dsh-xdpool 2.6.1 → 2.6.3

package/CHANGELOG.md

@@ -1,15 +1,119 @@
 # Changelog
 本项目的所有重要变更都会记录在此文件。
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
-## 2.6.1 — 交流群二维码就地展开在标签栏下方
+## 2.6.3 — 修掉 2.6.2 装上后插件起不来的问题
 
-> 反馈是「一直在最底部出现不直观，我要的是就在我点击的这个箭头这里出现」。改了三版才对：`absolute` 贴 shell（跑到页面中部）、`fixed` 视口居中（技术上正确但不是需求），最后改成**跟随文档流、紧跟标签栏**的就地展开。
+> 2.6.2 从 npm 安装后，插件导入失败（`Cannot find package '@earendil-works/pi-ai'`），
+> 于是它的所有 web 路由都没注册 —— 积分接口 404，用量面板空白，并显示
+> 「网关尚未上报 token 数」。这句话把问题指向了网关，实际是插件自己没加载起来。
 
-这是一个 disclosure，不是弹窗：没有遮罩、没有定位、没有居中。打开时把下面的面板按它自己的高度往下推，于是二维码就出现在按钮正下方 —— 和这张卡片上其他折叠面板的行为一致，也是唯一能让答案贴着问题的做法。
+### 缺 7 个 peer 依赖
 
-- 去掉 `aria-modal`：没有遮罩却声称是 modal，会让读屏软件以为交互被挡住了，那是假话
-- 没有背景可点，关闭由 × 按钮承担；Esc 仍然有效（键盘打开的东西必须能从键盘关掉）
-- 渲染检查加了断言：面板必须出现在 `</nav>` 与页面主体**之间**，以后重构不能又把它挂到末尾
+2.6.2 有 7 个 peerDependency（`cordis`、`dsh-llm`、`dsh-llm-pi-ai`、`dsh-credentials`、
+`dsh-settings`、`schemastery`、`pi-ai`），这些由宿主提供。手动复制目录时它们从宿主的
+`node_modules` 可见；改用包管理器安装后，解析链断了。
+
+现在 `postinstall` 会把这些包从宿主链接进 profile，版本与宿主完全一致，不额外占用空间。
+装完自带一次导入自检，失败会直接把原因写进日志，而不是等用户看到空白面板才发现。
+
+### 今日用量的三个缺陷
+
+**日期用了 UTC**：`toISOString()` 取的是 UTC 日期，在 UTC+8 意味着凌晨 0–8 点算成前一天。
+现在按本地日历取值。
+
+**`days: 1` 实际覆盖两天**：窗口下界原先减了整个 `days`，于是「今日」包含了昨天。
+改成 `days - 1`，标签与口径一致。
+
+**重启后归零**：`UsageRecorder` 只存内存，重启即空。现在启动时从渠道包的持久账本
+（保留 90 天）回填当天用量 —— 那些数据一直在磁盘上，只是从没被读回来。
+回填是尽力而为的：读不到只损失重启前的数字，不影响插件。
+
+## 2.6.2 — 积分统计、账号备份、输入框积分显示
+
+> 这一版把「用了多少积分」「还剩多少」「账号怎么搬走」三件事做完了，并修掉了几个把正确数据说错的地方。
+
+### 积分消耗：按官方的三段系数算，不再用倍率当单价
+
+模型选择器上的 `x0.11` 是一个**显示倍率**，不是每百万 token 的单价。真实计费是三段系数：
+
+```
+积分 = 未命中缓存的输入 × 输入系数 + 缓存命中 × 缓存系数 + 输出 × 输出系数
+```
+
+系数单位是「积分 / 百万 token」，同一模型三段差别很大（DeepSeek-V4.1-Flash 是 14.29 / 0.29 / 57.1）。
+
+按旧算法（总 token × 倍率），一天 355 万输入 + 2.88 亿缓存 + 36 万输出会被算成 **0.43 积分**，实际是 **155 积分** —— 差 360 倍。原因有两个：把显示倍率当成了单价，以及**完全没读缓存字段**。agent 类使用里缓存命中常占 95% 以上，忽略它就等于漏掉大部分账单。
+
+- 13 个模型的实测系数写进 `credits.ts`，标注测量日期（`2026-11-06`）
+- 读取账本里的 `cacheReadTokens`，按缓存档单独计费
+- 未收录的模型显示「未定价」，不按猜的价格计费
+- 模型 id 大小写、厂商前缀都能匹配（`DeepSeek-V4.1-Flash`、`nvidia/xxx`）
+- 只统计账号池自己的用量（`direct`），网关反代的流量单独计数、不计入
+
+### 输入框旁加了积分显示
+
+位置：**输入框那一行，模型名旁边**。一个池子图标，绿色表示还有积分，灰色表示用完；点开看剩余积分、今日已用和当前模型。
+
+### 账号备份：独立的第七个功能页
+
+导出加密文件，导入时整体替换。
+
+- 加密在浏览器里完成：PBKDF2-SHA256（31 万轮）+ AES-GCM-256，salt 和 IV 每次重新生成
+- 密码至少 8 位，不足直接拒绝导出
+- 密码错和文件损坏合并成一句话 —— 区分会泄露「猜对了没有」
+- 导入前弹确认，用 `backup.status` 报出将替换几个账号
+- 仍接受旧的未加密文件，不让早期导出的人被卡住
+- 一个按钮完成「选文件 + 导入」，不再是两步
+
+### 商汤的登录奖励
+
+`credits.claimAll` 对 Raccoon 明确拒绝，原文是「每日积分由服务端自动发放；登录奖励请在「新手任务」中领取」—— 但它只是把提示当错误返回。真正的入口是独立端点 `onboarding.claim`，pack 里早已实现，只是客户端从未调用。
+
+现在有「领取一次性奖励」按钮，对 Raccoon 和 Loomy 生效，按账号逐个领取。
+
+### CodeArts：三个缺陷
+
+**403 被当成凭据问题**（沿用 2.6.0 的修复并延续）：网关对 User-Agent 的 WAF 判定也会回 403，而 `403 → AUTH` 的规则会让一个请求头问题被报成「API 密钥无效」。CodeArts 那条已按 body 区分，其余厂商不动（对多数厂商 403 确实是凭据问题）。
+
+**被用掉的 refresh token 没有归入「凭据失效」**：`requestToken` 只认 `invalid_grant` 和 `ExpiredRefreshToken`，`STS5.1806`（`the refresh token has been used`）落到普通错误分支。而代码里**早就写好了**处理这种情况的逻辑 —— `instanceof RefreshTokenExpiredError` 会重读凭据，token 已被别处轮换时对账并**不**标记为死。错误没带着正确的类型到达那里，所以用户看到的只是一串看不懂的 400。
+
+华为 STS 的 refresh token 是**一次性**的：用过即作废并签发新的，所以「已被使用」意味着并发重放，或新 token 没存住。
+
+**过期的凭据不自愈**：STS 凭据寿命约 2 小时，refresh token 约 30 天。一个因模型请求失败而被 failover 走的账号，永远不再进入调度器「1 小时内到期」的续期窗口，于是一直躺在一个可续期的过期状态里。现在自愈挂在三条读凭据的 RPC 共享入口（余额、签到状态、领取），走与调度器同一条 per-ref 串行队列，避免并发消费同一个 token。
+
+### 路由
+
+- **限流靠后**：还有额度却被 429 的账号，排到所有未限流的后面。之前它和「额度耗尽」被同等对待，而两者该给的回应不同
+- **休息不丢弃**：被拒的账号排最后，但**只剩它时仍然尝试**，而不是直接失败
+- **未知账户先试一次**：从未读过余额的账号在 `priority` 模式下优先一次，让它的答案把额度填上
+- **只认 `ready` 档**：策略在 `ready` 池里选，`limited`/`resting` 只有在 `ready` 空时才成为候选 —— 否则按权重抽取的策略可能跳过一个健康账号去选冷却中的
+- 修掉了「均衡模式下、有健康账号时仍可能选到冷却账号」
+- 链可以选到扫码登录渠道（`<channel>:<model>`），走宿主适配器，与聚合渠道严格区分（凭据、错误词汇、代码路径都不同）
+- 两级结构：先选平台，平台内再排模型
+
+### 网关
+
+- **模型 id 可点击复制**，点它不会误触勾选框（那一行是 `<label>`，不阻止就会把刚复制的模型取消勾选）
+- **base URL 提供两种写法** —— 客户端自己补 `/v1` 的和要填完整前缀的，各自标注适用场景。之前只给带 `/v1` 的，遇到自己补 `/v1` 的客户端就成了 `/v1/v1/responses`
+- 明确写出只支持 Chat Completions；用 Responses 或 Anthropic 协议会拿到 404
+- 按渠道分组时显示每个模型的倍率
+- **`EADDRINUSE` 翻译成可操作的说明**：`listen EADDRINUSE` 本身只说现象。最常见原因不是「别的程序占了端口」，而是**上一个 DSH 还没完全退出**，仍占着自己开的网关端口 —— 所以提示是「稍等重试，或换个端口」
+- 复制按钮带降级：`navigator.clipboard` 在非安全上下文（局域网 http）里是 `undefined` 而非拒绝，所以有 `execCommand` 兜底，两条都不行就明确报失败
+
+### 界面
+
+- 交流群二维码改成**就地展开**在标签栏下方，不再是弹窗
+- 密码字段、复制按钮、进度条等控件的样式统一
+- 样式按页面分组导致的失效问题修复了两处（圆点、备份面板）—— 跨页面组件现在自带样式表
+
+### 其它
+
+- 渠道池首屏 `provider.status` 加 30 秒缓存（一次请求要数 13 个渠道的账号）
+- 免密 lane 默认关闭
+- 同模型多线路优先（限流时换线路拿同一模型，而不是换模型）
+- 熔断后的账号靠探测复活，探测成功才解除
+- 自定义 OpenAI 兼容端点
+- 凭据文件权限收紧到仅本人可读
 
 ## 2.6.0 — 一次收掉 2.5.1 之后的全部改动
 

package/lib/bin.js

@@ -1,6 +1,6 @@
 import { createDecipheriv, createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
-import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, writeFile, writeFile as writeFile$1 } from "node:fs/promises";
+import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, unlink, writeFile, writeFile as writeFile$1 } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
@@ -3404,12 +3404,46 @@ async function cheapIdentityIdFromFile(path) {
 	}
 }
 /**
+* The `uin` of a credential file, read WITHOUT the expiry gate.
+*
+* `parseWorkBuddyAuth` deliberately refuses an expired document, which is exactly the
+* state this is asked about — so the identity has to come from the raw JSON. `uin` and not
+* `uid`: `uin` is the billing identity, so two sign-ins of one person match even when the
+* desktop app wrote them from different installs.
+*/
+async function cheapUinFromFile(path) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(path, "utf8"));
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const document = parsed;
+	const uin = (typeof document["account"] === "object" && document["account"] !== null ? document["account"] : document)["uin"];
+	return typeof uin === "string" && uin !== "" ? uin : void 0;
+}
+/**
 * Why a file could not become an account.
 *
-* Distinguishing "encrypted" matters most: it is actionable (start the desktop
-* app, or set the executable override), whereas "malformed" means the file is
-* simply not a credential. Reporting them alike would send the user looking for
-* a fix that cannot work.
+* The distinctions matter because the REMEDIES differ, and a wrong label sends the reader
+* after a fix that cannot work:
+*
+*   - `encrypted`   — the desktop app holds the key; start it, or set the executable
+*                     override. Actionable.
+*   - `expired`     — the file IS a credential, correctly formed, whose refresh window has
+*                     closed. Nothing to fix: sign in again, or delete the snapshot. This
+*                     used to be reported as `malformed`, which reads as "this file is not
+*                     a credential" and sends the user looking for a format problem that
+*                     does not exist — the reported confusion over three 2026-10-08
+*                     snapshots whose tokens had simply aged out.
+*   - `unreadable`  — the bytes could not be read at all.
+*   - `malformed`   — genuine: unparseable, or parseable but not a credential shape.
+*
+* `expired` is decided by re-parsing the document the same way `parseWorkBuddyAuth` does,
+* which is the only way to tell "a credential that aged out" from "not a credential". A
+* document that parses as JSON but carries no token stays `malformed`: those are three
+* different facts and collapsing any two of them costs the reader the diagnosis.
 */
 async function skipReasonFor(path) {
 	let text;
@@ -3419,12 +3453,28 @@ async function skipReasonFor(path) {
 		return "unreadable";
 	}
 	if (text.includes("\"$wbEncrypted\"")) return "encrypted";
+	let parsed;
 	try {
-		JSON.parse(text);
-		return "malformed";
+		parsed = JSON.parse(text);
 	} catch {
 		return "malformed";
 	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return "malformed";
+	const document = parsed;
+	const auth = typeof document["auth"] === "object" && document["auth"] !== null ? document["auth"] : document;
+	const token = auth["accessToken"];
+	if (typeof token !== "string" || token === "") return "malformed";
+	/**
+	* It HAS a token, so the only remaining reason to skip it is a closed refresh window.
+	* Mirrors the guard in `parseWorkBuddyAuth`, and falls back to `malformed` when the
+	* window cannot be read — an unknown expiry is not evidence of expiry.
+	*/
+	const refreshRaw = auth["refreshExpiresAt"];
+	if (typeof refreshRaw === "number") {
+		const refreshAt = expiryToMs(refreshRaw);
+		if (refreshAt > 0 && refreshAt < Date.now()) return "expired";
+	}
+	return "malformed";
 }
 /**
 * Build the field opener, or undefined when the app cannot supply its key.
@@ -3726,6 +3776,46 @@ var WorkBuddyAccountPool = class {
 	skippedFilesInOrder() {
 		return this.skippedFiles;
 	}
+	/**
+	* Delete expired snapshots that a newer credential for the same account supersedes.
+	*
+	* Returns the paths actually removed. See the call site for the full safety rule; the
+	* short version is that it touches ONLY files classified `expired`, ONLY when the same
+	* `uin` is already served by a different (loaded) file, and never a live file.
+	*
+	* `uin` rather than `uid`: it is the billing identity, so two sign-ins of one person
+	* match even when the desktop app wrote them from different installs. A file whose
+	* identity cannot be read is left alone — deleting a credential on a guess is worse than
+	* keeping a dead one on the card.
+	*/
+	async pruneExpiredSnapshots(skipped, loaded) {
+		const expired = skipped.filter((entry) => entry.reason === "expired");
+		if (expired.length === 0) return [];
+		const liveNames = /* @__PURE__ */ new Set([WORKBUDDY_LIVE_FILENAME, "workbuddy-desktop-ai.info"]);
+		/**
+		* The identities already served by a file that loaded in this same scan.
+		*
+		* Taken from the parsed credentials rather than by re-reading each file: `found`
+		* already carries `uin`, and a second read of a file that just parsed would only add a
+		* chance to fail.
+		*/
+		const servedUins = /* @__PURE__ */ new Set();
+		for (const credential of loaded) if (credential.uin !== void 0 && credential.uin !== "") servedUins.add(credential.uin);
+		if (servedUins.size === 0) return [];
+		const removed = [];
+		for (const entry of expired) {
+			if (liveNames.has(basename(entry.path))) continue;
+			const uin = await cheapUinFromFile(entry.path);
+			if (uin === void 0 || !servedUins.has(uin)) continue;
+			try {
+				await unlink(entry.path);
+				removed.push(entry.path);
+			} catch (error) {
+				this.logger?.warn?.(`dsh-xdpool: could not remove expired snapshot ${entry.path}: ${String(error)}`);
+			}
+		}
+		return removed;
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
@@ -3752,6 +3842,33 @@ var WorkBuddyAccountPool = class {
 		}
 		this.skippedFiles = skipped;
 		if (skipped.length > 0) this.logger?.warn?.(`dsh-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
+		/**
+		* Remove expired snapshots whose account is served by a newer credential.
+		*
+		* A rotated sign-in leaves the old snapshot on disk forever: the desktop app writes a
+		* new `workbuddy-desktop.<ts>.<pid>.<uuid>.info` each time and never deletes the
+		* previous one. Within a month every one of them passes its `refreshExpiresAt` and the
+		* card starts listing a growing pile of "expired" files the user cannot act on —
+		* they are dead weight from a sign-in that already succeeded.
+		*
+		* The safety rule is narrow on purpose, because deleting a credential file is
+		* destructive and the auth directory belongs to another application:
+		*
+		*   - ONLY files this scan classified as `expired` — never `encrypted`, `unreadable`
+		*     or `malformed`, which may be the very file holding a working key;
+		*   - ONLY when the SAME account (by `uin`, the billing identity) was loaded from a
+		*     DIFFERENT file, i.e. a newer credential exists to serve it;
+		*   - never the live `workbuddy-desktop.info` / `workbuddy-desktop-ai.info`, which the
+		*     running app owns and rewrites.
+		*
+		* Anything skipped for not meeting all three is left alone and keeps its entry on the
+		* card, so the user still learns it is there.
+		*/
+		const cleaned = await this.pruneExpiredSnapshots(skipped, found);
+		if (cleaned.length > 0) {
+			this.skippedFiles = skipped.filter((entry) => !cleaned.includes(entry.path));
+			this.logger?.info?.(`dsh-xdpool: removed ${cleaned.length} expired credential snapshot(s) superseded by a newer sign-in`);
+		}
 		if (this.externalSource !== void 0) try {
 			const external = await this.externalSource();
 			for (const credential of external) {
@@ -3855,6 +3972,86 @@ var WorkBuddyAccountPool = class {
 		});
 	}
 	/**
+	* The pool ordered into three bands, so a resting account is deferred instead of
+	* discarded.
+	*
+	* `available()` answers a binary question, and a binary answer loses the
+	* distinction that matters most when a pool is under pressure:
+	*
+	*   - an account that still HAS credits but was rate-limited a moment ago is
+	*     healthy — it should be tried AFTER the others, not treated as gone;
+	*   - an account resting after a failure is the last resort, but it is still a
+	*     resort: when it is the only one, trying it beats failing the request.
+	*
+	* A pool that drops both from the list turns "every account is cooling for
+	* twenty more seconds" into an error the user reads as "no account available",
+	* which is a different and much more alarming statement.
+	*
+	* The bands:
+	*
+	*   1. `ready`    — passes every gate `available()` checks.
+	*   2. `limited`  — region-eligible and not disabled/reserved, but cooling for
+	*                   this model or account-wide. Ordered by when it comes back,
+	*                   so the account that recovers first is spent first.
+	*   3. `resting`  — sign-in was rejected by the upstream. It never heals on a
+	*                   timer, so it is only tried when 1 and 2 are both empty.
+	*
+	* `disabled` and `reserve` accounts appear in NO band: those are user choices,
+	* and overriding them is not resilience, it is ignoring an instruction.
+	*
+	* Kept separate from `available()` rather than replacing it, so the binary
+	* question still has a binary answer for callers that want one (diagnostics,
+	* the status document) without either copy drifting from the other.
+	*/
+	rankedPool(now, modelId, region, reserveExempt) {
+		const ready = [];
+		const limited = [];
+		const resting = [];
+		for (const account of this.accounts) {
+			if (this.disabledIds.has(account.id)) continue;
+			const reserve = this.creditReserves.get(account.id);
+			if (!reserveExempt?.has(account.id) && reserve !== void 0 && reserve > 0) {
+				const balance = this.creditBalances.get(account.id);
+				if (balance !== void 0 && balance <= reserve) continue;
+			}
+			if (region !== void 0 && regionOf(account.credential.domain) !== region) continue;
+			const deadUntil = account.credentialDeadUntilMs ?? 0;
+			const coolUntil = account.cooldownUntilMs;
+			const modelUntil = modelId === void 0 ? 0 : account.modelCooldowns[modelId] ?? 0;
+			if (deadUntil > now) {
+				resting.push(account);
+				continue;
+			}
+			/**
+			* Only a MODEL-level cooldown earns a retry; an account-wide one does not.
+			*
+			* The distinction is what keeps the tier honest. A 429 on one model leaves
+			* the account working for every other model, so trying it again for a
+			* different model is reasonable and often succeeds. An account-wide cooldown
+			* (credits exhausted, quota wall) means the gateway has already said no to
+			* this account as a whole — retrying it spends a round trip to be told the
+			* same thing, and the caller then reports 502 where the truthful answer was
+			* 429. That degradation is worse than the resilience is worth, so the
+			* account-wide case stays out of play entirely.
+			*/
+			if (coolUntil > now) continue;
+			if (modelUntil > now) {
+				limited.push({
+					account,
+					backAt: modelUntil
+				});
+				continue;
+			}
+			ready.push(account);
+		}
+		limited.sort((a, b) => a.backAt - b.backAt);
+		return {
+			ready,
+			limited: limited.map((entry) => entry.account),
+			resting
+		};
+	}
+	/**
 	* Why no account is available right now, for an accurate error.
 	*
 	* The pool can be empty for reasons that need OPPOSITE remedies: nobody is
@@ -4139,27 +4336,82 @@ var WorkBuddyAccountPool = class {
 		if (this.accounts.length === 0) await this.scan();
 		const maxTries = this.accounts.length + 1;
 		for (let attempt = 0; attempt < maxTries; attempt += 1) {
-			let pool = this.available(Date.now(), modelId, region, reserveExempt);
-			if (pool.length === 0 && attempt === 0) {
+			let bands = this.rankedPool(Date.now(), modelId, region, reserveExempt);
+			if (bands.ready.length === 0 && bands.limited.length === 0 && bands.resting.length === 0 && attempt === 0) {
 				await this.scan();
-				pool = this.available(Date.now(), modelId, region, reserveExempt);
+				bands = this.rankedPool(Date.now(), modelId, region, reserveExempt);
 			}
-			if (pool.length === 0) return void 0;
+			/**
+			* Fall through the bands, in order — but the fall-through is a STAGE, not a
+			* concatenation, and only `ready` is offered to the strategy when it is
+			* non-empty.
+			*
+			* This distinction is the whole correctness of the change. A strategy like
+			* `balanced` draws from the pool by weight and does not read the order at
+			* all, so handing it `[...ready, ...limited]` would let it pick a cooling
+			* account while a healthy one was sitting right there — silently breaking
+			* the promise "a cooling account is never chosen while a healthy one
+			* exists".
+			*
+			* The wider rule: a band is only tried when every earlier band is EMPTY.
+			* That keeps the truthful error intact — "every account is cooling for this
+			* model" must stay a 429 answered without touching the transport, not a
+			* round trip that comes back 502. Resilience is a last resort, not a
+			* preference, and a pool where nothing is ready has already told the caller
+			* exactly what is wrong.
+			*/
+			const stages = bands.ready.length > 0 ? [bands.ready] : [];
+			if (stages.length === 0) return;
 			if (this.preferredAccountId !== void 0) {
-				const preferred = pool.find((account) => account.id === this.preferredAccountId);
+				const preferred = bands.ready.find((account) => account.id === this.preferredAccountId);
 				if (preferred !== void 0 && await this.ensureFresh(preferred)) return preferred;
 			}
 			if (this.distribution === "sticky") {
-				const bound = this.affinityAccount(pool, conversationKey);
+				const bound = this.affinityAccount(bands.ready, conversationKey);
 				if (bound !== void 0 && await this.ensureFresh(bound)) return bound;
 			}
-			const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : this.distribution === "expiry" ? this.pickByExpiry(pool) : pool[0];
-			if (account === void 0) return void 0;
-			if (!await this.ensureFresh(account)) continue;
-			if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
-			return account;
+			/**
+			* An account whose balance has never been read goes first, ONCE — but only
+			* under `priority`.
+			*
+			* The reasoning is `priority`-specific: that mode drains one account at a
+			* time, so a fresh account appended to the pool would sit untouched behind an
+			* account that is nearly spent, and the pool would never learn what the new
+			* one has. Trying it once makes its own answer fill in the blank.
+			*
+			* `round-robin`, `balanced`, `sticky` and `expiry` already reach a new
+			* account by their own rule — the cursor walks to it, the weight draw will
+			* eventually pick it, a new conversation moves on to it — so jumping the
+			* queue here would not add information, it would only override the
+			* distribution the user chose. That was a real regression: it pinned every
+			* rotation to the first unprobed account.
+			*
+			* Restricted to `ready` as well: an account that is cooling is not made more
+			* attractive by being unknown, and probing it would spend a request to learn
+			* a number that does not change whether it can answer.
+			*/
+			const probe = this.distribution === "priority" && bands.ready.length > 1 ? bands.ready.find((account) => !this.creditBalances.has(account.id)) : void 0;
+			if (probe !== void 0 && this.isStageEligible(probe, bands)) {
+				if (await this.ensureFresh(probe)) return probe;
+			}
+			for (const pool of stages) {
+				const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : this.distribution === "expiry" ? this.pickByExpiry(pool) : pool[0];
+				if (account === void 0) continue;
+				if (!await this.ensureFresh(account)) continue;
+				if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
+				return account;
+			}
 		}
 	}
+	/**
+	* Whether an account belongs to a band that is currently in play.
+	*
+	* Only `ready` accounts are eligible for the probe shortcut: picking a resting
+	* account ahead of a healthy one is the very thing the bands exist to prevent.
+	*/
+	isStageEligible(account, bands) {
+		return bands.ready.includes(account);
+	}
 	/** How the pool currently spreads requests. Shown on the card. */
 	currentDistribution() {
 		return this.distribution;
@@ -11637,6 +11889,7 @@ Object.freeze({
 	"Drop pleasantries, repetition and superseded attempts.",
 	"Write the briefing only — no preamble, no markdown fence."
 ].join("\n");
+join("channel-pack", "token-ledger.json");
 //#endregion
 //#region src/status.ts
 /** Format the per-model credit multipliers. */