@swimmingliu/autovpn 2.2.1 → 2.2.3

package/dist/pipeline/credential-source.js

@@ -8,6 +8,7 @@ import { AccountStore, maskAccount } from '../pool/account-store.js';
 import { BRANDS, brandFromSite, brandSite, normalizeBrand } from '../pool/brands.js';
 import { FingerprintStore, resolveFingerprintCacheDir } from './brand-cache.js';
 import { resolveUserRuntimeRoot } from '../runtime/paths.js';
+import { profilePayload } from '../config/profile.js';
 import { redactText } from '../runtime/redaction.js';
 /**
  * How many pooled accounts one source may try before it reports failure.
@@ -89,6 +90,22 @@ function siteHost(site) {
         return '';
     }
 }
+/**
+ * Archive prefix for any spelling of a brand: its English key, its Chinese
+ * label, a known storefront host, or a name that normalizes to one of them.
+ */
+function credentialPrefixFor(value) {
+    const raw = String(value ?? '').trim();
+    if (!raw) {
+        return null;
+    }
+    const direct = BRAND_APK_PREFIXES[raw] ?? BRAND_APK_PREFIXES[raw.toLowerCase()];
+    if (direct) {
+        return direct;
+    }
+    const brand = normalizeBrand(raw);
+    return brand ? (BRAND_APK_PREFIXES[brand] ?? null) : null;
+}
 /**
  * Stable key for a brand's fingerprint.
  *
@@ -100,14 +117,82 @@ function siteHost(site) {
  * be established, which keeps custom entries working.
  */
 export function credentialBrandKey(sourceName, source) {
-    const site = String(source.official_site ?? '').trim();
-    const host = siteHost(site);
+    // Brand first, host second. A row's own name identifies the APK even when the
+    // operator points it at an alternate storefront (`www.leitingku.com`,
+    // `www.heidongm.com`, …), and hosting the file under that host split one
+    // brand across several cache entries — so a redirected row keyed by prefix
+    // never saw the entry the native row had just written.
+    const name = String(sourceName ?? '').trim();
+    const byName = credentialPrefixFor(name);
+    if (byName) {
+        return byName;
+    }
+    const host = siteHost(String(source.official_site ?? '').trim());
+    const byHost = credentialPrefixFor(host);
+    if (byHost) {
+        return byHost;
+    }
+    const lowered = name.toLowerCase();
+    return host || lowered || 'unknown';
+}
+/**
+ * Fingerprint key for the data plane a row actually reads.
+ *
+ * A redirected row carries the backend's canonical brand key (`leiting`), not
+ * the short archive prefix its cache file is named with (`lt`). Using the
+ * canonical key straight away produced `brand-leiting.json`, which never
+ * exists: every run missed the cache, fell back to downloading the APK from the
+ * storefront, and on a host that cannot reach that storefront failed with
+ * "APK could not be located" — while `brand-lt.json` sat on disk, unused.
+ */
+export function fingerprintKeyFor(sourceName, source) {
+    if (!String(source.brand_override ?? '').trim()) {
+        return credentialBrandKey(sourceName, source);
+    }
+    return credentialPrefixFor(String(source.brand_override))
+        ?? String(source.brand_override).trim().toLowerCase();
+}
+/**
+ * What to do with a pooled account after its login was refused.
+ *
+ * Retirement and rotation are separate decisions. Only a *classified* rejection
+ * — the vendor said the password or the account is wrong, or that the
+ * membership lapsed — is evidence the row is dead, so only that retires it.
+ * Any rejection at all, though, means this account cannot be used right now and
+ * the pool holds more.
+ *
+ * Conflating the two ended the source at zero rounds: 雷霆 refuses most of this
+ * pool with a bare `code=128` and no message, which matches neither classifier,
+ * so the loop gave up on the first account while 159 active rows went unread.
+ */
+export function accountFollowUp(state) {
+    if (state.membershipExpired) {
+        return { act: true, retire: 'expired', rotate: true };
+    }
+    if (state.credentialRejected) {
+        return { act: true, retire: 'invalid', rotate: true };
+    }
+    if (state.loginRejected) {
+        // Usable by nobody right now, but nothing proves it is dead: keep the row.
+        return { act: true, retire: null, rotate: true };
+    }
+    return { act: false, retire: null, rotate: false };
+}
+/**
+ * Cache files an earlier build may have written for this row.
+ *
+ * Before brand-first keying, the key was the official-site host, so a row
+ * pointed at an alternate storefront wrote `brand-www.leitingku.com.json`
+ * instead of `brand-lt.json`. Those files hold a valid fingerprint — often the
+ * only verified one on a host that cannot reach the vendor's site — so a read
+ * falls back to them and migrates the entry to the canonical key.
+ */
+function legacyFingerprintKey(sourceName, source) {
+    const host = siteHost(String(source.official_site ?? '').trim());
     if (host) {
-        return BRAND_APK_PREFIXES[host] ?? host;
+        return host;
     }
-    const name = String(sourceName ?? '').trim().toLowerCase();
-    const prefix = BRAND_APK_PREFIXES[sourceName] ?? BRAND_APK_PREFIXES[name];
-    return prefix ?? (name || 'unknown');
+    return String(sourceName ?? '').trim().toLowerCase() || 'unknown';
 }
 export function createFingerprintMemo(store, brand) {
     let value = store?.read(brand) ?? null;
@@ -195,6 +280,59 @@ export const MAX_EMPTY_ROUNDS = 5;
  * node is stopped explicitly and reported.
  */
 export const PLACEHOLDER_ONLY_ROUNDS = 8;
+/**
+ * Lap-mode defaults. A lap is one full pass over the frozen area list, so
+ * these numbers mean what they say: 50 laps × N areas is the request ceiling,
+ * 13 empty laps × N areas is the give-up point. The legacy round defaults
+ * above stay untouched for rows that never set a lap key.
+ */
+export const DEFAULT_MAX_LAPS = 50;
+export const DEFAULT_DRY_LAPS = 13;
+function finiteLapValue(value, min) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed >= min;
+}
+/**
+ * Resolve the lap policy, or null when the row never opted in.
+ *
+ * Null is the compatibility contract: the caller then runs the legacy round
+ * path with the same arguments as before, so an untouched profile produces
+ * the same request sequence after an upgrade.
+ */
+export function resolveLapRoundPolicy(source, areaCount) {
+    const optedIn = finiteLapValue(source.max_laps, 1) || finiteLapValue(source.dry_laps, 1) || finiteLapValue(source.min_laps, 0);
+    if (!optedIn) {
+        return null;
+    }
+    const areas = Math.max(1, Math.trunc(numberOrDefault(areaCount, 1)));
+    const cap = Math.max(1, Math.trunc(numberOrDefault(source.max_laps, DEFAULT_MAX_LAPS)));
+    const plateau = Math.max(1, Math.trunc(numberOrDefault(source.dry_laps, DEFAULT_DRY_LAPS)));
+    const floor = Math.min(Math.max(0, Math.trunc(numberOrDefault(source.min_laps, 0))), cap);
+    return {
+        policy: {
+            max_iterations: cap,
+            min_iterations: floor,
+            plateau_limit: plateau,
+            max_runtime_seconds: Math.max(0, numberOrDefault(source.max_runtime_seconds, 0))
+        },
+        areas_per_round: areas,
+        // The guards were tuned in rounds of 8 areas; keep their request volume
+        // when the unit becomes a lap of N areas, never below two laps.
+        empty_round_limit: Math.max(2, Math.ceil((MAX_EMPTY_ROUNDS * DEFAULT_AREAS_PER_ROUND) / areas)),
+        placeholder_round_limit: Math.max(2, Math.ceil((PLACEHOLDER_ONLY_ROUNDS * DEFAULT_AREAS_PER_ROUND) / areas)),
+        round_unit: 'lap'
+    };
+}
+/**
+ * The budget to advertise before the area list is known. Pre-flight events
+ * fire before login, so they must report the unit the loop will run in.
+ */
+export function resolveAdvertisedMaxIterations(source) {
+    if (finiteLapValue(source.max_laps, 1) || finiteLapValue(source.dry_laps, 1) || finiteLapValue(source.min_laps, 0)) {
+        return Math.max(1, Math.trunc(numberOrDefault(source.max_laps, DEFAULT_MAX_LAPS)));
+    }
+    return resolveRoundPolicy(source).max_iterations;
+}
 /** How many areas one round takes from the immutable list. */
 export function resolveAreasPerRound(value, areaCount) {
     const parsed = Math.trunc(Number(value));
@@ -838,7 +976,10 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     // and the caller's config object must not carry that into later stages.
     const source = { ...input.source };
     const platforms = resolveCredentialPlatforms(source);
-    const policy = resolveRoundPolicy(source);
+    // Pre-flight events fire before the area list exists, so the budget is
+    // advertised in the unit the loop will run in: laps or legacy rounds.
+    const advertisedIterations = resolveAdvertisedMaxIterations(source);
+    const legacyPolicy = resolveRoundPolicy(source);
     const errors = [];
     const diagnostics = {
         brand: input.source_name,
@@ -858,7 +999,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     };
     const empty = {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
+        requested_iterations: advertisedIterations,
         successful_iterations: 0,
         failed_iterations: 0,
         links: [],
@@ -866,8 +1007,8 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     };
     event(options, 'extract_source_started', {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
-        min_iterations: policy.min_iterations,
+        requested_iterations: advertisedIterations,
+        min_iterations: legacyPolicy.min_iterations,
         resume_from_iteration: 1,
         platforms
     });
@@ -926,7 +1067,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
             store?.close();
         event(options, 'extract_source_completed', {
             source_name: input.source_name,
-            requested_iterations: policy.max_iterations,
+            requested_iterations: advertisedIterations,
             successful_iterations: 0,
             failed_iterations: 1,
             raw_links: 0
@@ -943,7 +1084,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     // backend on a cached run, and it hides the 雷霆 entry the next run should
     // reuse. A redirect therefore always gets a memo of its own key; the shared
     // one is used only when the two brands agree.
-    const memoBrandKey = source.brand_override ?? credentialBrandKey(input.source_name, source);
+    const memoBrandKey = fingerprintKeyFor(input.source_name, source);
     const memo = source.brand_override
         ? createFingerprintMemo(options.fingerprintStore ?? null, memoBrandKey)
         : (options.memo ?? createFingerprintMemo(options.fingerprintStore ?? null, memoBrandKey));
@@ -981,8 +1122,8 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                             event(options, 'extract_platform_started', {
                                 ...payload,
                                 platform,
-                                requested_iterations: policy.max_iterations,
-                                min_iterations: policy.min_iterations
+                                requested_iterations: advertisedIterations,
+                                min_iterations: legacyPolicy.min_iterations
                             });
                             return;
                         }
@@ -1008,7 +1149,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                                 // counter.
                                 platform,
                                 iteration: Number(payload.iteration ?? 0),
-                                requested_iterations: policy.max_iterations,
+                                requested_iterations: advertisedIterations,
                                 new_items: Number(payload.new_items ?? 0),
                                 new_meaningful_items: Number(payload.new_meaningful_items ?? 0),
                                 extracted_links: Number(payload.extracted_links ?? 0),
@@ -1107,16 +1248,19 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                 && results.every((result) => result.diagnostics.login_rejected)
                 && results.some((result) => result.diagnostics.membership_expired);
             const credentialRejected = results.length > 0 && results.every((result) => result.diagnostics.credential_rejected);
-            if (store && leased && (membershipExpired || credentialRejected)) {
-                if (membershipExpired)
+            const loginRejected = results.length > 0 && results.every((result) => result.diagnostics.login_rejected);
+            const followUp = accountFollowUp({ membershipExpired, credentialRejected, loginRejected });
+            if (store && leased && followUp.act) {
+                if (followUp.retire === 'expired')
                     store.markExpired(leased.id, 'membership expired');
-                else
+                else if (followUp.retire === 'invalid')
                     store.markInvalid(leased.id, 'login rejected');
-                if (attempt < attempts && brand) {
-                    leased = store.lease(brand);
-                    if (leased) {
-                        account = leased.account;
-                        password = leased.password;
+                if (followUp.rotate && attempt < attempts && brand) {
+                    const next = store.lease(brand);
+                    if (next) {
+                        leased = next;
+                        account = next.account;
+                        password = next.password;
                         continue;
                     }
                 }
@@ -1197,15 +1341,19 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     }
     event(options, 'extract_source_completed', {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
+        requested_iterations: advertisedIterations,
         successful_iterations: successful,
         failed_iterations: failed,
         raw_links: links.length,
-        platforms
+        platforms,
+        // route_count is the max across platforms; both channels freeze the same
+        // vendor list, so this is the drawer's per-row area count.
+        area_count: diagnostics.route_count,
+        round_unit: resolveLapRoundPolicy(source, diagnostics.route_count) ? 'lap' : 'round'
     });
     return {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
+        requested_iterations: advertisedIterations,
         successful_iterations: successful,
         failed_iterations: failed,
         links,
@@ -1278,11 +1426,13 @@ async function runCredentialPlatform(input, options) {
         errors.push('account and password are required');
         return empty;
     }
+    // Advertised before the area list is known: lap rows report their lap cap.
+    const startLap = resolveLapRoundPolicy(source, 0);
     const startPolicy = resolveRoundPolicy(source);
     event(options, 'extract_source_started', {
         source_name: input.source_name,
-        requested_iterations: startPolicy.max_iterations,
-        min_iterations: startPolicy.min_iterations,
+        requested_iterations: resolveAdvertisedMaxIterations(source),
+        min_iterations: startLap ? startLap.policy.min_iterations : startPolicy.min_iterations,
         resume_from_iteration: 1,
         platform
     });
@@ -1293,7 +1443,7 @@ async function runCredentialPlatform(input, options) {
     // answering. That keeps a normal run to a handful of HTTP calls.
     // Keyed by the data plane, not the storefront: a redirected row downloads and
     // inspects the backend's APK, so it must share that brand's cached entry.
-    const brandKey = source.brand_override ?? credentialBrandKey(input.source_name, source);
+    const brandKey = fingerprintKeyFor(input.source_name, source);
     const store = options.fingerprintStore ?? null;
     // Same rule as the outer memo: a caller-supplied memo is keyed by the row
     // name, so a redirected row must not read or write through it.
@@ -1305,7 +1455,24 @@ async function runCredentialPlatform(input, options) {
     // vendor can rotate the signing certificate while the old seeds still serve
     // `/api/eversion`, and then every login fails on a stale certificate.
     const fresh = store?.readFresh(brandKey) ?? null;
-    const storedEntry = store?.read(brandKey) ?? null;
+    let storedEntry = store?.read(brandKey) ?? null;
+    if (!storedEntry && store && !source.brand_override) {
+        // An older build keyed this row by its official-site host. Reuse that entry
+        // instead of forcing an APK download the host may not be able to make, and
+        // move it to the canonical key so the next run reads it directly.
+        const legacyKey = legacyFingerprintKey(input.source_name, source);
+        if (legacyKey !== brandKey) {
+            const legacy = store.readFresh(legacyKey) ?? store.read(legacyKey);
+            if (legacy) {
+                log(`[extract] adopting fingerprint cached under ${legacyKey}`);
+                // Copies the entry under the canonical key while keeping the original
+                // `verified_at`: stamping a new one would promote an entry that is
+                // genuinely past its window into a trusted one.
+                store.adopt(brandKey, legacy);
+                storedEntry = store.read(brandKey);
+            }
+        }
+    }
     const staleButUsable = Boolean(storedEntry) && !fresh;
     const cached = staleButUsable ? storedEntry : memo.get();
     const session = options.egressSession;
@@ -1316,7 +1483,7 @@ async function runCredentialPlatform(input, options) {
     // Report real extraction work instead of making the UI infer APK/domain
     // activity from text logs. Cache reuse remains distinct from executed work.
     const substage = (name, status) => event(options, 'extract_substage', { source_name: input.source_name, platform, substage: name, status });
-    const inspectApk = async () => {
+    const inspectApk = async (recordFailure = true) => {
         substage('apk_download', 'running');
         let apkBytes = null;
         try {
@@ -1331,11 +1498,15 @@ async function runCredentialPlatform(input, options) {
                 source.brand_override ?? input.source_name, egress);
         }
         catch (error) {
-            errors.push(`apk: ${error instanceof Error ? error.message : String(error)}`);
+            if (recordFailure) {
+                errors.push(`apk: ${error instanceof Error ? error.message : String(error)}`);
+            }
         }
         if (!apkBytes) {
             substage('apk_download', 'failed');
-            errors.push('APK could not be located');
+            if (recordFailure) {
+                errors.push('APK could not be located');
+            }
             return null;
         }
         substage('apk_download', 'success');
@@ -1352,7 +1523,7 @@ async function runCredentialPlatform(input, options) {
         log(`[extract] ${discovered.package_name} ${discovered.version_name} seeds=${discovered.seed_domains.length}`);
         return discovered.seed_domains.length > 0 ? discovered : null;
     };
-    const inspectSharedApk = () => (memo.resolve ? memo.resolve(inspectApk) : inspectApk());
+    const inspectSharedApk = (recordFailure = true) => (memo.resolve ? memo.resolve(() => inspectApk(recordFailure)) : inspectApk(recordFailure));
     // `apk_url` / `apk_path` are an explicit override: when either is set the
     // caller is asserting a specific build, so a cached fingerprint must not
     // shadow it. Otherwise the cache would make the override a no-op.
@@ -1373,7 +1544,11 @@ async function runCredentialPlatform(input, options) {
             // stale certificate fails every login with no other signal.
             if (staleButUsable) {
                 log('[extract] cached fingerprint is past its trust window; re-inspecting the APK');
-                const refreshed = await inspectSharedApk();
+                // The refresh is opportunistic: the cached entry already answered
+                // `/api/eversion`, so an unreachable storefront must not also append
+                // "APK could not be located" to a run that is about to work. That line
+                // was the whole error text of a run whose nodes came through fine.
+                const refreshed = await inspectSharedApk(false);
                 if (refreshed) {
                     const refreshedEversion = await tryEversion(refreshed, credentialKeyCandidates(source, refreshed));
                     if (refreshedEversion) {
@@ -1491,10 +1666,15 @@ async function runCredentialPlatform(input, options) {
             diagnostics.membership_expired = isMembershipExpiredMessage(message);
             diagnostics.credential_rejected = !diagnostics.membership_expired && isCredentialLoginRejection(message);
             errors.push(`login rejected: code=${String(payload.code)}`);
-            // A cached fingerprint whose seeds answer eversion but whose signing
-            // cert the vendor rotated keeps failing here on every run. Drop the
-            // cache so the next run re-inspects the APK instead of repeating this.
-            if (cachedInUse) {
+            // A cached fingerprint whose signing cert the vendor rotated fails here,
+            // so the cache must not outlive the failure. Only a real credential
+            // rejection is evidence of that: a throttled or free-tier account is
+            // rejected too, and dropping the brand's fingerprint for it made the next
+            // run re-download the APK from a storefront this host cannot reach —
+            // turning one bad account into a source that never runs again. On a
+            // redirected row that rejection is the norm (most accounts are unknown to
+            // the backend), so there the cache is never dropped on a login result.
+            if (cachedInUse && diagnostics.credential_rejected && !source.brand_override) {
                 store?.clear(brandKey);
             }
             return { ...empty, failed_iterations: 1 };
@@ -1618,9 +1798,13 @@ async function runCredentialPlatform(input, options) {
     // Raw totals use the exact-string identity the pipeline dedupes with, so the
     // live number and `extract_source_completed.raw_links` agree.
     const linkIds = new Set();
-    const policy = resolveRoundPolicy(source);
+    // Lap mode: one round is one full sweep of the frozen list, so the cap and
+    // the plateau are laps with no conversion factor. A row with no lap key
+    // keeps the legacy round policy with identical arguments.
+    const lap = resolveLapRoundPolicy(source, activeRoutes.length);
+    const policy = lap ? lap.policy : resolveRoundPolicy(source);
     const maxIterations = policy.max_iterations;
-    const areasPerRound = resolveAreasPerRound(source.areas_per_round, activeRoutes.length);
+    const areasPerRound = lap ? lap.areas_per_round : resolveAreasPerRound(source.areas_per_round, activeRoutes.length);
     const areaConcurrency = resolveConcurrency(source.area_concurrency, DEFAULT_AREA_CONCURRENCY);
     const cursor = new AreaCursor(activeRoutes);
     const startedAt = Date.now();
@@ -1633,8 +1817,11 @@ async function runCredentialPlatform(input, options) {
     diagnostics.route_count = activeRoutes.length;
     diagnostics.areas_per_round = areasPerRound;
     diagnostics.area_concurrency = areaConcurrency;
-    log(`[extract] area list frozen: ${activeRoutes.length} areas,` +
-        ` ${areasPerRound}/round, concurrency ${areaConcurrency}, egress ${session.transport}`);
+    log(lap
+        ? `[extract] area list frozen: ${activeRoutes.length} areas, ${maxIterations} 遍 (1 遍 = 全部区域各一次),` +
+            ` concurrency ${areaConcurrency}, egress ${session.transport}`
+        : `[extract] area list frozen: ${activeRoutes.length} areas,` +
+            ` ${areasPerRound}/round, concurrency ${areaConcurrency}, egress ${session.transport}`);
     for (let round = 1; round <= maxIterations; round += 1) {
         if (!shouldStartRound(round, policy, (Date.now() - startedAt) / 1000)) {
             break;
@@ -1720,8 +1907,8 @@ async function runCredentialPlatform(input, options) {
             if (session.reportEmptySweep()) {
                 log('[extract] no route answered; switching to the upstream proxy');
             }
-            if (emptySweep >= MAX_EMPTY_ROUNDS) {
-                errors.push(`no route answered for ${emptySweep} consecutive rounds`);
+            if (emptySweep >= (lap?.empty_round_limit ?? MAX_EMPTY_ROUNDS)) {
+                errors.push(`no route answered for ${emptySweep} consecutive ${lap ? 'laps' : 'rounds'}`);
                 break;
             }
         }
@@ -1744,17 +1931,19 @@ async function runCredentialPlatform(input, options) {
             new_item_fingerprints: newFingerprints,
             new_item_link_ids: newLinkIds
         });
-        log(`[extract] round ${round}/${maxIterations} area=${batch.map((route) => route.area).join(',')}` +
+        log((lap
+            ? `[extract] 遍 ${round}/${maxIterations} area=${batch.map((route) => route.area).join(',')}`
+            : `[extract] round ${round}/${maxIterations} area=${batch.map((route) => route.area).join(',')}`) +
             ` +${appendedInRound} new (+${meaningfulInRound} meaningful, total ${links.length},` +
-            ` plateau ${plateau}/${policy.plateau_limit})`);
+            ` plateau ${plateau}/${policy.plateau_limit}${lap ? ' 遍' : ''})`);
         if (shouldStopOnPlateau(round, plateau, policy)) {
-            log(`[extract] early stop: ${plateau} consecutive rounds without a meaningful new node`);
+            log(`[extract] early stop: ${plateau} consecutive ${lap ? 'laps' : 'rounds'} without a meaningful new node`);
             break;
         }
-        if (placeholderStreak >= PLACEHOLDER_ONLY_ROUNDS) {
-            errors.push(`channel produced only placeholder nodes for ${placeholderStreak} rounds; stopping it` +
+        if (placeholderStreak >= (lap?.placeholder_round_limit ?? PLACEHOLDER_ONLY_ROUNDS)) {
+            errors.push(`channel produced only placeholder nodes for ${placeholderStreak} ${lap ? 'laps' : 'rounds'}; stopping it` +
                 ' (this brand does not serve real nodes on this platform)');
-            log(`[extract] ${platform} channel stopped: ${placeholderStreak} rounds of placeholder nodes only.` +
+            log(`[extract] ${platform} channel stopped: ${placeholderStreak} ${lap ? 'laps' : 'rounds'} of placeholder nodes only.` +
                 ' The other channel still runs; this platform is not serving real nodes for this brand.');
             break;
         }
@@ -1770,7 +1959,9 @@ async function runCredentialPlatform(input, options) {
         requested_iterations: maxIterations,
         successful_iterations: successfulRounds,
         failed_iterations: failedRounds,
-        raw_links: links.length
+        raw_links: links.length,
+        area_count: activeRoutes.length,
+        round_unit: lap ? 'lap' : 'round'
     });
     return {
         source_name: input.source_name,
@@ -1781,6 +1972,41 @@ async function runCredentialPlatform(input, options) {
         diagnostics
     };
 }
+/**
+ * Decide what a membership sweep does with one pooled row.
+ *
+ * The sweep logs in with explicit credentials, so the run path's own retirement
+ * (which only fires for a *leased* row) never runs for it — the same decision has
+ * to be reachable from here, or a free-tier account with a date years in the
+ * future stays in rotation forever. Kept pure so the policy can be asserted
+ * without a vendor login.
+ */
+export function classifyMembershipRefresh(facts, today) {
+    const expires = String(facts.membership_expires_at ?? '');
+    if (facts.login_ok) {
+        if (expires && expires < today)
+            return { status: 'expired', reason: 'membership expired' };
+        const level = facts.membership_level;
+        // Links, not routes: the route table is filtered by flags, not by the
+        // account's grade, so a free row can list paid-looking areas and still get
+        // nothing but placeholders. The run path uses links for the same reason.
+        const produced = Number(facts.produced_links ?? 0) > 0;
+        // A free-tier row (level 0/1) only ever yields placeholders. Retire it only
+        // when it produced nothing, exactly as the run path does, so a paid row the
+        // vendor misreports as level 1 keeps its place. A redirected row is exempt
+        // for the run path's reason: the level is the storefront's grading.
+        if (level !== undefined && level < 2 && !produced && !facts.redirected) {
+            return { status: 'retired', reason: 'no paid membership' };
+        }
+        return { status: 'updated', reason: '' };
+    }
+    if (facts.membership_expired)
+        return { status: 'expired', reason: 'membership expired' };
+    // The vendor rejected the credential itself: the row cannot log in at all.
+    if (facts.credential_rejected)
+        return { status: 'retired', reason: 'login rejected' };
+    return { status: 'failed', reason: '' };
+}
 /**
  * Learn every pooled account's real membership expiry by logging in.
  *
@@ -1790,6 +2016,38 @@ async function runCredentialPlatform(input, options) {
  * active rows deliberately, reusing the normal credential flow (cached
  * fingerprint, one node request) so the login path is the same one a run uses.
  */
+/**
+ * Where a membership sweep should log in for each brand.
+ *
+ * The sweep must reach the same host a run reaches, or its verdicts describe a
+ * different account than the one the pool rotates: on a redirected row the run
+ * rewrites `official_site` to the backend before any request, and the sweep
+ * used to probe the storefront the run never touches. Read from the profile so
+ * a redirected row is known here exactly as the run knows it.
+ */
+export function resolveExpiryProbeTargets(env, readSources) {
+    const targets = new Map();
+    let sources = {};
+    try {
+        // The profile path comes from the environment, so the project root argument
+        // is not consulted; `profilePayload` reads the same file a run does.
+        sources = readSources ? readSources() : (profilePayload(process.cwd(), env).sources ?? {});
+    }
+    catch {
+        // No readable profile: every brand falls back to its own storefront.
+    }
+    for (const [name, config] of Object.entries(sources)) {
+        const brand = normalizeBrand(name);
+        if (!brand)
+            continue;
+        const backend = normalizeBrand(String(config?.backend_brand ?? '').trim());
+        targets.set(brand, {
+            officialSite: String(config?.official_site ?? '').trim() || brandSite(brand),
+            ...(backend && backend !== brand ? { backendBrand: backend } : {})
+        });
+    }
+    return targets;
+}
 export async function refreshAccountExpiry(input = {}) {
     const env = input.env ?? process.env;
     const now = input.now ?? (() => new Date());
@@ -1801,11 +2059,20 @@ export async function refreshAccountExpiry(input = {}) {
         cacheDir: resolveFingerprintCacheDir(resolveUserRuntimeRoot(env)),
         now
     });
-    const outcome = { checked: 0, updated: 0, expired: 0, failed: 0, results: [] };
+    const outcome = { checked: 0, updated: 0, expired: 0, retired: 0, failed: 0, results: [] };
     const todayText = localDay(now());
     const requested = input.brand ? normalizeBrand(input.brand) : null;
     // Every brand the pool knows, from the registry rather than a second list.
     const brands = requested ? [requested] : BRANDS.map((brand) => brand.key);
+    // How a run would reach each brand. A redirected row is graded by its own
+    // storefront but logs in — and is graded again — against the backend it
+    // reads, with the backend's APK. Probing the storefront instead put the sweep
+    // on a host the run never touches (the deployment host cannot even resolve
+    // 黑洞's storefront) and graded the account by a backend it never uses, so its
+    // verdicts described a different account than the one the pool rotates.
+    const probeFor = resolveExpiryProbeTargets(env);
+    const probeSite = (brand) => probeFor.get(brand)?.officialSite ?? brandSite(brand);
+    const probeBackend = (brand) => probeFor.get(brand)?.backendBrand;
     try {
         for (const brand of brands) {
             let accounts = store.leaseAll(brand);
@@ -1814,10 +2081,13 @@ export async function refreshAccountExpiry(input = {}) {
             if (accounts.length === 0)
                 continue;
             // One memo per brand: the APK is inspected at most once for the whole
-            // sweep, not once per account. The cache key is the short brand key the
-            // normal run writes (`mf`, not `mifeng`); using the long name missed the
-            // cache on every sweep and re-downloaded the APK per account.
-            const brandKey = credentialBrandKey(brand, { official_site: brandSite(brand) });
+            // sweep, not once per account. The key comes from the same function a run
+            // uses, against the same probe source, so a redirected row is inspected
+            // under the backend's prefix and shares the entry the run just cached.
+            const brandKey = fingerprintKeyFor(brand, {
+                official_site: probeSite(brand),
+                ...(probeBackend(brand) ? { brand_override: probeBackend(brand) } : {})
+            });
             const memo = createFingerprintMemo(fingerprintStore, brandKey);
             await mapWithConcurrency(accounts, concurrency, async (leased) => {
                 const entry = {
@@ -1832,7 +2102,8 @@ export async function refreshAccountExpiry(input = {}) {
                         source_name: brand,
                         source: {
                             mode: 'credential',
-                            official_site: brandSite(brand),
+                            official_site: probeSite(brand),
+                            ...(probeBackend(brand) ? { backend_brand: probeBackend(brand) } : {}),
                             account: leased.account,
                             password: leased.password,
                             platforms: ['android'],
@@ -1843,25 +2114,31 @@ export async function refreshAccountExpiry(input = {}) {
                     }, { env, now, memo, fingerprintStore });
                     const expires = result.diagnostics.membership_expires_at ?? '';
                     entry.expires_at = expires;
-                    if (result.diagnostics.login_ok && expires) {
-                        store.setExpiry(brand, leased.account, expires);
-                        if (expires < todayText) {
-                            store.markExpired(leased.id, 'membership expired');
-                            entry.status = 'expired';
-                            outcome.expired += 1;
-                        }
-                        else {
-                            entry.status = 'updated';
-                            outcome.updated += 1;
-                        }
+                    const verdict = classifyMembershipRefresh({
+                        ...result.diagnostics,
+                        produced_links: result.links.length,
+                        redirected: Boolean(probeBackend(brand))
+                    }, todayText);
+                    entry.status = verdict.status;
+                    if (verdict.status === 'updated' || verdict.status === 'expired') {
+                        // A lapsed date is still the account's real date: keep it on the row
+                        // so the pool shows when it ran out, not an em dash.
+                        if (expires)
+                            store.setExpiry(brand, leased.account, expires);
                     }
-                    else if (result.diagnostics.membership_expired) {
-                        store.markExpired(leased.id, 'membership expired');
-                        entry.status = 'expired';
+                    if (verdict.status === 'expired') {
+                        store.markExpired(leased.id, verdict.reason);
                         outcome.expired += 1;
                     }
+                    else if (verdict.status === 'retired') {
+                        store.markInvalid(leased.id, verdict.reason);
+                        entry.error = verdict.reason;
+                        outcome.retired += 1;
+                    }
+                    else if (verdict.status === 'updated') {
+                        outcome.updated += 1;
+                    }
                     else {
-                        entry.status = 'failed';
                         // The CLI prints this line, so nothing that can carry a credential
                         // or a request URL may reach it.
                         entry.error = redactText(result.diagnostics.errors.join('; ')) || 'login did not report an expiry';