@itookit/dsht 0.6.0 → 0.6.3

package/README.md

@@ -345,7 +345,7 @@ Tab completes the leading slash command, extending an ambiguous draft to the sha
 | `/permission [preset]` | View or switch the host sandbox/approval preset |
 | `/feedback TEXT` | Record feedback about the current session |
 | `/handoff` | Delete the local HANDOFF.md, then have the agent write a fresh session handoff |
-| `/loop [name\|stop\|answer] [score] [tries]` | Pick a loop record from a list, edit the inputs and limits it starts from, then run the scored loop; records are the shipped `loop.yaml` with any `loop.yaml` from the config directory merged over it; `stop`/`abort` ends the run and `answer TEXT` supplies what a paused verifier asked for |
+| `/loop [name\|stop\|answer] [score] [tries]` | Pick a loop record from a list, edit the inputs and limits it starts from, then run the scored loop; records are read from the config directory's `loop.yaml`, created and merged from the shipped file; `stop`/`abort` ends the run and `answer TEXT` supplies what a paused verifier asked for |
 | `/export [local.zip]` | Download the session log ZIP to a new local file |
 | `/export-html [local.html]` | Save the loaded conversation as offline HTML with diagrams and math |
 | `/coredump [tag]` | Write a V8 heap snapshot to the working directory for memory diagnosis |
@@ -374,7 +374,7 @@ A command that would write to the conversation while the agent is working — `/
 
 `/loop [name|stop|answer] [score] [tries]` runs one record from `loop.yaml` as a **client-driven** loop, and it is meant to be chosen rather than typed. Typing `/loop` lists every record under the composer with its rounds, artifact, declared defaults and any input it is pointed at; ↑/↓ selects, Enter confirms the highlighted record, and Tab inserts its name for anyone who wants to add flags. Confirming opens a parameter list pre-filled with that record's own inputs first — for `designdoc-review`, the `path` of the document under review — followed by the shared limits `From`, `To`, `Pass`, `Tries`; a value is replaced by typing over it, the inputs as free text and the limits as numbers checked exactly as the flags are, leaving a row with the arrows or Enter commits what was typed so no box needs its own confirmation, `Start run` launches, and `← Choose another record` goes back; nothing runs until Start is pressed, so a default is always visible before it is spent. Editing a record's input retargets that one run and leaves `loop.yaml` alone, so `designdoc-review` reviews any document and `design-review` is unaffected. Passing any flag on the line (`/loop design-review 9 3`, `--from`, `--to`, `--score`, `--tries`) skips the form and runs exactly what was typed, which keeps scripted and headless use unchanged, and a name that does not exist lists the records that do. The record itself owns the rounds, their checklists, any extra standard, its fixed inputs and the defaults: this client sends the round's brief, an independent `dsht` process verifies the work in a session of its own and writes a verdict file back, and the client decides what comes next — a score at or above the passing mark advances to the next round, a lower score costs one attempt, and a round that exhausts its budget stops the run. The shipped records are `design-review` (ten rounds over the module design) and `designdoc-review` (the same loop over the document named by the record's `vars.path`, keeping one review file per document next to it — `tui-design.md.review.md`, `loop.md.review.md` — so retargeting a run never reads or overwrites another document's rounds; that file is a template in the record, `{{path}}.review.md`, and it is gitignored). `blocked` stops the run at once instead of spending the attempt budget, a verifier that cannot judge asks for a person instead and stops it the same way (headless runs exit 3), a round is only accepted once the client itself has checked that the round's own section reached the artifact file, and `--deadline <minutes>` bounds the whole run. A `passed` run only ever claims the rounds it covered and says which ones (`rounds 1–3/10 · selected range`); a run over the whole record ends on the consolidation round, whose verifier is handed every earlier round's checklist to re-check, so a later round that broke an earlier requirement cannot pass unnoticed. A round that starts by verifying runs inside the forked verifier's own session, so the selected session's conversation stays empty until a round fails and asks the agent to work; the progress line says `verifying step N · attempt M` while that check runs, the status bar reports the same work (`◐` with the loop's step) instead of claiming Ready, and a verifier that cannot produce a verdict reports a structured reason — its exit code plus what the child itself reported (no JSON verdict in the reply, or no reply committed after the turn) rather than the class of its error output alone — instead of waiting in silence, and the verifier is handed the run's own inputs, so it cannot judge a document the artifact only mentions from an earlier run, and `--trace-verbose` adds the sanitized last line. A progress line above the composer shows the round, attempt and best score; sending an ordinary message, `/loop stop`, `/cancel`, Esc, Ctrl+C, switching sessions or losing the connection all stop the loop, which is never persisted. `/loop stop` is a control command, so it is admitted while the run is in flight; with nothing running it says so instead of failing, and the finished run's progress line stays readable — the line that ended it still shows the result, and the next line you run clears it. A verifier that cannot judge *pauses* the run instead of ending it: the progress line and the status bar say `needs you`, `/loop answer TEXT` adds the missing condition and re-judges the current artifact under a new verification identity without spending an attempt or sending the agent anything, and `/loop abort` (the paused spelling of `/loop stop`) ends the run.
 
-The shipped `loop.yaml` is read at startup rather than compiled in, so the records are configuration: the file travels in the package, and a `loop.yaml` in the configuration directory (`$DSHT_CONFIG_DIR`, default `~/.config/dsht`) layers over it. A record with the same name **replaces** the shipped one whole, a new name adds a record, and every record your file does not name keeps following the package — which is why an upgrade still fixes shipped records you did not override. `DSHT_LOOP_FILE` points at another file instead. The record list says so: rows from your file are marked `· yours` and the file is named above them. An invalid file stops the client at startup with the path and the field at fault; a shipped file that cannot be read falls back to the records compiled into the build. Because a record you override can never be updated for you, the shipped definition's digest is stamped under the state directory and the first start after it changes reports that the shipped update is not reaching your copy — your file still wins, and nothing ever rewrites it.
+The runtime `loop.yaml` lives in the configuration directory (`$DSHT_CONFIG_DIR`, default `~/.config/dsht`). On first startup the client copies the shipped file there. On later starts it merges new or changed shipped records into that file while preserving records and defaults you edited; a same-name record is kept whole. The last merged shipped digests are stored beside it in `loop.yaml.seed.json`. `DSHT_LOOP_FILE` selects another runtime file, which is created and merged in the same way. The record list marks your edits and additions `· yours`. An invalid runtime file stops startup with its path and the faulty field; an unreadable shipped file falls back to the compiled-in records. If a shipped record changes while your edited copy remains, the first start after the update warns that your copy did not receive it.
 
 A file reference sends only `@path` in a text block. Harness instructs the model to read the referenced file or list the directory when needed; the TUI does not read local files, upload bytes, or expand contents into the prompt. Referencing an image path does not attach image data. Local attachments, image uploads/previews, and `@` session references are not implemented.
 
@@ -430,7 +430,7 @@ History separates semantic message blocks, prompt/reasoning summaries, view-only
 
 The client reads complete histories in the background on connection, every 60 seconds, at turn completion, and when opening `/cost`. Every new connection re-reads every session once, because the host keeps running while this client is disconnected and a recorded update time cannot show what happened during the gap; within one connection, idle sessions whose host update timestamp has not moved are skipped. No model requests are made by billing. Esc or Ctrl+C cancels an explicit refresh. The ledger counts disjoint uncached input, cache read/write and output buckets; reasoning is already part of output. Retries count separately, replacement samples update their attempt, and fork-inherited history is excluded. A request that reports no usable usage, no settlement timestamp, or a cache-write bucket the official table does not price is counted as unpriced instead of being guessed at, and a model no entry covers stays unpriced; an unlisted provider is never billed from the official table. Every listed session is read independently, so one unreachable or rejected session is reported as a failure count instead of stopping the scan, and a subagent child is read under its durable parent address. Failed scans retain labelled partial cached totals.
 
-The bundled CNY rates were checked against the [official pricing page](https://api-docs.deepseek.com/zh-cn/quick_start/pricing/) on 2026-09-10. Beijing weekday peak windows are 09:00–12:00 and 14:00–18:00; other times use half-price rates. Flash peak cache-miss-input/cache-hit-input/output rates are ¥2/¥0.04/¥8 per million tokens and Pro rates are ¥9/¥0.30/¥27; the current model name is `deepseek-flash`, and older Flash names keep those same rates. The provider has announced that from 2026-09-14T12:00+08:00 it serves `deepseek-v4-pro` from Flash and bills it at Flash rates, which the bundled entry records so that date does not overstate Pro usage. Separate cache writes use the uncached-input rate. An exact configured model price takes priority; otherwise `deepseek-official` names containing `pro` (case-insensitive) use Pro and all other names use Flash, including temporary model aliases. Other providers require explicit entries.
+The bundled CNY rates were checked against the [official pricing page](https://api-docs.deepseek.com/zh-cn/quick_start/pricing/) on 2026-09-24. Beijing peak windows are 09:00–12:00 and 14:00–18:00 on weekdays excluding Chinese public holidays; other times use half-price rates. Holiday dates come from the installed `workday-cn` package, which must be updated when a new year's official schedule is published. Flash peak cache-miss-input/cache-hit-input/output rates are ¥2/¥0.04/¥8 per million tokens and Pro rates are ¥9/¥0.30/¥27. The current Flash model is `deepseek-flash`, and the listed older Flash aliases keep its rates. DeepSeek [continues to bill V4 Pro at its own rates](https://api-docs.deepseek.com/zh-cn/updates/) after September 14. Separate cache writes use the uncached-input rate. Only explicitly listed models and aliases are priced; other providers require their own entries.
 
 The default price validity starts at Beijing midnight on the verification date; this is a local estimate policy, not a claim about the official effective date. Earlier usage needs historical price entries. The recorded assistant settlement timestamp selects the rate; requests spanning a tariff boundary may differ from the invoice because the official page does not specify their attribution. Images use provider-reported tokens. A scan folds the history again with the table it holds, so a stored total is a projection of the log and the table: editing `prices.json` re-prices the requests it covers on the next scan, and a request no entry covered is priced as soon as one does.
 

package/README.zh.md

@@ -345,7 +345,7 @@ Tab 补全开头的 slash 命令，多个候选时补到公共前缀；回车也
 | `/permission [preset]` | 查看或切换服务端沙箱与审批预设 |
 | `/feedback TEXT` | 记录当前会话反馈 |
 | `/handoff` | 先删除本地 HANDOFF.md，再让 agent 写出新的会话交接文档 |
-| `/loop [name\|stop\|answer] [score] [tries]` | 用列表选择循环记录（随包 `loop.yaml` 与配置目录中的 `loop.yaml` 合并），修改它启动时用的输入与限制后再运行评分循环；`stop`／`abort` 结束当前运行，`answer TEXT` 补上验证者要的判断条件 |
+| `/loop [name\|stop\|answer] [score] [tries]` | 用列表选择循环记录（从配置目录自动创建并合并后的 `loop.yaml` 读取），修改它启动时用的输入与限制后再运行评分循环；`stop`／`abort` 结束当前运行，`answer TEXT` 补上验证者要的判断条件 |
 | `/export [local.zip]` | 下载会话日志 ZIP 到新的本地文件 |
 | `/export-html [local.html]` | 将已加载会话保存为包含图表和公式的离线 HTML |
 | `/coredump [tag]` | 在当前工作目录写出 V8 堆快照，用于内存诊断 |
@@ -374,7 +374,7 @@ Slash 命令在选择器和对话输入框中均可使用。输入 `/` 会显示
 
 `/loop [name|stop|answer] [score] [tries]` 运行 `loop.yaml` 里的一条记录，是一条**客户端驱动**的循环，并且设计成"选"而不是"敲"。输入 `/loop` 会在输入框下方列出所有记录及其轮数、产出物、自带默认值和它指向的输入；↑/↓ 选择，Enter 确认高亮记录，Tab 则把记录名补进草稿以便继续加旗标。确认后会打开参数列表：**先是该记录自己的输入**（如 `designdoc-review` 的 `path`，即被审查的文档），**再是共享的四个值**（`From`、`To`、`Pass`、`Tries`）；选中某行直接输入即可覆盖——输入按自由文本，四个值按数字、与旗标同一套校验；用方向键或 Enter 离开某行即提交该行的内容，因此不需要在每个框里各按一次回车；`Start run` 开始运行，`← Choose another record` 返回记录列表；只有按下 Start 才会真正启动，因此每个默认值都在被花掉之前可见。改一条记录的输入只作用于本次运行、不改 `loop.yaml`，所以 `designdoc-review` 可以审查任意文档，而 `design-review` 不受影响。若命令行里写了任一旗标（`/loop design-review 9 3`、`--from`、`--to`、`--score`、`--tries`），则跳过表单、按所写的值直接运行，脚本与 headless 用法因此保持不变；名字不存在时会列出可用记录。轮次、每轮检查要点、附加标准、固定输入与默认值都由记录自带：本客户端发出本轮 Brief，由 dsht fork 出的独立进程在自己的 session 里验证并把 verdict 文件写回，客户端据此决定下一步——达到及格线进入下一轮，低于及格线消耗一次尝试，某轮用尽预算则停止。内置记录有 `design-review`（对模块设计做十轮审查）与 `designdoc-review`（同一循环，审查记录 `vars.path` 指定的文档，并**一份文档一个审查文件、就放在它旁边**（`tui-design.md.review.md`、`loop.md.review.md`），所以换文档重跑既不会读到也不会覆盖另一份文档的轮次；这个文件名在记录里是模板 `{{path}}.review.md`，且已被 `.gitignore` 覆盖）。`status` 为 `blocked` 时立即停止、不再消耗尝试预算；验证者无法判断时会要求人工介入并以同样方式停止（headless 退出码 3）；只有客户端自己核对过「本轮小节确实写进了产出物文件」的轮次才算通过；`--deadline <minutes>` 约束整个 run。`passed` 只声称本次 run 覆盖的轮次并写明是哪些（`rounds 1–3/10 · selected range`）；跑完整份记录时最后一轮是收束轮，它的验证者会拿到前面每一轮的检查要点逐轮复核，因此后来某一轮改坏了前序要求不会被放过。以"先验证"开始的一轮（`starts: verify` 且有 forked verifier）跑在独立验证进程自己的 session 里，因此当前会话的 history 不会出现内容，直到某一轮未通过、才要求 agent 去工作；验证进行期间进度行显示 `verifying step N · attempt M`，状态栏也如实显示同一件事（`◐` 加本轮 `review N/M`）而不是 Ready；验证者拿不出 verdict 时会给出结构化原因——退出码 ＋ 子进程自己报告的原因（回复里没有 JSON 判定、或回复在 turn 结束后仍未提交），而不是只给错误输出类别，更不是无声等待；同时验证者会拿到本次 run 自己的输入，因此不会去评审产出物里只属于更早那次 run 的文档，`--trace-verbose` 才会附上脱敏后的最后一行。输入框上方的进度行显示轮次、尝试与最高分；发送普通消息、`/loop stop`、`/cancel`、Esc、Ctrl+C、切换会话或断线都会停止循环，该状态不持久化：`/loop stop` 属于控制泳道，运行期间也允许提交；没有运行时它会直接说明而不是报错，且已结束运行的那行进度会保留可读——结束它的那一行仍然显示结果，而你运行下一行时它就被清掉。验证者无法判决时 run 会**暂停**而不是结束：进度行与状态栏显示 `needs you`，`/loop answer TEXT` 补上缺的判断条件、以新的 verification identity 重新判断当前产出物——不消耗尝试次数，也不给 agent 发任何东西；`/loop abort`（`/loop stop` 在暂停期的拼写）结束它。
 
-随包发布的 `loop.yaml` 在启动时读取，而不是编译期写死，因此记录是配置：文件随包分发，配置目录（`$DSHT_CONFIG_DIR`，默认 `~/.config/dsht`）下的 `loop.yaml` 叠加其上。同名记录**整条替换**内置记录，新名字新增一条记录，你没有点名的记录继续跟随包内版本——这正是升级仍能修好你没覆盖的内置记录的原因。`DSHT_LOOP_FILE` 可改指另一个文件。记录列表会把这件事说出来：来自你的文件的行标 `· yours`，并在上方写明文件名。文件非法时启动即失败，并给出行路径与出错字段；内置文件读不到时回退到编译进包的记录。被你覆盖的那条记录无法再为你自动更新，因此其内置定义的摘要会记在 state 目录下，内置定义变化后的第一次启动会提示"内置更新没有到达你的副本"——你的文件仍然生效，且任何情况下都不会被改写。
+运行时的 `loop.yaml` 位于配置目录（`$DSHT_CONFIG_DIR`，默认 `~/.config/dsht`）。首次启动时客户端把随包文件复制到该目录；以后每次启动，把新增或改过的内置记录合入该文件，同时保留你修改过的同名记录与默认值。同名记录作为整体保留，不做字段级拼接。上次合并的内置摘要放在同目录的 `loop.yaml.seed.json`。`DSHT_LOOP_FILE` 可改指另一个运行文件，同样会自动创建并合并。记录列表用 `· yours` 标注你的修改和新增项。运行文件非法时启动失败并指出路径和字段；随包文件不可读时回退到编译进包的记录。若内置记录更新但你的版本仍在使用，升级后的首次启动会提示这次更新没有进入你的副本。
 
 文件引用仅在文本块中发送 `@path`。Harness 提示模型按需读取文件或列出目录；TUI 不读取本地文件、不上传字节，也不将文件内容展开进提示词。引用图片路径不会附带图片数据。尚未实现本地附件、图片上传／预览及 `@` 会话引用。
 
@@ -430,7 +430,7 @@ Slash 命令在选择器和对话输入框中均可使用。输入 `/` 会显示
 
 客户端每次连接后、每 60 秒、任务结束及打开 `/cost` 时在后台通过 HTTP 读取完整历史；每个新连接都会把全部会话完整重读一遍，因为客户端不在时服务端仍在工作，已记录的更新时间无法说明这段空档里发生了什么；同一次连接内，服务端更新时间未变的空闲会话跳过扫描。计费不会发起模型请求。显式刷新时可按 Esc 或 Ctrl+C 取消。账本分别统计未缓存输入、缓存读／写和输出，思考 token 已包含在输出中。重试单独计费，同一次尝试的替换用量更新原记录，fork 继承历史不重复计费。没有可用用量、没有结算时间戳，或带官方价目表并不定价的缓存写入桶的请求只计入未计价而不猜测；没有条目覆盖的模型保持未计价，未列出的供应商不会套用官方价目。每个会话独立读取：某个会话不可达或被拒绝时只计为失败数量并继续扫描，不会中止整轮；子代理会话按其持久父级地址读取。扫描失败保留并标明部分缓存结果。
 
-内置人民币价格于 2026-09-10 根据[官方价格页](https://api-docs.deepseek.com/zh-cn/quick_start/pricing/)核对。北京时间工作日 09:00–12:00、14:00–18:00 为高峰，其余时段半价。Flash 高峰未命中输入／缓存命中输入／输出为每百万 token ¥2/¥0.04/¥8，Pro 为 ¥9/¥0.30/¥27；当前模型名为 `deepseek-flash`，旧 Flash 名称沿用同一费率。供应方已公告自北京时间 2026-09-14 12:00 起将 `deepseek-v4-pro` 交由 Flash 服务并按 Flash 价格计费，内置条目已记录该变更，避免此后高估 Pro 用量。单列的缓存写入按未命中输入价计算。配置中的精确模型价格优先；否则 `deepseek-official` 模型名包含 `pro`（不区分大小写）时按 Pro 计价，其余名称包括临时别名均按 Flash 计价。其他供应商需要显式配置。
+内置人民币价格于 2026-09-24 根据[官方价格页](https://api-docs.deepseek.com/zh-cn/quick_start/pricing/)核对。北京时间周一至周五（不含中国法定节假日）09:00–12:00、14:00–18:00 为高峰，其余时段半价。节假日日期来自安装的 `workday-cn` 包；国务院公布新年度安排后需要更新此依赖。Flash 高峰未命中输入／缓存命中输入／输出为每百万 token ¥2/¥0.04/¥8，Pro 为 ¥9/¥0.30/¥27；当前 Flash 模型名为 `deepseek-flash`，列出的旧 Flash 别名沿用同一费率。根据[官方更新日志](https://api-docs.deepseek.com/zh-cn/updates/)，9 月 14 日之后 V4 Pro 继续按自身费率计费。单列的缓存写入按未命中输入价计算。仅对价格表明确列出的模型与别名计价；其他供应商需要显式配置。
 
 默认价格有效期从核对日期的北京时间零点开始，这是本地估算规则，不代表官方价格生效日期。更早用量需要补充历史价格版本。程序按助手请求结算记录的时间选择单价；官方未说明跨时段请求的归属，因此边界附近的估算可能与账单不同。图片使用供应商报告的 token 数。每次扫描都按当前加载的价格表重新折叠历史，因此落盘的总额是日志与价格表的投影：修改 `prices.json` 会在下一次扫描时重新计价它覆盖的请求，此前没有条目覆盖的请求则在出现覆盖后立即计价。
 

package/dist/cli/dsht.js

@@ -57,8 +57,8 @@ Cookies are saved per server origin and reused on later starts. Tokens are never
 /prompt lists saved shortcut prompts; /prompt TEXT saves one in <state>/prompts.json.
 !command runs on this machine, not on the host, and prints its output in the transcript.
 DSHT_CONFIG_DIR overrides the prices.json directory; DSHT_STATE_DIR overrides usage storage.
-The shipped loop.yaml is read at startup; a loop.yaml in the config directory adds to it, and a
-record with the same name replaces the shipped one. DSHT_LOOP_FILE names another file instead.
+The config directory's loop.yaml is created from the shipped file when absent. On startup,
+unedited shipped records are merged into it. DSHT_LOOP_FILE names another runtime file instead.
 The memory log defaults to <state>/memory.log; DSHT_MEMORY_LOG sets another path or 'off'.
 The transition trace defaults to <state>/trace.log; DSHT_TRACE sets another path or 'off'.
 prices.json overrides the shipped rates and is seeded on first use; every scan re-decides the
@@ -155,13 +155,11 @@ async function main() {
     await ensureDirectory(config);
     const { prices, custom } = await loadPrices(config);
     const stateRoot = process.env.DSHT_STATE_DIR ?? join(process.env.XDG_STATE_HOME ?? join(homedir(), '.local', 'state'), 'dsht');
-    // The loop records are configuration: the shipped file is read now, a user file layered over it and
-    // the result installed before anything can list or run a record. An invalid user file stops the
-    // client here rather than running shipped records while the operator believes their own are in
-    // force; a shipped file that cannot be read falls back to the compiled-in records with a warning.
+    // Materialize the merged config file before installing the runtime source. An invalid user file
+    // stops startup; a missing or invalid shipped file uses the compiled-in fallback with a warning.
     const loopSource = await loadLoopSource({
         ...(process.env.DSHT_LOOP_FILE === undefined ? {} : { overlayFile: process.env.DSHT_LOOP_FILE }),
-        configDirectory: config, stateDirectory: stateRoot,
+        configDirectory: config,
     });
     installLoopSource(loopSource.source, loopSource.info);
     const costDirectory = join(stateRoot, 'cost', createHash('sha256').update(new URL(url).origin).digest('hex'));

package/dist/contracts.d.ts

@@ -41,16 +41,13 @@ export interface SavedPrompt {
 export type PanelName = 'help' | 'cost' | 'status' | 'queue' | 'prompts' | 'thoughts' | 'history' | 'search' | 'model' | 'removal' | 'loop';
 /** Where the loop records one client runs came from.
  *
- * The shipped file travels with the package and a user file may layer over it, so a record list is no
- * longer one file's content: this says which files were read and which records the user's own file
- * replaced or added. The warnings are the client's own notes — a shipped file it could not read, or a
- * record the user overrides that the package has since changed — and the UI shows them rather than
- * acting on them.
+ * The runtime file is in the configuration directory. Shipped updates are merged into that file;
+ * this says which records the operator changed or added and reports any missed shipped update.
  */
 export interface LoopSourceInfo {
     /** Shipped `loop.yaml` that was read; absent when the compiled-in records were used instead. */
     builtin?: string;
-    /** User file layered over the shipped records; absent when there is none. */
+    /** Runtime file read after creation and merging. */
     file?: string;
     /** Shipped records the user's file replaced, in that file's order. */
     overridden: readonly string[];

package/dist/controller/controller.js

@@ -927,7 +927,9 @@ export class Controller {
     /** Create a session in the selected workspace. */
     async createSession(signal) {
         this.traceEvent('action', { action: 'createSession', workspace: this.state.workspaceId ?? 'none' });
-        await this.session.createSession(signal);
+        const sessionId = await this.session.createSession(signal);
+        this.costs?.seedNewSession(sessionId);
+        this.update({});
     }
     /** Replace the selected transcript and follow the session.
      * @param sessionId - Session to follow.

package/dist/controller/loop-prompts-schema.d.ts

@@ -58,12 +58,10 @@ export declare const RESERVED_PROTOCOL_NAMES: readonly string[];
  * @returns One message per problem; an empty list means valid.
  */
 export declare function validateLoopPrompts(source: unknown): string[];
-/** Check a user file that layers over the shipped records.
+/** Check an existing runtime file before merging shipped records into it.
  *
- * It is a whole `loop.yaml` in shape, but partial in content: an overlay that only adds one record
- * or only moves the global defaults is exactly what it is for, so a missing or empty `protocols` is
- * valid here. Every record it does declare is held to the same rules as a shipped one, because the
- * renderer cannot tell the two apart once they are merged.
+ * Older user files may be partial: one record or one changed default is valid, so a missing or empty
+ * `protocols` is accepted here. Every declared record follows the shipped record rules.
  * @param source - Parsed overlay file.
  * @returns One message per problem; an empty list means valid.
  */

package/dist/controller/loop-prompts-schema.js

@@ -32,12 +32,10 @@ export function validateLoopPrompts(source) {
     validateProtocols(protocols, errors);
     return errors;
 }
-/** Check a user file that layers over the shipped records.
+/** Check an existing runtime file before merging shipped records into it.
  *
- * It is a whole `loop.yaml` in shape, but partial in content: an overlay that only adds one record
- * or only moves the global defaults is exactly what it is for, so a missing or empty `protocols` is
- * valid here. Every record it does declare is held to the same rules as a shipped one, because the
- * renderer cannot tell the two apart once they are merged.
+ * Older user files may be partial: one record or one changed default is valid, so a missing or empty
+ * `protocols` is accepted here. Every declared record follows the shipped record rules.
  * @param source - Parsed overlay file.
  * @returns One message per problem; an empty list means valid.
  */

package/dist/controller/loop-prompts.js

@@ -1,8 +1,8 @@
 /** Typed access to the loop prompts and the placeholder renderer.
  *
- * The loop record is configuration, not code: the shipped `loop.yaml` is read at startup from beside
- * the package and a user file may be layered over it (`loop-source.ts`), then the merged table is
- * installed here once. `loop-prompts-schema.ts` holds the shape and the rules, and
+ * The loop record is configuration: `loop-source.ts` creates or merges the config directory's
+ * `loop.yaml` from the shipped table, then reads that runtime file and installs its table here once.
+ * `loop-prompts-schema.ts` holds the shape and the rules, and
  * `loop-prompts.generated.ts` is the compiled-in fallback for a package whose file is missing. This
  * module turns one record into the strings a protocol needs, so the dynamic parts (this round's title,
  * its checklist, the record's own vars) are filled here and nowhere else. A template may only use

package/dist/controller/loop-protocols.d.ts

@@ -6,8 +6,7 @@ export declare function loopProtocolNames(): string[];
  *
  * The list and the run read the same records, so a chooser can show exactly the name, round count,
  * artifact and defaults the runner would use — never a second table that could drift. A record the
- * user's own file supplied is marked, because an operator who overrode a shipped record can no longer
- * tell the two apart from the name alone.
+ * operator edited is marked, so a shipped update can be distinguished from a local override.
  * @returns One summary per record.
  */
 export declare function loopRecords(): LoopRecord[];

package/dist/controller/loop-protocols.js

@@ -16,8 +16,7 @@ export function loopProtocolNames() {
  *
  * The list and the run read the same records, so a chooser can show exactly the name, round count,
  * artifact and defaults the runner would use — never a second table that could drift. A record the
- * user's own file supplied is marked, because an operator who overrode a shipped record can no longer
- * tell the two apart from the name alone.
+ * operator edited is marked, so a shipped update can be distinguished from a local override.
  * @returns One summary per record.
  */
 export function loopRecords() {

package/dist/controller/loop-source.d.ts

@@ -13,19 +13,17 @@ export interface LoopOverlaySource {
 }
 /** The records one process runs, and where they came from. */
 export interface LoopSourceLoad {
-    /** The merged table the renderer reads: shipped records, then the user's on top. */
+    /** The complete table read back from the configuration file. */
     source: LoopPromptSource;
-    /** Which files were read, what the user's file changed, and any note for the operator. */
+    /** Which files were read, what the operator changed, and any note for them. */
     info: LoopSourceInfo;
 }
 /** Where the records come from for one process. */
 export interface LoopSourceOptions {
-    /** Overlay to read instead of `<configDirectory>/loop.yaml`, from `--loop-file`/`DSHT_LOOP_FILE`. */
+    /** Alternate runtime file, from `DSHT_LOOP_FILE`. */
     overlayFile?: string;
-    /** Configuration directory holding `loop.yaml` when no explicit file is given. */
+    /** Configuration directory holding the default runtime `loop.yaml`. */
     configDirectory: string;
-    /** State directory holding the override stamp; omit to skip drift reporting. */
-    stateDirectory?: string;
     /** Shipped file to read; defaults to the `loop.yaml` beside the package entry point. */
     builtinFile?: string;
     /** Table used when the shipped file cannot be read; defaults to the compiled-in one. */
@@ -38,37 +36,17 @@ export interface LoopSourceOptions {
  * @returns Absolute path to the shipped record file.
  */
 export declare function shippedLoopFile(): string;
-/** The overlay file a process reads, if it reads one at all.
+/** The runtime file a process reads.
  *
  * An explicit file wins over the configuration directory: it is how a script or a second checkout
  * points at another set of records without moving the one the interactive client uses.
  * @param options - Resolved options.
- * @returns Absolute path of the overlay to try.
+ * @returns Runtime file path.
  */
 export declare function loopOverlayFile(options: LoopSourceOptions): string;
-/** Layer one user file over the shipped records.
- *
- * A record is taken whole: replacing one does not merge its fields with the shipped copy, because a
- * record is a single prompt contract and a half-new brief with a half-old round table is a protocol
- * nobody wrote. Records the file does not name are untouched, which is what lets a shipped fix reach
- * an install that customises something else.
- * @param builtin - Shipped records.
- * @param overlay - Parsed user file.
- * @returns The merged table and the names the user file replaced or added.
- */
-export declare function mergeLoopSource(builtin: LoopPromptSource, overlay: LoopOverlaySource): {
-    source: LoopPromptSource;
-    overridden: string[];
-    added: string[];
-};
-/** Read the merged records for one process.
- *
- * The shipped file falls back to the compiled-in table with a warning, because a packaging mistake
- * should not stop the client; a user file does not, because an invalid override the operator wrote is
- * a mistake they can fix and a silent fallback would run the shipped records while they believe their
- * own are in force. An absent overlay is ordinary: most installs have none.
+/** Create or merge the configuration file, then read it as the one runtime source.
  * @param options - Resolution options.
  * @returns The merged records, their sources and the notes to show the operator.
- * @throws when the overlay exists but is not a valid loop file.
+ * @throws when the runtime file is not a valid loop file.
  */
 export declare function loadLoopSource(options: LoopSourceOptions): Promise<LoopSourceLoad>;

package/dist/controller/loop-source.js

@@ -1,28 +1,11 @@
-/** Resolve the records `/loop` runs: the shipped loop.yaml, a user file layered over it, and the
- * table compiled into this build as the last resort.
- *
- * The loop record is configuration, not code: the shipped file travels with the package and is read
- * at startup, so a fix to a rubric reaches an install without a TypeScript build, and `DSHT_LOOP_FILE`
- * or `<config>/loop.yaml` lets an operator add a record or correct one without forking the project.
- *
- * Layering is per record, never per file. A user file that overrides one record leaves every other
- * shipped record following the package, so the next version's fixes still arrive; a whole-file
- * replacement would freeze the shipped records at whatever the operator copied. A record the user does
- * override can never be updated for them — the tool cannot know whether their copy is deliberate — so
- * the shipped record's digest is stamped under the state directory and a change is reported, not
- * applied.
- *
- * `loop-prompts.generated.ts` stays as the fallback: a package whose loop.yaml is missing or corrupt
- * still starts on the records this build was compiled with, which is also what keeps the module
- * self-contained for a test that must not touch the filesystem.
- */
+/** Keep the runtime loop.yaml in the configuration directory, merging shipped records into it. */
 import { createHash } from 'node:crypto';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { parse } from 'yaml';
+import { parse, parseDocument, stringify } from 'yaml';
 import { LOOP_PROMPTS } from "./loop-prompts.generated.js";
 import { validateLoopOverlayPrompts, validateLoopPrompts } from "./loop-prompts-schema.js";
-import { ensureDirectory, readText, writePrivateFile } from "../storage/index.js";
+import { createPrivateFile, ensureDirectory, readText, writePrivateFile } from "../storage/index.js";
 /** Path of the `loop.yaml` shipped beside this module.
  *
  * The path is relative to the module, so it resolves both in the source tree (`src/controller/`) and
@@ -32,81 +15,117 @@ import { ensureDirectory, readText, writePrivateFile } from "../storage/index.js
 export function shippedLoopFile() {
     return fileURLToPath(new URL('../../loop.yaml', import.meta.url));
 }
-/** The overlay file a process reads, if it reads one at all.
+/** The runtime file a process reads.
  *
  * An explicit file wins over the configuration directory: it is how a script or a second checkout
  * points at another set of records without moving the one the interactive client uses.
  * @param options - Resolved options.
- * @returns Absolute path of the overlay to try.
+ * @returns Runtime file path.
  */
 export function loopOverlayFile(options) {
     return options.overlayFile ?? join(options.configDirectory, 'loop.yaml');
 }
-/** Layer one user file over the shipped records.
- *
- * A record is taken whole: replacing one does not merge its fields with the shipped copy, because a
- * record is a single prompt contract and a half-new brief with a half-old round table is a protocol
- * nobody wrote. Records the file does not name are untouched, which is what lets a shipped fix reach
- * an install that customises something else.
- * @param builtin - Shipped records.
- * @param overlay - Parsed user file.
- * @returns The merged table and the names the user file replaced or added.
- */
-export function mergeLoopSource(builtin, overlay) {
-    const overridden = [];
-    const added = [];
-    for (const name of Object.keys(overlay.protocols ?? {})) {
-        (Object.hasOwn(builtin.protocols, name) ? overridden : added).push(name);
+function seedFor(source) {
+    return { version: 1, defaults: { ...source.defaults },
+        records: Object.fromEntries(Object.entries(source.protocols).map(([name, record]) => [name, digestOf(record)])) };
+}
+function seedFile(path) { return `${path}.seed.json`; }
+async function readSeed(path) {
+    const raw = await readText(path);
+    if (raw === undefined)
+        return undefined;
+    try {
+        const value = JSON.parse(raw);
+        if (value?.version === 1 && value.defaults && value.records && typeof value.records === 'object')
+            return value;
     }
-    return {
-        source: {
-            version: 1,
-            defaults: {
-                score: overlay.defaults?.score ?? builtin.defaults.score,
-                tries: overlay.defaults?.tries ?? builtin.defaults.tries,
-            },
-            protocols: { ...builtin.protocols, ...(overlay.protocols ?? {}) },
-        },
-        overridden,
-        added,
-    };
+    catch { /* An invalid stamp cannot make the user's configuration unreadable. */ }
+    return undefined;
 }
-/** Read the merged records for one process.
- *
- * The shipped file falls back to the compiled-in table with a warning, because a packaging mistake
- * should not stop the client; a user file does not, because an invalid override the operator wrote is
- * a mistake they can fix and a silent fallback would run the shipped records while they believe their
- * own are in force. An absent overlay is ordinary: most installs have none.
+/** Update unedited shipped fields while keeping user changes and additions. */
+function mergeRuntime(builtin, file, path, previous) {
+    const overridden = [], added = [], warnings = [];
+    const protocols = { ...builtin.protocols };
+    for (const [name, record] of Object.entries(file.protocols ?? {})) {
+        const shipped = builtin.protocols[name];
+        if (shipped === undefined) {
+            protocols[name] = record;
+            added.push(name);
+            continue;
+        }
+        const currentDigest = digestOf(shipped);
+        const baseline = previous?.records[name] ?? currentDigest;
+        if (digestOf(record) === baseline || digestOf(record) === currentDigest)
+            continue;
+        protocols[name] = record;
+        overridden.push(name);
+        if (previous?.records[name] !== undefined && previous.records[name] !== currentDigest) {
+            warnings.push(`Your ${name} in ${path} replaces a shipped record that changed in this version; the shipped update is not applied to your copy.`);
+        }
+    }
+    const defaults = { ...builtin.defaults };
+    for (const key of ['score', 'tries']) {
+        const value = file.defaults?.[key];
+        if (value !== undefined && value !== builtin.defaults[key]
+            && value !== (previous?.defaults[key] ?? builtin.defaults[key]))
+            defaults[key] = value;
+    }
+    return { source: { version: 1, defaults, protocols }, overridden, added, warnings };
+}
+/** Create or merge the configuration file, then read it as the one runtime source.
  * @param options - Resolution options.
  * @returns The merged records, their sources and the notes to show the operator.
- * @throws when the overlay exists but is not a valid loop file.
+ * @throws when the runtime file is not a valid loop file.
  */
 export async function loadLoopSource(options) {
     const fallback = options.fallback ?? LOOP_PROMPTS;
     const warnings = [];
     const shipped = await readShipped(options.builtinFile ?? shippedLoopFile(), fallback, warnings);
     const overlayPath = loopOverlayFile(options);
-    const raw = await readText(overlayPath);
-    if (raw === undefined) {
-        return {
-            source: shipped.source,
-            info: {
-                ...(shipped.file === undefined ? {} : { builtin: shipped.file }),
-                overridden: [], added: [], warnings,
-            },
-        };
+    await ensureDirectory(dirname(overlayPath));
+    const initial = await readText(overlayPath);
+    if (initial === undefined) {
+        await createPrivateFile(overlayPath, shipped.raw ?? stringify(shipped.source));
     }
+    const raw = await readText(overlayPath);
+    if (raw === undefined)
+        throw new Error(`Cannot read loop records at ${overlayPath}`);
     const overlay = parseOverlay(overlayPath, raw);
-    const merged = mergeLoopSource(shipped.source, overlay);
-    const drift = await stampOverrides(options.stateDirectory, shipped.source, merged.overridden, overlayPath);
+    const previous = await readSeed(seedFile(overlayPath));
+    const merged = mergeRuntime(shipped.source, overlay, overlayPath, previous);
+    const recordChanged = (name, record) => overlay.protocols?.[name] === undefined || digestOf(overlay.protocols[name]) !== digestOf(record);
+    const changed = ['score', 'tries'].some(key => overlay.defaults?.[key] !== merged.source.defaults[key])
+        || Object.entries(merged.source.protocols).some(([name, record]) => recordChanged(name, record));
+    if (changed) {
+        const document = parseDocument(raw);
+        for (const key of ['score', 'tries']) {
+            if (overlay.defaults?.[key] !== merged.source.defaults[key])
+                document.setIn(['defaults', key], merged.source.defaults[key]);
+        }
+        for (const [name, record] of Object.entries(merged.source.protocols)) {
+            if (recordChanged(name, record))
+                document.setIn(['protocols', name], record);
+        }
+        await writePrivateFile(overlayPath, document.toString());
+    }
+    const stamp = `${JSON.stringify(seedFor(shipped.source), null, 2)}\n`;
+    if (await readText(seedFile(overlayPath)) !== stamp)
+        await writePrivateFile(seedFile(overlayPath), stamp);
+    const runtime = await readText(overlayPath);
+    if (runtime === undefined)
+        throw new Error(`Cannot read loop records at ${overlayPath}`);
+    const source = parse(runtime);
+    const errors = validateLoopPrompts(source);
+    if (errors.length > 0)
+        throw new Error(`${overlayPath}:\n- ${errors.join('\n- ')}`);
     return {
-        source: merged.source,
+        source: source,
         info: {
             ...(shipped.file === undefined ? {} : { builtin: shipped.file }),
             file: overlayPath,
             overridden: merged.overridden,
             added: merged.added,
-            warnings: [...warnings, ...drift],
+            warnings: [...warnings, ...merged.warnings],
         },
     };
 }
@@ -135,12 +154,12 @@ async function readShipped(path, fallback, warnings) {
         warnings.push(`The shipped records at ${path} are invalid: ${errors.join('; ')}. Using the table compiled into this build.`);
         return { source: fallback };
     }
-    return { source: parsed, file: path };
+    return { source: parsed, file: path, raw };
 }
-/** Parse one overlay file, refusing anything the renderer would misread.
- * @param path - Overlay file path, used in every message.
+/** Parse one runtime file before merging, refusing anything the renderer would misread.
+ * @param path - Runtime file path, used in every message.
  * @param raw - File contents.
- * @returns The parsed overlay.
+ * @returns The parsed document.
  * @throws when the file is not valid YAML or does not satisfy the overlay schema.
  */
 function parseOverlay(path, raw) {
@@ -156,69 +175,21 @@ function parseOverlay(path, raw) {
         throw new Error(`${path}:\n- ${errors.join('\n- ')}`);
     return parsed;
 }
-/** Report a shipped record that changed under the operator's override.
- *
- * The stamp is the only durable trace of which shipped copy an override was written against. When a
- * later version ships a different definition of a record this install overrides, that update cannot
- * be applied — the operator's file wins by design — so it is reported once per change instead of
- * being lost silently. The write is best effort: a state directory that cannot be written costs a
- * warning, never a failed start.
- * @param stateDirectory - Directory holding the stamp; omitted disables the check.
- * @param builtin - Shipped records, read before merging.
- * @param overridden - Names the overlay replaced.
- * @param overlayPath - Overlay file the names came from, named in the warning.
- * @returns One warning per shipped record that changed since it was last seen.
- */
-async function stampOverrides(stateDirectory, builtin, overridden, overlayPath) {
-    if (stateDirectory === undefined)
-        return [];
-    const path = join(stateDirectory, 'loop-overrides.json');
-    const warnings = [];
-    const current = {};
-    let previous = {};
-    const raw = await readText(path);
-    // No override and no stamp: an install that never customised a shipped record leaves no file behind.
-    if (raw === undefined && overridden.length === 0)
-        return [];
-    if (raw !== undefined) {
-        try {
-            const parsed = JSON.parse(raw);
-            if (parsed.records !== null && typeof parsed.records === 'object')
-                previous = parsed.records;
-        }
-        catch {
-            previous = {};
-        }
-    }
-    for (const name of overridden) {
-        const record = builtin.protocols[name];
-        // A name the shipped table does not have is an addition, not an override: there is no upstream
-        // definition for it to fall behind.
-        if (record === undefined)
-            continue;
-        const digest = digestOf(record);
-        current[name] = digest;
-        if (previous[name] !== undefined && previous[name] !== digest) {
-            warnings.push(`Your ${name} in ${overlayPath} replaces a shipped record that changed in this version; `
-                + `the shipped update is not applied to your copy.`);
-        }
-    }
-    const stamp = `${JSON.stringify({ version: 1, records: current }, null, 2)}\n`;
-    if (stamp !== raw) {
-        try {
-            await ensureDirectory(stateDirectory);
-            await writePrivateFile(path, stamp);
-        }
-        catch { /* The stamp only enables a warning; failing to write it must not stop the client. */ }
-    }
-    return warnings;
-}
 /** Content digest of one record, stable across key order because it hashes the serialized record.
  * @param record - Shipped record.
  * @returns Lowercase hex sha256.
  */
 function digestOf(record) {
-    return createHash('sha256').update(JSON.stringify(record)).digest('hex');
+    return createHash('sha256').update(JSON.stringify(sortKeys(record))).digest('hex');
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+            .map(([key, entry]) => [key, sortKeys(entry)]));
+    }
+    return value;
 }
 /** Readable text for anything thrown. */
 function message(error) { return error instanceof Error ? error.message : String(error); }

package/dist/cost/ledger.d.ts

@@ -8,6 +8,8 @@ export declare class CostLedger {
     /** Whether the table came from a file the user maintains, rather than the shipped one. */
     readonly customPrices: boolean;
     private sessions;
+    /** New sessions are known to begin at zero, but have not yet had their history scanned. */
+    private provisional;
     private totals;
     private readonly catalog;
     scannedAt?: number;
@@ -34,6 +36,10 @@ export declare class CostLedger {
      * @param now - Clock that names the window, so a caller or a test can pin the boundary.
      */
     load(now?: number): Promise<void>;
+    /** Show zero immediately for a session this client just created, until a host scan confirms it.
+     * The provisional slice is memory only; a later scan replaces it with the actual history.
+     */
+    seedNewSession(sessionId: string): void;
     /** Replace one session using all billing events through the opening snapshot cut.
      *
      * The fold is the projection: every sample is decided again with the table loaded now, so a

package/dist/cost/ledger.js

@@ -9,6 +9,8 @@ export class CostLedger {
     directory;
     customPrices;
     sessions = new Map();
+    /** New sessions are known to begin at zero, but have not yet had their history scanned. */
+    provisional = new Set();
     totals = new Map();
     catalog;
     scannedAt;
@@ -32,7 +34,7 @@ export class CostLedger {
             return 'scanning';
         if (this.error)
             return 'partial';
-        return this.scannedAt !== undefined || this.sessions.size > 0 ? 'complete' : 'partial';
+        return this.provisional.size === 0 && (this.scannedAt !== undefined || this.sessions.size > 0) ? 'complete' : 'partial';
     }
     /** Load the newest cut per session; a stored total is read as it was decided.
      *
@@ -43,11 +45,23 @@ export class CostLedger {
      */
     async load(now = Date.now()) {
         this.totals.clear();
+        this.provisional.clear();
         this.sessions = await loadLedgers(this.directory);
         for (const sessionId of await pruneLedgers(this.directory, costWindowStart(now), this.sessions)) {
             this.sessions.delete(sessionId);
         }
     }
+    /** Show zero immediately for a session this client just created, until a host scan confirms it.
+     * The provisional slice is memory only; a later scan replaces it with the actual history.
+     */
+    seedNewSession(sessionId) {
+        if (this.sessions.has(sessionId))
+            return;
+        this.sessions.set(sessionId, { version: 4, sessionId, cut: -2, engine: PRICING_ENGINE_VERSION,
+            catalog: this.catalog, total: { amount: 0, unknown: 0, records: 0 }, days: [], unpriced: [] });
+        this.provisional.add(sessionId);
+        this.totals.clear();
+    }
     /** Replace one session using all billing events through the opening snapshot cut.
      *
      * The fold is the projection: every sample is decided again with the table loaded now, so a
@@ -101,6 +115,7 @@ export class CostLedger {
         if (this.directory && !await saveLedger(this.directory, saved))
             return;
         this.sessions.set(sessionId, saved);
+        this.provisional.delete(sessionId);
         this.totals.clear();
     }
     /** Count the retained ledger so a memory sample can separate it from the transcript window.

package/dist/cost/pricing.d.ts

@@ -7,7 +7,7 @@ export declare const DEFAULT_PRICES: PriceVersion[];
  * to the rules that produced it. Version 1 matched a model by the substring `pro` and priced a
  * request with no settlement time at the cheapest off-peak rate.
  */
-export declare const PRICING_ENGINE_VERSION = 2;
+export declare const PRICING_ENGINE_VERSION = 3;
 /** Revision of the shipped table, recorded beside a seeded file so a correction can replace it. */
 export declare const PRICES_REVISION = "2026-09-12";
 /** Whether a table is the seed an earlier revision wrote, which a corrected ship must replace.

package/dist/cost/pricing.js

@@ -1,9 +1,10 @@
 /** Versioned CNY price tables and the price decision taken for one request sample. */
 import { createHash } from 'node:crypto';
+import workday from 'workday-cn';
 import { object } from "../transport/wire.js";
 import { MISSING_TIME, MISSING_USAGE, UNSUPPORTED_USAGE } from "./types.js";
 const clocks = new Map();
-/** Published rates verified on 2026-09-12; preceding dates require historical configuration.
+/** Published rates verified on 2026-09-24; preceding dates require historical configuration.
  * Flash and Pro are priced independently, and a separate cache write uses the cache-miss input rate.
  */
 const OFFICIAL_PRICING = 'https://api-docs.deepseek.com/zh-cn/quick_start/pricing/';
@@ -34,7 +35,7 @@ export const DEFAULT_PRICES = [
  * to the rules that produced it. Version 1 matched a model by the substring `pro` and priced a
  * request with no settlement time at the cheapest off-peak rate.
  */
-export const PRICING_ENGINE_VERSION = 2;
+export const PRICING_ENGINE_VERSION = 3;
 /** Revision of the shipped table, recorded beside a seeded file so a correction can replace it. */
 export const PRICES_REVISION = '2026-09-12';
 /** Rates the first published revision charged, rebuilt with the same arithmetic so the values compare equal.
@@ -226,14 +227,21 @@ export function priceAt(prices, provider, model, time) {
     const { price, matchedBy } = candidate;
     let clock = clocks.get(price.timezone);
     if (!clock) {
-        clock = new Intl.DateTimeFormat('en-US', { timeZone: price.timezone, weekday: 'short', hour: '2-digit', minute: '2-digit', hourCycle: 'h23' });
+        clock = new Intl.DateTimeFormat('en-US', { timeZone: price.timezone, weekday: 'short', year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', hourCycle: 'h23' });
         clocks.set(price.timezone, clock);
     }
     const parts = clock.formatToParts(time);
     const part = (name) => parts.find(p => p.type === name).value;
     const day = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'].indexOf(part('weekday'));
+    const date = `${part('year')}-${part('month')}-${part('day')}`;
     const minute = Number(part('hour')) * 60 + Number(part('minute'));
-    return { price, matchedBy, rates: price.weekdays.includes(day) && price.windows.some(([a, b]) => minute >= a && minute < b) ? price.peak : price.offPeak };
+    const peakWindow = price.weekdays.includes(day) && price.windows.some(([a, b]) => minute >= a && minute < b);
+    // The package reads a Date through local getters. Build local noon from the date already resolved
+    // in the price's timezone so the result does not shift to the previous day west of UTC.
+    const [year, month, dateOfMonth] = date.split('-').map(Number);
+    const holiday = peakWindow && price.timezone === 'Asia/Shanghai'
+        && workday.isHoliday(new Date(year, month - 1, dateOfMonth, 12));
+    return { price, matchedBy, rates: peakWindow && !holiday ? price.peak : price.offPeak };
 }
 /** Decide the amount for one request sample using the table loaded at decision time.
  *

package/dist/cost/types.d.ts

@@ -6,7 +6,7 @@ export interface Rates {
     cacheWrite: number;
     output: number;
 }
-/** An explicit validity interval and weekday peak windows in the named time zone. */
+/** An explicit validity interval and peak calendar in the named time zone. */
 export interface PriceVersion {
     id: string;
     provider: string;

package/dist/session/controller.d.ts

@@ -177,7 +177,7 @@ export declare class SessionController {
      */
     createWorkspace(path: string, signal?: AbortSignal): Promise<void>;
     /** Create a session only after the user explicitly selects New session. */
-    createSession(signal?: AbortSignal): Promise<void>;
+    createSession(signal?: AbortSignal): Promise<string>;
     /** Create a session for another purpose without selecting it, named so a reader can tell it apart.
      *
      * A verifier runs in its own session while the reviewed session stays selected, so this never

package/dist/session/navigator.d.ts

@@ -40,7 +40,7 @@ export declare class SessionNavigator {
     switchWorkspace(query?: string, signal?: AbortSignal): Promise<void>;
     switchSession(query?: string, signal?: AbortSignal): Promise<void>;
     createWorkspace(path: string, signal?: AbortSignal): Promise<void>;
-    createSession(signal?: AbortSignal): Promise<void>;
+    createSession(signal?: AbortSignal): Promise<string>;
     get visibleSessions(): ObjectValue[];
     /** Longest registered path wins, with whole-segment matching for nested workspaces. */
     adoptLocalWorkspace(directory: string): string | undefined;

package/dist/session/navigator.js

@@ -125,7 +125,9 @@ export class SessionNavigator {
                 throw new Error('Select a workspace before creating a session');
             const result = object(await context.client.call('session/create', { request: { workspaceId } }, context.signal));
             context.check();
-            this.host.follow(string(result.sessionId));
+            const sessionId = string(result.sessionId);
+            this.host.follow(sessionId);
+            return sessionId;
         });
     }
     get visibleSessions() {

package/dist/ui/dialogs/loop.js

@@ -53,8 +53,7 @@ function labelWidth(rows) {
 export function LoopMenu({ records, index, source }) {
     const theme = useTheme();
     const start = Math.max(0, index - 5);
-    // Records are configuration now: whenever a user file supplied or replaced one, the list says so,
-    // because an operator who overrode a shipped record cannot tell the two apart from the name alone.
+    // The runtime file is in the config directory; mark records the operator edited or added.
     const origin = source?.file === undefined ? undefined : [
         `Records from ${source.file}`,
         ...(source.overridden.length === 0 ? [] : [`replaced: ${source.overridden.join(', ')}`]),

package/loop.yaml

@@ -4,15 +4,11 @@
 # contract (result block, verdict brief, retry clause) stays in src/controller/loop-contract.ts;
 # this file holds the objective, the rubric, the templates and the fixed inputs of one record.
 #
-# It is configuration, read at startup, not compiled in: the shipped copy travels with the package
-# and a user file layers over it per record.
-#   - To add or replace records without touching the package, write a loop.yaml in the config
-#     directory (default ~/.config/dsht, or $DSHT_CONFIG_DIR) with the same `version`, the records
-#     you want, and optionally `defaults`. A name that exists here is replaced whole; a new name is
-#     added; every record you do not name keeps following this file, so upgrades still reach it.
-#     $DSHT_LOOP_FILE points at another file instead of the config directory one.
-#   - src/controller/loop-source.ts merges the two; src/controller/loop-prompts-schema.ts holds the
-#     rules (the overlay is checked by validateLoopOverlayPrompts, which allows a partial file).
+# It is configuration: this shipped copy seeds ~/.config/dsht/loop.yaml (or $DSHT_CONFIG_DIR).
+# On later starts, unedited shipped records and defaults are merged into that runtime file; user
+# edits and additions stay there. $DSHT_LOOP_FILE selects another runtime file with the same rules.
+# The previous shipped digests live beside the runtime file in loop.yaml.seed.json.
+# src/controller/loop-source.ts performs the merge; loop-prompts-schema.ts validates both files.
 #   - `npm run build:prompts` inlines this file into the committed fallback module used only when the
 #     data file cannot be read, and `npm test` keeps the two in sync.
 #
@@ -43,8 +39,9 @@
 # earlier round's rubric to re-check, and only then may "passed" mean the whole artifact rather than
 # just the rounds that happened to run.
 #
-# After editing, run `npm run build:prompts` to regenerate src/controller/loop-prompts.generated.ts;
-# `npm test` fails when the generated file is stale. A record named `answer` or `abort` is refused,
+# When editing this shipped copy in the source repo, run `npm run build:prompts` to regenerate
+# src/controller/loop-prompts.generated.ts; edits to the config directory's runtime copy take effect
+# on restart without a build. A record named `answer` or `abort` is refused,
 # because those are `/loop` subcommands rather than protocols.
 
 version: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itookit/dsht",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "type": "module",
   "description": "Remote-first TUI for DeepSeek Harness with SSH-friendly mobile access and request-level cost tracking",
   "engines": {
@@ -77,6 +77,7 @@
     "react": "^19.2.0",
     "slice-ansi": "^8.0.0",
     "string-width": "^8.2.2",
+    "workday-cn": "^1.0.5",
     "wrap-ansi": "^9.0.2",
     "ws": "^8.21.0",
     "yaml": "^2.9.1"