fix(codebuddy): 11158 归 model_not_found；耗尽无选号时明细落候选渠道

11158「套餐不允许」与 11102「无此模型」对当前凭证同义：重试无意义、换号
才有用、与账号健康无关。此前落 400 其他 → INVALID → invalid_request，
归因面板显示「请求无效」。两者共用 MODEL_BLOCKED_CODES，列表探活同源。

_pick 首轮返回 None 时 provider 还停在占位 '-'，归因面板看不出哪个渠道
挂的（实测 deepseek-v4.1-flash-sg）。改为落收窄后的首个候选渠道。

Author: RobbsLuo

README.en.md

@@ -512,7 +512,7 @@ Four tabs (channel / model / user / credential) share one table (channel / reque
 
 **Two latency scopes**: successful requests only. Average = `latency_sum ÷ successes` (hourly rollup); percentile from per-request detail (90 days). `NULL` `ttfb_ms` ranks independently in each column. No samples → `—`.
 
-**Failure attribution**: panel below group table, `GET /api/stats/errors` (operator+) aggregates `ok=0` detail by `(channel, model, error_type)` → failure count, **unrescued count**, last failure time (descending, `limit` ≤ 5000). **Failure count = per-attempt**: every upstream rejection lands row, even when retry on another credential succeeds; failure row whose `request_id` also has success row for **same user** counts as rescued; `unrescued = failures − rescued` = **failure attempts never rescued** (a request failing twice counts twice; not number of lost requests). Hard credential failure (DEAD, e.g. 401) also lands a `credential_unavailable` row; an upstream account restriction (CodeBuddy 11140) lands `account_restricted`, cools the account for 2h and stops rotating within that channel, escalating to a whole-channel pause on a second hit in the window; counted as rescued if retry succeeds elsewhere; terminal row not duplicated once rotation exhausted. Click row → detail with *failed only* (`GET /api/stats/events?ok=0`). Admin/operator only. `/metrics` `upstream_errors_total` still in-process counter; not merged.
+**Failure attribution**: panel below group table, `GET /api/stats/errors` (operator+) aggregates `ok=0` detail by `(channel, model, error_type)` → failure count, **unrescued count**, last failure time (descending, `limit` ≤ 5000). **Failure count = per-attempt**: every upstream rejection lands row, even when retry on another credential succeeds; failure row whose `request_id` also has success row for **same user** counts as rescued; `unrescued = failures − rescued` = **failure attempts never rescued** (a request failing twice counts twice; not number of lost requests). Hard credential failure (DEAD, e.g. 401) also lands a `credential_unavailable` row; an upstream account restriction (CodeBuddy 11140) lands `account_restricted`, cools the account for 2h and stops rotating within that channel, escalating to a whole-channel pause on a second hit in the window; when the upstream says this credential cannot use that model (11102 no such model / 11158 plan not allowed) the row is `model_not_found` and writes an (account, model) negative cache instead of cooling the account; when rotation exhausts without ever picking a credential (all candidates cooling / empty pool) the row records the **candidate channel** rather than `-`; counted as rescued if retry succeeds elsewhere; terminal row not duplicated once rotation exhausted. Click row → detail with *failed only* (`GET /api/stats/events?ok=0`). Admin/operator only. `/metrics` `upstream_errors_total` still in-process counter; not merged.
 
 **Row drill-down**: clicking group row filters detail by that row (channel / model / credential; user dimension uses scope), stacking conditions. `GET /api/stats/events` accepts `provider` / `model` / `credential_id` (AND) + `ok=0`.
 

README.md

@@ -521,7 +521,7 @@ tabs 切四维（渠道 / 模型 / 用户 / 凭证），共用一表（渠道 /
 
 **延迟两类口径**：只统计成功请求。平均 = `latency_sum ÷ 成功数`（小时汇总）；分位从逐请求明细算（仅 90 天）。`ttfb_ms` = `NULL` 的两列各自独立排名。无样本 → `—`。
 
-**失败归因**：`GET /api/stats/errors`（operator+）按 `(渠道, 模型, 错误类型)` 聚合窗口内 `ok=0` → 失败次数 / **未救回数** / 最近失败时刻（降序，`limit` ≤ 5000）。**失败数 = 尝试口径**：换号重试每次上游拒绝各落一行；同用户同 `request_id` 另有成功行 = 已救回。`未救回 = 失败数 − 救回数`（同请求多次失败算多次，≠ 受损请求数）。凭证 401 硬禁用（DEAD）也落 `credential_unavailable`；账号被上游风控限制（CodeBuddy 11140）落 `account_restricted`，账号级 2h 冷却、当前请求不再换号，同渠道窗口内**第二个不同凭证**也中招时整渠道退避 24h；换号成功算已救回；轮换耗尽不重复落收尾行。点行钻取 +「只看失败」（`GET /api/stats/events?ok=0`）。仅 admin / operator。`/metrics` 的 `upstream_errors_total` 取进程内计数，不合并。
+**失败归因**：`GET /api/stats/errors`（operator+）按 `(渠道, 模型, 错误类型)` 聚合窗口内 `ok=0` → 失败次数 / **未救回数** / 最近失败时刻（降序，`limit` ≤ 5000）。**失败数 = 尝试口径**：换号重试每次上游拒绝各落一行；同用户同 `request_id` 另有成功行 = 已救回。`未救回 = 失败数 − 救回数`（同请求多次失败算多次，≠ 受损请求数）。凭证 401 硬禁用（DEAD）也落 `credential_unavailable`；账号被上游风控限制（CodeBuddy 11140）落 `account_restricted`，账号级 2h 冷却、当前请求不再换号，同渠道窗口内**第二个不同凭证**也中招时整渠道退避 24h；上游明确说该号用不了这个模型（11102 无此模型 / 11158 套餐不允许）落 `model_not_found`，写 (账号, 模型) 负缓存而非冷却账号；一次都没选中凭证就耗尽时（候选全在冷却 / 池子为空）明细落**候选渠道**而不是 `-`；换号成功算已救回；轮换耗尽不重复落收尾行。点行钻取 +「只看失败」（`GET /api/stats/events?ok=0`）。仅 admin / operator。`/metrics` 的 `upstream_errors_total` 取进程内计数，不合并。
 
 **点行钻取**：点分组表任一行 → 明细按该行过滤（渠道 / 模型 / 凭证；用户维度走作用域参数），条件可叠加。`GET /api/stats/events` 接受 `provider` / `model` / `credential_id`（AND）+ `ok=0`。
 

TECHNICAL.md

@@ -652,6 +652,7 @@ PRAGMA foreign_keys = ON;      -- 仅 api_keys 之外无外键（users 与 api_k
 `ErrKind.BLOCKED`（上游明确说没有这个模型）统计落 `error_type=model_not_found`，**不再并进 `invalid_request`**。后者是「请求无效」（`ErrKind.INVALID` / `ErrKind.REQUEST`），归因面板显示「请求无效」，读起来像客户端参数写错了——实际是上游把该模型下架了（实测 2026-10-26 officeAce 404 `ModelArts.81009` 被标成「请求无效」）。
 
 - 受控枚举 `CONTROLLED_ERROR_TYPES` 增 `model_not_found`（前端 `USAGE_ERROR_LABEL` 同步：「上游无此模型」）。
+- **套餐不允许也归这里**（2026-10-29）：CodeBuddy 11158 `model [...] is not allowed for user type [personal_free_user]` 与 11102「该后端无此模型」对**当前凭证**是同一件事——重试无意义、换号才有用、与账号健康无关。此前 11158 落进 `400 其他 → ErrKind.INVALID`，归因面板显示「请求无效」（实测 10:36 / 10:37 国际站免费号请求 `gpt-6-luna`、`gemini-3.8-flash`）。现在两者共用 `codebuddy.events.MODEL_BLOCKED_CODES`，列表探活（`client.filter_available_models`）也读同一个集合，不再各写一份。
 - 可用性视图（`GET /api/models/availability`）的计入口径增 `model_not_found`：它**仍属**模型级失败，只是分类更准。
 - **收尾行不变**：轮换耗尽时那一行仍按 `_exhaust_error_type` 落 `model_unavailable` / `no_healthy_credential`——「上游没这个模型」（尝试级归因）与「这个模型现在全都不可用」（收尾行）是两件事。
 

src/engine/executor.py

@@ -398,6 +398,21 @@ def _skip_provider(self, provider_id: str, tried: set[str]) -> None:
         for candidate in self._deps.credentials.candidates([provider_id]):
             tried.add(candidate.credential_id)
 
+    def _attribution_provider(self, target: ModelTarget, observed: str) -> str:
+        """失败明细里的渠道名：真打过就用实际渠道，一次都没选中就用候选渠道。
+
+        `_pick` **首轮**返回 None（候选全在冷却 / 一个凭证都没有）时，渠道名
+        还停在占位 `"-"`：归因面板只剩一个横杠，看不出是哪个渠道挂的（实测
+        2026-10-29 10:18 `deepseek-v4.1-flash-sg`——唯一持有它的
+        codebuddy_intl 两个号刚因 ConnectTimeout 进 SOFT 冷却，明细落成
+        `provider="-"`）。收窄后的候选按声明顺序取第一个：那是「本该服务它」
+        的渠道，也是运维该去查的那个。
+
+        候选必然非空：`_select` 在无注册上游时先抛 `NoProviderForModel`，
+        走到 `_pick` 返回 None 的分支时注册集已校验过。
+        """
+        return observed if observed != "-" else self._registered(target)[0]
+
     def _upstream_model(self, provider_id: str, model: str) -> str:
         """归一模型名 → 该上游注册的原始 id（大小写变体映射，未知则原样）。"""
         if self._deps.upstream_model_name is None:
@@ -681,7 +696,8 @@ def terminal(message: str, code: str) -> bytes:
                             "invalid_request")
                     if not attributed:
                         self._deps.record(
-                            username=state.username, provider=state.provider,
+                            username=state.username,
+                            provider=self._attribution_provider(target, state.provider),
                             credential_id=state.credential_id, model=target.model, ok=False,
                             error_type=self._exhaust_error_type(target),
                             latency_ms=_elapsed_ms(state.started))
@@ -1243,7 +1259,8 @@ async def _complete_model(self, request: ChatRequest, target: ModelTarget,
                             target.model, last_error, self._suggestions(target.model)))
                     if not attributed:
                         self._deps.record(
-                            username=username, provider=last_provider,
+                            username=username,
+                            provider=self._attribution_provider(target, last_provider),
                             credential_id=last_credential,
                             model=target.model, ok=False,
                             error_type=self._exhaust_error_type(target),

src/provider/codebuddy/client.py

@@ -32,7 +32,7 @@
 from ..lazy_clients import LazyClients
 from . import events as cb_events
 from .credential import CodeBuddyCredential, parse_credential
-from .events import UpstreamProtocolViolation
+from .events import MODEL_BLOCKED_CODES, UpstreamProtocolViolation
 from .headers import (
     CN_ENDPOINT,
     EP_CHAT,
@@ -69,7 +69,9 @@
 MODEL_ACCESS_CACHE_MAX_ENTRIES = 256
 MODEL_ACCESS_PROBE_TIMEOUT = 5.0
 MODEL_ACCESS_PROBE_CONCURRENCY = 4
-MODEL_ACCESS_DENIED_CODES = frozenset({11102, 11158})
+# 判活与错误分类共用同一个业务码集合（`events.MODEL_BLOCKED_CODES`）：两边
+# 各写一份曾让 11158 在探活里算「不可用」、在请求里算「请求无效」。
+MODEL_ACCESS_DENIED_CODES = MODEL_BLOCKED_CODES
 _MODEL_ACCESS_CACHE: dict[tuple[str, str], tuple[float, dict[str, bool | None]]] = {}
 _PROBE_PROMPT = "hi"
 

src/provider/codebuddy/events.py

@@ -43,7 +43,16 @@ def _usage(raw: dict[str, Any]) -> Usage:
 # saturated」。上游明确要求「switch models」，说明同凭证其他模型可用，
 # 落账号级 SOFT 会让整张凭证 60s 内全部模型一起不可用。
 _MODEL_SATURATED_CODE = 14003
-_MODEL_BLOCKED_CODE = 11102         # 该后端无此模型 → (账号, 模型) 负缓存
+# 「这个号用不了这个模型」→ (账号, 模型) 负缓存。两个业务码同义：
+#   11102 该后端无此模型（上游根本没部署）
+#   11158 套餐不允许：`model [gpt-6-luna] is not allowed for user type
+#         [personal_free_user]`（国际站免费号实测 2026-10-29 10:36 / 10:37）
+# 两者对**当前凭证**的结论完全一样——重试多少次都失败，换号才有意义，且与
+# 账号健康无关（不能落账号级冷却）。此前只认 11102，11158 掉进 `400 其他`
+# 被归成 `invalid_request`，归因面板显示「请求无效」，读起来像客户端参数
+# 写错了（与 2026-10-26 officeAce 81009 同一类误判）。
+# 列表探活（client.filter_available_models）共用本集合，口径不会再漂。
+MODEL_BLOCKED_CODES = frozenset({11102, 11158})
 _CREDITS_EXHAUSTED_CODE = 14018     # 积分耗尽 → 冷却到次日签到
 _PLAN_EXHAUSTED_CODE = 1005         # 权益/套餐耗尽
 # 请求级错误（不是账号的问题）：请求体坏 / 上下文超限 / 图片无效 / 渠道风控。
@@ -77,7 +86,7 @@ def classify_status(status: int, body: bytes = b"") -> ErrKind:
 
     * 402 / 14018 → 余额不足（冷却到次日 04:00，等签到恢复）
     * 1005 → 权益耗尽（12h 长冷却）
-    * 11102「该后端无此模型」→ (账号, 模型) 负缓存（400/404 形态）
+    * 11102/11158「该号用不了这个模型」→ (账号, 模型) 负缓存（400/404 形态）
     * 11140「账号被风控限制」→ 账号级长冷却，**当前请求不再换号**
     * 401/403 → session 失效（硬禁用）
     * 404 → 软冷却，不累计错误数
@@ -90,7 +99,7 @@ def classify_status(status: int, body: bytes = b"") -> ErrKind:
         return ErrKind.CREDIT
     if _PLAN_EXHAUSTED_CODE in codes:
         return ErrKind.PLAN
-    if status in (400, 404) and _MODEL_BLOCKED_CODE in codes:
+    if status in (400, 404) and codes & MODEL_BLOCKED_CODES:
         return ErrKind.BLOCKED
     if status >= 400 and _is_account_restricted(body):
         # 必须拦在 401/403 → DEAD 之前：11140 是上游按账号/IP 拉黑，不是凭据

tests/engine/test_executor_stats.py

@@ -290,6 +290,58 @@ async def test_complete_all_model_cooled_records_model_unavailable(repo):
             {"messages": [{"role": "user", "content": "hi"}]}))
     assert collector.events[-1]["error_type"] == "model_unavailable"
 
+async def test_stream_exhaustion_without_any_pick_records_candidate_provider(repo):
+    """一次都没选中凭证（候选全在冷却 / 池子为空）时，明细要落**候选渠道**。
+
+    `_pick` 首轮返回 None 时渠道名还停在占位 `"-"`：归因面板只剩一个横杠，
+    看不出是哪个渠道挂的（实测 2026-10-29 10:18 `deepseek-v4.1-flash-sg`
+    落成 `provider="-"`，而它只在 codebuddy_intl 上有）。
+    """
+    credentials, _db = repo
+    collector = RecordingCollector()
+    executor = _exec_with_stats(repo, [GOOD_EVENTS], collector)
+
+    from src.compat.openai.request import parse_chat_request
+
+    async for _ in executor.stream(parse_chat_request(
+            {"messages": [{"role": "user", "content": "hi"}], "stream": True})):
+        pass
+    event = collector.events[-1]
+    assert event["ok"] is False and event["provider"] == "codebuddy"
+    assert event["credential_id"] is None
+
+async def test_complete_exhaustion_without_any_pick_records_candidate_provider(repo):
+    """非流式同口径：没有选中凭证时明细仍能指出是哪个渠道。"""
+    credentials, _db = repo
+    collector = RecordingCollector()
+    executor = _exec_with_stats(repo, [GOOD_EVENTS], collector)
+
+    from src.compat.openai.request import parse_chat_request
+
+    with pytest.raises(NoHealthyCredential):
+        await executor.complete(parse_chat_request(
+            {"messages": [{"role": "user", "content": "hi"}]}))
+    assert collector.events[-1]["provider"] == "codebuddy"
+
+async def test_exhaustion_after_a_tried_credential_keeps_actual_provider(repo):
+    """真打过上游时明细记**实际**渠道，不被候选渠道顶掉。"""
+    credentials, _db = repo
+    credentials.add(provider="codebuddy", credential_data={"bearer_token": "t"})
+    collector = RecordingCollector()
+
+    class Soft(Exception):
+        def kind(self):
+            return ErrKind.SOFT
+
+    executor = _exec_with_stats(repo, [[Soft()]], collector, max_rotate=1)
+    from src.compat.openai.request import parse_chat_request
+
+    with pytest.raises(NoHealthyCredential):
+        await executor.complete(parse_chat_request(
+            {"messages": [{"role": "user", "content": "hi"}]}))
+    assert collector.events[-1]["provider"] == "codebuddy"
+    assert collector.events[-1]["credential_id"] is not None
+
 async def test_complete_records_success_and_failure(repo):
     credentials, _db = repo
     credentials.add(provider="codebuddy", credential_data={"bearer_token": "t"})

tests/provider/codebuddy/test_client.py

@@ -44,6 +44,10 @@ def test_classify_body_markers():
     # 「该后端无此模型」：(账号, 模型) 负缓存
     (400, b'{"code": 11102}', ErrKind.BLOCKED),
     (404, b'{"code": 11102}', ErrKind.BLOCKED),
+    # 「套餐不允许」：对**当前凭证**与 11102 等价（重试无意义、换号才有用）
+    (400, b'{"code": 11158, "msg": "model [gpt-6-luna] is not allowed for user '
+          b'type [personal_free_user]"}', ErrKind.BLOCKED),
+    (404, b'{"code": 11158}', ErrKind.BLOCKED),
     # 请求级错误：不罚号，仍换号（请求体坏 / 上下文超限 / 渠道风控 / 图片无效）
     (400, b'{"code": 11101}', ErrKind.REQUEST),
     (400, b'{"code": 500, "msg": "Unmarshal chat params failed"}', ErrKind.REQUEST),
@@ -55,6 +59,7 @@ def test_classify_body_markers():
     # 裸数字不误伤：111020 不是 11102（要求带 "code": 键值形态）
     (400, b'{"trace": 1110201}', ErrKind.INVALID),
     (400, b'{"code": 111020}', ErrKind.INVALID),
+    (400, b'{"code": 111580}', ErrKind.INVALID),
     # 嵌套信封：业务码在内层，按集合成员判断不漏
     (400, b'{"code": 0, "data": {"code": 11102}}', ErrKind.BLOCKED),
     (404, b"not json at all", ErrKind.SOFT),