dsh-xdpool 2.4.6 → 2.5.1

package/CHANGELOG.md

@@ -1,6 +1,130 @@
 # Changelog
 本项目的所有重要变更都会记录在此文件。
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
+## 2.5.1 — 六张 issue、一个交流群入口，外加拿掉 billion-context
+
+> 2.5.0 之后收到的反馈集中在两类：**看得见却点不动的界面**（链不显示、单选互顶、卡片空白），和**说错话的报错**（额度已用尽、密钥无效、为预留让你调低预留）。这一版把这两类都按「根因 + 可复现断言」的方式收掉，同时按你的要求移除了 billion-context 那一页，并在「点Star」旁边加了「交流群」。
+
+### 修掉六张 issue
+
+**#99 路由页有链却不显示，保存还会把链删掉**
+
+`setDrafts(prev => seeded.current ? prev : …)` 把守卫放进了函数式更新回调，紧接着一行同步 `seeded.current = true`。React 的回调在提交阶段才跑，那时标志位已经是 `true`，于是恒走 `prev` 分支 —— 初始值 `[]` 原样返回。列表恒空，而保存提交的是整张表，**第一次保存就把服务端那条链覆盖成空**。
+
+改成同步判断再置位（与同项目 `GatewayPage.tsx` 同形）。回归用例现在连「形状」一起锁：不许再出现 `setDrafts(prev => seeded …)`。
+
+**#101 国内版/国际版的「1M」互相顶掉**
+
+两张区域卡同时挂载（折叠面板用 `hidden`，不是卸载），预算单选 `name` 只用了 `budget-${model.id}`，同名即同组，浏览器只保留最后一个 `checked`。后渲染的国际版把国内版的黑点顶掉，表现为「点了没保存」。用 `useId()` 给每一行实例加作用域 —— 只加 region 不够，设置页与侧栏可能同时挂载同一区域。
+
+**#102 切回账号池就重拉全部数据（2–4 秒空白）**
+
+页签正文是三选一表达式，切页即卸载，`useState` 随之清零；而且 `load()` 把 `account.list` / `model.list` / `credits.balances` / `credits.status` 四合一一 `await Promise.all`，让整张卡等唯一走网络的余额查询。
+
+- 快照提到模块作用域，且**写在 `mountedRef` 判据之前**：已经发出去的结果即便在卸载后才回来，仍然落进快照
+- 拆两波：wave1 只问内存里的三项，先把卡画全（余额格写 `…`）；wave2 每渠道各自回填
+- `balancePending` 原来被硬编成 `false`，让渲染层那条 `…` 分支成了死代码 —— 现在真正用上了
+- 每次加载带单调序号，旧答案盖不掉新答案
+
+**#95 扫码渠道卡整片空白，且不报错**
+
+`if (entries.length === 0 && error === undefined) return <></>`。而 RPC 桥解析失败时 `provider.status` 回 `ok: false`、映射出空 map、`entries` 为空、`error` 仍是 `undefined` —— **「桥断了」和「没有扫码账号」渲染成同一片空气**。
+
+改成三态：读取中一行字、失败写明原因、成功但确实没有账号才保持安静。
+
+**#98 自动化三处**
+
+- 「体验XX专家」任务族（`expert_use_maidehao` / `douyinyin` / `shangjia_xuanchuan` / `bowangwang`，加同族的 `WorkBuddy_Valorant`）不在 `EVENT_CHAIN_BUILDERS` 里，所以 accept 和 claim 都正常、进度永远 0/1。这批专家**不在市场列表里**，expertId 只存在于任务自己的 `jump_url` 里（percent-encoded deeplink），因此新增 `expertIdFromJumpUrl()`：先解 `deeplink` 参数、再读内层 `expertId`。use 事件保持默认 `craft` 模式 —— `LOCAL`/零成本是 lighthouse 的专属判据。
+- `unavailableReason()` 遇到第一个低于预留的账号就 `return reserve`，后面账号根本没检查。一张 5 账号池里只要有一个长期低于预留线，任何失败都会被归因成 402「调低预留」。改为计数式：`dead`/`cooling`/`disabled` 先报（这些改数字改不好），只有**无可用账号且全部被预留挡住**才报 `reserve`。
+- `automationEarnings` 写入是 fire-and-forget，领取完成到进程退出的窗口里丢账（实测领了 21 个任务，落盘仍是 `credit: 0`）。`persistEarnings()` 改为返回 promise，`runJob` 收尾 `await this.flushEarnings()`。
+
+**#96 免密 lane 全失败，却报「额度已用尽」**
+
+403 指纹拒绝被渲染成宿主自己的措辞，指向「等待」；真正该做的是「升级插件」。新增 `withFreeTierHint()`：先说指纹失配、明确「等待无用，请更新」，再保留 per-conversation 配额这一可能（两者从外部无法区分，不自作聪明）。429 仍走原有的会话配额提示。
+
+### 新增：「交流群」
+
+- 卡片右上角「点Star」旁边多一个「交流群」按钮，点开在原位弹层显示微信群码
+- 底部导航网格从 `1fr auto` 扩成 `1fr auto auto`，否则第二个按钮会掉到标签栏下面
+- 二维码以 data URI 内嵌进 `lib/client.js`：客户端是宿主加载的单个脚本，解析不了包内相对路径，而 `<img>` 加载失败是**静默**的
+- Esc 与点击遮罩都能关；`alt` 写的是操作指引（读屏用户扫不了码）
+- 同一张图放在 `README.md` 与 `README.en.md` 第 13 行（标题与徽章之后），过期了换 `assets/community-qr.png` 并重跑 `tools/make-community-qr.mjs`
+
+### 移除：billion-context
+
+那一页只读观测另一个插件的回环代理。连同 `src/billion.ts`、`src/billion-mount.ts`、`src/client/BillionPage.tsx`、`/plugins/dsh-xdpool/billion` 路由、`POOL_BILLION_PATH` 与两个文档类型、84 个 `billion.*`/`shell.tabBillion` 语言键、`BILLION_CARD_CSS`、`optionalDependencies.billion-context`，以及 `cordis.patch.yml` 里那行长期 `disabled: true` 的条目一起删掉。README 的页面表随之从七页改回六页。
+
+### 一并发布的两个既有改动
+
+- **CodeArts 的输出上限是上限，不是默认值** —— `listModels()` 报 `maxTokens`、`resolveModel()` 报 `defaultMaxTokens`、线上 `max_tokens` 做 `Math.min` clamp。原先 `?? 65536` 只兜底不设界，宿主把别的 provider 的 384000 原样递过来就触发 HTTP-200 的 SSE 错误帧。见 #83 / #69。
+- **第三条内容指纹** —— 「Relative paths resolve from the workspace root」改成过去分词形式，池车道与渠道车道同步。见 #77 / #79。
+
+### 验证
+
+- 全套 **83 文件 1057 用例全绿**；host 侧 `tsc --noEmit` 干净
+- 新增 6 个测试文件：`billion-removed` / `card-shell`（交流群）/ `channel-pool-loading` / `expert-task-family` / `free-lane-refusal` / `reserve-floor-scope`
+- 交互验证不只做源码断言：`tools/probe-card-render.mjs` 用最小 hook 调度器驱动真实 `PoolShell`，完成「点击 → 重渲染 → 弹层出现 → 二维码 8666 字符 data URI → 遮罩关闭」整条链路
+
+Refs #95 #96 #98 #99 #101 #102。
+
+## 附：CodeArts 的输出上限是上限，不是默认值（细节，已并入 2.5.1）
+
+> 华为这条链接 65536 能用、131072 就空流，代码里也一直写着这个数字。但它是 `options.maxTokens ?? 65536` —— 只兜底，不设界。
+
+### 触发条件：宿主把别的 provider 的额度原样递过来
+
+宿主从模型目录里取 `maxTokens` 填进 `options.maxTokens`，而那份目录里 384000 是 deepseek-v4-pro、fireworks、huggingface 这些**真的能到 384000** 的条目的正常值。CodeArts 自己没声明上限时，这个 384000 就原样发出去了。
+
+后果不是 4xx：后端回 **HTTP 200**，把错误装在 SSE 帧里 ——
+
+```
+InferHub.4001.200 The request param is invalid, Please check it
+```
+
+适配器把它映射成 `INVALID_REQUEST`。用户看到的是「这个账号好好的，突然发不出话」，而新建会话发「你好」就失败，第一反应必然是密钥坏了 —— 这也是 #69「CodeArts 提示密钥无效」的一条候选根因（#69 正文只有一句话，无法确认是这条还是 403 那条，故 #83 里保留判断）。
+
+### 实测（2026-10-25，失败会话的原文 system/user + 全部 133 个 tools 直连，只改 max_tokens）
+
+| max_tokens | 结果 |
+| --- | --- |
+| 384000 | HTTP 200 + SSE 错误帧 `InferHub.4001.200` → INVALID_REQUEST |
+| 131072 | HTTP 200，空流 |
+| 65536 | 正常流式回复 |
+
+### 改法：三处对齐，线上请求做 clamp
+
+- `listModels()` 每个模型带 `maxTokens`，宿主没有理由再自己猜一个更大的
+- `resolveModel()` 带 `defaultMaxTokens`，`catalogFactsFor()` 会把它当 `fact.maxTokens` 交给宿主 —— 这是宿主唯一能知道上限的通道
+- 线上 `max_tokens: Math.min(options.maxTokens ?? CODEARTS_MAX_OUTPUT_TOKENS, CODEARTS_MAX_OUTPUT_TOKENS)`，调用方给更大就收回，给更小仍保留
+
+TRAE 与 Cline 早就这么做了（`clampTraeMaxTokens` / `clampClineMaxTokens`，也都写 `resolved.defaultMaxTokens`），CodeArts 是唯一的例外。
+
+- 回归：`tests/codearts-max-tokens.test.ts` 新增 5 例（源码断言，与 `tests/codearts-resign-headers.test.ts` 同形状 —— `pack.js` 是另一个仓库的构建产物，无法 import 驱动）
+- 反向对照：撤掉 `pack.js` 的补丁后 5 例全红，补上全绿
+
+Refs #83, #69。
+
+## 附：第三条内容指纹 —— 文件引用指引里的 “resolve from the workspace root”（细节，已并入 2.5.1）
+
+> 2.4.1/2.4.2 修好的两个指纹管了一周，10 月 28 日又整片 400/11128。这次被点名的不是产品名，而是一句普通说明。
+
+### 触发点在 read 工具的文件引用指引
+
+DSH 在 agent 有 `read` 工具时会贡献一段文件引用指引，开头是「Tokens prefixed with @ are paths the user explicitly referenced.」，第二句是 **「Relative paths resolve from the workspace root」**。把当次真实系统提示（约 41k 字符）整段发上去稳定 400/11128，逐段二分到 204 字符命中这段，再逐句验证：两句**单独发都是 200**，两句同现才 400；改其中任意一处小改动也 200 —— 所以这是内容指纹，不是长度规则、也不是头部规则。
+
+这也解释了为什么它看起来「不像」前两条：前两条是识别别的客户端的文案，这一条只是被网关的字符串表收进去了，句子本身没有任何产品名。
+
+### 改法：把陈述句改成同一句的过去分词形式
+
+`Relative paths resolve from the workspace root` → `Relative paths are resolved against the workspace root`。语义、长度量级、换行位置都不变，被列表收录的子串消失。同一账号上整段 41k 系统提示由 400 转 200；渠道车道与池车道同步补上，`pack.js` 的三处 `[xdpool-local]` 标记保持原样。
+
+- 池车道：`BANNED_SYSTEM_PHRASES` 增加第三行
+- 渠道车道：`vendor/channel-pack/pack.js` 的同一个 `replace` 链增加第三段
+- 回归：`tests/system-fingerprint.test.ts` 新增 5 例（含「三处指纹同现」整段用例）；`tests/chat-identity-headers.test.ts` 对已发布 bundle 的字节断言补上第三段，pack 刷新若把它冲掉会变红
+
+### 其他
+- 全套 79 文件 1028 用例（1026 通过 + 2 跳过）。
+
 ## 2.4.6 — 扫码账号每次打开都空白：一份数据卡在两个细节里
 
 > 2.4.4/2.4.5 之后侧栏能进、能滚了，但扫码过的渠道在账号池里经常整片空白，重开也一样。磁盘上账号是齐的（`state.json` 里 15 条），所以问题全在读取链。

package/README.en.md

@@ -7,6 +7,16 @@
   <a href="https://github.com/XDTrees/dsh-xdpool/stargazers"><img src="https://img.shields.io/github/stars/XDTrees/dsh-xdpool?style=flat-square" alt="GitHub stars"></a>
 </p>
 
+## Join the group
+
+<p align="center">
+  <img src="assets/community-qr.png" width="300" alt="WeChat group code: XD community group">
+  <br>
+  <sub>Scan with WeChat to join the <b>XD community group</b>. The code is valid for 7 days; if it has expired, say so in <a href="https://github.com/XDTrees/dsh-xdpool/issues">issues</a> and it will be refreshed.</sub>
+  <br>
+  <sub>The 交流群 button next to “Star” in the card's top-right corner opens this same code — no need to come back to the README.</sub>
+</p>
+
 <p align="center">
   <sub>Download stats still come from the previous package name <code>dsh-workbuddy-xdpool</code> (8,976/month as of 2026-10-12 — every download before the rename; the live shields badge kept getting rate-limited by the npm upstream, hence the snapshot figure). The new <code>dsh-xdpool</code> package accumulates its own stats, and the badge switches back to live data later.</sub>
 </p>
@@ -17,7 +27,7 @@ English | [中文](./README.md)
 
 It started as one thing: every account you've signed into the WorkBuddy desktop app, merged into one auto-failing-over pool. An account gets rate-limited or runs out of credits, and the request moves to the next one that works. No picking favourites, no manual import.
 
-Then it grew into seven pages. Beyond the account pool: sign in to thirteen vendors' free models by web or QR, aggregate **76 vendors'** free quotas into one lane, read a usage ledger, chain models together, and expose the pool as a local OpenAI-compatible gateway.
+Then it grew into six pages. Beyond the account pool: sign in to thirteen vendors' free models by web or QR, aggregate **76 vendors'** free quotas into one lane, read a usage ledger, chain models together, and expose the pool as a local OpenAI-compatible gateway.
 
 | Page | What it does |
 | --- | --- |
@@ -25,7 +35,6 @@ Then it grew into seven pages. Beyond the account pool: sign in to thirteen vend
 | **Login channels** | Thirteen vendors that sign in by web or QR — once, and their free models join the picker |
 | **Aggregate** | 76 vendors' free quotas into one pool (none on by default; a vendor lights up when it has a key) |
 | **Dashboard** | Today's turns, calls, failures, failover rescues, tokens, cache hits, speed |
-| **billion-context** | Read-only view of the local billion-context compressor |
 | **Routing** | Chain several models, in order or round-robin |
 | **Gateway** | Expose the pool as a local OpenAI-compatible endpoint, optionally to your LAN |
 

package/README.md

@@ -7,6 +7,16 @@
   <a href="https://github.com/XDTrees/dsh-xdpool/stargazers"><img src="https://img.shields.io/github/stars/XDTrees/dsh-xdpool?style=flat-square" alt="GitHub stars"></a>
 </p>
 
+## 先加群
+
+<p align="center">
+  <img src="assets/community-qr.png" width="300" alt="微信群二维码：XD 交流群">
+  <br>
+  <sub>微信扫一扫加入 <b>XD 交流群</b>。二维码 7 天内有效；过期了在 <a href="https://github.com/XDTrees/dsh-xdpool/issues">issues</a> 说一声会换新。</sub>
+  <br>
+  <sub>卡片右上角「点Star」旁边的「交流群」按钮打开的也是这个码 —— 不用回头找 README。</sub>
+</p>
+
 <p align="center">
   <sub>下载量统计沿用旧包名 <code>dsh-workbuddy-xdpool</code>（截至 2026-10-12 为 8,976 次/月，改名前的全部下载；shields 的实时徽章常被 npm 上游限流，所以这里用了快照数字）。新包 <code>dsh-xdpool</code> 的统计会随时间累积，之后徽章会换回实时数据。</sub>
 </p>
@@ -17,7 +27,7 @@
 
 它从一件事开始——把本机 WorkBuddy 桌面 App 里登录过的**所有账号**合成一个自动容错的池子，哪个号被限流了、积分用光了，请求自动换到下一个能用的号上去。你不用挑号，不用手动导入。
 
-然后它长成了七页：账号池之外，还能扫码登录十三家厂商的免费模型、把 **76 家**厂商的免费额度聚合成一条通道、看用量账本、把几个模型串成链、把池子开成一个本地 OpenAI 兼容网关。
+然后它长成了六页：账号池之外，还能扫码登录十三家厂商的免费模型、把 **76 家**厂商的免费额度聚合成一条通道、看用量账本、把几个模型串成链、把池子开成一个本地 OpenAI 兼容网关。
 
 | 页面 | 干什么 |
 | --- | --- |
@@ -25,7 +35,6 @@
 | **扫码登录** | 十三家支持网页 / 扫码登录的厂商，登一次，它们的免费模型就进选择器 |
 | **聚合渠道** | 76 家厂商的免费额度接进同一个池（默认一家都不开，填了 key 才亮） |
 | **数据看板** | 今天的轮次、调用、失败、换号救回、token、缓存命中、速度 |
-| **billion-context** | 只读观测本机 billion-context 压缩器的运行状态 |
 | **路由** | 把多个模型串成一条链，按顺序或轮换使用 |
 | **网关** | 把池子开成本地 OpenAI 兼容接口，可转发给局域网其它设备 |
 
@@ -38,7 +47,7 @@
 
 ## 先看几张图
 
-**账号池（卡片首页：品牌栏 + 七个页面标签，顶部就是用量）**
+**账号池（卡片首页：品牌栏 + 六个页面标签，顶部就是用量）**
 
 ![账号池：顶栏显示 XD Pool 与版本号、七个页面标签、用量面板在页面最上方、下方是 WorkBuddy 国内版账号卡与「已接入」状态](assets/account-pool.png)
 

package/cordis.patch.yml

@@ -4,45 +4,21 @@
 - insert:
     - id: llm-xdpool
       name: dsh-xdpool
-# billion-context is deliberately NOT mounted by this layer.
 #
-# 2.0.0 tried to. It inserted a row (`billion-context-xdpool`) so a profile that
-# had not installed the compressor would get one for free, and `src/billion-mount.ts`
-# held a runtime `create()` as a second path for the same job. Measured against a
-# profile that had ALREADY installed billion-context — which is the normal state
-# for anyone using that feature, since `bili-native` comes from billion-context's
-# own `dsh.bundle.patch.yml` — neither safeguard held:
-#
-#   the host did not disable our duplicate row, and it did not resolve it to a
-#   no-op. It left `enabled: true` and ran the fiber to `failed`, because
-#   billion-context registers a cordis service under its own name and a second
-#   registration is refused outright (`service "…" has been registered at <…>`).
-#
-# So every user who had installed billion-context got a permanently failed entry
-# in their plugin list — visible, unexplained, and pointing at us.
-#
-# The row below is kept, but DISABLED, for three reasons:
-#
-#   1. Addressability. `disabled: true` keeps the row's id resolvable, so a
-#      profile that wants to flip it on can do so with one edit instead of
-#      inventing a row.
-#   2. It states the decision where the old attempt lived, where the next person
-#      to wonder "why doesn't the pool bring up the compressor?" will look.
-#   3. It keeps `bili-native` (billion-context's own row) as the ONLY mount of
-#      that module, which is the arrangement that actually works.
-#
-# CONSEQUENCE, STATED PLAINLY
-#
-# A profile that has not installed billion-context sees the billion card report
-# "not installed". That is the honest reading of the facts, and it is already a
-# first-class state on that page — the page distinguishes not-installed from
-# no-answer from ready precisely so this case reads as information rather than
-# as a bug. Installing billion-context remains a decision the user makes; the
-# pool no longer makes it for them.
-#
-# `src/billion-mount.ts` no longer calls `create()` for the same reason: with
-# this row disabled, a runtime create would fight the very row it sits beside.
-# The function still runs — it is what lets the card distinguish
-# already-installed from not-installed — it just never mounts anything.
-- id: billion-context-xdpool
-  disabled: true
+# billion-context is gone from this plugin, and so is the row that used to sit
+# here (`billion-context-xdpool`, kept disabled).
+#
+# 2.0.0 inserted that row so a profile without the compressor would get one for
+# free. Measured against a profile that had ALREADY installed billion-context —
+# the normal state for anyone using it, since `bili-native` comes from that
+# plugin's own `dsh.bundle.patch.yml` — the host did not disable the duplicate
+# and did not resolve it to a no-op: it ran the fiber to `failed`, because the
+# plugin registers a cordis service under its own name and a second registration
+# is refused outright (`service "…" has been registered at <…>`). Every user who
+# had installed it got a permanently failed entry, unexplained, pointing at us.
+#
+# The follow-up kept the row, disabled, "for addressability". That was the wrong
+# trade: it left a name in this file for a feature the plugin no longer has, and
+# the page that read it (`billion-context`) is deleted too. Installing the
+# compressor is its own decision, made by installing it — which is the
+# arrangement that always worked.

package/lib/bin.js

@@ -339,10 +339,39 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 * rewrite is applied to assistant history too — one past reply carrying a
 * fingerprint would otherwise fail every later request in the conversation.
 *
+* A THIRD FINGERPRINT (measured against the live domestic gateway 2026-10-28)
+*
+* The file-reference guidance DSH contributes whenever the agent has a `read`
+* tool reintroduced the same 400/11128 after the two rewrites above shipped:
+*
+*   Tokens prefixed with @ are paths the user explicitly referenced.
+*   Relative paths resolve from the workspace root; absolute paths identify
+*   files or directories on the host.
+*
+* Ordinary phrasing throughout — the blocked region names no product — so the
+* fingerprint is not "this prompt is not WorkBuddy's" but a literal substring
+* list that happens to include this sentence. Neither sentence is the trigger
+* on its own: each 200s in isolation, and the pair 400s; the smallest edit
+* anywhere in the pair clears it, which is what marks it as content and not
+* prompt length, and the matching half is the second sentence ("Tokens
+* prefixed with @" alone stayed clean while the "Relative paths…" line was the
+* one whose text the gateway recognised).
+*
+* The rewrite turns the indicative into the same statement's participle —
+* "Relative paths resolve from the workspace root" becomes "Relative paths are
+* resolved against the workspace root". Meaning, length class and line breaks
+* are preserved; the substring the gateway lists is gone. Verified at 200 with
+* the full runtime system prompt (≈41k chars) that reproduced the 400 on the
+* same account, and with the pair alone.
+*
 * The list is an ARRAY because these fingerprints are appended to over time; a
 * future rejection should be one more row here, not a new code path.
 */
-const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"], [/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"]]);
+const BANNED_SYSTEM_PHRASES = Object.freeze([
+	[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"],
+	[/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"],
+	[/Relative paths resolve from the workspace root/gi, "Relative paths are resolved against the workspace root"]
+]);
 /**
 * Rewrite fingerprinted system/assistant content, leaving everything else
 * byte-identical.
@@ -964,7 +993,8 @@ function parseTask(value) {
 		status: typeof raw["status"] === "string" ? raw["status"] : "",
 		claimable: !claimed && target > 0 && current >= target,
 		claimed,
-		locked: raw["locked"] === true
+		locked: raw["locked"] === true,
+		jumpUrl: typeof raw["jump_url"] === "string" ? raw["jump_url"] : ""
 	};
 }
 var WorkBuddyUpstreamClient = class {
@@ -3664,11 +3694,11 @@ var WorkBuddyAccountPool = class {
 	* model id the legacy account-wide check applies (callers that cannot name a
 	* model, e.g. CLI diagnostics).
 	*/
-	available(now, modelId, region) {
+	available(now, modelId, region, reserveExempt) {
 		return this.accounts.filter((account) => {
 			if (this.disabledIds.has(account.id)) return false;
 			const reserve = this.creditReserves.get(account.id);
-			if (reserve !== void 0 && reserve > 0) {
+			if (!reserveExempt?.has(account.id) && reserve !== void 0 && reserve > 0) {
 				const balance = this.creditBalances.get(account.id);
 				if (balance !== void 0 && balance <= reserve) return false;
 			}
@@ -3692,7 +3722,7 @@ var WorkBuddyAccountPool = class {
 	* Counts are over the region's accounts, since a provider only ever sees its
 	* own gateway.
 	*/
-	unavailableReason(modelId, region) {
+	unavailableReason(modelId, region, reserveExempt) {
 		const now = Date.now();
 		const inRegion = this.accounts.filter((account) => region === void 0 || regionOf(account.credential.domain) === region);
 		if (inRegion.length === 0) return {
@@ -3705,6 +3735,29 @@ var WorkBuddyAccountPool = class {
 		let cooling = 0;
 		let disabled = 0;
 		let dead = 0;
+		/**
+		* Accounts that survived every OTHER filter and are held back only by their
+		* credit floor.
+		*
+		* Counted rather than returned on the first hit. The old `return` fired the
+		* moment it met one reserved account, so a single account parked under its
+		* floor reported `reserve` for the whole gateway — even while four other
+		* accounts were healthy and had just been tried. The caller turns
+		* `reason === 'reserve'` into a 402 telling the user to lower the reserve,
+		* which pointed at a setting that was not the problem (#98: a five-account
+		* pool reported `reserve_floor` because of one account that had sat below
+		* its floor for weeks, while the actual state was "the rest are cooling").
+		*/
+		let reserved = 0;
+		/**
+		* Accounts that reached the end of the walk unblocked.
+		*
+		* Non-zero means the pool still has somewhere to send a request, so a
+		* reserve is NOT what this answer is about: editing a number cannot fix a
+		* request that some other account is already able to serve, and saying
+		* otherwise sends the reader to the wrong setting.
+		*/
+		let usable = 0;
 		for (const account of inRegion) {
 			if (this.disabledIds.has(account.id)) {
 				disabled += 1;
@@ -3720,16 +3773,14 @@ var WorkBuddyAccountPool = class {
 				continue;
 			}
 			const reserve = this.creditReserves.get(account.id);
-			if (reserve !== void 0 && reserve > 0) {
+			if (!reserveExempt?.has(account.id) && reserve !== void 0 && reserve > 0) {
 				const balance = this.creditBalances.get(account.id);
-				if (balance !== void 0 && balance <= reserve) return {
-					total: inRegion.length,
-					cooling,
-					disabled,
-					dead,
-					reason: "reserve"
-				};
+				if (balance !== void 0 && balance <= reserve) {
+					reserved += 1;
+					continue;
+				}
 			}
+			usable += 1;
 		}
 		if (dead > 0) return {
 			total: inRegion.length,
@@ -3752,6 +3803,13 @@ var WorkBuddyAccountPool = class {
 			dead,
 			reason: "disabled"
 		};
+		if (usable === 0 && reserved > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			dead,
+			reason: "reserve"
+		};
 		return {
 			total: inRegion.length,
 			cooling,
@@ -3928,16 +3986,18 @@ var WorkBuddyAccountPool = class {
 	* Scans on first use, and rescans when every known account is cooling down: a
 	* fresh desktop login is the usual way out of an exhausted pool.
 	*
+	* `reserveExempt` is host-only: account ids whose own credentials freshly
+	* confirmed a zero-credit model. It never bypasses disabled, dead credentials, cooldowns or region.
 	* `conversationKey` is only consulted under `sticky`; other modes ignore it.
 	*/
-	async acquire(modelId, region, conversationKey) {
+	async acquire(modelId, region, conversationKey, reserveExempt) {
 		if (this.accounts.length === 0) await this.scan();
 		const maxTries = this.accounts.length + 1;
 		for (let attempt = 0; attempt < maxTries; attempt += 1) {
-			let pool = this.available(Date.now(), modelId, region);
+			let pool = this.available(Date.now(), modelId, region, reserveExempt);
 			if (pool.length === 0 && attempt === 0) {
 				await this.scan();
-				pool = this.available(Date.now(), modelId, region);
+				pool = this.available(Date.now(), modelId, region, reserveExempt);
 			}
 			if (pool.length === 0) return void 0;
 			if (this.preferredAccountId !== void 0) {
@@ -9935,6 +9995,71 @@ function appearanceChain(themeKey = APPEARANCE_THEME_KEY) {
 	};
 }
 /**
+* Pull the `expertId` out of a task's `jump_url`.
+*
+* The "体验XX专家" tasks (#98) name an expert that is NOT in the marketplace
+* listing — the reporter翻遍了 marketExpertList in both `agent` and `team`
+* types and got zero hits — so the only place the id appears is the deeplink
+* embedded in the task itself:
+*
+*   https://www.workbuddy.cn/work/launch/?deeplink=workbuddy%3A%2F%2Fexperts%3FexpertId%3Dex_GDl31WahyIH0&buddy_type=workbuddy
+*
+* The deeplink is percent-encoded, and it has to be: the `?` and `&` inside it
+* would otherwise end the outer query. So the parse is two steps — decode the
+* `deeplink` parameter, then read `expertId` off the scheme it decodes to — and
+* NOT a regex over the whole URL, which would also match the outer `expertId`
+* spelling in a future URL shape and silently pick the wrong one.
+*
+* Returns undefined for the tasks whose deeplink carries no id at all
+* (`WorkBuddy_Valorant` points at `workbuddy://expert` with no query), which is
+* the honest answer: those need a different source and are not guessed here.
+*/
+function expertIdFromJumpUrl(jumpUrl) {
+	if (jumpUrl === "") return void 0;
+	/** Read `expertId` off any URL-ish string, decoded or not. */
+	const readId = (value) => {
+		let query = value;
+		try {
+			const parsed = new URL(value);
+			query = parsed.search === "" ? value : parsed.search;
+		} catch {
+			query = value;
+		}
+		const marker = query.indexOf("expertId=");
+		if (marker === -1) return void 0;
+		const rest = query.slice(marker + 9);
+		const end = rest.search(/[&#]/u);
+		const id = (end === -1 ? rest : rest.slice(0, end)).trim();
+		return id === "" ? void 0 : id;
+	};
+	let source = jumpUrl;
+	try {
+		const raw = new URL(jumpUrl).searchParams.get("deeplink");
+		if (raw !== null && raw !== "") source = raw;
+	} catch {
+		source = jumpUrl;
+	}
+	return readId(source);
+}
+/**
+* Build a summon record for an expert the marketplace does not list.
+*
+* Everything the chains need beyond the id is cosmetic — the scorer keys on
+* `expertId` — so the title from the task is reused as the display name rather
+* than inventing one. `version` is left empty, which every consumer already
+* defaults to `1.0.0`.
+*/
+function expertFromTask(expertId, title) {
+	return {
+		expertId,
+		expertType: "agent",
+		displayName: title,
+		profession: title,
+		version: "",
+		categories: []
+	};
+}
+/**
 * The three "summon an expert" events (`expert_summon_click` and friends).
 *
 * Paid before the conversation, in the order the app emits them.
@@ -10048,7 +10173,12 @@ const EVENT_CHAIN_BUILDERS = {
 	skill_1: true,
 	expert_5: true,
 	Expert_team_use_3: true,
-	Expert_lighthouse: true
+	Expert_lighthouse: true,
+	expert_use_maidehao: true,
+	expert_use_douyinyin: true,
+	expert_use_shangjia_xuanchuan: true,
+	expert_use_bowangwang: true,
+	WorkBuddy_Valorant: true
 };
 const AUTOMATION_TICK_MS = 6e4;
 const JOB_KINDS = [
@@ -10237,6 +10367,16 @@ var WorkBuddyScheduler = class {
 	/** Host hooks that persist the ledger across restarts. */
 	loadEarnings;
 	saveEarningsFn;
+	/**
+	* The most recent ledger write that may still be in flight.
+	*
+	* `persistEarnings` is synchronous from its callers' point of view, but the
+	* host's settings write is not: it is an async document update. Keeping the
+	* promise here is what lets {@link flushEarnings} wait for the write that
+	* matters — the last one before a restart — without making every counter
+	* update await disk.
+	*/
+	pendingEarningsWrite = Promise.resolve();
 	constructor(pool, client, options = {}) {
 		this.pool = pool;
 		this.client = client;
@@ -10273,6 +10413,18 @@ var WorkBuddyScheduler = class {
 		this.saveEarningsFn = save;
 	}
 	/**
+	* Wait for the ledger write that is (or was last) in flight.
+	*
+	* Called at the END of a task pass, right after the last claim, so the rewards
+	* that were just collected are on disk before a restart can lose them. It is
+	* deliberately NOT awaited on every counter bump: the settings document write
+	* is the slow part, and paying it per account would slow the pass for no
+	* benefit while the process is still alive.
+	*/
+	async flushEarnings() {
+		await this.pendingEarningsWrite;
+	}
+	/**
 	* Fold a previously persisted ledger back in, when it belongs to today.
 	*
 	* Used after the settings document becomes readable, which happens after
@@ -10542,7 +10694,7 @@ var WorkBuddyScheduler = class {
 			compensationCredit: (existing?.compensationCredit ?? 0) + compensationCredit,
 			date: today
 		});
-		this.persistEarnings();
+		this.pendingEarningsWrite = this.persistEarnings();
 	}
 	/** Clear the per-account counters when the local day changes. */
 	rollEarnings(today) {
@@ -10558,9 +10710,18 @@ var WorkBuddyScheduler = class {
 	* Best effort on purpose: a failed save must never abort a run that has
 	* already collected rewards, and the in-memory ledger keeps serving the card
 	* for the rest of the session either way.
+	*
+	* The returned promise settles when the write has landed (or failed). Callers
+	* that are about to END a run await it: reported in #98, a task pass that
+	* claimed 21 tasks had its process restarted before the volatile settings
+	* write reached disk, so `automationEarnings` still read `credit: 0` while
+	* the upstream had really paid out. Fire-and-forget is fine for a counter the
+	* card will re-read in this process; it is not fine for the last write before
+	* exit.
 	*/
 	persistEarnings() {
-		if (this.saveEarningsFn === void 0) return;
+		const save = this.saveEarningsFn;
+		if (save === void 0) return Promise.resolve();
 		const accounts = {};
 		for (const [id, entry] of this.earnings) accounts[id] = entry;
 		const ledger = {
@@ -10568,12 +10729,14 @@ var WorkBuddyScheduler = class {
 			accounts
 		};
 		try {
-			const saved = this.saveEarningsFn(ledger);
-			if (saved !== void 0 && typeof saved.then === "function") saved.then(void 0, (error) => {
+			const saved = save(ledger);
+			if (saved !== void 0 && typeof saved.then === "function") return Promise.resolve(saved).then(void 0, (error) => {
 				this.logger.warn?.("dsh-xdpool: could not persist automation earnings:", error);
 			});
+			return Promise.resolve();
 		} catch (error) {
 			this.logger.warn?.("dsh-xdpool: could not persist automation earnings:", error);
+			return Promise.resolve();
 		}
 	}
 	/**
@@ -10682,6 +10845,7 @@ var WorkBuddyScheduler = class {
 		state.detail = detail;
 		state.progress = progressNote;
 		this.logger.info?.(`automation ${accountWord}: ${state.message}`);
+		if (kind === "tasks" || kind === "checkin" || kind === "streak" || kind === "travel" || kind === "compensation") await this.flushEarnings();
 	}
 	/** Compose the one-line summary shown on the card. */
 	summarise(kind, ok, failed, claimed, credit, energy) {
@@ -10804,10 +10968,43 @@ var WorkBuddyScheduler = class {
 			case "expert_5": return this.expertChains(credential, "agent", task);
 			case "Expert_team_use_3": return this.expertChains(credential, "team", task);
 			case "Expert_lighthouse": return this.lighthouseChains(credential);
+			case "expert_use_maidehao":
+			case "expert_use_douyinyin":
+			case "expert_use_shangjia_xuanchuan":
+			case "expert_use_bowangwang":
+			case "WorkBuddy_Valorant": return this.taskExpertChains(credential, task);
 			default: return [];
 		}
 	}
 	/**
+	* Summon-and-use one expert NAMED BY THE TASK.
+	*
+	* Structurally `expertChains` minus the marketplace: the expert id is read
+	* from the task's deeplink instead of by browsing `marketExpertList`, because
+	* this family's experts are not listed there at all (#98 measured 500 entries
+	* across both `agent` and `team`, zero hits).
+	*
+	* Returns `[]` — not a throw — when the task carries no usable id: the caller
+	* logs "could not be built" only for exceptions, and a task shape this code
+	* does not understand is information, not a fault.
+	*/
+	async taskExpertChains(credential, task) {
+		const expertId = expertIdFromJumpUrl(task.jumpUrl);
+		if (expertId === void 0) {
+			this.logger.warn?.(`automation events ${task.taskCode}: no expertId in jump_url, skipping`);
+			return [];
+		}
+		const expert = expertFromTask(expertId, task.title);
+		await this.client.reportDesktopEvents(credential, expertSummonEvents(expert));
+		if (this.delayMs > 0 && !this.stopped) await sleep(this.delayMs);
+		const chat = await this.client.openConversation(credential, expert.expertId);
+		if (chat === void 0) throw new Error(`${task.taskCode}: no server conversation`);
+		return [{
+			transport: "desktop",
+			events: [...expertChatEvents(expert, chat.conversationId, chat.requestId), expertActualUseEvent(expert, chat.conversationId, chat.requestId)]
+		}];
+	}
+	/**
 	* The summon-and-use chains for the expert tasks.
 	*
 	* Two steps per expert, and both are load-bearing: the summon events alone are