dsh-connect-trae 3.7.0 → 3.9.1

package/lib/index.js

@@ -129,9 +129,16 @@ function traeInputModalities(model) {
 * (wire resolution, callable-key filtering) must keep matching the
 * undecorated name; only the model rows handed to DSH (adapter catalog and
 * model discovery) use this decorated name.
+*
+* `withRate` is false for the ENTERPRISE panel. The multiplier is a
+* consumer-pool figure — personal credits per token, read from the consumer
+* directory — and the tenant pool does not bill against it, so printing it in
+* the model picker would price a model the tenant is not charged for. The rate
+* is part of the NAME that reaches DSH, which is why this is a parameter here
+* and not a rendering decision downstream.
 */
-function traeModelDisplayName(model) {
-	return model.creditMultiplier === void 0 ? model.name : `${model.name} · x${model.creditMultiplier.toFixed(2)}`;
+function traeModelDisplayName(model, withRate = true) {
+	return !withRate || model.creditMultiplier === void 0 ? model.name : `${model.name} · x${model.creditMultiplier.toFixed(2)}`;
 }
 /**
 * Whether one model should be offered image input.
@@ -499,24 +506,61 @@ function readManifest(directory) {
 /** Provider route this bundle owns for the domestic (CN) gateway. */
 const TRAE_PROVIDER = "trae";
 /**
+* Provider route this bundle owns for the CN **enterprise (tenant)** gateway.
+*
+* A separate provider id, not a mode switch, because the two pools bill
+* differently: a tenant account (`tob_online`) is served by BOTH gateways with
+* the SAME credential, and only the enterprise one draws on the enterprise
+* pool. Exposing one id would force a per-call guess about who pays.
+*
+* It never falls back to the consumer pool: picking this provider is the user
+* saying "bill the tenant", so a refusal is reported as an error instead of
+* being silently re-run against the personal quota.
+*/
+const TRAE_ENTERPRISE_PROVIDER = "trae-enterprise";
+/**
 * Provider route this bundle owns for the international (trae.ai) gateway.
 * Named `-global` to match the plugin family's convention (`workbuddy-global`);
 * the internal region bucket stays `ai`, which is the gateway/protocol name.
 */
 const TRAE_AI_PROVIDER = "trae-global";
-/** The provider id each region registers as. */
+/** The provider ids one region publishes, in model-picker order. */
+const TRAE_PROVIDER_IDS = {
+	cn: [TRAE_PROVIDER, TRAE_ENTERPRISE_PROVIDER],
+	ai: [TRAE_AI_PROVIDER]
+};
+/** Each region's default (first) provider id. */
 const TRAE_PROVIDERS = {
 	cn: TRAE_PROVIDER,
 	ai: TRAE_AI_PROVIDER
 };
+const TRAE_PROVIDER_ROUTES = {
+	[TRAE_PROVIDER]: "solo",
+	[TRAE_ENTERPRISE_PROVIDER]: "enterprise",
+	[TRAE_AI_PROVIDER]: "solo"
+};
+/** Chat pool a provider id bills against; `undefined` for an unknown id. */
+function routeOfTraeProvider(provider) {
+	return TRAE_PROVIDER_ROUTES[provider];
+}
 /** Human-readable provider names, shown in the DSH model picker. */
 const TRAE_PROVIDER_DISPLAY_NAMES = {
 	cn: "Trae",
 	ai: "Trae Global"
 };
+/** Display name per provider id (the region table above only names the default). */
+const TRAE_PROVIDER_ID_DISPLAY_NAMES = {
+	[TRAE_PROVIDER]: "Trae",
+	[TRAE_ENTERPRISE_PROVIDER]: "Trae 企业版",
+	[TRAE_AI_PROVIDER]: "Trae Global"
+};
+/** Display name of a provider id. */
+function displayNameOfTraeProvider(provider) {
+	return TRAE_PROVIDER_ID_DISPLAY_NAMES[provider] ?? provider;
+}
 /** Region a provider route id belongs to. */
 function regionOfTraeProvider(provider) {
-	for (const [region, id] of Object.entries(TRAE_PROVIDERS)) if (id === provider) return region;
+	for (const [region, ids] of Object.entries(TRAE_PROVIDER_IDS)) if (ids.includes(provider)) return region;
 }
 const TRAE_STREAM_IDLE_TIMEOUT_MS = 3e5;
 const INERT_AUTH = {
@@ -549,10 +593,10 @@ const REQUEST_IMAGE_BUDGETS = {
 * failing the entire provider route (`INVALID_MODEL_CONTEXT`).
 */
 const FALLBACK_CONTEXT_WINDOW = 2e5;
-function toPiModel(info, baseUrl, providerId) {
+function toPiModel(info, baseUrl, providerId, withRate = true) {
 	return {
 		id: info.id,
-		name: traeModelDisplayName(info),
+		name: traeModelDisplayName(info, withRate),
 		api: "openai-completions",
 		provider: providerId,
 		baseUrl,
@@ -770,7 +814,12 @@ function createTraeAdapter(options) {
 	const providerId = options.provider ?? "trae";
 	const providerName = options.displayName ?? "Trae";
 	const generation = options.piAiGeneration ?? piAiRuntimeInfo().generation;
-	const buildModels = () => options.catalog.current().map((info) => toPiModel(info, `${options.shim.baseUrl()}/v1`, providerId));
+	/**
+	* The enterprise provider shows no rate: the multiplier belongs to the
+	* consumer pool, and this provider bills the tenant pool.
+	*/
+	const showRate = options.provider !== TRAE_ENTERPRISE_PROVIDER;
+	const buildModels = () => options.catalog.current().map((info) => toPiModel(info, `${options.shim.baseUrl()}/v1`, providerId, showRate));
 	const provider = {
 		...createProvider({
 			id: providerId,
@@ -806,7 +855,7 @@ function createTraeAdapter(options) {
 		adapter: new PiAiAdapter({
 			profiles: () => profiles,
 			auth: INERT_AUTH,
-			resolveApiKey: async () => options.shim.token(),
+			resolveApiKey: async () => options.secret ?? options.shim.token(),
 			...options.resolveAttachments === void 0 ? {} : { resolveAttachments: options.resolveAttachments }
 		}),
 		invalidate() {
@@ -815,7 +864,113 @@ function createTraeAdapter(options) {
 	};
 }
 //#endregion
+//#region src/region.ts
+/** Every panel, in card tab order. */
+const TRAE_PANELS = [
+	"cn",
+	"enterprise",
+	"ai"
+];
+/** The region whose credential/account pool a panel draws on. */
+function regionOfPanel(panel) {
+	return panel === "ai" ? "ai" : "cn";
+}
+/** The provider id a panel publishes. */
+function providerOfPanel(panel) {
+	if (panel === "enterprise") return "trae-enterprise";
+	return panel === "ai" ? "trae-global" : "trae";
+}
+/** The panel that owns a provider id, or undefined for an unknown id. */
+function panelOfProvider(provider) {
+	return TRAE_PANELS.find((panel) => providerOfPanel(panel) === provider);
+}
+/** Narrow a stored settings key to a panel. */
+function panelOfKey(value) {
+	return TRAE_PANELS.includes(value) ? value : void 0;
+}
+/**
+* Verified gateway bases per region (docs/INTL_SG_EVIDENCE.md §2).
+* The AI gateway is shared by both international installs (Trae desktop and
+* TRAE SOLO); its mchost shards (`api16/api22-normal-alisg.mchost.guru`)
+* answer the same bytes but stay internal — `coresg-normal.trae.ai` is the
+* single stable entry point.
+*/
+const REGION_GATEWAYS = {
+	cn: {
+		chat: "https://trae-api-cn.mchost.guru",
+		remote: "https://solo.trae.cn/api/remote/v1",
+		pay: "https://api.trae.cn"
+	},
+	ai: {
+		chat: "https://coresg-normal.trae.ai",
+		remote: "https://coresg-normal.trae.ai/api/remote/v1",
+		pay: "https://growsg-normal.trae.ai"
+	}
+};
+/**
+* Enterprise (tenant) chat gateway for a CN credential that belongs to a
+* `tob_online` tenant.
+*
+* This is a SECOND chat gateway on the same credential, not a second region:
+* the roster, the credential and the protocol are the same as `cn`, but a
+* tenant account is billed against the enterprise pool when the request goes
+* here. Measured 2026-10-17 on a live `Trae CN` tenant account: the same model
+* served from this host does not move the personal `consumed_amount`, while
+* the same call to `trae-api-cn.mchost.guru` charges it.
+*
+* Two wire differences, both load-bearing:
+*  - the request must carry a per-call `session_id` (the consumer gateway
+*    rejects it with `4001`), and
+*  - a refused call answers **HTTP 200** whose FIRST SSE frame is
+*    `event:error` with `code: 4001` — not an HTTP error status, so the
+*    refusal is only visible if the response body is inspected.
+*/
+const TRAE_ENTERPRISE_HOST = "https://console.enterprise.trae.cn";
+/** Region for an edition label: the international installs belong to `ai`. */
+function regionOfEdition(edition) {
+	return edition === "sg" || edition === "solo-sg" ? "ai" : "cn";
+}
+/**
+* Region from the credential's `userRegion` claim. The desktop storage spells
+* it as an object (`{"region":"CN","_aiRegion":"CN"}`); the app logs also
+* spell the bare value lowercase (`"sg"`). Both are accepted, case-blind.
+*/
+function regionOfUserRegion(value) {
+	const raw = typeof value === "object" && value !== null && !Array.isArray(value) ? value["region"] : value;
+	if (typeof raw !== "string") return void 0;
+	const lowered = raw.trim().toLowerCase();
+	if (lowered === "cn") return "cn";
+	if (lowered === "sg" || lowered === "ai") return "ai";
+}
+/** Region from a credential host (`.trae.ai` → ai, `.trae.cn`/`.trae.com.cn` → cn). */
+function regionOfHost(host) {
+	if (host === void 0) return void 0;
+	const trimmed = host.trim();
+	if (trimmed === "") return void 0;
+	let hostname;
+	try {
+		hostname = new URL(trimmed.startsWith("http") ? trimmed : `https://${trimmed}`).hostname;
+	} catch {
+		return;
+	}
+	if (hostname === "trae.ai" || hostname.endsWith(".trae.ai")) return "ai";
+	if (hostname === "trae.cn" || hostname.endsWith(".trae.cn") || hostname.endsWith(".trae.com.cn")) return "cn";
+}
+/**
+* Region of a credential: the `userRegion` claim wins, the host suffix is the
+* fallback, and the edition label is the last resort. Every level is derived
+* from data the credential itself carries, so no user configuration is needed.
+*/
+function regionOfCredential(credential) {
+	return regionOfUserRegion(credential.userRegion) ?? regionOfHost(credential.host) ?? regionOfEdition(credential.edition);
+}
+//#endregion
 //#region src/status-paths.ts
+/**
+* Node-free constants and types shared by the Host and browser halves.
+* Mirrors the `dsh-workbuddy-connect` status-route pattern so the plugin card
+* stays consistent with that project's external presentation.
+*/
 /** Plugin-owned usage endpoint consumed by its browser half. */
 const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
 /** Plugin-owned live model refresh endpoint. */
@@ -857,6 +1012,49 @@ const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
 */
 const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
 /**
+* Plugin-owned account-pool endpoint: one route for the pool's batch actions.
+*
+* 参考：`dsh-connect-workbuddy` 的 `WORKBUDDY_POOL_PATH`。本路由与该实现同形
+*   （同一 `?action=` 风格、POST、loopback-only、per-row `accountId`），这样同时
+*   装了两个插件的用户面对的是同一套交互。
+*
+* `?action=checkin` and `?action=test` run over the whole member set; `remove`
+* addresses ONE account (the body carries `accountId`) and is the only way a
+* measurement of an account the user no longer wants can leave the store — a
+* deleted member otherwise keeps its row in the file forever, and a re-added
+* member would silently inherit an old exclusion.
+*
+* POST + loopback-only because both batches SPEND something: check-in sends a
+* claim, and a test is a real chat call. A page that is not the Host's own
+* loopback must not be able to trigger either.
+*/
+const TRAE_POOL_PATH = "/plugins/dsh-connect-trae/pool";
+/** Query parameter selecting which pool batch action a request means. */
+const TRAE_POOL_ACTION_PARAM = "action";
+/** Query parameter naming ONE pool account a per-row request addresses. */
+const TRAE_POOL_ACCOUNT_PARAM = "accountId";
+/** Read the pool action off a request URL; unknown/absent means undefined. */
+function poolActionOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(TRAE_POOL_ACTION_PARAM);
+	return value === "checkin" || value === "test" || value === "remove" ? value : void 0;
+}
+/**
+* Read the ONE account a per-row pool request addresses, from the QUERY string.
+*
+* Unlike the transfer route, the pool's `accountId` rides the URL rather than the
+* body, so a row action and a batch action are distinguishable before any bytes
+* are read — which is what lets the route refuse a malformed request without ever
+* touching the store.
+*/
+function poolAccountIdOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(TRAE_POOL_ACCOUNT_PARAM);
+	return value === null || value === "" ? void 0 : value;
+}
+/**
 * Plugin-owned account transfer endpoint: batch export and import of a region's
 * stored credentials (issue #37).
 *
@@ -882,8 +1080,8 @@ const TRAE_REGIONS = ["cn", "ai"];
 * Address one region's status route. The two regions are separate provider
 * stacks; every card request carries the region whose tab the user is on.
 */
-function withTraeRegion(path, region) {
-	return `${path}?${TRAE_REGION_PARAM}=${region}`;
+function withTraeRegion(path, panel) {
+	return `${path}?${TRAE_REGION_PARAM}=${panel}`;
 }
 /**
 * Read the region parameter off a status-route URL. Absent means the domestic
@@ -894,7 +1092,7 @@ function regionOfTraeStatusUrl(url) {
 	const at = url.indexOf("?");
 	const value = at === -1 ? null : new URLSearchParams(url.slice(at + 1)).get(TRAE_REGION_PARAM);
 	if (value === null || value === "") return "cn";
-	return TRAE_REGIONS.includes(value) ? value : void 0;
+	return TRAE_PANELS.includes(value) ? value : void 0;
 }
 /**
 * Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
@@ -971,11 +1169,11 @@ function followAppLoginEnabled(configured) {
 * region's picks. Tolerates any stored shape (absent, non-object) by starting
 * from an empty document.
 */
-function nextRegionSlots(regions, region, slot) {
+function nextRegionSlots(regions, panel, slot) {
 	const unwrapped = unwrapVolatileDeep(regions);
 	return {
 		...typeof unwrapped === "object" && unwrapped !== null && !Array.isArray(unwrapped) ? unwrapped : {},
-		[region]: slot
+		[panel]: slot
 	};
 }
 /**
@@ -1000,8 +1198,8 @@ function regionsMapOf(value) {
 	return record;
 }
 /** One region's stored slot as a plain object; any other shape reads as empty. */
-function regionSlotOf(value, region) {
-	const slot = unwrapVolatile(regionsMapOf(value)[region]);
+function regionSlotOf(value, panel) {
+	const slot = unwrapVolatile(regionsMapOf(value)[panel]);
 	return typeof slot === "object" && slot !== null && !Array.isArray(slot) ? slot : {};
 }
 /**
@@ -1014,8 +1212,10 @@ function regionSlotOf(value, region) {
 * `value` may be the whole settings section or the `regions` map (see
 * {@link regionsMapOf}).
 */
-function regionEnabledOf(value, region) {
-	return regionSlotOf(value, region)["enabled"] !== false;
+function regionEnabledOf(value, panel) {
+	const stored = regionSlotOf(value, panel)["enabled"];
+	if (typeof stored === "boolean") return stored;
+	return panel !== "enterprise";
 }
 /**
 * Build the next `regions` settings value for a provider on/off toggle. ONLY
@@ -1033,9 +1233,9 @@ function regionEnabledOf(value, region) {
 * value is always the `regions` map, i.e. exactly what `settingsScope.set(
 * 'regions', ...)` needs.
 */
-function nextRegionEnabled(value, region, enabled) {
-	return nextRegionSlots(regionsMapOf(value), region, {
-		...regionSlotOf(value, region),
+function nextRegionEnabled(value, panel, enabled) {
+	return nextRegionSlots(regionsMapOf(value), panel, {
+		...regionSlotOf(value, panel),
 		enabled
 	});
 }
@@ -1052,8 +1252,8 @@ function nextRegionEnabled(value, region, enabled) {
 * `value` may be the whole settings section or the `regions` map (see
 * {@link regionsMapOf}).
 */
-function regionCreditPositionOf(value, region) {
-	return regionSlotOf(value, region)["creditPosition"] === "stats" ? "stats" : "composer";
+function regionCreditPositionOf(value, panel) {
+	return regionSlotOf(value, panel)["creditPosition"] === "stats" ? "stats" : "composer";
 }
 /**
 * Build the next `regions` settings value for one region's credit seat.
@@ -1066,9 +1266,9 @@ function regionCreditPositionOf(value, region) {
 * value is always the `regions` map, i.e. exactly what `settingsScope.set(
 * 'regions', ...)` needs.
 */
-function nextRegionCreditPosition(value, region, position) {
-	return nextRegionSlots(regionsMapOf(value), region, {
-		...regionSlotOf(value, region),
+function nextRegionCreditPosition(value, panel, position) {
+	return nextRegionSlots(regionsMapOf(value), panel, {
+		...regionSlotOf(value, panel),
 		creditPosition: position
 	});
 }
@@ -1564,65 +1764,6 @@ function traeCliCandidates(platform = process.platform, home = homedir(), env =
 	return result;
 }
 //#endregion
-//#region src/region.ts
-/**
-* Verified gateway bases per region (docs/INTL_SG_EVIDENCE.md §2).
-* The AI gateway is shared by both international installs (Trae desktop and
-* TRAE SOLO); its mchost shards (`api16/api22-normal-alisg.mchost.guru`)
-* answer the same bytes but stay internal — `coresg-normal.trae.ai` is the
-* single stable entry point.
-*/
-const REGION_GATEWAYS = {
-	cn: {
-		chat: "https://trae-api-cn.mchost.guru",
-		remote: "https://solo.trae.cn/api/remote/v1",
-		pay: "https://api.trae.cn"
-	},
-	ai: {
-		chat: "https://coresg-normal.trae.ai",
-		remote: "https://coresg-normal.trae.ai/api/remote/v1",
-		pay: "https://growsg-normal.trae.ai"
-	}
-};
-/** Region for an edition label: the international installs belong to `ai`. */
-function regionOfEdition(edition) {
-	return edition === "sg" || edition === "solo-sg" ? "ai" : "cn";
-}
-/**
-* Region from the credential's `userRegion` claim. The desktop storage spells
-* it as an object (`{"region":"CN","_aiRegion":"CN"}`); the app logs also
-* spell the bare value lowercase (`"sg"`). Both are accepted, case-blind.
-*/
-function regionOfUserRegion(value) {
-	const raw = typeof value === "object" && value !== null && !Array.isArray(value) ? value["region"] : value;
-	if (typeof raw !== "string") return void 0;
-	const lowered = raw.trim().toLowerCase();
-	if (lowered === "cn") return "cn";
-	if (lowered === "sg" || lowered === "ai") return "ai";
-}
-/** Region from a credential host (`.trae.ai` → ai, `.trae.cn`/`.trae.com.cn` → cn). */
-function regionOfHost(host) {
-	if (host === void 0) return void 0;
-	const trimmed = host.trim();
-	if (trimmed === "") return void 0;
-	let hostname;
-	try {
-		hostname = new URL(trimmed.startsWith("http") ? trimmed : `https://${trimmed}`).hostname;
-	} catch {
-		return;
-	}
-	if (hostname === "trae.ai" || hostname.endsWith(".trae.ai")) return "ai";
-	if (hostname === "trae.cn" || hostname.endsWith(".trae.cn") || hostname.endsWith(".trae.com.cn")) return "cn";
-}
-/**
-* Region of a credential: the `userRegion` claim wins, the host suffix is the
-* fallback, and the edition label is the last resort. Every level is derived
-* from data the credential itself carries, so no user configuration is needed.
-*/
-function regionOfCredential(credential) {
-	return regionOfUserRegion(credential.userRegion) ?? regionOfHost(credential.host) ?? regionOfEdition(credential.edition);
-}
-//#endregion
 //#region src/auth.ts
 /** Host used for CLI tokens, which carry no host claim of their own. */
 const CLI_DEFAULT_HOST = "https://api.trae.cn";
@@ -1641,6 +1782,14 @@ const CLI_DEFAULT_HOST = "https://api.trae.cn";
 * working and upgrades itself the next time a credential is written; it is
 * never written again.
 */
+/**
+* How long a FAILED per-account refresh is remembered.
+*
+* Long enough that a revoked refresh token costs one exchange per five minutes
+* instead of two per card poll, short enough that a transient network failure is
+* retried on the next screen the user opens.
+*/
+const REFRESH_RETRY_MS = 3e5;
 const OWN_VERSION = 2;
 /** The superseded single-credential layout, still read for migration. */
 const OWN_VERSION_SINGLE = 1;
@@ -1688,12 +1837,15 @@ function normalizeTraeCredential(raw, edition, source) {
 	const refreshExpiresAtMs = timeToMs(value["refreshExpiredAt"] ?? value["refreshExpiresAt"]);
 	const refreshToken = optionalString(value["refreshToken"]);
 	const userRegion = userRegionOf(value["userRegion"]);
-	const accountName = optionalString((typeof value["account"] === "object" && value["account"] !== null && !Array.isArray(value["account"]) ? value["account"] : void 0)?.["username"]);
+	const account = typeof value["account"] === "object" && value["account"] !== null && !Array.isArray(value["account"]) ? value["account"] : void 0;
+	const accountName = optionalString(account?.["username"]);
+	const tenantId = optionalString(account?.["tenant_id"]) ?? (typeof account?.["tenant_id"] === "number" ? String(account["tenant_id"]) : void 0);
 	return {
 		accessToken,
 		...refreshToken === void 0 ? {} : { refreshToken },
 		userId: optionalString(value["userId"]) ?? "",
 		...accountName === void 0 ? {} : { accountName },
+		...tenantId === void 0 ? {} : { tenantId },
 		host: optionalString(value["host"]) ?? "",
 		...userRegion === void 0 ? {} : { userRegion },
 		expiresAtMs,
@@ -1702,10 +1854,38 @@ function normalizeTraeCredential(raw, edition, source) {
 		source
 	};
 }
+/**
+* Whether this account belongs to a Trae tenant, i.e. may bill the enterprise
+* pool.
+*
+* Evidence (2026-10-17, live): the tenant's own account carries
+* `account.tenant_id` / `tenant_name` and `scope: 'saas'`; the personal SOLO
+* account carries neither and reports `scope: 'marscode'`. Only the tenant one
+* streams on the enterprise gateway — the other answers `4019` risk control.
+*/
+function isEnterpriseAccount(credential) {
+	return credential?.tenantId !== void 0 && credential.tenantId.trim() !== "";
+}
 function traeAccountId(credential) {
 	const stable = `${credential.edition}\0${credential.userId || credential.accountName || "unknown"}`;
 	return createHash("sha256").update(stable).digest("hex").slice(0, 24);
 }
+/**
+* The exact shape of an account id — sha256 hex sliced to 24 characters, which is
+* what {@link traeAccountId} emits and therefore the only string a request may
+* legitimately name.
+*
+* This regex is a traversal guard as much as a validator: an id becomes part of a
+* path (`$DSH_HOME/.trae-pool.<panel>.json` uses it as a key, and a credential
+* lookup receives it), so `../../etc/passwd` has to fail here rather than fail
+* somewhere closer to the filesystem. Exported so an HTTP route can answer a bad
+* id with 400 instead of letting an exception surface as a 500.
+*/
+const TRAE_ACCOUNT_ID_RE = /^[0-9a-f]{24}$/;
+/** Whether a request-supplied value is a well-formed Trae account id. */
+function isTraeAccountId(value) {
+	return typeof value === "string" && TRAE_ACCOUNT_ID_RE.test(value);
+}
 /** One stored credential, validated. Returns undefined for a malformed row. */
 function credentialOfStored(stored) {
 	if (typeof stored !== "object" || stored === null || Array.isArray(stored)) return void 0;
@@ -1718,7 +1898,10 @@ function credentialOfStored(stored) {
 		userId: record["userId"],
 		host: record["host"],
 		userRegion: record["userRegion"],
-		account: record["accountName"] === void 0 ? void 0 : { username: record["accountName"] },
+		account: record["accountName"] === void 0 && record["tenantId"] === void 0 ? void 0 : {
+			...record["accountName"] === void 0 ? {} : { username: record["accountName"] },
+			...record["tenantId"] === void 0 ? {} : { tenant_id: record["tenantId"] }
+		},
 		expiredAt: record["expiresAtMs"],
 		refreshExpiredAt: record["refreshExpiredAtMs"]
 	}, edition, "dsh");
@@ -1773,17 +1956,52 @@ var TraeCredentialStore = class {
 	edition;
 	accountId;
 	region;
+	requireTenant;
+	hideTenantAccounts;
 	ownPathExplicit;
 	legacyOwnPath;
 	legacyOwnPathExplicit;
 	refresh;
 	refreshMarginMs;
 	inflight;
+	/**
+	* In-flight refreshes of individual accounts, one per account id.
+	*
+	* The card reads every member's balance in one poll and each balance can
+	* decide to refresh, so without this dedupe the same account would exchange
+	* its token several times in a second and the last writer would win over a
+	* copy another read already holds.
+	*/
+	inflightByAccount = /* @__PURE__ */ new Map();
+	/**
+	* When a per-account refresh last FAILED, so a dead refresh token is not
+	* exchanged again on every poll.
+	*
+	* The card reads every member's balance on each refresh, and a revoked refresh
+	* token fails forever: without this memo each poll would spend two upstream
+	* calls (the current contract and the superseded one) on an account no retry
+	* can fix. Five minutes keeps a transient network failure cheap to retry while
+	* a revoked sign-in costs almost nothing.
+	*/
+	refreshFailedAtMs = /* @__PURE__ */ new Map();
+	/**
+	* The account the NEXT request should bill, when a pool — not the user's
+	* binding — is choosing (issue #44).
+	*
+	* Runtime only, never persisted: the binding in settings is what a save
+	* writes and what the card's account table reports as selected, while this is
+	* "who serves right now". Keeping them apart is what lets the pool rotate
+	* without silently rewriting the user's choice, and what makes turning the
+	* pool off restore the bound account with no rebind at all.
+	*/
+	rotatedAccountId;
 	constructor(options) {
 		this.storagePathOverride = options.storagePath;
 		this.edition = options.edition ?? "auto";
 		this.accountId = options.accountId;
 		this.region = options.region;
+		this.requireTenant = options.requireTenant === true;
+		this.hideTenantAccounts = options.hideTenantAccounts === true;
 		this.ownPathExplicit = options.ownPath;
 		this.legacyOwnPath = options.legacyOwnPath ?? legacyTraeOwnAuthPath();
 		this.legacyOwnPathExplicit = options.legacyOwnPath;
@@ -1867,7 +2085,9 @@ var TraeCredentialStore = class {
 	* the plugin performed is never discarded by this preference.
 	*/
 	preferred(credentials) {
-		return credentials.find((credential) => credential.source === "desktop") ?? credentials[0];
+		const eligible = this.requireTenant ? credentials.filter((credential) => isEnterpriseAccount(credential)) : credentials;
+		if (eligible.length === 0) return void 0;
+		return eligible.find((credential) => credential.source === "desktop") ?? eligible[0];
 	}
 	/**
 	* The account the Trae app is signed in to right now, when that differs from
@@ -1891,6 +2111,7 @@ var TraeCredentialStore = class {
 			id: liveId,
 			accountName: live.accountName ?? (live.userId || `${live.edition} account`),
 			edition: live.edition,
+			enterprise: isEnterpriseAccount(live),
 			region: regionOfCredential(live),
 			source: live.source,
 			tokenExpiresAtMs: live.expiresAtMs,
@@ -1898,25 +2119,135 @@ var TraeCredentialStore = class {
 			selected: false
 		};
 	}
+	/**
+	* The accounts this store is willing to OFFER.
+	*
+	* Scoped to who this store may bill:
+	*   - a consumer store withholds tenant accounts (the enterprise pool is a
+	*     separate tab and a separate billing decision), and
+	*   - a tenant store withholds personal accounts (they cannot bill that
+	*     pool; the tenant gateway answers their chat with 4019).
+	*
+	* Either filter backs off when it would hide EVERYTHING, so a machine whose
+	* only login is on the other side keeps working instead of reading as
+	* "signed out".
+	*/
+	offered(discovered) {
+		const eligible = this.requireTenant ? discovered.filter((credential) => isEnterpriseAccount(credential)) : this.hideTenantAccounts ? discovered.filter((credential) => !isEnterpriseAccount(credential)) : discovered;
+		return eligible.length > 0 ? eligible : discovered;
+	}
 	async accounts() {
-		const credentials = await this.readAll();
-		const selectedExists = this.accountId !== void 0 && credentials.some((credential) => traeAccountId(credential) === this.accountId);
-		const defaultSelected = this.preferred(credentials);
+		const discovered = await this.readAll();
+		const offered = this.offered(discovered);
+		const inUse = this.inUse(discovered, offered);
+		/**
+		* Never hide the account we are actually billing.
+		*
+		* An explicit binding outranks the display filter (`inUse` honours it even
+		* when the offered list withholds it), and a list whose active row is
+		* invisible is worse than no list: the card's "save the selected account"
+		* press reads `selected`, so a hidden binding would be rewritten to whichever
+		* account merely happened to be DISPLAYED — silently moving the user's
+		* billing to an account they never chose. Re-appending it costs one extra
+		* row and makes the card tell the truth.
+		*/
+		const credentials = inUse !== void 0 && !offered.includes(inUse) ? [...offered, inUse] : offered;
+		const inUseId = inUse === void 0 ? void 0 : traeAccountId(inUse);
 		return credentials.map((credential) => ({
 			id: traeAccountId(credential),
 			accountName: credential.accountName ?? (credential.userId || `${credential.edition} account`),
 			edition: credential.edition,
+			enterprise: isEnterpriseAccount(credential),
 			region: regionOfCredential(credential),
 			source: credential.source,
 			tokenExpiresAtMs: credential.expiresAtMs,
 			...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: credential.refreshExpiresAtMs },
-			selected: selectedExists ? traeAccountId(credential) === this.accountId : credential === defaultSelected
+			selected: inUseId !== void 0 && traeAccountId(credential) === inUseId
 		}));
 	}
+	/**
+	* The credential this store bills, given every credential it can see.
+	*
+	* This is the ONE resolution rule, and it exists so that `current()` and
+	* `accounts()` cannot disagree: `current()` applies it to `readAll()`, and
+	* `accounts()` applies the SAME verdict to decide which row reads as
+	* `selected`. Deriving that flag independently is exactly how the two drifted
+	* apart — and a card that marks a different account than the one the chat
+	* bills is worse than no card at all, because a press that "saves the
+	* selected account" then rewrites the binding to the account that was only
+	* ever DISPLAYED.
+	*
+	* Order of business:
+	*   1. No binding — the detected default (`preferred`) is in use, chosen from
+	*      the OFFERED list rather than from every login on the machine. A
+	*      consumer store that withholds tenant accounts must not default its
+	*      billing to the tenant pool merely because that login sorts first;
+	*      withholding is a billing decision, not a display detail.
+	*   2. A binding — honour it verbatim, even when the OFFERED list hides that
+	*      account. Resolution is never scoped by `hideTenantAccounts`: the user's
+	*      explicit choice outranks a display filter.
+	*   3. A tenant-scoped store cannot bill through a personal account, and the
+	*      tenant gateway only reveals that at the first chat (`4019`). Honour the
+	*      binding when it is eligible; otherwise fall back to the preferred
+	*      tenant account, which is the one the user's enterprise tab is meant to
+	*      use.
+	*   4. A saved account can disappear when Trae replaces its local login. Do
+	*      NOT silently fall back to a different account: that would bill a
+	*      different account than the one the user explicitly selected. Return
+	*      undefined so the caller surfaces "no signed-in account" and the user
+	*      can re-select, instead of the plugin quietly switching accounts behind
+	*      their back.
+	*/
+	inUse(discovered, offered) {
+		if (this.accountId === void 0) return this.preferred(offered);
+		const selected = discovered.find((credential) => traeAccountId(credential) === this.accountId);
+		if (this.requireTenant && !isEnterpriseAccount(selected)) return this.preferred(offered);
+		return selected;
+	}
+	/**
+	* Point this store at one specific account for the NEXT request, without
+	* touching the user's saved binding (issue #44).
+	*
+	* Called by the account pool before each chat request. `undefined` clears the
+	* override, which is how switching the pool off immediately restores the
+	* binding — no rebind, no settings write, nothing to undo.
+	*
+	* A rotation is a REQUEST, not an assertion: `current()` honours it only when
+	* the account still exists locally and this store's own eligibility rules
+	* allow it, and otherwise falls back to the binding. So a rotation can never
+	* invent a credential that {@link current} would refuse.
+	*/
+	setRotatedAccount(accountId) {
+		if (this.rotatedAccountId === accountId) return;
+		this.rotatedAccountId = accountId;
+		this.inflight = void 0;
+	}
+	/** The rotation currently in effect, for diagnostics and the pool's own card. */
+	rotatedAccount() {
+		return this.rotatedAccountId;
+	}
+	/**
+	* The credential a rotation points at, or `undefined` when it cannot be
+	* honoured (the login was removed from this machine, or a tenant-scoped store
+	* refuses a personal account).
+	*
+	* Never substitutes a different account here: the caller then applies the
+	* user's binding, which is the honest answer when the pool's choice is gone.
+	*/
+	rotated(discovered, offered) {
+		const id = this.rotatedAccountId;
+		if (id === void 0) return void 0;
+		const credential = offered.find((item) => traeAccountId(item) === id) ?? discovered.find((item) => traeAccountId(item) === id);
+		if (credential === void 0) return void 0;
+		if (this.requireTenant && !isEnterpriseAccount(credential)) return void 0;
+		return credential;
+	}
 	async current() {
-		const credentials = await this.readAll();
-		if (this.accountId === void 0) return this.preferred(credentials);
-		return credentials.find((credential) => traeAccountId(credential) === this.accountId);
+		const discovered = await this.readAll();
+		const offered = this.offered(discovered);
+		const rotated = this.rotated(discovered, offered);
+		if (rotated !== void 0) return rotated;
+		return this.inUse(discovered, offered);
 	}
 	/**
 	* The stored credential of one specific account, without changing which
@@ -1938,6 +2269,41 @@ var TraeCredentialStore = class {
 		return (await this.readAll()).find((credential) => traeAccountId(credential) === accountId);
 	}
 	/**
+	* A SPECIFIC account's credential, refreshed when its access token is due.
+	*
+	* {@link credentialOf} is a pure lookup and hands back an expired token as-is,
+	* which is right for the chat path (that request fails honestly) but wrong for
+	* a READ of that account's own data: Trae's access token lives for days while
+	* the refresh token lives for months, so a pooled account the user has not
+	* used this week reads as "no balance" — the card showed a bare `—` for an
+	* account whose refresh token was still good. Only the refresh margin decides
+	* here, and a FAILED refresh still yields the stored credential so the caller
+	* reports the failure it actually hit instead of inventing "not signed in".
+	*
+	* This never touches the binding or the rotation: refreshing account B must
+	* not make B the account the next chat request bills.
+	*/
+	async resolveCredentialOf(accountId) {
+		const credential = await this.credentialOf(accountId);
+		if (credential === void 0) return void 0;
+		if (credential.expiresAtMs > Date.now() + this.refreshMarginMs) return credential;
+		const pending = this.inflightByAccount.get(accountId);
+		if (pending !== void 0) return pending;
+		const failedAt = this.refreshFailedAtMs.get(accountId);
+		if (failedAt !== void 0 && Date.now() - failedAt < REFRESH_RETRY_MS) return credential;
+		const attempt = this.refreshNow(credential).then((refreshed) => {
+			this.refreshFailedAtMs.delete(accountId);
+			return refreshed;
+		}).catch(() => {
+			this.refreshFailedAtMs.set(accountId, Date.now());
+			return credential;
+		}).finally(() => {
+			this.inflightByAccount.delete(accountId);
+		});
+		this.inflightByAccount.set(accountId, attempt);
+		return attempt;
+	}
+	/**
 	* Store imported credentials (issue #37), replacing any entry with the same
 	* account id and leaving every other entry alone.
 	*
@@ -2363,7 +2729,7 @@ async function refreshTraeCredential(credential, signal, device) {
 }
 //#endregion
 //#region src/identity.ts
-function nonEmpty(value) {
+function nonEmpty$1(value) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
 function deviceCenterId(storage) {
@@ -2388,8 +2754,8 @@ function deviceKeyPairOf(storage) {
 		const plaintext = parseTraeAuthValue(encoded);
 		if (typeof plaintext !== "object" || plaintext === null || Array.isArray(plaintext)) return void 0;
 		const value = plaintext;
-		const privateKeyPEM = nonEmpty(value["privateKeyPEM"]);
-		const publicKeyPEM = nonEmpty(value["publicKeyPEM"]);
+		const privateKeyPEM = nonEmpty$1(value["privateKeyPEM"]);
+		const publicKeyPEM = nonEmpty$1(value["publicKeyPEM"]);
 		return privateKeyPEM === void 0 || publicKeyPEM === void 0 ? void 0 : {
 			privateKeyPEM,
 			publicKeyPEM
@@ -2405,14 +2771,14 @@ async function readTraeIdentity(candidate, options = {}) {
 	const env = options.env ?? process.env;
 	const storage = JSON.parse(await readFile(candidate.path, "utf8"));
 	const appRoot = dirname(dirname(dirname(candidate.path)));
-	const machineFile = nonEmpty(await readFile(join(appRoot, "machineid"), "utf8").catch(() => ""));
-	const telemetryMachine = nonEmpty(storage["telemetry.machineId"]);
-	const devDevice = nonEmpty(storage["telemetry.devDeviceId"]);
+	const machineFile = nonEmpty$1(await readFile(join(appRoot, "machineid"), "utf8").catch(() => ""));
+	const telemetryMachine = nonEmpty$1(storage["telemetry.machineId"]);
+	const devDevice = nonEmpty$1(storage["telemetry.devDeviceId"]);
 	const dcDevice = deviceCenterId(storage);
 	const machineId = telemetryMachine ?? machineFile;
 	if (machineId === void 0) throw new Error(`Trae ${candidate.edition} has no stable machine identity`);
 	const deviceId = dcDevice ?? devDevice ?? createHash("sha256").update(machineId).digest("hex").slice(0, 32);
-	const buildVersion = nonEmpty(storage["iCubeLastVersion"]);
+	const buildVersion = nonEmpty$1(storage["iCubeLastVersion"]);
 	const appName = {
 		cn: "Trae CN",
 		sg: "Trae",
@@ -2432,18 +2798,18 @@ async function readTraeIdentity(candidate, options = {}) {
 		product = JSON.parse(await readFile(path, "utf8"));
 		break;
 	} catch {}
-	const appVersion = nonEmpty(product["appVersion"]);
-	const deviceBrand = platform === "darwin" ? nonEmpty(env["TRAE_DEVICE_BRAND"]) : void 0;
+	const appVersion = nonEmpty$1(product["appVersion"]);
+	const deviceBrand = platform === "darwin" ? nonEmpty$1(env["TRAE_DEVICE_BRAND"]) : void 0;
 	const deviceCpu = cpus()[0]?.model.split(" ")[0];
 	const osVersion = `${platform === "darwin" ? "macOS" : platform === "win32" ? "Windows" : platform} ${release()}`;
 	const deviceName = (() => {
 		try {
-			return nonEmpty(userInfo().username);
+			return nonEmpty$1(userInfo().username);
 		} catch {
 			return;
 		}
 	})();
-	const deviceModel = nonEmpty(env["TRAE_DEVICE_MODEL"]);
+	const deviceModel = nonEmpty$1(env["TRAE_DEVICE_MODEL"]);
 	const deviceKeyPair = deviceKeyPairOf(storage);
 	return {
 		edition: candidate.edition,
@@ -2520,12 +2886,12 @@ async function readTraeCliIdentity(edition, options = {}) {
 	const cliHome = join(home, CLI_HOME_BY_EDITION[edition]);
 	const argv = await readJsonFile(join(cliHome, "argv.json"));
 	const version = await readJsonFile(join(cliHome, "builtin", "ide_version.json"));
-	const crashReporterId = nonEmpty(argv?.["crash-reporter-id"]);
-	const host = nonEmpty(env["HOSTNAME"]) ?? await readHostname() ?? "unknown-host";
-	const user = nonEmpty(env["USER"]) ?? nonEmpty(env["USERNAME"]) ?? "unknown-user";
+	const crashReporterId = nonEmpty$1(argv?.["crash-reporter-id"]);
+	const host = nonEmpty$1(env["HOSTNAME"]) ?? await readHostname() ?? "unknown-host";
+	const user = nonEmpty$1(env["USER"]) ?? nonEmpty$1(env["USERNAME"]) ?? "unknown-user";
 	const deviceId = crashReporterId ?? createHash("sha256").update(`trae-cli\0${host}\0${user}`).digest("hex").slice(0, 32);
 	const machineId = createHash("sha256").update(`trae-cli-machine\0${deviceId}\0${host}`).digest("hex");
-	const appVersion = nonEmpty(version?.["version"]);
+	const appVersion = nonEmpty$1(version?.["version"]);
 	const deviceCpu = cpus()[0]?.model.split(" ")[0];
 	const osVersion = `${platform === "darwin" ? "macOS" : platform === "win32" ? "Windows" : platform} ${release()}`;
 	return {
@@ -2551,7 +2917,7 @@ async function readJsonFile(path) {
 async function readHostname() {
 	try {
 		const { hostname } = await import("node:os");
-		return nonEmpty(hostname());
+		return nonEmpty$1(hostname());
 	} catch {
 		return;
 	}
@@ -2611,6 +2977,29 @@ const STATUS_BY_KIND = {
 	client: 400,
 	unconfigured: 503
 };
+/**
+* Failures that say something about the ACCOUNT and are therefore worth another
+* account: a rejected token, a drained quota, a rate limit, a 5xx.
+*
+* `not_found`, `client` and `unconfigured` are deliberately absent — they say
+* something about the request or this build, and replaying them on a second
+* account would burn the same error twice while teaching the pool a false fact
+* about an account that never got a chance to serve.
+*/
+const FAILOVER_KINDS = /* @__PURE__ */ new Set([
+	"authentication",
+	"hard_credit",
+	"soft_rate",
+	"server"
+]);
+/**
+* Accounts one request may try.
+*
+* Not "all of them": every attempt costs a round-trip before the user sees a
+* byte, and a pool whose every member is down must fail with a reason instead of
+* turning one request into a slow tour of the roster.
+*/
+const MAX_POOL_ATTEMPTS = 3;
 function hostnameOfHost(host) {
 	let hostname = host.trim().toLowerCase();
 	if (hostname.startsWith("[")) {
@@ -2664,7 +3053,19 @@ function readBody(req) {
 	});
 }
 function createTraeShim(options) {
-	const secret = randomBytes(32).toString("base64url");
+	/**
+	* Resolve the route table. The single-client form becomes a one-entry table
+	* labelled `solo`, so existing call sites and tests keep one code path.
+	*/
+	const routes = options.routes !== void 0 ? options.routes.map((route) => ({
+		...route,
+		secret: randomBytes(32).toString("base64url")
+	})) : [{
+		label: "solo",
+		client: options.client,
+		secret: randomBytes(32).toString("base64url")
+	}];
+	const secret = routes[0]?.secret ?? randomBytes(32).toString("base64url");
 	const sockets = /* @__PURE__ */ new Set();
 	const server = createServer((req, res) => {
 		handle(req, res);
@@ -2678,18 +3079,65 @@ function createTraeShim(options) {
 		server.once("error", reject);
 	});
 	server.listen(0, "127.0.0.1");
-	function bearerOk(req) {
+	/** Route whose secret matches the request's bearer, or `undefined`. */
+	function routeOf(req) {
 		const match = typeof req.headers.authorization === "string" ? /^Bearer\s+(.+)$/i.exec(req.headers.authorization.trim()) : null;
-		if (match === null) return false;
+		if (match === null) return void 0;
 		const actual = Buffer.from(match[1] ?? "");
-		const expected = Buffer.from(secret);
-		return actual.length === expected.length && timingSafeEqual(actual, expected);
+		for (const route of routes) {
+			const expected = Buffer.from(route.secret);
+			if (actual.length === expected.length && timingSafeEqual(actual, expected)) return route;
+		}
+	}
+	/**
+	* Run one chat request, failing over across pooled accounts when the account
+	* that was chosen cannot serve it (issue #44).
+	*
+	* The happy path makes exactly one upstream call, so a pool that is switched
+	* off — or on, with the first choice healthy — costs nothing but one cheap
+	* ranking lookup. A failure is reported to the pool BEFORE the decision to
+	* retry, because a rate limit the pool never hears about is a rate limit it
+	* will walk straight back into on the next request.
+	*/
+	async function chatWithFailover(route, raw, signal) {
+		const pool = route.pool;
+		let client = route.client;
+		let accountId = pool === void 0 ? void 0 : await pool.prepare().catch(() => void 0);
+		const tried = [];
+		for (let attempt = 0;; attempt += 1) {
+			const result = await client.chatStream(raw, signal);
+			if (result.ok) return {
+				kind: "stream",
+				response: result.response
+			};
+			const retryable = pool !== void 0 && !signal.aborted && FAILOVER_KINDS.has(result.kind);
+			if (retryable && accountId !== void 0) await pool.failed(accountId, result.kind, result.message).catch(() => {});
+			const failed = {
+				kind: "failed",
+				status: STATUS_BY_KIND[result.kind],
+				code: result.kind,
+				message: result.message
+			};
+			if (!retryable) return failed;
+			if (accountId !== void 0) tried.push(accountId);
+			const next = attempt + 1 >= MAX_POOL_ATTEMPTS ? void 0 : await pool.next(tried).catch(() => void 0);
+			if (next === void 0) {
+				const reason = await pool.shortfall(tried).catch(() => void 0);
+				return reason === void 0 ? failed : {
+					...failed,
+					message: `${failed.message} (${reason})`
+				};
+			}
+			client = next.client;
+			accountId = next.accountId;
+		}
 	}
 	async function handle(req, res) {
 		try {
 			if (!hostIsLoopback(req.headers.host)) return writeError(res, 403, "host_not_allowed", "Host must be loopback");
 			if (!originIsLoopback(req.headers.origin)) return writeError(res, 403, "origin_not_allowed", "Origin must be loopback");
-			if (!bearerOk(req)) return writeError(res, 401, "unauthorized", "Missing or invalid bearer");
+			const route = routeOf(req);
+			if (route === void 0) return writeError(res, 401, "unauthorized", "Missing or invalid bearer");
 			const url = req.url ?? "/";
 			if (req.method === "GET" && (url === "/healthz" || url === "/healthz/")) return writeJson(res, 200, { ok: true });
 			if (req.method === "GET" && (url === "/v1/models" || url === "/v1/models/")) return writeJson(res, 200, {
@@ -2723,8 +3171,8 @@ function createTraeShim(options) {
 				const abort = () => controller.abort();
 				req.once("aborted", abort);
 				req.socket.once("close", abort);
-				const result = await options.client.chatStream(raw, controller.signal);
-				if (!result.ok) return writeError(res, STATUS_BY_KIND[result.kind], result.kind, result.message);
+				const result = await chatWithFailover(route, raw, controller.signal);
+				if (result.kind === "failed") return writeError(res, result.status, result.code, result.message);
 				res.writeHead(200, {
 					"Content-Type": "text/event-stream",
 					"Cache-Control": "no-cache",
@@ -2759,6 +3207,12 @@ function createTraeShim(options) {
 			return `http://127.0.0.1:${address.port}`;
 		},
 		token: () => secret,
+		tokenOf(label) {
+			if (label === void 0) return secret;
+			const route = routes.find((entry) => entry.label === label);
+			if (route === void 0) throw new Error(`trae shim has no route named ${label}`);
+			return route.secret;
+		},
 		close: () => new Promise((resolve, reject) => {
 			for (const socket of sockets) socket.destroy();
 			server.close((error) => error === void 0 ? resolve() : reject(error));
@@ -3107,7 +3561,7 @@ var TraeSoloUpstreamClient = class {
 	async fetchModels(signal) {
 		const [credential, identity] = await Promise.all([this.options.credential(), this.options.identity()]);
 		const region = regionOfCredential(credential);
-		const base = this.options.baseUrl ?? REGION_GATEWAYS[region].chat;
+		const base = this.options.baseUrl ?? this.chatBaseOf(credential);
 		const headers = {
 			...buildTraeCnHeaders(credential, identity),
 			Accept: "application/json"
@@ -3193,7 +3647,19 @@ var TraeSoloUpstreamClient = class {
 		}
 		const [credential, identity] = await Promise.all([this.options.credential(), this.options.identity()]);
 		const headers = buildTraeCnHeaders(credential, identity);
-		const base = this.options.baseUrl ?? REGION_GATEWAYS[regionOfCredential(credential)].chat;
+		const base = this.options.baseUrl ?? this.chatBaseOf(credential);
+		if (this.options.route === "enterprise") try {
+			const parsed = JSON.parse(prepared);
+			if (parsed["session_id"] === void 0) parsed["session_id"] = randomUUID();
+			prepared = JSON.stringify(parsed);
+		} catch {
+			return {
+				ok: false,
+				status: 400,
+				kind: "client",
+				message: "invalid JSON request"
+			};
+		}
 		let response;
 		try {
 			response = await this.fetchImpl(traeEndpoint(base, TRAE_SOLO_CHAT_PATH), {
@@ -3210,10 +3676,36 @@ var TraeSoloUpstreamClient = class {
 				message: `transport error: ${String(error)}`
 			};
 		}
-		if (response.ok) return {
-			ok: true,
-			response
-		};
+		if (response.ok) {
+			/**
+			* The enterprise gateway reports a refusal as **HTTP 200** whose first
+			* SSE frame is `event:error`. Handing that stream back as a success would
+			* surface the refusal as an empty assistant turn, so it is converted to
+			* a real error here — the same shape the consumer gateway uses for its
+			* non-2xx failures.
+			*/
+			if (this.options.route !== "enterprise") return {
+				ok: true,
+				response
+			};
+			const classified = await classifyEnterpriseResponse(response);
+			if ("response" in classified) return {
+				ok: true,
+				response: classified.response
+			};
+			this.options.log?.("dsh-connect-trae: enterprise llm_utils_chat refused", {
+				status: 200,
+				model: JSON.parse(prepared)["model"],
+				configName: JSON.parse(prepared)["config_name"],
+				body: classified.refusal
+			});
+			return {
+				ok: false,
+				status: 200,
+				kind: "client",
+				message: classified.refusal
+			};
+		}
 		const text = (await response.text()).slice(0, 1024);
 		this.options.log?.("dsh-connect-trae: llm_utils_chat rejected", {
 			status: response.status,
@@ -3229,10 +3721,80 @@ var TraeSoloUpstreamClient = class {
 			message: text || `Trae SOLO returned HTTP ${response.status}`
 		};
 	}
+	/** Chat gateway for this client's pinned route. */
+	chatBaseOf(credential) {
+		if (this.options.route === "enterprise") return TRAE_ENTERPRISE_HOST;
+		return REGION_GATEWAYS[regionOfCredential(credential)].chat;
+	}
 };
-//#endregion
-//#region src/sse.ts
-/** Incremental SSE decoder supporting CRLF, chunk splits and multi-line data. */
+/**
+* Return the refusal frame of an enterprise 200, or `undefined` when the stream
+* is a real answer.
+*
+* Reads (and re-plays) only the first SSE frame: a refusal is emitted before
+* any output token, so peeking that far is enough to classify the call, and
+* the stream is rebuilt so a caller that got `undefined` still sees every byte.
+*/
+function concatStream(head, reader) {
+	return new ReadableStream({ start(controller) {
+		if (head !== "") controller.enqueue(new TextEncoder().encode(head));
+		const drain = () => {
+			reader.read().then((result) => {
+				if (result.done) {
+					controller.close();
+					return;
+				}
+				controller.enqueue(result.value);
+				drain();
+			}).catch((error) => controller.error(error));
+		};
+		drain();
+	} });
+}
+/**
+* Classify an enterprise 200.
+*
+* Returns `{ refusal }` when the first SSE frame is `event:error`, otherwise
+* `{ response }` carrying a REBUILT response whose body re-emits every byte —
+* including the peeked frame. A refusal is emitted before any output token, so
+* peeking one frame is enough to classify the call.
+*
+* The response is rebuilt rather than patched: the original's body has been
+* partially read, so its `text()`/`json()` would keep failing with "Body has
+* already been read" even after `body` is swapped.
+*/
+async function classifyEnterpriseResponse(response) {
+	const body = response.body;
+	if (body === null) return { response };
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let head = "";
+	try {
+		while (!head.includes("\n\n")) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			head += decoder.decode(value, { stream: true });
+			if (head.length > 8192) break;
+		}
+	} catch {
+		return { response };
+	}
+	const frame = head.split("\n\n")[0] ?? "";
+	const event = /^event:(\S+)/m.exec(frame)?.[1];
+	const data = frame.split("\n").find((line) => line.startsWith("data:"))?.slice(5).trim() ?? "";
+	if (event !== "error") return { response: new Response(concatStream(head, reader), {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	}) };
+	try {
+		await reader.cancel();
+	} catch {}
+	return { refusal: data === "" ? "enterprise gateway refused the request" : data };
+}
+//#endregion
+//#region src/sse.ts
+/** Incremental SSE decoder supporting CRLF, chunk splits and multi-line data. */
 var SseDecoder = class {
 	buffer = "";
 	event;
@@ -3370,6 +3932,13 @@ function decodeTraeEvent(event) {
 *    two different statements, and a user hits the second without touching the
 *    first (issue #33).
 *  - `4023` — the model name is unknown on the route that was asked.
+*  - `4222` — the ENTERPRISE tenant's allowance is exhausted. Measured
+*    2026-10-17 on a live tenant account whose enterprise credit ran out: the
+*    gateway answered HTTP 200 with `{"code":4222,"message":""}` for a model
+*    that streamed normally moments earlier (and still streams on the consumer
+*    gateway). Like `4008` it is a billing fact rather than a config one, but
+*    it is specific to the tenant pool -- the consumer balance is unaffected,
+*    which is why it must not be folded into the `4008` reading.
 *  - `2001` — the upstream has not published its function config for the route
 *    that was asked. Evidence is issue #39: on a live CN account every SOLO
 *    function's `get_detail_param` answered HTTP 200 with `config_info_list:
@@ -3387,7 +3956,8 @@ const TRAE_ERROR_HINTS = {
 	4001: "Trae does not serve this model under the SOLO function the request used (config_name rejected)",
 	4008: "Trae reports the account's SOLO quota is exhausted for this request",
 	4011: "Trae throttled the SOLO channel for this account (a rate limit, not the credit balance)",
-	4023: "Trae does not recognise this model name on the SOLO route that was asked"
+	4023: "Trae does not recognise this model name on the SOLO route that was asked",
+	4222: "The enterprise tenant allowance is exhausted (tenant spend is separate from the personal credit balance; the consumer gateway still has its own)"
 };
 /** `extra` is a JSON *string* on the wire; unwrap it to read `plan`. */
 function traeErrorPlan(extra) {
@@ -3717,14 +4287,29 @@ var TraeSoloBridge = class {
 		try {
 			const input = JSON.parse(bodyJson);
 			if (typeof input["model"] === "string" && input["model"] !== "") model = input["model"];
-			const entry = this.catalog?.current().find((item) => item.id === model);
+			const entryKey = model.trim().toLowerCase();
+			const entry = this.catalog?.current().find((item) => item.id === model || item.id.trim().toLowerCase() === entryKey);
 			const fromCatalog = entry?.wireConfigName === void 0 ? void 0 : {
 				configName: entry.wireConfigName,
 				...entry.wireFunction === void 0 ? {} : { function: entry.wireFunction }
 			};
 			const fromResolver = this.wireResolver?.(model) ?? this.wireResolver?.(entry?.name ?? "");
 			const target = fromCatalog ?? fromResolver;
-			const wireModel = target?.configName ?? model;
+			/**
+			* Last line of defence: the discovered row's own id.
+			*
+			* For models whose directory id IS the gateway `config_name` the merge
+			* deliberately emits no `wireConfigName` (there is nothing to map), so a
+			* requested id that differs only by case has neither mapping source —
+			* and the row we just matched case-blindly is exactly the canonical
+			* spelling. Sending it is what a correct mapping would have produced.
+			*
+			* Deliberately NOT derived from the row's `name`: the rosters spell most
+			* ids in the opposite case of their display names (`glm-5.3` vs
+			* `GLM-5.3`) and the gateway accepts the LOWERCASE id for those — a
+			* name-derived rewrite answered `4001` for 4 of 5 probed models.
+			*/
+			const wireModel = target?.configName ?? entry?.id ?? model;
 			const wireFunction = target?.function ?? entry?.wireFunction;
 			if (wireModel !== input["model"]) input["model"] = wireModel;
 			if (wireFunction !== void 0 && input["function"] !== wireFunction) input["function"] = wireFunction;
@@ -4630,13 +5215,37 @@ async function readProbeOutput(response) {
 		};
 	}
 }
-/** The minimal chat call one probe makes. */
-function probeBody(model) {
+/**
+* The chat call one probe makes.
+*
+* `inputTokens` pads the user turn so the probe carries roughly as much text as
+* a real conversation. Size matters because an upstream that refuses LARGE
+* requests will happily answer a one-word probe, and a verdict earned by a
+* 1-token request says nothing about the 30k-token turn the user is about to
+* send. `0` keeps the historical minimal probe (one word) — that is the default
+* because it spends the least credit and answers the question the pool ranks on
+* ("can this account talk at all").
+*
+* The filler is `x` words: one ASCII word is about one token, so the body size
+* is predictable (tokens ≈ inputTokens × 2 characters) without a tokenizer.
+*/
+/**
+* The largest probe this plugin will pad.
+*
+* A 100k-token probe is already ~200 KB of JSON; anything above that is a request
+* the user's real turn would not plausibly reach in this product, and a config
+* file edited by hand must not turn one "test all" click into a multi-megabyte
+* upload.
+*/
+const MAX_PROBE_INPUT_TOKENS = 1e5;
+function probeBody(model, inputTokens = 0) {
+	const padded = Math.min(Math.max(0, Math.floor(inputTokens)), MAX_PROBE_INPUT_TOKENS);
+	const content = padded > 0 ? `ping ${"x ".repeat(padded).trimEnd()}` : "ping";
 	return JSON.stringify({
 		model,
 		messages: [{
 			role: "user",
-			content: "ping"
+			content
 		}]
 	});
 }
@@ -4645,11 +5254,11 @@ function probeBody(model) {
 * recorded verdict describes the user's real path (same wire resolution, same
 * function stamping, same error translation).
 */
-async function probeOneModel(chat, id, timeoutMs = TRAE_PROBE_TIMEOUT_MS) {
+async function probeOneModel(chat, id, timeoutMs = TRAE_PROBE_TIMEOUT_MS, inputTokens = 0) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const result = await chat(probeBody(id), controller.signal);
+		const result = await chat(probeBody(id, inputTokens), controller.signal);
 		if (!result.ok) return {
 			id,
 			...classifyProbeResult(result, false)
@@ -4969,6 +5578,322 @@ var TraeUsageClient = class {
 	}
 };
 //#endregion
+//#region src/account-pool.ts
+/**
+* How long an account stays out of the pool when the upstream stated no time.
+*
+* A conservative FALLBACK, not a measurement: it applies whenever a failed
+* outcome carries no `retryAtMs` — every rate limit that came without a reset
+* sentence AND every transient failure (a transport error, a 5xx). In both cases
+* "when can I use this again" has no honest answer.
+*
+* The two failure directions it avoids: keeping the account in the pool would
+* re-bill it immediately and re-trip the same limit; dropping it FOREVER would
+* discard a working account over an event that said nothing about it. A short,
+* stated cooldown is the least-wrong of the two — and it is what lets the pool
+* heal itself, since nothing else re-probes an excluded member.
+*/
+const POOL_UNKNOWN_COOLDOWN_MS = 18e5;
+/**
+* Whether one account can be billed at `nowMs`.
+*
+* Returns the exclusion reason, or undefined when the account is a candidate.
+* The order matters and is NOT arbitrary:
+*
+* - A `credential-rejected` account is excluded regardless of any cooldown: its
+*   token is not accepted, so waiting cannot help and the user must re-auth.
+*   (`401` / `403` from Trae, and the `ExchangeToken` rejection of an expired
+*   refresh token, land here.)
+* - A limited, unreachable or failed outcome is checked against its stated (or
+*   fallback) cooldown, so an account whose limit has already reset — or whose
+*   gateway blipped once — is back in the pool without needing another test.
+* - An `ok` measurement, and no measurement at all, are both candidates. The
+*   latter matters: a freshly discovered account has never been tested and must
+*   not be invisible.
+*
+* `not-found`, `credential-rejected` and `plan-gated` deliberately get NO
+* cooldown: one describes a model this channel does not serve (a catalog fact),
+* one needs the user to sign in again, and one needs a plan change. None is fixed
+* by waiting, and pretending otherwise would re-bill a state the upstream has
+* already refused.
+*
+* `policy-rejected` is NOT the `default` branch: a content-policy refusal is a
+* fact about ONE REQUEST, not about the account, so the account stays a candidate
+* exactly like `ok`. The measurement is still recorded so the card can explain
+* what happened.
+*
+* An outcome this build does not know becomes `unusable` rather than a candidate:
+* billing through a state we cannot interpret is worse than leaving the account
+* out until a later version explains it.
+*/
+function exclusionOf(probe, nowMs) {
+	if (probe === void 0) return void 0;
+	switch (probe.outcome) {
+		case "ok": return;
+		case "credential-rejected": return "credential-rejected";
+		case "not-found": return "not-found";
+		case "plan-gated": return "plan-gated";
+		case "unavailable": return retryDue(probe, nowMs) ? void 0 : "unavailable";
+		case "failed": return retryDue(probe, nowMs) ? void 0 : "failed";
+		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
+		case "model-busy": return retryDue(probe, nowMs, 12e4) ? void 0 : "model-busy";
+		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
+		case "policy-rejected": return;
+		default: return "unusable";
+	}
+}
+/**
+* Whether an account's cooldown has elapsed (or was never stated).
+*
+* The fallback is the ONLY thing a transient outcome relies on: `retryAtMs` is
+* attached for a rate limit or a drained quota, never for a transport failure, so
+* `atMs + POOL_UNKNOWN_COOLDOWN_MS` is what brings those back.
+*
+* `fallbackMs` lets one outcome carry a SHORTER clock than the generic one. It is
+* a parameter rather than a second function so every outcome shares one definition
+* of "due".
+*/
+function retryDue(probe, nowMs, fallbackMs = POOL_UNKNOWN_COOLDOWN_MS) {
+	return nowMs >= (probe.retryAtMs ?? probe.atMs + fallbackMs);
+}
+/**
+* Rank a pool's members best-first.
+*
+* The rule, in priority order — this is the whole feature:
+*
+* 1. **Usability.** Only accounts that can be billed right now are candidates;
+*    they always outrank every excluded one.
+* 2. **Expiring credits first, soonest first.** Points about to expire are worth
+*    exactly zero after they do, so spending them before they lapse is strictly
+*    better than saving them.
+* 3. **Largest expiring amount.** Between two accounts that both have expiring
+*    points, the one with more at risk goes first.
+* 4. **Credits, highest first.** Among accounts with nothing expiring, spend the
+*    one with the most, so a nearly-drained account is conserved.
+* 5. **Freshest credential.** Tie-break so a stale token never wins a draw.
+* 6. **Account id.** Final tie-break, making the order TOTAL: two accounts equal on
+*    every key would otherwise keep the caller's array order, so the same pool
+*    could rotate differently between two runs.
+*
+* WHY EXPIRY OUTRANKS SIZE (workbuddy issue #70). These used to be strict
+* lexicographic keys: total, THEN expiry. Since totals are almost never exactly
+* equal, the expiry rule was unreachable — an account with 196 points lapsing that
+* day ranked LAST behind accounts that expire weeks later, simply because it held
+* ~1,200 fewer points overall. It was never selected, so those points always
+* lapsed. A "use it or lose it" rule that another rule completely shadows is not a
+* tie-break, it is dead code.
+*
+* WHY SPENDING THE SMALL EXPIRING ACCOUNT IS STILL RIGHT. Credits are fungible, so
+* using the rich account instead does not preserve the 1 point — it spends the 1
+* point's chance and loses it. Using the expiring account spends a point that was
+* going to be lost anyway, and the rich account is still there for the next
+* request. The only real cost is a failover round-trip if the expiring account
+* cannot cover a whole request, which the exclusion/failover path already absorbs.
+*
+* Excluded accounts are still RETURNED (sorted after the candidates) so the card
+* can explain why each is out; they differ from candidates by `excludedBy` being
+* set, never by being silently dropped.
+*
+* Pure and total: the same input always yields the same order, and it never throws
+* on missing data (an account with no credits is ranked as 0, not crashed on).
+*/
+function rankPool(members, nowMs) {
+	const rows = members.map((member) => {
+		const excludedBy = exclusionOf(member.probe, nowMs);
+		return {
+			account: member.account,
+			score: scoreOf(member),
+			...excludedBy === void 0 ? {} : { excludedBy },
+			_usable: excludedBy === void 0,
+			_atRisk: (member.credits?.expiringSoon ?? 0) > 0,
+			_expiringAmount: member.credits?.expiringSoon ?? 0,
+			_expiring: member.credits?.nearestExpiryMs ?? Number.POSITIVE_INFINITY,
+			_tokenExpiresAtMs: member.tokenExpiresAtMs ?? 0
+		};
+	});
+	rows.sort((left, right) => {
+		if (left._usable !== right._usable) return left._usable ? -1 : 1;
+		if (left._atRisk !== right._atRisk) return left._atRisk ? -1 : 1;
+		if (left._atRisk && right._atRisk && left._expiring !== right._expiring) return left._expiring - right._expiring;
+		if (left._expiringAmount !== right._expiringAmount) return right._expiringAmount - left._expiringAmount;
+		if (left.score !== right.score) return right.score - left.score;
+		if (left._tokenExpiresAtMs !== right._tokenExpiresAtMs) return right._tokenExpiresAtMs - left._tokenExpiresAtMs;
+		return left.account.id < right.account.id ? -1 : left.account.id > right.account.id ? 1 : 0;
+	});
+	return rows.map(({ account, score, excludedBy }) => ({
+		account,
+		score,
+		...excludedBy === void 0 ? {} : { excludedBy }
+	}));
+}
+/**
+* The checked ids that still resolve to a local sign-in, in the caller's order.
+*
+* This is THE definition of "effective members". It exists because the same
+* predicate wants to be written in several places (the status document, the batch
+* route's empty-pool guard, the host dependency the card reads) and "fixed one
+* end, missed the other" is this project's most productive bug shape, so the rule
+* has one home and every site delegates to it.
+*
+* ORDER IS THE CALLER'S: the answer preserves the order of `orderedIds`. Callers
+* pass whichever list's order they want to show — the saved list for the user's
+* own order, the store's roster for the account table's.
+*/
+function effectiveMembersOf(orderedIds, listedIds) {
+	return orderedIds.filter((id) => listedIds.has(id));
+}
+/**
+* The members that may actually be billed, in the store's order.
+*
+* Three rules in one place, because a request path and a batch that each decide
+* "who counts" separately is how a pool ends up billing an account the user did
+* not opt into:
+*
+* - the SAVED opt-in list is the roster (`effectiveMembersOf` — an id the user
+*   never selected, or one this machine no longer has, is not a candidate);
+* - `triedIds` are the accounts that already failed THIS request, so a failover
+*   never walks back into the one that just refused it;
+* - a ghost (saved but not listed) is absent from `members`, so it drops out here
+*   without a second check.
+*
+* An EMPTY `savedIds` yields an empty result on purpose: an enabled pool with no
+* members bills nobody, rather than silently meaning "all of them".
+*/
+function billableMembers(members, savedIds, triedIds = []) {
+	const saved = new Set(effectiveMembersOf(savedIds, new Set(members.map((member) => member.account.id))));
+	const tried = new Set(triedIds);
+	return members.filter((member) => saved.has(member.account.id) && !tried.has(member.account.id));
+}
+/**
+* The account to bill, or undefined when the pool has no usable member.
+*
+* A thin selector over {@link rankPool} so the winner is decided in exactly one
+* place: every caller that needs "who serves now" gets the same answer.
+*/
+function pickAccount(members, nowMs) {
+	return rankPool(members, nowMs).find((row) => row.excludedBy === void 0)?.account;
+}
+/**
+* The credit figure used for ordering.
+*
+* Absent credits rank as zero. Deliberately NOT "unknown ranks first": an account
+* whose balance could not be read must never outrank one we positively know is
+* full, or a failing credit read would capture all the traffic.
+*/
+function scoreOf(member) {
+	return member.credits?.total ?? 0;
+}
+/**
+* Pick the free model to test against, from one panel's catalog.
+*
+* "Free" means `creditMultiplier === 0` EXACTLY. An absent multiplier is NOT free:
+* the CN static fallback catalog carries no multiplier at all, so treating absence
+* as zero would silently bill real credits on a "free" probe.
+*
+* Among the free candidates the LARGEST context window wins, because the probe
+* sends a real payload and a long-conversation probe is the point.
+*
+* Returns undefined when the panel has no free model, which the caller must render
+* as "none available" — never as a fallback to a paid model.
+*/
+function pickFreeModel(catalog) {
+	let best;
+	for (const model of catalog) {
+		if (model.creditMultiplier !== 0) continue;
+		if (best === void 0 || (model.contextWindow ?? 0) > (best.contextWindow ?? 0)) best = model;
+	}
+	return best;
+}
+/**
+* Resolve the model the pool should test against.
+*
+* A user-specified id always wins (it is a preference, not a computed default) and
+* is returned even when it is a PAID model: the card says so explicitly rather than
+* silently overriding the user's choice.
+*
+* The choice is VALIDATED against the panel's catalog, because the catalog changes:
+* the CN roster is empty until its first refresh, and models come and go. A saved
+* id that is no longer offered used to be returned as `preferred`, which let the
+* card enable its test button and the host run a batch against a model nobody
+* offers. It is reported as `stale` instead — never silently replaced by the free
+* model (that would test something the user did not choose) and never run.
+*/
+function resolveTargetModel(catalog, preferredId) {
+	if (preferredId !== void 0 && preferredId !== "") return catalog.some((model) => model.id === preferredId) ? {
+		modelId: preferredId,
+		source: "preferred"
+	} : {
+		staleModelId: preferredId,
+		source: "stale"
+	};
+	const free = pickFreeModel(catalog);
+	return free === void 0 ? { source: "none" } : {
+		modelId: free.id,
+		source: "free"
+	};
+}
+/**
+* Map one Trae probe verdict onto the pool's outcome vocabulary.
+*
+* The mapping is the whole bridge between `src/model-probe.ts` (which answers a
+* QUESTION ABOUT A MODEL) and the pool (which must decide a FACT ABOUT AN ACCOUNT),
+* so every row states which side it is reading:
+*
+*  - `available`      → `ok`.
+*  - `auth`           → `credential-rejected`: 401/403 means THIS token is refused;
+*    waiting cannot help and the user must sign in again.
+*  - `gated` (`1005`) → `plan-gated`: the account's plan does not cover this model,
+*    which is an ACCOUNT fact (a paying account may pass) but not one that heals on
+*    a clock.
+*  - `rate_limited`   → `rate-limited`: `4011` or an honest 429 — transient by
+*    definition, so it cools down rather than leaving the pool forever.
+*  - `unsupported`    → `not-found`: `4001` says no SOLO function serves this
+*    `config_name`. It is MODEL-scoped, so the recorded `modelId` is what keeps the
+*    row honest, and nothing about the account changes by waiting.
+*  - `unknown`        → `failed`: a timeout, a transport error or a proxy problem.
+*    It cools down (it is not a statement about the account) and carries the
+*    upstream text so the user can retest.
+*
+* There is deliberately NO Trae source for `model-busy`, `out-of-credit` and
+* `policy-rejected` in this table — they are produced by the live-request path
+* (`src/account-pool.ts` has no network), from `4008` (quota exhausted) and from a
+* content refusal. A verdict NOT in this table falls through to `failed`, so a new
+* upstream verdict can never silently mean "healthy".
+*/
+function outcomeOfVerdict(verdict) {
+	switch (verdict) {
+		case "available": return "ok";
+		case "auth": return "credential-rejected";
+		case "gated": return "plan-gated";
+		case "rate_limited": return "rate-limited";
+		case "unsupported": return "not-found";
+		default: return "failed";
+	}
+}
+/**
+* Which pool a panel's members belong to, for the on-disk probe store and the
+* `pool` settings slot.
+*
+* `enterprise` is its OWN bucket even though it shares the CN credential store:
+* an account that serves the personal SOLO channel says nothing about whether it
+* passes the tenant gate (`4019` is only revealed at the first chat), so measuring
+* one must not silently answer the other.
+*/
+function poolKeyOfPanel(panel) {
+	return panel;
+}
+/**
+* WHY THERE IS NO SCHEDULER HERE.
+*
+* Like the reference implementation, this module carries no timer: rotation is a
+* PERSISTENT change of who pays while failover is a PER-REQUEST borrow of another
+* account, and having both with an automatic re-test on a clock made "who is being
+* billed right now" unanswerable on one card. Recovery is expressed as the cooldown
+* in {@link exclusionOf} instead, which needs no timer: it is evaluated at ranking
+* time, so a cooled-down member simply becomes a candidate again on the next
+* request.
+*/
+//#endregion
 //#region src/transfer.ts
 /**
 * Account transfer: the export / import file format shared with sibling
@@ -5241,7 +6166,7 @@ function mergeTransferRecords(records, indexes, region, knownRegionOfCredential
 * matched on the code rather than on the HTTP status: read as a transport
 * failure it looks like the plugin is broken, when the day is simply spent.
 */
-const CHECKIN_DEVICE_ALREADY_CLAIMED = 9095;
+const CHECKIN_DEVICE_ALREADY_CLAIMED$1 = 9095;
 /** Redact token-like content before it crosses to the browser. */
 function safeMessage(error) {
 	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
@@ -5381,7 +6306,8 @@ function toCredits(snapshot, nowMs = Date.now()) {
 		displayDesc: pack.displayDesc,
 		remain: credit(Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))),
 		size: pack.creditsLimit ?? 0,
-		...usableExpiry(pack.endTimeMs) ? { expiresAtMs: pack.endTimeMs } : {}
+		...usableExpiry(pack.endTimeMs) ? { expiresAtMs: pack.endTimeMs } : {},
+		...pack.availableEndpoint === void 0 ? {} : { endpoint: pack.availableEndpoint }
 	}));
 	const remaining = (endpoint) => snapshot.packs.filter((pack) => pack.availableEndpoint === endpoint).reduce((sum, pack) => credit(sum + Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))), 0);
 	return {
@@ -5469,16 +6395,26 @@ function toCheckin(status) {
 	};
 }
 /**
-* Assemble one region's card document. `region` is the tab the card is on; the
-* region-scoped store already answers with only that region's accounts, so the
+* Assemble one region's card document. `panel` is the tab the card is on; the
+* panel-scoped store already answers with only that region's accounts, so the
 * document's model slots and account list are that region's by construction.
 * Sign-in state is read-only; credit is a live billing answer whose failure
 * degrades to `creditsError` rather than failing the whole document.
 */
-async function traeWebUsage(deps, region) {
-	const store = deps.store(region);
-	const enabled = deps.regionEnabled(region);
-	const accounts = await store.accounts();
+async function traeWebUsage(deps, panel) {
+	const store = deps.store(panel);
+	const enabled = deps.regionEnabled(panel);
+	/**
+	* Accounts this panel may actually bill.
+	*
+	* Filtered ONCE, at the source, because this list is spliced into every
+	* response shape below (`signed-out`, `signed-in`, the credits route). The
+	* enterprise pool can only bill a tenant account, and the tenant gateway does
+	* not make that obvious: it answers a personal token's DIRECTORY read in
+	* full and only refuses its chat (`4019`). Listing a personal account there
+	* would offer a binding that cannot work.
+	*/
+	const accounts = (await store.accounts()).filter((account) => panel !== "enterprise" || account.enterprise);
 	if ((await store.status()).state !== "signed-in") {
 		const { failures } = await store.diagnose();
 		return {
@@ -5507,45 +6443,66 @@ async function traeWebUsage(deps, region) {
 	}
 	let appLogin;
 	try {
-		appLogin = await deps.liveLogin?.(region);
+		appLogin = await deps.liveLogin?.(panel);
 	} catch {}
 	const account = {
 		accountId: accounts.find((item) => item.selected)?.id ?? "",
 		accountName: credential.accountName ?? credential.userId,
 		tokenExpiresAtMs: credential.expiresAtMs,
 		...credential.refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs: credential.refreshExpiresAtMs },
-		region,
+		region: regionOfPanel(panel),
 		enabled,
 		accounts,
 		...appLogin === void 0 ? {} : { appLogin },
-		models: deps.displayModels(region).map((model) => ({
+		models: deps.displayModels(panel).map((model) => ({
 			...model,
 			...model.input === void 0 ? {} : { input: [...model.input] }
 		})),
-		enabledModelIds: [...deps.enabledModelIds(region)],
-		...deps.rawDiagnostic === void 0 ? {} : { rawChat: deps.rawDiagnostic(region) }
+		enabledModelIds: [...deps.enabledModelIds(panel)],
+		...deps.rawDiagnostic === void 0 ? {} : { rawChat: deps.rawDiagnostic(panel) }
 	};
-	const client = deps.client(region);
-	if (region === "ai") try {
+	const poolSection = await poolSectionOf(deps, panel);
+	const client = deps.client(panel);
+	if (regionOfPanel(panel) === "ai") try {
 		const payStatus = await client.payStatus();
 		return {
 			status: "signed-in",
 			...account,
+			...poolSection,
 			payStatus
 		};
 	} catch (error) {
 		return {
 			status: "signed-in",
 			...account,
+			...poolSection,
 			payStatusError: safeMessage(error)
 		};
 	}
+	/**
+	* The enterprise panel shows NO credit figure, deliberately.
+	*
+	* `client.snapshot()` reads the CONSUMER packs, and that is the personal
+	* balance — not what a tenant turn spends. There is no enterprise counterpart
+	* to read: every tenant quota endpoint answers 404 (probed 2026-10-17), and
+	* the tenant console at console.enterprise.trae.cn is the only place the
+	* enterprise balance exists. Showing the personal number under an enterprise
+	* heading would be actively misleading, so the panel reports the absence
+	* explicitly and the card explains where the real figure lives.
+	*/
+	if (panel === "enterprise") return {
+		status: "signed-in",
+		...account,
+		...poolSection,
+		creditsUnavailable: "enterprise"
+	};
 	const [snapshotResult, checkinResult] = await Promise.allSettled([client.snapshot(), client.checkinStatus()]);
 	const credits = snapshotResult.status === "fulfilled" ? toCredits(snapshotResult.value) : void 0;
-	const alternatives = credits !== void 0 && credits.workAvailable <= 0 && credits.generalAvailable <= 0 ? await creditAlternatives(deps, region, accounts) : void 0;
+	const alternatives = credits !== void 0 && credits.workAvailable <= 0 && credits.generalAvailable <= 0 ? await creditAlternatives(deps, panel, accounts) : void 0;
 	return {
 		status: "signed-in",
 		...account,
+		...poolSection,
 		...credits === void 0 ? { creditsError: snapshotResult.status === "rejected" ? safeMessage(snapshotResult.reason) : "unknown" } : { credits },
 		...checkinResult.status === "fulfilled" ? { checkin: toCheckin(checkinResult.value) } : { checkinError: safeMessage(checkinResult.reason) },
 		...alternatives === void 0 ? {} : { alternatives }
@@ -5563,13 +6520,13 @@ async function traeWebUsage(deps, region) {
 * problem to explain. The list is capped so a machine with many stale
 * credentials cannot turn one status read into a burst of upstream calls.
 */
-async function creditAlternatives(deps, region, accounts) {
+async function creditAlternatives(deps, panel, accounts) {
 	if (deps.creditsOfAccount === void 0) return void 0;
-	const candidates = accounts.filter((account) => !account.selected && account.region === region).slice(0, TRAE_CREDIT_ALTERNATIVE_LIMIT);
+	const candidates = accounts.filter((account) => !account.selected && account.region === regionOfPanel(panel)).filter((account) => panel !== "enterprise" || account.enterprise).slice(0, TRAE_CREDIT_ALTERNATIVE_LIMIT);
 	if (candidates.length === 0) return void 0;
 	const alternatives = (await Promise.all(candidates.map(async (account) => {
 		try {
-			const credits = await deps.creditsOfAccount(region, account.id);
+			const credits = await deps.creditsOfAccount(panel, account.id);
 			if (credits === void 0) return void 0;
 			if (credits.workAvailable <= 0 && credits.generalAvailable <= 0) return void 0;
 			return {
@@ -5586,11 +6543,190 @@ async function creditAlternatives(deps, region, accounts) {
 	return alternatives.length === 0 ? void 0 : alternatives;
 }
 /**
-* The region a request addresses, or a 400 answer. Absent parameter means the
+* The panel's pool section, or an empty standpoint when this Host cannot run one.
+*
+* THE rule of this file: the pool is an ADD-ON to the status document, so no
+* failure inside it may cost the user the sign-in panel. A member with a broken
+* balance read, a probe store that cannot be parsed, a clock — all of it degrades
+* to "no pool section" rather than to a 500 that hides the account table.
+*
+* What is deliberately NOT swallowed here: a `credential`-class failure of the
+* BOUND account, which `traeWebUsage` reports as `status: error` before the pool
+* is even assembled.
+*/
+async function poolSectionOf(deps, panel) {
+	if (deps.pool === void 0) return {};
+	try {
+		const pool = await traeWebPool(deps, panel);
+		return pool === void 0 ? {} : { pool };
+	} catch {
+		return {};
+	}
+}
+/**
+* Assemble one panel's pool document (see {@link TraeWebPool}).
+*
+* Rows come from TWO sources and are kept in the Host's ranking order: checked
+* members (ranked by {@link rankPool}) first, then the local sign-ins the pool
+* does NOT cover, so the card can offer them to check. Unchecked rows carry no
+* credits and no measurement — nothing has been read for an account the pool does
+* not bill, and printing a friendlier-looking zero would be a lie.
+*
+* Every per-row read is failure-tolerant on purpose: one account whose balance
+* read throws must not remove the other members from the table.
+*/
+async function traeWebPool(deps, panel) {
+	const pool = deps.pool;
+	if (pool === void 0) return void 0;
+	const preferences = pool.preferences(panel);
+	const members = await pool.members(panel);
+	const nowMs = Date.now();
+	const ranked = rankPool(members, nowMs);
+	const target = resolveTargetModel(pool.catalog?.(panel) ?? [], preferences.targetModelId);
+	const byId = new Map(members.map((member) => [member.account.id, member]));
+	const excludedById = new Map(ranked.flatMap((row) => row.excludedBy === void 0 ? [] : [[row.account.id, row.excludedBy]]));
+	const rankedIds = new Set(ranked.map((row) => row.account.id));
+	const others = (await pool.otherAccounts?.(panel) ?? []).filter((account) => !rankedIds.has(account.id));
+	const checkinState = await pool.checkinState?.(panel).catch(() => ({})) ?? {};
+	const memberNames = await pool.memberNames?.(panel).catch(() => ({})) ?? {};
+	const currentAccountId = await pool.currentAccountId?.(panel).catch(() => void 0);
+	/**
+	* A row per listed account, members first.
+	*
+	* `member` is the membership source of truth: the saved list is what a batch
+	* runs on, so a local sign-in that is not checked must not render as one —
+	* otherwise the card would claim "N accounts will be tested" over a set the
+	* Host never touches.
+	*/
+	const savedMembers = new Set(preferences.memberAccountIds ?? []);
+	const rows = [];
+	const rowIds = /* @__PURE__ */ new Set();
+	for (const row of ranked) {
+		rows.push({
+			account: row.account,
+			member: savedMembers.has(row.account.id)
+		});
+		rowIds.add(row.account.id);
+	}
+	for (const account of others) {
+		rows.push({
+			account,
+			member: savedMembers.has(account.id)
+		});
+		rowIds.add(account.id);
+	}
+	for (const accountId of savedMembers) {
+		if (rowIds.has(accountId)) continue;
+		rows.push({
+			account: {
+				id: accountId,
+				accountName: ""
+			},
+			member: true
+		});
+		rowIds.add(accountId);
+	}
+	const reachableIds = new Set(members.map((member) => member.account.id));
+	const tokenExpiresById = /* @__PURE__ */ new Map();
+	for (const member of members) if (member.tokenExpiresAtMs !== void 0) tokenExpiresById.set(member.account.id, member.tokenExpiresAtMs);
+	const accounts = rows.map((row) => {
+		const entry = byId.get(row.account.id);
+		const measured = entry?.probe;
+		const credits = entry?.credits;
+		const checkin = checkinState[row.account.id];
+		const excludedBy = excludedById.get(row.account.id);
+		const accountName = row.account.accountName !== "" ? row.account.accountName : memberNames[row.account.id] ?? measured?.accountName ?? "";
+		return {
+			accountId: row.account.id,
+			accountName,
+			...credits === void 0 ? {} : {
+				credits: credits.total,
+				...credits.generalAvailable === void 0 ? {} : { generalAvailable: credits.generalAvailable },
+				...credits.workAvailable === void 0 ? {} : { workAvailable: credits.workAvailable },
+				expiringSoon: credits.expiringSoon,
+				...credits.nearestExpiryMs === void 0 ? {} : { nearestExpiryMs: credits.nearestExpiryMs }
+			},
+			...measured === void 0 ? {} : { probe: {
+				outcome: measured.outcome,
+				atMs: measured.atMs,
+				...measured.source === void 0 ? {} : { source: measured.source },
+				...measured.modelId === void 0 ? {} : { modelId: measured.modelId },
+				...measured.retryAtMs === void 0 ? {} : { retryAtMs: measured.retryAtMs },
+				...measured.message === void 0 ? {} : { message: safeMessage(measured.message) }
+			} },
+			...excludedBy === void 0 ? {} : { excludedBy },
+			...credits === void 0 && (tokenExpiresById.get(row.account.id) ?? Infinity) <= nowMs ? { tokenExpired: true } : {},
+			current: currentAccountId !== void 0 && currentAccountId === row.account.id,
+			member: row.member,
+			reachable: reachableIds.has(row.account.id),
+			...checkin === void 0 ? {} : {
+				checkedInToday: checkin.checkedIn,
+				...checkin.deviceCheckedIn === void 0 ? {} : { deviceCheckedIn: checkin.deviceCheckedIn }
+			}
+		};
+	});
+	/**
+	* Why the pool cannot pick anybody, when it cannot.
+	*
+	* Only meaningful for an ENABLED pool: a disabled pool is not picking anybody by
+	* design, and saying "no candidate" there would describe a fault that is not
+	* one. Every member excluded is the case the card must explain, because traffic
+	* then falls back to the saved selection while the table shows a full roster.
+	*/
+	let noCandidate;
+	if (preferences.enabled === true) {
+		if (members.length === 0) noCandidate = "empty";
+		else if (ranked.every((row) => row.excludedBy !== void 0)) noCandidate = new Set(ranked.map((row) => row.excludedBy)).size === 1 ? ranked[0]?.excludedBy ?? "unusable" : "unusable";
+	}
+	const effectiveMemberAccountIds = effectiveMembersOf(rows.filter((row) => row.member).map((row) => row.account.id), new Set(members.map((member) => member.account.id)));
+	return {
+		enabled: preferences.enabled === true,
+		checkinSupported: pool.checkin !== void 0 && regionOfPanel(panel) === "cn",
+		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
+		targetModelSource: target.source,
+		probeInputTokens: Math.max(0, preferences.probeInputTokens ?? 0),
+		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
+		...preferences.memberAccountIds === void 0 ? {} : { memberAccountIds: preferences.memberAccountIds },
+		effectiveMemberAccountIds,
+		...Object.keys(memberNames).length === 0 ? {} : { memberNames },
+		accounts,
+		...noCandidate === void 0 ? {} : { noCandidate }
+	};
+}
+/**
+* One test row, translated into the pool vocabulary the card renders.
+*
+* The runner answers in the model-probe verdicts (`available` / `auth` / `gated` /
+* `rate_limited` / `unsupported`); the card must not have to know that `gated` and
+* `1005` are the same event, so the translation happens here — once, for both the
+* batch and the single-row probe.
+*/
+function poolTestRowViewOf(row) {
+	return {
+		accountId: row.accountId,
+		accountName: row.accountName,
+		modelId: row.modelId,
+		outcome: outcomeOfVerdict(row.outcome),
+		detail: safeMessage(row.detail),
+		...row.retryAtMs === void 0 ? {} : { retryAtMs: row.retryAtMs }
+	};
+}
+/** One check-in row, redacted on the way out. */
+function poolCheckinRowViewOf(row) {
+	return {
+		accountId: row.accountId,
+		accountName: row.accountName,
+		status: row.status,
+		...row.credit === void 0 ? {} : { credit: row.credit },
+		...row.message === void 0 ? {} : { message: safeMessage(row.message) }
+	};
+}
+/**
+* The panel a request addresses, or a 400 answer. Absent parameter means the
 * domestic tab; an unknown value is refused rather than guessed.
 */
 /**
-* The general balance of every account in one region.
+* The general balance of every account in one panel.
 *
 * One upstream read per account — the same call `creditsOfAccount` already
 * makes for the exhausted-balance alternatives, widened to every account and to
@@ -5601,16 +6737,16 @@ async function creditAlternatives(deps, region, accounts) {
 * figure: the table lists how many accounts exist even when one cannot be
 * quoted, rather than dropping it and making the switch unavailable.
 */
-async function traeAccountCredits(deps, region) {
-	const accounts = (await deps.store(region).accounts()).filter((account) => account.region === region);
+async function traeAccountCredits(deps, panel) {
+	const accounts = (await deps.store(panel).accounts()).filter((account) => account.region === regionOfPanel(panel)).filter((account) => panel !== "enterprise" || account.enterprise);
 	if (accounts.length === 0) return [];
 	return Promise.all(accounts.map(async (account) => {
 		let generalAvailable;
 		if (account.selected) try {
-			generalAvailable = toCredits(await deps.client(region).snapshot()).generalAvailable;
+			generalAvailable = toCredits(await deps.client(panel).snapshot()).generalAvailable;
 		} catch {}
 		else if (deps.creditsOfAccount !== void 0) try {
-			generalAvailable = (await deps.creditsOfAccount(region, account.id))?.generalAvailable;
+			generalAvailable = (await deps.creditsOfAccount(panel, account.id))?.generalAvailable;
 		} catch {}
 		return {
 			id: account.id,
@@ -5621,12 +6757,12 @@ async function traeAccountCredits(deps, region) {
 	}));
 }
 function requestRegion(req, res) {
-	const region = regionOfTraeStatusUrl(req.url ?? "/");
-	if (region === void 0) {
+	const panel = regionOfTraeStatusUrl(req.url ?? "/");
+	if (panel === void 0) {
 		json(res, 400, { error: "unknown region" });
 		return;
 	}
-	return region;
+	return panel;
 }
 /** Mount the GET usage route on an optional webServer context. */
 function registerTraeUsageRoute(ctx, deps) {
@@ -5643,17 +6779,17 @@ function registerTraeUsageRoute(ctx, deps) {
 					json(res, 403, { error: "origin-not-trusted" });
 					return;
 				}
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
 				try {
-					json(res, 200, await traeWebUsage(deps, region));
+					json(res, 200, await traeWebUsage(deps, panel));
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
 			}
 		});
 		/**
-		* General balance of every account in the region — read only when the
+		* General balance of every account in the panel — read only when the
 		* composer panel is opened. One upstream read per account, paid once per
 		* open rather than on the 5-minute cycle (see
 		* {@link TRAE_ACCOUNT_CREDITS_PATH}).
@@ -5664,10 +6800,10 @@ function registerTraeUsageRoute(ctx, deps) {
 			handler: async (req, res) => {
 				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
 				try {
-					json(res, 200, { accounts: await traeAccountCredits(deps, region) });
+					json(res, 200, { accounts: await traeAccountCredits(deps, panel) });
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -5687,12 +6823,12 @@ function registerTraeUsageRoute(ctx, deps) {
 				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
 				if (deps.accountStateOf === void 0) return json(res, 503, { error: "account status unavailable" });
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
 				const accountId = new URL(req.url ?? "/", "http://localhost").searchParams.get("accountId");
 				if (accountId === null || accountId.trim() === "") return json(res, 400, { error: "missing accountId" });
 				try {
-					const state = await deps.accountStateOf(region, accountId);
+					const state = await deps.accountStateOf(panel, accountId);
 					if (state === void 0) return json(res, 404, { error: "unknown account" });
 					json(res, 200, state);
 				} catch (error) {
@@ -5706,10 +6842,10 @@ function registerTraeUsageRoute(ctx, deps) {
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
 				try {
-					json(res, 200, { accounts: await deps.store(region).accounts() });
+					json(res, 200, { accounts: (await deps.store(panel).accounts()).filter((account) => panel !== "enterprise" || account.enterprise) });
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -5730,15 +6866,15 @@ function registerTraeUsageRoute(ctx, deps) {
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
 				const action = transferActionOf(req.url ?? "");
 				if (action === void 0) return json(res, 400, { error: "unknown transfer action" });
 				try {
 					const body = await readTransferBody(req);
 					if (action === "export") {
 						const wanted = new Set(Array.isArray(body["accountIds"]) ? body["accountIds"].filter((id) => typeof id === "string") : []);
-						const store = deps.store(region);
+						const store = deps.store(panel);
 						const records = [];
 						for (const account of await store.accounts()) {
 							if (!wanted.has(account.id)) continue;
@@ -5765,8 +6901,8 @@ function registerTraeUsageRoute(ctx, deps) {
 					const text = typeof body["text"] === "string" ? body["text"] : "";
 					if (action === "preview") return json(res, 200, previewTransferFile(text));
 					const indexes = Array.isArray(body["indexes"]) ? body["indexes"].filter((index) => typeof index === "number" && Number.isInteger(index)) : [];
-					const { changes, imported, skipped } = mergeTransferRecords(parseTransferFile(text), indexes, region);
-					if (changes.size > 0) await deps.store(region).importAccounts([...changes.values()]);
+					const { changes, imported, skipped } = mergeTransferRecords(parseTransferFile(text), indexes, regionOfPanel(panel));
+					if (changes.size > 0) await deps.store(panel).importAccounts([...changes.values()]);
 					json(res, 200, {
 						imported,
 						skipped
@@ -5783,10 +6919,10 @@ function registerTraeUsageRoute(ctx, deps) {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
 				if (deps.discoverModels === void 0) return json(res, 503, { error: "model refresh unavailable" });
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
 				try {
-					json(res, 200, { models: await deps.discoverModels(region) });
+					json(res, 200, { models: await deps.discoverModels(panel) });
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -5809,8 +6945,8 @@ function registerTraeUsageRoute(ctx, deps) {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
 				if (deps.probeModels === void 0) return json(res, 503, { error: "model test unavailable" });
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
 				let ids;
 				try {
 					ids = await readModelTestBody(req);
@@ -5820,7 +6956,7 @@ function registerTraeUsageRoute(ctx, deps) {
 				if (ids.length === 0) return json(res, 400, { error: "no models to test" });
 				if (ids.length > 64) return json(res, 400, { error: `too many models (limit ${String(64)})` });
 				try {
-					json(res, 200, await deps.probeModels(region, ids));
+					json(res, 200, await deps.probeModels(panel, ids));
 				} catch (error) {
 					json(res, 500, { error: safeMessage(error) });
 				}
@@ -5852,9 +6988,9 @@ function registerTraeUsageRoute(ctx, deps) {
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
 				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
-				const region = requestRegion(req, res);
-				if (region === void 0) return;
-				if (region !== "cn") return json(res, 404, { error: "check-in is not available for the international region" });
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
+				if (regionOfPanel(panel) !== "cn") return json(res, 404, { error: "check-in is not available for the international region" });
 				try {
 					let accountId;
 					try {
@@ -5864,10 +7000,10 @@ function registerTraeUsageRoute(ctx, deps) {
 					}
 					if (accountId !== void 0) {
 						if (deps.claimCheckinOf === void 0) return json(res, 503, { error: "check-in by account unavailable" });
-						const outcome = await deps.claimCheckinOf(region, accountId);
+						const outcome = await deps.claimCheckinOf(panel, accountId);
 						if (outcome === void 0) return json(res, 404, { error: "unknown account" });
 						const { claim, checkin: after } = outcome;
-						const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED;
+						const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED$1;
 						return json(res, 200, {
 							claimed: claim.claimed,
 							alreadyCheckedIn: after.checkedIn,
@@ -5877,7 +7013,7 @@ function registerTraeUsageRoute(ctx, deps) {
 							checkin: toCheckin(after)
 						});
 					}
-					const client = deps.client(region);
+					const client = deps.client(panel);
 					const current = await client.checkinStatus();
 					if (!current.enabled) return json(res, 409, { error: "check-in is not enabled for this account" });
 					if (current.checkedIn) return json(res, 200, {
@@ -5890,13 +7026,13 @@ function registerTraeUsageRoute(ctx, deps) {
 						claimed: false,
 						alreadyCheckedIn: false,
 						deviceCheckedIn: true,
-						code: CHECKIN_DEVICE_ALREADY_CLAIMED,
+						code: CHECKIN_DEVICE_ALREADY_CLAIMED$1,
 						message: "this device already used today's check-in",
 						checkin: toCheckin(current)
 					});
 					const claim = await client.claimCheckin();
 					const checkin = await client.checkinStatus();
-					const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED;
+					const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED$1;
 					json(res, 200, {
 						claimed: claim.claimed,
 						alreadyCheckedIn: false,
@@ -5910,7 +7046,131 @@ function registerTraeUsageRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* The account pool's ONE mutation surface: `?action=checkin|test|remove`.
+		*
+		* Everything the pool does that costs something happens here and nowhere else —
+		* `checkin` sends a claim, `test` spends a real chat call per member, `remove`
+		* drops one account's measurement. The pool is therefore POST-only and
+		* loopback-only, like the model test and the check-in it wraps.
+		*
+		* The empty-pool guard runs on `effectiveMemberAccountIds` — what this Host can
+		* actually reach — rather than on the saved list. A saved id whose sign-in
+		* disappeared would otherwise let a batch answer `200` with zero rows, which
+		* the card reads as "全部正常".
+		*
+		* Answers are JSON except for a streaming test batch, which writes one NDJSON
+		* line per account as it lands: the loop is serial, so without a stream a user
+		* cannot tell a slow member from a dead button.
+		*/
+		const disposePool = ctx.webServer.register({
+			kind: "exact",
+			path: TRAE_POOL_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const panel = requestRegion(req, res);
+				if (panel === void 0) return;
+				const pool = deps.pool;
+				if (pool === void 0) return json(res, 503, { error: "account pool unavailable" });
+				const url = req.url ?? "/";
+				const action = poolActionOf(url);
+				if (action === void 0) return json(res, 400, { error: `missing or unknown action parameter (${TRAE_POOL_ACTION_PARAM})` });
+				const accountId = poolAccountIdOf(url);
+				if (accountId !== void 0 && !isTraeAccountId(accountId)) return json(res, 400, { error: "malformed account id" });
+				if (action === "remove") {
+					if (accountId === void 0) return json(res, 400, { error: "remove needs an accountId" });
+					if (pool.removeOne === void 0) return json(res, 503, { error: "pool removal unavailable" });
+					try {
+						json(res, 200, {
+							accountId,
+							removed: await pool.removeOne(panel, accountId)
+						});
+					} catch (error) {
+						json(res, 500, { error: safeMessage(error) });
+					}
+					return;
+				}
+				/**
+				* Both remaining actions need a NON-EMPTY effective pool.
+				*
+				* `effectiveMemberAccountIds` is optional; when the Host does not supply it
+				* the guard falls back to the saved list, which is weaker but never worse
+				* than no guard at all. `no-live-members` and `no-members` are separate
+				* reasons because the advice differs: re-check the accounts you lost versus
+				* check some accounts in.
+				*/
+				const saved = pool.preferences(panel).memberAccountIds ?? [];
+				let effective = saved;
+				if (pool.effectiveMemberAccountIds !== void 0) try {
+					effective = await pool.effectiveMemberAccountIds(panel);
+				} catch (error) {
+					return json(res, 500, { error: safeMessage(error) });
+				}
+				if (effective.length === 0) return json(res, 409, {
+					action,
+					reason: saved.length === 0 ? "no-members" : "no-live-members",
+					error: saved.length === 0 ? "no accounts are checked into this pool" : "none of the checked accounts can be reached on this machine"
+				});
+				if (action === "checkin") {
+					const supported = pool.checkinSupported?.(panel) ?? true;
+					if (!supported || pool.checkin === void 0) return json(res, 409, {
+						action,
+						reason: "checkin-unsupported",
+						error: supported ? "check-in is unavailable in this build" : "this panel has no daily check-in"
+					});
+					try {
+						json(res, 200, { rows: (await pool.checkin(panel)).map((row) => poolCheckinRowViewOf(row)) });
+					} catch (error) {
+						json(res, 500, { error: safeMessage(error) });
+					}
+					return;
+				}
+				const targetModelId = pool.preferences(panel).targetModelId;
+				if (pool.test === void 0) return json(res, 409, {
+					action,
+					reason: "test-unsupported",
+					error: "the pool cannot test this panel"
+				});
+				const single = accountId === void 0 ? void 0 : pool.testOne;
+				if (single !== void 0 && accountId !== void 0) {
+					const resolved = resolveTargetModel(pool.catalog?.(panel) ?? [], targetModelId);
+					if (resolved.modelId === void 0) return json(res, 409, {
+						action,
+						reason: resolved.source === "stale" ? "stale-target" : "no-target-model",
+						error: resolved.source === "stale" ? "the saved test model is no longer offered by this panel" : "no free model is available to test against"
+					});
+					resolved.modelId;
+				}
+				if (single !== void 0 && accountId !== void 0) try {
+					const row = await single(panel, accountId);
+					if (row === void 0) return json(res, 404, { error: "unknown account" });
+					return json(res, 200, { rows: [poolTestRowViewOf(row)] });
+				} catch (error) {
+					return json(res, 500, { error: safeMessage(error) });
+				}
+				res.writeHead(200, {
+					"Content-Type": "application/x-ndjson",
+					"Cache-Control": "no-store"
+				});
+				const writeLine = (value) => {
+					res.write(`${JSON.stringify(value)}\n`);
+				};
+				try {
+					writeLine({ rows: (await pool.test(panel, targetModelId ?? "", (row) => {
+						writeLine({ row: poolTestRowViewOf(row) });
+					})).map((row) => poolTestRowViewOf(row)) });
+				} catch (error) {
+					writeLine({
+						reason: "pool-failed",
+						error: safeMessage(error)
+					});
+				}
+				res.end();
+			}
+		});
 		return () => {
+			disposePool();
 			disposeCheckin();
 			disposeRefresh();
 			disposeTransfer();
@@ -5923,6 +7183,538 @@ function registerTraeUsageRoute(ctx, deps) {
 	}, "dsh-connect-trae: Web usage route");
 }
 //#endregion
+//#region src/account-pool-run.ts
+/** The upstream's business code for "this DEVICE already checked in today". */
+const CHECKIN_DEVICE_ALREADY_CLAIMED = 9095;
+/**
+* Check in every account, one at a time.
+*
+* Idempotent by design (see the module note): an account already checked in today
+* is reported as `already` and NO write is attempted. A failure on one account is
+* recorded on that row and the batch continues — EXCEPT for the device-level
+* refusal (`9095`), which stops the run: it is a fact about this MACHINE, so every
+* later account would hit the same wall and each of those calls is a wasted
+* upstream request against an endpoint that just said "stop".
+*
+* Never throws: every problem becomes a row.
+*/
+async function checkinAllAccounts(targets, deps) {
+	const rows = [];
+	for (const [index, target] of targets.entries()) {
+		if (index > 0) await (deps.wait ?? defaultWait)(400);
+		const row = await checkinOne(target, deps);
+		rows.push(row);
+		if (row.status === "device-already") {
+			for (const skipped of targets.slice(index + 1)) rows.push({
+				accountId: skipped.accountId,
+				accountName: skipped.accountName,
+				status: "device-already",
+				message: "skipped: this device has already claimed today"
+			});
+			break;
+		}
+	}
+	return rows;
+}
+/** One account's check-in, reduced to its row. */
+async function checkinOne(target, deps) {
+	const base = {
+		accountId: target.accountId,
+		accountName: target.accountName
+	};
+	let credential;
+	try {
+		credential = await deps.credentialFor(target.accountId);
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+	if (credential === void 0) return {
+		...base,
+		status: "failed",
+		message: "no stored credential for this account"
+	};
+	let status;
+	try {
+		status = await deps.checkinStatusOf(credential);
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+	if (!status.enabled) return {
+		...base,
+		status: "disabled",
+		message: "check-in is not enabled for this account"
+	};
+	if (status.checkedIn) return {
+		...base,
+		status: "already",
+		credit: status.credits
+	};
+	if (status.didCheckedIn) {}
+	try {
+		const claim = await deps.claimCheckinOf(credential);
+		if (claim.claimed) return {
+			...base,
+			status: "claimed",
+			credit: status.credits,
+			...nonEmpty(claim.message)
+		};
+		if (claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED) return {
+			...base,
+			status: "device-already",
+			message: claim.message
+		};
+		return {
+			...base,
+			status: "failed",
+			message: claim.message === "" ? `code ${String(claim.code)}` : claim.message
+		};
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+}
+/**
+* Test every account against one model, one at a time.
+*
+* The model is resolved by the caller (see `resolveTargetModel`) so this function
+* never has to decide "free or not" — an unresolvable target is the caller's
+* problem to report, and testing against a model nobody chose would be exactly the
+* silent spend this feature forbids.
+*
+* ONE model for the whole batch, deliberately. Letting each row test a different
+* model makes a green batch UNCOMPARABLE — one account's `ok` on model X and
+* another's on model Y — which is the reading ("all green") that the reference
+* implementation removed its per-account override for. What stays is that every
+* measurement RECORDS the model it probed and each row displays it.
+*
+* Never throws: a failed probe is a ROW, not an aborted batch. A credential
+* rejection does NOT stop the run (unlike the region-wide model test, where every
+* later probe would fail the same way): here each account has its OWN credential,
+* so one account's bad token says nothing about its neighbours.
+*
+* `onRow` fires the moment one account's row exists, which is what lets a caller
+* report progress. The loop is SERIAL by design, so without this a caller cannot
+* say anything until the SLOWEST member answers: one stuck account made a working
+* batch look like a dead button.
+*/
+async function testAllAccounts(targets, modelId, probe, deps, onRow) {
+	const rows = [];
+	for (const [index, target] of targets.entries()) {
+		if (index > 0) await (deps.wait ?? defaultWait)(400);
+		const row = await testOne(target, modelId, probe, deps);
+		rows.push(row);
+		onRow?.(row);
+	}
+	return rows;
+}
+/** One account's probe, reduced to its row. */
+async function testOne(target, modelId, probe, deps) {
+	const base = {
+		accountId: target.accountId,
+		accountName: target.accountName,
+		modelId
+	};
+	let credential;
+	try {
+		credential = await deps.credentialFor(target.accountId);
+	} catch (error) {
+		return {
+			...base,
+			outcome: "auth",
+			detail: messageOf(error)
+		};
+	}
+	if (credential === void 0) return {
+		...base,
+		outcome: "auth",
+		detail: "no stored credential for this account"
+	};
+	const result = await probe(deps.chatFor, credential, modelId);
+	return {
+		...base,
+		outcome: result.verdict,
+		detail: result.detail
+	};
+}
+/**
+* Turn a test batch's rows into the per-account measurements to remember.
+*
+* A row is stored only when the probe actually measured the MODEL. A row that
+* failed because the credential could not even be read says nothing about the
+* model, and recording it would exclude a possibly-perfect account from the pool —
+* so those accounts keep their previous measurement instead.
+*
+* `atMs` is stamped here, once for the batch, so the card's "tested N minutes ago"
+* reflects when the batch finished rather than drifting per row.
+*
+* `detail` is carried through as `message`. It was already produced from the
+* upstream's own (translated) text, so persisting it cannot leak a token, and
+* without it the pool table could only repeat one generic sentence for a DNS
+* failure, a gateway 502 and a cancelled request alike.
+*/
+function probeUpdatesOf(rows, nowMs = Date.now()) {
+	const updates = {};
+	for (const row of rows) {
+		if (isTransportFailure(row)) continue;
+		const outcome = outcomeOfVerdict(row.outcome);
+		updates[row.accountId] = {
+			outcome,
+			atMs: nowMs,
+			source: "test-batch",
+			modelId: row.modelId,
+			...row.accountName === "" ? {} : { accountName: row.accountName },
+			...row.retryAtMs === void 0 ? {} : { retryAtMs: row.retryAtMs },
+			...row.detail === "" ? {} : { message: row.detail }
+		};
+	}
+	return updates;
+}
+/**
+* Whether a row measures the transport rather than the account/model.
+*
+* `auth` carrying the pool's own "no stored credential" message is the one case we
+* can attribute to ourselves rather than the upstream: the request never left.
+* Every other rejection came from the upstream and IS a statement about this
+* account, so it is kept.
+*/
+function isTransportFailure(row) {
+	return row.outcome === "auth" && row.detail.startsWith("no stored credential");
+}
+/** Carry an optional upstream sentence only when it says something. */
+function nonEmpty(message) {
+	return message === "" ? {} : { message };
+}
+/** The default inter-account pause. */
+function defaultWait(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** A safe message from an unknown throwable, bounded in length. */
+function messageOf(error) {
+	return (error instanceof Error ? error.message : String(error)).slice(0, 300);
+}
+//#endregion
+//#region src/reset-time.ts
+/**
+* Parse a reset TIME out of an upstream failure message, when the upstream stated
+* one.
+*
+* 参考：`dsh-connect-workbuddy` 的 `src/probe.ts`（`parseUpstreamResetAt`）。
+*   该实现在 WorkBuddy 上是实测出来的（其网关的 429 正文里带一句「将在 … 重置」
+*   与一句英文 `will reset at …`），本文件把同一套解析规则搬过来，并把「偏移量
+*   必须显式」这条硬约束原样保留。
+* 改动：诚实标注**证据状态**。Trae 目前被记录在案的限流/配额文案里**没有任何一条
+*   带时间**：
+*
+*   - `4011` → `We're sorry, your requests have exceeded the rate limit.
+*     Please wait and try again later.`（docs/ISSUE33_DIAGNOSIS.md:30，实测原文）
+*   - `4008` → `Your requests have exceeded the quota.`（同文档:55，实测原文）
+*
+*   所以本函数在 Trae 上大概率永远返回 `undefined`，而**这正是它应有的行为**：
+*   没有给出的时间不能变成插件自己编的倒计时（池会退回
+*   `POOL_UNKNOWN_COOLDOWN_MS` 的 30 分钟兜底并在卡片上如实显示「上游未给出
+*   何时恢复」）。它存在的理由只有一个：Trae 的中文网关将来若在正文里写了时间
+*   （与 WorkBuddy 中文网关同一族文案），不要把一个真实存在的时间当没有解析出来
+*   丢掉 —— 参考实现里那是一条实测的 bug（英文正文解析不到 → 账号比上游要求的
+*   早 ~18 小时回到池里，再花一次请求重新撞上同一个限制）。
+*
+* NEVER use it for a credit PACK's `endTimeMs`: that is when a balance STOPS
+* being usable, not when a new allowance ARRIVES. Attaching it as a retry time
+* would put an exhausted account back into rotation at the exact moment its
+* credit disappears.
+*
+* @module dsh-connect-trae/reset-time
+*/
+/**
+* The timestamp shape both spellings share: `YYYY-MM-DD HH:MM:SS` followed by an
+* EXPLICIT UTC offset.
+*
+* The offset is required, not optional. `2026-09-30 02:30:30` with no zone is a
+* moment the plugin would have to guess at, and `Date.parse` guesses LOCAL time —
+* right on a UTC+8 machine by accident, silently wrong everywhere else. A message
+* that names a time without a zone therefore yields no time, which is the honest
+* answer.
+*/
+const RESET_STAMP = "(\\d{4})-(\\d{2})-(\\d{2})\\s+(\\d{2}):(\\d{2}):(\\d{2})\\s*UTC\\s*([+-])(\\d{1,2})(?::?(\\d{2}))?";
+/** Chinese spelling: the marker sits AFTER the timestamp (将在 … 重置). */
+const UPSTREAM_RESET_PATTERN_ZH = new RegExp(`将在?\\s*${RESET_STAMP}[\\s\\S]*?重置`, "u");
+/**
+* English spelling: the marker sits BEFORE the timestamp (`reset at` /
+* `refresh on`). It needs its own pattern because the two languages put the
+* keyword on different sides of the time, so loosening the surrounding prose
+* alone cannot cover both.
+*/
+const UPSTREAM_RESET_PATTERN_EN = new RegExp(`(?:reset|resets|refresh|refreshes|renew|renews)\\s+(?:at|on)\\s+${RESET_STAMP}`, "iu");
+/**
+* Parse the reset time out of an upstream failure message.
+*
+* Returns epoch ms, or undefined when the message names no parsable time — the
+* caller must then say "the upstream gave no time", never invent one.
+*
+* THE OFFSET IS HONOURED, NOT ASSUMED. `2026-09-30 02:30:30 UTC+8` is 18:30:30 UTC
+* the previous day, so the components are assembled with `Date.UTC` and the stated
+* offset subtracted — correct on every host regardless of its own zone.
+*
+* A whole-second resolution is what the upstream prints; sub-second precision would
+* be fiction in the other direction.
+*/
+function parseUpstreamResetAt(message) {
+	const match = UPSTREAM_RESET_PATTERN_ZH.exec(message) ?? UPSTREAM_RESET_PATTERN_EN.exec(message);
+	if (match === null) return void 0;
+	const [, year, month, day, hour, minute, second, sign, offsetHours, offsetMinutes] = match;
+	const offsetTotalMinutes = (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes ?? "0"));
+	const utcMs = Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hour), Number(minute), Number(second));
+	const parsed = new Date(utcMs);
+	if (parsed.getUTCFullYear() !== Number(year) || parsed.getUTCMonth() !== Number(month) - 1 || parsed.getUTCDate() !== Number(day) || parsed.getUTCHours() !== Number(hour) || parsed.getUTCMinutes() !== Number(minute) || parsed.getUTCSeconds() !== Number(second)) return;
+	if (Math.abs(offsetTotalMinutes) > 840) return void 0;
+	return utcMs - offsetTotalMinutes * 6e4;
+}
+//#endregion
+//#region src/account-pool-store.ts
+/**
+* The account pool's RUNTIME store: measured facts, on disk, outside settings.
+*
+* 参考：`dsh-connect-workbuddy` 的 `src/account-pool-store.ts`，以及本仓库
+*   `src/auth.ts` 的插件自有文件约定（`$DSH_HOME` 下的 `.trae-auth.<region>.json`，
+*   `withFileLock` + `writeFileAtomic`，`mode: 0o600`）。
+* 改动：一份、按**面板**分文件（cn / enterprise / ai），因为 enterprise 与 cn 共用
+*   同一份凭据却走不同的网关 —— 一个账号在个人 SOLO 通道能用，完全不说明它过得了
+*   租户门（`4019` 只在第一次真实对话时暴露），所以两份测量必须分开落盘。
+*
+* 为什么这些事实不放 settings（`regions[panel].pool`）：
+*
+*   卡片对用户偏好用的是「草稿 → 保存 → 丢弃草稿」模式：保存成功会丢弃草稿。
+*   如果探测结果也住在那个槽里，用户手工点一次「保存」就会用**几分钟前的草稿**
+*   覆盖掉刚刚写进去的测量结果 —— 那等于把测量回退，测试白做。
+*   观测数据由插件高频写入、且不是用户偏好，所以它必须落在自己的文件里。
+*
+* 本模块的读写**从不抛异常给调用方**：池是增强功能，一个损坏的观测文件绝不能让
+* 卡片或 host 启动失败 —— 最坏情况是「回到未测试」，而不是整个插件不可用。
+*
+* @module dsh-connect-trae/account-pool-store
+*/
+/** On-disk format version; readers reject anything else. */
+const STORE_FORMAT_VERSION = 1;
+/** Filename prefix for one panel's measured pool facts. */
+const POOL_STORE_PREFIX = ".trae-pool";
+/** Whether a parsed value looks like a stored probe. */
+function isProbe(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string") && (candidate["accountName"] === void 0 || typeof candidate["accountName"] === "string") && (candidate["modelId"] === void 0 || typeof candidate["modelId"] === "string") && (candidate["source"] === void 0 || typeof candidate["source"] === "string");
+}
+/**
+* One panel's path for measured pool facts.
+*
+* Panel-keyed for the same reason the credential copies are region-keyed: the
+* panels are parallel stacks and must never overwrite each other's measurements.
+*/
+function traePoolStorePath(panel) {
+	return join(resolveDshHome(), `${POOL_STORE_PREFIX}.${panel}.json`);
+}
+/**
+* The recovery time a stored record implies — declared, or recoverable from its
+* own body.
+*
+* The field itself wins when present: it is what the writer computed with the
+* full input set, and re-deriving it could only lose information.
+*
+* The fallback exists because a record can state a time in its `message` and
+* still have no `retryAtMs`. Read-time healing is the only place this can be
+* repaired for EXISTING records: every consumer receives probes through
+* {@link readTraePoolProbes}, so healing here fixes all of them at once. Re-
+* deriving at each consumer instead would be several copies of one rule, and the
+* next consumer added would silently miss it.
+*
+* Not a permanent second derivation: {@link writeTraePoolProbes} reads through
+* this function before it writes, so the very next write persists the healed
+* value.
+*
+* Scoped to the two outcomes whose vocabulary HAS a stated time. Widening it
+* would let an incidental sentence in an `ok` body attach a countdown to a
+* healthy account — the card prints any present `retryAtMs` beside the outcome,
+* so that would render a waiting time on an account waiting for nothing.
+*/
+function retryAtMsOf(probe) {
+	if (probe.retryAtMs !== void 0) return probe.retryAtMs;
+	if (probe.outcome !== "rate-limited" && probe.outcome !== "out-of-credit") return void 0;
+	if (probe.message === void 0) return void 0;
+	return parseUpstreamResetAt(probe.message);
+}
+/**
+* Read one panel's measured facts.
+*
+* Contains NO credentials. The one free-text field is `message`, and it is
+* REDACTED BY THE WRITER before it ever reaches this file, so a token-shaped
+* string cannot survive into storage.
+*
+* Returns an empty map for a missing, unreadable, malformed, or
+* version-mismatched file: all four mean "nothing measured yet", which is a valid
+* state the pool renders as "untested".
+*/
+async function readTraePoolProbes(panel) {
+	let raw;
+	try {
+		raw = await readFile(traePoolStorePath(panel), "utf8");
+	} catch {
+		return {};
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const document = parsed;
+	if (document.version !== STORE_FORMAT_VERSION) return {};
+	if (typeof document.probes !== "object" || document.probes === null) return {};
+	const probes = {};
+	for (const [accountId, probe] of Object.entries(document.probes)) {
+		if (accountId === "" || !isProbe(probe)) continue;
+		const retryAtMs = retryAtMsOf(probe);
+		const source = knownProbeSource(probe.source);
+		probes[accountId] = {
+			outcome: probe.outcome,
+			atMs: probe.atMs,
+			...source === void 0 ? {} : { source },
+			...retryAtMs === void 0 ? {} : { retryAtMs },
+			...probe.message === void 0 ? {} : { message: probe.message },
+			...probe.accountName === void 0 ? {} : { accountName: probe.accountName },
+			...probe.modelId === void 0 ? {} : { modelId: probe.modelId }
+		};
+	}
+	return probes;
+}
+/**
+* A stored source string reduced to a source this build understands.
+*
+* `isProbe` accepts any string so a newer build's label cannot destroy the
+* measurement it describes; this narrows it at the point of use. An unknown value
+* becomes `undefined`, which the card renders as "unknown" — the honest answer,
+* rather than mislabelling it as one of the two kinds we do know.
+*/
+function knownProbeSource(value) {
+	return value === "test-batch" || value === "live-request" ? value : void 0;
+}
+/**
+* Merge ONE new measurement over the record already stored for that account.
+*
+* A plain `{ ...existing, ...update }` is wrong here, and the damage is silent.
+* The two writers describe the same account at different moments and carry
+* different fields:
+*
+*   - `test-batch` measures the TARGET MODEL deliberately, so it is the writer
+*     that can produce a reset point (`retryAtMs`) parsed out of the upstream's
+*     own failure body.
+*   - `live-request` reports what a real chat request just hit. It often carries
+*     no `retryAtMs` at all (a transport blip names no time), and a spread would
+*     therefore DELETE the reset point the probe had already resolved.
+*
+* Measured consequence of the spread (reference implementation, a real
+* quota-exhausted account): the probe recorded "quota refreshes 2026-11-01", the
+* next live failure rewrote the record without that field, and the pool then
+* reported "retry in about 30 minutes" — putting an exhausted account back into
+* rotation to be refused again. The correct value was in the file one write
+* earlier.
+*
+* So `retryAtMs` is INHERITED when the update does not state one, and every other
+* field is the update's (the newer measurement owns `outcome`, `atMs`, `source`
+* and `message`). Inheriting is only about the one field whose absence is not a
+* statement: an update that DOES carry a time still overrides, which is what lets
+* a fresh, shorter cooldown supersede a stale longer one.
+*
+* `accountName` is INHERITED for the same reason: its absence is not a statement.
+* A writer that could not see the account must not erase the name an earlier
+* measurement DID see — that name is the only thing that can identify a member
+* whose sign-in has gone.
+*
+* `modelId` is deliberately NOT inherited (see the field note in
+* `account-pool.ts`): it describes THIS measurement, not the account.
+*
+* Pure and exported so the rule is unit-testable without a filesystem — this is
+* exactly the kind of "two writers, one slot" rule that bites silently.
+*/
+function mergePoolProbe(existing, update) {
+	if (existing === void 0) return update;
+	const merged = update.accountName === void 0 && existing.accountName !== void 0 ? {
+		...update,
+		accountName: existing.accountName
+	} : update;
+	if (update.retryAtMs !== void 0) return merged;
+	if (existing.retryAtMs === void 0 || existing.retryAtMs <= update.atMs) return merged;
+	return {
+		...merged,
+		retryAtMs: existing.retryAtMs
+	};
+}
+/**
+* Merge measurements into one panel's store and write it atomically.
+*
+* A MERGE rather than a replace, because batches measure one account at a time and
+* a partial failure must not erase what earlier runs learned. An account absent
+* from `updates` keeps its previous measurement, and an account present in both is
+* combined by {@link mergePoolProbe} rather than overwritten.
+*
+* Never throws: a failed write loses only the newest measurements, and the
+* caller's results are still returned to the user. Surfacing a disk error here
+* would fail an operation that actually succeeded.
+*/
+async function writeTraePoolProbes(panel, updates) {
+	if (Object.keys(updates).length === 0) return;
+	const path = traePoolStorePath(panel);
+	try {
+		await withFileLock(path, async () => {
+			const existing = await readTraePoolProbes(panel);
+			const merged = { ...existing };
+			for (const [accountId, update] of Object.entries(updates)) merged[accountId] = mergePoolProbe(existing[accountId], update);
+			await writeFileAtomic(path, `${JSON.stringify({
+				version: STORE_FORMAT_VERSION,
+				probes: merged
+			}, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+		});
+	} catch {}
+}
+/**
+* Forget one account's measurement, keeping every other row.
+*
+* Used when the user removes a pool member: its measurement is no longer about a
+* member, and leaving it in the file would resurrect a stale `rate-limited` row if
+* the account were added back later. Written through the same lock/atomic path so a
+* removal cannot interleave with a batch.
+*/
+async function dropTraePoolProbe(panel, accountId) {
+	const existing = await readTraePoolProbes(panel);
+	if (existing[accountId] === void 0) return;
+	const path = traePoolStorePath(panel);
+	const probes = {};
+	for (const [id, probe] of Object.entries(existing)) if (id !== accountId) probes[id] = probe;
+	try {
+		await withFileLock(path, async () => {
+			await writeFileAtomic(path, `${JSON.stringify({
+				version: STORE_FORMAT_VERSION,
+				probes
+			}, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+		});
+	} catch {}
+}
+//#endregion
 //#region src/model-config.ts
 /**
 * Parse a secret-free CustomModel debug line emitted by Trae. Optional values
@@ -6146,18 +7938,24 @@ function settingsNamespaceOf(ctx) {
 	return typeof id === "string" && id !== "" ? id : TRAE_SETTINGS_NS;
 }
 /**
-* One region's saved state. A config written before the region split has only
+* One panel's saved state. A config written before the region split has only
 * the flat fields: those were always captured from the CN endpoint (the
 * plugin had no international support), so they are read as the CN state and
 * only when no explicit CN slot exists. The ai region never inherits them —
 * that inheritance is exactly the bug where a stale CN directory would be
 * intersected with the international catalog and silently drop the user's
 * picks (the same failure workbuddy fixed with its region split).
+*
+* Keyed by PANEL (`cn` | `enterprise` | `ai`), because each panel carries its
+* own switch, account binding and model selection. `enterprise` has no legacy
+* equivalent: it starts from an EMPTY state (its own directory, its own model
+* picks) and never inherits CN's, so switching it on cannot silently activate
+* a model list the user never chose for the tenant pool.
 */
-function regionStateOf(config, region) {
-	const stored = unwrapVolatile(unwrapVolatile(config.regions)?.[region]);
+function regionStateOf(config, panel) {
+	const stored = unwrapVolatile(unwrapVolatile(config.regions)?.[panel]);
 	if (stored !== void 0) return stored;
-	if (region !== "cn") return {};
+	if (panel !== "cn") return {};
 	return {
 		...config.lastCatalog === void 0 ? {} : { lastCatalog: config.lastCatalog },
 		...config.enabledModelIds === void 0 ? {} : { enabledModelIds: config.enabledModelIds },
@@ -6166,15 +7964,23 @@ function regionStateOf(config, region) {
 	};
 }
 /**
-* Whether one region's provider is switched on (issue #11). Opt-out semantics:
+* Whether one panel's provider is switched on (issue #11). Opt-out semantics:
 * only an explicit `false` disables it, so every config written before this
 * switch existed — including the pre-region-split flat fields, which never
 * carry `enabled` — keeps both providers running exactly as before. The card
 * reads the same rule through `regionEnabledOf`, so the two halves can never
 * disagree about a region's state.
+*
+* The ENTERPRISE panel is the one deliberate exception: it defaults OFF. A
+* consumer-only account (`tenant 7o2d894p7dr0o4`) cannot use that pool at all,
+* so opting every existing user into a second CN provider would put a route in
+* their model picker that fails on first use. It is switched on from its card
+* tab, by someone whose account actually belongs to a tenant.
 */
-function regionEnabled(config, region) {
-	return regionStateOf(config, region).enabled !== false;
+function regionEnabled(config, panel) {
+	const stored = regionStateOf(config, panel).enabled;
+	if (stored !== void 0) return stored !== false;
+	return panel !== "enterprise";
 }
 /**
 * WHERE one region's credit readout sits (learned from workbuddy #62).
@@ -6216,19 +8022,32 @@ const modelConfig = z.object({
 	input: z.array(z.union(["text", "image"])),
 	creditMultiplier: z.number(),
 	wireFunction: z.string(),
+	wireConfigName: z.string(),
 	multimodal: z.boolean()
 });
+/**
+* One panel's saved state. Panels are keyed `cn | enterprise | ai` — see
+* {@link TraePanel}; `enterprise` is a second CN provider with its own switch,
+* account binding and model selection.
+*/
 const regionStateConfig = z.object({
-	enabled: z.boolean().default(true).description("Whether this region's provider is offered to DSH (opt-out; false withdraws it entirely)"),
+	enabled: z.boolean().description("Whether this panel's provider is offered to DSH (false withdraws it entirely)"),
 	lastCatalog: z.array(modelConfig).default([]),
 	enabledModelIds: z.array(z.string()).default([]),
 	imageModelIds: z.array(z.string()).default([]),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}),
-	creditPosition: z.union([z.const("composer"), z.const("stats")]).default("composer").description("积分读数显示位置：\"composer\" = 输入框工具栏（默认），\"stats\" = 输入框下方（与「轮次 / 步数 / token」统计同一行）。装了别的插件后读数不显示时改成 stats。")
+	creditPosition: z.union([z.const("composer"), z.const("stats")]).default("composer").description("积分读数显示位置：\"composer\" = 输入框工具栏（默认），\"stats\" = 输入框下方（与「轮次 / 步数 / token」统计同一行）。装了别的插件后读数不显示时改成 stats。"),
+	pool: z.object({
+		enabled: z.boolean().default(false).description("账号池：打开后本面板由池中可用账号轮流计费（关闭时按下面的绑定账号）"),
+		targetModelId: z.string().default("").description("账号池测速使用的模型 id（留空 = 自动选择免费模型）"),
+		memberAccountIds: z.array(z.string()).default([]).description("加入本面板账号池的账号 id（显式勾选，默认为空）"),
+		probeInputTokens: z.number().default(0).description("账号池测试请求填充的 token 量（0 = 最小请求，不填充）")
+	}).default({})
 });
 const accountSelectionConfig = z.object({
 	cn: z.string().description("Selected domestic (CN) account id (never a token)"),
-	ai: z.string().description("Selected international account id (never a token)")
+	ai: z.string().description("Selected international account id (never a token)"),
+	enterprise: z.string().description("Selected account id for the CN enterprise pool (never a token)")
 });
 const Config = z.object({
 	authFile: asVolatile(z.string().description("Optional Trae storage.json path override")),
@@ -6242,8 +8061,8 @@ const Config = z.object({
 	accountId: z.string().description("Deprecated: pre-split account selector, attributed to its own region"),
 	showPointsInMainUi: asVolatile(z.boolean().default(false).description("在输入框工具栏显示积分读数「Trae CN · <数值>」（仅当选中的模型属于本插件时出现，可点击查看账号与积分明细）")),
 	followAppLogin: asVolatile(z.boolean().default(false).description("跟随 Trae 桌面端当前登录账号换绑（打开后每次配置生效时重绑到 App 现在登录的账号）")),
-	accounts: asVolatile(accountSelectionConfig.description("Per-region account selections, keyed cn | ai")),
-	regions: asVolatile(z.dict(regionStateConfig).default({}).description("Per-region model directory and selection, keyed cn | ai")),
+	accounts: asVolatile(accountSelectionConfig.description("Per-panel account selections, keyed cn | enterprise | ai")),
+	regions: asVolatile(z.dict(regionStateConfig).default({}).description("Per-panel model directory and selection, keyed cn | enterprise | ai")),
 	lastCatalog: z.array(modelConfig).description("Deprecated: pre-region-split CN model directory"),
 	enabledModelIds: z.array(z.string()).default([]).description("Deprecated: pre-region-split CN selection"),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Deprecated: pre-region-split CN context budgets"),
@@ -6252,11 +8071,33 @@ const Config = z.object({
 });
 /** Every region, in card tab order. */
 const REGION_KEYS = ["cn", "ai"];
+/**
+* What ONE failed real request means for the account that served it (issue #44).
+*
+* The shim only reports account-scoped kinds here, so this table never has to
+* interpret `not_found` (a model the account cannot see) or `client` (our own bad
+* body) — both would exclude a healthy account for good over something that is
+* not about the account at all.
+*
+* `credential-rejected` is the one permanent entry, and deliberately so: a 401
+* from the chat gateway means the stored token cannot be refreshed into one that
+* works, and the honest recovery is a re-login (which the card offers), not a
+* silent retry every half hour.
+*/
+const POOL_OUTCOME_BY_KIND = {
+	authentication: "credential-rejected",
+	hard_credit: "out-of-credit",
+	soft_rate: "rate-limited",
+	server: "unavailable",
+	not_found: "not-found",
+	client: "failed",
+	unconfigured: "failed"
+};
 function apply(ctx, config) {
 	const settingsNs = settingsNamespaceOf(ctx);
 	let current = () => config;
-	const enabledSet = (value, region) => new Set(regionStateOf(value, region).enabledModelIds ?? []);
-	const imageSet = (value, region) => new Set(regionStateOf(value, region).imageModelIds ?? []);
+	const enabledSet = (value, panel) => new Set(regionStateOf(value, panel).enabledModelIds ?? []);
+	const imageSet = (value, panel) => new Set(regionStateOf(value, panel).imageModelIds ?? []);
 	/**
 	* Per-region wire state. Each region's discovery owns its own maps: the CN
 	* and international rosters overlap (and spell some ids differently), so a
@@ -6269,30 +8110,30 @@ function apply(ctx, config) {
 	* `lastCatalog` / `models` / `enabledModelIds` that still lists it.
 	*/
 	const wireState = {};
-	for (const region of REGION_KEYS) wireState[region] = {
+	for (const panel of TRAE_PANELS) wireState[panel] = {
 		callableKeys: /* @__PURE__ */ new Set(),
 		resolved: false,
 		byId: /* @__PURE__ */ new Map(),
 		byName: /* @__PURE__ */ new Map()
 	};
-	const dropDeadModels = (rows, region) => {
-		const wire = wireState[region];
+	const dropDeadModels = (rows, panel) => {
+		const wire = wireState[panel];
 		if (!wire.resolved) return rows;
 		return rows.filter((model) => wire.callableKeys.has(model.id.trim().toLowerCase()) || wire.callableKeys.has(model.name.trim().toLowerCase()));
 	};
-	const fallbackModels = (value, region) => applyImageSelection(fallbackModelsFor(region), imageSet(value, region));
-	const derive = (value, raw, region) => {
-		const selectedImages = imageSet(value, region);
-		const derived = deriveCatalog(applyImageSelection(sanitizeCatalog(dropDeadModels(raw, region)), selectedImages), enabledSet(value, region), regionStateOf(value, region).contextBudgets ?? {});
-		return derived.length > 0 ? derived : fallbackModels(value, region);
+	const fallbackModels = (value, panel) => applyImageSelection(fallbackModelsFor(regionOfPanel(panel)), imageSet(value, panel));
+	const derive = (value, raw, panel) => {
+		const selectedImages = imageSet(value, panel);
+		const derived = deriveCatalog(applyImageSelection(sanitizeCatalog(dropDeadModels(raw, panel)), selectedImages), enabledSet(value, panel), regionStateOf(value, panel).contextBudgets ?? {});
+		return derived.length > 0 ? derived : fallbackModels(value, panel);
 	};
-	const configuredModels = (value, region) => {
-		const state = regionStateOf(value, region);
-		return state.lastCatalog?.length ? derive(value, state.lastCatalog, region) : region === "cn" && value.models?.length ? derive(value, value.models, region) : fallbackModels(value, region);
+	const configuredModels = (value, panel) => {
+		const state = regionStateOf(value, panel);
+		return state.lastCatalog?.length ? derive(value, state.lastCatalog, panel) : panel === "cn" && value.models?.length ? derive(value, value.models, panel) : fallbackModels(value, panel);
 	};
-	const displayModels = (value, region) => {
-		const state = regionStateOf(value, region);
-		return state.lastCatalog?.length ? dropDeadModels(sanitizeCatalog(state.lastCatalog), region) : region === "cn" && value.models?.length ? dropDeadModels(sanitizeCatalog(value.models), region) : fallbackModelsFor(region);
+	const displayModels = (value, panel) => {
+		const state = regionStateOf(value, panel);
+		return state.lastCatalog?.length ? dropDeadModels(sanitizeCatalog(state.lastCatalog), panel) : panel === "cn" && value.models?.length ? dropDeadModels(sanitizeCatalog(value.models), panel) : fallbackModelsFor(regionOfPanel(panel));
 	};
 	/**
 	* Legacy migration for the pre-split single `accountId`: its region is
@@ -6302,9 +8143,20 @@ function apply(ctx, config) {
 	* inheriting a selection that belongs to the other side of the split.
 	*/
 	let legacyAccountRegion;
-	const effectiveAccountFor = (region, value) => {
-		const explicit = unwrapVolatile(value.accounts)?.[region];
+	/**
+	* Which account a panel is bound to.
+	*
+	* Keyed by PANEL: the enterprise pool draws on the same CN credentials but
+	* keeps its OWN binding, so pointing the consumer tab at a personal account
+	* never moves the enterprise tab (and vice versa). A panel with no explicit
+	* binding falls through to that REGION's default selection, which is the
+	* store's own "preferred account for this region".
+	*/
+	const effectiveAccountFor = (panel, value) => {
+		const explicit = unwrapVolatile(value.accounts)?.[panel];
 		if (explicit !== void 0) return explicit;
+		const region = regionOfPanel(panel);
+		if (panel === "enterprise") return void 0;
 		return legacyAccountRegion === region ? value.accountId : void 0;
 	};
 	/**
@@ -6326,10 +8178,29 @@ function apply(ctx, config) {
 			}
 		}
 	}
+	/**
+	* One stack per PANEL.
+	*
+	* `cn` and `enterprise` share a credential REGION but not a directory, a wire
+	* map or a model selection: the two pools publish different rosters, so a
+	* shared catalog would let one pool's answer filter the other's models. Each
+	* panel therefore gets its own catalog, wire state, clients and shim routes,
+	* and the credential store below is the only thing they have in common.
+	*/
 	const stacks = {};
-	for (const region of REGION_KEYS) {
+	for (const panel of TRAE_PANELS) {
+		const region = regionOfPanel(panel);
+		/**
+		* Whether tenant (enterprise) accounts are also offered by the CONSUMER
+		* panels.
+		*
+		* Off by default, so a published build offers an enterprise login only
+		* under the enterprise panel. Opt-in per machine, and intentionally not
+		* surfaced in user-facing documentation.
+		*/
+		const tenantLocal = process.env["DSH_TRAE_TENANT_IN_CONSUMER"] === "1";
 		const catalog = new TraeCatalog(region);
-		const wire = wireState[region];
+		const wire = wireState[panel];
 		/**
 		* Best-effort device identity for this region's installation. Prefer the
 		* selected credential's own edition so an international account reads its
@@ -6382,6 +8253,7 @@ function apply(ctx, config) {
 		};
 		const store = new TraeCredentialStore({
 			region,
+			...panel === "enterprise" ? { requireTenant: true } : { hideTenantAccounts: !tenantLocal },
 			...unwrapVolatile(config.authFile) === void 0 ? {} : { storagePath: unwrapVolatile(config.authFile) },
 			edition: unwrapVolatile(config.edition) ?? "auto",
 			refresh: async (credential) => refreshTraeCredential(credential, void 0, await refreshDeviceSafe())
@@ -6389,19 +8261,66 @@ function apply(ctx, config) {
 		const solo = new TraeSoloUpstreamClient({
 			credential: () => store.resolve(),
 			identity,
+			...panel === "enterprise" ? { route: "enterprise" } : {},
 			log: (message, detail) => ctx.logger.warn(message, detail)
 		});
 		const remoteCatalog = new TraeSoloRemoteCatalogClient({ credential: () => store.resolve() });
 		const wireResolver = (displayId) => wire.byId.get(displayId) ?? wire.byName.get(displayId.trim().toLowerCase());
-		const upstream = new TraeSoloBridge(solo, catalog, wireResolver);
-		const delegating = new TraeDelegatingUpstreamClient(upstream);
+		/**
+		* One client + bridge per provider id.
+		*
+		* `routeOfTraeProvider` pins each to its billing pool: the consumer ids get
+		* the region gateway exactly as before, `trae-enterprise` gets the tenant
+		* gateway and stamps the `session_id` it requires. The discovery client
+		* below stays UNROUTED on purpose — it owns the roster/probe path and, for
+		* a tenant credential, reads both pools so the shared catalogue keeps every
+		* model either one serves.
+		*/
+		/**
+		* Latest successful discovery for this panel, mutated by discoverModels
+		* and READ by applySelection (via the stack): a settings write rebuilds
+		* the catalog from saved rows that may predate wireConfigName, and the
+		* merge below is what keeps the case mapping alive across it.
+		*/
+		const latestDiscovery = [];
+		const routeClients = {};
+		const shimRoutes = [];
+		for (const provider of [providerOfPanel(panel)]) {
+			const route = routeOfTraeProvider(provider) ?? "solo";
+			const client = new TraeSoloUpstreamClient({
+				credential: () => store.resolve(),
+				identity,
+				route,
+				log: (message, detail) => ctx.logger.warn(message, detail)
+			});
+			const delegating = new TraeDelegatingUpstreamClient(new TraeSoloBridge(client, catalog, wireResolver));
+			routeClients[provider] = {
+				provider,
+				route,
+				client,
+				upstream: delegating,
+				secret: ""
+			};
+			shimRoutes.push({
+				label: route,
+				client: delegating,
+				pool: poolShimHooksOf(panel)
+			});
+		}
 		const shim = createTraeShim({
 			catalog,
-			client: delegating,
+			routes: shimRoutes,
 			logger: ctx.logger
 		});
+		for (const entry of Object.values(routeClients)) entry.secret = shim.tokenOf(entry.route);
+		/**
+		* The region's PRIMARY provider plumbing, used by region-wide paths that
+		* are not pool-specific: model probing, Raw-Chat status, and the stack's
+		* `delegating` handle. Per-provider turns never go through this.
+		*/
+		const primary = routeClients[providerOfPanel(panel)];
 		let rawDiagnostic = () => ({ state: "disabled" });
-		if (region === "cn") (async () => {
+		if (panel === "cn") (async () => {
 			try {
 				const resolved = await resolveTraeRawRuntime(store, "qwen-3.7-plus");
 				const gateway = createTraeRawGateway({
@@ -6415,7 +8334,7 @@ function apply(ctx, config) {
 							runtime: resolved.runtime
 						}
 					}),
-					solo: upstream,
+					solo: new TraeSoloBridge(primary.client, catalog, wireResolver),
 					endpoint: `${REGION_GATEWAYS.cn.chat}/api/ide/v2/llm_raw_chat`,
 					edition: resolved.identity.edition,
 					identity: {
@@ -6425,7 +8344,7 @@ function apply(ctx, config) {
 					runtime: resolved.runtime,
 					enabled: false
 				});
-				delegating.replace(gateway.upstream);
+				primary.upstream.replace(gateway.upstream);
 				rawDiagnostic = () => gateway.diagnostic();
 				ctx.effect(() => () => gateway.invalidate(), "dsh-connect-trae: Raw capability invalidation");
 			} catch (error) {
@@ -6436,12 +8355,14 @@ function apply(ctx, config) {
 			credential: () => store.resolve(),
 			deviceId: async () => (await identity()).deviceId
 		});
-		stacks[region] = {
+		stacks[panel] = {
 			region,
 			store,
 			catalog,
 			shim,
-			delegating,
+			lastDiscovery: latestDiscovery,
+			delegating: routeClients[providerOfPanel(panel)]?.upstream,
+			routeClients,
 			usageClient,
 			/**
 			* Credit balance of one named account, WITHOUT rebinding the store
@@ -6451,11 +8372,13 @@ function apply(ctx, config) {
 			* A throwaway client is used on purpose: the shared `usageClient` reads
 			* `store.resolve()`, which is bound to the selected account, and calling
 			* `selectAccount` to look at a neighbour would both race concurrent chat
-			* requests and persist a switch the user never made. A stale token simply
-			* fails here and the account is left out of the answer.
+			* requests and persist a switch the user never made. The credential is
+			* resolved (not merely looked up) so an account whose short-lived access
+			* token lapsed overnight still answers: its refresh token is good for
+			* months, and reporting `—` for a recoverable account is a lie.
 			*/
 			creditsOfAccount: async (accountId) => {
-				const credential = await store.credentialOf(accountId);
+				const credential = await store.resolveCredentialOf(accountId);
 				if (credential === void 0) return void 0;
 				return toCredits(await new TraeUsageClient({ credential: async () => credential }).snapshot());
 			},
@@ -6463,7 +8386,7 @@ function apply(ctx, config) {
 				const state = { id: accountId };
 				const selectedCredential = await store.current();
 				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
-					const credential = store.credentialOf(accountId);
+					const credential = store.resolveCredentialOf(accountId);
 					return new TraeUsageClient({
 						credential: async () => credential,
 						deviceId: async () => (await identity()).deviceId
@@ -6481,7 +8404,7 @@ function apply(ctx, config) {
 			claimCheckinOf: async (accountId) => {
 				const selectedCredential = await store.current();
 				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
-					const credential = store.credentialOf(accountId);
+					const credential = store.resolveCredentialOf(accountId);
 					return new TraeUsageClient({
 						credential: async () => credential,
 						deviceId: async () => (await identity()).deviceId
@@ -6510,6 +8433,8 @@ function apply(ctx, config) {
 					wire.byId.set(model.id, target);
 					wire.byName.set(model.name.trim().toLowerCase(), target);
 				}
+				latestDiscovery.length = 0;
+				latestDiscovery.push(...merged);
 				return merged;
 			},
 			/**
@@ -6532,25 +8457,405 @@ function apply(ctx, config) {
 				const skipped = [];
 				for (const id of ids) if (known.has(id.trim().toLowerCase())) testable.push(id);
 				else skipped.push(id);
-				const results = await probeModelsSequentially((body, signal) => upstream.chatStream(body, signal), testable);
+				const results = await probeModelsSequentially((body, signal) => primary.upstream.chatStream(body, signal), testable);
 				return skipped.length === 0 ? { results } : {
 					results,
 					skipped
 				};
 			},
 			invalidateAdapter: () => {},
-			rawDiagnostic: () => rawDiagnostic()
+			rawDiagnostic: () => rawDiagnostic(),
+			wireResolver,
+			identity,
+			routeOf: (provider) => routeOfTraeProvider(provider) ?? "solo"
+		};
+	}
+	/** This panel's saved pool preferences, unwrapped and defaulted to OFF. */
+	const poolPreferencesOf = (panel) => unwrapVolatileDeep(regionStateOf(current(), panel).pool) ?? {};
+	/**
+	* Project one account's card credits onto the pool's ranking shape.
+	*
+	* The pool's `total` is the figure a request can SPEND, which on Trae is the
+	* General bucket alone (SOLO chat never drains Work). The card's `total` is the
+	* wider `available` figure, so it is deliberately NOT reused here: ranking by it
+	* would put an account with a large Work balance and no General credit in front
+	* of one that can actually serve. `undefined` (the read failed) stays undefined
+	* so `rankPool` treats it as zero rather than as full.
+	*/
+	/**
+	* Credit totals the pool ranks on, cached per account.
+	*
+	* The CHAT path must not spend an upstream round-trip per candidate just to
+	* decide who bills: {@link poolMembersOf} reads every balance, which is right
+	* for the card (one read per poll) and far too slow per request. So the card's
+	* poll warms this cache and the router only reads it.
+	*
+	* A cold cache means "unknown", not "no credit": `rankPool` orders a missing
+	* figure as zero and then falls back to token freshness, so a cold start still
+	* picks a member — the user chose the roster — instead of refusing to bill.
+	*/
+	const poolCreditCache = {
+		cn: /* @__PURE__ */ new Map(),
+		enterprise: /* @__PURE__ */ new Map(),
+		ai: /* @__PURE__ */ new Map()
+	};
+	const poolCreditsOfAccount = async (panel, accountId) => {
+		const credits = await stacks[panel].creditsOfAccount(accountId);
+		if (credits === void 0) return void 0;
+		const within3d = credits.expiry?.within3d;
+		const projected = {
+			total: credits.generalAvailable,
+			generalAvailable: credits.generalAvailable,
+			workAvailable: credits.workAvailable,
+			expiringSoon: within3d?.total ?? 0,
+			...within3d?.earliestExpiresAtMs === void 0 ? {} : { nearestExpiryMs: within3d.earliestExpiresAtMs }
+		};
+		poolCreditCache[panel].set(accountId, projected);
+		return projected;
+	};
+	/**
+	* Assemble one pool member per LOCAL account, in the store's order.
+	*
+	* "Member" means the account still has a sign-in this machine can use: a saved
+	* id whose desktop credentials vanished is a ghost, and a ghost cannot be tested
+	* or checked in, so listing it as a member would enable a batch over nothing.
+	* The saved list is intersected separately (see
+	* {@link TraePoolDeps.effectiveMemberAccountIds}) — here the store is the source.
+	*
+	* Balance reads are settled independently: one account whose credit read fails
+	* must not take the whole pool document down, and it ranks as zero rather than
+	* disappearing.
+	*/
+	const poolMembersOf = async (panel) => {
+		const probes = await readTraePoolProbes(poolKeyOfPanel(panel));
+		const choices = await stacks[panel].store.accounts();
+		return await Promise.all(choices.map(async (choice) => {
+			const credits = await poolCreditsOfAccount(panel, choice.id).catch(() => void 0);
+			return {
+				account: {
+					id: choice.id,
+					accountName: choice.accountName
+				},
+				...credits === void 0 ? {} : { credits },
+				...probes[choice.id] === void 0 ? {} : { probe: probes[choice.id] },
+				...choice.tokenExpiresAtMs === void 0 ? {} : { tokenExpiresAtMs: choice.tokenExpiresAtMs }
+			};
+		}));
+	};
+	/**
+	* The catalog a pool test resolves its target model against.
+	*
+	* The LAST discovery wins, and the saved/live catalog is the fallback: a test
+	* clicked before the first discovery lands must still find the free models the
+	* region already knows, and one clicked after it must not be judged against a
+	* roster the upstream has since replaced.
+	*/
+	const poolCatalogOf = (panel) => stacks[panel].lastDiscovery.length > 0 ? stacks[panel].lastDiscovery : stacks[panel].catalog.current();
+	/** Id → display name for one panel, for the rows a batch reports. */
+	const poolMemberNamesOf = async (panel) => {
+		const names = {};
+		for (const member of await poolMembersOf(panel)) names[member.account.id] = member.account.accountName;
+		return names;
+	};
+	/**
+	* The accounts a batch runs on: the SAVED member list, narrowed to what this
+	* machine can still reach, in the user's own order.
+	*
+	* Order is the user's, not the ranking's, on purpose: a batch result table that
+	* reorders itself between presses is hard to read row by row, and the ranking
+	* is already shown by the table above it.
+	*/
+	const poolTargetsOf = async (panel) => {
+		const saved = poolPreferencesOf(panel).memberAccountIds ?? [];
+		const names = await poolMemberNamesOf(panel);
+		return effectiveMembersOf(saved, new Set(Object.keys(names))).map((accountId) => ({
+			accountId,
+			accountName: names[accountId] ?? ""
+		}));
+	};
+	/**
+	* Pool members from LOCAL state only: the store's logins, the saved probes and
+	* the cached credit totals. No upstream call, so it is safe on the request
+	* path (see {@link poolCreditCache} for why the cache exists).
+	*/
+	async function localPoolMembers(panel) {
+		const probes = await readTraePoolProbes(poolKeyOfPanel(panel)).catch(() => ({}));
+		const choices = await stacks[panel].store.accounts().catch(() => []);
+		const cache = poolCreditCache[panel];
+		return choices.map((choice) => {
+			const credits = cache.get(choice.id);
+			return {
+				account: {
+					id: choice.id,
+					accountName: choice.accountName
+				},
+				...credits === void 0 ? {} : { credits },
+				...probes[choice.id] === void 0 ? {} : { probe: probes[choice.id] },
+				...choice.tokenExpiresAtMs === void 0 ? {} : { tokenExpiresAtMs: choice.tokenExpiresAtMs }
+			};
+		});
+	}
+	/**
+	* The members that may actually be billed: the user's SAVED opt-in list
+	* intersected with what this machine can still reach, minus the accounts that
+	* already failed this request (`billableMembers` is the one definition of that
+	* rule, shared with the batch paths).
+	*/
+	async function poolBillableMembers(panel, tried = []) {
+		return billableMembers(await localPoolMembers(panel), poolPreferencesOf(panel).memberAccountIds ?? [], tried);
+	}
+	/**
+	* Point the NEXT request at the best pooled account, or back at the bound one
+	* when the pool is off (issue #44).
+	*
+	* Returns the account it chose. Both the chat path and the card's usage read go
+	* through here, so "currently serving" on screen and the next real request
+	* cannot disagree — one rule, one answer.
+	*
+	* When EVERY member is excluded the rotation is cleared rather than pointed at
+	* an excluded account: the bound account then serves, which is the user's own
+	* explicit choice and the only account a refusal would not have served anyway.
+	* The card reports the exclusion reasons, so this is never silent.
+	*/
+	async function applyPoolSelection(panel) {
+		const store = stacks[panel].store;
+		if (poolPreferencesOf(panel).enabled !== true) {
+			store.setRotatedAccount(void 0);
+			return;
+		}
+		try {
+			const winner = pickAccount(await poolBillableMembers(panel), Date.now());
+			store.setRotatedAccount(winner?.id);
+			return winner?.id;
+		} catch {
+			store.setRotatedAccount(void 0);
+			return;
+		}
+	}
+	/**
+	* The client for the next account worth trying, bound to THAT account.
+	*
+	* Built per attempt from the account's own stored credential, so a failover
+	* never rebinds the store and never disturbs a request that is already billing
+	* the chosen account (the same rule per-account probes follow, issue #25). The
+	* bridge is the same one a normal turn uses, so display ids still resolve to
+	* their wire names.
+	*/
+	async function failoverClientFor(panel, tried) {
+		const next = pickAccount(await poolBillableMembers(panel, tried), Date.now());
+		if (next === void 0) return void 0;
+		const stack = stacks[panel];
+		const accountId = next.id;
+		return {
+			accountId,
+			client: new TraeSoloBridge(new TraeSoloUpstreamClient({
+				credential: async () => {
+					const credential = await stack.store.resolveCredentialOf(accountId);
+					if (credential === void 0) throw new Error(`no stored credential for account ${accountId}`);
+					return credential;
+				},
+				identity: () => stack.identity(),
+				route: stack.routeOf(providerOfPanel(panel)),
+				log: (message, detail) => ctx.logger.warn(message, detail)
+			}), stack.catalog, stack.wireResolver)
 		};
 	}
 	/**
+	* Persist what a real request taught us about an account (issue #44).
+	*
+	* Written as a `live-request` probe so the card can tell a measurement taken by
+	* a batch from one taken by traffic, and so the ranking excludes the account on
+	* its next turn instead of walking back into the same limit.
+	*/
+	async function recordPoolFailure(panel, accountId, kind, message) {
+		const outcome = POOL_OUTCOME_BY_KIND[kind];
+		if (outcome === void 0) return;
+		await writeTraePoolProbes(poolKeyOfPanel(panel), { [accountId]: {
+			outcome,
+			atMs: Date.now(),
+			source: "live-request",
+			message: `${kind}: ${message}`
+		} }).catch(() => {});
+	}
+	/**
+	* Why nothing else could serve, as one clause for the error the caller sees.
+	*
+	* `undefined` when the pool is off (the plain upstream error is the whole
+	* story) or when there was in fact a candidate left — the shim asked because it
+	* ran out of attempts, not out of accounts.
+	*/
+	async function poolShortfallOf(panel, tried) {
+		if (poolPreferencesOf(panel).enabled !== true) return void 0;
+		let members;
+		let remaining;
+		try {
+			members = await poolBillableMembers(panel);
+			if (members.length === 0) return "the account pool is enabled but has no usable member";
+			remaining = await poolBillableMembers(panel, tried);
+		} catch {
+			return;
+		}
+		if (remaining.length === 0) return `all ${members.length} pooled account(s) were tried for this request`;
+		const ranked = rankPool(remaining, Date.now());
+		const reasons = [...new Set(ranked.flatMap((entry) => entry.excludedBy === void 0 ? [] : [entry.excludedBy]))];
+		return reasons.length === 0 ? void 0 : `every remaining pooled account is excluded (${reasons.join(", ")})`;
+	}
+	/**
+	* The shim's view of one panel's pool.
+	*
+	* Declared as a hoisted function because the shim's route table is built ABOVE
+	* this point in `apply`; only the bodies run later, on a real request.
+	*/
+	function poolShimHooksOf(panel) {
+		return {
+			prepare: () => applyPoolSelection(panel),
+			next: (tried) => failoverClientFor(panel, tried),
+			failed: (accountId, kind, message) => recordPoolFailure(panel, accountId, kind, message),
+			shortfall: (tried) => poolShortfallOf(panel, tried)
+		};
+	}
+	/**
+	* The pool's dependency bag for ONE panel.
+	*
+	* Every member re-reads the store on each call rather than capturing a list:
+	* a batch runs for minutes, and a sign-in the user performed half-way through
+	* must be visible to the rows it has not reached yet.
+	*
+	* The bag is built per REQUEST, so it captures the panel and never has to be
+	* told which tab asked.
+	*/
+	const poolDepsOf = (panel) => {
+		const bridges = /* @__PURE__ */ new Map();
+		const chatBridgeFor = (accountId) => {
+			const existing = bridges.get(accountId);
+			if (existing !== void 0) return existing;
+			const stack = stacks[panel];
+			const bridge = new TraeSoloBridge(new TraeSoloUpstreamClient({
+				credential: async () => {
+					const credential = await stack.store.resolveCredentialOf(accountId);
+					if (credential === void 0) throw new Error(`no stored credential for account ${accountId}`);
+					return credential;
+				},
+				identity: () => stack.identity(),
+				route: stack.routeOf(providerOfPanel(panel)),
+				log: (message, detail) => ctx.logger.warn(message, detail)
+			}), stack.catalog, stack.wireResolver);
+			const chat = (body, signal) => bridge.chatStream(body, signal);
+			bridges.set(accountId, chat);
+			return chat;
+		};
+		const probeDeps = () => ({
+			credentialFor: (accountId) => stacks[panel].store.resolveCredentialOf(accountId),
+			checkinStatusOf: async (credential) => {
+				return new TraeUsageClient({
+					credential: async () => credential,
+					deviceId: async () => (await stacks[panel].identity()).deviceId
+				}).checkinStatus();
+			},
+			claimCheckinOf: async (credential) => {
+				return new TraeUsageClient({
+					credential: async () => credential,
+					deviceId: async () => (await stacks[panel].identity()).deviceId
+				}).claimCheckin();
+			},
+			chatFor: (credential) => chatBridgeFor(traeAccountId(credential))
+		});
+		/** How much text a probe should carry for this panel (0 = the minimal probe). */
+		const probeInputTokensOf = (stored) => {
+			const tokens = poolPreferencesOf(stored).probeInputTokens;
+			return typeof tokens === "number" && Number.isFinite(tokens) && tokens > 0 ? Math.min(tokens, MAX_PROBE_INPUT_TOKENS) : 0;
+		};
+		/** One account's row, through the same bridge and probe the batch uses. */
+		const testWith = async (target, modelId, probeInputTokens) => {
+			const [row] = await testAllAccounts([target], modelId, (chatFor, credential, id) => {
+				if (credential === void 0) return Promise.resolve({
+					id,
+					verdict: "auth",
+					detail: "no stored credential for this account"
+				});
+				return probeOneModel(chatFor(credential), id, void 0, probeInputTokens);
+			}, probeDeps());
+			return row;
+		};
+		return {
+			preferences: (stored) => poolPreferencesOf(stored),
+			members: (stored) => poolMembersOf(stored),
+			effectiveMemberAccountIds: async (stored) => {
+				return effectiveMembersOf(poolPreferencesOf(stored).memberAccountIds ?? [], new Set((await poolMembersOf(stored)).map((member) => member.account.id)));
+			},
+			memberNames: async (stored) => {
+				const names = {};
+				for (const member of await poolMembersOf(stored)) names[member.account.id] = member.account.accountName;
+				return names;
+			},
+			otherAccounts: async (stored) => (await poolMembersOf(stored)).map((member) => member.account),
+			currentAccountId: async (stored) => {
+				const configured = configuredAccountsOf(current())[stored];
+				return isTraeAccountId(configured) ? configured : void 0;
+			},
+			catalog: (stored) => poolCatalogOf(stored),
+			checkinSupported: (stored) => regionOfPanel(stored) === "cn",
+			checkin: async (stored) => checkinAllAccounts(await poolTargetsOf(stored), probeDeps()),
+			checkinState: async (stored) => {
+				const state = {};
+				for (const target of await poolTargetsOf(stored)) {
+					const credential = await stacks[stored].store.resolveCredentialOf(target.accountId);
+					if (credential === void 0) continue;
+					const client = new TraeUsageClient({
+						credential: async () => credential,
+						deviceId: async () => (await stacks[stored].identity()).deviceId
+					});
+					try {
+						const status = await client.checkinStatus();
+						state[target.accountId] = {
+							checkedIn: status.checkedIn,
+							deviceCheckedIn: status.didCheckedIn,
+							enabled: status.enabled
+						};
+					} catch {}
+				}
+				return state;
+			},
+			test: async (stored, modelId, onRow) => {
+				const probeInputTokens = probeInputTokensOf(stored);
+				const rows = await testAllAccounts(await poolTargetsOf(stored), modelId, (chatFor, credential, id) => {
+					if (credential === void 0) return Promise.resolve({
+						id,
+						verdict: "auth",
+						detail: "no stored credential for this account"
+					});
+					return probeOneModel(chatFor(credential), id, void 0, probeInputTokens);
+				}, probeDeps(), onRow);
+				await writeTraePoolProbes(poolKeyOfPanel(stored), probeUpdatesOf(rows));
+				return rows;
+			},
+			testOne: async (stored, accountId) => {
+				const model = resolveTargetModel(poolCatalogOf(stored), poolPreferencesOf(stored).targetModelId);
+				if (model.modelId === void 0) return void 0;
+				const names = await poolMemberNamesOf(stored);
+				const row = await testWith({
+					accountId,
+					accountName: names[accountId] ?? ""
+				}, model.modelId, probeInputTokensOf(stored));
+				await writeTraePoolProbes(poolKeyOfPanel(stored), probeUpdatesOf([row]));
+				return row;
+			},
+			removeOne: async (stored, accountId) => {
+				await dropTraePoolProbe(poolKeyOfPanel(stored), accountId);
+				return true;
+			}
+		};
+	};
+	/**
 	* The app's current sign-in when it differs from the bound account (issue
 	* #29). Pure read: the store resolves the bound account verbatim, so billing
 	* never moves from here — the card's hint and the follow switch below are
 	* the only writers.
 	*/
-	const liveLoginOf = async (region) => {
+	const liveLoginOf = async (panel) => {
+		const region = regionOfPanel(panel);
 		try {
-			const live = await stacks[region].store.liveLogin();
+			const live = await stacks[panel].store.liveLogin();
 			if (live === void 0 || live.region !== region) return void 0;
 			return {
 				id: live.id,
@@ -6574,30 +8879,51 @@ function apply(ctx, config) {
 	* event (`loader/volatile-update`) is what re-runs `applySelection` with the
 	* updated document — the same channel every card write already uses.
 	*/
-	const followAppLogin = async (region) => {
-		const live = await liveLoginOf(region);
+	const followAppLogin = async (panel) => {
+		const live = await liveLoginOf(panel);
 		if (live === void 0 || writeSettings === void 0) return void 0;
 		const configured = configuredAccountsOf(current());
-		if (configured[region] === live.id) return live;
+		if (configured[panel] === live.id) return live;
 		await writeSettings({ accounts: {
 			...configured,
-			[region]: live.id
+			[panel]: live.id
 		} });
 		return live;
 	};
 	ctx.inject(["webServer"], (webCtx) => registerTraeUsageRoute(webCtx, {
-		store: (region) => stacks[region].store,
-		client: (region) => stacks[region].usageClient,
-		displayModels: (region) => displayModels(current(), region),
-		enabledModelIds: (region) => regionStateOf(current(), region).enabledModelIds ?? [],
-		regionEnabled: (region) => regionEnabled(current(), region),
-		discoverModels: (region, signal) => stacks[region].discoverModels(signal),
-		probeModels: (region, ids) => stacks[region].probeModels(ids),
-		rawDiagnostic: (region) => stacks[region].rawDiagnostic(),
-		creditsOfAccount: (region, accountId) => stacks[region].creditsOfAccount(accountId),
-		accountStateOf: (region, accountId) => stacks[region].accountStateOf(accountId),
-		claimCheckinOf: (region, accountId) => stacks[region].claimCheckinOf(accountId),
-		liveLogin: (region) => liveLoginOf(region)
+		store: (panel) => stacks[panel].store,
+		client: (panel) => stacks[panel].usageClient,
+		displayModels: (panel) => displayModels(current(), panel),
+		enabledModelIds: (panel) => regionStateOf(current(), panel).enabledModelIds ?? [],
+		regionEnabled: (panel) => regionEnabled(current(), panel),
+		discoverModels: (panel, signal) => stacks[panel].discoverModels(signal),
+		probeModels: (panel, ids) => stacks[panel].probeModels(ids),
+		rawDiagnostic: (panel) => stacks[panel].rawDiagnostic(),
+		creditsOfAccount: (panel, accountId) => stacks[panel].creditsOfAccount(accountId),
+		accountStateOf: (panel, accountId) => stacks[panel].accountStateOf(accountId),
+		claimCheckinOf: (panel, accountId) => stacks[panel].claimCheckinOf(accountId),
+		liveLogin: (panel) => liveLoginOf(panel),
+		pool: {
+			preferences: (panel) => poolPreferencesOf(panel),
+			members: (panel) => poolMembersOf(panel),
+			effectiveMemberAccountIds: async (panel) => {
+				return effectiveMembersOf(poolPreferencesOf(panel).memberAccountIds ?? [], new Set((await poolMembersOf(panel)).map((member) => member.account.id)));
+			},
+			memberNames: (panel) => poolMemberNamesOf(panel),
+			otherAccounts: async (panel) => (await poolMembersOf(panel)).map((member) => member.account),
+			currentAccountId: async (panel) => {
+				await applyPoolSelection(panel).catch(() => void 0);
+				const credential = await stacks[panel].store.current().catch(() => void 0);
+				return credential === void 0 ? void 0 : traeAccountId(credential);
+			},
+			catalog: (panel) => poolCatalogOf(panel),
+			checkinSupported: (panel) => regionOfPanel(panel) === "cn",
+			checkin: (panel) => poolDepsOf(panel).checkin?.(panel) ?? Promise.resolve([]),
+			checkinState: (panel) => poolDepsOf(panel).checkinState?.(panel) ?? Promise.resolve({}),
+			test: (panel, modelId, onRow) => poolDepsOf(panel).test?.(panel, modelId, onRow) ?? Promise.resolve([]),
+			testOne: (panel, accountId) => poolDepsOf(panel).testOne?.(panel, accountId) ?? Promise.resolve(void 0),
+			removeOne: (panel, accountId) => poolDepsOf(panel).removeOne?.(panel, accountId) ?? Promise.resolve(false)
+		}
 	}));
 	/**
 	* Live registration handles per region, filled once the shim is listening.
@@ -6609,8 +8935,18 @@ function apply(ctx, config) {
 	* card tab alone would leave every model selectable.
 	*/
 	const registration = {
-		cn: {},
-		ai: {}
+		cn: { adapters: [] },
+		enterprise: { adapters: [] },
+		ai: { adapters: [] }
+	};
+	/** Release every live registration this apply() created. */
+	const disposeRegistration = () => {
+		for (const panel of TRAE_PANELS) {
+			for (const entry of registration[panel].adapters) entry.handle();
+			registration[panel].adapters.length = 0;
+		}
+		registration.cn.directory?.();
+		delete registration.cn.directory;
 	};
 	/**
 	* Publish each region's on/off state to the harness (issue #11). Both swaps
@@ -6622,21 +8958,53 @@ function apply(ctx, config) {
 	* lands immediately.
 	*/
 	const syncRegionRegistration = (value) => {
-		for (const region of REGION_KEYS) registration[region].adapter?.replace(regionEnabled(value, region) ? [TRAE_PROVIDERS[region]] : []);
-		registration.cn.directory?.replace(REGION_KEYS.filter((region) => regionEnabled(value, region)).map((region) => ({
-			provider: TRAE_PROVIDERS[region],
-			displayName: TRAE_PROVIDER_DISPLAY_NAMES[region],
+		for (const panel of TRAE_PANELS) {
+			const enabled = regionEnabled(value, panel);
+			for (const entry of registration[panel].adapters) entry.handle.replace(enabled ? [entry.provider] : []);
+		}
+		registration.cn.directory?.replace(TRAE_PANELS.filter((panel) => regionEnabled(value, panel)).map((panel) => ({
+			provider: providerOfPanel(panel),
+			displayName: displayNameOfTraeProvider(providerOfPanel(panel)),
 			settingsNs,
 			settingsPath: [],
 			declared: false
 		})));
 	};
-	/** Push the current config into every region's store selection and catalog. */
+	/** Push the current config into every panel's store selection and catalog. */
 	const applySelection = (value) => {
-		for (const region of REGION_KEYS) {
-			const stack = stacks[region];
-			stack.store.setSource(unwrapVolatile(value.authFile), unwrapVolatile(value.edition) ?? "auto", effectiveAccountFor(region, value));
-			stack.catalog.set(configuredModels(value, region));
+		for (const panel of TRAE_PANELS) {
+			const stack = stacks[panel];
+			stack.store.setSource(unwrapVolatile(value.authFile), unwrapVolatile(value.edition) ?? "auto", effectiveAccountFor(panel, value));
+			/**
+			* Re-merge the wire mapping the last discovery taught us.
+			*
+			* configuredModels rebuilds from the SAVED rows, and rows saved before
+			* wireConfigName existed carry wireFunction alone. Every settings write
+			* goes through here (card writes, follow-app-login, the initial seed),
+			* so without this each write would strip the case mapping until the next
+			* discovery -- the exact window that turns deepseek-v4.1-flash into a
+			* 4001, because the gateway is case-sensitive and the lowercase
+			* directory id is the one spelling it refuses.
+			*/
+			const known = /* @__PURE__ */ new Map();
+			for (const model of stack.lastDiscovery) {
+				known.set(model.id, model);
+				known.set(model.id.trim().toLowerCase(), model);
+				if (model.name.trim() !== "") known.set(model.name.trim().toLowerCase(), model);
+			}
+			const rows = configuredModels(value, panel).map((model) => {
+				const match = known.get(model.id) ?? known.get(model.id.trim().toLowerCase()) ?? (model.name.trim() !== "" ? known.get(model.name.trim().toLowerCase()) : void 0);
+				if (match === void 0) return model;
+				const wireConfigName = model.wireConfigName ?? match.wireConfigName;
+				const wireFunction = model.wireFunction ?? match.wireFunction;
+				if (wireConfigName === model.wireConfigName && wireFunction === model.wireFunction) return model;
+				return {
+					...model,
+					...wireConfigName === void 0 ? {} : { wireConfigName },
+					...wireFunction === void 0 ? {} : { wireFunction }
+				};
+			});
+			stack.catalog.set(rows);
 			stack.invalidateAdapter();
 		}
 		syncRegionRegistration(value);
@@ -6695,9 +9063,9 @@ function apply(ctx, config) {
 		if (followInFlight || !followAppLoginEnabled(current())) return;
 		followInFlight = true;
 		try {
-			for (const region of REGION_KEYS) {
-				if (!regionEnabled(current(), region)) continue;
-				await followAppLogin(region);
+			for (const panel of TRAE_PANELS) {
+				if (!regionEnabled(current(), panel)) continue;
+				await followAppLogin(panel);
 			}
 		} catch (error) {
 			ctx.logger.warn("dsh-connect-trae: follow-app-login rebind skipped", error);
@@ -6709,77 +9077,78 @@ function apply(ctx, config) {
 	let stopped = false;
 	ctx.effect(() => () => {
 		stopped = true;
-		for (const region of REGION_KEYS) stacks[region].shim.close();
+		for (const panel of TRAE_PANELS) stacks[panel].shim.close();
 	});
-	Promise.all(REGION_KEYS.map((region) => stacks[region].shim.ready)).then(async () => {
+	Promise.all(TRAE_PANELS.map((panel) => stacks[panel].shim.ready)).then(async () => {
 		if (stopped) return;
 		try {
 			const piAi = piAiRuntimeInfo();
 			ctx.logger.info(`dsh-connect-trae: pi-ai ${piAi.version ?? "unknown"} (${piAi.generation} generation)${piAi.inspected ? "" : " — not resolved locally, the host supplies it"}`);
-			for (const region of REGION_KEYS) {
-				const stack = stacks[region];
+			for (const panel of TRAE_PANELS) {
+				const stack = stacks[panel];
+				const provider = providerOfPanel(panel);
+				const entry = stack.routeClients[provider];
+				if (entry === void 0) continue;
 				const trae = createTraeAdapter({
 					shim: stack.shim,
 					catalog: stack.catalog,
-					provider: TRAE_PROVIDERS[region],
-					displayName: TRAE_PROVIDER_DISPLAY_NAMES[region],
+					provider,
+					displayName: displayNameOfTraeProvider(provider),
+					secret: entry.secret,
 					resolveAttachments: () => ctx.get("attachments")
 				});
 				stack.invalidateAdapter = () => {
 					trae.invalidate();
 				};
-				registration[region].adapter = region === "cn" ? ctx.llm.registerAdapter([TRAE_PROVIDER], trae.adapter) : ctx.llm.registerAdapter([TRAE_AI_PROVIDER], trae.adapter);
+				registration[panel].adapters.push({
+					provider,
+					handle: ctx.llm.registerAdapter([provider], trae.adapter)
+				});
 			}
 			ctx.llm.registerModelDiscovery(settingsNs, async (request, signal) => {
-				const region = regionOfTraeProvider(request.provider ?? "");
-				if (region === void 0) return [];
-				if (!regionEnabled(current(), region)) return [];
+				const panel = panelOfProvider(request.provider ?? "");
+				if (panel === void 0) return [];
+				if (!regionEnabled(current(), panel)) return [];
 				const cancellation = signal ?? request.signal;
-				return applyImageSelection(await stacks[region].discoverModels(cancellation), imageSet(current(), region)).map((model) => ({
+				const next = applyImageSelection(await stacks[panel].discoverModels(cancellation), imageSet(current(), panel));
+				const withRate = panel !== "enterprise";
+				return next.map((model) => ({
 					id: model.id,
-					name: traeModelDisplayName(model),
+					name: traeModelDisplayName(model, withRate),
 					...model.contextWindow === void 0 ? {} : { contextWindow: model.contextWindow },
 					...model.maxTokens === void 0 ? {} : { maxTokens: model.maxTokens },
 					inputModalities: traeInputModalities(model)
 				}));
 			});
-			registration.cn.directory = ctx.llm.registerConfigurableProviders(REGION_KEYS.map((region) => ({
-				provider: TRAE_PROVIDERS[region],
-				displayName: TRAE_PROVIDER_DISPLAY_NAMES[region],
+			registration.cn.directory = ctx.llm.registerConfigurableProviders(TRAE_PANELS.map((panel) => ({
+				provider: providerOfPanel(panel),
+				displayName: displayNameOfTraeProvider(providerOfPanel(panel)),
 				settingsNs,
 				settingsPath: [],
 				declared: false
 			})));
 			syncRegionRegistration(current());
 		} finally {
-			if (registration.cn.adapter === void 0 || registration.ai.adapter === void 0 || registration.cn.directory === void 0) {
-				registration.cn.adapter?.();
-				registration.ai.adapter?.();
-				registration.cn.directory?.();
-			}
+			if (registration.cn.adapters.length === 0 || registration.ai.adapters.length === 0 || registration.cn.directory === void 0) disposeRegistration();
 		}
 		try {
 			ctx.effect(() => () => {
-				registration.cn.adapter?.();
-				registration.ai.adapter?.();
-				registration.cn.directory?.();
+				disposeRegistration();
 			});
 		} catch {
-			registration.cn.adapter?.();
-			registration.ai.adapter?.();
-			registration.cn.directory?.();
+			disposeRegistration();
 		}
-		for (const region of REGION_KEYS) {
-			if (!regionEnabled(current(), region)) continue;
+		for (const panel of TRAE_PANELS) {
+			if (!regionEnabled(current(), panel)) continue;
 			(async () => {
-				const stack = stacks[region];
+				const stack = stacks[panel];
 				try {
 					const models = await stack.discoverModels();
 					if (stopped) return;
-					stack.catalog.set(derive(current(), models, region));
+					stack.catalog.set(derive(current(), models, panel));
 				} catch (error) {
-					ctx.logger.warn(`dsh-connect-trae: live ${region} model directory unavailable; serving the configured catalog`, error);
-					stack.catalog.set(configuredModels(current(), region));
+					ctx.logger.warn(`dsh-connect-trae: live ${panel} model directory unavailable; serving the configured catalog`, error);
+					stack.catalog.set(configuredModels(current(), panel));
 				}
 				stack.invalidateAdapter();
 			})();
@@ -6789,4 +9158,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, discoveredCatalog, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, MAX_PROBE_INPUT_TOKENS, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };