diff --git a/internal/lua/plugins/ccquota.lua b/internal/lua/plugins/ccquota.lua
index 83c9af4..b37cd11 100644
--- a/internal/lua/plugins/ccquota.lua
+++ b/internal/lua/plugins/ccquota.lua
@@ -299,7 +299,10 @@ PLUGIN.ui = {
     try{
       var r=await fetch("/api/sources",{credentials:"same-origin"});
       srcs=(await r.json()).sources||[];
-    }catch(e){ render([]); return; }
+    }catch(e){
+      var s0=document.getElementById("ccq-sub"); if(s0) s0.textContent="拉取源列表失败: "+e.message;
+      render([]); return;
+    }
     // Every source on the Command Code host is one account, keyed by its own
     // API key — two keys on that host are two seats, and both must be listed.
     var accts=srcs.filter(function(s){
@@ -310,6 +313,11 @@ PLUGIN.ui = {
     if(btn) btn.disabled=true;
     var auto=document.getElementById("ccq-auto")||document.querySelector(".ccq-auto");
     if(auto) auto.textContent="拉取中…";
+    if(!window.pluginAPI || typeof pluginAPI.call!=="function"){
+      var sb=document.getElementById("ccq-sub");
+      if(sb) sb.textContent="pluginAPI.call 不可用（内核版本过旧）";
+      render([]); return;
+    }
     var out=[];
     var errs=0;
     // One account at a time: the endpoints are independent, and a sequential
@@ -331,11 +339,36 @@ PLUGIN.ui = {
     if(auto) auto.textContent="更新于 "+new Date().toLocaleTimeString();
     try{ await pluginAPI.postState("ccquota",{reports:out,updated_at:Date.now()}); }catch(e){}
   }
-  document.addEventListener("DOMContentLoaded",function(){
+  // The mount is injected long after DOMContentLoaded has already fired, so
+  // listening for that event here registered a handler for an event that had
+  // already been dispatched — the page rendered but stayed empty until a manual
+  // refresh. Wiring the button and fetching immediately is what makes the page
+  // populate on first open.
+  // The plugin mount is injected by the kernel and its <script> evaluated after
+  // injection, but that still happens during the UI's own boot — and the page
+  // body is rebuilt whenever the tab is opened. Two consequences:
+  //
+  //   - A DOMContentLoaded listener never fires (the event already passed), so
+  //     the page rendered empty until a manual refresh.
+  //   - Wiring the refresh button once at script-eval time silently loses the
+  //     handler when the tab's DOM is replaced.
+  //
+  // pluginAPI.onTabShown is the kernel's answer to both: the callback runs when
+  // the tab is actually shown, with the DOM in place. It also runs once for the
+  // already-visible tab at boot, so this single registration covers first paint
+  // AND every later re-entry.
+  function mount(){
     var b=document.getElementById("ccq-refresh");
-    if(b) b.addEventListener("click",refresh);
-    refresh();
-  });
+    // The tab's DOM is rebuilt on re-entry, so a handler wired against the old
+    // node is gone. The flag lives on the NODE, not in a closure variable, which
+    // is what makes re-wiring safe.
+    if(b && !b.__ccqWired){ b.__ccqWired = true; b.addEventListener("click",refresh); }
+  }
+  // Run once immediately — the billing page does the same, and waiting only for
+  // onTabShown leaves the page blank when the tab is already open at boot.
+  mount();
+  refresh();
+  if (window.pluginAPI && pluginAPI.onTabShown) pluginAPI.onTabShown(mount);
   window.__ccqRender = render;
   window.__ccqRefresh = refresh;
 })();