dsh-workbuddy-xdpool 1.7.2 → 1.7.3

package/lib/index.d.ts

@@ -288,6 +288,13 @@ interface UpstreamClientOptions {
   fetchImpl?: typeof fetch;
   /** Client version string sent to the upstream. */
   clientVersion?: string;
+  /**
+   * Override the catalog-fetch backoff, in milliseconds.
+   *
+   * Tests set this to `[]` (or tiny values) so a retry case does not spend real
+   * seconds sleeping. Production uses {@link CATALOG_RETRY_BACKOFF_MS}.
+   */
+  catalogRetryBackoffMs?: readonly number[];
 }
 /** Region for a login domain; an empty domain means CN (matching upstream tooling). */
 /** The two gateways WorkBuddy serves: the domestic one and the international one. */
@@ -421,6 +428,19 @@ export declare function buddyAppEvents(buddyId: string, buddyName: string): Reco
 export declare class WorkBuddyUpstreamClient {
   private readonly fetchImpl;
   private readonly clientVersion;
+  /** Backoff ladder for `fetchModels`; empty means a single attempt. */
+  private readonly catalogRetryBackoffMs;
+  /**
+   * Optional logger for retry notices.
+   *
+   * Set by the host so a retry is visible in the log with its attempt count —
+   * without it, a retry that eventually succeeds is invisible, and an operator
+   * debugging "why was the catalog slow" has nothing to look at.
+   */
+  logger: {
+    warn?(...args: unknown[]): void;
+    info?(...args: unknown[]): void;
+  } | undefined;
   constructor(options?: UpstreamClientOptions);
   /**
    * Normalize an OpenAI chat-completions body for the WorkBuddy upstream:
@@ -467,6 +487,16 @@ export declare class WorkBuddyUpstreamClient {
    * below is common to the two branches.
    */
   fetchModels(credential: WorkBuddyCredential, signal?: AbortSignal): Promise<readonly WorkBuddyUpstreamModel[]>;
+  /**
+   * One catalog attempt, without retries.
+   *
+   * Split out so {@link fetchModels} can retry it: the failure this guards
+   * against is a startup network hiccup, where several independent components
+   * see `fetch failed` inside the same second and the very next request
+   * succeeds — exactly the case a single attempt turns into "the user's model
+   * list is missing half its entries for the rest of the session".
+   */
+  private fetchModelsOnce;
   /** Read-only credits query, aggregated by package. Does not consume credits. */
   fetchCredits(credential: WorkBuddyCredential): Promise<WorkBuddyCredits>;
   /** Query today's check-in status without changing account state. */
@@ -1063,241 +1093,283 @@ export declare class WorkBuddyAccountPool {
   };
 }
 //#endregion
-//#region src/catalog.d.ts
-/** One model the provider exposes. */
-interface WorkBuddyModelInfo {
+//#region src/status-paths.d.ts
+/**
+ * Node-free constants and types shared by the Host and browser halves of the
+ * WorkBuddy XD Pool settings card.
+ *
+ * Pool's runtime state already lives in `src/status.ts` (`buildStatus` /
+ * `WorkBuddyStatus`); this module only carves the cross-domain (Host→browser)
+ * JSON document into a shape that stays token-free and matches what the
+ * browser card renders. Route paths are plugin-owned and mounted on the Host's
+ * same-origin web server (see `src/web-status.ts`).
+ *
+ * @module dsh-workbuddy-xdpool/status-paths
+ */
+/** Plugin-owned read-only pool status endpoint (account rows + models + shim). */
+export declare const POOL_STATUS_PATH = "/plugins/dsh-workbuddy-xdpool/status";
+/** Plugin-owned local account rescan endpoint (re-read desktop snapshots). */
+export declare const POOL_RESCAN_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/rescan";
+/** Plugin-owned cooldown reset endpoint (clear all 429 cooldowns). */
+export declare const POOL_RESET_COOLDOWN_PATH = "/plugins/dsh-workbuddy-xdpool/cooldowns/reset";
+/** Plugin-owned daily check-in action endpoint (claim today's reward). */
+export declare const POOL_CHECKIN_PATH = "/plugins/dsh-workbuddy-xdpool/checkin";
+/** Plugin-owned model-selection save endpoint (writes the settings section). */
+export declare const POOL_MODELS_SAVE_PATH = "/plugins/dsh-workbuddy-xdpool/models/save";
+/**
+ * Throw one account out of the pool for good, or take it back.
+ *
+ * Separate from the disable route because the semantics differ: disabling is a
+ * rotation preference the account survives, ignoring survives the account.
+ */
+export declare const POOL_ACCOUNT_IGNORE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/ignored";
+/** Run one automation job immediately, so the card can verify it on demand. */
+export declare const POOL_AUTOMATION_RUN_PATH = "/plugins/dsh-workbuddy-xdpool/automation/run";
+/** Set or clear one account's reserved-credit floor. */
+export declare const POOL_CREDIT_RESERVE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/credit-reserve";
+/** One account's row, token-free. */
+interface PoolWebAccount {
+  id: string;
+  label: string;
+  nickname?: string;
+  domain: string;
+  /** ISO timestamp; absent when the credential carries no expiry. */
+  expiresAt?: string;
+  /** Account-wide cooldown (every model blocked); only after a no-model penalize. */
+  cooling: boolean;
+  /** ISO timestamp when the account-wide 429 cooldown lifts; only while cooling. */
+  cooldownUntil?: string;
+  /**
+   * Per-model cooldowns currently active. The account is NOT `cooling` while a
+   * model is limited — its other models still serve — but each entry tells the
+   * card which model is out until when (e.g. `hy4-preview` cooling to 10:14,
+   * `hy3` normal).
+   */
+  modelCooldowns?: ReadonlyArray<{
+    modelId: string;
+    until: string;
+  }>;
+  /**
+   * Whether the user switched this account off. A disabled account never
+   * serves a request, but it stays listed so the card can switch it back on.
+   */
+  disabled: boolean;
+  rateLimitHits: number;
+  /**
+   * Credits the user asked to keep for this account. The pool stops picking the
+   * account once its balance reaches the reserve, so this many credits survive.
+   * 0 means the account may be spent down as before.
+   */
+  creditReserve: number;
+  /**
+   * Whether the account is held back purely by its reserve right now. Kept
+   * distinct from `cooling`: a reserved account is healthy and simply
+   * protected, which is a different thing to tell the user than rate-limited.
+   */
+  reserved: boolean;
+  /**
+   * What the automation earned for this account today. Absent when it earned
+   * nothing (or the automation never ran for it), so the card can stay quiet
+   * instead of printing a row of zeroes.
+   */
+  automationToday?: PoolWebAutomationEarnings;
+  /** ISO timestamp of the last successful use (best-effort pool bookkeeping). */
+  lastUsedAt?: string;
+  /** Aggregated credit summary for the account, read-only. */
+  credits?: PoolWebCredits;
+  creditsError?: string;
+  /**
+   * Today's check-in state for this account, read-only. Present only when the
+   * per-account check-in probe succeeded and the program is active. The card
+   * renders one claim button per account, so a multi-account pool can collect
+   * every account's daily reward without switching accounts by hand.
+   */
+  checkin?: PoolWebCheckin;
+  checkinError?: string;
+}
+/** One credit package (as surfaced by the pool's upstream client), node-free. */
+interface PoolWebCreditPackage {
+  packageName: string;
+  remain?: number;
+  size?: number;
+  /** CapacityType 4 — refreshed each cycle and never expires. */
+  monthly?: boolean;
+  /** Next cycle refresh point, ms. */
+  cycleRefreshMs?: number;
+  /** One-off expiry, ms. */
+  expiresAtMs?: number;
+}
+/** Aggregated credit answer the card renders under one account. */
+interface PoolWebCredits {
+  total?: number;
+  packages: readonly PoolWebCreditPackage[];
+  /** Credits expiring within 3 days. */
+  expiringSoon?: number;
+  /** When the nearest package expires, ms. */
+  nearestExpiryMs?: number;
+}
+/**
+ * Daily check-in state the card renders under one account's credits. Mirrors
+ * the upstream activity endpoint, minus anything the browser does not need.
+ */
+interface PoolWebCheckin {
+  /** The activity is running; a claim button is offered only while true. */
+  active: boolean;
+  /** Already collected today — the button renders as a done state. */
+  todayCheckedIn: boolean;
+  /** Consecutive days checked in. */
+  streakDays: number;
+  /** Credits a single day grants. */
+  dailyCredit: number;
+  /** Credits collected today (0 before claiming). */
+  todayCredit: number;
+  /** Today is a streak milestone day. */
+  isStreakDay: boolean;
+  /** The day count the next milestone lands on. */
+  nextStreakDay: number;
+  /** Bonus credits granted on a milestone day. */
+  streakBonusCredit: number;
+}
+/** Result of one claim, so the card can confirm what was collected. */
+interface PoolWebCheckinClaim {
+  credit: number;
+  streakDays: number;
+  isStreakDay: boolean;
+}
+/** One model the pool exposes to DSH, with cost / free tags. */
+interface PoolWebModel {
   id: string;
-  /** Display name; the multiplier is appended for the picker. */
   name: string;
-  contextWindow: number;
-  maxOutputTokens: number;
-  /** Relative credit cost, e.g. 0.79 for `x0.79`. */
+  /** Relative credit cost, e.g. 0.79 for x0.79. */
   multiplier?: number;
-  /** Upstream-declared thinking levels. */
-  supportedEfforts?: readonly string[];
-  supportsImages: boolean;
   /** Upstream tags: free / limited-free / night-discount. */
   tags?: readonly string[];
+  /** Effective image support after the user's per-model toggle. */
+  supportsImages: boolean;
+  /** Effective context window after the user's budget cap. */
+  contextWindow: number;
+  /** The window the upstream advertises, before any cap. */
+  nativeContextWindow: number;
+  /** Upstream output ceiling, so the card can show both limits. */
+  maxOutputTokens: number;
+  /** Thinking levels the upstream declares, when it declares any. */
+  supportedEfforts?: readonly string[];
+  /** Whether this model is currently enabled in the picker. */
+  enabled: boolean;
 }
 /**
- * Static fallback used before the first live catalog fetch, and whenever the
- * upstream cannot be reached.
+ * Body of the account ignore/unignore route: exactly one account per request.
  *
- * The multipliers are carried on purpose. Without them the provider's model
- * picker silently loses every rate and every free badge the moment the live
- * fetch fails — which reads to the user as "the plugin broke my model list"
- * rather than "the upstream is unreachable". The values are the ones the two
- * gateways actually advertise for these ids (`credits: "x0.79 credits"` and so
- * on), so a fallback row looks the same as a live one.
+ * `ignored: true` throws the account out of the pool for good (its credential is
+ * not even read on the next scan, and a fresh desktop sign-in will not bring it
+ * back). `false` restores it, at which point the next scan discovers it again.
+ */
+interface PoolWebAccountIgnore {
+  /** Pool account id, as reported in `PoolWebAccount.id`. */
+  accountId: string;
+  /** `true` ignores the account permanently; `false` takes it back. */
+  ignored: boolean;
+}
+/**
+ * One account the user has thrown out of the pool.
  *
- * `multiplier: 0` is the gateways' own spelling of "free" (`credits: "x0.00"`),
- * which is what turns on the free badge.
+ * Kept on the status document so the card can list what was ignored and offer a
+ * way back: without that, "ignored" is a one-way door the user cannot inspect or
+ * undo from the UI, which is how a hidden list becomes a support burden.
  */
-export declare const FALLBACK_WORKBUDDY_MODELS: readonly WorkBuddyModelInfo[];
-/** Live catalog with a static fallback behind it. */
-export declare class WorkBuddyCatalog {
-  private models;
-  private listeners;
-  /** User's model selection. Empty object = follow the catalog unfiltered. */
-  private selection;
-  current(): readonly WorkBuddyModelInfo[];
-  /**
-   * The models DSH should actually offer, after applying the user's selection:
-   * disabled models are dropped, an explicit image list overrides the upstream
-   * capability flag, and a per-model budget caps the advertised window.
-   *
-   * An absent `enabledModelIds` means "everything" — a fresh install with no
-   * saved selection must not present an empty picker.
-   */
-  visible(): readonly WorkBuddyModelInfo[];
-  /** Replace the catalog and notify the adapter to rebuild its model list. */
-  update(models: readonly WorkBuddyModelInfo[]): void;
-  /** Restore the static fallback, e.g. when the upstream stops answering. */
-  reset(): void;
-  /** Replace the user's selection; the adapter rebuilds from `visible()`. */
-  applySelection(selection: ModelSelection): void;
-  /** The selection currently in force, for the card's save round-trip. */
-  currentSelection(): ModelSelection;
-  onChange(listener: () => void): () => void;
-  find(id: string): WorkBuddyModelInfo | undefined;
-  /** Replace the catalog from the live upstream list; keeps the fallback if empty. */
-  updateFromUpstream(models: readonly WorkBuddyUpstreamModel[]): void;
-  private notify;
+interface PoolWebIgnoredAccount {
+  /** Pool account id, the same key `PoolWebAccount.id` uses. */
+  id: string;
+  /** Human label captured at ignore time, so the row reads without a rescan. */
+  label: string;
+  /** ISO timestamp of when it was ignored. */
+  ignoredAt: string;
 }
-/** The user's model selection, as stored in the settings section. */
-interface ModelSelection {
-  /** Absent = every model in the catalog is offered. */
+interface PoolWebModelSelection {
+  /** Absent = every model is enabled. */
   enabledModelIds?: readonly string[];
   /** Absent = each model follows its upstream image capability. */
   imageModelIds?: readonly string[];
   /** Per-model context-window cap, keyed by model id. */
   contextBudgets?: Readonly<Record<string, number | undefined>>;
 }
-//#endregion
-//#region src/shim.d.ts
-interface ShimLogger {
-  info?(...args: unknown[]): void;
-  warn(...args: unknown[]): void;
-  error(...args: unknown[]): void;
-}
-interface WorkBuddyShim {
-  ready: Promise<void>;
-  baseUrl(): string;
-  token(): string;
-  close(): Promise<void>;
-}
-interface WorkBuddyShimOptions {
-  pool: WorkBuddyAccountPool;
-  client: WorkBuddyUpstreamClient;
-  catalog: WorkBuddyCatalog;
-  logger?: ShimLogger;
+/** The JSON document the pool card renders. */
+interface PoolWebStatus {
+  ok: boolean;
+  accounts: readonly PoolWebAccount[];
+  /** The next account the pool would use (rotation cursor). */
+  activeAccountId?: string;
+  cooling: number;
+  models: readonly PoolWebModel[];
+  /** The saved selection the card diffs its draft against. */
+  selection: PoolWebModelSelection;
   /**
-   * Restrict this shim to one gateway. Two shims run side by side — one
-   * per region — and each must only ever draw accounts that belong to its
-   * own gateway. Absent means "every account" (a single-region deployment).
+   * How the pool spreads requests: `priority` drains one account before
+   * moving on, `round-robin` splits the spend evenly.
    */
-  region?: WorkBuddyRegion;
-  /** Max accounts to try per request before giving up. */
-  maxAttempts?: number;
-}
-export declare function createWorkBuddyShim(options: WorkBuddyShimOptions): WorkBuddyShim;
-//#endregion
-//#region src/adapter.d.ts
-/** Provider route this bundle owns. */
-/** Provider route this bundle owns for the domestic (CN) gateway. */
-export declare const WORKBUDDY_POOL_PROVIDER = "workbuddy-xdpool";
-interface WorkBuddyAdapterOptions {
-  shim: WorkBuddyShim;
-  catalog: WorkBuddyCatalog;
-  /** Plugin context; the pi-ai adapter reads `attachments`/`fs` from it. */
-  ctx: Context$1;
-  providerId?: string;
-  displayName?: string;
-}
-/** What {@link createWorkBuddyAdapter} hands back. */
-interface WorkBuddyAdapter {
-  providerId: string;
-  displayName: string;
-  adapter: PiAiAdapter;
-  /** Rebuild the pi-ai model list from the current catalog. */
-  buildModels: () => Model<Api>[];
-  /** Rebuild the adapter's provider snapshot; call after a catalog update. */
-  invalidate: () => void;
-}
-/**
- * Assemble the adapter. `getModels` re-reads the live catalog, and every
- * model's `baseUrl` is re-resolved per read so the shim's ephemeral port
- * applies from the first snapshot after startup. Call only after `shim.ready`.
- */
-export declare function createWorkBuddyAdapter(options: WorkBuddyAdapterOptions): WorkBuddyAdapter;
-//#endregion
-//#region src/scheduler.d.ts
-/** How often the loop wakes to look for a due job. */
-/**
- * How long to wait for event scoring to land before re-reading the task list.
- *
- * Scoring is asynchronous on the upstream side, so an immediate re-read still
- * shows the old progress and the claim pass would skip a task that is in fact
- * now claimable. Measured: the chain is reflected by about eight seconds.
- */
-export declare const EVENT_SCORE_WAIT_MS = 9000;
-export declare const AUTOMATION_TICK_MS = 60000;
-/** Which jobs the automation runs, and when. */
-/**
- * The persisted daily earnings ledger.
- *
- * `date` is the local day the counters belong to: a ledger from a previous day
- * is discarded on load rather than carried forward as "today".
- */
-interface AutomationLedger {
-  date: string;
-  accounts: Record<string, AutomationAccountEarnings>;
-}
-interface AutomationOptions {
-  /** Master switch; false stops every job. */
-  enabled?: boolean;
-  /** Hour list for the daily check-in job. */
-  checkinHours?: readonly number[];
-  /** Hour list for the task-centre job (accept + claim). */
-  taskHours?: readonly number[];
-  /** Hour list for the activity-report job. */
-  reportHours?: readonly number[];
-  /** Hour list for the streak-redemption job. */
-  streakHours?: readonly number[];
-  /** Hour list for the buddy travel job. */
-  travelHours?: readonly number[];
-  /** Per-account serial delay, in milliseconds. */
-  accountDelayMs?: number;
-  /** Override the gap between expert chains, in milliseconds (tests use 0). */
-  expertGapMs?: number;
-  /** Override the event-scoring wait, in milliseconds (tests use 0). */
-  eventScoreWaitMs?: number;
-  /** Override the clock, for tests. */
-  now?: () => Date;
-  /** Logger; defaults to a no-op so tests stay quiet. */
-  logger?: SchedulerLogger;
+  distribution: PoolDistribution;
+  /** Which region this document describes. */
+  region: PoolRegion;
+  /** Every region holding at least one account, in display order. */
+  regions: readonly PoolRegion[];
+  shim: {
+    running: boolean;
+    baseUrl?: string;
+  };
+  /** Daily-points automation state, so the card can show what ran and when. */
+  automation: PoolWebAutomation;
+  /** Per-account credit floors currently in force, keyed by account id. */
+  creditReserves: Readonly<Record<string, number>>;
   /**
-   * Persist the daily earnings ledger, and restore it on construction.
+   * Accounts thrown out of the pool, in the order they were ignored.
    *
-   * The ledger cannot live only in memory: a host restart mid-day would wipe
-   * what the automation already earned, and the card would show nothing for
-   * rewards that really were collected.
+   * Reported so the card can show the list and offer a way back. These accounts
+   * are NOT in `accounts`: they are filtered out before their credentials are
+   * read, which is the whole point of the feature.
    */
-  loadEarnings?: () => AutomationLedger | undefined;
-  saveEarnings?: (ledger: AutomationLedger) => void;
-}
-/** Logger surface, kept structural so any host logger fits. */
-interface SchedulerLogger {
-  info?(...args: unknown[]): void;
-  warn?(...args: unknown[]): void;
-}
-/** One job's last-run record, surfaced on the status document. */
-interface AutomationJobState {
-  /** `YYYY-MM-DD` of the last completed run, or undefined if it never ran. */
-  lastRunDate?: string;
+  ignored: readonly PoolWebIgnoredAccount[];
   /**
-   * The scheduled SLOT of the last run, as `YYYY-MM-DDTHH`.
+   * Where THIS region's model list came from.
    *
-   * The tick de-duplicates on this rather than on the date: keying on the date
-   * alone caps every job at one run a day, which is wrong for a job with two
-   * time points — blocking the cat loop's second pass would leave the cat out
-   * until tomorrow. Per slot a job runs once in each configured hour, while a
-   * repeat tick inside the same hour is still refused.
+   * `live` = fetched from the gateway (or a cached fetch survived a restart).
+   * `fallback` = the built-in static table, which means the startup fetch
+   * failed and the user is looking at a SHORTER, possibly stale roster — models
+   * they had enabled can be missing from it entirely.
+   *
+   * Surfaced because the failure used to be log-only: the picker quietly lost
+   * half its entries and nothing on screen said why, so it read as "the plugin
+   * deleted my models".
    */
-  lastRunSlot?: string;
+  catalogSource?: PoolWebCatalogSource;
+  /** When the live catalog was last successfully fetched, ISO. */
+  catalogUpdatedAt?: string;
+  /** Why the last fetch failed, when it did. Redacted and length-capped. */
+  catalogError?: string;
+}
+/** How a region's model list was obtained. */
+type PoolWebCatalogSource = 'live' | 'fallback';
+/** One automation job's last run, as shown on the card. */
+interface PoolWebAutomationJob {
+  /** `YYYY-MM-DD` of the last run in this process, if it has run. */
+  lastRunDate?: string;
   /**
-   * Every configured slot consumed TODAY, as `YYYY-MM-DDTHH`.
-   *
-   * This is what actually gates a re-run, and it is a SET rather than a single
-   * slot because one field could not express the contract: a job configured for
-   * `[9, 21]` runs twice, and a single "last slot" value can only remember one
-   * of them — the second run erased the first, so the 9 o'clock candidate looked
-   * unconsumed again and the job re-fired every hour after 21:00.
-   *
-   * The values are the CONFIGURED hours that were spent, never the clock time
-   * the run happened to finish at. Storing the finish time was the original
-   * defect: the reader compared it against a configured candidate, so the two
-   * almost never matched and the gate stayed open all day.
+   * Epoch ms of the last run, so the card can show the TIME.
    *
-   * In-memory like the rest of `states`: this is a per-process record, and the
-   * catch-up design deliberately re-runs an hour that passed while DSH was
-   * closed. See `automationEarnings` for the ledger that DOES persist.
+   * Carried because a date-only stamp cannot tell one run from eight: every
+   * repeat inside the same day rendered as the identical `2026-09-28 · 2`,
+   * which is what kept a "re-runs every hour" defect invisible on the card.
    */
-  firedSlots?: readonly string[];
+  lastRunAtMs?: number;
   /**
-   * The clock slot the last run STARTED in (`YYYY-MM-DDTHH`).
+   * Configured slots consumed today, as `YYYY-MM-DDTHH`.
    *
-   * Separate from {@link firedSlots} on purpose: this is a throttle ("do not
-   * start twice inside the same hour"), while `firedSlots` is the schedule
-   * ledger. Conflating the two is what let a catch-up run at 13:00 erase the
-   * record of the 9 o'clock slot.
+   * Shown so "which of today's hours already ran" is answerable at a glance
+   * rather than inferred from a counter.
    */
-  lastFiredHour?: string;
-  /** Epoch ms of the last completed run. */
-  lastRunAtMs?: number;
-  /** Accounts that completed without throwing. */
+  firedSlots?: readonly string[];
+  /** Accounts that finished without error on the last run. */
   ok: number;
-  /** Accounts that threw (each one skipped, the run continued). */
+  /** Accounts that failed on the last run (each one skipped, the run continued). */
   failed: number;
   /** Credits claimed by the task job on the last run. */
   credit: number;
@@ -1305,843 +1377,865 @@ interface AutomationJobState {
   energy: number;
   /** Tasks claimed by the task job on the last run. */
   claimed: number;
-  /** Human-readable summary of the last run. */
+  /** One-line summary of the last run. */
+  message?: string;
   /**
-   * What this run actually did, in the words of the task board.
+   * What the last run actually did, in the words of the task board.
    *
-   * `message` is a count ("3 accounts, 5 tasks claimed"); this is the list a
-   * person can check off — the reward titles the pass collected. A row showing
-   * only a bare number cannot answer "did it do the thing I care about", which
-   * is the question the panel exists to answer.
+   * `message` is a count; this is the list a person can check off, which is
+   * what turns a row from "it ran" into "it did the things I care about".
    */
   detail?: readonly string[];
-  /**
-   * A pending milestone worth naming, when there is one.
-   *
-   * Streak tiers are why this exists: every tier reads `locked` until enough
-   * consecutive days accumulate, and "locked" on its own reads as "broken"
-   * rather than "come back in four days".
-   */
+  /** A pending milestone worth naming, e.g. the next streak tier countdown. */
   progress?: string;
-  message?: string;
 }
 /**
- * What the automation earned for ONE account today.
+ * Automation block on the status document.
  *
- * Reset at the local day boundary alongside the per-job "already ran today"
- * guard, so the card shows today rather than a running total that never
- * answers "did it do anything for this account recently".
+ * Carries the schedule and each job's last outcome so the card can answer
+ * "is it on, when does it run, and what did it last do" without reaching into
+ * the scheduler itself.
  */
-interface AutomationAccountEarnings {
-  /** Credits the automation claimed from the task centre today. */
+interface PoolWebAutomation {
+  /** Master switch, mirrored from the saved config. */
+  enabled: boolean;
+  /** Whether the loop is currently running. */
+  running: boolean;
+  /** Configured hours per job, so the card can show the schedule. */
+  checkinHours: readonly number[];
+  reportHours: readonly number[];
+  taskHours: readonly number[];
+  streakHours: readonly number[];
+  travelHours: readonly number[];
+  jobs: {
+    checkin: PoolWebAutomationJob;
+    report: PoolWebAutomationJob;
+    tasks: PoolWebAutomationJob;
+    streak: PoolWebAutomationJob;
+    travel: PoolWebAutomationJob;
+  };
+  /** Claimable tasks seen on the most recent task pass, across accounts. */
+  claimableSeen: number;
+  /**
+   * Whether a manual run is in flight. The card polls this to know when to
+   * stop showing progress and report the result.
+   */
+  runInProgress: boolean;
+  /**
+   * Per-account credits/energy/tasks the automation earned TODAY, keyed by
+   * account id. An account that earned nothing is simply absent, so the card
+   * can say "nothing yet" instead of showing a bare zero.
+   */
+  earningsToday: Readonly<Record<string, PoolWebAutomationEarnings>>;
+}
+/** Today's automation take for one account. */
+interface PoolWebAutomationEarnings {
+  /** Credits claimed from the task centre today. */
   credit: number;
   /** Energy claimed from the task centre today. */
   energy: number;
   /** Tasks claimed today. */
   claimed: number;
-  /**
-   * Credits the automation collected from check-in today.
-   *
-   * Kept separate from `credit` because they are different achievements and the
-   * card shows them on their own lines: "the automation claimed 3 tasks" and
-   * "the automation checked in" are not the same claim to the user.
-   */
+  /** Credits collected from check-in today. */
   checkinCredit: number;
-  /** Credits from streak redemption + lottery today. */
+  /** Credits from streak redemption and the lottery today. */
   bonusCredit: number;
-  /** Credits from the buddy adoption / travel loop today. */
+  /** Credits from buddy adoption and the travel loop today. */
   travelCredit: number;
-  /** Local date the counters belong to. */
+  /** Local date the counters belong to (YYYY-MM-DD). */
   date: string;
 }
-/** What ONE account gained during a single run. */
-interface AutomationAccountGain {
-  credit: number;
-  energy: number;
-  claimed: number;
-  checkinCredit: number;
-  bonusCredit: number;
-  travelCredit: number;
-}
-/** Totals from running the whole ordered pass at once. */
-interface AutomationRunSummary {
-  /** How many jobs actually ran (a job with no hour is skipped). */
-  jobsRun: number;
-  /** Accounts that finished without error, summed across jobs. */
-  okCount: number;
-  /** Accounts that failed, summed across jobs. */
-  failed: number;
-  credit: number;
-  energy: number;
-  claimed: number;
-  /**
-   * What each account gained during THIS run, keyed by account id. Only
-   * accounts that gained something appear.
-   */
-  accounts: Readonly<Record<string, AutomationAccountGain>>;
-}
-/** Automation snapshot for the status document and the card. */
-interface AutomationStatus {
-  enabled: boolean;
-  /** Whether the loop is running. */
-  running: boolean;
-  checkinHours: readonly number[];
-  taskHours: readonly number[];
-  reportHours: readonly number[];
-  streakHours: readonly number[];
-  travelHours: readonly number[];
-  jobs: {
-    checkin: AutomationJobState;
-    report: AutomationJobState;
-    tasks: AutomationJobState;
-    streak: AutomationJobState;
-    travel: AutomationJobState;
-  };
-  /** Claimable tasks seen on the most recent task pass, across accounts. */
-  claimableSeen: number;
-  /**
-   * Per-account totals for today, keyed by account id. Only accounts that
-   * actually earned something appear, so the card can render "no earnings"
-   * as an absence rather than a zero it has to explain.
-   */
-  earningsToday: Readonly<Record<string, AutomationAccountEarnings>>;
-  /**
-   * Whether a manual run is in flight right now.
-   *
-   * A run takes tens of seconds (one upstream call per account per job, plus
-   * the scoring wait), which is far too long for the card to hold a request
-   * open. The button starts a run and the panel polls this flag instead.
-   */
-  runInProgress: boolean;
-}
-/** The three plus one job kinds, in a stable order. */
-type AutomationJobKind = 'checkin' | 'tasks' | 'report' | 'streak' | 'travel';
-/** The four jobs in the order a tick runs them: report before tasks, always. */
-export declare const AUTOMATION_JOB_KINDS: readonly AutomationJobKind[];
-/** Reject anything that is not a job kind, so a route cannot name an unknown job. */
-export declare function isAutomationJobKind(value: unknown): value is AutomationJobKind;
-export declare function dayKey(date: Date, timeZone?: string): string;
 /**
- * Whether `now`'s local hour is one of `hours`.
+ * The two gateways, matching the provider ids the host registers. `cn` is the
+ * domestic gateway (`copilot.tencent.com` / `codebuddy.cn`); `global` is the
+ * international one (`workbuddy.ai`).
+ */
+type PoolRegion = 'cn' | 'global';
+/** How the pool spreads requests across its accounts. */
+type PoolDistribution = 'priority' | 'round-robin' | 'balanced';
+/**
+ * The schedule every automation job falls back to.
  *
- * The reference panel computes a `nextFire` instant and sleeps until it; this
- * loop instead wakes every minute and asks "is any job due now". Both fire at
- * the top of a configured hour, but the polling form cannot miss a slot to a
- * suspended process — a laptop that slept through 10:00 still runs the job the
- * moment it wakes, on the same day.
+ * Shared by both halves on purpose. The host uses it when a configured hour
+ * list arrives empty (the settings schema materializes "never configured" into
+ * `[]`), and the card uses it when it writes the `automation` block back, so a
+ * document that already holds an empty list is healed instead of being saved
+ * back as an unrunnable schedule.
+ *
+ * This lives here rather than in `scheduler.ts` because the browser half cannot
+ * import the host module: `scheduler.ts` pulls in `node:crypto` and the whole
+ * upstream client, none of which exists in the browser bundle. Two hand-written
+ * copies would drift, and the drift is invisible — the card would write a
+ * schedule the scheduler does not run.
  */
-export declare function isFireHour(now: Date, hours: readonly number[]): boolean;
+export declare const DEFAULT_AUTOMATION_HOURS: {
+  readonly checkin: readonly [9];
+  readonly report: readonly [10];
+  readonly tasks: readonly [11];
+  readonly streak: readonly [12];
+  readonly travel: readonly [9, 21];
+};
+//#endregion
+//#region src/catalog.d.ts
+/** One model the provider exposes. */
+interface WorkBuddyModelInfo {
+  id: string;
+  /** Display name; the multiplier is appended for the picker. */
+  name: string;
+  contextWindow: number;
+  maxOutputTokens: number;
+  /** Relative credit cost, e.g. 0.79 for `x0.79`. */
+  multiplier?: number;
+  /** Upstream-declared thinking levels. */
+  supportedEfforts?: readonly string[];
+  supportsImages: boolean;
+  /** Upstream tags: free / limited-free / night-discount. */
+  tags?: readonly string[];
+}
 /**
- * The points automation.
+ * Static fallback used before the first live catalog fetch, and whenever the
+ * upstream cannot be reached.
  *
- * Owns a single timer loop. Construction is inert — nothing runs until
- * {@link start}, and {@link stop} is idempotent so a plugin teardown that fires
- * twice is harmless.
+ * This table is the DOMESTIC (CN) roster, and it is kept in step with what
+ * `copilot.tencent.com` actually advertises. It matters more than a "just in
+ * case" list usually would: a failed startup fetch falls back to it, and the
+ * user sees that as "half my models were deleted" — `deepseek-v4.1-flash`
+ * and friends simply vanishing from the picker, with no visible explanation.
+ *
+ * Every row below was captured from the live endpoint, INCLUDING the window
+ * sizes: the previous version carried a 32K window for `hy3` when the gateway
+ * says 192K, and listed `kimi-k3` under an id the gateway no longer uses
+ * (`kimi-k3-1`). A stale fallback is worse than a short one — it looks
+ * authoritative while being wrong.
+ *
+ * `multiplier: 0` is the gateways' own spelling of "free" (`credits: "x0.00"`),
+ * which is what turns on the free badge.
  */
-export declare class WorkBuddyScheduler {
-  private readonly pool;
-  private readonly client;
-  private readonly logger;
-  private readonly now;
-  private readonly delayMs;
-  /**
-   * How long to wait for event scoring before re-reading the task list.
-   * Tests set 0 so a pass does not spend nine real seconds per account.
-   */
-  private readonly eventScoreWaitMs;
-  /**
-   * Gap between two expert summon chains.
-   * Tests set 0 so a pass does not spend six real seconds per expert.
-   */
-  private readonly expertGapMs;
-  private enabled;
-  private checkinHours;
-  private taskHours;
-  private reportHours;
-  private streakHours;
-  private travelHours;
-  private timer;
-  private running;
-  /** Guards against a slow run overlapping the next tick. */
-  private busy;
-  /** True while a manual run is in flight, so the card can poll it. */
-  private runInFlight;
-  /**
-   * Set once {@link stop} is called.
-   *
-   * Deliberately false before `start`: the loop is not running yet, but a
-   * manual `tick` must still work. `stop` is what makes a run abandon the
-   * accounts it has not reached yet.
-   */
-  private stopped;
-  private readonly states;
-  private claimableSeen;
-  /**
-   * Credits/energy/tasks earned per account TODAY, keyed by account id.
-   *
-   * Cleared whenever the day key rolls over, so the card always answers
-   * "what did the automation get for THIS account today".
-   */
-  private earnings;
-  /** Day key the counters above belong to. */
-  private earningsDate;
-  /** Host hooks that persist the ledger across restarts. */
-  private readonly loadEarnings;
-  private saveEarningsFn;
-  constructor(pool: WorkBuddyAccountPool, client: WorkBuddyUpstreamClient, options?: AutomationOptions);
-  /** Apply a new configuration; safe to call while running. */
+export declare const FALLBACK_WORKBUDDY_MODELS: readonly WorkBuddyModelInfo[];
+/** Live catalog with a static fallback behind it. */
+export declare class WorkBuddyCatalog {
+  private models;
+  private listeners;
+  /** User's model selection. Empty object = follow the catalog unfiltered. */
+  private selection;
   /**
-   * Install the persistence hook once the host settings service is available.
+   * Whether `models` came from the gateway or from the static table.
    *
-   * Separate from the constructor because the scheduler is built with the pool,
-   * long before the settings section exists; a ledger written before that point
-   * would have nowhere to go.
+   * Tracked so the card can SAY which it is showing. A failed fetch used to be
+   * invisible on screen: the picker simply held fewer models than before, which
+   * the user reasonably read as "the plugin deleted my models" rather than "the
+   * network hiccuped at startup".
    */
-  setEarningsPersistence(save: (ledger: AutomationLedger) => void | Promise<void>): void;
+  private source;
+  /** When the live list last landed. */
+  private lastUpdatedAt;
+  /** Why the last fetch failed, for display. */
+  private lastError;
+  current(): readonly WorkBuddyModelInfo[];
   /**
-   * Fold a previously persisted ledger back in, when it belongs to today.
+   * The models DSH should actually offer, after applying the user's selection:
+   * disabled models are dropped, an explicit image list overrides the upstream
+   * capability flag, and a per-model budget caps the advertised window.
    *
-   * Used after the settings document becomes readable, which happens after
-   * construction; a ledger from an earlier day is ignored so the counters never
-   * claim yesterday as today.
+   * An absent `enabledModelIds` means "everything" — a fresh install with no
+   * saved selection must not present an empty picker.
    */
-  applyEarningsLedger(ledger: AutomationLedger): void;
-  applyConfig(options: AutomationOptions): void;
-  /** Hours for one job, used by the loop and the status document. */
-  private hoursOf;
-  /** Start the loop. Idempotent. */
-  start(): void;
-  /** Stop the loop. Idempotent, and safe before `start`. */
-  stop(): void;
-  /** Snapshot for the status document. */
+  visible(): readonly WorkBuddyModelInfo[];
+  /** Replace the catalog and notify the adapter to rebuild its model list. */
+  update(models: readonly WorkBuddyModelInfo[]): void;
+  /** Restore the static fallback, e.g. when the upstream stops answering. */
+  reset(): void;
+  /** Replace the user's selection; the adapter rebuilds from `visible()`. */
+  applySelection(selection: ModelSelection): void;
+  /** The selection currently in force, for the card's save round-trip. */
+  currentSelection(): ModelSelection;
   /**
-   * Run one job immediately, regardless of the clock.
-   *
-   * Exists so the automation can be verified from the card without waiting for
-   * its hour. A manual run is recorded exactly like a scheduled one, so the
-   * timer will not repeat it later the same day: every job is idempotent, but a
-   * second pass would still be wasted upstream calls.
+   * Whether this catalog is serving live data or the built-in table.
    *
-   * `force` ignores the already-ran-today guard, which is what pressing the
-   * button a second time means.
+   * `fallback` is not an error state, but it IS a degraded one: the user is
+   * looking at a shorter roster than the gateway offers, so the card says so
+   * and offers a retry instead of letting them wonder where the models went.
    */
-  runNow(kind: AutomationJobKind, force?: boolean): Promise<AutomationJobState>;
+  currentSource(): PoolWebCatalogSource;
   /**
-   * Run every job once, in the scheduled order.
+   * When the live list last landed, if it ever did.
    *
-   * Order matters and is not configurable: the activity report has to land
-   * before the task pass reads task progress, or the pass sees counters the
-   * report would have moved. This is what the card's single button calls.
+   * Named `catalogUpdatedAt()` rather than `updatedAt()` because the class
+   * already had an `updatedAt` member; two members of the same name is a
+   * compile error, and the awkwardness is a useful signal that the concept is
+   * "when THIS catalog was refreshed", not a generic timestamp.
    */
+  catalogUpdatedAt(): string | undefined;
+  /** Why the last fetch failed, if it did. */
+  lastFetchError(): string | undefined;
+  onChange(listener: () => void): () => void;
+  find(id: string): WorkBuddyModelInfo | undefined;
+  /** Replace the catalog from the live upstream list; keeps the fallback if empty. */
+  updateFromUpstream(models: readonly WorkBuddyUpstreamModel[]): void;
   /**
-   * Start a full pass in the background and return immediately.
-   *
-   * A pass takes tens of seconds - one upstream round trip per account per job,
-   * plus the scoring wait - which is far too long to hold the card request open:
-   * the browser or the host web server would time out, and the user would see
-   * a hung button for a run that is actually working.
+   * Record that a fetch attempt failed, leaving the current list in place.
    *
-   * Returns whether a run started. A second call while one is in flight is
-   * ignored rather than queued: pressing the button twice means hurry up, and
-   * the run already under way covers it.
-   */
-  startRunAll(): boolean;
-  runAll(): Promise<AutomationRunSummary>;
-  status(): AutomationStatus;
-  /**
-   * One poll: run every due job, serially.
-   *
-   * Serial by design — the jobs share the same accounts and the upstream
-   * rate-limits per account, so overlapping passes would only trip that limit.
-   * A job that throws is recorded and the loop continues.
+   * The list is deliberately NOT reset here: a refresh that fails should keep
+   * whatever working catalog is already loaded, rather than demoting a healthy
+   * session to the static table because one retry ran out.
    */
+  noteFetchFailure(message: string): void;
+  private notify;
+}
+/** The user's model selection, as stored in the settings section. */
+interface ModelSelection {
+  /** Absent = every model in the catalog is offered. */
+  enabledModelIds?: readonly string[];
+  /** Absent = each model follows its upstream image capability. */
+  imageModelIds?: readonly string[];
+  /** Per-model context-window cap, keyed by model id. */
+  contextBudgets?: Readonly<Record<string, number | undefined>>;
+}
+//#endregion
+//#region src/shim.d.ts
+interface ShimLogger {
+  info?(...args: unknown[]): void;
+  warn(...args: unknown[]): void;
+  error(...args: unknown[]): void;
+}
+interface WorkBuddyShim {
+  ready: Promise<void>;
+  baseUrl(): string;
+  token(): string;
+  close(): Promise<void>;
+}
+interface WorkBuddyShimOptions {
+  pool: WorkBuddyAccountPool;
+  client: WorkBuddyUpstreamClient;
+  catalog: WorkBuddyCatalog;
+  logger?: ShimLogger;
   /**
-   * Whether `kind` is due at `now`: its earliest configured hour has passed in
-   * the scheduling timezone, and no hour of today has been consumed yet.
-   *
-   * Hours are consumed per SLOT (one entry per configured hour), so a job with
-   * two hours still runs twice a day — but a job whose hour passed while DSH was
-   * closed runs immediately on the next tick instead of waiting for tomorrow.
+   * Restrict this shim to one gateway. Two shims run side by side — one
+   * per region — and each must only ever draw accounts that belong to its
+   * own gateway. Absent means "every account" (a single-region deployment).
    */
+  region?: WorkBuddyRegion;
+  /** Max accounts to try per request before giving up. */
+  maxAttempts?: number;
+}
+export declare function createWorkBuddyShim(options: WorkBuddyShimOptions): WorkBuddyShim;
+//#endregion
+//#region src/adapter.d.ts
+/** Provider route this bundle owns. */
+/** Provider route this bundle owns for the domestic (CN) gateway. */
+export declare const WORKBUDDY_POOL_PROVIDER = "workbuddy-xdpool";
+interface WorkBuddyAdapterOptions {
+  shim: WorkBuddyShim;
+  catalog: WorkBuddyCatalog;
+  /** Plugin context; the pi-ai adapter reads `attachments`/`fs` from it. */
+  ctx: Context$1;
+  providerId?: string;
+  displayName?: string;
+}
+/** What {@link createWorkBuddyAdapter} hands back. */
+interface WorkBuddyAdapter {
+  providerId: string;
+  displayName: string;
+  adapter: PiAiAdapter;
+  /** Rebuild the pi-ai model list from the current catalog. */
+  buildModels: () => Model<Api>[];
+  /** Rebuild the adapter's provider snapshot; call after a catalog update. */
+  invalidate: () => void;
+}
+/**
+ * Assemble the adapter. `getModels` re-reads the live catalog, and every
+ * model's `baseUrl` is re-resolved per read so the shim's ephemeral port
+ * applies from the first snapshot after startup. Call only after `shim.ready`.
+ */
+export declare function createWorkBuddyAdapter(options: WorkBuddyAdapterOptions): WorkBuddyAdapter;
+//#endregion
+//#region src/scheduler.d.ts
+/** How often the loop wakes to look for a due job. */
+/**
+ * How long to wait for event scoring to land before re-reading the task list.
+ *
+ * Scoring is asynchronous on the upstream side, so an immediate re-read still
+ * shows the old progress and the claim pass would skip a task that is in fact
+ * now claimable. Measured: the chain is reflected by about eight seconds.
+ */
+export declare const EVENT_SCORE_WAIT_MS = 9000;
+export declare const AUTOMATION_TICK_MS = 60000;
+/** Which jobs the automation runs, and when. */
+/**
+ * The persisted daily earnings ledger.
+ *
+ * `date` is the local day the counters belong to: a ledger from a previous day
+ * is discarded on load rather than carried forward as "today".
+ */
+interface AutomationLedger {
+  date: string;
+  accounts: Record<string, AutomationAccountEarnings>;
+}
+interface AutomationOptions {
+  /** Master switch; false stops every job. */
+  enabled?: boolean;
+  /** Hour list for the daily check-in job. */
+  checkinHours?: readonly number[];
+  /** Hour list for the task-centre job (accept + claim). */
+  taskHours?: readonly number[];
+  /** Hour list for the activity-report job. */
+  reportHours?: readonly number[];
+  /** Hour list for the streak-redemption job. */
+  streakHours?: readonly number[];
+  /** Hour list for the buddy travel job. */
+  travelHours?: readonly number[];
+  /** Per-account serial delay, in milliseconds. */
+  accountDelayMs?: number;
+  /** Override the gap between expert chains, in milliseconds (tests use 0). */
+  expertGapMs?: number;
+  /** Override the event-scoring wait, in milliseconds (tests use 0). */
+  eventScoreWaitMs?: number;
+  /** Override the clock, for tests. */
+  now?: () => Date;
+  /** Logger; defaults to a no-op so tests stay quiet. */
+  logger?: SchedulerLogger;
   /**
-   * The configured slot `kind` should consume at `now`, or undefined when none.
-   *
-   * Returns the SLOT STRING (not a boolean) because the caller must record the
-   * same value it acted on. Returning a boolean was the original bug's enabler:
-   * the tick asked "is it due", then `runJob` independently wrote "what time is
-   * it now" — and those two answers were almost never equal.
-   *
-   * CATCH-UP semantics are deliberate: a candidate fires once its hour has
-   * PASSED and its slot is still unconsumed, so a laptop that slept through
-   * 10:00 still runs the job when it wakes, on the same day.
+   * Persist the daily earnings ledger, and restore it on construction.
    *
-   * The EARLIEST unconsumed candidate wins, which is what keeps a two-hour job
-   * (`travelHours: [9, 21]`) whole: consuming the earliest due slot leaves the
-   * later one for its own hour.
-   */
-  private dueSlot;
-  /** Today's consumed slots for one job, as a set. */
-  private firedSlotsOf;
-  /** Record one consumed slot on a job's state. */
-  private consumeSlot;
-  private tick;
-  /** Run one job against every eligible account and record the outcome. */
-  /**
-   * Add one account's take to today's counters, resetting first if the day
-   * rolled over. Called from the task pass, which is the only job that earns.
+   * The ledger cannot live only in memory: a host restart mid-day would wipe
+   * what the automation already earned, and the card would show nothing for
+   * rewards that really were collected.
    */
+  loadEarnings?: () => AutomationLedger | undefined;
+  saveEarnings?: (ledger: AutomationLedger) => void;
+}
+/** Logger surface, kept structural so any host logger fits. */
+interface SchedulerLogger {
+  info?(...args: unknown[]): void;
+  warn?(...args: unknown[]): void;
+}
+/** One job's last-run record, surfaced on the status document. */
+interface AutomationJobState {
+  /** `YYYY-MM-DD` of the last completed run, or undefined if it never ran. */
+  lastRunDate?: string;
   /**
-   * Today's per-account earnings, as a plain object for the status document.
+   * The scheduled SLOT of the last run, as `YYYY-MM-DDTHH`.
    *
-   * Rolls the day first so a status read just after midnight does not report
-   * yesterday's totals under today's date.
-   */
-  private earningsSnapshot;
-  /**
-   * Add one account take to today counters, resetting first if the day rolled
-   * over. Every source is tracked separately so the card can show what earned
-   * what, rather than one opaque total.
+   * The tick de-duplicates on this rather than on the date: keying on the date
+   * alone caps every job at one run a day, which is wrong for a job with two
+   * time points — blocking the cat loop's second pass would leave the cat out
+   * until tomorrow. Per slot a job runs once in each configured hour, while a
+   * repeat tick inside the same hour is still refused.
    */
-  private recordEarnings;
-  /** Clear the per-account counters when the local day changes. */
-  private rollEarnings;
+  lastRunSlot?: string;
   /**
-   * Write the ledger through the host hook, when one was supplied.
+   * Every configured slot consumed TODAY, as `YYYY-MM-DDTHH`.
    *
-   * Best effort on purpose: a failed save must never abort a run that has
-   * already collected rewards, and the in-memory ledger keeps serving the card
-   * for the rest of the session either way.
-   */
-  private persistEarnings;
-  /**
-   * Run one job against every eligible account and record the outcome.
+   * This is what actually gates a re-run, and it is a SET rather than a single
+   * slot because one field could not express the contract: a job configured for
+   * `[9, 21]` runs twice, and a single "last slot" value can only remember one
+   * of them — the second run erased the first, so the 9 o'clock candidate looked
+   * unconsumed again and the job re-fired every hour after 21:00.
    *
-   * `consumedSlot` is the configured slot this run spends (`dueSlot`'s answer).
-   * It is passed IN rather than recomputed here so the value recorded is exactly
-   * the value the schedule decided on — the defect this replaces wrote
-   * `slotKey(now)` instead, i.e. the clock time the run finished at, which
-   * almost never equals the configured candidate the gate had compared against.
+   * The values are the CONFIGURED hours that were spent, never the clock time
+   * the run happened to finish at. Storing the finish time was the original
+   * defect: the reader compared it against a configured candidate, so the two
+   * almost never matched and the gate stayed open all day.
    *
-   * The task job runs in TWO passes. The first sends the event chains that light
-   * up client-scored tasks; the second collects rewards. They are separate
-   * because scoring lands asynchronously — a chain sent and claimed within the
-   * same breath finds the task still un-scored — and because sending is fast
-   * while claiming wants the whole pool to have been lit up first. Splitting
-   * them costs one shared wait instead of one wait per account.
+   * In-memory like the rest of `states`: this is a per-process record, and the
+   * catch-up design deliberately re-runs an hour that passed while DSH was
+   * closed. See `automationEarnings` for the ledger that DOES persist.
    */
-  private runJob;
-  /** Compose the one-line summary shown on the card. */
-  private summarise;
+  firedSlots?: readonly string[];
   /**
-   * Accounts to run against, in pool order.
+   * The clock slot the last run STARTED in (`YYYY-MM-DDTHH`).
    *
-   * Disabled accounts are excluded here rather than filtered by the caller so a
-   * card switch takes effect on the next pass without any event plumbing.
+   * Separate from {@link firedSlots} on purpose: this is a throttle ("do not
+   * start twice inside the same hour"), while `firedSlots` is the schedule
+   * ledger. Conflating the two is what let a catch-up run at 13:00 erase the
+   * record of the 9 o'clock slot.
    */
-  private accountsInOrder;
+  lastFiredHour?: string;
+  /** Epoch ms of the last completed run. */
+  lastRunAtMs?: number;
+  /** Accounts that completed without throwing. */
+  ok: number;
+  /** Accounts that threw (each one skipped, the run continued). */
+  failed: number;
+  /** Credits claimed by the task job on the last run. */
+  credit: number;
+  /** Energy claimed by the task job on the last run. */
+  energy: number;
+  /** Tasks claimed by the task job on the last run. */
+  claimed: number;
+  /** Human-readable summary of the last run. */
   /**
-   * Send one activity report, then verify it landed.
+   * What this run actually did, in the words of the task board.
    *
-   * The upstream answers 200 even when it drops the event, so the streak is
-   * read back as the oracle: `days > 0` means it counted. A failed read-back is
-   * logged and treated as a suspicious result, never as a retry — the report is
-   * idempotent per day, and hammering it is exactly what the one-a-day quota
-   * exists to avoid.
+   * `message` is a count ("3 accounts, 5 tasks claimed"); this is the list a
+   * person can check off — the reward titles the pass collected. A row showing
+   * only a bare number cannot answer "did it do the thing I care about", which
+   * is the question the panel exists to answer.
    */
-  private reportOne;
-  private sendEventChains;
+  detail?: readonly string[];
   /**
-   * Send one chain on the channel it was built for.
+   * A pending milestone worth naming, when there is one.
    *
-   * The transport is not a detail of the sender: the scorer keys different
-   * tasks to different fingerprint families, so a web-scored event posted as a
-   * desktop event is accepted and then ignored.
+   * Streak tiers are why this exists: every tier reads `locked` until enough
+   * consecutive days accumulate, and "locked" on its own reads as "broken"
+   * rather than "come back in four days".
    */
-  private sendChain;
+  progress?: string;
+  message?: string;
+}
+/**
+ * What the automation earned for ONE account today.
+ *
+ * Reset at the local day boundary alongside the per-job "already ran today"
+ * guard, so the card shows today rather than a running total that never
+ * answers "did it do anything for this account recently".
+ */
+interface AutomationAccountEarnings {
+  /** Credits the automation claimed from the task centre today. */
+  credit: number;
+  /** Energy claimed from the task centre today. */
+  energy: number;
+  /** Tasks claimed today. */
+  claimed: number;
   /**
-   * Build every chain that scores one task.
+   * Credits the automation collected from check-in today.
    *
-   * Most tasks need a single chain; `template_5` needs five, because the scorer
-   * counts distinct `template_used` events rather than a boolean. The two tasks
-   * that join a conversation (skill, expert) open a real one first, which is why
-   * this is async.
+   * Kept separate from `credit` because they are different achievements and the
+   * card shows them on their own lines: "the automation claimed 3 tasks" and
+   * "the automation checked in" are not the same claim to the user.
    */
-  private chainsFor;
+  checkinCredit: number;
+  /** Credits from streak redemption + lottery today. */
+  bonusCredit: number;
+  /** Credits from the buddy adoption / travel loop today. */
+  travelCredit: number;
+  /** Local date the counters belong to. */
+  date: string;
+}
+/** What ONE account gained during a single run. */
+interface AutomationAccountGain {
+  credit: number;
+  energy: number;
+  claimed: number;
+  checkinCredit: number;
+  bonusCredit: number;
+  travelCredit: number;
+}
+/** Totals from running the whole ordered pass at once. */
+interface AutomationRunSummary {
+  /** How many jobs actually ran (a job with no hour is skipped). */
+  jobsRun: number;
+  /** Accounts that finished without error, summed across jobs. */
+  okCount: number;
+  /** Accounts that failed, summed across jobs. */
+  failed: number;
+  credit: number;
+  energy: number;
+  claimed: number;
   /**
-   * The summon-and-use chains for the expert tasks.
+   * What each account gained during THIS run, keyed by account id. Only
+   * accounts that gained something appear.
+   */
+  accounts: Readonly<Record<string, AutomationAccountGain>>;
+}
+/** Automation snapshot for the status document and the card. */
+interface AutomationStatus {
+  enabled: boolean;
+  /** Whether the loop is running. */
+  running: boolean;
+  checkinHours: readonly number[];
+  taskHours: readonly number[];
+  reportHours: readonly number[];
+  streakHours: readonly number[];
+  travelHours: readonly number[];
+  jobs: {
+    checkin: AutomationJobState;
+    report: AutomationJobState;
+    tasks: AutomationJobState;
+    streak: AutomationJobState;
+    travel: AutomationJobState;
+  };
+  /** Claimable tasks seen on the most recent task pass, across accounts. */
+  claimableSeen: number;
+  /**
+   * Per-account totals for today, keyed by account id. Only accounts that
+   * actually earned something appear, so the card can render "no earnings"
+   * as an absence rather than a zero it has to explain.
+   */
+  earningsToday: Readonly<Record<string, AutomationAccountEarnings>>;
+  /**
+   * Whether a manual run is in flight right now.
    *
-   * Two steps per expert, and both are load-bearing: the summon events alone are
-   * impressions, and a use event on its own scores nothing because the scorer
-   * looks the conversation up. Only a real chat with `X-Expert-Id` produces an
-   * id it will accept.
+   * A run takes tens of seconds (one upstream call per account per job, plus
+   * the scoring wait), which is far too long for the card to hold a request
+   * open. The button starts a run and the panel polls this flag instead.
    */
-  private expertChains;
+  runInProgress: boolean;
+}
+/** The three plus one job kinds, in a stable order. */
+type AutomationJobKind = 'checkin' | 'tasks' | 'report' | 'streak' | 'travel';
+/** The four jobs in the order a tick runs them: report before tasks, always. */
+export declare const AUTOMATION_JOB_KINDS: readonly AutomationJobKind[];
+/** Reject anything that is not a job kind, so a route cannot name an unknown job. */
+export declare function isAutomationJobKind(value: unknown): value is AutomationJobKind;
+export declare function dayKey(date: Date, timeZone?: string): string;
+/**
+ * Whether `now`'s local hour is one of `hours`.
+ *
+ * The reference panel computes a `nextFire` instant and sleeps until it; this
+ * loop instead wakes every minute and asks "is any job due now". Both fire at
+ * the top of a configured hour, but the polling form cannot miss a slot to a
+ * suspended process — a laptop that slept through 10:00 still runs the job the
+ * moment it wakes, on the same day.
+ */
+export declare function isFireHour(now: Date, hours: readonly number[]): boolean;
+/**
+ * The points automation.
+ *
+ * Owns a single timer loop. Construction is inert — nothing runs until
+ * {@link start}, and {@link stop} is idempotent so a plugin teardown that fires
+ * twice is harmless.
+ */
+export declare class WorkBuddyScheduler {
+  private readonly pool;
+  private readonly client;
+  private readonly logger;
+  private readonly now;
+  private readonly delayMs;
   /**
-   * The 腾讯轻量云 expert chain.
+   * How long to wait for event scoring before re-reading the task list.
+   * Tests set 0 so a pass does not spend nine real seconds per account.
+   */
+  private readonly eventScoreWaitMs;
+  /**
+   * Gap between two expert summon chains.
+   * Tests set 0 so a pass does not spend six real seconds per expert.
+   */
+  private readonly expertGapMs;
+  private enabled;
+  private checkinHours;
+  private taskHours;
+  private reportHours;
+  private streakHours;
+  private travelHours;
+  private timer;
+  private running;
+  /** Guards against a slow run overlapping the next tick. */
+  private busy;
+  /** True while a manual run is in flight, so the card can poll it. */
+  private runInFlight;
+  /**
+   * Set once {@link stop} is called.
    *
-   * Structurally the same as the expert task, with two differences the scorer
-   * checks: `agent_task_created` has to name the expert, and the use event has
-   * to report `mode: 'LOCAL'` with an empty type and zero cost — that is what
-   * the lighthouse criterion looks for.
+   * Deliberately false before `start`: the loop is not running yet, but a
+   * manual `tick` must still work. `stop` is what makes a run abandon the
+   * accounts it has not reached yet.
    */
-  private lighthouseChains;
+  private stopped;
+  private readonly states;
+  private claimableSeen;
   /**
-   * The task-centre pass for one account.
+   * Credits/energy/tasks earned per account TODAY, keyed by account id.
    *
-   * Order matters: enrich first (enrol in everything open), then claim. Both
-   * halves are idempotent — accepting an already-accepted task succeeds, and a
-   * repeat claim answers `already_claimed` — so a pass that dies halfway is
-   * safe to replay on the next tick.
+   * Cleared whenever the day key rolls over, so the card always answers
+   * "what did the automation get for THIS account today".
    */
-  private runTasks;
+  private earnings;
+  /** Day key the counters above belong to. */
+  private earningsDate;
+  /** Host hooks that persist the ledger across restarts. */
+  private readonly loadEarnings;
+  private saveEarningsFn;
+  constructor(pool: WorkBuddyAccountPool, client: WorkBuddyUpstreamClient, options?: AutomationOptions);
+  /** Apply a new configuration; safe to call while running. */
   /**
-   * Streak redemption plus the lottery it unlocks.
+   * Install the persistence hook once the host settings service is available.
    *
-   * Tiers unlock on consecutive active days (7/14/28). Redeeming one pays
-   * credits, energy, a makeup card and — the part nothing else grants — lottery
-   * draws, so the draw runs straight after and only for the chances in hand.
+   * Separate from the constructor because the scheduler is built with the pool,
+   * long before the settings section exists; a ledger written before that point
+   * would have nowhere to go.
+   */
+  setEarningsPersistence(save: (ledger: AutomationLedger) => void | Promise<void>): void;
+  /**
+   * Fold a previously persisted ledger back in, when it belongs to today.
    *
-   * Everything here is idempotent: a tier already claimed is skipped by its
-   * status, and a draw consumes one chance, so a replay cannot double-spend.
+   * Used after the settings document becomes readable, which happens after
+   * construction; a ledger from an earlier day is ignored so the counters never
+   * claim yesterday as today.
    */
-  private redeemStreak;
+  applyEarningsLedger(ledger: AutomationLedger): void;
+  applyConfig(options: AutomationOptions): void;
+  /** Hours for one job, used by the loop and the status document. */
+  private hoursOf;
+  /** Start the loop. Idempotent. */
+  start(): void;
+  /** Stop the loop. Idempotent, and safe before `start`. */
+  stop(): void;
+  /** Snapshot for the status document. */
   /**
-   * One trip through the buddy travel loop for an account.
+   * Run one job immediately, regardless of the clock.
    *
-   * A single pass advances the state machine by at most one step: a trip
-   * that has arrived is collected, and an idle buddy is sent out. A buddy
-   * already travelling is left alone — there is nothing to do until it lands.
+   * Exists so the automation can be verified from the card without waiting for
+   * its hour. A manual run is recorded exactly like a scheduled one, so the
+   * timer will not repeat it later the same day: every job is idempotent, but a
+   * second pass would still be wasted upstream calls.
    *
-   * Measured against the live upstream: the departed trip reports
-   * `dailyLimitReached` immediately, so the once-a-day limit needs no local
-   * bookkeeping.
+   * `force` ignores the already-ran-today guard, which is what pressing the
+   * button a second time means.
    */
-  private runTravel;
-}
-//#endregion
-//#region src/status.d.ts
-/** One account's status row. */
-interface AccountStatus {
-  id: string;
-  label: string;
-  nickname?: string;
-  domain: string;
-  /** ISO timestamp when the access token expires. */
-  expiresAt?: string;
-  /** Account-wide cooldown (every model blocked). */
-  cooling: boolean;
-  cooldownUntil?: string;
-  /** Per-model cooldowns active right now (modelId → ISO until); the account
-   *  itself is not `cooling` while only some models are limited. */
-  modelCooldowns?: readonly {
-    modelId: string;
-    until: string;
-  }[];
-  rateLimitHits: number;
-  /** Read-only aggregated credit summary for the account. */
-  credits?: WorkBuddyCredits;
-  creditsError?: string;
-  sourcePath: string;
-}
-/** Whole-plugin status document. */
-interface WorkBuddyStatus {
-  ok: boolean;
-  accounts: AccountStatus[];
-  activeAccountId?: string;
-  cooling: number;
-  models: {
-    id: string;
-    name: string;
-    multiplier?: number;
-    tags?: readonly string[];
-  }[];
-  shim: {
-    running: boolean;
-    baseUrl?: string;
-  };
-}
-interface StatusOptions {
-  pool: WorkBuddyAccountPool;
-  /** The catalog to report. Regional callers pass their own region's. */
-  catalog: WorkBuddyCatalog;
-  client: WorkBuddyUpstreamClient;
-  shim?: {
-    running: boolean;
-    baseUrl?: string;
-  };
-  /** Query credits per account. Off for cheap diagnostics runs. */
-  includeCredits?: boolean;
-}
-/** Build the status document. Never throws. */
-export declare function buildStatus(options: StatusOptions): Promise<WorkBuddyStatus>;
-/** Format the status document for a terminal. */
-export declare function formatStatus(status: WorkBuddyStatus): string;
-/** Format the per-model credit multipliers. */
-export declare function formatRates(status: WorkBuddyStatus): string;
-//#endregion
-//#region src/status-paths.d.ts
-/**
- * Node-free constants and types shared by the Host and browser halves of the
- * WorkBuddy XD Pool settings card.
- *
- * Pool's runtime state already lives in `src/status.ts` (`buildStatus` /
- * `WorkBuddyStatus`); this module only carves the cross-domain (Host→browser)
- * JSON document into a shape that stays token-free and matches what the
- * browser card renders. Route paths are plugin-owned and mounted on the Host's
- * same-origin web server (see `src/web-status.ts`).
- *
- * @module dsh-workbuddy-xdpool/status-paths
- */
-/** Plugin-owned read-only pool status endpoint (account rows + models + shim). */
-export declare const POOL_STATUS_PATH = "/plugins/dsh-workbuddy-xdpool/status";
-/** Plugin-owned local account rescan endpoint (re-read desktop snapshots). */
-export declare const POOL_RESCAN_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/rescan";
-/** Plugin-owned cooldown reset endpoint (clear all 429 cooldowns). */
-export declare const POOL_RESET_COOLDOWN_PATH = "/plugins/dsh-workbuddy-xdpool/cooldowns/reset";
-/** Plugin-owned daily check-in action endpoint (claim today's reward). */
-export declare const POOL_CHECKIN_PATH = "/plugins/dsh-workbuddy-xdpool/checkin";
-/** Plugin-owned model-selection save endpoint (writes the settings section). */
-export declare const POOL_MODELS_SAVE_PATH = "/plugins/dsh-workbuddy-xdpool/models/save";
-/**
- * Throw one account out of the pool for good, or take it back.
- *
- * Separate from the disable route because the semantics differ: disabling is a
- * rotation preference the account survives, ignoring survives the account.
- */
-export declare const POOL_ACCOUNT_IGNORE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/ignored";
-/** Run one automation job immediately, so the card can verify it on demand. */
-export declare const POOL_AUTOMATION_RUN_PATH = "/plugins/dsh-workbuddy-xdpool/automation/run";
-/** Set or clear one account's reserved-credit floor. */
-export declare const POOL_CREDIT_RESERVE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/credit-reserve";
-/** One account's row, token-free. */
-interface PoolWebAccount {
-  id: string;
-  label: string;
-  nickname?: string;
-  domain: string;
-  /** ISO timestamp; absent when the credential carries no expiry. */
-  expiresAt?: string;
-  /** Account-wide cooldown (every model blocked); only after a no-model penalize. */
-  cooling: boolean;
-  /** ISO timestamp when the account-wide 429 cooldown lifts; only while cooling. */
-  cooldownUntil?: string;
+  runNow(kind: AutomationJobKind, force?: boolean): Promise<AutomationJobState>;
   /**
-   * Per-model cooldowns currently active. The account is NOT `cooling` while a
-   * model is limited — its other models still serve — but each entry tells the
-   * card which model is out until when (e.g. `hy4-preview` cooling to 10:14,
-   * `hy3` normal).
+   * Run every job once, in the scheduled order.
+   *
+   * Order matters and is not configurable: the activity report has to land
+   * before the task pass reads task progress, or the pass sees counters the
+   * report would have moved. This is what the card's single button calls.
    */
-  modelCooldowns?: ReadonlyArray<{
-    modelId: string;
-    until: string;
-  }>;
   /**
-   * Whether the user switched this account off. A disabled account never
-   * serves a request, but it stays listed so the card can switch it back on.
+   * Start a full pass in the background and return immediately.
+   *
+   * A pass takes tens of seconds - one upstream round trip per account per job,
+   * plus the scoring wait - which is far too long to hold the card request open:
+   * the browser or the host web server would time out, and the user would see
+   * a hung button for a run that is actually working.
+   *
+   * Returns whether a run started. A second call while one is in flight is
+   * ignored rather than queued: pressing the button twice means hurry up, and
+   * the run already under way covers it.
    */
-  disabled: boolean;
-  rateLimitHits: number;
+  startRunAll(): boolean;
+  runAll(): Promise<AutomationRunSummary>;
+  status(): AutomationStatus;
   /**
-   * Credits the user asked to keep for this account. The pool stops picking the
-   * account once its balance reaches the reserve, so this many credits survive.
-   * 0 means the account may be spent down as before.
+   * One poll: run every due job, serially.
+   *
+   * Serial by design — the jobs share the same accounts and the upstream
+   * rate-limits per account, so overlapping passes would only trip that limit.
+   * A job that throws is recorded and the loop continues.
    */
-  creditReserve: number;
   /**
-   * Whether the account is held back purely by its reserve right now. Kept
-   * distinct from `cooling`: a reserved account is healthy and simply
-   * protected, which is a different thing to tell the user than rate-limited.
+   * Whether `kind` is due at `now`: its earliest configured hour has passed in
+   * the scheduling timezone, and no hour of today has been consumed yet.
+   *
+   * Hours are consumed per SLOT (one entry per configured hour), so a job with
+   * two hours still runs twice a day — but a job whose hour passed while DSH was
+   * closed runs immediately on the next tick instead of waiting for tomorrow.
    */
-  reserved: boolean;
   /**
-   * What the automation earned for this account today. Absent when it earned
-   * nothing (or the automation never ran for it), so the card can stay quiet
-   * instead of printing a row of zeroes.
+   * The configured slot `kind` should consume at `now`, or undefined when none.
+   *
+   * Returns the SLOT STRING (not a boolean) because the caller must record the
+   * same value it acted on. Returning a boolean was the original bug's enabler:
+   * the tick asked "is it due", then `runJob` independently wrote "what time is
+   * it now" — and those two answers were almost never equal.
+   *
+   * CATCH-UP semantics are deliberate: a candidate fires once its hour has
+   * PASSED and its slot is still unconsumed, so a laptop that slept through
+   * 10:00 still runs the job when it wakes, on the same day.
+   *
+   * The EARLIEST unconsumed candidate wins, which is what keeps a two-hour job
+   * (`travelHours: [9, 21]`) whole: consuming the earliest due slot leaves the
+   * later one for its own hour.
    */
-  automationToday?: PoolWebAutomationEarnings;
-  /** ISO timestamp of the last successful use (best-effort pool bookkeeping). */
-  lastUsedAt?: string;
-  /** Aggregated credit summary for the account, read-only. */
-  credits?: PoolWebCredits;
-  creditsError?: string;
+  private dueSlot;
+  /** Today's consumed slots for one job, as a set. */
+  private firedSlotsOf;
+  /** Record one consumed slot on a job's state. */
+  private consumeSlot;
+  private tick;
+  /** Run one job against every eligible account and record the outcome. */
   /**
-   * Today's check-in state for this account, read-only. Present only when the
-   * per-account check-in probe succeeded and the program is active. The card
-   * renders one claim button per account, so a multi-account pool can collect
-   * every account's daily reward without switching accounts by hand.
+   * Add one account's take to today's counters, resetting first if the day
+   * rolled over. Called from the task pass, which is the only job that earns.
    */
-  checkin?: PoolWebCheckin;
-  checkinError?: string;
-}
-/** One credit package (as surfaced by the pool's upstream client), node-free. */
-interface PoolWebCreditPackage {
-  packageName: string;
-  remain?: number;
-  size?: number;
-  /** CapacityType 4 — refreshed each cycle and never expires. */
-  monthly?: boolean;
-  /** Next cycle refresh point, ms. */
-  cycleRefreshMs?: number;
-  /** One-off expiry, ms. */
-  expiresAtMs?: number;
-}
-/** Aggregated credit answer the card renders under one account. */
-interface PoolWebCredits {
-  total?: number;
-  packages: readonly PoolWebCreditPackage[];
-  /** Credits expiring within 3 days. */
-  expiringSoon?: number;
-  /** When the nearest package expires, ms. */
-  nearestExpiryMs?: number;
-}
-/**
- * Daily check-in state the card renders under one account's credits. Mirrors
- * the upstream activity endpoint, minus anything the browser does not need.
- */
-interface PoolWebCheckin {
-  /** The activity is running; a claim button is offered only while true. */
-  active: boolean;
-  /** Already collected today — the button renders as a done state. */
-  todayCheckedIn: boolean;
-  /** Consecutive days checked in. */
-  streakDays: number;
-  /** Credits a single day grants. */
-  dailyCredit: number;
-  /** Credits collected today (0 before claiming). */
-  todayCredit: number;
-  /** Today is a streak milestone day. */
-  isStreakDay: boolean;
-  /** The day count the next milestone lands on. */
-  nextStreakDay: number;
-  /** Bonus credits granted on a milestone day. */
-  streakBonusCredit: number;
-}
-/** Result of one claim, so the card can confirm what was collected. */
-interface PoolWebCheckinClaim {
-  credit: number;
-  streakDays: number;
-  isStreakDay: boolean;
-}
-/** One model the pool exposes to DSH, with cost / free tags. */
-interface PoolWebModel {
-  id: string;
-  name: string;
-  /** Relative credit cost, e.g. 0.79 for x0.79. */
-  multiplier?: number;
-  /** Upstream tags: free / limited-free / night-discount. */
-  tags?: readonly string[];
-  /** Effective image support after the user's per-model toggle. */
-  supportsImages: boolean;
-  /** Effective context window after the user's budget cap. */
-  contextWindow: number;
-  /** The window the upstream advertises, before any cap. */
-  nativeContextWindow: number;
-  /** Upstream output ceiling, so the card can show both limits. */
-  maxOutputTokens: number;
-  /** Thinking levels the upstream declares, when it declares any. */
-  supportedEfforts?: readonly string[];
-  /** Whether this model is currently enabled in the picker. */
-  enabled: boolean;
-}
-/**
- * Body of the account ignore/unignore route: exactly one account per request.
- *
- * `ignored: true` throws the account out of the pool for good (its credential is
- * not even read on the next scan, and a fresh desktop sign-in will not bring it
- * back). `false` restores it, at which point the next scan discovers it again.
- */
-interface PoolWebAccountIgnore {
-  /** Pool account id, as reported in `PoolWebAccount.id`. */
-  accountId: string;
-  /** `true` ignores the account permanently; `false` takes it back. */
-  ignored: boolean;
-}
-/**
- * One account the user has thrown out of the pool.
- *
- * Kept on the status document so the card can list what was ignored and offer a
- * way back: without that, "ignored" is a one-way door the user cannot inspect or
- * undo from the UI, which is how a hidden list becomes a support burden.
- */
-interface PoolWebIgnoredAccount {
-  /** Pool account id, the same key `PoolWebAccount.id` uses. */
-  id: string;
-  /** Human label captured at ignore time, so the row reads without a rescan. */
-  label: string;
-  /** ISO timestamp of when it was ignored. */
-  ignoredAt: string;
-}
-interface PoolWebModelSelection {
-  /** Absent = every model is enabled. */
-  enabledModelIds?: readonly string[];
-  /** Absent = each model follows its upstream image capability. */
-  imageModelIds?: readonly string[];
-  /** Per-model context-window cap, keyed by model id. */
-  contextBudgets?: Readonly<Record<string, number | undefined>>;
-}
-/** The JSON document the pool card renders. */
-interface PoolWebStatus {
-  ok: boolean;
-  accounts: readonly PoolWebAccount[];
-  /** The next account the pool would use (rotation cursor). */
-  activeAccountId?: string;
-  cooling: number;
-  models: readonly PoolWebModel[];
-  /** The saved selection the card diffs its draft against. */
-  selection: PoolWebModelSelection;
   /**
-   * How the pool spreads requests: `priority` drains one account before
-   * moving on, `round-robin` splits the spend evenly.
+   * Today's per-account earnings, as a plain object for the status document.
+   *
+   * Rolls the day first so a status read just after midnight does not report
+   * yesterday's totals under today's date.
+   */
+  private earningsSnapshot;
+  /**
+   * Add one account take to today counters, resetting first if the day rolled
+   * over. Every source is tracked separately so the card can show what earned
+   * what, rather than one opaque total.
+   */
+  private recordEarnings;
+  /** Clear the per-account counters when the local day changes. */
+  private rollEarnings;
+  /**
+   * Write the ledger through the host hook, when one was supplied.
+   *
+   * Best effort on purpose: a failed save must never abort a run that has
+   * already collected rewards, and the in-memory ledger keeps serving the card
+   * for the rest of the session either way.
+   */
+  private persistEarnings;
+  /**
+   * Run one job against every eligible account and record the outcome.
+   *
+   * `consumedSlot` is the configured slot this run spends (`dueSlot`'s answer).
+   * It is passed IN rather than recomputed here so the value recorded is exactly
+   * the value the schedule decided on — the defect this replaces wrote
+   * `slotKey(now)` instead, i.e. the clock time the run finished at, which
+   * almost never equals the configured candidate the gate had compared against.
+   *
+   * The task job runs in TWO passes. The first sends the event chains that light
+   * up client-scored tasks; the second collects rewards. They are separate
+   * because scoring lands asynchronously — a chain sent and claimed within the
+   * same breath finds the task still un-scored — and because sending is fast
+   * while claiming wants the whole pool to have been lit up first. Splitting
+   * them costs one shared wait instead of one wait per account.
+   */
+  private runJob;
+  /** Compose the one-line summary shown on the card. */
+  private summarise;
+  /**
+   * Accounts to run against, in pool order.
+   *
+   * Disabled accounts are excluded here rather than filtered by the caller so a
+   * card switch takes effect on the next pass without any event plumbing.
+   */
+  private accountsInOrder;
+  /**
+   * Send one activity report, then verify it landed.
+   *
+   * The upstream answers 200 even when it drops the event, so the streak is
+   * read back as the oracle: `days > 0` means it counted. A failed read-back is
+   * logged and treated as a suspicious result, never as a retry — the report is
+   * idempotent per day, and hammering it is exactly what the one-a-day quota
+   * exists to avoid.
    */
-  distribution: PoolDistribution;
-  /** Which region this document describes. */
-  region: PoolRegion;
-  /** Every region holding at least one account, in display order. */
-  regions: readonly PoolRegion[];
-  shim: {
-    running: boolean;
-    baseUrl?: string;
-  };
-  /** Daily-points automation state, so the card can show what ran and when. */
-  automation: PoolWebAutomation;
-  /** Per-account credit floors currently in force, keyed by account id. */
-  creditReserves: Readonly<Record<string, number>>;
+  private reportOne;
+  private sendEventChains;
   /**
-   * Accounts thrown out of the pool, in the order they were ignored.
+   * Send one chain on the channel it was built for.
    *
-   * Reported so the card can show the list and offer a way back. These accounts
-   * are NOT in `accounts`: they are filtered out before their credentials are
-   * read, which is the whole point of the feature.
+   * The transport is not a detail of the sender: the scorer keys different
+   * tasks to different fingerprint families, so a web-scored event posted as a
+   * desktop event is accepted and then ignored.
    */
-  ignored: readonly PoolWebIgnoredAccount[];
-}
-/** One automation job's last run, as shown on the card. */
-interface PoolWebAutomationJob {
-  /** `YYYY-MM-DD` of the last run in this process, if it has run. */
-  lastRunDate?: string;
+  private sendChain;
   /**
-   * Epoch ms of the last run, so the card can show the TIME.
+   * Build every chain that scores one task.
    *
-   * Carried because a date-only stamp cannot tell one run from eight: every
-   * repeat inside the same day rendered as the identical `2026-09-28 · 2`,
-   * which is what kept a "re-runs every hour" defect invisible on the card.
+   * Most tasks need a single chain; `template_5` needs five, because the scorer
+   * counts distinct `template_used` events rather than a boolean. The two tasks
+   * that join a conversation (skill, expert) open a real one first, which is why
+   * this is async.
    */
-  lastRunAtMs?: number;
+  private chainsFor;
   /**
-   * Configured slots consumed today, as `YYYY-MM-DDTHH`.
+   * The summon-and-use chains for the expert tasks.
    *
-   * Shown so "which of today's hours already ran" is answerable at a glance
-   * rather than inferred from a counter.
+   * Two steps per expert, and both are load-bearing: the summon events alone are
+   * impressions, and a use event on its own scores nothing because the scorer
+   * looks the conversation up. Only a real chat with `X-Expert-Id` produces an
+   * id it will accept.
    */
-  firedSlots?: readonly string[];
-  /** Accounts that finished without error on the last run. */
-  ok: number;
-  /** Accounts that failed on the last run (each one skipped, the run continued). */
-  failed: number;
-  /** Credits claimed by the task job on the last run. */
-  credit: number;
-  /** Energy claimed by the task job on the last run. */
-  energy: number;
-  /** Tasks claimed by the task job on the last run. */
-  claimed: number;
-  /** One-line summary of the last run. */
-  message?: string;
+  private expertChains;
   /**
-   * What the last run actually did, in the words of the task board.
+   * The 腾讯轻量云 expert chain.
    *
-   * `message` is a count; this is the list a person can check off, which is
-   * what turns a row from "it ran" into "it did the things I care about".
+   * Structurally the same as the expert task, with two differences the scorer
+   * checks: `agent_task_created` has to name the expert, and the use event has
+   * to report `mode: 'LOCAL'` with an empty type and zero cost — that is what
+   * the lighthouse criterion looks for.
    */
-  detail?: readonly string[];
-  /** A pending milestone worth naming, e.g. the next streak tier countdown. */
-  progress?: string;
-}
-/**
- * Automation block on the status document.
- *
- * Carries the schedule and each job's last outcome so the card can answer
- * "is it on, when does it run, and what did it last do" without reaching into
- * the scheduler itself.
- */
-interface PoolWebAutomation {
-  /** Master switch, mirrored from the saved config. */
-  enabled: boolean;
-  /** Whether the loop is currently running. */
-  running: boolean;
-  /** Configured hours per job, so the card can show the schedule. */
-  checkinHours: readonly number[];
-  reportHours: readonly number[];
-  taskHours: readonly number[];
-  streakHours: readonly number[];
-  travelHours: readonly number[];
-  jobs: {
-    checkin: PoolWebAutomationJob;
-    report: PoolWebAutomationJob;
-    tasks: PoolWebAutomationJob;
-    streak: PoolWebAutomationJob;
-    travel: PoolWebAutomationJob;
-  };
-  /** Claimable tasks seen on the most recent task pass, across accounts. */
-  claimableSeen: number;
+  private lighthouseChains;
   /**
-   * Whether a manual run is in flight. The card polls this to know when to
-   * stop showing progress and report the result.
+   * The task-centre pass for one account.
+   *
+   * Order matters: enrich first (enrol in everything open), then claim. Both
+   * halves are idempotent — accepting an already-accepted task succeeds, and a
+   * repeat claim answers `already_claimed` — so a pass that dies halfway is
+   * safe to replay on the next tick.
    */
-  runInProgress: boolean;
+  private runTasks;
   /**
-   * Per-account credits/energy/tasks the automation earned TODAY, keyed by
-   * account id. An account that earned nothing is simply absent, so the card
-   * can say "nothing yet" instead of showing a bare zero.
+   * Streak redemption plus the lottery it unlocks.
+   *
+   * Tiers unlock on consecutive active days (7/14/28). Redeeming one pays
+   * credits, energy, a makeup card and — the part nothing else grants — lottery
+   * draws, so the draw runs straight after and only for the chances in hand.
+   *
+   * Everything here is idempotent: a tier already claimed is skipped by its
+   * status, and a draw consumes one chance, so a replay cannot double-spend.
    */
-  earningsToday: Readonly<Record<string, PoolWebAutomationEarnings>>;
+  private redeemStreak;
+  /**
+   * One trip through the buddy travel loop for an account.
+   *
+   * A single pass advances the state machine by at most one step: a trip
+   * that has arrived is collected, and an idle buddy is sent out. A buddy
+   * already travelling is left alone — there is nothing to do until it lands.
+   *
+   * Measured against the live upstream: the departed trip reports
+   * `dailyLimitReached` immediately, so the once-a-day limit needs no local
+   * bookkeeping.
+   */
+  private runTravel;
 }
-/** Today's automation take for one account. */
-interface PoolWebAutomationEarnings {
-  /** Credits claimed from the task centre today. */
-  credit: number;
-  /** Energy claimed from the task centre today. */
-  energy: number;
-  /** Tasks claimed today. */
-  claimed: number;
-  /** Credits collected from check-in today. */
-  checkinCredit: number;
-  /** Credits from streak redemption and the lottery today. */
-  bonusCredit: number;
-  /** Credits from buddy adoption and the travel loop today. */
-  travelCredit: number;
-  /** Local date the counters belong to (YYYY-MM-DD). */
-  date: string;
+//#endregion
+//#region src/status.d.ts
+/** One account's status row. */
+interface AccountStatus {
+  id: string;
+  label: string;
+  nickname?: string;
+  domain: string;
+  /** ISO timestamp when the access token expires. */
+  expiresAt?: string;
+  /** Account-wide cooldown (every model blocked). */
+  cooling: boolean;
+  cooldownUntil?: string;
+  /** Per-model cooldowns active right now (modelId → ISO until); the account
+   *  itself is not `cooling` while only some models are limited. */
+  modelCooldowns?: readonly {
+    modelId: string;
+    until: string;
+  }[];
+  rateLimitHits: number;
+  /** Read-only aggregated credit summary for the account. */
+  credits?: WorkBuddyCredits;
+  creditsError?: string;
+  sourcePath: string;
 }
-/**
- * The two gateways, matching the provider ids the host registers. `cn` is the
- * domestic gateway (`copilot.tencent.com` / `codebuddy.cn`); `global` is the
- * international one (`workbuddy.ai`).
- */
-type PoolRegion = 'cn' | 'global';
-/** How the pool spreads requests across its accounts. */
-type PoolDistribution = 'priority' | 'round-robin' | 'balanced';
-/**
- * The schedule every automation job falls back to.
- *
- * Shared by both halves on purpose. The host uses it when a configured hour
- * list arrives empty (the settings schema materializes "never configured" into
- * `[]`), and the card uses it when it writes the `automation` block back, so a
- * document that already holds an empty list is healed instead of being saved
- * back as an unrunnable schedule.
- *
- * This lives here rather than in `scheduler.ts` because the browser half cannot
- * import the host module: `scheduler.ts` pulls in `node:crypto` and the whole
- * upstream client, none of which exists in the browser bundle. Two hand-written
- * copies would drift, and the drift is invisible — the card would write a
- * schedule the scheduler does not run.
- */
-export declare const DEFAULT_AUTOMATION_HOURS: {
-  readonly checkin: readonly [9];
-  readonly report: readonly [10];
-  readonly tasks: readonly [11];
-  readonly streak: readonly [12];
-  readonly travel: readonly [9, 21];
-};
+/** Whole-plugin status document. */
+interface WorkBuddyStatus {
+  ok: boolean;
+  accounts: AccountStatus[];
+  activeAccountId?: string;
+  cooling: number;
+  models: {
+    id: string;
+    name: string;
+    multiplier?: number;
+    tags?: readonly string[];
+  }[];
+  shim: {
+    running: boolean;
+    baseUrl?: string;
+  };
+}
+interface StatusOptions {
+  pool: WorkBuddyAccountPool;
+  /** The catalog to report. Regional callers pass their own region's. */
+  catalog: WorkBuddyCatalog;
+  client: WorkBuddyUpstreamClient;
+  shim?: {
+    running: boolean;
+    baseUrl?: string;
+  };
+  /** Query credits per account. Off for cheap diagnostics runs. */
+  includeCredits?: boolean;
+}
+/** Build the status document. Never throws. */
+export declare function buildStatus(options: StatusOptions): Promise<WorkBuddyStatus>;
+/** Format the status document for a terminal. */
+export declare function formatStatus(status: WorkBuddyStatus): string;
+/** Format the per-model credit multipliers. */
+export declare function formatRates(status: WorkBuddyStatus): string;
 //#endregion
 //#region src/ignored.d.ts
 /** Directory holding this plugin's own state (imported snapshots, ignore list). */
@@ -2271,6 +2365,19 @@ interface PoolStatusRouteOptions {
    * disk, including edits made by the CLI while the card is open.
    */
   ignoredAccounts?: () => readonly PoolWebIgnoredAccount[];
+  /**
+   * Re-fetch the model catalog for BOTH regions and report what landed.
+   *
+   * Absent when the host did not wire it: the route then answers 503 rather
+   * than pretending the refresh happened.
+   */
+  refreshCatalog?: () => Promise<{
+    regions: Readonly<Record<PoolRegion, {
+      source: PoolWebCatalogSource;
+      models: number;
+      error?: string;
+    }>>;
+  }>;
 }
 /**
  * Assemble the card's status document. Per-account credits and check-in state