fix(clients): re-enable depleted clients on API renewal (#5619)

Renewing a subscription via POST /panel/api/clients/bulkAdjust extended a client's expiry/quota but left it disabled. The enforcement loop disables a depleted client across client_traffics, client_records and the inbound settings JSON (and pushes that to the node), while BulkAdjust only updated expiry/total and never cleared enable. On a node its UpdateUser push was built from the stale ClientRecord (Enable=false), which the next traffic poll merged back onto the master, so the client never recovered.

BulkAdjust now re-enables a client only when it was disabled because it was depleted and the adjustment lifts it back within limits, computed as a set-difference of the production depletedCond predicate and applied through the canonical BulkSetEnable (run after the per-inbound loop, since lockInbound is non-reentrant). Manually-disabled or still-depleted clients stay disabled.

Update now writes the clients.enable column explicitly so re-enabling sticks for inbound-less clients and stops feeding a stale record into node pushes.

frontend/public/openapi.json

@@ -5848,7 +5848,7 @@
         "tags": [
           "Clients"
         ],
-        "summary": "Shift expiry and/or traffic quota for many clients in one call. addDays/addBytes may be negative. Clients with unlimited expiry (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the corresponding field — bulk extend never converts unlimited to limited. The optional flow directive sets the XTLS flow on every client: \"none\" clears it, \"xtls-rprx-vision\"/\"xtls-rprx-vision-udp443\" set it where the inbound supports it (omit or \"\" to leave it unchanged). Returns the adjusted count and per-email skip reasons.",
+        "summary": "Shift expiry and/or traffic quota for many clients in one call. addDays/addBytes may be negative. Clients with unlimited expiry (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the corresponding field — bulk extend never converts unlimited to limited. A client that was auto-disabled solely because it was depleted (expired or over quota) is automatically re-enabled — locally and on its node — when the adjustment lifts it out of depletion; a manually-disabled or still-depleted client is left disabled. The optional flow directive sets the XTLS flow on every client: \"none\" clears it, \"xtls-rprx-vision\"/\"xtls-rprx-vision-udp443\" set it where the inbound supports it (omit or \"\" to leave it unchanged). Returns the adjusted count and per-email skip reasons.",
         "operationId": "post_panel_api_clients_bulkAdjust",
         "requestBody": {
           "required": true,

frontend/src/pages/api-docs/endpoints.ts

@@ -673,7 +673,7 @@ export const sections: readonly Section[] = [
       {
         method: 'POST',
         path: '/panel/api/clients/bulkAdjust',
-        summary: 'Shift expiry and/or traffic quota for many clients in one call. addDays/addBytes may be negative. Clients with unlimited expiry (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the corresponding field — bulk extend never converts unlimited to limited. The optional flow directive sets the XTLS flow on every client: "none" clears it, "xtls-rprx-vision"/"xtls-rprx-vision-udp443" set it where the inbound supports it (omit or "" to leave it unchanged). Returns the adjusted count and per-email skip reasons.',
+        summary: 'Shift expiry and/or traffic quota for many clients in one call. addDays/addBytes may be negative. Clients with unlimited expiry (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the corresponding field — bulk extend never converts unlimited to limited. A client that was auto-disabled solely because it was depleted (expired or over quota) is automatically re-enabled — locally and on its node — when the adjustment lifts it out of depletion; a manually-disabled or still-depleted client is left disabled. The optional flow directive sets the XTLS flow on every client: "none" clears it, "xtls-rprx-vision"/"xtls-rprx-vision-udp443" set it where the inbound supports it (omit or "" to leave it unchanged). Returns the adjusted count and per-email skip reasons.',
         body: '{\n  "emails": ["alice", "bob"],\n  "addDays": 30,\n  "addBytes": 53687091200,\n  "flow": "xtls-rprx-vision"\n}',
         response: '{\n  "success": true,\n  "obj": {\n    "adjusted": 2,\n    "skipped": [\n      { "email": "carol", "reason": "unlimited expiry" }\n    ]\n  }\n}',
       },

internal/web/service/client_bulk.go

@@ -421,6 +421,27 @@ func (s *ClientService) BulkAdjust(inboundSvc *InboundService, emails []string,
 		}
 	}
 
+	now := time.Now().Unix() * 1000
+	cond := depletedCond(db)
+	candidateEmails := make([]string, 0, len(plan))
+	for email, entry := range plan {
+		if entry.applyExpiry || entry.applyTotal {
+			candidateEmails = append(candidateEmails, email)
+		}
+	}
+	wasDisabledDepleted := map[string]struct{}{}
+	for _, batch := range chunkStrings(candidateEmails, sqlInChunk) {
+		var rows []string
+		if err := db.Model(xray.ClientTraffic{}).
+			Where(cond+" AND enable = ? AND email IN ?", now, false, batch).
+			Pluck("email", &rows).Error; err != nil {
+			return result, needRestart, err
+		}
+		for _, e := range rows {
+			wasDisabledDepleted[e] = struct{}{}
+		}
+	}
+
 	adjusted := map[string]struct{}{}
 	for email, entry := range plan {
 		if _, skipped := skippedReasons[email]; skipped {
@@ -464,6 +485,41 @@ func (s *ClientService) BulkAdjust(inboundSvc *InboundService, emails []string,
 		}
 		result.Skipped = append(result.Skipped, BulkAdjustReport{Email: email, Reason: "flow not supported on inbound"})
 	}
+
+	if len(wasDisabledDepleted) > 0 {
+		stillDepleted := map[string]struct{}{}
+		wasList := make([]string, 0, len(wasDisabledDepleted))
+		for e := range wasDisabledDepleted {
+			wasList = append(wasList, e)
+		}
+		for _, batch := range chunkStrings(wasList, sqlInChunk) {
+			var rows []string
+			if err := db.Model(xray.ClientTraffic{}).
+				Where(cond+" AND email IN ?", now, batch).
+				Pluck("email", &rows).Error; err != nil {
+				return result, needRestart, err
+			}
+			for _, e := range rows {
+				stillDepleted[e] = struct{}{}
+			}
+		}
+		reEnable := make([]string, 0, len(wasDisabledDepleted))
+		for e := range wasDisabledDepleted {
+			if _, still := stillDepleted[e]; !still {
+				reEnable = append(reEnable, e)
+			}
+		}
+		if len(reEnable) > 0 {
+			_, nr, err := s.BulkSetEnable(inboundSvc, reEnable, true)
+			if err != nil {
+				return result, needRestart, err
+			}
+			if nr {
+				needRestart = true
+			}
+		}
+	}
+
 	return result, needRestart, nil
 }
 

internal/web/service/client_bulk_reenable_test.go

@@ -0,0 +1,287 @@
+package service
+
+import (
+	"testing"
+	"time"
+
+	"github.com/mhsanaei/3x-ui/v3/internal/database"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
+)
+
+const reenableDay = int64(24 * 60 * 60 * 1000)
+
+func recordEnableOf(t *testing.T, svc *ClientService, email string) bool {
+	t.Helper()
+	rec, err := svc.GetRecordByEmail(nil, email)
+	if err != nil {
+		t.Fatalf("GetRecordByEmail(%q): %v", email, err)
+	}
+	return rec.Enable
+}
+
+func forceRecordDisabled(t *testing.T, svc *ClientService, email string) {
+	t.Helper()
+	if err := database.GetDB().Model(&model.ClientRecord{}).
+		Where("email = ?", email).
+		UpdateColumn("enable", false).Error; err != nil {
+		t.Fatalf("force record disabled %q: %v", email, err)
+	}
+	if recordEnableOf(t, svc, email) {
+		t.Fatalf("setup: record %q should start disabled", email)
+	}
+}
+
+func jsonClientEnable(t *testing.T, inboundSvc *InboundService, inboundId int, email string) bool {
+	t.Helper()
+	ib, err := inboundSvc.GetInbound(inboundId)
+	if err != nil {
+		t.Fatalf("GetInbound(%d): %v", inboundId, err)
+	}
+	clients, err := inboundSvc.GetClients(ib)
+	if err != nil {
+		t.Fatalf("GetClients(%d): %v", inboundId, err)
+	}
+	for _, c := range clients {
+		if c.Email == email {
+			return c.Enable
+		}
+	}
+	t.Fatalf("client %q not found in inbound %d settings JSON", email, inboundId)
+	return false
+}
+
+func assertEnableEverywhere(t *testing.T, svc *ClientService, inboundSvc *InboundService, inboundId int, email string, want bool) {
+	t.Helper()
+	if got := trafficOf(t, email).Enable; got != want {
+		t.Fatalf("%s: client_traffics.enable = %v, want %v", email, got, want)
+	}
+	if got := recordEnableOf(t, svc, email); got != want {
+		t.Fatalf("%s: client_records.enable = %v, want %v", email, got, want)
+	}
+	if got := jsonClientEnable(t, inboundSvc, inboundId, email); got != want {
+		t.Fatalf("%s: inbound JSON enable = %v, want %v", email, got, want)
+	}
+}
+
+func seedLocalDisabledClient(t *testing.T, svc *ClientService, port int, stream, email string, total, expiry, up, down int64) *model.Inbound {
+	t.Helper()
+	c := model.Client{
+		Email:      email,
+		ID:         "11111111-1111-1111-1111-111111111111",
+		SubID:      email,
+		Enable:     false,
+		TotalGB:    total,
+		ExpiryTime: expiry,
+	}
+	var ib *model.Inbound
+	if stream == "" {
+		ib = mkInbound(t, port, model.VLESS, clientsSettings(t, []model.Client{c}))
+	} else {
+		ib = mkInboundStream(t, port, model.VLESS, clientsSettings(t, []model.Client{c}), stream)
+	}
+	if err := svc.SyncInbound(nil, ib.Id, []model.Client{c}); err != nil {
+		t.Fatalf("seed linkage: %v", err)
+	}
+	mkTraffic(t, ib.Id, email, up, down, total, expiry, false)
+	forceRecordDisabled(t, svc, email)
+	return ib
+}
+
+func TestBulkAdjust_ReenablesExpiredThenExtended_AllThreeLocations(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	now := time.Now().UnixMilli()
+	email := "exp@x"
+	ib := seedLocalDisabledClient(t, svc, 52001, "", email, 0, now-reenableDay, 0, 0)
+
+	res, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 30, 0, "")
+	if err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	if res.Adjusted != 1 {
+		t.Fatalf("expected 1 adjusted, got %d (skipped=%v)", res.Adjusted, res.Skipped)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, true)
+	if got := trafficOf(t, email).ExpiryTime; got != now-reenableDay+30*reenableDay {
+		t.Fatalf("%s: expiry = %d, want %d", email, got, now-reenableDay+30*reenableDay)
+	}
+}
+
+func TestBulkAdjust_DoesNotReenable_ManuallyDisabledNotDepleted(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	now := time.Now().UnixMilli()
+	email := "man@x"
+	ib := seedLocalDisabledClient(t, svc, 52002, "", email, 0, now+30*reenableDay, 0, 0)
+
+	res, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 30, 0, "")
+	if err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	if res.Adjusted != 1 {
+		t.Fatalf("expected 1 adjusted, got %d (skipped=%v)", res.Adjusted, res.Skipped)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, false)
+}
+
+func TestBulkAdjust_StaysDisabled_ExtensionTooSmall(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	now := time.Now().UnixMilli()
+	email := "sml@x"
+	ib := seedLocalDisabledClient(t, svc, 52003, "", email, 0, now-10*reenableDay, 0, 0)
+
+	if _, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 5, 0, ""); err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, false)
+}
+
+func TestBulkAdjust_ReenablesOverQuota_WhenAddBytesClearsQuota(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	email := "q@x"
+	ib := seedLocalDisabledClient(t, svc, 52004, "", email, 100, 0, 60, 40)
+
+	res, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 0, 200, "")
+	if err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	if res.Adjusted != 1 {
+		t.Fatalf("expected 1 adjusted, got %d (skipped=%v)", res.Adjusted, res.Skipped)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, true)
+	if got := trafficOf(t, email).Total; got != 300 {
+		t.Fatalf("%s: total = %d, want 300", email, got)
+	}
+}
+
+func TestBulkAdjust_OverQuota_DaysOnly_StaysDisabled(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	now := time.Now().UnixMilli()
+	email := "qd@x"
+	ib := seedLocalDisabledClient(t, svc, 52005, "", email, 100, now-reenableDay, 60, 40)
+
+	if _, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 60, 0, ""); err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, false)
+}
+
+func TestBulkAdjust_NegativeReduction_DoesNotFlipEnable(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	now := time.Now().UnixMilli()
+	email := "neg@x"
+	c := model.Client{Email: email, ID: "11111111-1111-1111-1111-111111111111", SubID: email, Enable: true, ExpiryTime: now + 5*reenableDay}
+	ib := mkInbound(t, 52006, model.VLESS, clientsSettings(t, []model.Client{c}))
+	if err := svc.SyncInbound(nil, ib.Id, []model.Client{c}); err != nil {
+		t.Fatalf("seed linkage: %v", err)
+	}
+	mkTraffic(t, ib.Id, email, 0, 0, 0, now+5*reenableDay, true)
+
+	if _, _, err := svc.BulkAdjust(inboundSvc, []string{email}, -10, 0, ""); err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, true)
+}
+
+func TestBulkAdjust_FlowOnly_NoEnableChange(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	now := time.Now().UnixMilli()
+	email := "flow@x"
+	ib := seedLocalDisabledClient(t, svc, 52007, realityStream, email, 0, now-reenableDay, 0, 0)
+
+	if _, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 0, 0, "xtls-rprx-vision-udp443"); err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, false)
+	if got := flowOf(t, svc, email); got != "xtls-rprx-vision-udp443" {
+		t.Fatalf("%s: flow = %q, want xtls-rprx-vision-udp443", email, got)
+	}
+}
+
+func TestBulkAdjust_UnlimitedExpiry_QuotaCleared_Reenables(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	email := "u@x"
+	ib := seedLocalDisabledClient(t, svc, 52008, "", email, 100, 0, 100, 0)
+
+	res, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 0, 200, "")
+	if err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	if res.Adjusted != 1 {
+		t.Fatalf("expected 1 adjusted, got %d (skipped=%v)", res.Adjusted, res.Skipped)
+	}
+	assertEnableEverywhere(t, svc, inboundSvc, ib.Id, email, true)
+	if got := trafficOf(t, email).Total; got != 300 {
+		t.Fatalf("%s: total = %d, want 300", email, got)
+	}
+}
+
+func TestBulkAdjust_NodeInbound_ReenablesDBLocations(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	node := &model.Node{Name: "n5619", Address: "127.0.0.1", Port: 2096, ApiToken: "tok", Enable: true, Status: "offline"}
+	if err := database.GetDB().Create(node).Error; err != nil {
+		t.Fatalf("create node: %v", err)
+	}
+
+	now := time.Now().UnixMilli()
+	email := "node@x"
+	c := model.Client{Email: email, ID: "11111111-1111-1111-1111-111111111111", SubID: email, Enable: false, ExpiryTime: now - reenableDay}
+	ib := &model.Inbound{
+		Tag:      "node-in-5619",
+		Enable:   true,
+		Port:     52900,
+		Protocol: model.VLESS,
+		Settings: clientsSettings(t, []model.Client{c}),
+		NodeID:   &node.Id,
+	}
+	if err := database.GetDB().Create(ib).Error; err != nil {
+		t.Fatalf("create node inbound: %v", err)
+	}
+	if err := svc.SyncInbound(nil, ib.Id, []model.Client{c}); err != nil {
+		t.Fatalf("seed linkage: %v", err)
+	}
+	mkTraffic(t, ib.Id, email, 0, 0, 0, now-reenableDay, false)
+	forceRecordDisabled(t, svc, email)
+
+	res, _, err := svc.BulkAdjust(inboundSvc, []string{email}, 30, 0, "")
+	if err != nil {
+		t.Fatalf("BulkAdjust: %v", err)
+	}
+	if res.Adjusted != 1 {
+		t.Fatalf("expected 1 adjusted, got %d (skipped=%v)", res.Adjusted, res.Skipped)
+	}
+	if got := trafficOf(t, email).Enable; !got {
+		t.Fatalf("%s: client_traffics.enable = false, want true", email)
+	}
+	if got := recordEnableOf(t, svc, email); !got {
+		t.Fatalf("%s: client_records.enable = false, want true", email)
+	}
+	if got := jsonClientEnable(t, inboundSvc, ib.Id, email); !got {
+		t.Fatalf("%s: inbound JSON enable = false, want true", email)
+	}
+}

internal/web/service/client_crud.go

@@ -409,6 +409,12 @@ func (s *ClientService) Update(inboundSvc *InboundService, id int, updated model
 		return needRestart, err
 	}
 
+	if err := database.GetDB().Model(&model.ClientRecord{}).
+		Where("id = ?", id).
+		UpdateColumn("enable", updated.Enable).Error; err != nil {
+		return needRestart, err
+	}
+
 	if err := database.GetDB().Model(&model.ClientRecord{}).
 		Where("id = ?", id).
 		UpdateColumn("updated_at", time.Now().UnixMilli()).Error; err != nil {

internal/web/service/client_update_enable_test.go

@@ -0,0 +1,153 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/mhsanaei/3x-ui/v3/internal/database"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
+)
+
+func TestUpdate_PersistsRecordEnable_True(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	email := "u-true@x"
+	c := model.Client{Email: email, ID: "11111111-1111-1111-1111-111111111111", SubID: email, Enable: false}
+	ib := mkInbound(t, 53001, model.VLESS, clientsSettings(t, []model.Client{c}))
+	if err := svc.SyncInbound(nil, ib.Id, []model.Client{c}); err != nil {
+		t.Fatalf("seed linkage: %v", err)
+	}
+	mkTraffic(t, ib.Id, email, 0, 0, 0, 0, false)
+
+	rec, err := svc.GetRecordByEmail(nil, email)
+	if err != nil {
+		t.Fatalf("GetRecordByEmail: %v", err)
+	}
+	updated := rec.ToClient()
+	updated.Enable = true
+	if _, err := svc.Update(inboundSvc, rec.Id, *updated); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	if got := recordEnableOf(t, svc, email); !got {
+		t.Fatalf("%s: client_records.enable = false, want true", email)
+	}
+	if got := trafficOf(t, email).Enable; !got {
+		t.Fatalf("%s: client_traffics.enable = false, want true", email)
+	}
+	if got := jsonClientEnable(t, inboundSvc, ib.Id, email); !got {
+		t.Fatalf("%s: inbound JSON enable = false, want true", email)
+	}
+}
+
+func TestUpdate_PersistsRecordEnable_False(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	email := "u-false@x"
+	c := model.Client{Email: email, ID: "11111111-1111-1111-1111-111111111111", SubID: email, Enable: true}
+	ib := mkInbound(t, 53002, model.VLESS, clientsSettings(t, []model.Client{c}))
+	if err := svc.SyncInbound(nil, ib.Id, []model.Client{c}); err != nil {
+		t.Fatalf("seed linkage: %v", err)
+	}
+	mkTraffic(t, ib.Id, email, 0, 0, 0, 0, true)
+
+	rec, err := svc.GetRecordByEmail(nil, email)
+	if err != nil {
+		t.Fatalf("GetRecordByEmail: %v", err)
+	}
+	updated := rec.ToClient()
+	updated.Enable = false
+	if _, err := svc.Update(inboundSvc, rec.Id, *updated); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	if got := recordEnableOf(t, svc, email); got {
+		t.Fatalf("%s: client_records.enable = true, want false", email)
+	}
+}
+
+func TestUpdate_PersistsRecordEnable_NoInbound(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	email := "u-noib@x"
+	rec := &model.ClientRecord{
+		Email:  email,
+		UUID:   "11111111-1111-1111-1111-111111111111",
+		SubID:  email,
+		Enable: false,
+	}
+	if err := database.GetDB().Create(rec).Error; err != nil {
+		t.Fatalf("create record: %v", err)
+	}
+	forceRecordDisabled(t, svc, email)
+
+	updated := rec.ToClient()
+	updated.Enable = true
+	if _, err := svc.Update(inboundSvc, rec.Id, *updated); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	if got := recordEnableOf(t, svc, email); !got {
+		t.Fatalf("%s: client_records.enable = false, want true (no-inbound persistence gap)", email)
+	}
+}
+
+func TestResetTrafficByEmail_LeavesRecordEnableTrue(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	email := "r-attached@x"
+	c := model.Client{Email: email, ID: "11111111-1111-1111-1111-111111111111", SubID: email, Enable: false}
+	ib := mkInbound(t, 53003, model.VLESS, clientsSettings(t, []model.Client{c}))
+	if err := svc.SyncInbound(nil, ib.Id, []model.Client{c}); err != nil {
+		t.Fatalf("seed linkage: %v", err)
+	}
+	mkTraffic(t, ib.Id, email, 10, 20, 0, 0, false)
+
+	if _, err := svc.ResetTrafficByEmail(inboundSvc, email); err != nil {
+		t.Fatalf("ResetTrafficByEmail: %v", err)
+	}
+
+	if got := recordEnableOf(t, svc, email); !got {
+		t.Fatalf("%s: client_records.enable = false, want true", email)
+	}
+	tr := trafficOf(t, email)
+	if !tr.Enable {
+		t.Fatalf("%s: client_traffics.enable = false, want true", email)
+	}
+	if tr.Up != 0 || tr.Down != 0 {
+		t.Fatalf("%s: expected up/down 0, got up=%d down=%d", email, tr.Up, tr.Down)
+	}
+}
+
+func TestResetTrafficByEmail_NoInbound_LeavesRecordEnableTrue(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	email := "r-noib@x"
+	rec := &model.ClientRecord{
+		Email:  email,
+		UUID:   "11111111-1111-1111-1111-111111111111",
+		SubID:  email,
+		Enable: false,
+	}
+	if err := database.GetDB().Create(rec).Error; err != nil {
+		t.Fatalf("create record: %v", err)
+	}
+	forceRecordDisabled(t, svc, email)
+
+	if _, err := svc.ResetTrafficByEmail(inboundSvc, email); err != nil {
+		t.Fatalf("ResetTrafficByEmail: %v", err)
+	}
+
+	if got := recordEnableOf(t, svc, email); !got {
+		t.Fatalf("%s: client_records.enable = false, want true (no-inbound reset re-enable gap)", email)
+	}
+}