thincoder 0.12.58 → 0.12.60

package/src/tui/cmd-config.mjs

@@ -1,4 +1,3 @@
-import { existsSync, readFileSync } from "node:fs"
 import { ansi, C } from "./ansi.mjs"
 /** Merge an embedding-key save into the raw config, backfilling baseURL/model from defaults.
  *  Keeps existing custom values (Ollama/local embedding); defaults are the single source
@@ -17,8 +16,9 @@ export function embeddingPatch(raw, embKey, defaults) {
 export async function handleConfigCommand(ctx, args = []) {
   const { agent, pushLine, pushLabel, showPicker, askQuestion, persistRaw, maskKey, pickModelForSlot } = ctx
   const { configPath, DEFAULTS } = await import("../config.mjs")
-  const ac = agent.config?.agent ?? {}
-  const ec = agent.config?.embedding ?? {}
+  let ac = agent.config?.agent ?? {}
+  let ec = agent.config?.embedding ?? {}
+  let tc = agent.config?.traces ?? {}
 
   // agent.config.proxy 已被 loadConfig 归一化为 { uri, web, model } | undefined
   function proxySummary() {
@@ -30,9 +30,10 @@ export async function handleConfigCommand(ctx, args = []) {
   async function setEmbedKey() {
     const embKey = await askQuestion("Enter embedding API key (default: SiliconFlow bge-m3):")
     if (!embKey) return false
+    // D-F5b 语义先盘后存（embeddingPatch 在磁盘 fresh raw 上合并——冲突放弃不留 ghost）
+    await persistRaw((raw) => { raw.embedding = embeddingPatch(raw, embKey, DEFAULTS.embedding) })
     agent.config.embedding ??= {}
     agent.config.embedding.apiKey = embKey
-    await persistRaw((raw) => { raw.embedding = embeddingPatch(raw, embKey, DEFAULTS.embedding) })
     if (agent.memory) {
       const { createEmbedder } = await import("../embedding.mjs")
       agent.memory.embedder = createEmbedder(agent.config.embedding)
@@ -77,13 +78,15 @@ export async function handleConfigCommand(ctx, args = []) {
     }
   }
 
-  /** 保存 config（mutate 改 raw）→ reloadConfig（provider 代理无需重启即生效） */
+  /** 保存 config（mutate 改 raw）→ reloadConfig（provider 代理无需重启即生效）。
+   *  D-F5b：磁盘新鲜读 → mutate → 写前 mtime 门控（writeConfigAtomic——冲突放弃 +
+   *  .bak 留现场）；冲突时先 reloadConfig 采纳磁盘新值再 throw——调用方 try/catch
+   *  统一展示 "Save failed: config changed on disk concurrently — retry"。 */
   async function saveProxy(mutate) {
-    const raw = existsSync(configPath) ? JSON.parse(readFileSync(configPath, "utf8")) : {}
-    mutate(raw)
-    const { saveConfig } = await import("../config.mjs")
-    saveConfig(raw)
+    const { writeConfigAtomic, configPath } = await import("../config.mjs")
+    const r = writeConfigAtomic(configPath, mutate)
     await reloadConfig()
+    if (!r.ok) throw new Error("config changed on disk concurrently — retry")
   }
 
   // ── Proxy sub-menu loop：每轮重建 entries 显示最新状态，defaultIndex 记住上次位置 ──
@@ -228,17 +231,56 @@ export async function handleConfigCommand(ctx, args = []) {
     }
   }
 
+  // ── 并发池子菜单（§24 D-24a/R14——agent.poolLimits——读/改两域；保存经 saveProxy
+  // 落盘 + reloadConfig 热应用——下个 spawn 生效）──
+  async function poolMenu() {
+    let poolIdx = 0
+    for (;;) {
+      const pl = agent.config?.agent?.poolLimits ?? {}
+      // 显示回退与默认同源（DEFAULTS.agent.poolLimits——配置 DEFAULTS 与运行时回退常量
+      // ASYNC_POOL_LIMITS 的耦合由 T-24a4 锚定断言锁住——防默认值单侧漂移）
+      const cur = (k) => (Number.isInteger(pl[k]) && pl[k] >= 1 ? pl[k] : DEFAULTS.agent.poolLimits[k])
+      const entries = [
+        { type: "header", text: `Async pools: eng-coder ${cur("engCoder")} / other ${cur("other")}（默认 4/4——分域互不阻塞——超限排队）` },
+        { type: "item", text: `eng-coder 池上限 = ${cur("engCoder")}`, action: "engCoder" },
+        { type: "item", text: `其他角色池上限 = ${cur("other")}`, action: "other" },
+      ]
+      const c = await showPicker("并发池（agent.poolLimits）", entries, { defaultIndex: poolIdx })
+      if (!c) return // Esc 返回主菜单
+      poolIdx = Math.max(0, entries.filter((e) => e.type === "item").indexOf(c))
+      const val = await askQuestion(`${c.action} pool limit (current: ${cur(c.action)} — positive integer ≥1):`)
+      if (!val) continue // 空输入不改动
+      const num = Number(val)
+      if (!Number.isInteger(num) || num < 1) { pushLine("Pool limit must be a positive integer (≥1)", C.error); continue }
+      const next = { engCoder: cur("engCoder"), other: cur("other"), [c.action]: num }
+      try {
+        await saveProxy((raw) => { raw.agent ??= {}; raw.agent.poolLimits = { engCoder: next.engCoder, other: next.other } })
+        pushLabel("❯ Config", ansi.bold + C.tool)
+        pushLine(`agent.poolLimits = { engCoder: ${next.engCoder}, other: ${next.other} }（下个 spawn 生效——分域互不阻塞）`, C.tool)
+      } catch (error) { pushLine(`Save failed: ${error.message}`, C.error) }
+    }
+  }
+
   // ── Main config loop ──
   let running = true
   let mainIdx = 0 // 记住上次选中位置，改完一项回主菜单时恢复
   while (running) {
+    // 每轮刷新——保存分支经 reloadConfig 替换了 agent.config 对象——回菜单显示新值
+    ac = agent.config?.agent ?? {}
+    ec = agent.config?.embedding ?? {}
+    tc = agent.config?.traces ?? {}
     const consultCount = (ac.consultModels ?? []).length
+    const pl = ac.poolLimits ?? {}
+    const cur = (k) => (Number.isInteger(pl[k]) && pl[k] >= 1 ? pl[k] : DEFAULTS.agent.poolLimits[k])
     const mainEntries = [
-      { type: "header", text: `proxy=${proxySummary()} | maxTurns=${ac.maxTurns ?? 200} | compactThreshold=${ac.compactThreshold ?? 100000} | verifyGuard=${ac.verifyGuard === true ? "on" : "off"} | consult=${consultCount} model(s) | embedding=${agent.memory?.embedder ? "on" : "off"}` },
+      { type: "header", text: `proxy=${proxySummary()} | maxTurns=${ac.maxTurns ?? 200} | compactThreshold=${ac.compactThreshold ?? 100000} | verifyGuard=${ac.verifyGuard === true ? "on" : "off"} | consult=${consultCount} model(s) | embedding=${agent.memory?.embedder ? "on" : "off"} | traces=${tc.enabled === false ? "off" : "on"}` },
       { type: "item", text: `agent.maxTurns = ${ac.maxTurns ?? 200}`, action: "agent.maxTurns" },
       { type: "item", text: `agent.subagentTurns = ${ac.subagentTurns ?? 100}`, action: "agent.subagentTurns" },
+      { type: "item", text: `并发池 agent.poolLimits = engCoder ${cur("engCoder")} / other ${cur("other")}（async 分域上限）`, action: "pool" },
       { type: "item", text: `agent.compactThreshold = ${ac.compactThreshold ?? 100000}${agent.config?.agent?.compactThresholdAuto ? " (auto)" : ""}`, action: "agent.compactThreshold" },
       { type: "item", text: `agent.verifyGuard = ${ac.verifyGuard === true ? "on" : "off"}`, action: "agent.verifyGuard" },
+      { type: "item", text: `traces.enabled = ${tc.enabled === false ? "off" : "on"}（轨迹存档——发布默认关——隐私）`, action: "traces.enabled" },
+      { type: "item", text: `traces.retentionHours = ${tc.retentionHours ?? 24} h（超期文件启动时清理）`, action: "traces.retentionHours" },
       { type: "item", text: `agent.consultModels = ${consultCount} model(s)${consultCount ? ` (${(ac.consultModels ?? []).map((m) => m.provider + ":" + m.model).join(", ")})` : ""}`, action: "consult" },
       { type: "item", text: `agent.consultTurns = ${ac.consultTurns ?? 40}`, action: "agent.consultTurns" },
       { type: "item", text: `agent.consultTimeoutMs = ${Math.round((ac.consultTimeoutMs ?? 600000) / 60000)} min`, action: "agent.consultTimeoutMs" },
@@ -259,14 +301,16 @@ export async function handleConfigCommand(ctx, args = []) {
       pushLine(`agent.subagentTurns: ${ac.subagentTurns ?? 100}`, C.dim)
       pushLine(`agent.compactThreshold: ${ac.compactThreshold ?? 100000}${agent.config?.agent?.compactThresholdAuto ? " (auto)" : ""}`, C.dim)
       pushLine(`agent.verifyGuard: ${ac.verifyGuard === true ? "on" : "off"}`, C.dim)
+      pushLine(`traces.enabled: ${tc.enabled === false ? "off" : "on"}（默认 off——发布隐私——本地分析可开）`, C.dim)
+      pushLine(`traces.retentionHours: ${tc.retentionHours ?? 24}（超期文件启动清理——D-TR10）`, C.dim)
       pushLine(`agent.consultModels: ${(ac.consultModels ?? []).map((m) => `${m.provider}:${m.model}${m.effort ? ` (${m.effort})` : ""}`).join(", ") || "(none)"}`, C.dim)
+      pushLine(`agent.poolLimits: { engCoder: ${cur("engCoder")}, other: ${cur("other")} }（async 分域上限——默认 4/4——agent.poolLimits 可配）`, C.dim)
       pushLine(`agent.consultTurns: ${ac.consultTurns ?? 40}`, C.dim)
       pushLine(`agent.consultTimeoutMs: ${Math.round((ac.consultTimeoutMs ?? 600000) / 60000)} min`, C.dim)
       pushLine(`embedding: ${agent.memory?.embedder ? `enabled (${ec.model ?? ""})` : "disabled (FTS only)"}`, C.dim)
       pushLine(`proxy: ${proxySummary()}`, C.dim)
       pushLine(`Config file: ${configPath}`, C.dim)
-      running = false
-      continue
+      continue // 回主菜单（Esc 退出）
     }
 
     if (choice.action === "proxy") {
@@ -279,8 +323,13 @@ export async function handleConfigCommand(ctx, args = []) {
       continue
     }
 
+    if (choice.action === "pool") {
+      await poolMenu()
+      continue
+    }
+
     if (choice.action === "embedkey") {
-      if (await setEmbedKey()) running = false
+      await setEmbedKey() // 保存成功/取消都回主菜单（Esc 退出）
       continue
     }
 
@@ -293,9 +342,20 @@ export async function handleConfigCommand(ctx, args = []) {
         })
         pushLabel("❯ Config", ansi.bold + C.tool)
         pushLine(`agent.verifyGuard = ${newVal ? "on" : "off"}`, C.tool)
-        running = false
       } catch (error) { pushLine(`Save failed: ${error.message}`, C.error) }
-      continue
+      continue // 回主菜单（Esc 退出）
+    }
+
+    if (choice.action === "traces.enabled") {
+      const newVal = tc.enabled === false // 显式写布尔（默认 off——DEFAULTS 合并后必有值）
+      try {
+        await saveProxy((raw) => {
+          raw.traces = { ...(raw.traces ?? {}), enabled: newVal }
+        })
+        pushLabel("❯ Config", ansi.bold + C.tool)
+        pushLine(`traces.enabled = ${newVal ? "on" : "off"}${newVal ? "（轨迹落盘 ~/.thincoder/traces/——保留 " + (tc.retentionHours ?? 24) + "h）" : ""}`, C.tool)
+      } catch (error) { pushLine(`Save failed: ${error.message}`, C.error) }
+      continue // 回主菜单（Esc 退出）
     }
 
     // Embedding model is fixed (BAAI/bge-m3, SiliconFlow) — no picker; it's over-engineering
@@ -308,6 +368,7 @@ export async function handleConfigCommand(ctx, args = []) {
       : label === "agent.subagentTurns" ? (ac.subagentTurns ?? 100)
       : label === "agent.compactThreshold" ? (ac.compactThreshold ?? 100000)
       : label === "agent.consultTurns" ? (ac.consultTurns ?? 40)
+      : label === "traces.retentionHours" ? (tc.retentionHours ?? 24)
       : isTimeout ? Math.round((ac.consultTimeoutMs ?? 600000) / 60000)
       : ""
     const val = await askQuestion(`${label} (current: ${current}${isTimeout ? " min" : ""}):`)
@@ -325,7 +386,7 @@ export async function handleConfigCommand(ctx, args = []) {
       pushLabel("❯ Config", ansi.bold + C.tool)
       pushLine(`${label} = ${isTimeout ? `${val} min (${stored} ms)` : val}`, C.tool)
       pushLine("(restart to apply)", C.dim)
-      running = false
     } catch (error) { pushLine(`Save failed: ${error.message}`, C.error) }
+    // 回主菜单（Esc 退出）——数值输入 Enter 空值也已 continue 于此
   }
 }

package/src/tui/cmd-eng.mjs

@@ -1,11 +1,12 @@
 /** /eng command: toggle engineering mode.
  *  Requires METHODOLOGY.md in project root. Offers to create one if missing.
- *  ctx: { agent, pushLine, pushLabel, persistRaw, showPicker } */
+ *  ctx: { agent, pushLine, pushLabel, showPicker } */
 import { existsSync, copyFileSync, readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from "node:fs"
 import { join, dirname } from "node:path"
 import { fileURLToPath } from "node:url"
 import { ansi, C } from "./ansi.mjs"
 import { activeSlot, slotPath } from "../session.mjs"
+import { purgeExpiredDesignTokens } from "../token-ttl.mjs"
 
 const templateDir = join(fileURLToPath(import.meta.url), "..", "..", "prompts")
 import { ENG_OFF_REMINDER } from "../agent.mjs"
@@ -25,7 +26,7 @@ export function writeSessionFile(p, data) {
 }
 
 export async function handleEngCommand(ctx) {
-  const { agent, pushLine, pushLabel, persistRaw, showPicker } = ctx
+  const { agent, pushLine, pushLabel, showPicker } = ctx
   agent.config.agent ??= {}
   const methodologyPath = join(agent.cwd, "METHODOLOGY.md")
 
@@ -47,31 +48,40 @@ export async function handleEngCommand(ctx) {
   }
 
   agent.config.agent.engineering = !agent.config.agent.engineering
+  // §24 D-24b: per-review instances die with the mode (fresh convergence cycles
+  // on the next toggle).
+  agent._advisorRuns = new Map()
   if (!agent.config.agent.engineering) {
-    agent._engDesignToken = null // invalidate stale token
-    agent._engDesignTokens = new Map() // multi-design slots die with the mode (2026-09-01 fix #2)
+    // R16 (2026-09-06 F-R16a): OFF 不清 token——有效 token 跨模式存活（仅 TTL 过期
+    // 在三清理时机删：恢复过滤 / 开模式清过期 / spawn 门禁拒时删槽）。
     // OFF must reach the model too (2026-08-25): /auto pushes a reminder on toggle — the
     // mode flip is invisible to the agent otherwise. (ON needs none here: the injector
     // in agent.mjs already announces ON transitions on the next turn.)
     agent._pendingReminders = agent._pendingReminders ?? []
     agent._pendingReminders.push(ENG_OFF_REMINDER)
   }
-  await persistEngineering(ctx, agent)
+  // 开工程模式（真实 OFF→ON 转换）→ 清过期 token（有效保留——用户裁定"打开工程
+  // 模式时应该清理"——F-R16b ②——与 eng tool enter 同语义）。
+  const clearedExpired = agent.config.agent.engineering ? purgeExpiredDesignTokens(agent) : 0
+  await persistEngineering(agent)
   pushLabel("❯ Eng", ansi.bold + C.tool)
   pushLine(`Engineering mode: ${agent.config.agent.engineering ? "ON" : "OFF"} (session)`, C.tool)
   if (agent.config.agent.engineering) {
     pushLine(`  → strictly following ${methodologyPath}`, C.dim)
+    if (clearedExpired > 0) {
+      pushLine(`  → cleared ${clearedExpired} expired design token${clearedExpired === 1 ? "" : "s"}; valid tokens from prior reviews stay usable`, C.dim)
+    }
   }
 }
 
 /**
- * Dual persistence (2026-08-29 — engineering is session-level): write the flipped flag into
- * the CURRENT session slot first (slot authority — shared with VS Code, per-session), then
- * the config.json mirror (CLI visibility/compat; no longer the cross-session source of truth).
+ * Slot-only persistence (2026-09-08 — ENG-SESSION-PROVIDER-CLEANUP D1.1): the flipped flag
+ * goes into the CURRENT session slot only — the slot is the sole authority (shared with
+ * VS Code, per-session; config.json is just the initial default, no mirror write).
  * The in-memory agent.config.agent.engineering (already flipped) stays the live authority for
  * this process; saveSession also round-trips it on every turn-end write.
  */
-async function persistEngineering(ctx, agent) {
+async function persistEngineering(agent) {
   const slot = activeSlot(agent.cwd)
   try {
     const p = slotPath(agent.cwd, slot)
@@ -80,11 +90,5 @@ async function persistEngineering(ctx, agent) {
       data.engineering = agent.config.agent.engineering
       writeSessionFile(p, data)
     }
-  } catch { /* slot missing/unreadable — config mirror still written */ }
-  if (ctx.persistRaw) {
-    await ctx.persistRaw((raw) => {
-      raw.agent ??= {}
-      raw.agent.engineering = agent.config.agent.engineering
-    })
-  }
+  } catch { /* slot missing/unreadable — in-memory flag already flipped; saveSession persists at turn end */ }
 }

package/src/tui/cmd-extract.mjs

@@ -7,7 +7,7 @@ export async function handleExtractCommand(ctx) {
   pushLine("[extract] Analyzing session...", C.dim)
   const count = await runDistill()
   const msg = count > 0
-    ? `Knowledge extracted: ${count} candidate(s) saved to memory (agent will recall them via memory_search)`
+    ? `Knowledge extracted: ${count} candidate(s) saved to memory (agent will recall them via the memory tool)`
     : "No new knowledge found in this session."
   pushLine(msg, count > 0 ? C.tool : C.dim)
 }

package/src/tui/cmd-mcp.mjs

@@ -82,9 +82,15 @@ export async function handleMcpCommand(ctx, args = []) {
   }
 
   async function removeServer(name) {
+    // D-F5a（#7）先盘后存：磁盘 fresh raw.mcp.servers 上只删目标条目——不整节写回内存
+    // agent.config.mcp.servers（内存含 reloadMcpFromDisk 的 keptConnected 尾巴——
+    // 整节写回会把对端磁盘上其他 server 的新改动一起抹掉）；冲突放弃不留内存 ghost
+    await persistRaw((raw) => {
+      raw.mcp ??= { servers: [] }
+      if (!Array.isArray(raw.mcp.servers)) return
+      raw.mcp.servers = raw.mcp.servers.filter((s) => s?.name !== name)
+    })
     agent.config.mcp.servers = getServers().filter((s) => s.name !== name)
-    // 评审 #1：磁盘无 mcp 段时（T23 场景——mcp 段被整体删除而连接保留）raw.mcp 为 undefined → 先建段再写
-    await persistRaw((raw) => { raw.mcp ??= { servers: [] }; raw.mcp.servers = agent.config.mcp.servers })
     // Remove from tool list
     const { removeMcpTools } = await import("../mcp.mjs")
     removeMcpTools(agent, name)
@@ -174,6 +180,15 @@ Return ONLY the JSON object:`,
         }],
         tools: [],
         signal: AbortSignal.timeout(15_000),
+        // §18.6 D-TR4/D-TR6（2026-09-04 fix round1）：/mcp ai 生成调用经 chat() 唯一
+        // 采集点——补轨迹元数据 + traces 开关透传（agent.config.traces.enabled——
+        // 关=不落盘必须全覆盖——与 agent.mjs/context.mjs 同模式）
+        logCtx: {
+          stage: "mcp", kind: "mcp",
+          role: agent?._role ?? null,
+          session: agent?._sessionStart ?? null, cwd: agent?.cwd ?? process.cwd(),
+          traces: agent?.config?.traces?.enabled !== false,
+        },
       })
       const jsonMatch = (res.content ?? "").match(/\{[\s\S]*\}/)
       if (!jsonMatch) { pushLine("[mcp] AI response not valid JSON", C.error); return }

package/src/tui/cmd-new.mjs

@@ -9,8 +9,9 @@ export async function handleNewCommand(ctx) {
   const doNewSession = () => {
     const slot = newSession(agent.cwd)
     // 2026-08-31 会诊 F3：resetSessionState 清全量会话态（_fullHistory/title/_sessionStart/
-    // _engDesignToken/压缩与验证计数等）——原实现只清 agent.history，新会话首次落盘把旧
-    // 会话完整人类线 + 旧标题写进新 slot（实锤 .19/.3 双副本）。_slot 更新为粘性新槽位。
+    // 多槽设计凭证（_engDesignTokens——单值镜像 _engDesignToken 已退役 D3）/压缩与验证计数
+    // 等）——原实现只清 agent.history，新会话首次落盘把旧会话完整人类线 + 旧标题写进新
+    // slot（实锤 .19/.3 双副本）。_slot 更新为粘性新槽位。
     resetSessionState(agent)
     agent._slot = slot
     state.tasks = []

package/src/tui/cmd-session.mjs

@@ -1,4 +1,4 @@
-import { listSlots, switchToSlot, applySession, renameSlot, activeSlot, slotOccupancy } from "../session.mjs"
+import { listSlots, switchToSlot, applySession, renameSlot, activeSlot, slotOccupancy, readEndMarker } from "../session.mjs"
 import { ansi, C } from "./ansi.mjs"
 import { restoreLines } from "./startup.mjs"
 import { stringWidth, sliceByWidth } from "./render.mjs"
@@ -19,8 +19,16 @@ export async function handleRenameCommand(ctx, args) {
     pushLine(`Title too long (max 80 chars)`, C.error)
     return
   }
-  if (!renameSlot(agent.cwd, slot, title)) {
-    pushLine(`Rename failed — active session (slot ${slot}) not found`, C.error)
+  // §12.2.5：renameSlot 契约 { ok, reason }——失败原因对用户可见（F3）
+  const r = renameSlot(agent.cwd, slot, title)
+  if (!r.ok) {
+    const why = {
+      "file-missing": `active session (slot ${slot}) not found`,
+      "parse-failure": `session file (slot ${slot}) is corrupted`,
+      "mtime-conflict": "session changed on disk concurrently — retry",
+      "invalid-slot": `invalid slot ${slot}`,
+    }[r.reason] ?? r.reason
+    pushLine(`Rename failed — ${why}`, C.error)
     return
   }
   agent.title = title
@@ -37,6 +45,13 @@ export async function handleSessionCommand(ctx) {
     pushLine("No sessions (use /new to start a new session)", C.dim)
     return
   }
+  // 2026-09-05 §10 D-5：本端高亮按端记录（● = 记录槽 ∈ 列表 ? 记录槽 : manifest active
+  // 回退——含"记录槽已被对端删除"的守卫）；listSlots 的 manifest active 语义不变
+  // （ACP session/list 零变化——manifest active 保留为列表回退高亮）
+  const rec = readEndMarker(agent.cwd)
+  const highlightSlot = (rec?.slot != null && slots.some((s) => s.slot === rec.slot))
+    ? rec.slot
+    : (slots.find((s) => s.isActive)?.slot ?? null)
   const shortDate = (d) => {
     const dt = new Date(d)
     return `${dt.getMonth() + 1}/${dt.getDate()} ${String(dt.getHours()).padStart(2, "0")}:${String(dt.getMinutes()).padStart(2, "0")}`
@@ -53,7 +68,7 @@ export async function handleSessionCommand(ctx) {
       const turns = s.turnCount > 0 ? `${s.turnCount} turns` : "0 turns"
       const when = shortDate(s.updatedAt)
       const model = s.activeProvider ? ` — ${s.activeProvider}` : ""
-      const marker = s.isActive ? " ●" : ""
+      const marker = s.slot === highlightSlot ? " ●" : ""
       return {
         type: "item",
         text: `Slot ${s.slot} │ ${turns} │ ${when} │ ${label}${model}${marker}`,

package/src/tui/cmd-think.mjs

@@ -76,7 +76,7 @@ export async function handleThinkCommand(ctx, args = []) {
     if (e.action === "auto") {
       const newAuto = agent.config?.agent?.autoThink === true
       pushLine(`Auto-think: ${newAuto ? "ON" : "OFF"}`, C.tool)
-      return // exit loop — no useful actions remain when auto mode just changed
+      return // exit loop — no useful actions remain when auto mode just changed (T8b 锁定——toggle 即退是已批准语义——2026-09-05 曾误改 OFF 回菜单——测试抓回归——已撤销)
     } else if (e.action === "effort") {
       pushLine(`Reasoning effort: ${e.level}`, C.tool)
     } else {
@@ -97,16 +97,16 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
       // 开 auto = 要思考：清显式 off 标记（thinking:null，NF1 约定；交付评审 #1）——残留 null
       // 会让 auto 每轮写入的 reasoning_effort 与 enable_thinking:false 矛盾同发（F2 违约）。
       // 仅清 null：thinking-type 模型的 {type:"disabled"} 不在评审 #1 范围，保持既有语义。
-      if (cur.thinking === null) { delete cur.thinking; await syncProviderField("thinking", undefined) }
+      if (cur.thinking === null) { delete cur.thinking; await syncProviderField(agent.activeProvider, "thinking", undefined) }
       delete cur.reasoningEffort
-      await syncProviderField("reasoningEffort", undefined)
+      await syncProviderField(agent.activeProvider, "reasoningEffort", undefined)
     }
   } else if (e.action === "effort") {
     // 选档位 = 要思考：清显式 off 标记（thinking:null，NF1 约定；交付评审 #1）——残留 null 会让
     // enable_thinking:false 与 reasoning_effort 矛盾同发（F2 违约）。仅清 null（同上注释）。
-    if (cur.thinking === null) { delete cur.thinking; await syncProviderField("thinking", undefined) }
+    if (cur.thinking === null) { delete cur.thinking; await syncProviderField(agent.activeProvider, "thinking", undefined) }
     cur.reasoningEffort = e.level
-    await syncProviderField("reasoningEffort", e.level)
+    await syncProviderField(agent.activeProvider, "reasoningEffort", e.level)
   } else {
     const enable = e.action === "on"
     if (isEffortOnly) {
@@ -116,9 +116,9 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
       // "on" 默认 effort 取 spec 枚举首值（交付评审 #2）：硬编码 "high" 对 qwen3.8-max
       // （enum xhigh/medium/low）无效，会被 core.mjs 枚举校验 throw（400 前置）
       else { delete cur.thinking; if (!cur.reasoningEffort) cur.reasoningEffort = spec.reasoningEffortEnum?.[0] ?? "high" }
-      await syncProviderField("thinking", cur.thinking)
-      if (!enable) await syncProviderField("reasoningEffort", undefined)
-      else await syncProviderField("reasoningEffort", cur.reasoningEffort)
+      await syncProviderField(agent.activeProvider, "thinking", cur.thinking)
+      if (!enable) await syncProviderField(agent.activeProvider, "reasoningEffort", undefined)
+      else await syncProviderField(agent.activeProvider, "reasoningEffort", cur.reasoningEffort)
     } else {
       if (enable) {
         cur.thinking = { type: thinkOnValue }
@@ -127,11 +127,11 @@ async function applyThink(e, agent, syncProviderField, spec, isEffortOnly, isCus
         cur.thinking = isCustomThink ? undefined : { type: "disabled" }
         delete cur.reasoningEffort
       }
-      await syncProviderField("thinking", cur.thinking)
+      await syncProviderField(agent.activeProvider, "thinking", cur.thinking)
       if (enable) {
-        await syncProviderField("reasoningEffort", cur.reasoningEffort)
+        await syncProviderField(agent.activeProvider, "reasoningEffort", cur.reasoningEffort)
       } else {
-        await syncProviderField("reasoningEffort", undefined)
+        await syncProviderField(agent.activeProvider, "reasoningEffort", undefined)
       }
     }
   }

package/src/tui/cmd-upgrade.mjs

@@ -1,9 +1,10 @@
 import { ansi, C } from "./ansi.mjs"
+import { upgradeFailureText } from "./update-notice.mjs"
 
 /** /upgrade command: check for updates and optionally upgrade.
  *  ctx: { agent, pushLine, pushLabel, showPicker } */
 export async function handleUpgradeCommand(ctx) {
-  const { pushLine, pushLabel, showPicker } = ctx
+  const { pushLine, pushLabel, showPicker, render } = ctx
   const { checkForUpdate } = await import("../upgrade.mjs")
   const { readFileSync } = await import("node:fs")
 
@@ -31,13 +32,27 @@ export async function handleUpgradeCommand(ctx) {
   pushLine(`Upgrading to ${result.latest}...`, C.tool)
   const { exec } = await import("node:child_process")
   const cp = exec("npm install -g thincoder@latest", { windowsHide: true })
-  cp.stdout?.on("data", () => {})
-  cp.stderr?.on("data", () => {})
+  let stdout = ""
+  let done = false
+  cp.stdout?.on("data", (d) => { stdout += d })
+  cp.stderr?.on("data", (d) => { stdout += d })
+  // 2026-09-05（advisor 🟡#5/#7）：异步回调必须显式 render（pushLine 只写 lines 不绘制——
+  // handleSlash 返回后的统一 render 先于 exec 完成，结论行要等下次输入才可见）；失败文案
+  // 复用 upgradeFailureText（附 npm 输出尾 ≤3 行——与 update-notice 后台路径同诊断能力）
+  cp.on("error", (e) => {
+    if (done) return
+    done = true
+    pushLine(`✗ Upgrade failed (${e.message}). Run \`thincoder upgrade\` manually.`, C.error)
+    render?.()
+  })
   cp.on("close", (code) => {
+    if (done) return
+    done = true
     if (code === 0) {
       pushLine(`✓ Upgraded to ${result.latest}. Restart to apply.`, C.tool)
     } else {
-      pushLine(`✗ Upgrade failed (exit ${code}). Run \`thincoder upgrade\` manually.`, C.error)
+      pushLine(upgradeFailureText(code, stdout), C.error)
     }
+    render?.()
   })
 }

package/src/tui/config-helpers.mjs

@@ -1,26 +1,38 @@
-import { existsSync, readFileSync } from "node:fs"
-
 /** persistRaw / syncProviderField / maskKey: config read/write helpers.
  *  Extracted from index.mjs for shared use by slash-commands, wizard, and pickers.
- *  createConfigHelpers(agent) returns { persistRaw, syncProviderField, maskKey } */
-export function createConfigHelpers(agent) {
-  /** Read config.json → mutate → persist to disk */
+ *  createConfigHelpers(agent) returns { persistRaw, syncProviderField, maskKey }
+ *  R10 F5（D-F5b）：persistRaw 全链（磁盘新鲜读→mutate→写）收口进 config.mjs
+ *  writeConfigAtomic——mtime 门控 + .bak + 冲突放弃（见 MULTI-INSTANCE-COLLAB.md §2a.2）。
+ *  createConfigHelpers(agent, opts)：opts.configPath 为测试注入缝（默认 configPath——
+ *  生产 index.mjs 单参调用零变化）。 */
+export function createConfigHelpers(agent, opts = {}) {
+  const cfgPath = opts.configPath ?? null // null → 默认 configPath（动态 import 解）
+
+  /** 磁盘新鲜读 → mutate（单操作）→ mtime 门控写；冲突时 throw（提示语见下——TUI
+   *  slash 分发层统一 [error] 行展示；调用方若自带 try/catch 展示 Save failed 同文案）。 */
   async function persistRaw(mutate) {
-    const { saveConfig, configPath } = await import("../config.mjs")
-    const raw = existsSync(configPath) ? JSON.parse(readFileSync(configPath, "utf8")) : {}
-    mutate(raw)
-    saveConfig(raw)
+    const { writeConfigAtomic, configPath } = await import("../config.mjs")
+    const r = writeConfigAtomic(cfgPath ?? configPath, mutate)
+    if (!r.ok) throw new Error("config changed on disk concurrently — retry")
   }
 
-  /** Sync a field of the current provider to the providers array and persist to disk */
-  async function syncProviderField(field, value) {
-    const target = agent.providers.find((p) => p.name === agent.activeProvider)
-    if (!target) return
-    if (value === undefined) delete target[field]
-    else target[field] = value
+  /** Sync a field of a provider (by name) to the providers array and persist to disk.
+   *  D-F5a（#1）：磁盘 fresh raw.providers 上单字段补丁——不取 agent.providers 整数组
+   *  （长跑进程的内存 providers 快照不得整体写回——会抹掉对端对磁盘其他改动的保留）。
+   *  内存 agent.providers 目标项同步镜像（旧行为：改内存 + 整节写盘——镜像保留内存
+   *  一致性，磁盘写只剩单字段）。value === undefined → 删除该字段。 */
+  async function syncProviderField(name, field, value) {
+    const mem = agent.providers?.find((p) => p?.name === name)
+    if (!mem) return // 内存无此 provider（旧语义 early return——不产生空写）
     await persistRaw((raw) => {
-      raw.providers = agent.providers
+      raw.providers ??= []
+      const target = raw.providers.find((p) => p?.name === name)
+      if (!target) return // 磁盘目标已被对端删除 → 只做内存镜像，不落盘
+      if (value === undefined) delete target[field]
+      else target[field] = value
     })
+    if (value === undefined) delete mem[field]
+    else mem[field] = value
   }
 
   /** Mask API key for display */

package/src/tui/distill-cmd.mjs

@@ -22,7 +22,7 @@ export async function runDistill(ctx) {
     }
     let saved = 0
     for (const c of candidates) {
-      pushLine(`── Candidate [${c.type}] ${c.title} (scope: ${c.scope ?? "personal"})`, C.warn)
+      pushLine(`── Candidate [${c.type}] ${c.title} (layer: ${c.layer ?? "personal"})`, C.warn)
       for (const line of c.content.split("\n").slice(0, 6)) pushLine(`   ${line}`, C.dim)
       if (c.type === "rule") pushLine("   (rule type — consider writing manually; press y to extract)", C.warn)
       const accept = await askPermission("distill-save", { title: c.title })