = due.sort((a, b) => b.stampAge - a.stampAge || cmpStr(a.path, b.path) || cmpStr(a.locale, b.locale));
     }
     return {
         schema: MAINTAIN_SCHEMA,
@@ -270,11 +415,12 @@ export async function buildMaintainReport(input, opts = {}) {
         duplicates: { threshold: DUP_TITLE_THRESHOLD, clusters: findDuplicates(kept) },
         staleness: { topN, oldest: staleness(kept, now, topN) },
         diffusion: { singleChildDirs: singleChildDirs(paths) },
-        rootOrphans: rootOrphans(paths),
+        flatRootPages: flatRootPages(paths),
         tags: tagVocab(kept),
         redirects,
         sections: sectionDist(kept),
         freshness,
+        dueForReview,
     };
 }
 // --- renderMaintainMarkdown -----------------------------------------------------
@@ -313,10 +459,10 @@ export function renderMaintainMarkdown(r) {
         L.push('  - none');
     for (const d of r.diffusion.singleChildDirs)
         L.push(`  - \`${d.dir}/\` holds only \`${d.childPath}\``);
-    L.push('- root-level orphans (depth-2 pages, no sub-shelf):');
-    if (r.rootOrphans.length === 0)
+    L.push('- flat root pages per section (depth-2 listing, shelving hint — NOT inbound analysis; true orphans = surface deep links.orphanPages):');
+    if (r.flatRootPages.length === 0)
         L.push('  - none');
-    for (const o of r.rootOrphans)
+    for (const o of r.flatRootPages)
         L.push(`  - \`${o.section}/\` (${fmt(o.paths.length)}): ${o.paths.map((p) => `\`${p}\``).join(', ')}`);
     L.push('', '## Tag vocabulary', '');
     if (!r.tags.available)
@@ -347,6 +493,17 @@ export function renderMaintainMarkdown(r) {
         for (const e of r.freshness.expiredReviewBy)
             L.push(`  - review overdue: \`${e.path}\` (${e.locale}) since ${e.reviewBy} (${fmt(e.daysExpired)}d)`);
     }
+    if (r.dueForReview !== null) {
+        L.push('', `## 到期复核 Due for review（deep，advisory）`, '');
+        L.push(`- ${fmt(r.dueForReview.length)} 条 —仅提示，机器不代写；复核由人或复核协议执行`);
+        for (const d of r.dueForReview) {
+            const why = d.stampAge >= d.cadence
+                ? `戳龄 ${fmt(d.stampAge)}d ≥ 周期 ${fmt(d.cadence)}d`
+                : `confessional stamp（自称未复跑），周期 ${fmt(d.cadence)}d 未到亦列`;
+            const cmds = d.verifyCommands.length > 0 ? ` · ${d.verifyCommands.map((c) => '`' + c + '`').join(' ')}` : '';
+            L.push(`  - \`${d.locale}/${d.path}\` — ${why}${cmds}`);
+        }
+    }
     L.push('', '## Machine-readable JSON', '', '```json', JSON.stringify(r, null, 2), '```', '');
     return L.join('\n');
 }

package/dist/surface.d.ts

@@ -11,8 +11,9 @@
  * tier costs nothing beyond the map baseline, the deep tier reads every body
  * once (caller pools the reads).
  */
-import type { MaintainRow } from './maintain.js';
+import { type MaintainRow } from './maintain.js';
 import type { Locale } from './wiki/pages.read.js';
+import type { NavSnapshot } from './wiki/nav.js';
 export declare const SURFACE_SCHEMA: "historian.surface.v1";
 /** Minimal shape of a live `pages.list` row the surface diff needs. */
 export interface LiveRow {
@@ -26,6 +27,12 @@ export interface SurfaceInput {
     readonly generatedAt: string;
     readonly baseUrl: string;
     readonly liveInventory?: readonly LiveRow[];
+    /**
+     * Live primary nav. Issue #1's disease is sidebar exposure, so the check
+     * must read the real tree — omit/null reports `available: false` rather
+     * than falsely claiming a clean nav.
+     */
+    readonly nav?: NavSnapshot | null;
     readonly deep?: boolean;
     readonly readBody?: (path: string, locale: Locale) => Promise<string | null>;
 }
@@ -39,7 +46,18 @@ export interface SurfaceCoverage {
     readonly removedFromLive: number;
 }
 export interface SurfaceNav {
-    readonly machineSections: readonly string[];
+    readonly available: boolean;
+    readonly mode: string | null;
+    /** DYNAMIC/MIXED re-mirror the filesystem page tree into the sidebar — the exact Issue #1 relapse. */
+    readonly filesystemExposed: boolean;
+    /** Underscore-prefixed (machine-namespace) links explicitly mounted in the curated tree. */
+    readonly machineLinks: {
+        readonly locale: string;
+        readonly label: string;
+        readonly target: string;
+    }[];
+    /** Informational: underscore segments in the PAGE tree — by design (_meta/_evidence/_sandbox/_data). */
+    readonly machinePaths: readonly string[];
     readonly sectionLandingMissing: {
         readonly dir: string;
         readonly pagePaths: number;

package/dist/surface.js

@@ -14,8 +14,12 @@
 import { isInternalPath } from './tools/shared.js';
 import { lintBody } from './lint.js';
 import { classifyGenre } from './templates/genres.js';
+import { CONFESSIONAL_STAMP_RE, STAMP_LINE_RE } from './maintain.js';
 export const SURFACE_SCHEMA = 'historian.surface.v1';
 const MACHINE_SEG_RE = /^_/;
+// nav targets carry a leading slash and may pre-pend the locale segment
+// (/zh/_meta/x) — machine check runs on the first real path segment.
+const MACHINE_TARGET_RE = /^\/(?:(?:en|zh)\/)?_[^/]+/;
 const ROOT_EXEMPT = new Set(['home', 'wiki-index']);
 const visible = (r) => r.isPublished !== false && r.isPrivate !== true;
 const rowKey = (path, locale) => `${locale}\u0000${path}`;
@@ -23,15 +27,24 @@ function isFrontPath(path) {
     return !isInternalPath(path) && !path.startsWith('_sandbox/') && !path.startsWith('_data/');
 }
 // --- light tier ---------------------------------------------------------------
-function buildNav(rows, live) {
+function buildNav(rows, live, nav) {
     const paths = new Set();
     for (const r of rows)
         paths.add(r.path);
     for (const r of live ?? [])
         paths.add(r.path);
-    const machineSections = [...new Set([...paths].map((p) => p.split('/')[0]))]
+    const machinePaths = [...new Set([...paths].map((p) => p.split('/')[0]))]
         .filter((s) => MACHINE_SEG_RE.test(s))
         .sort();
+    const mode = nav?.mode ?? null;
+    const machineLinks = [];
+    for (const t of nav?.trees ?? []) {
+        for (const it of t.items) {
+            if (MACHINE_TARGET_RE.test(it.target)) {
+                machineLinks.push({ locale: t.locale, label: it.label, target: it.target });
+            }
+        }
+    }
     const perDir = new Map();
     for (const p of paths) {
         const seg = p.split('/');
@@ -43,7 +56,14 @@ function buildNav(rows, live) {
         .filter(([dir, n]) => n >= 2 && !paths.has(dir))
         .map(([dir, pagePaths]) => ({ dir, pagePaths }))
         .sort((a, b) => b.pagePaths - a.pagePaths || a.dir.localeCompare(b.dir));
-    return { machineSections, sectionLandingMissing };
+    return {
+        available: nav != null,
+        mode,
+        filesystemExposed: mode === 'DYNAMIC' || mode === 'MIXED',
+        machineLinks,
+        machinePaths,
+        sectionLandingMissing,
+    };
 }
 function buildCoverage(rows, live) {
     if (live === undefined)
@@ -92,6 +112,13 @@ function resolveTargetPath(baseUrl, rawHref) {
         return { path: t.slice(3), locale: 'en' };
     return { path: t, locale: 'en' };
 }
+/** True when EVERY stamp-bearing line confesses non-execution — see the
+ *  ledgerClaims rule in buildDeep. Lines are the unit of judgement because a
+ *  struck old stamp beside a fresh honest one must keep the exemption. */
+function isConfessionalStamp(body) {
+    const stampLines = body.split('\n').filter((l) => STAMP_LINE_RE.test(l));
+    return stampLines.length > 0 && stampLines.every((l) => CONFESSIONAL_STAMP_RE.test(l));
+}
 async function scanBodies(input) {
     if (input.readBody === undefined)
         return [];
@@ -233,7 +260,13 @@ function buildDeep(input, scans) {
         .map((s) => ({ path: s.row.path, cjkRatio: Number(s.lint.cjkRatio.toFixed(3)) }));
     const ledgerClaims = [];
     for (const s of ok) {
-        if (s.lint.isRedirectStub || !isFrontPath(s.row.path) || s.lint.hasStamp)
+        // Stamp honesty (swarm-A P2): a stamp that only ever confesses the review
+        // never ran ("…(content not re-run)"/未复跑/未复核/baseline) is not evidence —
+        // claiming review without execution must not suppress the claim ledger.
+        // Any single non-confessional stamp line (incl. supersede-keeping-struck-old)
+        // exempts exactly as before.
+        const exempt = s.lint.hasStamp && !isConfessionalStamp(s.body);
+        if (s.lint.isRedirectStub || !isFrontPath(s.row.path) || exempt)
             continue;
         const genre = classifyGenre({ title: s.row.title, body: s.body }).genre;
         if (!(genre === 'G4' || genre === 'G5' || genre === 'G6'))
@@ -269,7 +302,7 @@ export async function buildSurfaceReport(input) {
         generatedAt: input.generatedAt,
         deep: input.deep === true,
         coverage: buildCoverage(input.rows, input.liveInventory),
-        nav: buildNav(input.rows, input.liveInventory),
+        nav: buildNav(input.rows, input.liveInventory, input.nav),
         tagsEmpty: input.rows
             .filter((r) => isFrontPath(r.path) && (r.tags?.length ?? 0) === 0)
             .map((r) => ({ path: r.path, locale: r.locale }))
@@ -291,8 +324,21 @@ export function renderSurfaceMarkdown(r) {
         for (const m of cap(r.coverage.missingFromMap, 40))
             L.push(`  - \`${m.locale}/${m.path}\``);
     }
-    L.push('', '## 导航 Nav（动态侧栏镜像）', '');
-    L.push(`- 机器命名空间暴露 machineSections: ${r.nav.machineSections.map((s) => `\`${s}/\``).join(' ') || 'none'}`);
+    L.push('', '## 导航 Nav（真相 = 实时导航树，非页面树推断）', '');
+    if (!r.nav.available) {
+        L.push('- ⚠ 导航树不可读（nav.available=false）— 机器段暴露无法核验，请检查 token 的导航读取权限');
+    }
+    else {
+        L.push(`- mode: \`${r.nav.mode}\` · 文件系统暴露 filesystemExposed: ${r.nav.filesystemExposed ? '⚠ 是 — DYNAMIC/MIXED 会把页面树镜像回侧栏（Issue #1 复发）' : '否'}`);
+        if (r.nav.machineLinks.length > 0) {
+            L.push(`- ⚠ 导航树内机器段链接 machineLinks (${r.nav.machineLinks.length}):`);
+            for (const m of cap(r.nav.machineLinks, 20))
+                L.push(`  - [${m.locale}] ${m.label} → \`${m.target}\``);
+        }
+        else {
+            L.push(`- 导航树内机器段链接: none ✓（页面树存档段 ${r.nav.machinePaths.map((s) => `\`${s}/\``).join(' ') || '—'} 属设计内，仅备查）`);
+        }
+    }
     if (r.nav.sectionLandingMissing.length > 0) {
         L.push(`- 落地页缺失 sectionLandingMissing（面包屑 404 / 空目录页）:`);
         for (const s of r.nav.sectionLandingMissing)

package/dist/templates/skeletons.js

@@ -599,7 +599,7 @@ export const G6_ZH = `# 如何做某事（占位：目标句式标题，须与
 
 | 元数据 | 值 |
 | --- | --- |
-| 状态 | <!-- Active / Superseded-by: <path> / Deprecated --> |
+| 状态 | draft <!-- 必须与顶部 状态/Status 头同 token；改状态时两处一起改 --> |
 | 上次核实 | <!-- YYYY-MM-DD，在哪套环境按本页步骤重跑过 --> |
 | 复核周期 | <!-- 如每 90 天，到期重跑本页步骤 --> |
 | 被取代于 | <!-- 新手册路径，无则填 — --> |
@@ -648,7 +648,7 @@ export const G6_EN = `# How to Do X (placeholder: goal-titled heading, must matc
 
 | Field | Value |
 | --- | --- |
-| Status | <!-- Active / Superseded-by: <path> / Deprecated --> |
+| Status | draft <!-- must carry the SAME token as the 状态/Status header above; change both together --> |
 | Last verified | <!-- YYYY-MM-DD and the environment the steps were re-run in --> |
 | Review by | <!-- e.g. every 90 days; re-run the steps when due --> |
 | Superseded by | <!-- path of the newer manual, or — --> |

package/dist/tools/local.js

@@ -10,9 +10,11 @@ import { buildChronology, filterRowsByPath } from '../chronology.js';
 import { getMap, refreshMapCache, CACHE_PATH } from '../map.js';
 import { buildMaintainReport, renderMaintainMarkdown } from '../maintain.js';
 import { buildSurfaceReport, renderSurfaceMarkdown } from '../surface.js';
+import { lintBody, statusTokenFindings } from '../lint.js';
 import { normalizeLocale, PathValidationError } from '../wiki/locale.js';
 import { listPages, readPage } from '../wiki/pages.read.js';
-import { errEnvelope, okJson, reportUrls, URL_MANDATE } from './shared.js';
+import { readPrimaryNav } from '../wiki/nav.js';
+import { errEnvelope, isInternalPath, okJson, reportUrls, URL_MANDATE } from './shared.js';
 const s = tool.schema;
 const TRANSLATE_ARGS = {
     text: s.string(),
@@ -63,6 +65,24 @@ const MAP_ARGS = {
     deep: s.boolean().optional().describe('maintain: additionally read every page body (freshness + stubs + broken/stacked links + twin parity + zh-first + unfinished skeletons + claim ledgers) — one bounded read per row, cached across both scans'),
 };
 const MapArgsSchema = s.object(MAP_ARGS);
+/** P1 surfacing: lint's status-token-conflict finding per scanned body,
+ *  reusing runMaintain's per-page body cache (zero extra wiki reads). Machine
+ *  rows carry the `status-token-conflict` key so harness graders can count it
+ *  without re-deriving the rule. */
+async function scanStatusTokenConflicts(rows, readBody, baseUrl) {
+    const out = [];
+    for (const r of rows) {
+        if (isInternalPath(r.path))
+            continue;
+        const body = await readBody(r.path, r.locale);
+        if (body === null || body === '')
+            continue;
+        const findings = statusTokenFindings(lintBody(body, { locale: r.locale, baseUrl, title: r.title }));
+        for (const f of findings)
+            out.push({ path: r.path, locale: r.locale, key: f.key, detail: f.detail });
+    }
+    return out;
+}
 /** maintain: light tier is map rows + ONE read-only pages.list pass per locale
  *  (the mirror's MapRow carries no tags; the list join restores the vocab view);
  *  deep additionally reads each body via readPage. Reserved-path pages (e.g.
@@ -102,23 +122,33 @@ async function runMaintain(deps, mapDeps, snapshot, deep) {
         }
         : undefined;
     const report = await buildMaintainReport({ rows, mapGeneratedAt: snapshot.generatedAt, mapStaleSeconds: snapshot.staleSeconds }, { deep, readBody });
+    const nav = await readPrimaryNav(client);
     const surface = await buildSurfaceReport({
         rows,
         generatedAt: report.generatedAt,
         baseUrl: deps.options.baseUrl,
         liveInventory,
+        nav,
         deep,
         readBody,
     });
+    const statusTokenConflicts = deep && readBody !== undefined
+        ? await scanStatusTokenConflicts(rows, readBody, deps.options.baseUrl)
+        : [];
+    const conflictNote = statusTokenConflicts.length === 0
+        ? ''
+        : `\n\n## 状态令牌冲突 Status-token conflicts (${statusTokenConflicts.length})\n` +
+            statusTokenConflicts.map((c) => `- \`${c.locale}/${c.path}\` status-token-conflict: ${c.detail}`).join('\n') +
+            '\n';
     return {
         action: 'maintain',
-        schema: 'historian.maintain.v2',
+        schema: 'historian.maintain.v3',
         deep: report.deep,
         generatedAt: report.generatedAt,
         rowCount: report.rowCount,
-        report,
+        report: { ...report, statusTokenConflicts },
         surface,
-        markdown: `${renderMaintainMarkdown(report)}\n\n${renderSurfaceMarkdown(surface)}`,
+        markdown: `${renderMaintainMarkdown(report)}${conflictNote}\n\n${renderSurfaceMarkdown(surface)}`,
         urls: reportUrls(deps.options.baseUrl, CACHE_PATH, 'en'),
     };
 }

package/dist/tools/shared.d.ts

@@ -129,9 +129,10 @@ export declare function sectionRefusalJson(path: string, allowedSections: readon
 export declare class PublishGateError extends Error {
     constructor(message: string);
 }
-/** Hard gate on front-tier writes: refuses the two shapes that shipped real
+/** Hard gate on front-tier writes: refuses the three shapes that shipped real
  *  incidents — a page claiming Active with TODO markers or empty skeleton
- *  sections, and a redirect stub whose body carries no clickable exit.
+ *  sections, a redirect stub whose body carries no clickable exit, and (R4/P1)
+ *  an Active write whose table-row 状态/Status token contradicts the header.
  *  `_sandbox/*` and internal namespaces are exempt; 状态:draft stays the
  *  sanctioned work-in-progress escape hatch. Null = proceed. */
 export declare function publishGateRefusalJson(content: string, locale: Locale, path: string, baseUrl: string): ToolResult | null;

package/dist/tools/shared.js

@@ -85,7 +85,7 @@ function hintFor(errorKind) {
         case 'GraphQLError':
             return 'The wiki answered a GraphQL error — check the path/locale arguments.';
         case 'PublishGateError':
-            return '消除 TODO/空节并把状态置 Active，或保留 状态:draft 待自检通过后发布；重定向存根正文必须带可点击的 [链接](目标URL)。';
+            return '消除 TODO/空节并把状态置 Active，或保留 状态:draft 待自检通过后发布；重定向存根正文必须带可点击的 [链接](目标URL)；Active 页的表格行 状态/Status 必须与顶部冒号状态头同 token（改状态两处一起改）。';
         default:
             return 'Inspect the message and retry.';
     }
@@ -314,9 +314,10 @@ export class PublishGateError extends Error {
         this.name = 'PublishGateError';
     }
 }
-/** Hard gate on front-tier writes: refuses the two shapes that shipped real
+/** Hard gate on front-tier writes: refuses the three shapes that shipped real
  *  incidents — a page claiming Active with TODO markers or empty skeleton
- *  sections, and a redirect stub whose body carries no clickable exit.
+ *  sections, a redirect stub whose body carries no clickable exit, and (R4/P1)
+ *  an Active write whose table-row 状态/Status token contradicts the header.
  *  `_sandbox/*` and internal namespaces are exempt; 状态:draft stays the
  *  sanctioned work-in-progress escape hatch. Null = proceed. */
 export function publishGateRefusalJson(content, locale, path, baseUrl) {

package/dist/wiki/nav.d.ts

@@ -0,0 +1,21 @@
+import { type GqlClient } from './client.js';
+export interface NavItem {
+    readonly label: string;
+    readonly targetType: string;
+    readonly target: string;
+}
+export interface NavTree {
+    readonly locale: string;
+    readonly items: readonly NavItem[];
+}
+export interface NavSnapshot {
+    readonly mode: string;
+    readonly trees: readonly NavTree[];
+}
+/** Shape-tolerant parse: unknown/nullish shapes degrade to '' entries; a
+ *  payload without `navigation` is not-a-nav (null), letting the caller mark
+ *  the check unavailable instead of claiming "clean". */
+export declare function parseNav(raw: unknown): NavSnapshot | null;
+/** Never throws: an unreadable nav (older server, token without navigation
+ *  read) returns null so the scan degrades to "unavailable", not failure. */
+export declare function readPrimaryNav(client: GqlClient): Promise<NavSnapshot | null>;

package/dist/wiki/nav.js

@@ -0,0 +1,43 @@
+// Live navigation reader (v0.5.1). Issue #1's actual disease was the SIDEBAR
+// mirroring the filesystem (DYNAMIC/MIXED exposing _meta/_evidence/_sandbox),
+// not the existence of machine-namespace pages — those are by design. So the
+// detector reads the real primary nav (mode + curated flat trees) instead of
+// inferring exposure from the page tree.
+//
+// Shape note: this wiki.js generation REJECTS `children` on NavigationItem
+// (HTTP 400, re-probed 2026-09-08) — flat `items` are the whole truth.
+import { gql } from './client.js';
+const NAV_QUERY = '{ navigation { config { mode } tree { locale items { label targetType target } } } }';
+/** Shape-tolerant parse: unknown/nullish shapes degrade to '' entries; a
+ *  payload without `navigation` is not-a-nav (null), letting the caller mark
+ *  the check unavailable instead of claiming "clean". */
+export function parseNav(raw) {
+    const nav = raw?.navigation;
+    if (nav === undefined || nav === null)
+        return null;
+    const trees = [];
+    for (const t of Array.isArray(nav.tree) ? nav.tree : []) {
+        const row = t;
+        const items = [];
+        for (const i of Array.isArray(row?.items) ? row.items : []) {
+            const it = i;
+            items.push({
+                label: typeof it?.label === 'string' ? it.label : '',
+                targetType: typeof it?.targetType === 'string' ? it.targetType : '',
+                target: typeof it?.target === 'string' ? it.target : '',
+            });
+        }
+        trees.push({ locale: typeof row?.locale === 'string' ? row.locale : '', items });
+    }
+    return { mode: typeof nav.config?.mode === 'string' ? nav.config.mode : '', trees };
+}
+/** Never throws: an unreadable nav (older server, token without navigation
+ *  read) returns null so the scan degrades to "unavailable", not failure. */
+export async function readPrimaryNav(client) {
+    try {
+        return parseNav(await gql(client, NAV_QUERY, {}));
+    }
+    catch {
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-wiki-historian",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "opencode plugin that manages a wiki.js knowledge base with bilingual pages, genre templates, and migration tooling.",
   "type": "module",
   "license": "MIT",

package/skills/historian/SKILL.md

@@ -200,7 +200,7 @@ G5 现状卡的硬约束：状态块是机读单行（`Active` / `Superseded-by:
 | `historian_translate_snippet` | 翻译片段 | `text`, `from`(en/zh), `to`(en/zh) |
 | `historian_search` | 搜索页面 | `query`, `kind`(title/content), `tags?`(1-5 个), `tagsMode?`(all 缺省/any) |
 | `historian_read` | 读取页面 | `path`, `locale` |
-| `historian_map` | 页面地图/时间线/维护扫描 | `action`(show/refresh/timeline/maintain)；maintain 可选 `deep`（缺省 false=light 扫）；timeline 可选 `days`（近 N 天）与 `path`（前缀过滤）；输出人读 markdown + 机读 JSON，zh/en 行独立；maintain 同时返回 surface 接口面体检（信封 `historian.maintain.v2`） |
+| `historian_map` | 页面地图/时间线/维护扫描 | `action`(show/refresh/timeline/maintain)；maintain 可选 `deep`（缺省 false=light 扫）；timeline 可选 `days`（近 N 天）与 `path`（前缀过滤）；输出人读 markdown + 机读 JSON，zh/en 行独立；maintain 同时返回 surface 接口面体检（信封 `historian.maintain.v3`） |
 | `historian_migrate` | 迁移页面到规范 | `path`, `genre?`, `apply`(false/true) |
 | `historian_delete` | 删除页面 | `path`, `locale`, `confirm`(必须 "yes") |
 | `historian_move` | 移动页面 | `path`, `locale`, `newPath`, `newLocale?`, `confirm`(必须 "yes") |
@@ -327,21 +327,21 @@ historian_map action:'refresh'
 - **light 扫：每次批量写后必跑**——只基于地图行 + 每 locale 一次只读 `pages.list`（便宜，随批走）
 - **deep 扫：每周至多一次**——逐页读正文，跑新鲜度（缺「上次核实于」/ 复核过期）与 `> Redirect:` 存根计数（贵，克制用）
 
-light 扫在 maintain 行之外附带 **surface-light**：`coverage`（live 页面与地图不一致）、`nav`（`_*` 机器命名空间暴露于侧栏 / 章节缺落地页→面包屑 404）、`tagsEmpty`；deep 扫附带 **surface-deep**：正文级检测，逐页一次读取、双消费者共享缓存。
+light 扫在 maintain 行之外附带 **surface-light**：`coverage`（live 页面与地图不一致）、`nav`（侧栏真相=实时导航树：mode 非 STATIC 即把页面树镜像回侧栏 / 树内挂 `_` 段链接 / 章节缺落地页→面包屑 404）、`tagsEmpty`；deep 扫附带 **surface-deep**：正文级检测，逐页一次读取、双消费者共享缓存。
 
 报告行 → 处置映射表：
 
 | 报告行 | 含义 | 处置 |
 |--------|------|------|
 | `missingTwinPaths` | 双语孪生缺口 | 补孪生：翻译腿建 zh（或 en）页，走翻译失败处理 |
-| `duplicates.clusters` | 近重复标题簇（trigram-Jaccard 阈值） | bold-merge 流程：选最完整页为权威（bold），其余走 supersede 或 Redirect 存根 |
+| `duplicates.clusters` | 近重复标题簇（trigram-Jaccard 阈值；「（重定向）」存根不参与聚类） | bold-merge 流程：选最完整页为权威（bold），其余走 supersede 或 Redirect 存根 |
 | `staleness.oldest` | 最陈旧页 | mark/refresh：G5 卡重新核实或标记 stale，不静默覆盖 |
-| `rootOrphans` / `diffusion.singleChildDirs` | 顶级孤儿 / 独子目录 | 归架：并入正确章节、建章节索引，或按冻结协议做 Redirect 存根 |
+| `flatRootPages` / `diffusion.singleChildDirs` | 章节根平铺页清单（归架提示，非入链判定）/ 独子目录 | 归架：并入正确章节、建章节索引，或按冻结协议做 Redirect 存根；真孤儿看 surface deep 的 `orphanPages` |
 | `tags.vocabulary` | 标签漂移 | 词表映射：近义标签收敛到主词，`historian_page_update` 批量改 |
 | `redirects.stubs`（deep） | 重定向存根清单 | 核对目标存在、入链已改写；死链存根即修 |
 | `freshness`（deep） | 缺核实戳 / reviewBy 过期 | 回 G5 卡补核；到期页列入下周复核 |
 | `coverage.missingFromMap`（surface） | 新页/迁移未进地图 | `action:'refresh'` 后重扫 |
-| `nav.machineSections`（surface） | `_*` 机器命名空间进侧栏 | 导航树手工策划，只挂主题章节 |
+| `nav.filesystemExposed` / `nav.machineLinks`（surface） | 侧栏被 DYNAMIC/MIXED 镜像出页面树 / 导航树里挂了 `_` 段链接 | 导航树手工策划只挂主题章节，mode 固定 STATIC；`nav.available=false` 时先修 token 导航读权限再下结论 |
 | `nav.sectionLandingMissing`（surface） | 章节缺落地页（面包屑 404） | 建章节总览页并链入 wiki-index |
 | `unfinished`（surface deep） | Active 页含 TODO/空节/导言空 | 补全或降回 draft |
 | `stubs` / `links.broken` / `toStubs` / `sameTargetStacks`（deep） | 存根无可点出口 / 死链 / 指存根 / 同页多锚点 | 修出口与目标；锚点收敛到规范页 |