@@ -153,7 +153,7 @@ curl http://localhost:10081/v1/models \
 
 ### 5. 控制思考强度（`reasoning_effort`）
 
-请求体支持 OpenAI 风格的 `reasoning_effort`。有效档位写入网关请求的 `parameters` 对象（与官方客户端一致），**无需**额外的 device token、Bearer token 或模型服务域名配置；未携带该字段的请求保持原有行为。
+请求体支持 OpenAI 风格的 `reasoning_effort`。有效档位写入网关请求的 `parameters` 对象（与官方客户端一致），**无需**额外的 device token、Bearer token 或模型服务域名配置；未携带 `reasoning_effort` 的请求不改变思考档位，保持模型默认强度（但请求体仍会带上 `parameters.max_tokens`，见下文「`is_reasoning` 与 `max_tokens` 的来源」）。
 
 ```json
 {
@@ -179,12 +179,16 @@ curl http://localhost:10081/v1/models \
 
 其余档位不会写入 `max_thinking_tokens`：官方客户端仅在技能 / 子代理覆盖场景才把档位换算为思考预算，主交互路径只发送档位字符串。
 
+> 档位之间的区别在上游是否可观测仍存疑（见下方「档位实效说明」）：`none` 是唯一实测稳定生效的档位，其余档位不应被当作可靠的强度旋钮。
+
 #### `is_reasoning` 与 `max_tokens` 的来源
 
 两项能力信息来自网关模型目录，与官方客户端的解析方式一致：
 
-- `is_reasoning`：取目录的 `is_reasoning` 字段，缺失时为 `false`。动态目录不可用时回退为 `true`，以保持桥接层原有的"默认开启思考"行为，避免静默关闭所有模型的思考能力。
-- `max_tokens`：取目录的 `max_output_tokens`，缺失或非法（非正整数）时回退为 `32000`，与官方客户端的 `LS()` 归一化结果相同。
+- `is_reasoning`：优先看目录条目是否存在 `thinking_config.enabled`（存在且非 null 即视为"可思考"——这是目录真正声明可思考能力的位置；`dfmodel` / `kmodel_latest` 的顶层 `is_reasoning=false` 与嵌套块矛盾，故以嵌套块为准），其次才看顶层 `is_reasoning`；两者都缺失时回退为 `true`。动态目录整体不可用时同样回退为 `true`（保持原有"默认开启思考"）。
+- `max_tokens`：调用方传入的 `max_tokens` / `max_completion_tokens` 优先，但被钳制在 1,000,000 上限（避免 `1e18` 之类异常值直达上游）；未传或非法时才取目录的 `max_output_tokens`，目录缺失时为 `32000`。该值总是写入网关请求的 `parameters.max_tokens`，这是本 PR 引入的行为变更：此前版本的请求体不含该字段，客户端传入的 `max_tokens` 会被静默丢弃。
+
+> **档位实效说明**：实测显示，除 `none`（且仅当目录声明了 `thinking_config.disabled` 时）外，各档位字符串对 `reasoning_tokens` 的影响落在采样噪声内。档位仍会经目录校验后透传，但不应据此期待精细的思考强度控制；下面的 pi `thinkingLevelMap` 示例只用于显式表达调用方意图。
 
 **pi 客户端配置示例**：Qoder 上游不接受 OpenAI 的 `developer` 角色，而 pi 会用该角色承载代理指令；因此必须在 `~/.pi/agent/models.json` 的 `qoder-local` provider 上设置 `supportsDeveloperRole: false`，使 pi 改用 `system` 角色。为模型设置 `reasoning: true`，并将 pi 的档位映射到模型目录实际支持的值：
 
@@ -246,6 +250,8 @@ curl http://localhost:10081/v1/models \
 合计剩余      4,941 · 09-25 重置
 ```
 
+> **合计口径**：`合计剩余` 只累加可消费的额度——标记为「不可用」的池子（如组织资源包的 `available=false`）虽仍会单独成行展示，但不计入合计，否则汇总数字会与紧上方那一行的「不可用」自相矛盾。
+
 > 免费账号的套餐池为 `userQuota.total = 0`（套餐本身不含额度），此时面板首行直接展示真正持有额度的池子（通常是加购额度），而不是渲染成「套餐 0 / 0 · 已用尽」。`total`/`cap` 为 0 的池子视为不存在，不会出现在额度明细卡中。
 
 ### 数据来源
@@ -268,7 +274,8 @@ curl http://localhost:10081/v1/models \
 - **官方额度优先**：面板的套餐用量来自账号级 OpenAPI，包含 IDE、CLI 和本服务产生的全部消耗，也能覆盖服务启动前的当期用量。
 - **额度来源分别展示**：套餐额度、加购额度和组织资源包在额度明细卡中分别成行展示，并汇总各额度来源返回的剩余 Credits；组织资源包的“可用/不可用”状态以 OpenAPI 返回值为准。
 - **本地累计仅作降级**：usage 帧中 `billable=false` 的请求仍计入 token，但不计入本地 credits；OpenAPI 从未成功时，面板才显示本服务观察到的周期消耗，并明确标注口径。
-- **周期边界权威同步**：重置时刻以网关 `/user/status` 的 `nextResetAt` 为权威，OpenAPI `expiresAt` 仅在其缺失时兜底；且 `expiresAt` 必须小于 `2100-01-01` 才会被采纳——无期限套餐会把它填成 `9999-12-31` 哨兵值，该值会被忽略。本地周期起点按自然月回退推导，断网期间仍可完成一次性滚动。
+- **周期边界权威同步**：重置时刻以网关 `/user/status` 的 `nextResetAt` 为权威，OpenAPI `expiresAt` 仅在其缺失时兜底；且 `expiresAt` 必须小于 `2100-01-01` 才会被采纳——无期限套餐会把它填成 `9999-12-31` 哨兵值，该值会被忽略。本地周期起点按自然月回退推导（月末会夹取到目标月最后一天，3/31 → 2/28），断网期间仍可完成一次性滚动。
+- **边界变更的接受规则**（防止累计值被抖动或陈旧缓存误清）：首次拿到边界时**保留**已累计的 credits；边界**未向前推进**（`/user/status` 缓存 1 小时，可能上报已滚过的旧值）则直接忽略；前进幅度小于 7 天时视为同一周期，不清零；达到 7 天以上才判定为真实续期并清零上一周期。
 - **累计值仍保留**：`stats.credits` 保存本服务历史累计扣费，鼠标悬停在额度行可查看。
 
 ### 刷新时机
 
@@ -337,6 +337,55 @@ func TestQuotaSourceSelectionIgnoresEmptyPools(t *testing.T) {
 	}
 }
 
+// quotaDetailsSource returns the renderQuotaDetails body from the embedded UI,
+// delimited by the next top-level function.
+func quotaDetailsSource(t *testing.T) string {
+	t.Helper()
+	start := strings.Index(indexHTML, "function renderQuotaDetails(d) {")
+	if start < 0 {
+		t.Fatal("renderQuotaDetails not found in the embedded UI")
+	}
+	end := strings.Index(indexHTML[start:], "function makeBadge(")
+	if end < 0 {
+		t.Fatal("could not delimit renderQuotaDetails")
+	}
+	return indexHTML[start : start+end]
+}
+
+// The 合计剩余 summary must not absorb credits the account cannot spend: an
+// unavailable org_resource_package still gets a row marked 不可用, so counting
+// its remaining credits made the summary contradict the row right above it.
+func TestQuotaSummaryOnlyCountsAvailablePools(t *testing.T) {
+	details := quotaDetailsSource(t)
+
+	guard := "if (pool.available) totalRemaining += remaining;"
+	if !strings.Contains(details, guard) {
+		t.Errorf("the summary must accumulate only available pools; missing %q", guard)
+	}
+	// Any other accumulation must carry the same availability guard.
+	for _, line := range strings.Split(details, "\n") {
+		if strings.Contains(line, "totalRemaining += remaining") && !strings.Contains(line, "pool.available") {
+			t.Errorf("totalRemaining accumulated without the availability guard: %q", strings.TrimSpace(line))
+		}
+	}
+}
+
+// fmtCredits never returns a negative string and total comes from
+// Number(pool.quota[...] || 0), so the '—' branch of the total ternary was
+// unreachable. The cell must render fmtCredits(total) directly.
+func TestQuotaDetailsHasNoDeadTotalBranch(t *testing.T) {
+	details := quotaDetailsSource(t)
+
+	for _, dead := range []string{"total >= 0 ?", "? fmtCredits(total) : '—'"} {
+		if strings.Contains(details, dead) {
+			t.Errorf("dead total branch %q must be removed from renderQuotaDetails", dead)
+		}
+	}
+	if !strings.Contains(details, "' / ' + fmtCredits(total) + '</td>'") {
+		t.Error("renderQuotaDetails must render the total via fmtCredits(total)")
+	}
+}
+
 // Repeated wrong passwords trigger per-IP rate limiting (HTTP 429).
 func TestLoginRateLimit(t *testing.T) {
 	a, _ := newAdmin(t)
 
@@ -1345,12 +1345,15 @@ function renderQuotaDetails(d) {
     var ratio = total > 0 ? Math.min(Math.max(used / total, 0), 1) : 0;
     var statusText = pool.available ? (remaining > 0 ? '可用' : '已用尽') : '不可用';
     var statusKind = pool.available && remaining > 0 ? 'ok' : (pool.available ? 'bad' : 'neutral');
-    totalRemaining += remaining;
+    // Only spendable credits count towards 合计剩余: an unavailable pool still
+    // gets a row marked 不可用, but adding its remaining credits to the summary
+    // would contradict that very row.
+    if (pool.available) totalRemaining += remaining;
 
     var tr = document.createElement('tr');
     tr.innerHTML =
       '<td>' + pool.name + '</td>' +
-      '<td class="num">' + fmtCredits(used) + ' / ' + (total >= 0 ? fmtCredits(total) : '—') + '</td>' +
+      '<td class="num">' + fmtCredits(used) + ' / ' + fmtCredits(total) + '</td>' +
       '<td class="num">' + fmtCredits(remaining) + '</td>' +
       '<td><div class="rate-cell"><div class="rate-bar"><div class="rate-fill" style="width:' + (ratio * 100) + '%"></div></div>' +
       '<span class="rate-text num">' + Math.round(ratio * 100) + '%</span></div></td>' +
 
@@ -26,6 +26,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"time"
+	"unicode/utf8"
 
 	"github.com/google/uuid"
 )
@@ -343,7 +344,11 @@ type AuthError struct {
 func (e *AuthError) Error() string {
 	s := fmt.Sprintf("HTTP %d", e.StatusCode)
 	if e.Detail != "" {
-		s += " " + e.Detail
+		// Detail carries the raw upstream body, which includes userId and trace
+		// ids. Error() is what the bridge logs, so redact it here: doing it at
+		// every construction site instead would be easy to miss, and Detail
+		// itself is kept raw for callers that classify the failure.
+		s += " " + truncateErrorBody([]byte(e.Detail))
 	}
 	return s
 }
@@ -408,6 +413,130 @@ func truncateBusyMessage(s string) string {
 	return string(r[:maxBusyMessageRunes]) + "…"
 }
 
+// maxErrorBodyChars caps how much of an upstream error body is embedded in an
+// error message. The account loop logs these at WARN, so the payload must not
+// reach the log verbatim: the quota response carries userId and trace ids.
+const maxErrorBodyChars = 200
+
+// redactedErrorKeys are JSON keys whose values are stripped from an upstream
+// error body before it is embedded in an error message. Truncation alone is not
+// enough: these fields sit near the start of the real payload.
+var redactedErrorKeys = []string{"userId", "userType", "traceId", "traceID", "requestId"}
+
+// truncateErrorBody returns a short, single-line, identity-free prefix of an
+// upstream error body for embedding in an error message. Identity-valued JSON
+// keys are replaced before the length cap, so a short-but-sensitive payload does
+// not slip through as-is.
+func truncateErrorBody(body []byte) string {
+	s := strings.TrimSpace(string(body))
+	for _, key := range redactedErrorKeys {
+		s = redactJSONValue(s, key)
+	}
+	s = strings.ReplaceAll(s, "\n", " ")
+	s = strings.ReplaceAll(s, "\r", " ")
+	if len(s) <= maxErrorBodyChars {
+		return s
+	}
+	// Cut on a rune boundary: a byte-wise slice through a multi-byte character
+	// yields an invalid string, which then reaches the log garbage-escaped.
+	cut := maxErrorBodyChars
+	for cut > 0 && !utf8.RuneStart(s[cut]) {
+		cut--
+	}
+	return s[:cut] + "…"
+}
+
+// redactJSONValue replaces the value of a JSON field with "[REDACTED]". It works
+// on the raw text (the body may not even be valid JSON), which is exactly the
+// shape an upstream error page takes. A missing field is a no-op. The scan
+// resumes after the replacement so a value is never rescanned.
+//
+// Whitespace around the colon is accepted because upstreams pretty-print
+// (`"userId" : "..."`), and a missing closing quote is handled because a
+// truncated response body is a realistic case: matching only the compact form
+// would leak the identity value in both.
+func redactJSONValue(s, key string) string {
+	needle := `"` + key + `"`
+	var out strings.Builder
+	for {
+		keyStart := strings.Index(s, needle)
+		if keyStart < 0 {
+			break
+		}
+		valueStart, ok := jsonValueStart(s, keyStart+len(needle))
+		if !ok {
+			// The key is not a field name here (e.g. it appears inside a string
+			// value). Emit it unchanged and keep scanning past it.
+			out.WriteString(s[:keyStart+len(needle)])
+			s = s[keyStart+len(needle):]
+			continue
+		}
+		out.WriteString(s[:valueStart])
+		if s[valueStart] == '"' {
+			out.WriteString(`"[REDACTED]"`)
+		} else {
+			out.WriteString("[REDACTED]")
+		}
+		s = s[jsonValueEnd(s, valueStart):]
+	}
+	out.WriteString(s)
+	return out.String()
+}
+
+// jsonValueStart returns the index of the value's first byte, delimiter
+// included: the opening quote for a string, the first character for a scalar.
+// Everything before it (the key, whitespace, the colon) is copied verbatim. It
+// reports false when the text after the key is not a `: <value>` pair.
+func jsonValueStart(s string, from int) (int, bool) {
+	i := from
+	for i < len(s) && isJSONSpace(s[i]) {
+		i++
+	}
+	if i >= len(s) || s[i] != ':' {
+		return 0, false
+	}
+	i++
+	for i < len(s) && isJSONSpace(s[i]) {
+		i++
+	}
+	if i >= len(s) {
+		return 0, false
+	}
+	return i, true
+}
+
+// jsonValueEnd returns the index of the first byte PAST the value starting at
+// start. For a string that is one past its closing quote; for a scalar it is the
+// next JSON delimiter. A string whose closing quote is missing (a truncated
+// response) is treated as running to the end of the text so its content cannot
+// leak.
+func jsonValueEnd(s string, start int) int {
+	if s[start] == '"' {
+		for i := start + 1; i < len(s); i++ {
+			if s[i] == '\\' {
+				i++ // skip the escaped byte
+				continue
+			}
+			if s[i] == '"' {
+				return i + 1
+			}
+		}
+		return len(s) // unterminated value: redact through the end
+	}
+	for i := start; i < len(s); i++ {
+		switch s[i] {
+		case ',', '}', ']', ' ', '\t', '\n', '\r':
+			return i
+		}
+	}
+	return len(s)
+}
+
+// isJSONSpace reports whether b is insignificant whitespace between JSON tokens.
+func isJSONSpace(b byte) bool {
+	return b == ' ' || b == '\t' || b == '\n' || b == '\r'
+}
+
 // busyCodeOf normalizes a JSON "code" field that may arrive as a string
 // ("10605") or a number (10605).
 func busyCodeOf(raw json.RawMessage) string {
@@ -498,7 +627,7 @@ func postEncoded(ctx context.Context, urlStr string, obj interface{}, machineID,
 			}
 			return nil, &AuthError{StatusCode: resp.StatusCode, Detail: string(detail)}
 		}
-		return nil, fmt.Errorf("HTTP %d at %s body=%s", resp.StatusCode, urlStr, string(detail))
+		return nil, fmt.Errorf("HTTP %d at %s body=%s", resp.StatusCode, urlStr, truncateErrorBody(detail))
 	}
 
 	var result map[string]interface{}
@@ -695,10 +824,13 @@ func FetchQuotaUsage(ctx context.Context, bearer string, region *RegionConfig) (
 	if err != nil {
 		return nil, err
 	}
-	log.Printf("[auth] OpenAPI response: method=GET url=%s status=%d duration=%s headers=%v body=%s",
-		urlStr, resp.StatusCode, time.Since(started), resp.Header, body)
+	log.Printf("[auth] OpenAPI response: method=GET url=%s status=%d duration=%s",
+		urlStr, resp.StatusCode, time.Since(started))
 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("quota usage returned HTTP %d: %s", resp.StatusCode, body)
+		// The body is redacted and truncated before it reaches the error: the
+		// account loop logs this at WARN, and the quota payload carries the
+		// account's userId and trace ids. The status alone identifies the failure.
+		return nil, fmt.Errorf("quota usage returned HTTP %d: %s", resp.StatusCode, truncateErrorBody(body))
 	}
 	var usage QuotaUsage
 	if err := json.Unmarshal(body, &usage); err != nil {
@@ -841,7 +973,7 @@ func call(ctx context.Context, sess *SessionContext, method, fullURL string, jso
 			}
 			return nil, &AuthError{StatusCode: resp.StatusCode, Detail: string(detail)}
 		}
-		return nil, fmt.Errorf("HTTP %d body=%s", resp.StatusCode, string(detail))
+		return nil, fmt.Errorf("HTTP %d body=%s", resp.StatusCode, truncateErrorBody(detail))
 	}
 
 	var result map[string]interface{}
@@ -1084,7 +1216,7 @@ func OpenStreamLines(ctx context.Context, sess *SessionContext, fullURL string,
 			}
 			return &AuthError{StatusCode: resp.StatusCode, Detail: string(errBody)}
 		}
-		return fmt.Errorf("HTTP %d %s", resp.StatusCode, string(errBody))
+		return fmt.Errorf("HTTP %d %s", resp.StatusCode, truncateErrorBody(errBody))
 	}
 
 	// Cut off silent streams: long generations are fine (lines keep