把 transcribe 的 command body 抽進 library，讓那個分支變成可執行的程式碼（#136 四輪的結構性根因）

[kiki830621]

Problem

Transcribe.run() 的 body 目前只能用原始碼文字比對來驗證，因為它無條件呼叫 CommandCore.live()（硬寫死六個引擎 + ExternalEngineRegistry），而 $HOME 不是 seam——NSHomeDirectory() 在 Darwin 上忽略它（實測過兩次）。所以指向假 home 的 subprocess 測試會靜默載入開發者真實的 ~/.bestasr/engines.json，甚至可能 spawn 真模型。

結果是 #136 花了四輪、每輪都在加固同一個 text pin，而每一輪的加固都打開了下一個洞：

輪次	加了什麼	下一輪發現的洞
R1	把 #50 改成 warning	資料層測了，行為層沒測
R2	釘住 rendering	wiring 沒測（call-site if explain guard 可原樣裝回）
R3	釘住 wiring（文字比對）	report 的 stream 預設值沒人執行
R4	加 probe 執行預設值 + lock 改位置錨定	位置錨定丟掉了引數保護；probe 自己的呼叫形狀沒釘
R5	引數 label pin + lexer + fixture pin	？

R4 的 DA 實測出這條路的天花板：把 guard explain else { return } 從 runMapped { 內移到 func run() 裡、runMapped 之前 → 即使套上全套補救仍然全綠。再往外還有 runMapped 本身、以及 BestASR.configuration 的 subcommands: 陣列（把 Transcribe.self 拿掉，bestasr transcribe 整個消失，而 DecodeKnobsTests 只用 Transcribe.parse(...)、不經 root command，不會發現）。

text pin 的涵蓋範圍恆等於它錨定的那一層 lexical 區塊。 沒有任何有限的 anchor 集合能封住外層。

Type

refactor

方向（未定案）

// BestASRKit
public enum TranscribeCommandBody {
    public static func run(core: CommandCore, request: SelectionRequest, explain: Bool,
                           out: UnsafeMutablePointer<FILE> = stdout,
                           err: UnsafeMutablePointer<FILE> = TranscribeDiagnostics.destination
    ) async throws { … }
}

// Sources/bestasr
func run() async throws {
    try await runMapped { try await TranscribeCommandBody.run(core: .live(), …) }
}

好處是真的：guard／ordering／stream 全部變成可執行的 code，測試直接驅動，不再靠文字近似。

誠實邊界（這是為什麼它不該塞進 #136）

抽取不消除殘留，只縮小它。 有人仍然可以在 Transcribe.run() 那一行 delegation 前面加 guard explain else { return }，而那一行仍然沒有測試涵蓋——所以抽取之後你還是需要一個 text pin，只是它要守的東西從「一整個多語句 body」縮成「一行純轉發」。殘留面積降一個數量級，不是降到零。

這是 refactor 不是 bug fix。#136 的行為缺陷在 PR #141 已修好並經 28 個 mutation 驗證；把架構改動塞進去會讓那個 PR 的 diff 與風險都翻倍。

R4 的 DA 明確建議：先套 pin 收掉 #136，抽取另開——本 issue 即是。

發現於 PR #141 round-4 verify（DA §1.6）。相關：#136。

[kiki830621]

Round-5 of PR #141 prototyped this and measured it. Two results change the plan here:

1. The residue is larger than this issue estimates. Round 4's DA said extraction leaves "a guard in front of the delegation line". Measured (474/474 green prototype): the delegation line still needs pins for the guard, explain forwarding, stream override, statement-after, deletion, and #if. Five assertions become four — and still need the lexer, the uniqueness count and the argument splitter, because they still read a source file.

2. Extraction creates a new hole one level down. TranscribeCommandBody.run grows its own out:/err: defaults; every executed test passes both explicitly and the probe measures report's defaults, not the body's. Measured: body_err_default_stdout → GREEN. That is exactly the round-4 blocking finding, reappearing inside its own remedy.

A third option was costed and dominates both: a seam on CommandCore.live() (@TaskLocal static var injected, +6/−1 production lines, zero new targets, BestASRCommand.swift untouched) makes Transcribe.run() executable under test. It catches four regressions only execution can see, including a vanishing --explain flag that both the shipped pin and a hardened candidate miss.

This issue is not closed by that — extraction may still be worth doing for its own reasons — but if it is done, it must come with a probe for the body's own defaults, or it re-opens what it was meant to fix.

[kiki830621]

Superseded in practice by 1afa2ee on PR #141, though not closed by it.

Round 5 measured all three options. Extraction as specified here would have left a larger residue than this issue estimates and created a fresh untested-defaults hole one level down (TranscribeCommandBody.run grows its own out:/err: defaults; the prototype measured that mutation green). What shipped instead is the seam: CommandCore.injected, plus moving only Transcribe into a non-product library target so the probe can run it.

That gets what this issue wanted — the branch becomes executable code — without the residue, because the test drives the command end to end rather than driving an extracted body while a text pin guards the delegation.

Leaving this open only if there is an independent reason to extract a TranscribeCommandBody (there may not be). If not, it can be closed as done-by-other-means.