docs(includes): R11 注释英文化——75 个文件的中文注释改写为英文短注释

按规范「注释只讲解作用，不掺杂历史原因，尽量英文」：把 includes 下 75 个 .vp 的中文 # 注释与三引号 docstring 改写为英文，每个注释块压到 2 行以内。

保留要点：作用、约束、危险警告（不得/必须/注意）、ABI 与类型约定（如 BYTEPTR | t.CPtr = i8** 的跨模块坍缩坑）、位宽/长度约定、fail-fast 要求、内存与句柄所有权。

未动：文件头注释（规范豁免，仍是中文）、运行时中文字符串常量（printf / fatal_error / MlirFail 等用户可见消息，属代码字面量）。

验证：独立脚本比对 HEAD 与工作区的代码骨架（剥离 # 注释与三引号 docstring 后的非空行）——75 个文件逐字节一致；行尾 CRLF/LF 未被改动；全文剩余中文仅 547 行头注释、0 条行尾注释。bootstrap 三重重编 SUCCESS；全量 77/77 顺序回归通过。

requests/https.vp

@@ -31,21 +31,18 @@ import memhub
 
 define HTTPS_PORT = 443
 
-# 模块内部状态
+# Module-internal state
 _ossl_ready: bool = False
 _socket_ready: bool = False
-_err_store: t.CArray[char, 512]      # 最近一次失败原因（静态缓冲）
-_info_store: t.CArray[char, 512]     # 最近一次成功握手的 TLS 元信息
-_scratch_store: t.CArray[char, 512]  # 临时拼接缓冲
-_last_verify_val: INT = -1              # 最近一次握手后 SSL_get_verify_result（0=通过；-1=未启用）
-_last_verify_flag: INT = -1             # 最近一次请求 verify 标志（1=开启；0=关闭；-1=未知）
+_err_store: t.CArray[char, 512]      # last failure reason (static buffer)
+_info_store: t.CArray[char, 512]     # TLS metadata of last successful handshake
+_scratch_store: t.CArray[char, 512]  # scratch concat buffer
+_last_verify_val: INT = -1              # last SSL_get_verify_result (0=ok; -1=disabled)
+_last_verify_flag: INT = -1             # last request verify flag (1=on; 0=off; -1=unknown)
 
 # ============================================================
-# SSE 流式内容接收区（post_stream 专用；单路请求，UI 线程轮询拉取）
-#   _st_len: 工作线程已写入的内容字节数
-#   _st_consumed: UI 已消费游标（仅拉取方推进）
-#   _st_state: 0=运行中 1=完成(2xx) 2=失败
-#   _st_status: HTTP 状态码（失败网络路径为负错误码）
+# SSE streaming receive area (post_stream only; single request, polled by UI thread).
+#   _st_len written bytes; _st_consumed consumed cursor; _st_state 0=running 1=done(2xx) 2=fail; _st_status HTTP code.
 # ============================================================
 define STREAM_CAP = 262144
 _st_buf: t.CArray[char, 262144]
@@ -57,7 +54,7 @@ _st_err: t.CArray[char, 512]
 
 
 def stream_begin():
-    """开始新一轮流式接收：重置缓冲/游标/状态。"""
+    """Start a new streaming receive: reset buffer/cursor/state."""
     global _st_len, _st_consumed, _st_state, _st_status
     _st_len = 0
     _st_consumed = 0
@@ -67,7 +64,7 @@ def stream_begin():
 
 
 def stream_pull(out: str, cap: INT) -> INT:
-    """拉取未消费的增量内容到 out（自动补 0），返回拷贝字节数。"""
+    """Copy unconsumed delta into out (NUL-terminated); return bytes copied."""
     global _st_consumed
     if out is None or cap <= 1:
         return 0
@@ -84,60 +81,60 @@ def stream_pull(out: str, cap: INT) -> INT:
 
 
 def stream_state() -> INT:
-    """0=运行中 1=完成(2xx) 2=失败。"""
+    """0=running 1=done(2xx) 2=failed."""
     return _st_state
 
 
 def stream_status() -> INT:
-    """HTTP 状态码；负数为网络/解析错误。"""
+    """HTTP status code; negative means network/parse error."""
     return _st_status
 
 
 def stream_error_text() -> str:
-    """失败原因文本（_st_state==2 时）。"""
+    """Failure reason text (when _st_state==2)."""
     return _st_err
 
 
 def last_verify_result() -> int:
-    """返回最近一次握手的证书校验结果：0 通过；>0 失败码；-1 未开启校验。"""
+    """Last cert verify result: 0=ok; >0=failure code; -1=verify disabled."""
     return _last_verify_val
 
 
 def last_verify_enabled() -> int:
-    """返回最近一次请求是否开启校验（1=是；0=否；-1=未知）。"""
+    """Whether last request enabled verify (1=yes; 0=no; -1=unknown)."""
     return _last_verify_flag
 
 
 # ============================================================
-# 内部辅助
+# Internal helpers
 # ============================================================
 
 def last_error() -> str:
-    """返回最近一次失败的原因文本（无则空串）。"""
+    """Last failure reason text (empty string if none)."""
     return _err_store
 
 
 def last_tls_info() -> str:
-    """返回最近一次成功握手的 TLS 信息（版本/套件/对端主题），无则空串。"""
+    """Last successful handshake TLS info (version/cipher/peer subject), empty if none."""
     return _info_store
 
 
 def _RecordErrorText(text: str):
-    """把失败原因写入静态缓冲 _err_store。"""
+    """Write failure reason into static buffer _err_store."""
     if text is None: return
     _err_store[0] = 0
     stdio.snprintf(_err_store, 512, "%s", text)
 
 
 def _RecordInfoText(text: str):
-    """把 TLS 元信息写入静态缓冲 _info_store。"""
+    """Write TLS metadata into static buffer _info_store."""
     if text is None: return
     _info_store[0] = 0
     stdio.snprintf(_info_store, 512, "%s", text)
 
 
 def _EnsureReady() -> INT:
-    """初始化 socket 与 openssl（均幂等）。"""
+    """Initialize socket and openssl (both idempotent)."""
     global _socket_ready, _ossl_ready
     if not _socket_ready:
         if socket.SocketInit() != 0:
@@ -153,13 +150,13 @@ def _EnsureReady() -> INT:
 
 
 def _ParseHttpsUrl(url: str, host_buf: str, host_size: INT, path_buf: str, path_size: INT, port: INT*) -> INT:
-    """解析 https://host[:port][/path]，端口缺省 443。"""
+    """Parse https://host[:port][/path]; default port 443."""
     if url is None: return -1
     if host_buf is None or path_buf is None or port is None: return -1
 
     p: str = url
 
-    # Skip "https://"（8 字节）
+    # Skip "https://" (8 bytes)
     if string.strncmp(p, "https://", 8) == 0:
         p += 8
 
@@ -204,12 +201,12 @@ def _ParseHttpsUrl(url: str, host_buf: str, host_size: INT, path_buf: str, path_
 
 
 def _ScratchBuf() -> str:
-    """返回静态拼接缓冲（512B，复用）。"""
+    """Return static concat buffer (512B, reused)."""
     return _scratch_store
 
 
 def _TlsErrText():
-    """把最近一次 openssl 错误队列文本写入静态 scratch 缓冲。"""
+    """Write last openssl error-queue text into static scratch buffer."""
     e: uint32 = openssl.ERR_get_error()
     if e == 0:
         _scratch_store[0] = 0
@@ -219,16 +216,12 @@ def _TlsErrText():
 
 
 # ============================================================
-# 核心请求
+# Core request
 # ============================================================
 
 def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str, content_type: str, auth: str = None) -> rawptr[requests.Response]:
-    """HTTPS GET/POST 核心实现。
-
-    verify=False 时跳过证书链/主机名校验（不推荐）；verify=True 时
-    ca_file 提供 PEM CA bundle，否则使用系统默认 CA 路径。
-    auth（可选）：形如 "Bearer <key>" 的 Authorization 头值，
-    非空时仅在 POST 请求头中插入 Authorization 头（默认 None = 行为不变）。
+    """HTTPS GET/POST core. verify=False skips cert chain/hostname checks (not recommended);
+    verify=True uses ca_file PEM bundle (else system default); auth adds Authorization header on POST only.
     """
     global _last_verify_val, _last_verify_flag
     if requests._mbuddy is None: return None
@@ -242,13 +235,13 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
         requests.release(resp)
         return None
 
-    # 临时缓冲（错误文本格式化；openssl 详情走模块级 scratch）
+    # Temp buffer for error text; openssl details go to module scratch.
     errmsg: str = requests._mbuddy.alloc(512)
     if errmsg is None:
         requests.release(resp)
         return None
 
-    # ---- 解析 URL ----
+    # ---- Parse URL ----
     host_buf: t.CArray[char, 256]
     path_buf: t.CArray[char, 1024]
     port: INT = 0
@@ -260,7 +253,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
         requests.release(resp)
         return None
 
-    # ---- 建立 TCP 连接 ----
+    # ---- Establish TCP connection ----
     sock = socket.Socket(socket.AF_INET, socket.SOCK_STREAM)
     if sock.fd == socket.INVALID_SOCKET:
         _RecordErrorText("socket() failed")
@@ -298,7 +291,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
                 requests.release(resp)
                 return None
         else:
-            # 系统默认路径（Windows 上通常为空，证书链校验将失败）
+            # System default paths (usually empty on Windows; cert chain check will fail).
             openssl.SSL_CTX_set_default_verify_paths(ctx)
     else:
         openssl.SSL_CTX_set_verify(ctx, openssl.SslVerifyNone, None)
@@ -313,13 +306,13 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
         return None
 
     openssl.SSL_set_fd(ssl, sock.fd)
-    # SNI（SSL_set_tlsext_host_name 是宏 → 直接 SSL_ctrl）
+    # SNI (SSL_set_tlsext_host_name is a macro -> call SSL_ctrl directly)
     openssl.SSL_ctrl(ssl, openssl.SslCtrlSetTlsextHostname, openssl.TlsextNametypeHostName, host_buf)
-    # 主机名校验（TLS 内核对证书 SAN/CN 与 host 比对）
+    # Hostname verification (TLS core compares cert SAN/CN against host)
     if verify:
         openssl.SSL_set1_host(ssl, host_buf)
 
-    # ---- 握手 ----
+    # ---- Handshake ----
     hret: INT = openssl.SSL_connect(ssl)
     if hret <= 0:
         want: INT = openssl.SSL_get_error(ssl, hret)
@@ -333,13 +326,13 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
         requests.release(resp)
         return None
 
-    # ---- 记录最近一次证书校验结果（供 last_verify_result 查询）----
+    # ---- Record last cert verify result (for last_verify_result) ----
     if verify:
         _last_verify_val = INT(openssl.SSL_get_verify_result(ssl))
     else:
         _last_verify_val = -1
 
-    # ---- 证书链校验结果复核 ----
+    # ---- Re-check cert chain verify result ----
     if verify:
         vres: int32 = openssl.SSL_get_verify_result(ssl)
         if vres != 0:
@@ -356,7 +349,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
             requests.release(resp)
             return None
 
-    # ---- 记录 TLS 元信息（版本 / 套件 / 对端证书主题）----
+    # ---- Record TLS metadata (version / cipher / peer subject) ----
     name_buf: str = requests._mbuddy.alloc(512)
     if name_buf is not None:
         peer: openssl.X509Ptr = openssl.SSL_get1_peer_certificate(ssl)
@@ -378,7 +371,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
         _RecordInfoText(errmsg)
         requests._mbuddy.free(name_buf)
 
-    # ---- 组请求头并发送 ----
+    # ---- Build request headers and send ----
     req_buf: str = requests._mbuddy.alloc(requests.HTTP_BUFSIZ)
     if req_buf is None:
         _RecordErrorText("alloc request buffer failed")
@@ -394,7 +387,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
     if is_post:
         body_len = INT(string.strlen(data)) if data is not None else 0
         ct: str = content_type if content_type is not None else "application/x-www-form-urlencoded"
-        # 分段组头，便于按需插入 Authorization（auth 非空才加，默认路径输出与原来完全一致）
+        # Build header in stages so Authorization can be inserted on demand (only when auth non-empty).
         hdr_off: INT = 0
         hdr_cap: INT = requests.HTTP_BUFSIZ
         stdio.snprintf(req_buf, hdr_cap, "POST %s HTTP/1.1\r\nHost: %s\r\n", path_buf, host_buf)
@@ -429,7 +422,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
 
     requests._mbuddy.free(req_buf)
 
-    # ---- 接收响应(缓冲自动翻倍增长, 支持 MB 级正文, 如 MNIST .gz 下载) ----
+    # ---- Receive response (buffer auto-doubles, supports MB bodies) ----
     resp_cap: INT = requests.HTTP_BUFSIZ
     resp_buf: str = requests._mbuddy.alloc(sizet(resp_cap))
     if resp_buf is None:
@@ -445,7 +438,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
     while True:
         room: INT = resp_cap - 1 - total
         if room <= 0:
-            # 缓冲已满仍可能有数据: 翻倍扩容(硬上限 256MB, 防失控流)
+            # Buffer full but more data may follow: double capacity (hard cap 256MB, runaway-guard).
             if resp_cap >= 268435456:
                 break
             resp_cap = resp_cap * 2
@@ -468,7 +461,7 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
 
     resp_buf[total] = 0
 
-    # 关闭 TLS 与 TCP
+    # Close TLS and TCP
     openssl.SSL_shutdown(ssl)
     openssl.SSL_free(ssl)
     openssl.SSL_CTX_free(ctx)
@@ -482,14 +475,12 @@ def _HttpsRequest(method: str, url: str, verify: bool, ca_file: str, data: str,
 
 
 # ============================================================
-# 公共 API
+# Public API
 # ============================================================
 
 def _HttpsRedirectLoop(method: str, url: str, verify: bool, ca_file: str, data: str, content_type: str, auth: str = None) -> rawptr[requests.Response]:
-    """HTTPS GET/POST + 重定向跟随（跨 http/https，最多 5 跳）。
-
-    auth（可选）原样透传给 _HttpsRequest；None 时行为与原来完全一致。
-    注意：跨主机重定向时 Authorization 同样会透传（仅提示，逻辑未改动）。
+    """HTTPS GET/POST with redirect following (cross http/https, max 5 hops).
+    auth is passed through to _HttpsRequest; note Authorization also follows cross-host redirects.
     """
     if requests._mbuddy is None: return None
 
@@ -535,7 +526,7 @@ def _HttpsRedirectLoop(method: str, url: str, verify: bool, ca_file: str, data:
             return None
         requests.release(resp)
 
-        # 跨协议分流：https → 继续本循环；http → 交给 requests（http）链
+        # Cross-scheme dispatch: https -> continue loop; http -> hand to requests (http) chain
         if string.strncmp(nxt, "https://", 8) != 0:
             requests._mbuddy.free(loc)
             requests._mbuddy.free(cur)
@@ -553,50 +544,27 @@ def _HttpsRedirectLoop(method: str, url: str, verify: bool, ca_file: str, data:
 
 
 def get(url: str, verify: bool = True, ca_file: str = None) -> rawptr[requests.Response]:
-    """HTTPS GET request（自动跟随 3xx 重定向，最多 5 跳）。
-
-    Args:
-        url: Full URL (e.g., "https://example.com/path")
-        verify: True 时校验证书链 + 主机名（默认）
-        ca_file: PEM CA bundle 路径；None 时使用系统默认 CA 路径
-    Returns:
-        Pointer to a Response object, None on failure (see last_error()).
+    """HTTPS GET (follows 3xx redirects, max 5 hops). verify checks cert chain + hostname;
+    ca_file is a PEM CA bundle path, None uses system default. Returns Response* or None.
     """
     return _HttpsRedirectLoop("GET", url, verify, ca_file, None, None)
 
 
 def post(url: str, data: str = None, content_type: str = "application/x-www-form-urlencoded",
          verify: bool = True, ca_file: str = None, auth: str = None) -> rawptr[requests.Response]:
-    """HTTPS POST request（自动跟随 3xx 重定向，最多 5 跳）。
-
-    Args:
-        url: Full URL
-        data: Request body data
-        content_type: Content-Type header
-        verify: True 时校验证书链 + 主机名（默认）
-        ca_file: PEM CA bundle 路径；None 时使用系统默认 CA 路径
-        auth: 可选 Authorization 头值（形如 "Bearer <key>"），
-              非空时随请求头发送；None/空串 = 与旧版完全一致。
-    Returns:
-        Pointer to a Response object, None on failure (see last_error()).
+    """HTTPS POST (follows 3xx redirects, max 5 hops). verify checks cert chain + hostname;
+    ca_file PEM CA bundle (None = system default); auth optional "Bearer <key>", sent when non-empty.
     """
     return _HttpsRedirectLoop("POST", url, verify, ca_file, data, content_type, auth)
 
 
 # ============================================================
-# SSE 流式 Chat Completions（post_stream）
-#
-# 与 post() 不同：请求头带 Accept: text/event-stream；响应体按行解析
-# SSE（data: {json}），把每段 choices[0].delta.content 抽进 _st_buf 供
-# UI 线程 stream_pull() 增量拉取显示。全程阻塞读取，应在后台线程调用。
-#
-# 返回: >=0 HTTP 状态码（2xx 正常完成；3xx/4xx/5xx 状态仍返回给调用方，
-#       正文中的非 SSE 内容不会进 _st_buf）；-1/-2 网络/解析失败
-#       （_st_state=2，失败原因见 stream_error_text()/last_error()）。
+# SSE streaming Chat Completions (post_stream): sends Accept: text/event-stream and extracts
+# choices[0].delta.content from data:{json} lines into _st_buf; blocking, returns HTTP status or -1/-2.
 # ============================================================
 
 def _SseDeltaContent(root: rawptr[json.JsonValue]) -> str:
-    """从流式 data 事件取 choices[0].delta.content；缺失返回 None。"""
+    """Extract choices[0].delta.content from a stream data event; None if absent."""
     if root is None or not root.is_object():
         return None
     cv: rawptr[json.JsonValue] = root["choices"]
@@ -615,7 +583,7 @@ def _SseDeltaContent(root: rawptr[json.JsonValue]) -> str:
 
 
 def _StreamAppendContent(txt: str):
-    """把一段增量内容追加到 _st_buf（超容量则截断丢弃并记录）。"""
+    """Append delta content to _st_buf (truncate on overflow)."""
     global _st_len
     if txt is None:
         return
@@ -631,7 +599,7 @@ def _StreamAppendContent(txt: str):
 
 
 def _SetStreamFail(rc: INT):
-    """流式失败收尾：从 _err_store 拷原因文本并置状态。"""
+    """Finish stream failure: copy reason from _err_store and set state."""
     global _st_state, _st_status
     _st_state = 2
     _st_status = rc
@@ -640,10 +608,8 @@ def _SetStreamFail(rc: INT):
 
 def post_stream(url: str, data: str, content_type: str = "application/json",
                 verify: bool = True, ca_file: str = None, auth: str = None) -> INT:
-    """SSE 流式 POST（阻塞，应在后台线程调用）。
-
-    data 应为已含 "stream":true 的 JSON 请求体。
-    返回 HTTP 状态码；负数为网络/解析失败（_st_state=2）。
+    """SSE streaming POST (blocking; call from a background thread). data must be a JSON body
+    containing "stream":true. Returns HTTP status; negative means network/parse failure.
     """
     global _st_state, _st_status
     if requests._mbuddy is None:
@@ -652,12 +618,12 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
     _st_state = 0
     _st_status = 0
 
-    # Winsock/openssl 初始化（幂等；流式首次可能在后台线程执行）
+    # Winsock/openssl init (idempotent; first call may run on a background thread)
     if _EnsureReady() != 0:
         _SetStreamFail(-1)
         return -1
 
-    # ---- 连接/TLS（与 _HttpsRequest 一致）----
+    # ---- Connect/TLS (same as _HttpsRequest) ----
     errmsg: str = requests._mbuddy.alloc(512)
     if errmsg is None:
         return -1
@@ -754,7 +720,7 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
             requests._mbuddy.free(errmsg)
             return -1
 
-    # ---- 组请求头（POST + Accept: text/event-stream）并发送 ----
+    # ---- Build request headers (POST + Accept: text/event-stream) and send ----
     req_buf: str = requests._mbuddy.alloc(requests.HTTP_BUFSIZ)
     if req_buf is None:
         _RecordErrorText("alloc request buffer failed")
@@ -794,7 +760,7 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
         openssl.SSL_write(ssl, data, body_len)
     requests._mbuddy.free(req_buf)
 
-    # ---- 读取响应：跳过响应头 → SSE 行解析 → 抽 delta.content ----
+    # ---- Read response: skip headers -> parse SSE lines -> extract delta.content ----
     rd: str = requests._mbuddy.alloc(16384)
     if rd is None:
         _RecordErrorText("alloc stream buffer failed")
@@ -805,7 +771,7 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
         requests._mbuddy.free(errmsg)
         return -1
 
-    # JSON 解析池（事件粒度 reset，足够容纳单个 data 事件）
+    # JSON pool (reset per event, sized for one data event)
     pmem: str = stdlib.malloc(524288)
     if pmem is None:
         _RecordErrorText("alloc json pool failed")
@@ -829,15 +795,15 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
         if n <= 0:
             break
         had_read = 1
-        # 1) 追加到 leftover
+        # 1) Append to leftover
         ai: INT = 0
         while ai < n and llen < 16383:
             leftover[llen] = rd[ai]
             llen += 1
             ai += 1
-        # 2) 逐行处理
+        # 2) Process line by line
         while True:
-            # 找行尾 \n
+            # Find line end \n
             nl: INT = -1
             for k in range(llen):
                 if leftover[k] == 10:
@@ -852,7 +818,7 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
             line: str = leftover
             if header_done == 0:
                 if string.strncmp(line, "HTTP/", 5) == 0:
-                    # 状态码：HTTP/1.1 200 OK
+                    # Status code: HTTP/1.1 200 OK
                     sp: INT = 0
                     while line[sp] != 0 and line[sp] != ' ':
                         sp += 1
@@ -878,13 +844,13 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
                                 dtx: str = _SseDeltaContent(ev)
                                 if dtx is not None:
                                     _StreamAppendContent(dtx)
-            # 3) 移除已处理行
+            # 3) Remove processed line
             rem: INT = llen - (nl + 1)
             for j2 in range(rem):
                 leftover[j2] = leftover[nl + 1 + j2]
             llen = rem
 
-    # ---- 收尾 ----
+    # ---- Wrap up ----
     openssl.SSL_shutdown(ssl)
     openssl.SSL_free(ssl)
     openssl.SSL_CTX_free(ctx)
@@ -911,21 +877,15 @@ def post_stream(url: str, data: str, content_type: str = "application/json",
 
 
 # ============================================================
-# 大文件 Range 下载原语（requests.download 使用，与 requests._DlOnce 镜像）
-#
-# 线程安全：本函数不使用 _mbuddy（请求/响应缓冲一律 stdlib），每个连接独立
-# SSL_CTX/SSL/socket，供多线程并行切片并发调用（OPENSSL_init_ssl 由主线程
-# 先 _EnsureReady 预热一次）。
-#
-# 返回: >=0 响应体字节数；-1 参数错；-2 3xx 重定向（Location 写 out_loc）；
-#       -3 其它失败（last_error() 查看原因）。
+# Large-file Range download primitive for requests.download. Thread-safe: no _mbuddy,
+# independent SSL_CTX/SSL/socket per connection. Returns body bytes>=0; -1 arg; -2 redirect; -3 failure.
 # ============================================================
 
 def _DlOnce(url: str, start: sizet, count: INT, verify: bool, ca_file: str,
             dst: str, dst_cap: INT, out_status: INT*,
             out_loc: str, out_loccap: INT,
             out_total: sizet*) -> INT:
-    """HTTPS 单次 Range 拉取（线程安全，见模块注释）。"""
+    """HTTPS single Range fetch (thread-safe; see module comment)."""
     global _last_verify_val, _last_verify_flag
     if url is None or dst is None or dst_cap <= 0 \
             or out_status is None or out_total is None:
@@ -1005,7 +965,7 @@ def _DlOnce(url: str, start: sizet, count: INT, verify: bool, ca_file: str,
     else:
         _last_verify_val = -1
 
-    # 组 Range 请求头（不带 Accept-Encoding，保证响应为原始字节）
+    # Build Range request header (no Accept-Encoding, so response is raw bytes)
     req: str = stdlib.malloc(1024)
     if req is None:
         openssl.SSL_free(ssl)