chore: bump version to 3.0.19

Co-authored-by: Codex <noreply@openai.com>

backend/crates/gateway-admin/src/model/provider_credentials.rs

@@ -171,13 +171,6 @@ pub struct CredentialImportCommit {
     pub prepared: PreparedCredentialImport,
 }
 
-/// 可选的重新授权目标。
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ReauthorizationTarget {
-    pub account_id: ProviderAccountId,
-    pub credential_revision: Revision,
-}
-
 /// OAuth pending owner 的中立身份；不编码具体 Provider 的 Redis key 或 JSON。
 #[derive(Clone, PartialEq, Eq)]
 pub enum AuthorizationOwner {
@@ -238,15 +231,13 @@ impl fmt::Debug for AuthorizationOwnerBinding {
 }
 
 /// OAuth 完成时应创建新账号还是 CAS 更新既有 credential。
+///
+/// 重新授权只绑定稳定的账号身份：credential revision 由服务端在临近写入时读取，
+/// 长流程期间的后台刷新不得让恢复操作失效。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum AuthorizationMutationTarget {
-    Create {
-        name: String,
-    },
-    Reauthorize {
-        account_id: ProviderAccountId,
-        expected_credential_revision: Revision,
-    },
+    Create { name: String },
+    Reauthorize { account_id: ProviderAccountId },
 }
 
 /// 必须完整进入 Provider opaque pending payload、并在 complete 后原样恢复的事务信封。
@@ -292,7 +283,7 @@ impl PendingAuthorizationMutation {
 pub struct StartAuthorization {
     pub context: MutationContext,
     pub name: String,
-    pub reauthorization: Option<ReauthorizationTarget>,
+    pub reauthorization: Option<ProviderAccountId>,
 }
 
 /// OAuth 流程启动结果。
@@ -480,14 +471,12 @@ pub struct CredentialDeletionResult {
 /// Provider-owned token 轮换命令。
 pub struct RotateCredential {
     pub mutation: CredentialMutation,
-    pub expected_credential_revision: Revision,
     pub provider_material: ProviderDocument,
 }
 
 /// Provider 校验手工轮换材料时所需的非事务输入。
 pub struct PrepareCredentialRotation {
     pub account: AccountRecord,
-    pub expected_credential_revision: Revision,
     pub provider_material: ProviderDocument,
 }
 
@@ -496,10 +485,6 @@ impl fmt::Debug for PrepareCredentialRotation {
         formatter
             .debug_struct("PrepareCredentialRotation")
             .field("account", &self.account)
-            .field(
-                "expected_credential_revision",
-                &self.expected_credential_revision,
-            )
             .field("provider_material", &self.provider_material)
             .finish()
     }
@@ -572,10 +557,6 @@ impl fmt::Debug for RotateCredential {
         formatter
             .debug_struct("RotateCredential")
             .field("mutation", &self.mutation)
-            .field(
-                "expected_credential_revision",
-                &self.expected_credential_revision,
-            )
             .field("provider_material", &self.provider_material)
             .finish()
     }

backend/crates/gateway-admin/src/use_case/mod.rs

@@ -90,17 +90,10 @@ async fn pending_authorization(
     resource: &'static str,
 ) -> Result<PendingAuthorizationMutation, AdminError> {
     let target = match &command.reauthorization {
-        Some(target) => {
-            let details =
-                required_credential(accounts, provider_kind, &target.account_id, resource).await?;
-            if details.credential.credential_revision != target.credential_revision {
-                return Err(AdminError::conflict(format!(
-                    "{resource} reauthorization target is stale"
-                )));
-            }
+        Some(account_id) => {
+            required_credential(accounts, provider_kind, account_id, resource).await?;
             AuthorizationMutationTarget::Reauthorize {
-                account_id: target.account_id.clone(),
-                expected_credential_revision: target.credential_revision,
+                account_id: account_id.clone(),
             }
         }
         None => AuthorizationMutationTarget::Create {
@@ -142,7 +135,6 @@ fn validate_prepared_rotation(
     let facts = prepared.facts();
     if facts.account_id.as_str() != account.id.as_str()
         || facts.provider_kind != account.provider_kind
-        || facts.expected_credential_revision != account.credential_revision
     {
         return Err(AdminError::conflict(format!(
             "{resource} prepared facts do not match the current credential"
@@ -179,16 +171,11 @@ async fn validate_authorization_commit(
             PreparedAuthorizationCredential::Create(credential),
         ) => credential.provider_kind == *provider_kind,
         (
-            AuthorizationMutationTarget::Reauthorize {
-                account_id,
-                expected_credential_revision,
-            },
+            AuthorizationMutationTarget::Reauthorize { account_id },
             PreparedAuthorizationCredential::Reauthorize(credential),
         ) => {
             let facts = credential.facts();
-            facts.provider_kind == *provider_kind
-                && facts.account_id == *account_id
-                && facts.expected_credential_revision == *expected_credential_revision
+            facts.provider_kind == *provider_kind && facts.account_id == *account_id
         }
         _ => false,
     };

backend/crates/gateway-admin/src/use_case/openai.rs

@@ -227,17 +227,11 @@ impl OpenAiService for DefaultOpenAiService {
             "OpenAI credential rotation",
         )
         .await?;
-        if details.credential.credential_revision != command.expected_credential_revision {
-            return Err(AdminError::conflict(
-                "OpenAI credential rotation revision is stale",
-            ));
-        }
         let account = details.credential;
         let prepared = self
             .provider
             .prepare_rotation(PrepareCredentialRotation {
                 account: account.clone(),
-                expected_credential_revision: command.expected_credential_revision,
                 provider_material: command.provider_material,
             })
             .await

backend/crates/gateway-admin/tests/use_case/accounts.rs

@@ -64,6 +64,7 @@ pub(super) struct FakeProviderAdmin {
     import_account_ids: Mutex<Vec<String>>,
     quota_requests: Mutex<Vec<ProviderQuotaRequest>>,
     quota: Mutex<ProviderQuota>,
+    current_credential_revision: Mutex<Revision>,
 }
 
 impl FakeProviderAdmin {
@@ -79,6 +80,7 @@ impl FakeProviderAdmin {
             import_account_ids: Mutex::new(vec!["acct_prepared".to_owned()]),
             quota_requests: Mutex::new(Vec::new()),
             quota: Mutex::new(empty_quota()),
+            current_credential_revision: Mutex::new(revision(1)),
         })
     }
 
@@ -122,6 +124,13 @@ impl FakeProviderAdmin {
             .expect("authorization retry") = true;
     }
 
+    pub(super) fn set_current_credential_revision(&self, revision: Revision) {
+        *self
+            .current_credential_revision
+            .lock()
+            .expect("current credential revision") = revision;
+    }
+
     fn export_inputs(&self) -> Vec<ProviderExportCredentialInput> {
         self.export_inputs.lock().expect("export inputs").clone()
     }
@@ -142,7 +151,10 @@ impl FakeProviderAdmin {
             PreparedCredentialRotationFacts {
                 account_id: ProviderAccountId::new(account.id.clone()).expect("account ID"),
                 provider_kind: account.provider_kind.clone(),
-                expected_credential_revision: account.credential_revision,
+                expected_credential_revision: *self
+                    .current_credential_revision
+                    .lock()
+                    .expect("current credential revision"),
                 name: account.name.clone(),
                 email: account.email.clone(),
                 plan_type: account.plan_type.clone(),
@@ -264,13 +276,9 @@ impl ProviderAdmin for FakeProviderAdmin {
             AuthorizationMutationTarget::Create { name } => {
                 PreparedAuthorizationCredential::Create(prepared_create(self.kind.clone(), name))
             }
-            AuthorizationMutationTarget::Reauthorize {
-                account_id,
-                expected_credential_revision,
-            } => {
+            AuthorizationMutationTarget::Reauthorize { account_id } => {
                 let mut account = account_record(self.kind.as_str());
                 account.id = account_id.as_str().to_owned();
-                account.credential_revision = *expected_credential_revision;
                 PreparedAuthorizationCredential::Reauthorize(self.prepared_rotation(&account))
             }
         };

backend/crates/gateway-admin/tests/use_case/openai.rs

@@ -6,7 +6,7 @@ use gateway_admin::{
     AdminServices,
     model::provider_credentials::{
         AuthorizationMutationTarget, CompleteAuthorization, CredentialDeletion, CredentialMutation,
-        ImportCredentials, ProviderQuotaRequest, ReauthorizationTarget, StartAuthorization,
+        ImportCredentials, ProviderQuotaRequest, StartAuthorization,
     },
     ports::provider::ProviderAdminErrorKind,
 };
@@ -351,7 +351,7 @@ async fn openai_import_provider_error_should_not_touch_store_transaction() {
 }
 
 #[tokio::test]
-async fn openai_reauthorization_should_restore_pending_envelope_and_hold_guard_through_commit() {
+async fn openai_reauthorization_should_commit_after_credential_revision_advances() {
     let events = events();
     let provider = FakeProviderAdmin::new("openai", events.clone());
     let store = FakeAccountStore::new("openai", events.clone());
@@ -361,10 +361,7 @@ async fn openai_reauthorization_should_restore_pending_envelope_and_hold_guard_t
         .start_authorization(StartAuthorization {
             context: context("oauth-start-openai"),
             name: "reauthorize".to_owned(),
-            reauthorization: Some(ReauthorizationTarget {
-                account_id: ProviderAccountId::new("acct_test").expect("account ID"),
-                credential_revision: revision(1),
-            }),
+            reauthorization: Some(ProviderAccountId::new("acct_test").expect("account ID")),
         })
         .await
         .expect("start reauthorization");
@@ -377,15 +374,14 @@ async fn openai_reauthorization_should_restore_pending_envelope_and_hold_guard_t
     );
     assert!(matches!(
         pending.target(),
-        AuthorizationMutationTarget::Reauthorize {
-            account_id,
-            expected_credential_revision,
-        } if account_id.as_str() == "acct_test"
-            && *expected_credential_revision == revision(1)
+        AuthorizationMutationTarget::Reauthorize { account_id }
+            if account_id.as_str() == "acct_test"
     ));
     assert!(!format!("{pending:?}").contains("admin-test"));
 
-    services
+    provider.set_current_credential_revision(revision(2));
+
+    let result = services
         .openai()
         .complete_authorization(CompleteAuthorization {
             context: context("oauth-complete-openai"),
@@ -395,6 +391,8 @@ async fn openai_reauthorization_should_restore_pending_envelope_and_hold_guard_t
         .await
         .expect("complete reauthorization");
 
+    assert_eq!(result.credential_revision, Some(revision(3)));
+
     assert_eq!(
         recorded(&events),
         [

backend/crates/gateway-api/src/admin/accounts.rs

@@ -16,7 +16,7 @@ use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use chrono::{DateTime, FixedOffset, Utc};
 use futures::{Stream, StreamExt as _};
 use gateway_admin::model::{
-    AdminError as AdminServiceError, AdminErrorKind, PageSize, Revision,
+    AdminError as AdminServiceError, AdminErrorKind, PageSize,
     accounts::{
         AccountConnectionTestEvent as DomainConnectionTestEvent, AccountCost, AccountListQuery,
         AccountModelUsage, AccountSort, AccountSortField, AccountStatus as DomainAccountStatus,
@@ -26,8 +26,8 @@ use gateway_admin::model::{
         AccountDirectoryItem, AccountDirectoryPage, AccountExportBundle, AccountRefreshResult,
         AuthorizationStarted, CompleteAuthorization, CredentialDeletion, CredentialDeletionResult,
         CredentialImportResult, CredentialMutation, CredentialMutationResult, ImportCredentials,
-        ProviderDocument, ProviderModels, ProviderQuota, ProviderQuotaWindow,
-        ReauthorizationTarget, RotateCredential, StartAuthorization,
+        ProviderDocument, ProviderModels, ProviderQuota, ProviderQuotaWindow, RotateCredential,
+        StartAuthorization,
     },
 };
 use gateway_core::{
@@ -196,8 +196,6 @@ pub struct AccountView {
     pub token_refreshing: bool,
     pub availability: String,
     pub enabled: bool,
-    pub credential_revision: u64,
-    pub state_revision: Option<u64>,
     pub access_token_expires_at: Option<String>,
     pub access_token_expires_at_display: Option<String>,
     pub refresh_token_expires_at: Option<String>,
@@ -604,24 +602,16 @@ pub struct StartAccountAuthorizationRequest {
     pub provider: String,
     pub name: String,
     pub account_id: Option<String>,
-    pub expected_credential_revision: Option<u64>,
 }
 
 impl StartAccountAuthorizationRequest {
     pub fn validate(&self) -> Result<(), WireValidationError> {
         AccountProvider::parse(&self.provider)?;
         require_text(&self.name, MAX_NAME_BYTES, "name")?;
-        match (
-            self.account_id.as_deref(),
-            self.expected_credential_revision,
-        ) {
-            (None, None) => Ok(()),
-            (Some(account_id), Some(credential_revision)) => {
-                require_account_id(account_id, "accountId")?;
-                require_positive(credential_revision, "expectedCredentialRevision")
-            }
-            _ => Err(WireValidationError::new("reauthorization")),
+        if let Some(account_id) = self.account_id.as_deref() {
+            require_account_id(account_id, "accountId")?;
         }
+        Ok(())
     }
 
     fn into_command(
@@ -630,15 +620,11 @@ impl StartAccountAuthorizationRequest {
     ) -> Result<(AccountProvider, StartAuthorization), WireValidationError> {
         self.validate()?;
         let provider = AccountProvider::parse(&self.provider)?;
-        let reauthorization = match (self.account_id, self.expected_credential_revision) {
-            (None, None) => None,
-            (Some(account_id), Some(credential_revision)) => Some(ReauthorizationTarget {
-                account_id: ProviderAccountId::new(account_id)
-                    .map_err(|_| WireValidationError::new("accountId"))?,
-                credential_revision: revision(credential_revision, "expectedCredentialRevision")?,
-            }),
-            _ => return Err(WireValidationError::new("reauthorization")),
-        };
+        let reauthorization = self
+            .account_id
+            .map(ProviderAccountId::new)
+            .transpose()
+            .map_err(|_| WireValidationError::new("accountId"))?;
         Ok((
             provider,
             StartAuthorization {
@@ -771,7 +757,6 @@ impl AccountDeletionRequest {
 pub struct RotateAccountRequest {
     pub provider: String,
     pub account_id: String,
-    pub expected_credential_revision: u64,
     pub access_token: String,
     pub refresh_token: Option<String>,
 }
@@ -782,10 +767,6 @@ impl RotateAccountRequest {
             return Err(WireValidationError::new("provider"));
         }
         require_account_id(&self.account_id, "accountId")?;
-        require_positive(
-            self.expected_credential_revision,
-            "expectedCredentialRevision",
-        )?;
         validate_oauth_material(&self.access_token, self.refresh_token.as_deref())
     }
 
@@ -806,10 +787,6 @@ impl RotateAccountRequest {
                 account_id: ProviderAccountId::new(self.account_id)
                     .map_err(|_| WireValidationError::new("accountId"))?,
             },
-            expected_credential_revision: revision(
-                self.expected_credential_revision,
-                "expectedCredentialRevision",
-            )?,
             provider_material: ProviderDocument::new(OpaqueProviderData::new(material)),
         })
     }
@@ -858,15 +835,12 @@ impl From<AuthorizationStarted> for AccountAuthorizationData {
 #[serde(rename_all = "camelCase")]
 pub struct AccountMutationData {
     pub account_id: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub credential_revision: Option<u64>,
 }
 
 impl From<CredentialMutationResult> for AccountMutationData {
     fn from(result: CredentialMutationResult) -> Self {
         Self {
             account_id: result.account_id.to_string(),
-            credential_revision: result.credential_revision.map(Revision::get),
         }
     }
 }
@@ -1409,8 +1383,6 @@ fn account_view(item: AccountDirectoryItem, now: DateTime<Utc>) -> AccountView {
         token_refreshing: false,
         availability: account.availability.as_str().to_owned(),
         enabled: account.enabled,
-        credential_revision: account.credential_revision.get(),
-        state_revision: None,
         access_token_expires_at: expires_at,
         access_token_expires_at_display: account
             .access_token_expires_at
@@ -1661,10 +1633,6 @@ fn empty_account_usage() -> AccountUsageView {
     }
 }
 
-fn revision(value: u64, field: &'static str) -> Result<Revision, WireValidationError> {
-    Revision::new(value).map_err(|_| WireValidationError::new(field))
-}
-
 fn provider_document(
     value: Value,
     field: &'static str,
@@ -1698,13 +1666,6 @@ fn require_text(
     Ok(())
 }
 
-fn require_positive(value: u64, field: &'static str) -> Result<(), WireValidationError> {
-    if value == 0 || i64::try_from(value).is_err() {
-        return Err(WireValidationError::new(field));
-    }
-    Ok(())
-}
-
 fn validate_oauth_material(
     access_token: &str,
     refresh_token: Option<&str>,

backend/crates/gateway-api/tests/admin/accounts.rs

@@ -105,12 +105,15 @@ mod actions {
     use gateway_admin::model::{
         Revision,
         accounts::{AccountConnectionTestEvent as DomainConnectionTestEvent, AccountStatus},
-        provider_credentials::{CredentialDeletionResult, CredentialImportResult},
+        provider_credentials::{
+            CredentialDeletionResult, CredentialImportResult, CredentialMutationResult,
+        },
     };
     use gateway_api::admin::accounts::{
         AccountActionRequest, AccountConnectionTestEvent, AccountDeletionData,
         AccountDeletionRequest, AccountExportData, AccountExportQuery, AccountIdQuery,
-        AccountImportData, AccountImportRequest, AccountRefreshRequest, AccountTestQuery,
+        AccountImportData, AccountImportRequest, AccountMutationData, AccountRefreshRequest,
+        AccountTestQuery, RotateAccountRequest, StartAccountAuthorizationRequest,
     };
     use gateway_core::engine::credential::ProviderAccountId;
     use serde_json::json;
@@ -168,6 +171,58 @@ mod actions {
         );
     }
 
+    #[test]
+    fn credential_recovery_requests_should_not_accept_client_revision_fences() {
+        let authorization: StartAccountAuthorizationRequest = serde_json::from_value(json!({
+            "provider": "openai",
+            "name": "reauthorize",
+            "accountId": "acct_1"
+        }))
+        .expect("decode reauthorization");
+        assert!(authorization.validate().is_ok());
+        assert!(
+            serde_json::from_value::<StartAccountAuthorizationRequest>(json!({
+                "provider": "openai",
+                "name": "reauthorize",
+                "accountId": "acct_1",
+                "expectedCredentialRevision": 1
+            }))
+            .is_err()
+        );
+
+        let rotation: RotateAccountRequest = serde_json::from_value(json!({
+            "provider": "openai",
+            "accountId": "acct_1",
+            "accessToken": "header.payload.signature",
+            "refreshToken": "refresh-token"
+        }))
+        .expect("decode rotation");
+        assert!(rotation.validate().is_ok());
+        assert!(
+            serde_json::from_value::<RotateAccountRequest>(json!({
+                "provider": "openai",
+                "accountId": "acct_1",
+                "expectedCredentialRevision": 1,
+                "accessToken": "header.payload.signature"
+            }))
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn credential_mutation_response_should_not_expose_internal_revision() {
+        let response = AccountMutationData::from(CredentialMutationResult {
+            config_revision: Revision::new(8).expect("config revision"),
+            account_id: ProviderAccountId::new("acct_1").expect("account ID"),
+            credential_revision: Some(Revision::new(9).expect("credential revision")),
+        });
+
+        assert_eq!(
+            serde_json::to_value(response).expect("serialize credential mutation"),
+            json!({ "accountId": "acct_1" })
+        );
+    }
+
     #[test]
     fn account_import_should_use_provider_and_opaque_data_fields() {
         let valid: AccountImportRequest = serde_json::from_value(json!({

backend/crates/gateway-core/src/engine/credential.rs

@@ -602,6 +602,15 @@ pub trait ProviderAccountStore: Send + Sync {
         expected_revision: CredentialRevision,
     ) -> Result<LoadedCredential, StoreError>;
 
+    /// 读取账号当前 credential 及其 revision，不做任何版本比对。
+    ///
+    /// 管理写入必须在临近 CAS 时用它取 fence，而不是携带调用方持有的旧 revision：
+    /// 后台刷新随时会推进 revision，用陈旧快照会把正常的恢复操作误判为冲突。
+    async fn load_current_credential(
+        &self,
+        account: &ProviderAccountId,
+    ) -> Result<LoadedCredential, StoreError>;
+
     async fn compare_and_swap_credential(
         &self,
         update: CredentialCasUpdate,

backend/crates/gateway-store/src/postgres/provider_accounts.rs

@@ -2191,15 +2191,23 @@ impl ProviderAccountStore for PgProviderAccountRepository {
         &self,
         account: &CoreProviderAccountId,
         expected_revision: CoreCredentialRevision,
+    ) -> Result<LoadedCredential, CoreStoreError> {
+        let loaded = self.load_current_credential(account).await?;
+        if loaded.account.revision().get() != expected_revision.get() {
+            return Err(CoreStoreError::new(CoreStoreErrorKind::Conflict));
+        }
+        Ok(loaded)
+    }
+
+    async fn load_current_credential(
+        &self,
+        account: &CoreProviderAccountId,
     ) -> Result<LoadedCredential, CoreStoreError> {
         let record = self
             .load_provider_account(account.as_str())
             .await
             .map_err(core_store_error)?
             .ok_or_else(|| CoreStoreError::new(CoreStoreErrorKind::InvalidData))?;
-        if record.summary.credential_revision.get() != expected_revision.get() {
-            return Err(CoreStoreError::new(CoreStoreErrorKind::Conflict));
-        }
         Ok(LoadedCredential {
             account: core_account_from_summary(record.summary)?,
             credential: PlaintextCredential::new(record.provider_credentials_json.fields().clone()),

backend/crates/gateway-store/src/redis/credential_cooldown.rs

@@ -348,6 +348,13 @@ impl ProviderAccountStore for CooldownCachingProviderAccountStore {
             .await
     }
 
+    async fn load_current_credential(
+        &self,
+        account: &ProviderAccountId,
+    ) -> Result<LoadedCredential, CoreStoreError> {
+        self.authoritative.load_current_credential(account).await
+    }
+
     async fn compare_and_swap_credential(
         &self,
         update: CredentialCasUpdate,

backend/crates/gateway-store/tests/postgres/provider_accounts.rs

@@ -769,6 +769,25 @@ async fn core_refresh_cas_updates_profile_and_credential_under_one_revision() {
     assert_eq!(row.3["access_token"], "after-secret");
     assert_eq!(row.4, 2);
 
+    assert!(
+        repository
+            .load_credential(
+                &account_id,
+                CredentialRevision::new(1).expect("stale credential revision"),
+            )
+            .await
+            .is_err()
+    );
+    let current = repository
+        .load_current_credential(&account_id)
+        .await
+        .expect("load current credential without a caller revision");
+    assert_eq!(current.account.revision().get(), 2);
+    assert_eq!(
+        current.credential.expose_to_provider()["access_token"],
+        "after-secret"
+    );
+
     let stale = CredentialCasUpdate::new(
         account_id.clone(),
         CredentialRevision::new(1).expect("stale credential revision"),

backend/crates/gateway-store/tests/redis/credential_cooldown.rs

@@ -73,6 +73,13 @@ impl ProviderAccountStore for CooldownTestAccountStore {
         unreachable!("cooldown tests do not load credentials")
     }
 
+    async fn load_current_credential(
+        &self,
+        _account: &ProviderAccountId,
+    ) -> Result<LoadedCredential, CoreStoreError> {
+        unreachable!("cooldown tests do not load credentials")
+    }
+
     async fn compare_and_swap_credential(
         &self,
         _update: CredentialCasUpdate,

backend/crates/providers/openai/src/admin.rs

@@ -61,7 +61,7 @@ use crate::transport::profile::{
 };
 
 const PROVIDER_NAME: &str = "openai";
-const PENDING_DOCUMENT_SCHEMA_VERSION: u64 = 2;
+const PENDING_DOCUMENT_SCHEMA_VERSION: u64 = 3;
 const MAX_ACCESS_TOKEN_BYTES: usize = 16 * 1024;
 const MAX_REFRESH_TOKEN_BYTES: usize = 64 * 1024;
 
@@ -146,7 +146,7 @@ impl OpenAiAdminProvider {
         }
         let current = self
             .accounts
-            .load_credential(existing.id(), existing.revision())
+            .load_current_credential(existing.id())
             .await
             .map_err(map_store_error)?;
         incoming.credential = CodexCredentialCodec::preserve_installation_id(
@@ -356,16 +356,11 @@ impl ProviderAdmin for OpenAiAdminProvider {
         command: PrepareCredentialRotation,
     ) -> Result<PreparedCredentialRotation, ProviderAdminError> {
         validate_account_record(&command.account, &self.provider_kind)?;
-        if command.account.credential_revision != command.expected_credential_revision {
-            return Err(provider_admin_error(ProviderAdminErrorKind::Conflict));
-        }
         let account_id = ProviderAccountId::new(command.account.id.clone())
             .map_err(|_| provider_admin_error(ProviderAdminErrorKind::Invalid))?;
-        let expected_revision = CredentialRevision::new(command.expected_credential_revision.get())
-            .map_err(|_| provider_admin_error(ProviderAdminErrorKind::Invalid))?;
         let current = self
             .accounts
-            .load_credential(&account_id, expected_revision)
+            .load_current_credential(&account_id)
             .await
             .map_err(map_store_error)?;
         if !account_matches_record(&current.account, &command.account) {
@@ -425,11 +420,17 @@ impl ProviderAdmin for OpenAiAdminProvider {
         validate_account_record(&command.account, &self.provider_kind)?;
         let account_id = ProviderAccountId::new(command.account.id.clone())
             .map_err(|_| provider_admin_error(ProviderAdminErrorKind::Invalid))?;
-        let revision = CredentialRevision::new(command.account.credential_revision.get())
-            .map_err(|_| provider_admin_error(ProviderAdminErrorKind::Invalid))?;
+        let current = self
+            .accounts
+            .load_current_credential(&account_id)
+            .await
+            .map_err(map_store_error)?;
+        if !account_matches_record(&current.account, &command.account) {
+            return Err(provider_admin_error(ProviderAdminErrorKind::Conflict));
+        }
         let prepared = self
             .credentials
-            .manual_refresh(account_id, revision)
+            .manual_refresh(current)
             .await
             .map_err(map_credential_admin_error)?;
         prepared_rotation(prepared, command.account.provider_kind)
@@ -717,20 +718,9 @@ fn dashboard_desktop_release(
 fn account_matches_record(account: &ProviderAccount, record: &AccountRecord) -> bool {
     account.id().as_str() == record.id
         && account.provider() == &record.provider_kind
-        && account.revision().get() == record.credential_revision.get()
-        && account.name() == record.name
-        && account.email() == record.email.as_deref()
         && account.upstream_user_id() == record.upstream_user_id
         && account.upstream_account_id() == record.upstream_account_id.as_deref()
-        && account.plan_type() == record.plan_type.as_deref()
         && account.authentication_kind() == record.authentication_kind
-        && account.enabled() == record.enabled
-        && account.availability() == record.availability
-        && account.cooldown_until().map(DateTime::<Utc>::from) == record.cooldown_until
-        && account.access_token_expires_at().map(DateTime::<Utc>::from)
-            == record.access_token_expires_at
-        && account.next_refresh_at().map(DateTime::<Utc>::from) == record.next_refresh_at
-        && account.has_refresh_token() == record.has_refresh_token
 }
 
 fn empty_quota() -> ProviderQuota {
@@ -1002,7 +992,6 @@ struct PendingDocument {
     nonce: String,
     code_verifier: String,
     reauthorization_account_id: Option<String>,
-    reauthorization_credential_revision: Option<u64>,
     mutation: PendingMutationDocument,
 }
 
@@ -1019,13 +1008,8 @@ struct PendingMutationDocument {
 #[derive(Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
 enum PendingTargetDocument {
-    Create {
-        name: String,
-    },
-    Reauthorize {
-        account_id: String,
-        expected_credential_revision: u64,
-    },
+    Create { name: String },
+    Reauthorize { account_id: String },
 }
 
 #[derive(Deserialize)]
@@ -1069,15 +1053,9 @@ fn encode_pending(pending: &CodexPendingAuthorization) -> Map<String, Value> {
     );
     document.insert(
         "reauthorization_account_id".to_owned(),
-        pending.reauthorization().map_or(Value::Null, |target| {
-            Value::String(target.account_id().to_string())
-        }),
-    );
-    document.insert(
-        "reauthorization_credential_revision".to_owned(),
-        pending.reauthorization().map_or(Value::Null, |target| {
-            Value::Number(Number::from(target.credential_revision().get()))
-        }),
+        pending
+            .reauthorization()
+            .map_or(Value::Null, |target| Value::String(target.to_string())),
     );
     document.insert(
         "mutation".to_owned(),
@@ -1118,19 +1096,12 @@ fn encode_target(target: &AuthorizationMutationTarget) -> Map<String, Value> {
             document.insert("kind".to_owned(), Value::String("create".to_owned()));
             document.insert("name".to_owned(), Value::String(name.clone()));
         }
-        AuthorizationMutationTarget::Reauthorize {
-            account_id,
-            expected_credential_revision,
-        } => {
+        AuthorizationMutationTarget::Reauthorize { account_id } => {
             document.insert("kind".to_owned(), Value::String("reauthorize".to_owned()));
             document.insert(
                 "account_id".to_owned(),
                 Value::String(account_id.to_string()),
             );
-            document.insert(
-                "expected_credential_revision".to_owned(),
-                Value::Number(Number::from(expected_credential_revision.get())),
-            );
         }
     }
     document
@@ -1171,7 +1142,6 @@ fn decode_pending(
         nonce: SecretString::from(document.nonce),
         code_verifier: SecretString::from(document.code_verifier),
         reauthorization_account_id: document.reauthorization_account_id,
-        reauthorization_credential_revision: document.reauthorization_credential_revision,
         mutation: decode_mutation(document.mutation)?,
     })
 }
@@ -1186,15 +1156,12 @@ fn decode_mutation(
         .map_err(|_| CodexOAuthPendingStoreError::InvalidValue)?;
     let target = match document.target {
         PendingTargetDocument::Create { name } => AuthorizationMutationTarget::Create { name },
-        PendingTargetDocument::Reauthorize {
-            account_id,
-            expected_credential_revision,
-        } => AuthorizationMutationTarget::Reauthorize {
-            account_id: ProviderAccountId::new(account_id)
-                .map_err(|_| CodexOAuthPendingStoreError::InvalidValue)?,
-            expected_credential_revision: Revision::new(expected_credential_revision)
-                .map_err(|_| CodexOAuthPendingStoreError::InvalidValue)?,
-        },
+        PendingTargetDocument::Reauthorize { account_id } => {
+            AuthorizationMutationTarget::Reauthorize {
+                account_id: ProviderAccountId::new(account_id)
+                    .map_err(|_| CodexOAuthPendingStoreError::InvalidValue)?,
+            }
+        }
     };
     let actor = match document.owner {
         PendingOwnerDocument::AdminSession { admin_user_id } => {
@@ -1297,10 +1264,10 @@ fn map_credential_admin_error(error: CodexCredentialAdminError) -> ProviderAdmin
         | Error::AccountBanned
         | Error::IdentityRejected => ProviderAdminErrorKind::Invalid,
         Error::NotFound => ProviderAdminErrorKind::NotFound,
-        Error::RevisionConflict | Error::RefreshLeaseUnavailable | Error::RefreshAmbiguous => {
+        Error::RefreshLeaseUnavailable | Error::RefreshAmbiguous => {
             ProviderAdminErrorKind::Conflict
         }
-        Error::StoreUnavailable | Error::RefreshUnavailable | Error::IdentityUnavailable => {
+        Error::RefreshUnavailable | Error::IdentityUnavailable => {
             ProviderAdminErrorKind::Unavailable
         }
     })
@@ -1312,8 +1279,6 @@ const fn credential_admin_error_code(error: CodexCredentialAdminError) -> &'stat
         CodexCredentialAdminError::IdentityMismatch => "identity_mismatch",
         CodexCredentialAdminError::InvalidCredential => "invalid_credential",
         CodexCredentialAdminError::NotFound => "not_found",
-        CodexCredentialAdminError::RevisionConflict => "revision_conflict",
-        CodexCredentialAdminError::StoreUnavailable => "store_unavailable",
         CodexCredentialAdminError::MissingRefreshToken => "missing_refresh_token",
         CodexCredentialAdminError::RefreshLeaseUnavailable => "refresh_lease_unavailable",
         CodexCredentialAdminError::RefreshRejected => "refresh_rejected",

backend/crates/providers/openai/src/credential/admin.rs

@@ -13,7 +13,6 @@ use gateway_core::engine::credential::{
     AccountAvailability, CredentialCasUpdate, CredentialRevision, LoadedCredential,
     NewProviderAccount, ProviderAccount, ProviderAccountId, ProviderAccountUpdate,
 };
-use gateway_core::error::StoreErrorKind;
 use gateway_core::provider_ports::{
     ProviderLeaseAcquisition, ProviderLeaseGuard, ProviderLeasePort, ProviderLeaseRequest,
     ProviderRefreshCapacityRequest, ProviderRefreshLeaseRequest, ProviderRefreshPolicy,
@@ -28,7 +27,6 @@ use thiserror::Error;
 use super::identity::{
     CodexAccountIdentityVerifier, CodexIdentityExpectation, CodexIdentityVerificationError,
 };
-use super::repository::CodexCredentialRepository;
 use super::security::CodexCredentialCodec;
 use super::token_client::{RefreshFailure, TokenRefresher};
 use super::types::{
@@ -350,10 +348,6 @@ pub enum CodexCredentialAdminError {
     InvalidCredential,
     #[error("Codex account was not found")]
     NotFound,
-    #[error("Codex credential revision is stale")]
-    RevisionConflict,
-    #[error("Codex account store is unavailable")]
-    StoreUnavailable,
     #[error("Codex account has no refresh token")]
     MissingRefreshToken,
     #[error("Codex refresh lease is unavailable")]
@@ -551,9 +545,8 @@ impl CodexCredentialAdmin {
     }
 }
 
-/// 有状态的 Codex 手工刷新边界；只读取 Store 并准备 CAS，不自行持久化。
+/// 有状态的 Codex 手工刷新边界；消费调用方刚读取的当前 credential 并准备 CAS。
 pub struct CodexCredentialAdminService {
-    repository: CodexCredentialRepository,
     refresher: Arc<dyn TokenRefresher>,
     verifier: Arc<dyn CodexAccountIdentityVerifier>,
     leases: Arc<dyn ProviderLeasePort>,
@@ -564,7 +557,6 @@ impl fmt::Debug for CodexCredentialAdminService {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter
             .debug_struct("CodexCredentialAdminService")
-            .field("repository", &"CodexCredentialRepository")
             .field("refresher", &"TokenRefresher")
             .field("verifier", &"CodexAccountIdentityVerifier")
             .field("leases", &"ProviderLeasePort")
@@ -575,14 +567,12 @@ impl fmt::Debug for CodexCredentialAdminService {
 
 impl CodexCredentialAdminService {
     pub fn new(
-        repository: CodexCredentialRepository,
         refresher: Arc<dyn TokenRefresher>,
         verifier: Arc<dyn CodexAccountIdentityVerifier>,
         leases: Arc<dyn ProviderLeasePort>,
         runtime_policy: Arc<dyn ProviderRuntimePolicyPort>,
     ) -> Self {
         Self {
-            repository,
             refresher,
             verifier,
             leases,
@@ -593,19 +583,11 @@ impl CodexCredentialAdminService {
     /// 官方 RT exchange + AT 身份验证；结果由 App 在同一 revision/audit 事务中提交。
     pub async fn manual_refresh(
         &self,
-        account_id: ProviderAccountId,
-        expected_revision: CredentialRevision,
+        current: LoadedCredential,
     ) -> Result<PreparedCodexCredentialRotation, CodexCredentialAdminError> {
-        let current = self
-            .repository
-            .store()
-            .load_credential(&account_id, expected_revision)
-            .await
-            .map_err(map_admin_store_error)?;
-        if current.account.provider().as_str() != PROVIDER_NAME
-            || current.account.id() != &account_id
-            || current.account.revision() != expected_revision
-        {
+        let account_id = current.account.id().clone();
+        let expected_revision = current.account.revision();
+        if current.account.provider().as_str() != PROVIDER_NAME {
             return Err(CodexCredentialAdminError::NotFound);
         }
         let runtime = CodexCredentialCodec::decode(&current.credential)
@@ -990,17 +972,6 @@ fn china_rfc3339(value: DateTime<Utc>) -> String {
         .to_rfc3339()
 }
 
-fn map_admin_store_error(error: gateway_core::error::StoreError) -> CodexCredentialAdminError {
-    match error.kind() {
-        StoreErrorKind::Conflict => CodexCredentialAdminError::RevisionConflict,
-        StoreErrorKind::Unavailable => CodexCredentialAdminError::StoreUnavailable,
-        StoreErrorKind::InvalidState | StoreErrorKind::InvalidData => {
-            CodexCredentialAdminError::NotFound
-        }
-        _ => CodexCredentialAdminError::StoreUnavailable,
-    }
-}
-
 const fn map_refresh_failure(error: RefreshFailure) -> CodexCredentialAdminError {
     match error {
         RefreshFailure::InvalidGrant => CodexCredentialAdminError::RefreshRejected,

backend/crates/providers/openai/src/credential/mod.rs

@@ -48,9 +48,8 @@ pub use identity::{
 pub use oauth::{
     CodexOAuthAdmin, CodexOAuthAdminError, CodexOAuthAdminService, CodexOAuthAuthorizationStarted,
     CodexOAuthPendingClaimOutcome, CodexOAuthPendingStore, CodexOAuthPendingStoreError,
-    CodexOAuthReauthorizationTarget, CodexPendingAuthorization, CompleteCodexOAuthAuthorization,
-    CompletedCodexOAuthAuthorization, CompletedCodexOAuthCredential, StartCodexOAuthAuthorization,
-    StoredCodexPendingAuthorization,
+    CodexPendingAuthorization, CompleteCodexOAuthAuthorization, CompletedCodexOAuthAuthorization,
+    CompletedCodexOAuthCredential, StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
 };
 pub use quota::{
     CodexAccountQuotaSnapshot, CodexCredentialQuotaError, CodexCredentialQuotaService,

backend/crates/providers/openai/src/credential/oauth.rs

@@ -13,7 +13,7 @@ use gateway_admin::model::{
     },
 };
 use gateway_core::engine::credential::{
-    CredentialRevision, NewProviderAccount, ProviderAccountId, ProviderAccountStore,
+    NewProviderAccount, ProviderAccountId, ProviderAccountStore,
 };
 use gateway_core::provider_ports::ProviderRuntimePolicyPort;
 use secrecy::{ExposeSecret, SecretString};
@@ -47,24 +47,6 @@ pub struct StartCodexOAuthAuthorization {
     pub mutation: PendingAuthorizationMutation,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CodexOAuthReauthorizationTarget {
-    account_id: ProviderAccountId,
-    credential_revision: CredentialRevision,
-}
-
-impl CodexOAuthReauthorizationTarget {
-    #[must_use]
-    pub const fn account_id(&self) -> &ProviderAccountId {
-        &self.account_id
-    }
-
-    #[must_use]
-    pub const fn credential_revision(&self) -> CredentialRevision {
-        self.credential_revision
-    }
-}
-
 #[derive(Clone, PartialEq, Eq)]
 pub struct CodexOAuthAuthorizationStarted {
     pub flow_id: String,
@@ -153,7 +135,7 @@ pub struct CodexPendingAuthorization {
     state: SecretString,
     nonce: SecretString,
     code_verifier: SecretString,
-    reauthorization: Option<CodexOAuthReauthorizationTarget>,
+    reauthorization: Option<ProviderAccountId>,
     mutation: PendingAuthorizationMutation,
 }
 
@@ -167,7 +149,6 @@ pub struct StoredCodexPendingAuthorization {
     pub nonce: SecretString,
     pub code_verifier: SecretString,
     pub reauthorization_account_id: Option<String>,
-    pub reauthorization_credential_revision: Option<u64>,
     pub mutation: PendingAuthorizationMutation,
 }
 
@@ -175,19 +156,11 @@ impl CodexPendingAuthorization {
     pub fn from_stored(
         input: StoredCodexPendingAuthorization,
     ) -> Result<Self, CodexOAuthPendingStoreError> {
-        let reauthorization = match (
-            input.reauthorization_account_id,
-            input.reauthorization_credential_revision,
-        ) {
-            (None, None) => None,
-            (Some(account_id), Some(revision)) => Some(CodexOAuthReauthorizationTarget {
-                account_id: ProviderAccountId::new(account_id)
-                    .map_err(|_| CodexOAuthPendingStoreError::InvalidValue)?,
-                credential_revision: CredentialRevision::new(revision)
-                    .map_err(|_| CodexOAuthPendingStoreError::InvalidValue)?,
-            }),
-            _ => return Err(CodexOAuthPendingStoreError::InvalidValue),
-        };
+        let reauthorization = input
+            .reauthorization_account_id
+            .map(ProviderAccountId::new)
+            .transpose()
+            .map_err(|_| CodexOAuthPendingStoreError::InvalidValue)?;
         let pending = Self {
             flow_id: input.flow_id,
             owner_ref: input.owner_ref,
@@ -256,7 +229,7 @@ impl CodexPendingAuthorization {
     }
 
     #[must_use]
-    pub const fn reauthorization(&self) -> Option<&CodexOAuthReauthorizationTarget> {
+    pub const fn reauthorization(&self) -> Option<&ProviderAccountId> {
         self.reauthorization.as_ref()
     }
 
@@ -455,15 +428,10 @@ impl CodexOAuthAdmin for CodexOAuthAdminService {
     ) -> Result<CodexOAuthAuthorizationStarted, CodexOAuthAdminError> {
         let (name, reauthorization) = match command.mutation.target() {
             AuthorizationMutationTarget::Create { name } => (name.clone(), None),
-            AuthorizationMutationTarget::Reauthorize {
-                account_id,
-                expected_credential_revision,
-            } => {
-                let expected_revision = CredentialRevision::new(expected_credential_revision.get())
-                    .map_err(|_| CodexOAuthAdminError::InvalidInput)?;
+            AuthorizationMutationTarget::Reauthorize { account_id } => {
                 let current = self
                     .store
-                    .load_credential(account_id, expected_revision)
+                    .load_current_credential(account_id)
                     .await
                     .map_err(map_store_error)?;
                 if current.account.provider().as_str() != "openai"
@@ -471,13 +439,7 @@ impl CodexOAuthAdmin for CodexOAuthAdminService {
                 {
                     return Err(CodexOAuthAdminError::NotFound);
                 }
-                (
-                    current.account.name().to_owned(),
-                    Some(CodexOAuthReauthorizationTarget {
-                        account_id: account_id.clone(),
-                        credential_revision: expected_revision,
-                    }),
-                )
+                (current.account.name().to_owned(), Some(account_id.clone()))
             }
         };
         self.start_pending(command.mutation, name, reauthorization)
@@ -531,7 +493,7 @@ impl CodexOAuthAdminService {
         let current = if let Some(target) = pending.reauthorization() {
             let current = self
                 .store
-                .load_credential(target.account_id(), target.credential_revision())
+                .load_current_credential(target)
                 .await
                 .map_err(map_store_error)?;
             Some(current)
@@ -606,7 +568,7 @@ impl CodexOAuthAdminService {
         &self,
         mutation: PendingAuthorizationMutation,
         name: String,
-        reauthorization: Option<CodexOAuthReauthorizationTarget>,
+        reauthorization: Option<ProviderAccountId>,
     ) -> Result<CodexOAuthAuthorizationStarted, CodexOAuthAdminError> {
         if !valid_text(&name) {
             return Err(CodexOAuthAdminError::InvalidInput);
@@ -625,11 +587,7 @@ impl CodexOAuthAdminService {
             state: SecretString::from(random_secret()?),
             nonce: SecretString::from(random_secret()?),
             code_verifier: SecretString::from(random_secret()?),
-            reauthorization_account_id: reauthorization
-                .as_ref()
-                .map(|target| target.account_id().to_string()),
-            reauthorization_credential_revision: reauthorization
-                .map(|target| target.credential_revision().get()),
+            reauthorization_account_id: reauthorization.as_ref().map(ToString::to_string),
             mutation,
         })
         .map_err(map_pending_error)?;
@@ -843,15 +801,8 @@ fn pending_mutation_matches(pending: &CodexPendingAuthorization) -> bool {
     }
     match (pending.mutation.target(), pending.reauthorization.as_ref()) {
         (AuthorizationMutationTarget::Create { name }, None) => name == &pending.name,
-        (
-            AuthorizationMutationTarget::Reauthorize {
-                account_id,
-                expected_credential_revision,
-            },
-            Some(target),
-        ) => {
-            account_id == target.account_id()
-                && expected_credential_revision.get() == target.credential_revision().get()
+        (AuthorizationMutationTarget::Reauthorize { account_id }, Some(target)) => {
+            account_id == target
         }
         _ => false,
     }

backend/crates/providers/openai/src/lib.rs

@@ -160,7 +160,6 @@ pub async fn initialize(
     let refresher: Arc<dyn TokenRefresher> = token_client.clone();
     let exchanger: Arc<dyn AuthorizationCodeExchanger> = token_client;
     let credential_admin = Arc::new(CodexCredentialAdminService::new(
-        repository.clone(),
         Arc::clone(&refresher),
         Arc::clone(&identity),
         Arc::clone(&leases),

backend/crates/providers/openai/tests/admin.rs

@@ -346,7 +346,23 @@ async fn openai_admin_provider_persists_the_full_pending_envelope_and_binds_owne
             .get("mutation")
             .and_then(Value::as_object)
             .expect("pending mutation");
+        assert!(
+            payload
+                .expose_to_provider()
+                .get("reauthorization_credential_revision")
+                .is_none()
+        );
+        assert_eq!(
+            mutation.get("schema_version").and_then(Value::as_u64),
+            Some(3)
+        );
         assert!(mutation.get("expected_config_revision").is_none());
+        assert!(
+            mutation
+                .get("target")
+                .and_then(Value::as_object)
+                .is_some_and(|target| target.get("expected_credential_revision").is_none())
+        );
         assert_eq!(
             mutation.get("started_request_id").and_then(Value::as_str),
             Some("request-start")
@@ -370,6 +386,81 @@ async fn openai_admin_provider_persists_the_full_pending_envelope_and_binds_owne
     assert_eq!(pending.values.lock().expect("OAuth pending").len(), 1);
 }
 
+#[tokio::test]
+async fn openai_reauthorization_pending_payload_contains_only_stable_account_identity() {
+    let accounts = Arc::new(MemoryAccountStore::default());
+    accounts
+        .seed_oauth_credential(ImportCodexOAuthCredential {
+            account_id: "acct_pending_reauth".to_owned(),
+            name: "pending reauthorization".to_owned(),
+            secret: secret("pending-reauth-access"),
+            verified_account: profile("chatgpt-pending-reauth"),
+            next_refresh_at: Some(Utc::now() + chrono::Duration::minutes(30)),
+            enabled: true,
+        })
+        .await;
+    let pending = Arc::new(TestOAuthPending::default());
+    let config = valid_config();
+    let bundle = provider_openai::initialize(
+        config.config.clone(),
+        provider_ports_with(accounts, Arc::clone(&pending)),
+    )
+    .await
+    .expect("OpenAI bundle");
+    let context = MutationContext {
+        actor: MutationActor::AdminApiKey,
+        request_id: "request-pending-reauth".to_owned(),
+    };
+
+    bundle
+        .admin_provider()
+        .start_authorization(PendingAuthorizationMutation::new(
+            ProviderKind::new("openai").expect("provider"),
+            AuthorizationMutationTarget::Reauthorize {
+                account_id: ProviderAccountId::new("acct_pending_reauth").expect("account id"),
+            },
+            AuthorizationOwnerBinding::from_context(&context),
+        ))
+        .await
+        .expect("start reauthorization");
+
+    let values = pending.values.lock().expect("OAuth pending");
+    let (_, payload, _, _) = values.values().next().expect("stored pending");
+    let document = payload.expose_to_provider();
+    let mutation = document
+        .get("mutation")
+        .and_then(Value::as_object)
+        .expect("pending mutation");
+    let target = mutation
+        .get("target")
+        .and_then(Value::as_object)
+        .expect("pending target");
+    assert_eq!(
+        mutation.get("schema_version").and_then(Value::as_u64),
+        Some(3)
+    );
+    assert_eq!(
+        document
+            .get("reauthorization_account_id")
+            .and_then(Value::as_str),
+        Some("acct_pending_reauth")
+    );
+    assert!(
+        document
+            .get("reauthorization_credential_revision")
+            .is_none()
+    );
+    assert_eq!(
+        target.get("kind").and_then(Value::as_str),
+        Some("reauthorize")
+    );
+    assert_eq!(
+        target.get("account_id").and_then(Value::as_str),
+        Some("acct_pending_reauth")
+    );
+    assert!(target.get("expected_credential_revision").is_none());
+}
+
 #[tokio::test]
 async fn openai_admin_provider_projects_cached_quota_models_and_canonical_export() {
     let store = Arc::new(MemoryAccountStore::default());
@@ -568,10 +659,20 @@ async fn openai_admin_provider_rejects_unprepared_mutations_before_store_commit(
         .await
         .expect_err("invalid import");
     assert_eq!(import_error.kind(), ProviderAdminErrorKind::Invalid);
+    let mut stale_record = record.clone();
+    stale_record.name = "stale name".to_owned();
+    stale_record.email = None;
+    stale_record.plan_type = None;
+    stale_record.credential_revision = Revision::new(99).expect("stale revision");
+    stale_record.has_refresh_token = false;
+    stale_record.access_token_expires_at = None;
+    stale_record.next_refresh_at = None;
+    stale_record.enabled = false;
+    stale_record.availability = AdminAccountAvailability::Banned;
+    stale_record.cooldown_until = Some(Utc::now() + chrono::Duration::minutes(5));
     let rotation_error = admin
         .prepare_rotation(PrepareCredentialRotation {
-            account: record.clone(),
-            expected_credential_revision: record.credential_revision,
+            account: stale_record,
             provider_material: ProviderDocument::new(OpaqueProviderData::new(Map::new())),
         })
         .await

backend/crates/providers/openai/tests/credential/admin.rs

@@ -11,7 +11,7 @@ use ed25519_dalek::pkcs8::EncodePrivateKey as _;
 use futures::future::BoxFuture;
 use gateway_core::engine::credential::{
     AccountAvailability, CredentialRevision, LoadedCredential, PlaintextCredential,
-    ProviderAccount, ProviderAccountId,
+    ProviderAccount, ProviderAccountId, ProviderAccountStore,
 };
 use gateway_core::provider_ports::{
     ProviderLeaseAcquisition, ProviderLeasePort, ProviderLeaseRequest, ProviderRefreshLeaseRequest,
@@ -456,7 +456,6 @@ async fn manual_refresh_fixture(
         available,
     });
     let service = CodexCredentialAdminService::new(
-        store.repository(),
         refresher.clone(),
         Arc::new(ManualVerifier),
         leases.clone(),
@@ -478,11 +477,12 @@ async fn manual_refresh_prepares_revision_fenced_rotation_without_store_mutation
     let (store, refresher, leases, service) =
         manual_refresh_fixture(Ok(refreshed_tokens()), true).await;
     let account_id = ProviderAccountId::new("acct_manual_refresh").expect("account id");
+    let current = store
+        .load_current_credential(&account_id)
+        .await
+        .expect("current credential");
     let prepared = service
-        .manual_refresh(
-            account_id.clone(),
-            CredentialRevision::new(1).expect("revision"),
-        )
+        .manual_refresh(current)
         .await
         .expect("manual refresh");
 
@@ -528,24 +528,16 @@ async fn manual_refresh_prepares_revision_fenced_rotation_without_store_mutation
 }
 
 #[tokio::test]
-async fn manual_refresh_stale_revision_and_missing_lease_fail_before_exchange() {
-    let (_, stale_refresher, _, stale_service) =
-        manual_refresh_fixture(Ok(refreshed_tokens()), true).await;
-    let account_id = ProviderAccountId::new("acct_manual_refresh").expect("account id");
-    let stale = stale_service
-        .manual_refresh(
-            account_id.clone(),
-            CredentialRevision::new(2).expect("revision"),
-        )
-        .await
-        .expect_err("stale revision");
-    assert_eq!(stale, CodexCredentialAdminError::RevisionConflict);
-    assert!(stale_refresher.seen.lock().expect("seen tokens").is_empty());
-
-    let (_, unavailable_refresher, _, unavailable_service) =
+async fn manual_refresh_missing_lease_fails_before_exchange() {
+    let (store, unavailable_refresher, _, unavailable_service) =
         manual_refresh_fixture(Ok(refreshed_tokens()), false).await;
+    let account_id = ProviderAccountId::new("acct_manual_refresh").expect("account id");
+    let current = store
+        .load_current_credential(&account_id)
+        .await
+        .expect("current credential");
     let unavailable = unavailable_service
-        .manual_refresh(account_id, CredentialRevision::new(1).expect("revision"))
+        .manual_refresh(current)
         .await
         .expect_err("lease unavailable");
     assert_eq!(
@@ -606,9 +598,7 @@ impl CodexAccountIdentityVerifier for ImportVerifier {
 pub(super) fn import_service(
     refresher: Arc<ManualRefresher>,
 ) -> provider_openai::credential::CodexCredentialAdminService {
-    let store = Arc::new(MemoryAccountStore::default());
     CodexCredentialAdminService::new(
-        store.repository(),
         refresher,
         Arc::new(ImportVerifier),
         Arc::new(ManualLeases {
@@ -806,7 +796,6 @@ async fn real_cpr_fixture_import_contract() {
         &std::fs::read(fixture).expect("read CPR fixture"),
     )
     .expect("parse CPR fixture");
-    let store = Arc::new(MemoryAccountStore::default());
     let refresher = Arc::new(
         provider_openai::credential::token_client::official_openai_token_client()
             .expect("official token client"),
@@ -834,7 +823,6 @@ async fn real_cpr_fixture_import_contract() {
     );
     let verifier = Arc::new(CodexAccountIdentityService::new(signed, accounts));
     let service = CodexCredentialAdminService::new(
-        store.repository(),
         refresher,
         verifier,
         Arc::new(ManualLeases {

backend/crates/providers/openai/tests/credential/oauth.rs

@@ -5,7 +5,7 @@ use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use gateway_admin::model::provider_credentials::{
     AuthorizationMutationTarget, AuthorizationOwnerBinding, PendingAuthorizationMutation,
 };
-use gateway_admin::model::{MutationActor, MutationContext, Revision};
+use gateway_admin::model::{MutationActor, MutationContext};
 use gateway_core::engine::credential::ProviderAccountId;
 use gateway_core::routing::ProviderKind;
 use provider_openai::credential::token_client::{
@@ -44,7 +44,6 @@ fn duplicate_pending(
         nonce: pending.nonce.clone(),
         code_verifier: pending.code_verifier.clone(),
         reauthorization_account_id: pending.reauthorization_account_id.clone(),
-        reauthorization_credential_revision: pending.reauthorization_credential_revision,
         mutation: pending.mutation.clone(),
     })
 }
@@ -69,12 +68,7 @@ impl CodexOAuthPendingStore for PendingStore {
                 state: pending.state().clone(),
                 nonce: pending.nonce().clone(),
                 code_verifier: pending.code_verifier().clone(),
-                reauthorization_account_id: pending
-                    .reauthorization()
-                    .map(|target| target.account_id().to_string()),
-                reauthorization_credential_revision: pending
-                    .reauthorization()
-                    .map(|target| target.credential_revision().get()),
+                reauthorization_account_id: pending.reauthorization().map(ToString::to_string),
                 mutation: pending.mutation().clone(),
             },
             None,
@@ -252,7 +246,6 @@ fn reauthorization_mutation(request_id: &str, account_id: &str) -> PendingAuthor
         ProviderKind::new("openai").expect("provider"),
         AuthorizationMutationTarget::Reauthorize {
             account_id: ProviderAccountId::new(account_id).expect("account id"),
-            expected_credential_revision: Revision::new(1).expect("revision"),
         },
         AuthorizationOwnerBinding::from_context(&context),
     )
@@ -530,7 +523,7 @@ fn oauth_command_debug_redacts_owner_flow_and_callback() {
 }
 
 #[tokio::test]
-async fn reauthorization_binds_account_revision_and_returns_only_prepared_rotation() {
+async fn reauthorization_uses_revision_advanced_after_start_for_prepared_rotation() {
     let store = Arc::new(MemoryAccountStore::default());
     store
         .seed_oauth_credential(ImportCodexOAuthCredential {
@@ -558,6 +551,8 @@ async fn reauthorization_binds_account_revision_and_returns_only_prepared_rotati
         })
         .await
         .expect("start reauthorization");
+    let advanced_revision = store.advance_credential_revision("acct_oauth_reauth").await;
+    assert_eq!(advanced_revision.get(), 2);
     let state = Url::parse(&started.authorization_url)
         .expect("authorization URL")
         .query_pairs()
@@ -581,7 +576,7 @@ async fn reauthorization_binds_account_revision_and_returns_only_prepared_rotati
         prepared.credential.account_id().as_str(),
         "acct_oauth_reauth"
     );
-    assert_eq!(prepared.credential.expected_revision().get(), 1);
+    assert_eq!(prepared.credential.expected_revision().get(), 2);
     let runtime =
         provider_openai::credential::CodexCredentialCodec::decode(prepared.credential.credential())
             .expect("prepared credential");
@@ -601,7 +596,7 @@ async fn reauthorization_binds_account_revision_and_returns_only_prepared_rotati
             .expect("unchanged account")
             .revision()
             .get(),
-        1
+        2
     );
 }
 

backend/crates/providers/openai/tests/support.rs

@@ -67,6 +67,39 @@ impl MemoryAccountStore {
             .map(|stored| stored.account.clone())
     }
 
+    pub(crate) async fn advance_credential_revision(&self, id: &str) -> CredentialRevision {
+        let account_id = ProviderAccountId::new(id).expect("test account id");
+        let current = self
+            .load_current_credential(&account_id)
+            .await
+            .expect("current test credential");
+        let account = current.account;
+        let expected_revision = account.revision();
+        let update = CredentialCasUpdate::new(
+            account_id.clone(),
+            expected_revision,
+            ProviderAccountUpdate {
+                account_id,
+                name: account.name().to_owned(),
+                email: account.email().map(str::to_owned),
+                plan_type: account.plan_type().map(str::to_owned),
+            },
+            current.credential,
+            account.has_refresh_token(),
+            account.access_token_expires_at(),
+            account.next_refresh_at(),
+        )
+        .expect("valid test credential update");
+        match self
+            .compare_and_swap_credential(update)
+            .await
+            .expect("advance test credential revision")
+        {
+            CredentialCasOutcome::Updated(revision) => revision,
+            CredentialCasOutcome::Conflict => panic!("test credential revision conflicted"),
+        }
+    }
+
     pub(crate) fn quota_reads(&self) -> usize {
         self.quota_reads.load(Ordering::SeqCst)
     }
@@ -141,14 +174,22 @@ impl ProviderAccountStore for MemoryAccountStore {
         &self,
         account: &ProviderAccountId,
         expected_revision: CredentialRevision,
+    ) -> Result<LoadedCredential, StoreError> {
+        let loaded = self.load_current_credential(account).await?;
+        if loaded.account.revision() != expected_revision {
+            return Err(store_error(StoreErrorKind::Conflict));
+        }
+        Ok(loaded)
+    }
+
+    async fn load_current_credential(
+        &self,
+        account: &ProviderAccountId,
     ) -> Result<LoadedCredential, StoreError> {
         let accounts = self.accounts.lock().expect("account store lock");
         let stored = accounts
             .get(account)
             .ok_or_else(|| store_error(StoreErrorKind::InvalidData))?;
-        if stored.account.revision() != expected_revision {
-            return Err(store_error(StoreErrorKind::Conflict));
-        }
         Ok(LoadedCredential {
             account: stored.account.clone(),
             credential: stored.credential.clone(),

backend/crates/providers/xai/src/admin.rs

@@ -58,7 +58,7 @@ use crate::credential::{
 use crate::transport::profile::{GrokCliReleaseSnapshot, GrokCliReleaseStatus};
 use crate::transport::{GROK_CLI_BASE_URL, XAI_PROVIDER_NAME, grok_billing_breakdown};
 
-const PENDING_SCHEMA_VERSION: u64 = 2;
+const PENDING_SCHEMA_VERSION: u64 = 3;
 const PENDING_TTL: TimeDelta = TimeDelta::minutes(30);
 const PENDING_CLAIM_TTL: Duration = Duration::from_secs(90);
 const MAX_PENDING_TEXT_BYTES: usize = 512;
@@ -520,16 +520,10 @@ impl ProviderAdmin for XaiAdminProvider {
         if pending.provider_kind() != &self.provider_kind {
             return Err(provider_error(ProviderAdminErrorKind::Invalid));
         }
-        if let AuthorizationMutationTarget::Reauthorize {
-            account_id,
-            expected_credential_revision,
-        } = pending.target()
-        {
-            let revision = CredentialRevision::new(expected_credential_revision.get())
-                .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?;
+        if let AuthorizationMutationTarget::Reauthorize { account_id } = pending.target() {
             let current = self
                 .accounts
-                .load_credential(account_id, revision)
+                .load_current_credential(account_id)
                 .await
                 .map_err(map_store_error)?;
             if current.account.provider() != &self.provider_kind {
@@ -590,16 +584,11 @@ impl ProviderAdmin for XaiAdminProvider {
         command: PrepareCredentialRotation,
     ) -> Result<PreparedCredentialRotation, ProviderAdminError> {
         validate_account_record(&command.account, &self.provider_kind)?;
-        if command.account.credential_revision != command.expected_credential_revision {
-            return Err(provider_error(ProviderAdminErrorKind::Conflict));
-        }
         let account_id = ProviderAccountId::new(command.account.id.clone())
             .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?;
-        let revision = CredentialRevision::new(command.expected_credential_revision.get())
-            .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?;
         let current = self
             .accounts
-            .load_credential(&account_id, revision)
+            .load_current_credential(&account_id)
             .await
             .map_err(map_store_error)?;
         if !account_matches_record(&current.account, &command.account) {
@@ -653,15 +642,17 @@ impl ProviderAdmin for XaiAdminProvider {
         validate_account_record(&command.account, &self.provider_kind)?;
         let account_id = ProviderAccountId::new(command.account.id.clone())
             .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?;
-        let current = self.account(&account_id).await?;
-        if !account_matches_record(&current, &command.account) {
+        let current = self
+            .accounts
+            .load_current_credential(&account_id)
+            .await
+            .map_err(map_store_error)?;
+        if !account_matches_record(&current.account, &command.account) {
             return Err(provider_error(ProviderAdminErrorKind::Conflict));
         }
-        let revision = CredentialRevision::new(command.account.credential_revision.get())
-            .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?;
         let prepared = self
             .refresh
-            .prepare_manual_refresh(&account_id, revision)
+            .prepare_manual_refresh(current)
             .await
             .map_err(map_refresh_error)?;
         prepared_rotation(prepared, command.account.provider_kind)
@@ -817,15 +808,10 @@ impl XaiAdminProvider {
                     .map_err(map_repository_error)?;
                 PreparedAuthorizationCredential::Create(prepared_create(prepared, Utc::now())?)
             }
-            AuthorizationMutationTarget::Reauthorize {
-                account_id,
-                expected_credential_revision,
-            } => {
-                let revision = CredentialRevision::new(expected_credential_revision.get())
-                    .map_err(|_| provider_error(ProviderAdminErrorKind::Internal))?;
+            AuthorizationMutationTarget::Reauthorize { account_id } => {
                 let current = self
                     .accounts
-                    .load_credential(account_id, revision)
+                    .load_current_credential(account_id)
                     .await
                     .map_err(map_store_error)?;
                 if current.account.provider() != &self.provider_kind {
@@ -1045,19 +1031,9 @@ fn account_from_record(account: &AccountRecord) -> Result<ProviderAccount, Provi
 fn account_matches_record(account: &ProviderAccount, record: &AccountRecord) -> bool {
     account.id().as_str() == record.id
         && account.provider() == &record.provider_kind
-        && account.revision().get() == record.credential_revision.get()
-        && account.name() == record.name
-        && account.email() == record.email.as_deref()
         && account.upstream_user_id() == record.upstream_user_id
         && account.upstream_account_id() == record.upstream_account_id.as_deref()
-        && account.plan_type() == record.plan_type.as_deref()
-        && account.enabled() == record.enabled
-        && account.availability() == record.availability
-        && account.cooldown_until().map(DateTime::<Utc>::from) == record.cooldown_until
-        && account.access_token_expires_at().map(DateTime::<Utc>::from)
-            == record.access_token_expires_at
-        && account.next_refresh_at().map(DateTime::<Utc>::from) == record.next_refresh_at
-        && account.has_refresh_token() == record.has_refresh_token
+        && account.authentication_kind() == record.authentication_kind
 }
 
 fn project_quota(
@@ -1209,13 +1185,8 @@ struct PendingMutationDocument {
 #[derive(Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
 enum PendingTargetDocument {
-    Create {
-        name: String,
-    },
-    Reauthorize {
-        account_id: String,
-        expected_credential_revision: u64,
-    },
+    Create { name: String },
+    Reauthorize { account_id: String },
 }
 
 #[derive(Deserialize)]
@@ -1280,19 +1251,12 @@ fn encode_target(target: &AuthorizationMutationTarget) -> Map<String, Value> {
             document.insert("kind".to_owned(), Value::String("create".to_owned()));
             document.insert("name".to_owned(), Value::String(name.clone()));
         }
-        AuthorizationMutationTarget::Reauthorize {
-            account_id,
-            expected_credential_revision,
-        } => {
+        AuthorizationMutationTarget::Reauthorize { account_id } => {
             document.insert("kind".to_owned(), Value::String("reauthorize".to_owned()));
             document.insert(
                 "account_id".to_owned(),
                 Value::String(account_id.to_string()),
             );
-            document.insert(
-                "expected_credential_revision".to_owned(),
-                Value::Number(Number::from(expected_credential_revision.get())),
-            );
         }
     }
     document
@@ -1358,15 +1322,12 @@ fn decode_mutation(
         .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?;
     let target = match document.target {
         PendingTargetDocument::Create { name } => AuthorizationMutationTarget::Create { name },
-        PendingTargetDocument::Reauthorize {
-            account_id,
-            expected_credential_revision,
-        } => AuthorizationMutationTarget::Reauthorize {
-            account_id: ProviderAccountId::new(account_id)
-                .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?,
-            expected_credential_revision: Revision::new(expected_credential_revision)
-                .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?,
-        },
+        PendingTargetDocument::Reauthorize { account_id } => {
+            AuthorizationMutationTarget::Reauthorize {
+                account_id: ProviderAccountId::new(account_id)
+                    .map_err(|_| provider_error(ProviderAdminErrorKind::Invalid))?,
+            }
+        }
     };
     let actor = match document.owner {
         PendingOwnerDocument::AdminSession { admin_user_id } => {

backend/crates/providers/xai/src/credential/refresh.rs

@@ -9,7 +9,7 @@ use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use futures::{StreamExt as _, stream};
 use gateway_core::engine::credential::{
-    AccountAvailability, CredentialRevision, ProviderAccountId,
+    AccountAvailability, CredentialRevision, LoadedCredential, ProviderAccountId,
 };
 use gateway_core::provider_ports::{
     ProviderCooldown, ProviderCooldownPort, ProviderCredentialStatePort, ProviderLeaseAcquisition,
@@ -343,16 +343,13 @@ impl GrokCredentialRefreshService {
         self.refresh_one_with_policy(credential, policy).await
     }
 
-    /// 手工刷新一个指定 revision；只返回 Provider 验证后的 CAS command，不写 Store。
+    /// 手工刷新一次原子读取的当前 credential；只返回 Provider 验证后的 CAS command，不写 Store。
     pub async fn prepare_manual_refresh(
         &self,
-        account_id: &ProviderAccountId,
-        expected_revision: CredentialRevision,
+        current: LoadedCredential,
     ) -> Result<PreparedGrokCredentialRotation, GrokCredentialRefreshError> {
-        let current = self
-            .repository
-            .load_managed(account_id, expected_revision)
-            .await?;
+        let account_id = current.account.id().clone();
+        let expected_revision = current.account.revision();
         let loaded = super::repository::loaded_from_core(current.clone())?;
         let policy = self.runtime_policy.load_refresh_policy().await?;
         if loaded
@@ -407,7 +404,7 @@ impl GrokCredentialRefreshService {
             return Err(GrokCredentialRefreshError::InvalidRefreshResponse);
         }
         let (access_token_expires_at, next_refresh_at) =
-            refreshed_deadlines(account_id, tokens.expires_in, policy)
+            refreshed_deadlines(&account_id, tokens.expires_in, policy)
                 .ok_or(GrokCredentialRefreshError::InvalidRefreshResponse)?;
         let prepared = GrokCredentialAdmin
             .prepare_rotation(&RotateManagedGrokCredential {

backend/crates/providers/xai/src/credential/repository.rs

@@ -463,21 +463,6 @@ impl GrokCredentialRepository {
         loaded_from_core(loaded)
     }
 
-    pub(crate) async fn load_managed(
-        &self,
-        account_id: &ProviderAccountId,
-        revision: CredentialRevision,
-    ) -> Result<LoadedCredential, GrokCredentialRepositoryError> {
-        let loaded = self
-            .store
-            .load_credential(account_id, revision)
-            .await
-            .map_err(map_rotation_load_error)?;
-        ensure_xai(&loaded.account)?;
-        decode_secret(&loaded.credential)?;
-        Ok(loaded)
-    }
-
     /// 读取 xAI Provider 的全部账号；credential 逐行按 revision fence 加载。
     pub(crate) async fn list_loaded_for_provider(
         &self,
@@ -528,8 +513,12 @@ impl GrokCredentialRepository {
         &self,
         account_id: &ProviderAccountId,
     ) -> Result<LoadedGrokCredential, GrokCredentialRepositoryError> {
-        let account = self.ensure_xai_account(account_id).await?;
-        self.load(account_id, account.revision()).await
+        let loaded = self
+            .store
+            .load_current_credential(account_id)
+            .await
+            .map_err(map_store_error)?;
+        loaded_from_core(loaded)
     }
 
     pub(crate) async fn replace_quota(

backend/crates/providers/xai/tests/admin.rs

@@ -509,7 +509,6 @@ async fn xai_admin_provider_rejects_unprepared_mutations_before_store_commit() {
     let rotation_error = admin
         .prepare_rotation(PrepareCredentialRotation {
             account: record.clone(),
-            expected_credential_revision: record.credential_revision,
             provider_material: ProviderDocument::new(OpaqueProviderData::new(Map::new())),
         })
         .await
@@ -543,7 +542,7 @@ fn pending_payload(flow_id: &str, owner_ref: &str) -> OpaqueProviderData {
         .expose()
         .to_owned();
     let value = json!({
-        "schema_version": 1,
+        "schema_version": 3,
         "flow_id": flow_id,
         "owner_ref": owner_ref,
         "expires_at": (Utc::now() + chrono::Duration::minutes(30)).to_rfc3339(),

backend/crates/providers/xai/tests/credential/refresh.rs

@@ -381,9 +381,13 @@ async fn manual_refresh_returns_prepared_rotation_without_writing_store() {
     let id = input.account_id.clone();
     let (store, _, refresher, service) =
         fixture(input, [Ok(success_tokens(Some("manual-refresh")))], true).await;
+    let current = store
+        .load_current_credential(&id)
+        .await
+        .expect("load current credential");
 
     let prepared = service
-        .prepare_manual_refresh(&id, CredentialRevision::new(1).expect("revision"))
+        .prepare_manual_refresh(current)
         .await
         .expect("prepare manual refresh");
     assert_eq!(store.account(&id).expect("account").revision().get(), 1);
@@ -401,20 +405,35 @@ async fn manual_refresh_returns_prepared_rotation_without_writing_store() {
 }
 
 #[tokio::test]
-async fn manual_refresh_rejects_stale_revision_before_upstream_call() {
+async fn manual_refresh_preserves_snapshot_revision_as_the_final_cas_fence() {
     let input = due_input("manual-stale");
     let id = input.account_id.clone();
-    let (_, _, refresher, service) = fixture(input, [], true).await;
+    let (store, _, refresher, service) = fixture(
+        input,
+        [Ok(success_tokens(Some("manual-stale-refresh")))],
+        true,
+    )
+    .await;
+    let current = store
+        .load_current_credential(&id)
+        .await
+        .expect("load current credential");
+    force_due(&store, &id).await;
+
+    let prepared = service
+        .prepare_manual_refresh(current)
+        .await
+        .expect("prepare from current snapshot");
+    let (_, credential, _guard) = prepared.into_parts();
 
     assert!(matches!(
-        service
-            .prepare_manual_refresh(&id, CredentialRevision::new(2).expect("revision"))
-            .await,
-        Err(GrokCredentialRefreshError::Repository(
-            provider_xai::GrokCredentialRepositoryError::StaleCredentialRevision
-        ))
+        store
+            .compare_and_swap_credential(credential)
+            .await
+            .expect("attempt stale prepared rotation"),
+        CredentialCasOutcome::Conflict
     ));
-    assert_eq!(refresher.prepare_calls.load(Ordering::SeqCst), 0);
+    assert_eq!(refresher.prepare_calls.load(Ordering::SeqCst), 1);
 }
 
 #[tokio::test]
@@ -423,11 +442,13 @@ async fn manual_refresh_preserves_failure_class_without_store_write() {
     let id = input.account_id.clone();
     let (store, _, _, service) =
         fixture(input, [Err(GrokRefreshFailure::InvalidGrant)], true).await;
+    let current = store
+        .load_current_credential(&id)
+        .await
+        .expect("load current credential");
 
     assert!(matches!(
-        service
-            .prepare_manual_refresh(&id, CredentialRevision::new(1).expect("revision"))
-            .await,
+        service.prepare_manual_refresh(current).await,
         Err(GrokCredentialRefreshError::ManualFailure(
             GrokRefreshFailure::InvalidGrant
         ))

backend/crates/providers/xai/tests/support.rs

@@ -283,11 +283,19 @@ impl ProviderAccountStore for MemoryProviderAccountStore {
         account: &ProviderAccountId,
         expected_revision: CredentialRevision,
     ) -> Result<LoadedCredential, StoreError> {
-        let accounts = lock(&self.accounts);
-        let stored = accounts.get(account).ok_or_else(invalid)?;
-        if stored.account.revision() != expected_revision {
+        let loaded = self.load_current_credential(account).await?;
+        if loaded.account.revision() != expected_revision {
             return Err(conflict());
         }
+        Ok(loaded)
+    }
+
+    async fn load_current_credential(
+        &self,
+        account: &ProviderAccountId,
+    ) -> Result<LoadedCredential, StoreError> {
+        let accounts = lock(&self.accounts);
+        let stored = accounts.get(account).ok_or_else(invalid)?;
         Ok(LoadedCredential {
             account: stored.account.clone(),
             credential: stored.credential.clone(),

docs/api.md

@@ -47,8 +47,6 @@ Client Key 固定绑定一个 Provider：`openai` 或 `xai`。同一次请求不
 
 Admin API 不暴露全局配置版本，mutation 请求也不要求客户端提供全局配置版本。会改变路由快照或安全配置的写入由后端在事务内推进内部配置 revision，并用于快照发布与审计。
 
-单个 credential 的轮换或重新授权仍使用 `expectedCredentialRevision`，它只保护该 credential 本身，不是全局配置锁。
-
 ## 2. 健康检查
 
 | 方法 | 路由 | 鉴权 | 说明 |
@@ -150,7 +148,6 @@ OpenAI rotation 请求字段为：
 {
   "provider": "openai",
   "accountId": "acct_...",
-  "expectedCredentialRevision": 1,
   "accessToken": "...",
   "refreshToken": "..."
 }
@@ -162,12 +159,11 @@ OAuth start 使用：
 {
   "provider": "openai",
   "name": "account name",
-  "accountId": null,
-  "expectedCredentialRevision": null
+  "accountId": null
 }
 ```
 
-重新授权已有账号时，`accountId` 与 `expectedCredentialRevision` 必须同时提供。
+重新授权已有账号时只需提供 `accountId`。
 
 ## 6. Client Key
 

frontend/src/api/modules/accounts.ts

@@ -105,8 +105,6 @@ export interface Account {
   tokenRefreshing: boolean
   availability: string
   enabled: boolean
-  credentialRevision: number
-  stateRevision: number | null
   accessTokenExpiresAt: string | null
   accessTokenExpiresAtDisplay: string | null
   refreshTokenExpiresAt: string | null
@@ -160,7 +158,6 @@ export interface AccountImportResponse {
 
 export interface AccountMutationResponse {
   accountId: string
-  credentialRevision?: number
 }
 
 export interface AccountDeletionResponse {

frontend/src/views/accounts/composables/useAccountOnboarding.ts

@@ -72,7 +72,6 @@ export function useAccountOnboarding(options: {
           ...(account
             ? {
                 accountId: account.id,
-                expectedCredentialRevision: account.credentialRevision,
               }
             : {}),
         })

release/version.yaml

@@ -1 +1 @@
-version: "3.0.18"
+version: "3.0.19"