feat(pool): persist cooldowns, honour retryAfterSeconds, show pool state in console

- pool state (cooldown_until + last_error) persisted to <dataRoot>/pool_state.json
  and restored on startup, so a restart does not immediately retry a known-dead account
- LoadState runs after all slots are added (constructing an empty pool and loading
  matched nothing)
- CooldownFor prefers upstream retryAfterSeconds (e.g. 10605 gateway-busy queue)
  capped at 5m instead of cooling the account for 30m
- console account list shows a 可用/冷却中 <remaining> badge with the last error,
  plus a manual 冷却 button

Author: LeonardW-sl

internal/bridge/pool.go

@@ -1,8 +1,11 @@
 package bridge
 
 import (
+	"encoding/json"
 	"errors"
 	"net/http"
+	"os"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -72,13 +75,99 @@ func (s *Slot) noteSuccess() {
 
 // Pool 是账号池：轮询选号，跳过冷却中与已试过的账号。
 type Pool struct {
-	mu     sync.Mutex
-	slots  []*Slot
-	cursor int
+	mu        sync.Mutex
+	slots     []*Slot
+	cursor    int
+	statePath string // 非空时把冷却状态持久化到该文件（重启不丢）
 }
 
 func NewPool(slots ...*Slot) *Pool { return &Pool{slots: slots} }
 
+// NewPoolWithState 创建带持久化的账号池：先从 statePath 载入冷却状态，
+// 之后每次冷却 / 恢复都会写回，使重启不丢失冷却（避免重启后立刻再撞
+// 已知失效的账号）。
+func NewPoolWithState(statePath string, slots ...*Slot) *Pool {
+	p := &Pool{slots: slots, statePath: statePath}
+	p.load()
+	return p
+}
+
+// poolState 是落盘的池状态（仅保存需要跨重启保留的字段）。
+type poolState struct {
+	Slots map[string]slotState `json:"slots"`
+}
+
+type slotState struct {
+	CooldownUntil time.Time `json:"cooldown_until"`
+	LastError     string    `json:"last_error,omitempty"`
+}
+
+// LoadState 从磁盘恢复冷却状态。必须在账号全部 Add 之后调用——
+// 构造时空池 load 匹配不到任何 ID（这正是先前重启丢冷却的原因）。
+func (p *Pool) LoadState() { p.load() }
+
+// load 从磁盘恢复冷却状态（仅恢复尚未过期的冷却）。
+func (p *Pool) load() {
+	if p == nil || p.statePath == "" {
+		return
+	}
+	data, err := os.ReadFile(p.statePath)
+	if err != nil {
+		return
+	}
+	var st poolState
+	if json.Unmarshal(data, &st) != nil {
+		return
+	}
+	now := time.Now()
+	restored := 0
+	for _, s := range p.snapshot() {
+		e, ok := st.Slots[s.ID]
+		if !ok {
+			continue
+		}
+		s.mu.Lock()
+		if e.CooldownUntil.After(now) {
+			s.cooldownUntil = e.CooldownUntil
+			restored++
+		}
+		s.lastErr = e.LastError
+		s.mu.Unlock()
+	}
+	if restored > 0 {
+		logger.Info("pool: restored %d cooling account(s) from %s", restored, p.statePath)
+	}
+}
+
+// save 原子写回池状态（临时文件 + rename）。
+func (p *Pool) save() {
+	if p == nil || p.statePath == "" {
+		return
+	}
+	st := poolState{Slots: map[string]slotState{}}
+	for _, s := range p.snapshot() {
+		s.mu.Lock()
+		until := s.cooldownUntil
+		lastErr := s.lastErr
+		s.mu.Unlock()
+		if !until.IsZero() || lastErr != "" {
+			st.Slots[s.ID] = slotState{CooldownUntil: until, LastError: lastErr}
+		}
+	}
+	data, err := json.MarshalIndent(st, "", "  ")
+	if err != nil {
+		return
+	}
+	tmp := p.statePath + ".tmp"
+	if err := os.WriteFile(tmp, data, 0600); err != nil {
+		logger.Error("pool: save state: %v", err)
+		return
+	}
+	if err := os.Rename(tmp, p.statePath); err != nil {
+		logger.Error("pool: rename state: %v", err)
+	}
+}
+
 func (p *Pool) Add(s *Slot) {
 	if p == nil {
 		return
@@ -143,6 +232,7 @@ func (p *Pool) Cool(id string, d time.Duration, reason string) {
 		if s.ID == id {
 			s.cool(d, reason)
 			logger.Info("pool: account %s cooled for %s (%s)", id, d, reason)
+			p.save()
 			return
 		}
 	}
@@ -153,6 +243,7 @@ func (p *Pool) NoteSuccess(id string) {
 	for _, s := range p.snapshot() {
 		if s.ID == id {
 			s.noteSuccess()
+			p.save()
 			return
 		}
 	}
@@ -204,6 +295,11 @@ func isAccountExhaustedDetail(detail string) bool {
 func CooldownFor(err error) time.Duration {
 	var ue *UpstreamError
 	if errors.As(err, &ue) {
+		// 上游给了明确重试时间（如 10605 排队 retryAfterSeconds）时优先用它，
+		// 上限 5 分钟，避免异常大值把账号长期雪藏。
+		if d, ok := retryAfterFromDetail(ue.Detail); ok {
+			return d
+		}
 		switch {
 		case ue.Status == http.StatusUnauthorized || ue.Status == http.StatusForbidden:
 			return CooldownQuota
@@ -216,6 +312,38 @@ func CooldownFor(err error) time.Duration {
 	return CooldownTransient
 }
 
+// retryAfterFromDetail 从上游详情解析 retryAfterSeconds（10605 排队等场景）。
+func retryAfterFromDetail(detail string) (time.Duration, bool) {
+	idx := strings.Index(detail, "retryAfterSeconds")
+	if idx < 0 {
+		return 0, false
+	}
+	rest := detail[idx+len("retryAfterSeconds"):]
+	start := -1
+	for i := 0; i < len(rest); i++ {
+		if rest[i] >= '0' && rest[i] <= '9' {
+			start = i
+			break
+		}
+	}
+	if start < 0 {
+		return 0, false
+	}
+	end := start
+	for end < len(rest) && rest[end] >= '0' && rest[end] <= '9' {
+		end++
+	}
+	n, err := strconv.Atoi(rest[start:end])
+	if err != nil || n <= 0 {
+		return 0, false
+	}
+	d := time.Duration(n) * time.Second
+	if d > 5*time.Minute {
+		d = 5 * time.Minute
+	}
+	return d, true
+}
+
 // SlotStatus 是给控制台/运维看的账号池运行时状态。
 type SlotStatus struct {
 	ID                 string `json:"id"`

internal/bridge/pool_test.go

@@ -215,3 +215,18 @@ func TestNoAccountErrorMapsTo503(t *testing.T) {
 		t.Errorf("FriendlyError(ErrNoAccount) = (%q, %q)", msg, typ)
 	}
 }
+
+func TestCooldownForRetryAfterSeconds(t *testing.T) {
+	detail := `{"code":"403","message":"{\"code\":\"10605\",\"retryAfterSeconds\":30}"}`
+	if got := CooldownFor(NewUpstreamError(403, detail)); got != 30*time.Second {
+		t.Errorf("retryAfterSeconds=30 -> %v, want 30s", got)
+	}
+	if got := CooldownFor(NewUpstreamError(403, `{"code":"112"}`)); got != CooldownQuota {
+		t.Errorf("plain 403 -> %v, want %v", got, CooldownQuota)
+	}
+	// 超大值被截到 5 分钟
+	big := `{"retryAfterSeconds":99999}`
+	if got := CooldownFor(NewUpstreamError(403, big)); got != 5*time.Minute {
+		t.Errorf("huge retryAfter -> %v, want 5m", got)
+	}
+}

service.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
@@ -271,7 +272,7 @@ func (s *Service) startBridgeWithAccount(acct *account.Account) error {
 // buildAccountPool 把所有有 secret 的账号建成运行时账号池。
 // 单个账号建会话失败（凭证失效/网络等）只跳过该账号，不阻断整池启动。
 func (s *Service) buildAccountPool() *bridge.Pool {
-	pool := bridge.NewPool()
+	pool := bridge.NewPoolWithState(filepath.Join(account.DataRoot(), "pool_state.json"))
 	accounts, err := account.List()
 	if err != nil {
 		logger.Error("buildAccountPool: list accounts: %v", err)
@@ -294,6 +295,8 @@ func (s *Service) buildAccountPool() *bridge.Pool {
 		pool.Add(slot)
 		logger.Info("buildAccountPool: added account %s (region=%s)", a.Name, a.Region)
 	}
+	// 账号全部入池后再恢复冷却状态（构造时空池 load 匹配不到 ID）。
+	pool.LoadState()
 	return pool
 }
 

webconsole/index.html

@@ -437,6 +437,12 @@ <h3>NewAPI / 中转站接入</h3>
       </table>`;
     }
 
+    function fmtDur(ms) {
+      const sec = Math.max(0, Math.ceil(ms / 1000));
+      const m = Math.floor(sec / 60), r = sec % 60;
+      return m > 0 ? m + 'm' + String(r).padStart(2, '0') + 's' : r + 's';
+    }
+
     function fmtNum(n) {
       if (n == null || Number.isNaN(n)) return '-';
       return Number(n).toLocaleString(undefined, { maximumFractionDigits: 2 });
@@ -497,19 +503,29 @@ <h3>NewAPI / 中转站接入</h3>
 
 
 
-    function renderAccounts(list) {
-      
+    function renderAccounts(list, pool) {
+      const poolById = {};
+      ((pool && pool.slots) || []).forEach(s => { poolById[s.id] = s; });
       if (!list || !list.length) {
         $('accountBody').innerHTML = '<tr><td colspan="4" class="muted">暂无账号</td></tr>';
         return;
       }
       $('accountBody').innerHTML = list.map(a => {
         const cachedQuota = quotaCache[a.id];
+        const slot = poolById[a.id];
+        const coolMs = slot ? (slot.cooling_remaining_ms || 0) : 0;
+        const poolBadge = __omp_shell("slot ? ''")
+          : coolMs > 0
+            ? `<span class="pill" style="border-color:#e6b800;background:#fff8e1;color:#8a6d00">冷却中 ${fmtDur(coolMs)}</span>`
+            : `<span class="pill" style="border-color:#8bc34a;background:#f1f8e9;color:#33691e">可用</span>`;
+        const poolNote = (slot && coolMs > 0 && slot.last_error)
+          ? `<div class="muted" style="font-size:11px">${slot.last_error}</div>` : '';
         return `
         <tr data-id="${a.id}">
           <td>
-            <div><strong>${a.name || a.id}</strong> ${a.active ? '<span class="pill">active</span>' : ''}</div>
+            <div><strong>${a.name || a.id}</strong> ${a.active ? '<span class="pill">active</span>' : ''} ${poolBadge}</div>
             <div class="muted">${a.email || '-'}</div>
+            ${poolNote}
           </td>
           <td>
             <div>${a.plan || '-'}</div>
@@ -520,6 +536,7 @@ <h3>NewAPI / 中转站接入</h3>
             <button class="secondary" data-act="activate" data-id="${a.id}" ${a.active ? 'disabled' : ''}>激活</button>
             <button class="secondary" data-act="quota" data-id="${a.id}">刷新额度</button>
             <button class="secondary" data-act="checkin" data-id="${a.id}">🎁 签到</button>
+            <button class="secondary" data-act="cool" data-id="${a.id}">冷却</button>
             <button class="danger" data-act="delete" data-id="${a.id}">删除</button>
           </td>
         </tr>
@@ -548,8 +565,10 @@ <h3>NewAPI / 中转站接入</h3>
       await loadConnection();
 
       try {
+        let pool = null;
+        try { pool = await api('/api/pool'); } catch (e) {}
         const accounts = await api('/api/accounts');
-        renderAccounts(accounts);
+        renderAccounts(accounts, pool);
         // 并行拉额度
         (accounts || []).forEach(a => loadQuota(a.id));
       } catch (e) {
@@ -829,6 +848,11 @@ <h3>NewAPI / 中转站接入</h3>
             btn.disabled = false;
             btn.textContent = oldText;
           }
+        } else if (act === 'cool') {
+          const secs = parseInt(prompt('冷却该账号多少秒？（默认 300）', '300'), 10);
+          if (!secs || secs <= 0) return;
+          await api('/api/pool/cool', { method: 'POST', body: JSON.stringify({ id, seconds: secs, reason: 'manual' }) });
+          await refresh();
         } else if (act === 'delete') {
           if (!confirm('确认删除该账号？')) return;
           await api('/api/accounts/delete', { method: 'POST', body: JSON.stringify({ id }) });