chore: bump version to 3.3.10

Co-authored-by: Codex <noreply@openai.com>
fix(openai): harden downstream websocket delivery
2026-11-07 16:05:27 +00:00 · 2026-08-31 03:30:13 +08:00 · 2026-08-31 03:27:11 +08:00 · 2026-08-31 02:58:16 +08:00 · 2026-08-31 02:40:40 +08:00 · 2026-08-31 02:40:40 +08:00
462 changed files with 23012 additions and 43465 deletions
@@ -45,7 +45,7 @@ jobs:
          ref: ${{ inputs.ref }}

      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Build runtime image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -79,7 +79,7 @@ jobs:
          ${{ hashFiles('trivy-results.sarif') != '' &&
              (github.event_name != 'pull_request' ||
               github.event.pull_request.head.repo.full_name == github.repository) }}
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
        with:
          sarif_file: trivy-results.sarif
          category: runtime-container
@@ -448,7 +448,7 @@ jobs:
          PY

      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -519,7 +519,7 @@ jobs:
          path: dist/release

      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
@@ -16,9 +16,6 @@

 </div>

-Codex Proxy RS 在一个网关中管理 OpenAI 与 xAI 账号，为客户端提供统一鉴权、模型路由、额度状态、
-请求观测和管理控制面。
-
 > [!NOTE]
 > 数据面支持 OpenAI Responses、Images 和模型目录协议，不提供 `/v1/chat/completions`。

@@ -30,7 +27,7 @@ Codex Proxy RS 在一个网关中管理 OpenAI 与 xAI 账号，为客户端提
 | Provider | 固定 `openai`、`xai` 两个 Provider，各自拥有 OAuth、credential、额度、目录与 transport |
 | 路由 | Client Key 限定账号分组；按模型能力编译 Provider 候选；支持全局精确模型映射、会话亲和和安全 fallback |
 | 透明边界 | OpenAI 保留未知请求字段及字段顺序，并原样转发 SSE、WebSocket 与 Images 业务字节；xAI 在 Provider 内转换协议 |
-| 账号 | OAuth、OpenAI AT/RT、账号文件与 Agent Identity 导入，credential/额度刷新、账号恢复及主动额度重置卡 |
+| 账号 | OAuth、OpenAI AT/RT 与账号文件导入，credential/额度刷新、账号恢复及主动额度重置卡 |
 | 管理 | 账号与分组、Client Key、运行设置、用量/错误观测、S3/R2 备份、系统更新与回滚 |
 | 计量 | Token、图片、费用、延迟、账号与 Provider 归因，并记录上游响应确认的实际 `service_tier` |

@@ -93,7 +90,7 @@ curl -i http://127.0.0.1:8080/healthz
 ### 3. 初始化网关

 1. 使用 `admin@cpr.local` 与初始密码登录。
-2. 导入或授权 Provider 账号：OpenAI 支持 OAuth、逐行 AT/RT、OAuth JSON 与 Agent Identity；
+2. 导入或授权 Provider 账号：OpenAI 支持 OAuth、逐行 AT/RT 与 OAuth JSON；
   xAI 支持 OAuth 和账号 JSON。
 3. 创建账号分组并按需配置全局模型映射。未命中的模型名原样交给候选 Provider。
 4. 创建 `sk_...` Client Key，选择可用账号分组，并设置速率和并发限制；空分组范围表示全部账号。
@@ -8,16 +8,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"

-[[package]]
-name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common 0.1.7",
- "generic-array",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -216,9 +206,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-s3"
-version = "1.141.0"
+version = "1.142.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9f9420d3a2467eed22ed3635ca653653162c386a0b0f65c78189f9bd3c1379e"
+checksum = "f9e15a5c55e05f4b0b7e483160b3c85cccdf77cff02c95504f3e71d460855cd2"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -308,9 +298,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.61.1"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9381123ab62d20c13082b151f30f962a3b112b727345394536dfa39a482944"
+checksum = "6de526c7b567420a31bc283657a7921b45c4cafe0827fdf2490713dcc770c28f"
 dependencies = [
 "aws-smithy-types",
 "bytes",
@@ -341,9 +331,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-http-client"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "635d23afda0a6ab48d666c4d447c4873e8d1e83518a2be2093122397e50b838e"
+checksum = "3c1c8a04cb31ba74d0115af5a890bb8c0d48fba64b52812fa13929a6ef0cc83c"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-runtime-api",
@@ -385,9 +375,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime"
-version = "1.12.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07505b34e8f4b3591a4fa69e9792b52289b95488dbbc68c3c0075b7bedb245e1"
+checksum = "483b858ff67522011c4786310c5cd8fd88d0be7ea3d5f1a48328446300c4269e"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-http",
@@ -411,9 +401,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b98f2e1fd67ec06618f9c291e5e495a468e60519e44c9c1979cd0521f3affdb"
+checksum = "954c563ce84507722d2679f07a35d21b9c6466b3872d513020d0281fc8112ac9"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-runtime-api-macros",
@@ -721,17 +711,6 @@ dependencies = [
 "phf 0.12.1",
 ]

-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common 0.1.7",
- "inout",
- "zeroize",
-]
-
 [[package]]
 name = "cmake"
 version = "0.1.58"
@@ -961,7 +940,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
 "generic-array",
- "rand_core 0.6.4",
 "typenum",
 ]

@@ -976,36 +954,6 @@ dependencies = [
 "rand_core 0.10.1",
 ]

-[[package]]
-name = "crypto_box"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16182b4f39a82ec8a6851155cc4c0cda3065bb1db33651726a29e1951de0f009"
-dependencies = [
- "aead",
- "blake2",
- "crypto_secretbox",
- "curve25519-dalek 4.1.3",
- "salsa20",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "crypto_secretbox"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d6cf87adf719ddf43a805e92c6870a531aedda35ff640442cbaf8674e141e1"
-dependencies = [
- "aead",
- "cipher",
- "generic-array",
- "poly1305",
- "salsa20",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "ctutils"
 version = "0.4.2"
@@ -1016,48 +964,6 @@ dependencies = [
 "subtle",
 ]

-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "curve25519-dalek-derive",
- "fiat-crypto 0.2.9",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek"
-version = "5.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "curve25519-dalek-derive",
- "digest 0.11.3",
- "fiat-crypto 0.3.0",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek-derive"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "data-encoding"
 version = "2.11.0"
@@ -1169,31 +1075,6 @@ dependencies = [
 "zeroize",
 ]

-[[package]]
-name = "ed25519"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
-dependencies = [
- "pkcs8",
- "signature 3.0.0",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
-dependencies = [
- "curve25519-dalek 5.0.0",
- "ed25519",
- "serde",
- "sha2 0.11.0",
- "signature 3.0.0",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "either"
 version = "1.16.0"
@@ -1246,7 +1127,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -1295,18 +1176,6 @@ dependencies = [
 "subtle",
 ]

-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
-[[package]]
-name = "fiat-crypto"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
-
 [[package]]
 name = "filetime"
 version = "0.2.29"
@@ -1577,7 +1446,6 @@ dependencies = [
 "tempfile",
 "thiserror",
 "tokio",
- "tower",
 "tracing",
 "tracing-appender",
 "tracing-subscriber",
@@ -1631,7 +1499,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
 "typenum",
 "version_check",
- "zeroize",
 ]

 [[package]]
@@ -2073,15 +1940,6 @@ dependencies = [
 "hashbrown 0.17.1",
 ]

-[[package]]
-name = "inout"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "ipnet"
 version = "2.12.0"
@@ -2318,12 +2176,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"

-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -2498,17 +2350,6 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"

-[[package]]
-name = "poly1305"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
-dependencies = [
- "cpufeatures 0.2.17",
- "opaque-debug",
- "universal-hash",
-]
-
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -2579,8 +2420,6 @@ dependencies = [
 "bytes",
 "chrono",
 "cookie",
- "crypto_box",
- "ed25519-dalek",
 "flate2",
 "futures",
 "gateway-admin",
@@ -2609,7 +2448,6 @@ dependencies = [
 "tracing-subscriber",
 "tungstenite 0.27.0",
 "url",
- "urlencoding",
 "uuid",
 "wiremock",
 "zstd",
@@ -2714,7 +2552,7 @@ dependencies = [
 "once_cell",
 "socket2",
 "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2813,9 +2651,9 @@ dependencies = [

 [[package]]
 name = "redis"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3257df217f7eab0044627a268c9cc6cdb60c0c421c88f83ac41c4e31520b6b84"
+checksum = "e37a4ca5c6ca42aa3e6df2fd32b987a65d32a4c2159a6f3fe0fd1df306a2658f"
 dependencies = [
 "arc-swap",
 "arcstr",
@@ -2984,7 +2822,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3049,15 +2887,6 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"

-[[package]]
-name = "salsa20"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
-dependencies = [
- "cipher",
-]
-
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -3628,7 +3457,7 @@ dependencies = [
 "getrandom 0.4.3",
 "once_cell",
 "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4046,16 +3875,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"

-[[package]]
-name = "universal-hash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
-dependencies = [
- "crypto-common 0.1.7",
- "subtle",
-]
-
 [[package]]
 name = "untrusted"
 version = "0.7.1"
@@ -4080,12 +3899,6 @@ dependencies = [
 "serde",
 ]

-[[package]]
-name = "urlencoding"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
-
 [[package]]
 name = "utf-8"
 version = "0.7.6"
@@ -4100,9 +3913,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"

 [[package]]
 name = "uuid"
-version = "1.24.0"
+version = "1.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -28,7 +28,7 @@ tracing = "0.1.44"
 uuid = { version = "1.23.3", features = ["v7"] }
 cron = "0.17"
 chrono-tz = "0.10"
-tokio = { version = "1.52", features = ["rt", "time", "macros"] }
+tokio = { version = "1.52", features = ["rt", "time", "macros", "sync"] }

 [dev-dependencies]
 serde_json = { version = "1.0.150", features = ["arbitrary_precision", "preserve_order"] }
@@ -134,9 +134,9 @@ impl fmt::Debug for AdminConfig {
 /// Admin-owned 启动配置错误；不回显任何配置值。
 #[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
 pub enum AdminConfigError {
-    #[error("configuration field `{0}` is invalid")]
+    #[error("配置字段 `{0}` 不合法")]
    InvalidField(&'static str),
-    #[error("admin.default_password does not meet the initial password policy")]
+    #[error("admin.default_password 不符合初始密码策略")]
    WeakInitialPassword,
 }

@@ -261,6 +261,7 @@ pub async fn initialize(

    let accounts = Arc::new(DefaultAccountsService::new(
        store.accounts(),
+        store.account_runtime(),
        registry.clone(),
        snapshot.clone(),
        probe.clone(),
@@ -282,6 +283,7 @@ pub async fn initialize(
        accounts,
        account_groups: Arc::new(DefaultAccountGroupService::new(
            store.account_groups(),
+            store.account_runtime(),
            snapshot.clone(),
        )),
        client_keys: Arc::new(DefaultClientKeyService::new(
@@ -322,9 +324,9 @@ fn backup_worker_contribution(
    task: backup::task::BackupTask,
 ) -> Result<Vec<WorkerContribution>, AdminError> {
    let id = WorkerId::try_new(WorkerKind::Backup, BACKUP_WORKER_OWNER)
-        .map_err(|_| AdminError::internal("Backup worker id is invalid"))?;
+        .map_err(|_| AdminError::internal("备份 Worker ID 不合法"))?;
    let restart = DaemonRestartPolicy::try_new(Duration::from_secs(1), Duration::from_secs(60))
-        .map_err(|_| AdminError::internal("Backup worker restart policy is invalid"))?;
+        .map_err(|_| AdminError::internal("备份 Worker 重启策略不合法"))?;
    let registration = WorkerRegistration::try_new(
        id,
        WorkerRunnable::Daemon {
@@ -332,12 +334,12 @@ fn backup_worker_contribution(
            task: Box::new(task),
        },
    )
-    .map_err(|_| AdminError::internal("Backup worker registration is invalid"))?;
+    .map_err(|_| AdminError::internal("备份 Worker 注册信息不合法"))?;
    Ok(vec![WorkerContribution::Registration(registration)])
 }

 fn provider_kind(value: &'static str) -> Result<ProviderKind, AdminError> {
-    ProviderKind::new(value).map_err(|_| AdminError::internal("Built-in Provider kind is invalid"))
+    ProviderKind::new(value).map_err(|_| AdminError::internal("内置 Provider 类型不合法"))
 }

 fn map_provider_registry_error(error: ProviderAdminError) -> AdminError {
@@ -347,11 +349,12 @@ fn map_provider_registry_error(error: ProviderAdminError) -> AdminError {
        }
        ProviderAdminErrorKind::NotFound => AdminErrorKind::NotFound,
        ProviderAdminErrorKind::Conflict => AdminErrorKind::Conflict,
+        ProviderAdminErrorKind::Ambiguous => AdminErrorKind::UpstreamResultUnknown,
        ProviderAdminErrorKind::Unavailable | ProviderAdminErrorKind::CredentialRefreshRequired => {
            AdminErrorKind::Unavailable
        }
        ProviderAdminErrorKind::BadGateway => AdminErrorKind::BadGateway,
        ProviderAdminErrorKind::Internal => AdminErrorKind::Internal,
    };
-    AdminError::new(kind, "Provider registry initialization failed")
+    AdminError::new(kind, "Provider 注册表初始化失败")
 }
@@ -3,7 +3,7 @@
 use std::collections::BTreeMap;

 use chrono::{DateTime, Utc};
-use gateway_core::routing::AccountGroupId;
+use gateway_core::{engine::credential::AccountStatusFacts, routing::AccountGroupId};

 use super::{PageSize, Revision, observability::DecimalAmount};

@@ -45,7 +45,17 @@ pub struct AccountGroupCapacity {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupUsage {
    pub today_usd: DecimalAmount,
-    pub total_usd: DecimalAmount,
+    /// 当前 usage retention 窗口内、按请求发生时 routing group 快照归属的累计成本。
+    pub retained_total_usd: DecimalAmount,
+}
+
+/// 当前页账号组 membership 对应的持久账号事实；运行态在 Admin query service 合并。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AccountGroupMemberFact {
+    pub group_id: AccountGroupId,
+    pub account_id: String,
+    pub status: AccountStatusFacts,
+    pub total_slots: u64,
 }

 /// Lightweight group reference embedded in account and client-key views.
@@ -1,11 +1,15 @@
 //! 多 Provider 账号目录与连接测试的公共事实。

-use std::pin::Pin;
+use std::{collections::BTreeMap, pin::Pin};

 use chrono::{DateTime, Utc};
 use futures::Stream;

-use gateway_core::routing::ProviderKind;
+use gateway_core::{
+    engine::{UpstreamSendState, probe::AccountProbeErrorSource},
+    error::GatewayErrorKind,
+    routing::ProviderKind,
+};

 use super::{PageSize, Revision, account_groups::AccountGroupRef, observability::TimeRange};

@@ -52,6 +56,14 @@ pub struct AccountListQuery {
    pub sort: Option<AccountSort>,
 }

+/// Admin query service 从运行态存储取得的当前账号冷却快照。
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct AccountRuntimeSnapshot {
+    pub rate_limited_until: BTreeMap<String, DateTime<Utc>>,
+    /// `None` 表示实时 lease 存储不可用；`Some` 中未出现的账号当前使用量为零。
+    pub in_flight: Option<BTreeMap<String, u64>>,
+}
+
 /// Optional account membership filter.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum AccountGroupFilter {
@@ -249,6 +261,9 @@ pub enum AccountConnectionTestEvent {
    },
    Completed,
    Failed {
+        source: AccountProbeErrorSource,
+        gateway_error_code: GatewayErrorKind,
+        send_state: Option<UpstreamSendState>,
        message: String,
        provider_error_code: Option<String>,
        provider_error_type: Option<String>,
@@ -21,11 +21,12 @@ pub enum AdminErrorKind {
    Conflict,
    RateLimited,
    BadGateway,
+    UpstreamResultUnknown,
    Unavailable,
    Internal,
 }

-/// 不携带基础设施细节的管理用例错误。
+/// 不携带基础设施细节、可安全返回给管理员的管理用例错误。
 #[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
 #[error("{message}")]
 pub struct AdminError {
@@ -47,6 +48,12 @@ impl AdminError {
        self.kind
    }

+    /// 返回已脱敏、可公开给管理员的文案。
+    #[must_use]
+    pub fn message(&self) -> &str {
+        &self.message
+    }
+
    #[must_use]
    pub fn invalid(message: impl Into<String>) -> Self {
        Self::new(AdminErrorKind::Invalid, message)
@@ -72,6 +79,11 @@ impl AdminError {
        Self::new(AdminErrorKind::BadGateway, message)
    }

+    #[must_use]
+    pub fn upstream_result_unknown(message: impl Into<String>) -> Self {
+        Self::new(AdminErrorKind::UpstreamResultUnknown, message)
+    }
+
    #[must_use]
    pub fn unavailable(message: impl Into<String>) -> Self {
        Self::new(AdminErrorKind::Unavailable, message)
@@ -1,6 +1,6 @@
 //! 用量、成本、健康与错误诊断的 UTC 语义事实。

-use std::{num::NonZeroU32, str::FromStr};
+use std::str::FromStr;

 use chrono::{DateTime, TimeDelta, Timelike as _, Utc};

@@ -38,22 +38,6 @@ impl TimeRange {
    }
 }

-/// 从一开始的观测页码。
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct PageNumber(NonZeroU32);
-
-impl PageNumber {
-    #[must_use]
-    pub const fn new(value: NonZeroU32) -> Self {
-        Self(value)
-    }
-
-    #[must_use]
-    pub const fn get(self) -> u32 {
-        self.0.get()
-    }
-}
-
 /// 观测记录的稳定键集游标。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ObservabilityCursor {
@@ -147,8 +131,8 @@ pub struct UsageQuery {
    pub range: TimeRange,
    pub filter: UsageFilter,
    pub cursor: Option<ObservabilityCursor>,
-    pub page: PageNumber,
    pub page_size: PageSize,
+    pub include_total: bool,
 }

 /// 运维错误过滤条件。
@@ -175,8 +159,8 @@ pub struct OpsErrorQuery {
    pub range: TimeRange,
    pub filter: OpsErrorFilter,
    pub cursor: Option<ObservabilityCursor>,
-    pub page: PageNumber,
    pub page_size: PageSize,
+    pub include_total: bool,
 }

 /// 用量诊断维度。
@@ -402,6 +386,16 @@ pub struct RequestMetrics {
    pub max_latency_ms: Option<u64>,
    pub latency_percentiles: LatencyPercentiles,
    pub first_token_latency_percentiles: LatencyPercentiles,
+    pub admission_decision_count: u64,
+    pub admission_decision_percentiles: LatencyPercentiles,
+    pub account_selection_wait_count: u64,
+    pub account_selection_wait_percentiles: LatencyPercentiles,
+    pub output_throughput_p10: Option<u64>,
+    pub output_throughput_p50: Option<u64>,
+    pub output_throughput_p90: Option<u64>,
+    pub capacity_sample_count: u64,
+    pub capacity_utilization_avg_basis_points: Option<u64>,
+    pub capacity_utilization_p95_basis_points: Option<u64>,
    pub cache_eligible_request_count: u64,
    pub cache_hit_request_count: u64,
 }
@@ -535,13 +529,60 @@ pub struct DashboardTotals {
 #[derive(Debug, Clone, PartialEq)]
 pub struct DashboardObservation {
    pub range: TimeRange,
-    pub requests: RequestMetrics,
-    pub attempts: AttemptMetrics,
    pub totals: DashboardTotals,
    pub provider_accounts: AccountPoolMetrics,
    pub trend: Vec<RequestMetricPoint>,
    pub account_usage: Vec<DashboardAccountUsage>,
-    pub recent_requests: Vec<UsageRecord>,
+    pub recent_requests: Vec<UsageListRecord>,
+}
+
+/// 使用记录表格的窄读模型。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageListRecord {
+    pub id: String,
+    pub endpoint: String,
+    pub client_transport: String,
+    pub requested_model_id: Option<String>,
+    pub provider_kind: Option<String>,
+    pub provider_account_ref: Option<String>,
+    pub provider_account_name: Option<String>,
+    pub provider_account_email: Option<String>,
+    pub provider_account_authentication_kind: Option<String>,
+    pub upstream_model_id: Option<String>,
+    pub upstream_transport: Option<String>,
+    pub service_tier: Option<String>,
+    pub input_tokens: Option<u64>,
+    pub output_tokens: Option<u64>,
+    pub cached_tokens: Option<u64>,
+    pub cache_write_tokens: Option<u64>,
+    pub reasoning_tokens: Option<u64>,
+    pub image_input_tokens: Option<u64>,
+    pub image_output_tokens: Option<u64>,
+    pub total_tokens: Option<u64>,
+    pub cost_source: String,
+    pub cost_amount: Option<DecimalAmount>,
+    pub cost_currency: Option<String>,
+    pub billing: Option<UsageBilling>,
+    pub transport_decision_wait_ms: Option<u64>,
+    pub connect_ms: Option<u64>,
+    pub headers_ms: Option<u64>,
+    pub first_event_ms: Option<u64>,
+    pub first_reasoning_ms: Option<u64>,
+    pub first_text_ms: Option<u64>,
+    pub first_token_ms: Option<u64>,
+    pub provider_processing_ms: Option<u64>,
+    pub latency_ms: Option<u64>,
+    pub admission_decision_ms: Option<u64>,
+    pub account_selection_wait_ms: Option<u64>,
+    pub capacity_used_slots: Option<u64>,
+    pub capacity_total_slots: Option<u64>,
+    pub client_ip: Option<String>,
+    pub user_agent: Option<String>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_preset: Option<String>,
+    pub subagent_kind: Option<String>,
+    pub compact: bool,
+    pub started_at: DateTime<Utc>,
 }

 /// 一次完整模型请求的公共观测记录。
@@ -604,6 +645,10 @@ pub struct UsageRecord {
    pub first_token_ms: Option<u64>,
    pub provider_processing_ms: Option<u64>,
    pub latency_ms: Option<u64>,
+    pub admission_decision_ms: Option<u64>,
+    pub account_selection_wait_ms: Option<u64>,
+    pub capacity_used_slots: Option<u64>,
+    pub capacity_total_slots: Option<u64>,
    pub client_ip: Option<String>,
    pub user_agent: Option<String>,
    pub reasoning_effort: Option<String>,
@@ -621,8 +666,8 @@ pub struct UsageRecord {
 /// 用量分页结果。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UsagePage {
-    pub items: Vec<UsageRecord>,
-    pub total: u64,
+    pub items: Vec<UsageListRecord>,
+    pub total: Option<u64>,
    pub next_cursor: Option<ObservabilityCursor>,
 }

@@ -708,6 +753,9 @@ pub struct DiagnosticObservation {
    pub total_tokens: u64,
    pub average_latency_ms: Option<u64>,
    pub latency_p95_ms: Option<u64>,
+    pub first_token_p95_ms: Option<u64>,
+    pub non_completion_count: u64,
+    pub retry_count: u64,
    pub cost_coverage: CostCoverage,
    pub costs: Vec<CurrencyCost>,
 }
@@ -747,7 +795,7 @@ pub struct OpsError {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct OpsErrorPage {
    pub items: Vec<OpsError>,
-    pub total: u64,
+    pub total: Option<u64>,
    pub next_cursor: Option<ObservabilityCursor>,
 }

@@ -787,6 +835,9 @@ pub struct TrendSummary {
    pub average_latency_ms: Option<u64>,
    pub max_latency_ms: Option<u64>,
    pub min_latency_ms: Option<u64>,
+    pub peak_first_token_p95_ms: Option<f64>,
+    pub peak_latency_p95_ms: Option<f64>,
+    pub minimum_output_throughput_p50: Option<u64>,
    pub success_rate: Option<f64>,
    pub cache_hit_request_rate: Option<f64>,
    pub costs: Vec<CurrencyCost>,
@@ -935,6 +986,7 @@ pub struct DashboardResult {
 /// 洞察健康时间点的语义结果。
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageInsightsHealthPoint {
+    pub total_requests: u64,
    pub bucket_start: DateTime<Utc>,
    pub success_requests: u64,
    pub failed_requests: u64,
@@ -954,6 +1006,7 @@ pub struct UsageInsightsHealth {
    pub incomplete_requests: u64,
    pub caller_error_requests: u64,
    pub success_rate: f64,
+    pub completion_rate: f64,
    pub points: Vec<UsageInsightsHealthPoint>,
 }

@@ -963,6 +1016,13 @@ pub struct UsageInsightsPerformancePoint {
    pub bucket_start: DateTime<Utc>,
    pub latency_percentiles: LatencyPercentiles,
    pub first_token_latency_percentiles: LatencyPercentiles,
+    pub admission_decision_percentiles: LatencyPercentiles,
+    pub account_selection_wait_percentiles: LatencyPercentiles,
+    pub output_throughput_p10: Option<u64>,
+    pub output_throughput_p50: Option<u64>,
+    pub output_throughput_p90: Option<u64>,
+    pub capacity_utilization_avg_basis_points: Option<u64>,
+    pub capacity_utilization_p95_basis_points: Option<u64>,
 }

 /// 洞察性能汇总与可观测覆盖率。
@@ -972,6 +1032,16 @@ pub struct UsageInsightsPerformance {
    pub first_token_latency_percentiles: LatencyPercentiles,
    pub latency_coverage: f64,
    pub first_token_coverage: f64,
+    pub admission_decision_percentiles: LatencyPercentiles,
+    pub account_selection_wait_percentiles: LatencyPercentiles,
+    pub admission_decision_coverage: f64,
+    pub account_selection_wait_coverage: f64,
+    pub output_throughput_p10: Option<u64>,
+    pub output_throughput_p50: Option<u64>,
+    pub output_throughput_p90: Option<u64>,
+    pub capacity_utilization_avg_basis_points: Option<u64>,
+    pub capacity_utilization_p95_basis_points: Option<u64>,
+    pub capacity_coverage: f64,
    pub points: Vec<UsageInsightsPerformancePoint>,
 }

@@ -985,6 +1055,8 @@ pub struct UsageInsightsCostPoint {
    pub total_tokens: u64,
    pub estimated_cost: Option<DecimalAmount>,
    pub standard_cost: Option<DecimalAmount>,
+    pub no_cache_cost: Option<DecimalAmount>,
+    pub cache_savings: Option<DecimalAmount>,
    pub cached_token_rate: f64,
    pub cache_hit_request_rate: Option<f64>,
 }
@@ -994,7 +1066,11 @@ pub struct UsageInsightsCostPoint {
 pub struct UsageInsightsCost {
    pub estimated_cost: Option<DecimalAmount>,
    pub standard_cost: Option<DecimalAmount>,
+    pub no_cache_cost: Option<DecimalAmount>,
+    pub cache_savings: Option<DecimalAmount>,
+    pub tier_premium: Option<DecimalAmount>,
    pub cost_per_request: Option<DecimalAmount>,
+    pub cost_per_successful_request: Option<DecimalAmount>,
    pub tokens_per_request: f64,
    pub cached_token_rate: f64,
    pub cache_hit_request_rate: Option<f64>,
@@ -1030,6 +1106,12 @@ pub struct DiagnosticsItem {
    pub request_share: f64,
    pub average_latency_ms: Option<u64>,
    pub latency_p95_ms: Option<u64>,
+    pub first_token_p95_ms: Option<u64>,
+    pub non_completion_count: u64,
+    pub non_completion_rate: f64,
+    pub retry_count: u64,
+    pub retry_rate: f64,
+    pub impact_score: f64,
    pub estimated_cost: Option<DecimalAmount>,
    pub attempt_count: u64,
    pub total_tokens: u64,
@@ -3,7 +3,7 @@
 use std::fmt;

 use async_trait::async_trait;
-use chrono::{DateTime, Utc};
+use chrono::{DateTime, NaiveDate, Utc};
 use gateway_core::{
    engine::credential::{OpaqueProviderData, ProviderAccountId, ProviderAccountIdentity},
    routing::{ProviderKind, UpstreamModelId},
@@ -627,6 +627,58 @@ pub struct ProviderQuota {
    pub provider_data: Option<ProviderDocument>,
 }

+/// Provider 官方个人资料中的累计摘要。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderProfileStatisticsSummary {
+    pub total_text_tokens: Option<u64>,
+    pub peak_tokens: Option<u64>,
+    pub longest_task_duration_ms: Option<u64>,
+    pub current_streak_days: Option<u64>,
+    pub longest_streak_days: Option<u64>,
+}
+
+/// Provider 官方个人资料中的单日 Token bucket。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderProfileDailyUsage {
+    pub date: NaiveDate,
+    pub tokens: u64,
+}
+
+/// Provider 官方个人资料中的插件或 Skill 调用排行。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderProfileInvocation {
+    pub invocation_type: String,
+    pub plugin_id: Option<String>,
+    pub plugin_name: Option<String>,
+    pub skill_id: Option<String>,
+    pub skill_name: Option<String>,
+    pub usage_count: Option<u64>,
+}
+
+/// Provider 官方个人资料中的活动洞察。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderProfileActivityInsights {
+    pub fast_mode_percent: Option<f64>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_effort_percent: Option<f64>,
+    pub skills_explored: Option<u64>,
+    pub total_skills_used: Option<u64>,
+    pub total_threads: Option<u64>,
+    pub invocations: Option<Vec<ProviderProfileInvocation>>,
+}
+
+/// Provider 已解释的官方个人资料统计。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderProfileStatistics {
+    pub display_name: Option<String>,
+    pub username: Option<String>,
+    pub image_url: Option<String>,
+    pub has_stats_error: bool,
+    pub summary: ProviderProfileStatisticsSummary,
+    pub daily_usage: Option<Vec<ProviderProfileDailyUsage>>,
+    pub activity_insights: ProviderProfileActivityInsights,
+}
+
 /// Provider 返回的一张安全主动额度重置卡。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderResetCredit {
@@ -17,7 +17,8 @@ use crate::model::provider_credentials::{
    PendingAuthorizationMutation, PrepareCredentialImport, PrepareCredentialRefresh,
    PrepareCredentialRotation, PreparedAuthorizationCommit, PreparedCredentialImport,
    PreparedCredentialRotation, ProviderExport, ProviderExportCredentialInput, ProviderModels,
-    ProviderQuota, ProviderQuotaRequest, ProviderResetCreditResult, ProviderResetCredits,
+    ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest, ProviderResetCreditResult,
+    ProviderResetCredits,
 };

 /// Provider 管理失败的稳定分类。
@@ -27,6 +28,8 @@ pub enum ProviderAdminErrorKind {
    Unsupported,
    NotFound,
    Conflict,
+    /// Provider 已发起不可逆操作，但无法确认最终执行结果。
+    Ambiguous,
    Unavailable,
    CredentialRefreshRequired,
    BadGateway,
@@ -35,8 +38,8 @@ pub enum ProviderAdminErrorKind {

 /// 不携带 OAuth 请求材料的管理错误。
 ///
-/// `message` 用于当前认证管理请求展示；上游没有标准 `error.message` 时，
-/// Provider 可以按其官方契约回退为完整的非成功响应正文。
+/// `message` 是 Provider 局部诊断，可能包含原始上游正文；通用管理用例不得自动把它作为公开文案。
+/// 只有明确拥有原始诊断合同的调用方才能读取，`Debug` 始终只记录是否存在。
 #[derive(Clone, PartialEq, Eq, thiserror::Error)]
 #[error("provider admin operation failed: {kind:?}")]
 pub struct ProviderAdminError {
@@ -146,6 +149,14 @@ pub trait ProviderAdmin: Send + Sync {
        request: ProviderQuotaRequest,
    ) -> Result<ProviderQuota, ProviderAdminError>;

+    /// 查询 Provider 官方个人资料统计；不支持该能力的 Provider 使用默认拒绝。
+    async fn profile_statistics(
+        &self,
+        _account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileStatistics, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
    /// 查询 Provider 主动额度重置卡；不支持该能力的 Provider 使用默认拒绝。
    async fn reset_credits(
        &self,
@@ -11,13 +11,13 @@ use super::backup::BackupStorePorts;
 use crate::model::{
    MutationContext, Revision,
    account_groups::{
-        AccountGroupListQuery, AccountGroupMutation, AccountGroupPage, DeleteAccountGroup,
-        NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
+        AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
+        DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
    },
    accounts::{
-        AccountListQuery, AccountPage, AccountPageItem, AccountUpdateResult, AccountUsage,
-        AccountUsageWindowQuery, AccountUsageWindowResult, AccountsUpdateResult,
-        BatchUpdateAccounts, DeleteAccounts, UpdateAccount,
+        AccountListQuery, AccountPage, AccountPageItem, AccountRuntimeSnapshot,
+        AccountUpdateResult, AccountUsage, AccountUsageWindowQuery, AccountUsageWindowResult,
+        AccountsUpdateResult, BatchUpdateAccounts, DeleteAccounts, UpdateAccount,
    },
    auth::{AdminAuditEvent, AdminSession},
    client_keys::{
@@ -86,9 +86,17 @@ pub type AdminStoreResult<T> = Result<T, AdminStoreError>;
 /// 账号目录与公共账号写操作。
 #[async_trait]
 pub trait AccountStore: Send + Sync {
-    async fn list_accounts(&self, query: AccountListQuery) -> AdminStoreResult<AccountPage>;
+    async fn list_accounts(
+        &self,
+        query: AccountListQuery,
+        runtime: AccountRuntimeSnapshot,
+    ) -> AdminStoreResult<AccountPage>;

-    async fn load_account(&self, account_id: &str) -> AdminStoreResult<Option<AccountPageItem>>;
+    async fn load_account(
+        &self,
+        account_id: &str,
+        runtime: AccountRuntimeSnapshot,
+    ) -> AdminStoreResult<Option<AccountPageItem>>;

    async fn load_account_usage(
        &self,
@@ -174,6 +182,17 @@ pub trait AccountStore: Send + Sync {
    ) -> AdminStoreResult<()>;
 }

+/// 可丢失账号运行态的管理读端口；跨存储编排由 Admin application service 拥有。
+#[async_trait]
+pub trait AccountRuntimeStore: Send + Sync {
+    async fn active_rate_limits(&self) -> AdminStoreResult<AccountRuntimeSnapshot>;
+
+    async fn account_runtime(
+        &self,
+        account_ids: &[String],
+    ) -> AdminStoreResult<AccountRuntimeSnapshot>;
+}
+
 /// 管理员密码、会话和安全审计。
 #[async_trait]
 pub trait AuthStore: Send + Sync {
@@ -240,6 +259,11 @@ pub trait AccountGroupStore: Send + Sync {
        query: AccountGroupListQuery,
    ) -> AdminStoreResult<AccountGroupPage>;

+    async fn load_account_group_members(
+        &self,
+        group_ids: &[gateway_core::routing::AccountGroupId],
+    ) -> AdminStoreResult<Vec<AccountGroupMemberFact>>;
+
    async fn create_account_group(
        &self,
        command: NewAccountGroup,
@@ -346,13 +370,35 @@ pub trait SettingsStore: Send + Sync {
    ) -> AdminStoreResult<AdminApiKeyMutation>;
 }

+/// 账号目录、运行态与分组所需的 Store 能力集合。
+#[derive(Clone)]
+pub struct AdminAccountStorePorts {
+    accounts: Arc<dyn AccountStore>,
+    runtime: Arc<dyn AccountRuntimeStore>,
+    groups: Arc<dyn AccountGroupStore>,
+}
+
+impl AdminAccountStorePorts {
+    #[must_use]
+    pub fn new(
+        accounts: Arc<dyn AccountStore>,
+        runtime: Arc<dyn AccountRuntimeStore>,
+        groups: Arc<dyn AccountGroupStore>,
+    ) -> Self {
+        Self {
+            accounts,
+            runtime,
+            groups,
+        }
+    }
+}
+
 /// 管理用例所需能力的封闭集合。
 ///
 /// 字段保持私有，每个 getter 只交出一种明确能力。该类型不提供通用拆包入口。
 #[derive(Clone)]
 pub struct AdminStorePorts {
-    accounts: Arc<dyn AccountStore>,
-    account_groups: Arc<dyn AccountGroupStore>,
+    accounts: AdminAccountStorePorts,
    auth: Arc<dyn AuthStore>,
    client_keys: Arc<dyn ClientKeyStore>,
    observability: Arc<dyn ObservabilityStore>,
@@ -363,8 +409,7 @@ pub struct AdminStorePorts {
 impl AdminStorePorts {
    #[must_use]
    pub fn new(
-        accounts: Arc<dyn AccountStore>,
-        account_groups: Arc<dyn AccountGroupStore>,
+        accounts: AdminAccountStorePorts,
        auth: Arc<dyn AuthStore>,
        client_keys: Arc<dyn ClientKeyStore>,
        observability: Arc<dyn ObservabilityStore>,
@@ -373,7 +418,6 @@ impl AdminStorePorts {
    ) -> Self {
        Self {
            accounts,
-            account_groups,
            auth,
            client_keys,
            observability,
@@ -384,12 +428,17 @@ impl AdminStorePorts {

    #[must_use]
    pub fn accounts(&self) -> Arc<dyn AccountStore> {
-        self.accounts.clone()
+        self.accounts.accounts.clone()
+    }
+
+    #[must_use]
+    pub fn account_runtime(&self) -> Arc<dyn AccountRuntimeStore> {
+        self.accounts.runtime.clone()
    }

    #[must_use]
    pub fn account_groups(&self) -> Arc<dyn AccountGroupStore> {
-        self.account_groups.clone()
+        self.accounts.groups.clone()
    }

    #[must_use]
@@ -1,20 +1,29 @@
 //! Account group management use cases.

-use std::sync::Arc;
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    sync::Arc,
+    time::SystemTime,
+};

 use async_trait::async_trait;
-use gateway_core::routing::{AccountGroupId, snapshot::SnapshotControl};
+use gateway_core::{
+    engine::credential::{AccountStatus, resolve_account_status},
+    routing::{AccountGroupId, snapshot::SnapshotControl},
+};
 use uuid::Uuid;

 use crate::{
    model::{
        AdminError, MutationContext,
        account_groups::{
-            AccountGroupListQuery, AccountGroupMutation, AccountGroupPage, CreateAccountGroup,
-            DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
+            AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupListQuery,
+            AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage, AccountGroupRecord,
+            CreateAccountGroup, DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled,
+            UpdateAccountGroup,
        },
    },
-    ports::store::AccountGroupStore,
+    ports::store::{AccountGroupStore, AccountRuntimeStore},
 };

 use super::{map_store_error, publish_committed};
@@ -47,6 +56,7 @@ pub trait AccountGroupService: Send + Sync {

 pub(crate) struct DefaultAccountGroupService {
    store: Arc<dyn AccountGroupStore>,
+    runtime: Arc<dyn AccountRuntimeStore>,
    snapshot: Arc<dyn SnapshotControl>,
 }

@@ -54,16 +64,54 @@ impl DefaultAccountGroupService {
    #[must_use]
    pub(crate) fn new(
        store: Arc<dyn AccountGroupStore>,
+        runtime: Arc<dyn AccountRuntimeStore>,
        snapshot: Arc<dyn SnapshotControl>,
    ) -> Self {
-        Self { store, snapshot }
+        Self {
+            store,
+            runtime,
+            snapshot,
+        }
+    }
+
+    async fn enrich_records(&self, records: &mut [AccountGroupRecord]) -> Result<(), AdminError> {
+        if records.is_empty() {
+            return Ok(());
+        }
+        let group_ids = records
+            .iter()
+            .map(|record| record.id.clone())
+            .collect::<Vec<_>>();
+        let members = self
+            .store
+            .load_account_group_members(&group_ids)
+            .await
+            .map_err(|error| map_store_error(error, "account group members"))?;
+        let account_ids = members
+            .iter()
+            .map(|member| member.account_id.clone())
+            .collect::<BTreeSet<_>>()
+            .into_iter()
+            .collect::<Vec<_>>();
+        let runtime = match self.runtime.account_runtime(&account_ids).await {
+            Ok(runtime) => runtime,
+            Err(error) => {
+                tracing::warn!(error = %error, "account group runtime projection is unavailable");
+                Default::default()
+            }
+        };
+        project_group_runtime(records, &members, &runtime);
+        Ok(())
    }

    async fn publish(
        &self,
        result: Result<AccountGroupMutation, crate::ports::store::AdminStoreError>,
    ) -> Result<AccountGroupMutation, AdminError> {
-        let result = result.map_err(|error| map_store_error(error, "account group"))?;
+        let mut result = result.map_err(|error| map_store_error(error, "account group"))?;
+        if let Some(record) = result.record.as_mut() {
+            self.enrich_records(std::slice::from_mut(record)).await?;
+        }
        publish_committed(self.snapshot.as_ref(), result.config_revision).await?;
        Ok(result)
    }
@@ -72,10 +120,13 @@ impl DefaultAccountGroupService {
 #[async_trait]
 impl AccountGroupService for DefaultAccountGroupService {
    async fn list(&self, query: AccountGroupListQuery) -> Result<AccountGroupPage, AdminError> {
-        self.store
+        let mut page = self
+            .store
            .list_account_groups(query)
            .await
-            .map_err(|error| map_store_error(error, "account group"))
+            .map_err(|error| map_store_error(error, "account group"))?;
+        self.enrich_records(&mut page.items).await?;
+        Ok(page)
    }

    async fn create(
@@ -84,7 +135,7 @@ impl AccountGroupService for DefaultAccountGroupService {
        command: CreateAccountGroup,
    ) -> Result<AccountGroupMutation, AdminError> {
        let id = AccountGroupId::new(format!("grp_{}", Uuid::now_v7().simple()))
-            .map_err(|_| AdminError::internal("Failed to create account group ID"))?;
+            .map_err(|_| AdminError::internal("创建账号组 ID 失败"))?;
        self.publish(
            self.store
                .create_account_group(
@@ -128,3 +179,63 @@ impl AccountGroupService for DefaultAccountGroupService {
            .await
    }
 }
+
+fn project_group_runtime(
+    records: &mut [AccountGroupRecord],
+    members: &[AccountGroupMemberFact],
+    runtime: &crate::model::accounts::AccountRuntimeSnapshot,
+) {
+    let now = SystemTime::now();
+    let mut status_by_account = BTreeMap::new();
+    let mut slots_by_account = BTreeMap::new();
+    let mut accounts_by_group = BTreeMap::<&str, Vec<&str>>::new();
+    for member in members {
+        let mut status = member.status.clone();
+        status.rate_limited_until = runtime
+            .rate_limited_until
+            .get(&member.account_id)
+            .copied()
+            .map(Into::into);
+        status_by_account
+            .entry(member.account_id.as_str())
+            .or_insert_with(|| resolve_account_status(&status, now).status);
+        slots_by_account
+            .entry(member.account_id.as_str())
+            .or_insert(member.total_slots);
+        accounts_by_group
+            .entry(member.group_id.as_str())
+            .or_default()
+            .push(member.account_id.as_str());
+    }
+    for record in records {
+        let account_ids = accounts_by_group
+            .get(record.id.as_str())
+            .map_or(&[][..], Vec::as_slice);
+        let available_ids = account_ids
+            .iter()
+            .copied()
+            .filter(|account_id| status_by_account.get(account_id) == Some(&AccountStatus::Normal))
+            .collect::<Vec<_>>();
+        let total = u64::try_from(account_ids.len()).unwrap_or(u64::MAX);
+        let available = u64::try_from(available_ids.len()).unwrap_or(u64::MAX);
+        record.account_summary = AccountGroupAccountSummary {
+            available,
+            limited: total.saturating_sub(available),
+            total,
+        };
+        record.capacity = AccountGroupCapacity {
+            used_slots: if available_ids.is_empty() {
+                Some(0)
+            } else {
+                runtime.in_flight.as_ref().map(|in_flight| {
+                    available_ids.iter().fold(0_u64, |sum, account_id| {
+                        sum.saturating_add(in_flight.get(*account_id).copied().unwrap_or(0))
+                    })
+                })
+            },
+            total_slots: available_ids.iter().fold(0_u64, |sum, account_id| {
+                sum.saturating_add(slots_by_account.get(*account_id).copied().unwrap_or(0))
+            }),
+        };
+    }
+}
@@ -24,12 +24,15 @@ use crate::{
        observability::TimeRange,
        provider_credentials::{
            AccountDirectoryItem, AccountDirectoryPage, AccountExportBundle, AccountRefreshResult,
-            ConsumeProviderResetCredit, PrepareCredentialRefresh, ProviderModels, ProviderQuota,
-            ProviderQuotaRequest, ProviderQuotaWindow, ProviderResetCreditResult,
-            ProviderResetCredits, QuotaLocalUsageAttribution,
+            ConsumeProviderResetCredit, PrepareCredentialRefresh, ProviderModels,
+            ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest, ProviderQuotaWindow,
+            ProviderResetCreditResult, ProviderResetCredits, QuotaLocalUsageAttribution,
        },
    },
-    ports::{provider::ProviderAdminRegistry, store::AccountStore},
+    ports::{
+        provider::ProviderAdminRegistry,
+        store::{AccountRuntimeStore, AccountStore},
+    },
 };

 use super::{
@@ -80,14 +83,19 @@ pub trait AccountsService: Send + Sync {
        refresh: bool,
    ) -> Result<AccountDirectoryItem, AdminError>;

+    async fn profile_statistics(
+        &self,
+        _account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileStatistics, AdminError> {
+        Err(AdminError::invalid("当前 Provider 不支持账号统计"))
+    }
+
    async fn reset_credits(
        &self,
        _context: &MutationContext,
        _account_id: ProviderAccountId,
    ) -> Result<ProviderResetCredits, AdminError> {
-        Err(AdminError::invalid(
-            "Provider reset credits are not supported",
-        ))
+        Err(AdminError::invalid("当前 Provider 不支持重置额度"))
    }

    async fn consume_reset_credit(
@@ -95,9 +103,7 @@ pub trait AccountsService: Send + Sync {
        _context: &MutationContext,
        _command: ConsumeProviderResetCredit,
    ) -> Result<ProviderResetCreditResult, AdminError> {
-        Err(AdminError::invalid(
-            "Provider reset credits are not supported",
-        ))
+        Err(AdminError::invalid("当前 Provider 不支持重置额度"))
    }

    async fn models(
@@ -115,6 +121,7 @@ pub trait AccountsService: Send + Sync {

 pub(crate) struct DefaultAccountsService {
    accounts: Arc<dyn AccountStore>,
+    account_runtime: Arc<dyn AccountRuntimeStore>,
    providers: ProviderAdminRegistry,
    snapshot: Arc<dyn SnapshotControl>,
    probe: Arc<dyn AccountProbe>,
@@ -126,12 +133,14 @@ impl DefaultAccountsService {
    #[must_use]
    pub(crate) fn new(
        accounts: Arc<dyn AccountStore>,
+        account_runtime: Arc<dyn AccountRuntimeStore>,
        providers: ProviderAdminRegistry,
        snapshot: Arc<dyn SnapshotControl>,
        probe: Arc<dyn AccountProbe>,
    ) -> Self {
        Self {
            accounts,
+            account_runtime,
            providers,
            snapshot,
            probe,
@@ -155,11 +164,16 @@ impl DefaultAccountsService {
        &self,
        account_id: &ProviderAccountId,
    ) -> Result<AccountPageItem, AdminError> {
+        let runtime = self
+            .account_runtime
+            .account_runtime(&[account_id.as_str().to_owned()])
+            .await
+            .map_err(|error| map_store_error(error, "account runtime"))?;
        self.accounts
-            .load_account(account_id.as_str())
+            .load_account(account_id.as_str(), runtime)
            .await
            .map_err(|error| map_store_error(error, "provider account"))?
-            .ok_or_else(|| AdminError::not_found("Provider account was not found"))
+            .ok_or_else(|| AdminError::not_found("Provider 账号不存在"))
    }

    async fn provider_for_account(
@@ -266,9 +280,14 @@ impl DefaultAccountsService {
 #[async_trait]
 impl AccountsService for DefaultAccountsService {
    async fn list(&self, query: AccountListQuery) -> Result<AccountDirectoryPage, AdminError> {
+        let runtime = self
+            .account_runtime
+            .active_rate_limits()
+            .await
+            .map_err(|error| map_store_error(error, "account runtime"))?;
        let page = self
            .accounts
-            .list_accounts(query)
+            .list_accounts(query, runtime)
            .await
            .map_err(|error| map_store_error(error, "account directory"))?;
        let now = Utc::now();
@@ -293,7 +312,7 @@ impl AccountsService for DefaultAccountsService {
        let mut quotas = futures::future::join_all(page.items.iter().map(|item| async {
            let account = &item.account;
            let account_id = ProviderAccountId::new(account.id.clone())
-                .map_err(|_| AdminError::invalid("Invalid provider account ID"))?;
+                .map_err(|_| AdminError::invalid("Provider 账号 ID 不合法"))?;
            // 单个账号的 quota 投影失败（Provider 未注册或 quota 读取失败）不拖垮整页：
            // 该账号降级为空额度投影，其余账号与页面状态照常返回。
            let provider = match self.providers.require(&account.provider_kind) {
@@ -359,9 +378,7 @@ impl AccountsService for DefaultAccountsService {
        account_ids: Vec<ProviderAccountId>,
    ) -> Result<AccountExportBundle, AdminError> {
        if account_ids.is_empty() || account_ids.len() > 200 {
-            return Err(AdminError::invalid(
-                "Account export requires between 1 and 200 accounts",
-            ));
+            return Err(AdminError::invalid("账号导出数量必须在 1 到 200 之间"));
        }
        let exported_ids = account_ids.clone();
        let mut grouped = BTreeMap::<ProviderKind, Vec<ProviderAccountId>>::new();
@@ -376,7 +393,7 @@ impl AccountsService for DefaultAccountsService {
            let unique = ids.iter().collect::<std::collections::BTreeSet<_>>();
            unique.len() != ids.len()
        }) {
-            return Err(AdminError::invalid("Account export contains duplicate IDs"));
+            return Err(AdminError::invalid("账号导出列表包含重复 ID"));
        }
        let mut documents = Vec::with_capacity(grouped.len());
        for (provider_kind, ids) in grouped {
@@ -466,7 +483,7 @@ impl AccountsService for DefaultAccountsService {
        command: UpdateAccount,
    ) -> Result<AccountUpdateResult, AdminError> {
        let account_id = ProviderAccountId::new(command.account_id.clone())
-            .map_err(|_| AdminError::invalid("Invalid provider account ID"))?;
+            .map_err(|_| AdminError::invalid("Provider 账号 ID 不合法"))?;
        let (_, provider) = self.provider_for_account(&account_id).await?;
        let enabled = command.enabled;
        let result = self
@@ -494,7 +511,7 @@ impl AccountsService for DefaultAccountsService {
            .iter()
            .map(|id| {
                ProviderAccountId::new(id.clone())
-                    .map_err(|_| AdminError::invalid("Invalid provider account ID"))
+                    .map_err(|_| AdminError::invalid("Provider 账号 ID 不合法"))
            })
            .collect::<Result<Vec<_>, _>>()?;
        let mut providers = BTreeMap::<
@@ -538,6 +555,17 @@ impl AccountsService for DefaultAccountsService {
        self.load_directory_item(account_id, refresh).await
    }

+    async fn profile_statistics(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileStatistics, AdminError> {
+        let (_, provider) = self.provider_for_account(account_id).await?;
+        provider
+            .profile_statistics(account_id)
+            .await
+            .map_err(|error| map_provider_error(error, "provider profile statistics"))
+    }
+
    async fn reset_credits(
        &self,
        context: &MutationContext,
@@ -654,6 +682,9 @@ impl AccountsService for DefaultAccountsService {
                        .map(|response| String::from_utf8_lossy(response.body()).into_owned());
                    let message = error.client_message().to_owned();
                    vec![AccountConnectionTestEvent::Failed {
+                        source: error.source(),
+                        gateway_error_code: error.kind(),
+                        send_state: error.send_state(),
                        message,
                        provider_error_code: error.client_error_code().map(ToOwned::to_owned),
                        provider_error_type: error.client_error_type().map(ToOwned::to_owned),
@@ -673,11 +704,7 @@ fn map_reset_credits_error_after_refresh(
    error: crate::ports::provider::ProviderAdminError,
 ) -> AdminError {
    if error.kind() == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired {
-        return AdminError::bad_gateway(
-            error
-                .message()
-                .unwrap_or("OpenAI reset-credit upstream rejected the refreshed credential"),
-        );
+        return AdminError::bad_gateway("上游服务拒绝了刷新后的凭据");
    }
    map_provider_error(error, "provider reset credits")
 }
@@ -199,12 +199,12 @@ fn hash_admin_password(password: &str) -> Result<String, AdminError> {
    Argon2::default()
        .hash_password(password.as_bytes(), &salt)
        .map(|hash| hash.to_string())
-        .map_err(|_| AdminError::internal("Failed to hash administrator password"))
+        .map_err(|_| AdminError::internal("管理员密码哈希失败"))
 }

 fn verify_admin_password(password: &str, encoded: &str) -> Result<bool, AdminError> {
    let hash = PasswordHash::new(encoded)
-        .map_err(|_| AdminError::internal("Stored administrator password hash is invalid"))?;
+        .map_err(|_| AdminError::internal("已保存的管理员密码哈希不合法"))?;
    Ok(Argon2::default()
        .verify_password(password.as_bytes(), &hash)
        .is_ok())
@@ -429,9 +429,7 @@ fn map_backup_error(error: BackupError) -> AdminError {
        code::ACTIVE_TASK_CONFLICT | code::STATE_CONFLICT | code::STORAGE_IDENTITY_LOCKED => {
            AdminError::conflict(error.message().to_owned())
        }
-        code::STORE_UNAVAILABLE => {
-            AdminError::new(AdminErrorKind::Unavailable, error.message().to_owned())
-        }
-        _ => AdminError::bad_gateway(error.message().to_owned()),
+        code::STORE_UNAVAILABLE => AdminError::new(AdminErrorKind::Unavailable, "备份服务暂不可用"),
+        _ => AdminError::bad_gateway("备份服务请求失败"),
    }
 }
@@ -77,7 +77,7 @@ impl ClientKeyService for DefaultClientKeyService {
            .reveal_client_key(id)
            .await
            .map_err(|error| map_store_error(error, "client API key"))?
-            .ok_or_else(|| AdminError::not_found("Client API key was not found"))
+            .ok_or_else(|| AdminError::not_found("Client API Key 不存在"))
    }

    async fn create(
@@ -86,7 +86,7 @@ impl ClientKeyService for DefaultClientKeyService {
        command: CreateClientKey,
    ) -> Result<CreatedClientKey, AdminError> {
        let id = ClientApiKeyId::new(format!("key_{}", Uuid::now_v7().simple()))
-            .map_err(|_| AdminError::internal("Failed to create Client API key ID"))?;
+            .map_err(|_| AdminError::internal("创建 Client API Key ID 失败"))?;
        let mut bytes = [0_u8; 32];
        OsRng.fill_bytes(&mut bytes);
        let plaintext = format!("sk_{}", URL_SAFE_NO_PAD.encode(bytes));
@@ -176,7 +176,7 @@ fn validate_cursor(query: &ClientKeyListQuery) -> Result<(), AdminError> {
    };
    if cursor.sort != query.sort {
        return Err(AdminError::invalid(
-            "Client API key cursor sort does not match the query",
+            "Client API Key 游标排序与查询条件不一致",
        ));
    }
    let matches = matches!(
@@ -198,6 +198,6 @@ fn validate_cursor(query: &ClientKeyListQuery) -> Result<(), AdminError> {
    if matches {
        Ok(())
    } else {
-        Err(AdminError::invalid("Invalid Client API key cursor"))
+        Err(AdminError::invalid("Client API Key 游标不合法"))
    }
 }
@@ -42,7 +42,15 @@ fn map_store_error(error: AdminStoreError, resource: &'static str) -> AdminError
        }
        AdminStoreErrorKind::Unavailable => AdminErrorKind::Unavailable,
    };
-    AdminError::new(kind, format!("{resource} operation failed"))
+    tracing::warn!(resource, error_kind = ?error.kind(), "admin store operation failed");
+    let message = match kind {
+        AdminErrorKind::Invalid => "请求参数不合法",
+        AdminErrorKind::NotFound => "请求的资源不存在",
+        AdminErrorKind::Conflict => "当前资源状态冲突，请刷新后重试",
+        AdminErrorKind::Unavailable => "依赖服务暂不可用",
+        _ => "服务内部错误",
+    };
+    AdminError::new(kind, message)
 }

 fn map_provider_error(
@@ -56,15 +64,23 @@ fn map_provider_error(
        ProviderAdminErrorKind::Unsupported => AdminErrorKind::Invalid,
        ProviderAdminErrorKind::NotFound => AdminErrorKind::NotFound,
        ProviderAdminErrorKind::Conflict => AdminErrorKind::Conflict,
+        ProviderAdminErrorKind::Ambiguous => AdminErrorKind::UpstreamResultUnknown,
        ProviderAdminErrorKind::Unavailable => AdminErrorKind::Unavailable,
        ProviderAdminErrorKind::CredentialRefreshRequired => AdminErrorKind::Unavailable,
        ProviderAdminErrorKind::BadGateway => AdminErrorKind::BadGateway,
        ProviderAdminErrorKind::Internal => AdminErrorKind::Internal,
    };
-    let message = error
-        .message()
-        .map(ToOwned::to_owned)
-        .unwrap_or_else(|| format!("{resource} operation failed"));
+    tracing::warn!(resource, error_kind = ?error.kind(), "admin provider operation failed");
+    let message = match kind {
+        AdminErrorKind::Invalid => "Provider 请求不合法",
+        AdminErrorKind::NotFound => "Provider 资源不存在",
+        AdminErrorKind::Conflict => "Provider 资源状态冲突，请刷新后重试",
+        AdminErrorKind::BadGateway => "上游服务请求失败",
+        AdminErrorKind::UpstreamResultUnknown => "上游执行结果未知，请刷新状态后再决定是否重试",
+        AdminErrorKind::Unavailable => "Provider 服务暂不可用",
+        AdminErrorKind::Internal => "服务内部错误",
+        _ => "Provider 操作失败",
+    };
    AdminError::new(kind, message)
 }

@@ -73,7 +89,7 @@ async fn publish_committed(
    revision: crate::model::Revision,
 ) -> Result<(), AdminError> {
    let revision = ConfigRevision::new(revision.get())
-        .map_err(|_| AdminError::internal("Committed configuration revision is invalid"))?;
+        .map_err(|_| AdminError::internal("已提交的配置版本不合法"))?;
    snapshot.publish_committed(revision).await;
    Ok(())
 }
@@ -88,7 +104,7 @@ async fn required_credential(
        .credential_details(provider_kind, account_id)
        .await
        .map_err(|error| map_store_error(error, resource))?
-        .ok_or_else(|| AdminError::not_found(format!("{resource} was not found")))
+        .ok_or_else(|| AdminError::not_found("Provider 凭据不存在"))
 }

 async fn pending_authorization(
@@ -120,7 +136,7 @@ async fn pending_authorization(
 fn validate_prepared_import(
    provider_kind: &ProviderKind,
    prepared: &PreparedCredentialImport,
-    resource: &'static str,
+    _resource: &'static str,
 ) -> Result<(), AdminError> {
    if prepared.provider_kind != *provider_kind
        || prepared
@@ -128,9 +144,7 @@ fn validate_prepared_import(
            .iter()
            .any(|credential| credential.provider_kind != *provider_kind)
    {
-        return Err(AdminError::conflict(format!(
-            "{resource} prepared facts do not match the requested Provider scope"
-        )));
+        return Err(AdminError::conflict("Provider 准备结果与请求范围不一致"));
    }
    Ok(())
 }
@@ -138,15 +152,13 @@ fn validate_prepared_import(
 fn validate_prepared_rotation(
    account: &crate::model::accounts::AccountRecord,
    prepared: &PreparedCredentialRotation,
-    resource: &'static str,
+    _resource: &'static str,
 ) -> Result<(), AdminError> {
    let facts = prepared.facts();
    if facts.account_id.as_str() != account.id.as_str()
        || facts.provider_kind != account.provider_kind
    {
-        return Err(AdminError::conflict(format!(
-            "{resource} prepared facts do not match the current credential"
-        )));
+        return Err(AdminError::conflict("Provider 准备结果与当前凭据不一致"));
    }
    Ok(())
 }
@@ -160,9 +172,7 @@ async fn validate_authorization_commit(
    if prepared.pending.provider_kind() != provider_kind
        || !prepared.pending.owner_binding().matches_context(context)
    {
-        let validation_error = AdminError::conflict(format!(
-            "{resource} pending authorization binding is invalid"
-        ));
+        let validation_error = AdminError::conflict("OAuth 授权绑定已失效，请重新发起授权");
        if let Err(error) = prepared.abort().await {
            tracing::warn!(
                resource,
@@ -188,9 +198,7 @@ async fn validate_authorization_commit(
        _ => false,
    };
    if !matches_target {
-        let validation_error = AdminError::conflict(format!(
-            "{resource} prepared credential does not match its pending target"
-        ));
+        let validation_error = AdminError::conflict("OAuth 凭据与待提交目标不一致");
        if let Err(error) = prepared.abort().await {
            tracing::warn!(
                resource,
@@ -1,8 +1,10 @@
 //! 观测查询、趋势、费用覆盖与健康阈值规则。

 use std::{
-    collections::{BTreeMap, btree_map::Entry},
+    collections::{BTreeMap, HashMap, btree_map::Entry},
+    str::FromStr,
    sync::Arc,
+    time::{Duration as StdDuration, Instant},
 };

 use async_trait::async_trait;
@@ -38,6 +40,58 @@ const HEALTH_TIMELINE_SLOTS: i64 = 24 * 4;
 const HEALTH_TIMELINE_MIN_SAMPLE_SIZE: u64 = 10;
 const HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD: u64 = 3;
 const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 99.0;
+const DASHBOARD_QUERY_BUCKET_SECONDS: i64 = 2;
+const DASHBOARD_QUERY_CACHE_RETENTION: StdDuration = StdDuration::from_secs(2);
+
+#[derive(Clone, Copy, PartialEq, Eq, Hash)]
+struct DashboardQueryKey {
+    start: DateTime<Utc>,
+    end_bucket: i64,
+}
+
+impl DashboardQueryKey {
+    fn new(range: TimeRange) -> Self {
+        Self {
+            start: range.start,
+            end_bucket: range
+                .end
+                .timestamp()
+                .div_euclid(DASHBOARD_QUERY_BUCKET_SECONDS),
+        }
+    }
+}
+
+struct DashboardQueryEntry {
+    created_at: Instant,
+    result: Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>>,
+}
+
+#[derive(Default)]
+struct DashboardQueryCache {
+    entries: tokio::sync::Mutex<HashMap<DashboardQueryKey, DashboardQueryEntry>>,
+}
+
+impl DashboardQueryCache {
+    async fn result_cell(
+        &self,
+        key: DashboardQueryKey,
+    ) -> Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>> {
+        let now = Instant::now();
+        let mut entries = self.entries.lock().await;
+        entries.retain(|_, entry| {
+            now.duration_since(entry.created_at) < DASHBOARD_QUERY_CACHE_RETENTION
+        });
+        Arc::clone(
+            &entries
+                .entry(key)
+                .or_insert_with(|| DashboardQueryEntry {
+                    created_at: now,
+                    result: Arc::new(tokio::sync::OnceCell::new()),
+                })
+                .result,
+        )
+    }
+}

 /// API 消费的观测控制面服务。
 #[async_trait]
@@ -74,6 +128,7 @@ pub(crate) struct DefaultObservabilityService {
    store: Arc<dyn ObservabilityStore>,
    settings: Arc<dyn SettingsStore>,
    providers: ProviderAdminRegistry,
+    dashboard_queries: DashboardQueryCache,
 }

 impl DefaultObservabilityService {
@@ -87,16 +142,13 @@ impl DefaultObservabilityService {
            store,
            settings,
            providers,
+            dashboard_queries: DashboardQueryCache::default(),
        }
    }
-}

-#[async_trait]
-impl ObservabilityService for DefaultObservabilityService {
-    async fn dashboard_summary(
+    async fn load_dashboard_summary(
        &self,
        range: TimeRange,
-        kind: TrendKind,
    ) -> Result<DashboardResult, AdminError> {
        let observed_at = Utc::now();
        let (mut observation, settings, runtime_slots) = futures::try_join!(
@@ -105,7 +157,7 @@ impl ObservabilityService for DefaultObservabilityService {
            self.store.dashboard_runtime_slots(observed_at),
        )
        .map_err(|error| map_store_error(error, "dashboard"))?;
-        self.enrich_billing(&mut observation.recent_requests);
+        self.enrich_list_billing(&mut observation.recent_requests);
        self.enrich_dashboard_quotas(&mut observation.account_usage)
            .await;
        let today_start = china_day_start(observation.range.end);
@@ -118,11 +170,18 @@ impl ObservabilityService for DefaultObservabilityService {
            observation.totals.cached_tokens,
            observation.totals.input_tokens,
        );
-        let average_first_token_latency_ms = average(
-            observation.requests.first_token_latency_sum_ms,
-            observation.requests.first_token_latency_count,
-        );
-        let trend = trend(kind, observation.trend.clone())?;
+        let (first_token_latency_sum_ms, first_token_latency_count) = observation
+            .trend
+            .iter()
+            .fold((0_u64, 0_u64), |(sum, count), point| {
+                (
+                    sum.saturating_add(point.metrics.first_token_latency_sum_ms),
+                    count.saturating_add(point.metrics.first_token_latency_count),
+                )
+            });
+        let average_first_token_latency_ms =
+            average(first_token_latency_sum_ms, first_token_latency_count);
+        let trend = trend(TrendKind::Usage, observation.trend.clone())?;
        let health_timeline = health_timeline_at(&observation.trend, Utc::now());
        let wire_profiles = self.providers.dashboard_wire_profiles();
        let max_concurrent_per_account = u64::from(settings.max_concurrent_per_account);
@@ -160,6 +219,26 @@ impl ObservabilityService for DefaultObservabilityService {
            wire_profiles,
        })
    }
+}
+
+#[async_trait]
+impl ObservabilityService for DefaultObservabilityService {
+    async fn dashboard_summary(
+        &self,
+        range: TimeRange,
+        kind: TrendKind,
+    ) -> Result<DashboardResult, AdminError> {
+        let cell = self
+            .dashboard_queries
+            .result_cell(DashboardQueryKey::new(range))
+            .await;
+        let mut result = cell
+            .get_or_init(|| self.load_dashboard_summary(range))
+            .await
+            .clone()?;
+        result.trend = trend(kind, result.observation.trend.clone())?;
+        Ok(result)
+    }

    async fn dashboard_trend(
        &self,
@@ -180,20 +259,20 @@ impl ObservabilityService for DefaultObservabilityService {
            .list_usage_records(query)
            .await
            .map_err(|error| map_store_error(error, "usage records"))?;
-        self.enrich_billing(&mut page.items);
+        self.enrich_list_billing(&mut page.items);
        Ok(page)
    }

    async fn usage_record_detail(&self, request_id: &str) -> Result<UsageDetail, AdminError> {
        if request_id.trim().is_empty() {
-            return Err(AdminError::invalid("Usage record ID is required"));
+            return Err(AdminError::invalid("用量记录 ID 不能为空"));
        }
        let mut detail = self
            .store
            .usage_record_detail(request_id)
            .await
            .map_err(|error| map_store_error(error, "usage record"))?;
-        self.enrich_billing(std::slice::from_mut(&mut detail.request));
+        self.enrich_detail_billing(std::slice::from_mut(&mut detail.request));
        Ok(detail)
    }

@@ -246,26 +325,50 @@ impl ObservabilityService for DefaultObservabilityService {
        let total_requests = items.iter().fold(0_u64, |total, item| {
            total.saturating_add(item.request_count)
        });
-        Ok(DiagnosticsResult {
-            dimension,
-            items: items
-                .into_iter()
-                .map(|item| DiagnosticsItem {
+        let mut items = items
+            .into_iter()
+            .map(|item| {
+                let error_rate = rate_or_zero(item.failure_count, item.request_count);
+                let non_completion_rate =
+                    rate_or_zero(item.non_completion_count, item.request_count);
+                let retry_rate = rate_or_zero(item.retry_count, item.request_count);
+                let impact_score = diagnostic_impact_score(
+                    item.request_count,
+                    total_requests,
+                    error_rate,
+                    non_completion_rate,
+                    retry_rate,
+                    item.first_token_p95_ms,
+                );
+                DiagnosticsItem {
                    key: item.key,
                    name: item.name,
                    request_count: item.request_count,
-                    success_count: item.request_count.saturating_sub(item.failure_count),
+                    success_count: item.success_count,
                    error_count: item.failure_count,
-                    error_rate: rate_or_zero(item.failure_count, item.request_count),
+                    error_rate,
                    request_share: rate_or_zero(item.request_count, total_requests),
                    average_latency_ms: item.average_latency_ms,
                    latency_p95_ms: item.latency_p95_ms,
+                    first_token_p95_ms: item.first_token_p95_ms,
+                    non_completion_count: item.non_completion_count,
+                    non_completion_rate,
+                    retry_count: item.retry_count,
+                    retry_rate,
+                    impact_score,
                    estimated_cost: usd_cost(&item.costs),
                    attempt_count: item.attempt_count,
                    total_tokens: item.total_tokens,
-                })
-                .collect(),
-        })
+                }
+            })
+            .collect::<Vec<_>>();
+        items.sort_by(|left, right| {
+            right
+                .impact_score
+                .total_cmp(&left.impact_score)
+                .then_with(|| right.request_count.cmp(&left.request_count))
+        });
+        Ok(DiagnosticsResult { dimension, items })
    }

    async fn ops_errors(&self, query: OpsErrorQuery) -> Result<OpsErrorPage, AdminError> {
@@ -279,35 +382,40 @@ impl ObservabilityService for DefaultObservabilityService {
 fn build_usage_insights(
    overview: UsageOverview,
    trend: Vec<RequestMetricPoint>,
-    standard_costs: UsageStandardCosts,
+    standard_costs: UsageCostScenarios,
 ) -> Result<UsageInsights, AdminError> {
    let granularity = trend.first().map_or(
        crate::model::observability::Granularity::FifteenMinutes,
        |point| point.granularity,
    );
    if trend.iter().any(|point| point.granularity != granularity) {
-        return Err(AdminError::internal(
-            "Usage insight trend contains mixed granularities",
-        ));
+        return Err(AdminError::internal("用量洞察趋势包含不一致的时间粒度"));
    }

    let requests = &overview.requests;
    let failed_requests = service_failure_count(requests);
    let health_requests = requests.success_count.saturating_add(failed_requests);
    let health = UsageInsightsHealth {
-        total_requests: health_requests,
+        total_requests: requests.request_count,
        success_requests: requests.success_count,
        failed_requests,
        cancelled_requests: requests.cancelled_count,
        incomplete_requests: requests.incomplete_count,
        caller_error_requests: requests.caller_error_count,
        success_rate: rate_or_zero(requests.success_count, health_requests),
+        completion_rate: rate_or_zero(
+            requests
+                .success_count
+                .saturating_add(requests.failure_count),
+            requests.request_count,
+        ),
        points: trend
            .iter()
            .map(|point| {
                let failed_requests = service_failure_count(&point.metrics);
                let health_requests = point.metrics.success_count.saturating_add(failed_requests);
                UsageInsightsHealthPoint {
+                    total_requests: point.metrics.request_count,
                    bucket_start: point.bucket_start,
                    success_requests: point.metrics.success_count,
                    failed_requests,
@@ -327,27 +435,74 @@ fn build_usage_insights(
            requests.first_token_latency_count,
            requests.request_count,
        ),
+        admission_decision_percentiles: requests.admission_decision_percentiles,
+        account_selection_wait_percentiles: requests.account_selection_wait_percentiles,
+        admission_decision_coverage: rate_or_zero(
+            requests.admission_decision_count,
+            requests.request_count,
+        ),
+        account_selection_wait_coverage: rate_or_zero(
+            requests.account_selection_wait_count,
+            requests.request_count,
+        ),
+        output_throughput_p10: requests.output_throughput_p10,
+        output_throughput_p50: requests.output_throughput_p50,
+        output_throughput_p90: requests.output_throughput_p90,
+        capacity_utilization_avg_basis_points: requests.capacity_utilization_avg_basis_points,
+        capacity_utilization_p95_basis_points: requests.capacity_utilization_p95_basis_points,
+        capacity_coverage: rate_or_zero(requests.capacity_sample_count, requests.request_count),
        points: trend
            .iter()
            .map(|point| UsageInsightsPerformancePoint {
                bucket_start: point.bucket_start,
                latency_percentiles: point.metrics.latency_percentiles,
                first_token_latency_percentiles: point.metrics.first_token_latency_percentiles,
+                admission_decision_percentiles: point.metrics.admission_decision_percentiles,
+                account_selection_wait_percentiles: point
+                    .metrics
+                    .account_selection_wait_percentiles,
+                output_throughput_p10: point.metrics.output_throughput_p10,
+                output_throughput_p50: point.metrics.output_throughput_p50,
+                output_throughput_p90: point.metrics.output_throughput_p90,
+                capacity_utilization_avg_basis_points: point
+                    .metrics
+                    .capacity_utilization_avg_basis_points,
+                capacity_utilization_p95_basis_points: point
+                    .metrics
+                    .capacity_utilization_p95_basis_points,
            })
            .collect(),
    };
    let estimated_cost = usd_cost(&overview.attempts.costs);
-    let UsageStandardCosts {
-        total: standard_cost,
-        by_bucket: standard_costs_by_bucket,
+    let UsageCostScenarios {
+        standard:
+            ScenarioCosts {
+                total: standard_cost,
+                by_bucket: standard_costs_by_bucket,
+            },
+        no_cache:
+            ScenarioCosts {
+                total: no_cache_cost,
+                by_bucket: no_cache_costs_by_bucket,
+            },
    } = standard_costs;
+    let cache_savings = amount_difference(no_cache_cost.as_ref(), estimated_cost.as_ref());
+    let tier_premium = amount_difference(estimated_cost.as_ref(), standard_cost.as_ref());
+    let cost_per_request = estimated_cost
+        .as_ref()
+        .and_then(|cost| cost.checked_div_u64(requests.request_count));
+    let cost_per_successful_request = estimated_cost
+        .as_ref()
+        .and_then(|cost| cost.checked_div_u64(requests.success_count));
    let cost = UsageInsightsCost {
-        cost_per_request: estimated_cost
-            .as_ref()
-            .and_then(|cost| cost.checked_div_u64(requests.request_count)),
+        cost_per_request,
        estimated_cost,
        standard_cost,
+        no_cache_cost,
+        cache_savings,
+        tier_premium,
        tokens_per_request: rate_or_zero(requests.total_tokens, requests.request_count),
+        cost_per_successful_request,
        cached_token_rate: rate_or_zero(requests.cached_tokens, requests.input_tokens),
        cache_hit_request_rate: ratio(
            requests.cache_hit_request_count,
@@ -367,6 +522,11 @@ fn build_usage_insights(
                total_tokens: point.metrics.total_tokens,
                estimated_cost: usd_cost(&point.costs),
                standard_cost: standard_costs_by_bucket.get(&point.bucket_start).cloned(),
+                no_cache_cost: no_cache_costs_by_bucket.get(&point.bucket_start).cloned(),
+                cache_savings: amount_difference(
+                    no_cache_costs_by_bucket.get(&point.bucket_start),
+                    usd_cost(&point.costs).as_ref(),
+                ),
                cached_token_rate: rate_or_zero(
                    point.metrics.cached_tokens,
                    point.metrics.input_tokens,
@@ -391,12 +551,12 @@ fn build_usage_insights(
 }

 #[derive(Debug, Default)]
-struct UsageStandardCosts {
+struct ScenarioCosts {
    total: Option<DecimalAmount>,
    by_bucket: BTreeMap<DateTime<Utc>, DecimalAmount>,
 }

-impl UsageStandardCosts {
+impl ScenarioCosts {
    fn add(
        &mut self,
        bucket_start: DateTime<Utc>,
@@ -405,14 +565,15 @@ impl UsageStandardCosts {
        self.total = Some(match self.total.take() {
            Some(current) => current
                .checked_add(&amount)
-                .ok_or_else(|| AdminError::internal("Usage standard cost exceeds decimal range"))?,
+                .ok_or_else(|| AdminError::internal("用量标准成本超出数值范围"))?,
            None => amount.clone(),
        });
        match self.by_bucket.entry(bucket_start) {
            Entry::Occupied(mut entry) => {
-                let sum = entry.get().checked_add(&amount).ok_or_else(|| {
-                    AdminError::internal("Usage standard cost exceeds decimal range")
-                })?;
+                let sum = entry
+                    .get()
+                    .checked_add(&amount)
+                    .ok_or_else(|| AdminError::internal("用量标准成本超出数值范围"))?;
                entry.insert(sum);
            }
            Entry::Vacant(entry) => {
@@ -423,23 +584,29 @@ impl UsageStandardCosts {
    }
 }

+#[derive(Debug, Default)]
+struct UsageCostScenarios {
+    standard: ScenarioCosts,
+    no_cache: ScenarioCosts,
+}
+
 fn recover_standard_costs(
    providers: &ProviderAdminRegistry,
    facts: Vec<UsageCalculatedBillingFact>,
-) -> Result<UsageStandardCosts, AdminError> {
-    let mut standard_costs = UsageStandardCosts::default();
+) -> Result<UsageCostScenarios, AdminError> {
+    let mut scenarios = UsageCostScenarios::default();
    for fact in facts {
-        let Ok(provider_kind) = ProviderKind::new(fact.provider_kind) else {
+        let Ok(provider_kind) = ProviderKind::new(fact.provider_kind.clone()) else {
            continue;
        };
        let input = ProviderBillingInput {
-            upstream_model_id: fact.upstream_model_id,
-            service_tier: fact.service_tier,
+            upstream_model_id: fact.upstream_model_id.clone(),
+            service_tier: fact.service_tier.clone(),
            input_tokens: fact.input_tokens,
            output_tokens: fact.output_tokens,
            cached_tokens: fact.cached_tokens,
            cache_write_tokens: fact.cache_write_tokens,
-            total: fact.total,
+            total: fact.total.clone(),
        };
        let breakdown = match providers.calculated_billing(&provider_kind, &input) {
            Ok(breakdown) => breakdown,
@@ -456,9 +623,80 @@ fn recover_standard_costs(
        {
            continue;
        }
-        standard_costs.add(fact.bucket_start, breakdown.standard_amount.amount)?;
+        scenarios
+            .standard
+            .add(fact.bucket_start, breakdown.standard_amount.amount.clone())?;
+        if let Some(no_cache_cost) = no_cache_cost(&fact, &breakdown) {
+            scenarios.no_cache.add(fact.bucket_start, no_cache_cost)?;
+        }
    }
-    Ok(standard_costs)
+    Ok(scenarios)
+}
+
+fn no_cache_cost(
+    fact: &UsageCalculatedBillingFact,
+    breakdown: &crate::model::observability::CalculatedBillingBreakdown,
+) -> Option<DecimalAmount> {
+    let input_tokens = fact.input_tokens?;
+    let cached_tokens = fact.cached_tokens.unwrap_or_default().min(input_tokens);
+    let cache_write_tokens = fact
+        .cache_write_tokens
+        .unwrap_or_default()
+        .min(input_tokens.saturating_sub(cached_tokens));
+    let input_rate = decimal(&breakdown.input_price_per_million.amount)?;
+    let replaced_input_amount = input_rate
+        .scaled()
+        .checked_mul(u128::from(cached_tokens.saturating_add(cache_write_tokens)))?
+        .checked_div(1_000_000)?;
+    let total = decimal(&breakdown.total_amount.amount)?
+        .scaled()
+        .checked_sub(decimal(&breakdown.cache_read_amount.amount)?.scaled())?
+        .checked_sub(decimal(&breakdown.cache_write_amount.amount)?.scaled())?
+        .checked_add(replaced_input_amount)?;
+    DecimalAmount::from_str(
+        &gateway_core::accounting::Decimal::from_scaled(total)
+            .ok()?
+            .canonical(),
+    )
+    .ok()
+}
+
+fn amount_difference(
+    larger: Option<&DecimalAmount>,
+    smaller: Option<&DecimalAmount>,
+) -> Option<DecimalAmount> {
+    let difference = decimal(larger?)?
+        .scaled()
+        .checked_sub(decimal(smaller?)?.scaled())?;
+    DecimalAmount::from_str(
+        &gateway_core::accounting::Decimal::from_scaled(difference)
+            .ok()?
+            .canonical(),
+    )
+    .ok()
+}
+
+fn decimal(value: &DecimalAmount) -> Option<gateway_core::accounting::Decimal> {
+    value.as_str().parse().ok()
+}
+
+fn diagnostic_impact_score(
+    request_count: u64,
+    total_requests: u64,
+    error_rate: f64,
+    non_completion_rate: f64,
+    retry_rate: f64,
+    first_token_p95_ms: Option<u64>,
+) -> f64 {
+    let request_share = rate_or_zero(request_count, total_requests);
+    let slow_score = first_token_p95_ms
+        .map_or(0.0, |value| value as f64 / 30_000.0)
+        .min(1.0);
+    error_rate * 0.35
+        + non_completion_rate * 0.25
+        + retry_rate.min(1.0) * 0.20
+        + request_share * 0.10
+        + slow_score * 0.10
 }

 fn usd_cost(costs: &[CurrencyCost]) -> Option<DecimalAmount> {
@@ -499,7 +737,39 @@ impl DefaultObservabilityService {

    /// 逐条尽力把可校验的总额升级为完整分解；单条脏数据（非法 Provider kind、
    /// 不支持的来源或费用规则失败）只保留该条已存的总额，不影响整页返回。
-    fn enrich_billing(&self, records: &mut [crate::model::observability::UsageRecord]) {
+    fn enrich_list_billing(&self, records: &mut [crate::model::observability::UsageListRecord]) {
+        for record in records {
+            let Some(UsageBilling::Total { source, total }) = record.billing.as_ref() else {
+                continue;
+            };
+            if !matches!(source.as_str(), "calculated" | "provider_reported") {
+                continue;
+            }
+            let (Some(provider), Some(upstream_model_id)) = (
+                record.provider_kind.as_deref(),
+                record.upstream_model_id.as_ref(),
+            ) else {
+                continue;
+            };
+            let Ok(provider_kind) = ProviderKind::new(provider.to_owned()) else {
+                continue;
+            };
+            let input = ProviderBillingInput {
+                upstream_model_id: upstream_model_id.clone(),
+                service_tier: record.service_tier.clone(),
+                input_tokens: record.input_tokens,
+                output_tokens: record.output_tokens,
+                cached_tokens: record.cached_tokens,
+                cache_write_tokens: record.cache_write_tokens,
+                total: total.clone(),
+            };
+            if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
+                record.billing = Some(UsageBilling::Calculated(Box::new(breakdown)));
+            }
+        }
+    }
+
+    fn enrich_detail_billing(&self, records: &mut [crate::model::observability::UsageRecord]) {
        for record in records {
            let Some(UsageBilling::Total { source, total }) = record.billing.as_ref() else {
                continue;
@@ -612,9 +882,9 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
            .saturating_add(point.cost_coverage.not_billable_count);
        for cost in &point.costs {
            if let Some(amount) = costs.get_mut(&cost.currency) {
-                *amount = amount.checked_add(&cost.amount).ok_or_else(|| {
-                    AdminError::internal("Cost aggregation exceeded numeric bounds")
-                })?;
+                *amount = amount
+                    .checked_add(&cost.amount)
+                    .ok_or_else(|| AdminError::internal("成本聚合结果超出数值范围"))?;
            } else {
                costs.insert(cost.currency.clone(), cost.amount.clone());
            }
@@ -630,6 +900,20 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
        metrics.cache_hit_request_count,
        metrics.cache_eligible_request_count,
    );
+    let peak_first_token_p95_ms = points
+        .iter()
+        .filter_map(|point| point.metrics.first_token_latency_percentiles.p95_ms)
+        .map(|value| value.as_f64())
+        .reduce(f64::max);
+    let peak_latency_p95_ms = points
+        .iter()
+        .filter_map(|point| point.metrics.latency_percentiles.p95_ms)
+        .map(|value| value.as_f64())
+        .reduce(f64::max);
+    let minimum_output_throughput_p50 = points
+        .iter()
+        .filter_map(|point| point.metrics.output_throughput_p50)
+        .min();
    Ok(Trend {
        kind,
        points: points.into_iter().map(trend_point).collect(),
@@ -643,6 +927,9 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
            average_latency_ms,
            max_latency_ms: metrics.max_latency_ms,
            min_latency_ms: metrics.min_latency_ms,
+            peak_first_token_p95_ms,
+            peak_latency_p95_ms,
+            minimum_output_throughput_p50,
            success_rate,
            cache_hit_request_rate,
            costs: costs
@@ -123,6 +123,6 @@ fn validate_settings(command: &ReplaceRuntimeSettings) -> Result<(), AdminError>
    if valid {
        Ok(())
    } else {
-        Err(AdminError::invalid("Runtime settings violate constraints"))
+        Err(AdminError::invalid("运行时设置不满足约束"))
    }
 }
@@ -94,5 +94,12 @@ fn map_system_error(error: SystemOperationError) -> AdminError {
        SystemOperationErrorKind::Upstream => AdminErrorKind::BadGateway,
        SystemOperationErrorKind::Internal => AdminErrorKind::Internal,
    };
-    AdminError::new(kind, error.message())
+    let message = match kind {
+        AdminErrorKind::Invalid => "系统操作请求不合法",
+        AdminErrorKind::Conflict => "系统当前状态不允许执行该操作",
+        AdminErrorKind::BadGateway => "系统更新服务请求失败",
+        AdminErrorKind::Internal => "系统操作失败",
+        _ => "系统操作失败",
+    };
+    AdminError::new(kind, message)
 }
@@ -0,0 +1,236 @@
+use std::{
+    collections::BTreeMap,
+    str::FromStr as _,
+    sync::{Arc, Mutex},
+};
+
+use async_trait::async_trait;
+use chrono::{Duration, Utc};
+use gateway_admin::{
+    model::{
+        MutationContext, PageSize, Revision,
+        account_groups::{
+            AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupColor,
+            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
+            AccountGroupRecord, AccountGroupUsage, DeleteAccountGroup, NewAccountGroup,
+            SetAccountGroupEnabled, UpdateAccountGroup,
+        },
+        accounts::AccountRuntimeSnapshot,
+        observability::DecimalAmount,
+    },
+    ports::store::{
+        AccountGroupStore, AccountRuntimeStore, AdminStoreError, AdminStoreErrorKind,
+        AdminStoreResult,
+    },
+};
+use gateway_core::{
+    engine::credential::{AccountStatusFacts, CredentialState, QuotaState},
+    routing::AccountGroupId,
+};
+
+use super::AdminHarness;
+
+const GROUP_ID: &str = "grp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+
+#[tokio::test]
+async fn group_query_service_enriches_only_current_page_members_with_runtime_facts() {
+    let groups = Arc::new(FakeGroupStore::default());
+    let runtime = Arc::new(FakeRuntimeStore::default());
+    let service = AdminHarness::new()
+        .account_groups(groups.clone())
+        .account_runtime(runtime.clone())
+        .build()
+        .await;
+
+    let page = service
+        .account_groups()
+        .list(AccountGroupListQuery {
+            page: 1,
+            page_size: PageSize::new(20).expect("page size"),
+            search: None,
+            enabled: None,
+        })
+        .await
+        .expect("list projected account groups");
+
+    assert_eq!(
+        groups
+            .requested_groups
+            .lock()
+            .expect("requested groups")
+            .as_slice(),
+        [GROUP_ID]
+    );
+    assert_eq!(
+        runtime
+            .requested_accounts
+            .lock()
+            .expect("requested accounts")
+            .as_slice(),
+        ["acct_available", "acct_limited"]
+    );
+    let group = &page.items[0];
+    assert_eq!(
+        group.account_summary,
+        AccountGroupAccountSummary {
+            available: 1,
+            limited: 1,
+            total: 2,
+        }
+    );
+    assert_eq!(
+        group.capacity,
+        AccountGroupCapacity {
+            used_slots: Some(2),
+            total_slots: 4,
+        }
+    );
+}
+
+#[derive(Default)]
+struct FakeGroupStore {
+    requested_groups: Mutex<Vec<String>>,
+}
+
+#[async_trait]
+impl AccountGroupStore for FakeGroupStore {
+    async fn list_account_groups(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> AdminStoreResult<AccountGroupPage> {
+        Ok(AccountGroupPage {
+            config_revision: Revision::new(1).expect("revision"),
+            items: vec![group_record()],
+            total: 1,
+            page: query.page,
+            page_size: query.page_size.get(),
+        })
+    }
+
+    async fn load_account_group_members(
+        &self,
+        group_ids: &[AccountGroupId],
+    ) -> AdminStoreResult<Vec<AccountGroupMemberFact>> {
+        *self.requested_groups.lock().expect("requested groups") = group_ids
+            .iter()
+            .map(|group_id| group_id.as_str().to_owned())
+            .collect();
+        Ok(vec![member("acct_available", 4), member("acct_limited", 3)])
+    }
+
+    async fn create_account_group(
+        &self,
+        _: NewAccountGroup,
+        _: &MutationContext,
+    ) -> AdminStoreResult<AccountGroupMutation> {
+        Err(unused())
+    }
+
+    async fn update_account_group(
+        &self,
+        _: UpdateAccountGroup,
+        _: &MutationContext,
+    ) -> AdminStoreResult<AccountGroupMutation> {
+        Err(unused())
+    }
+
+    async fn set_account_group_enabled(
+        &self,
+        _: SetAccountGroupEnabled,
+        _: &MutationContext,
+    ) -> AdminStoreResult<AccountGroupMutation> {
+        Err(unused())
+    }
+
+    async fn delete_account_group(
+        &self,
+        _: DeleteAccountGroup,
+        _: &MutationContext,
+    ) -> AdminStoreResult<AccountGroupMutation> {
+        Err(unused())
+    }
+}
+
+#[derive(Default)]
+struct FakeRuntimeStore {
+    requested_accounts: Mutex<Vec<String>>,
+}
+
+#[async_trait]
+impl AccountRuntimeStore for FakeRuntimeStore {
+    async fn active_rate_limits(&self) -> AdminStoreResult<AccountRuntimeSnapshot> {
+        Ok(AccountRuntimeSnapshot::default())
+    }
+
+    async fn account_runtime(
+        &self,
+        account_ids: &[String],
+    ) -> AdminStoreResult<AccountRuntimeSnapshot> {
+        *self.requested_accounts.lock().expect("requested accounts") = account_ids.to_vec();
+        Ok(AccountRuntimeSnapshot {
+            rate_limited_until: BTreeMap::from([(
+                "acct_limited".to_owned(),
+                Utc::now() + Duration::minutes(5),
+            )]),
+            in_flight: Some(BTreeMap::from([("acct_available".to_owned(), 2)])),
+        })
+    }
+}
+
+fn group_record() -> AccountGroupRecord {
+    let now = Utc::now();
+    AccountGroupRecord {
+        id: group_id(),
+        name: "Primary".to_owned(),
+        description: None,
+        color: AccountGroupColor::parse("#2563EBFF").expect("color"),
+        enabled: true,
+        member_count: 2,
+        provider_counts: BTreeMap::from([("openai".to_owned(), 2)]),
+        client_key_count: 1,
+        account_summary: AccountGroupAccountSummary {
+            available: 0,
+            limited: 0,
+            total: 0,
+        },
+        capacity: AccountGroupCapacity {
+            used_slots: None,
+            total_slots: 0,
+        },
+        usage: AccountGroupUsage {
+            today_usd: DecimalAmount::from_str("1").expect("today usage"),
+            retained_total_usd: DecimalAmount::from_str("3").expect("retained usage"),
+        },
+        created_at: now,
+        updated_at: now,
+    }
+}
+
+fn member(account_id: &str, total_slots: u64) -> AccountGroupMemberFact {
+    AccountGroupMemberFact {
+        group_id: group_id(),
+        account_id: account_id.to_owned(),
+        status: AccountStatusFacts {
+            enabled: true,
+            credential_state: CredentialState::Ready,
+            access_token_expires_at: None,
+            quota: QuotaState::default(),
+            rate_limited_until: None,
+            last_error_reason: None,
+            last_error_message: None,
+        },
+        total_slots,
+    }
+}
+
+fn group_id() -> AccountGroupId {
+    AccountGroupId::new(GROUP_ID).expect("group ID")
+}
+
+fn unused() -> AdminStoreError {
+    AdminStoreError::new(
+        AdminStoreErrorKind::Unavailable,
+        "account group",
+        "unused test operation",
+    )
+}
@@ -5,11 +5,15 @@ use chrono::{TimeDelta, Utc};
 use futures::{StreamExt as _, future::BoxFuture};
 use gateway_core::{
    engine::{
+        UpstreamSendState,
        credential::{
            AccountStatusFacts, CredentialState, OpaqueProviderData, ProviderAccountId,
            QuotaEvidence, QuotaState, resolve_account_status,
        },
-        probe::{AccountProbe, AccountProbeError, AccountProbeRequest, AccountProbeResult},
+        probe::{
+            AccountProbe, AccountProbeError, AccountProbeErrorSource, AccountProbeRequest,
+            AccountProbeResult,
+        },
    },
    error::{ClientVisibleUpstreamError, GatewayError, GatewayErrorKind},
    operation::{GenerateRequest, Operation, ProtocolPayload},
@@ -22,8 +26,8 @@ use gateway_admin::{
        AdminError, MutationContext, Revision,
        accounts::{
            AccountConnectionTestEvent, AccountListQuery, AccountPage, AccountPageItem,
-            AccountRecord, AccountSummary, AccountUpdateResult, AccountUsage,
-            AccountUsageWindowQuery, AccountUsageWindowResult, AccountsUpdateResult,
+            AccountRecord, AccountRuntimeSnapshot, AccountSummary, AccountUpdateResult,
+            AccountUsage, AccountUsageWindowQuery, AccountUsageWindowResult, AccountsUpdateResult,
            BatchUpdateAccounts, DeleteAccounts, UpdateAccount,
        },
        observability::TimeRange,
@@ -503,7 +507,11 @@ impl FakeAccountStore {

 #[async_trait]
 impl AccountStore for FakeAccountStore {
-    async fn list_accounts(&self, _: AccountListQuery) -> AdminStoreResult<AccountPage> {
+    async fn list_accounts(
+        &self,
+        _: AccountListQuery,
+        _: AccountRuntimeSnapshot,
+    ) -> AdminStoreResult<AccountPage> {
        self.record("store.list_accounts");
        let accounts = self.accounts.lock().expect("accounts").clone();
        let total = accounts.len() as u64;
@@ -522,7 +530,11 @@ impl AccountStore for FakeAccountStore {
        })
    }

-    async fn load_account(&self, account_id: &str) -> AdminStoreResult<Option<AccountPageItem>> {
+    async fn load_account(
+        &self,
+        account_id: &str,
+        _: AccountRuntimeSnapshot,
+    ) -> AdminStoreResult<Option<AccountPageItem>> {
        self.record("store.load_account");
        // probe 后的账号状态覆盖只对同一 id 生效；其余按账号列表查询。
        let account = self
@@ -950,6 +962,9 @@ async fn connection_test_should_probe_unavailable_account() {
    assert!(matches!(
        events.last(),
        Some(AccountConnectionTestEvent::Failed {
+            source: AccountProbeErrorSource::Upstream,
+            gateway_error_code: GatewayErrorKind::RateLimited,
+            send_state: Some(UpstreamSendState::NotSent),
            message,
            provider_error_code: Some(code),
            provider_error_type: Some(error_type),
@@ -984,6 +999,9 @@ async fn connection_test_rate_limited_probe_returns_provider_failure() {
    assert!(matches!(
        events.last(),
        Some(AccountConnectionTestEvent::Failed {
+            source: AccountProbeErrorSource::Provider,
+            gateway_error_code: GatewayErrorKind::RateLimited,
+            send_state: Some(UpstreamSendState::NotSent),
            message,
            ..
        })
@@ -1722,7 +1740,37 @@ async fn reset_credit_oauth_refresh_should_reuse_the_exact_consume_command() {
 }

 #[tokio::test]
-async fn accounts_refresh_should_preserve_the_provider_failure_message() {
+async fn reset_credit_unknown_result_should_keep_a_stable_admin_kind() {
+    let events = events();
+    let provider = FakeProviderAdmin::new("openai", events.clone());
+    provider.fail_next(ProviderAdminErrorKind::Ambiguous);
+    let store = FakeAccountStore::new("openai", events);
+    let services = accounts_service(provider, store).await;
+    let command = ConsumeProviderResetCredit {
+        account_id: ProviderAccountId::new("acct_test").expect("account ID"),
+        credit_id: Some("credit_1".to_owned()),
+        redeem_request_id: uuid::Uuid::parse_str("244e790c-42a3-4ec9-a45d-a32b218bc8ac")
+            .expect("UUID v4"),
+    };
+
+    let error = services
+        .accounts()
+        .consume_reset_credit(&context("reset-credit-ambiguous"), command)
+        .await
+        .expect_err("ambiguous consume result must remain classified");
+
+    assert_eq!(
+        error.kind(),
+        gateway_admin::model::AdminErrorKind::UpstreamResultUnknown
+    );
+    assert_eq!(
+        error.to_string(),
+        "上游执行结果未知，请刷新状态后再决定是否重试"
+    );
+}
+
+#[tokio::test]
+async fn accounts_refresh_should_not_expose_the_provider_failure_message() {
    let events = events();
    let provider = FakeProviderAdmin::new("openai", events.clone());
    let upstream_message = "Your refresh token has already been used.";
@@ -1740,7 +1788,8 @@ async fn accounts_refresh_should_preserve_the_provider_failure_message() {
        .expect_err("Provider preparation must fail");

    assert_eq!(error.kind(), gateway_admin::model::AdminErrorKind::Conflict);
-    assert_eq!(error.to_string(), upstream_message);
+    assert_eq!(error.to_string(), "Provider 资源状态冲突，请刷新后重试");
+    assert!(!error.to_string().contains(upstream_message));
    assert_eq!(
        recorded(&events),
        ["store.load_account", "provider.prepare_refresh"]
@@ -1950,12 +1999,16 @@ impl AccountProbe for FailingAccountProbe {
                Some("usage_exhausted".to_owned()),
                Some("invalid_request_error".to_owned()),
            );
-            Err(GatewayError::new(
-                GatewayErrorKind::RateLimited,
-                "upstream capacity is temporarily unavailable",
-            )
-            .with_client_visible_upstream_error(detail)
-            .into())
+            Err(AccountProbeError::new(
+                GatewayError::new(
+                    GatewayErrorKind::RateLimited,
+                    "upstream capacity is temporarily unavailable",
+                )
+                .with_client_visible_upstream_error(detail),
+                AccountProbeErrorSource::Upstream,
+                Some(UpstreamSendState::NotSent),
+                None,
+            ))
        })
    }
 }
@@ -1971,11 +2024,15 @@ impl AccountProbe for FreeModelQuotaProbe {
    ) -> BoxFuture<'_, Result<AccountProbeResult, AccountProbeError>> {
        Box::pin(async move {
            self.store.set_account_after_probe(account_record("xai"));
-            Err(GatewayError::new(
-                GatewayErrorKind::RateLimited,
-                "xAI free model quota is exhausted",
-            )
-            .into())
+            Err(AccountProbeError::new(
+                GatewayError::new(
+                    GatewayErrorKind::RateLimited,
+                    "xAI free model quota is exhausted",
+                ),
+                AccountProbeErrorSource::Provider,
+                Some(UpstreamSendState::NotSent),
+                None,
+            ))
        })
    }
 }
@@ -1,3 +1,4 @@
+mod account_groups;
 mod accounts;
 mod auth;
 mod backup;
@@ -21,12 +22,12 @@ use gateway_admin::{
    model::{
        MutationContext, Revision,
        account_groups::{
-            AccountGroupListQuery, AccountGroupMutation, AccountGroupPage, DeleteAccountGroup,
-            NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
+            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
+            DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
        },
        accounts::{
-            AccountListQuery, AccountPage, AccountUpdateResult, AccountUsage,
-            AccountUsageWindowQuery, AccountUsageWindowResult, AccountsUpdateResult,
+            AccountListQuery, AccountPage, AccountRuntimeSnapshot, AccountUpdateResult,
+            AccountUsage, AccountUsageWindowQuery, AccountUsageWindowResult, AccountsUpdateResult,
            BatchUpdateAccounts, DeleteAccounts, UpdateAccount,
        },
        auth::{AdminAuditEvent, AdminSession},
@@ -56,8 +57,9 @@ use gateway_admin::{
        backup::BackupStorePorts,
        provider::{ProviderAdmin, ProviderAdminError, ProviderAdminErrorKind},
        store::{
-            AccountGroupStore, AccountStore, AdminStoreError, AdminStoreErrorKind, AdminStorePorts,
-            AdminStoreResult, AuthStore, ClientKeyStore, ObservabilityStore, SettingsStore,
+            AccountGroupStore, AccountRuntimeStore, AccountStore, AdminAccountStorePorts,
+            AdminStoreError, AdminStoreErrorKind, AdminStorePorts, AdminStoreResult, AuthStore,
+            ClientKeyStore, ObservabilityStore, SettingsStore,
        },
        system::{
            SystemOperationError, SystemOperationErrorKind, SystemOperations,
@@ -79,6 +81,8 @@ pub(super) struct AdminHarness {
    default_password: String,
    session_ttl_minutes: u64,
    accounts: Arc<dyn AccountStore>,
+    account_runtime: Arc<dyn AccountRuntimeStore>,
+    account_groups: Arc<dyn AccountGroupStore>,
    auth: Arc<dyn AuthStore>,
    client_keys: Arc<dyn ClientKeyStore>,
    observability: Arc<dyn ObservabilityStore>,
@@ -96,6 +100,8 @@ impl AdminHarness {
            default_password: "strong-test-password".to_owned(),
            session_ttl_minutes: 60,
            accounts: unavailable.clone(),
+            account_runtime: unavailable.clone(),
+            account_groups: Arc::new(UnavailableAccountGroupStore),
            auth: Arc::new(BootstrapAuthStore::default()),
            client_keys: unavailable.clone(),
            observability: unavailable.clone(),
@@ -125,6 +131,16 @@ impl AdminHarness {
        self
    }

+    pub(super) fn account_runtime(mut self, store: Arc<dyn AccountRuntimeStore>) -> Self {
+        self.account_runtime = store;
+        self
+    }
+
+    pub(super) fn account_groups(mut self, store: Arc<dyn AccountGroupStore>) -> Self {
+        self.account_groups = store;
+        self
+    }
+
    pub(super) fn auth(mut self, store: Arc<dyn AuthStore>) -> Self {
        self.auth = store;
        self
@@ -175,8 +191,11 @@ impl AdminHarness {
                default_password: InitialAdminPassword::new(self.default_password),
            },
            AdminStorePorts::new(
-                self.accounts,
-                Arc::new(UnavailableAccountGroupStore),
+                AdminAccountStorePorts::new(
+                    self.accounts,
+                    self.account_runtime,
+                    self.account_groups,
+                ),
                self.auth,
                self.client_keys,
                self.observability,
@@ -252,6 +271,13 @@ impl AccountGroupStore for UnavailableAccountGroupStore {
        Err(unavailable("account groups"))
    }

+    async fn load_account_group_members(
+        &self,
+        _: &[gateway_core::routing::AccountGroupId],
+    ) -> AdminStoreResult<Vec<AccountGroupMemberFact>> {
+        Err(unavailable("account group members"))
+    }
+
    async fn create_account_group(
        &self,
        _: NewAccountGroup,
@@ -287,13 +313,18 @@ impl AccountGroupStore for UnavailableAccountGroupStore {

 #[async_trait]
 impl AccountStore for UnavailableStore {
-    async fn list_accounts(&self, _: AccountListQuery) -> AdminStoreResult<AccountPage> {
+    async fn list_accounts(
+        &self,
+        _: AccountListQuery,
+        _: AccountRuntimeSnapshot,
+    ) -> AdminStoreResult<AccountPage> {
        Err(unavailable("accounts"))
    }

    async fn load_account(
        &self,
        _: &str,
+        _: AccountRuntimeSnapshot,
    ) -> AdminStoreResult<Option<gateway_admin::model::accounts::AccountPageItem>> {
        Err(unavailable("account"))
    }
@@ -410,6 +441,17 @@ impl AccountStore for UnavailableStore {
    }
 }

+#[async_trait]
+impl AccountRuntimeStore for UnavailableStore {
+    async fn active_rate_limits(&self) -> AdminStoreResult<AccountRuntimeSnapshot> {
+        Ok(AccountRuntimeSnapshot::default())
+    }
+
+    async fn account_runtime(&self, _: &[String]) -> AdminStoreResult<AccountRuntimeSnapshot> {
+        Ok(AccountRuntimeSnapshot::default())
+    }
+}
+
 #[async_trait]
 impl ClientKeyStore for UnavailableStore {
    async fn list_client_keys(&self, _: ClientKeyListQuery) -> AdminStoreResult<ClientKeyPage> {
@@ -1,7 +1,10 @@
 use std::{
-    num::NonZeroU32,
    str::FromStr as _,
-    sync::{Arc, Mutex},
+    sync::{
+        Arc, Mutex,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration as StdDuration,
 };

 use async_trait::async_trait;
@@ -14,10 +17,10 @@ use gateway_admin::{
        observability::{
            AccountPoolMetrics, AttemptMetrics, CostCoverage, CurrencyCost, DashboardObservation,
            DashboardRuntimeSlots, DiagnosticDimension, DiagnosticObservation, Granularity,
-            HealthStatus, OpsErrorPage, OpsErrorQuery, PageNumber, RequestMetricPoint,
-            RequestMetrics, RequestOutcome, TimeRange, TrendKind, UsageBilling,
-            UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageOverview, UsagePage,
-            UsageQuery, UsageRecord, china_day_start,
+            HealthStatus, LatencyPercentiles, OpsErrorPage, OpsErrorQuery, PercentileMilliseconds,
+            RequestMetricPoint, RequestMetrics, TimeRange, TrendKind, UsageBilling,
+            UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageListRecord, UsageOverview,
+            UsagePage, UsageQuery, china_day_start,
        },
        settings::{
            AdminApiKey, AdminApiKeyMutation, ReplaceRuntimeSettings, RotationStrategy,
@@ -105,6 +108,40 @@ async fn health_timeline_should_keep_exactly_china_day_quarter_hour_slots() {
    }));
 }

+#[tokio::test]
+async fn dashboard_summary_should_derive_first_token_average_from_trend() {
+    let now = Utc::now();
+    let current_slot = quarter_hour_start(now);
+    let store = Arc::new(FixtureObservabilityStore::new(observation_range(now)));
+    store.replace_trend(vec![
+        health_metric_point(
+            current_slot - Duration::minutes(15),
+            RequestMetrics {
+                first_token_latency_sum_ms: 120,
+                first_token_latency_count: 2,
+                ..RequestMetrics::default()
+            },
+        ),
+        health_metric_point(
+            current_slot,
+            RequestMetrics {
+                first_token_latency_sum_ms: 180,
+                first_token_latency_count: 1,
+                ..RequestMetrics::default()
+            },
+        ),
+    ]);
+    let services = observability_services(store).await;
+
+    let summary = services
+        .observability()
+        .dashboard_summary(observation_range(now), TrendKind::Usage)
+        .await
+        .expect("dashboard summary");
+
+    assert_eq!(summary.average_first_token_latency_ms, Some(100));
+}
+
 #[tokio::test]
 async fn health_timeline_should_match_legacy_status_precedence_and_thresholds() {
    let now = Utc::now();
@@ -160,11 +197,15 @@ async fn health_timeline_should_match_legacy_status_precedence_and_thresholds()
        ),
    ];

-    for (metrics, expected_status, expected_reliability) in fixtures {
+    for (index, (metrics, expected_status, expected_reliability)) in
+        fixtures.into_iter().enumerate()
+    {
        store.replace_trend(vec![health_metric_point(current_slot, metrics)]);
+        let range_end =
+            now + Duration::seconds(i64::try_from(index).expect("fixture index fits i64") * 2);
        let timeline = services
            .observability()
-            .dashboard_summary(observation_range(now), TrendKind::Usage)
+            .dashboard_summary(observation_range(range_end), TrendKind::Usage)
            .await
            .expect("dashboard summary")
            .health_timeline;
@@ -220,6 +261,53 @@ async fn dashboard_summary_should_share_one_current_observation_time_across_runt
    assert!(summary_observed_at.is_some_and(|value| value > historical_end));
 }

+#[tokio::test]
+async fn dashboard_summary_should_coalesce_concurrent_requests_in_one_short_window() {
+    let end_bucket = Utc::now().timestamp().div_euclid(2) * 2;
+    let first_end = DateTime::from_timestamp(end_bucket, 100_000_000).expect("first end");
+    let second_end = DateTime::from_timestamp(end_bucket, 900_000_000).expect("second end");
+    let first_range = TimeRange::new(china_day_start(first_end), first_end).expect("first range");
+    let second_range =
+        TimeRange::new(china_day_start(second_end), second_end).expect("second range");
+    let store = Arc::new(FixtureObservabilityStore::new(first_range));
+    store.set_dashboard_delay(StdDuration::from_millis(20));
+    let services = observability_services(store.clone()).await;
+    let observability = services.observability();
+
+    let (first, second) = tokio::join!(
+        observability.dashboard_summary(first_range, TrendKind::Usage),
+        observability.dashboard_summary(second_range, TrendKind::Errors),
+    );
+
+    first.expect("first dashboard summary");
+    second.expect("second dashboard summary");
+    assert_eq!(store.dashboard_summary_calls(), 1);
+}
+
+#[tokio::test]
+async fn dashboard_summary_should_reload_after_the_short_window_changes() {
+    let end_bucket = Utc::now().timestamp().div_euclid(2) * 2;
+    let first_end = DateTime::from_timestamp(end_bucket, 100_000_000).expect("first end");
+    let second_end = first_end + Duration::seconds(2);
+    let first_range = TimeRange::new(china_day_start(first_end), first_end).expect("first range");
+    let second_range =
+        TimeRange::new(china_day_start(second_end), second_end).expect("second range");
+    let store = Arc::new(FixtureObservabilityStore::new(first_range));
+    let services = observability_services(store.clone()).await;
+    let observability = services.observability();
+
+    observability
+        .dashboard_summary(first_range, TrendKind::Usage)
+        .await
+        .expect("first dashboard summary");
+    observability
+        .dashboard_summary(second_range, TrendKind::Usage)
+        .await
+        .expect("second dashboard summary");
+
+    assert_eq!(store.dashboard_summary_calls(), 2);
+}
+
 #[tokio::test]
 async fn observability_services_should_calculate_usage_insights_and_diagnostic_shares() {
    let now = Utc::now();
@@ -234,6 +322,24 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
        output_tokens: 200,
        total_tokens: 1_000,
        latency_count: 5,
+        admission_decision_count: 10,
+        admission_decision_percentiles: LatencyPercentiles {
+            p50_ms: Some(PercentileMilliseconds::new(2.0).expect("admission P50")),
+            p95_ms: Some(PercentileMilliseconds::new(5.0).expect("admission P95")),
+            p99_ms: Some(PercentileMilliseconds::new(8.0).expect("admission P99")),
+        },
+        account_selection_wait_count: 8,
+        account_selection_wait_percentiles: LatencyPercentiles {
+            p50_ms: Some(PercentileMilliseconds::new(10.0).expect("selection P50")),
+            p95_ms: Some(PercentileMilliseconds::new(40.0).expect("selection P95")),
+            p99_ms: Some(PercentileMilliseconds::new(70.0).expect("selection P99")),
+        },
+        output_throughput_p10: Some(40),
+        output_throughput_p50: Some(50),
+        output_throughput_p90: Some(60),
+        capacity_sample_count: 8,
+        capacity_utilization_avg_basis_points: Some(6_500),
+        capacity_utilization_p95_basis_points: Some(8_000),
        ..RequestMetrics::default()
    };
    store.replace_overview(UsageOverview {
@@ -294,10 +400,16 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
        .await
        .expect("usage diagnostics");

-    assert_eq!(insights.health.total_requests, 8);
+    assert_eq!(insights.health.total_requests, 10);
    assert_eq!(insights.health.failed_requests, 2);
+    assert_eq!(insights.health.success_rate, 0.75);
+    assert_eq!(insights.health.completion_rate, 1.0);
    assert_eq!(insights.granularity, Granularity::FifteenMinutes);
    assert_eq!(insights.performance.latency_coverage, 0.5);
+    assert_eq!(insights.performance.admission_decision_coverage, 1.0);
+    assert_eq!(insights.performance.account_selection_wait_coverage, 0.8);
+    assert_eq!(insights.performance.capacity_coverage, 0.8);
+    assert_eq!(insights.performance.output_throughput_p50, Some(50));
    assert_eq!(insights.cost.tokens_per_request, 100.0);
    assert_eq!(
        insights
@@ -337,8 +449,25 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
            .map(gateway_admin::model::observability::DecimalAmount::as_str),
        Some("1")
    );
+    assert_eq!(
+        insights
+            .cost
+            .no_cache_cost
+            .as_ref()
+            .map(gateway_admin::model::observability::DecimalAmount::as_str),
+        Some("1.25")
+    );
+    assert_eq!(
+        insights
+            .cost
+            .tier_premium
+            .as_ref()
+            .map(gateway_admin::model::observability::DecimalAmount::as_str),
+        Some("0.25")
+    );
    assert_eq!(diagnostics.items[0].request_share, 0.75);
    assert_eq!(diagnostics.items[1].request_share, 0.25);
+    assert!((diagnostics.items[0].impact_score - 0.075).abs() < 1e-9);
 }

 #[tokio::test]
@@ -416,7 +545,9 @@ struct FixtureObservabilityStore {
    runtime_slots: Mutex<Option<DashboardRuntimeSlots>>,
    summary_observed_at: Mutex<Option<DateTime<Utc>>>,
    slots_observed_at: Mutex<Option<DateTime<Utc>>>,
-    usage_records: Mutex<Vec<UsageRecord>>,
+    usage_records: Mutex<Vec<UsageListRecord>>,
+    dashboard_delay: Mutex<StdDuration>,
+    dashboard_summary_calls: AtomicUsize,
 }

 impl FixtureObservabilityStore {
@@ -435,9 +566,19 @@ impl FixtureObservabilityStore {
            summary_observed_at: Mutex::new(None),
            slots_observed_at: Mutex::new(None),
            usage_records: Mutex::new(Vec::new()),
+            dashboard_delay: Mutex::new(StdDuration::ZERO),
+            dashboard_summary_calls: AtomicUsize::new(0),
        }
    }

+    fn set_dashboard_delay(&self, delay: StdDuration) {
+        *self.dashboard_delay.lock().expect("dashboard delay") = delay;
+    }
+
+    fn dashboard_summary_calls(&self) -> usize {
+        self.dashboard_summary_calls.load(Ordering::Relaxed)
+    }
+
    fn replace_trend(&self, trend: Vec<RequestMetricPoint>) {
        *self.trend.lock().expect("trend") = trend;
    }
@@ -471,7 +612,7 @@ impl FixtureObservabilityStore {
        )
    }

-    fn replace_usage_records(&self, records: Vec<UsageRecord>) {
+    fn replace_usage_records(&self, records: Vec<UsageListRecord>) {
        *self.usage_records.lock().expect("usage records") = records;
    }
 }
@@ -483,14 +624,17 @@ impl ObservabilityStore for FixtureObservabilityStore {
        range: TimeRange,
        observed_at: DateTime<Utc>,
    ) -> AdminStoreResult<DashboardObservation> {
+        self.dashboard_summary_calls.fetch_add(1, Ordering::Relaxed);
        *self
            .summary_observed_at
            .lock()
            .expect("summary observed at") = Some(observed_at);
+        let dashboard_delay = *self.dashboard_delay.lock().expect("dashboard delay");
+        if !dashboard_delay.is_zero() {
+            tokio::time::sleep(dashboard_delay).await;
+        }
        Ok(DashboardObservation {
            range,
-            requests: RequestMetrics::default(),
-            attempts: AttemptMetrics::default(),
            totals: Default::default(),
            provider_accounts: AccountPoolMetrics::default(),
            trend: self.trend.lock().expect("trend").clone(),
@@ -536,7 +680,7 @@ impl ObservabilityStore for FixtureObservabilityStore {
        let total = u64::try_from(items.len()).unwrap_or(u64::MAX);
        Ok(UsagePage {
            items,
-            total,
+            total: Some(total),
            next_cursor: None,
        })
    }
@@ -640,8 +784,8 @@ fn usage_query(now: DateTime<Utc>) -> UsageQuery {
        range: observation_range(now),
        filter: UsageFilter::default(),
        cursor: None,
-        page: PageNumber::new(NonZeroU32::new(1).expect("page number")),
        page_size: PageSize::new(50).expect("page size"),
+        include_total: true,
    }
 }

@@ -650,16 +794,9 @@ fn total_record(
    provider_kind: Option<&str>,
    source: &str,
    now: DateTime<Utc>,
-) -> UsageRecord {
-    UsageRecord {
+) -> UsageListRecord {
+    UsageListRecord {
        id: id.to_owned(),
-        client_api_key_ref: "key_billing".to_owned(),
-        config_revision: 1,
-        routing_scope: "all".to_owned(),
-        routing_group_refs: Vec::new(),
-        routing_group_names_snapshot: Vec::new(),
-        protocol: "openai".to_owned(),
-        operation: "generate".to_owned(),
        endpoint: "/v1/responses".to_owned(),
        client_transport: "http_sse".to_owned(),
        requested_model_id: Some("gpt-5.5".to_owned()),
@@ -670,23 +807,7 @@ fn total_record(
        provider_account_authentication_kind: None,
        upstream_model_id: Some("gpt-5.5".to_owned()),
        upstream_transport: None,
-        http_version: None,
-        websocket_pool: None,
        service_tier: None,
-        provider_metadata_json: None,
-        attempt_count: 1,
-        upstream_send_state: "sent".to_owned(),
-        downstream_committed_at: None,
-        outcome: RequestOutcome::Succeeded,
-        client_status_code: Some(200),
-        upstream_status_code: Some(200),
-        client_response_id: None,
-        upstream_request_id: None,
-        upstream_response_id: None,
-        error_kind: None,
-        provider_error_code: None,
-        error_message: None,
-        retry_after_ms: None,
        input_tokens: Some(800),
        output_tokens: Some(200),
        cached_tokens: Some(0),
@@ -715,18 +836,17 @@ fn total_record(
        first_token_ms: None,
        provider_processing_ms: None,
        latency_ms: Some(100),
+        admission_decision_ms: None,
+        account_selection_wait_ms: None,
+        capacity_used_slots: None,
+        capacity_total_slots: None,
        client_ip: None,
        user_agent: None,
        reasoning_effort: None,
        reasoning_preset: None,
-        request_kind: None,
        subagent_kind: None,
        compact: false,
-        image_generation_requested: false,
-        image_generation_succeeded: None,
        started_at: now,
-        deadline_at: now,
-        completed_at: Some(now),
    }
 }

@@ -742,6 +862,9 @@ fn health_metric_point(bucket_start: DateTime<Utc>, metrics: RequestMetrics) ->

 fn diagnostic(name: &str, request_count: u64) -> DiagnosticObservation {
    DiagnosticObservation {
+        first_token_p95_ms: None,
+        non_completion_count: 0,
+        retry_count: 0,
        key: name.to_owned(),
        name: name.to_owned(),
        request_count,
@@ -24,7 +24,7 @@ secrecy = "0.10"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["arbitrary_precision", "preserve_order"] }
 thiserror = "2.0.18"
-tokio = { version = "1.52.3", default-features = false, features = ["macros", "time"] }
+tokio = { version = "1.52.3", default-features = false, features = ["macros", "rt", "sync", "time"] }
 tower-http = { version = "0.7.0", features = ["cors", "fs", "request-id", "timeout", "trace"] }
 tracing = "0.1.44"
 url = "2.5.8"
@@ -33,7 +33,7 @@ uuid = { version = "1.23.3", features = ["v7"] }
 [dev-dependencies]
 async-trait = "0.1.89"
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio"] }
-tokio = { version = "1.52.3", default-features = false, features = ["macros", "net", "rt-multi-thread"] }
+tokio = { version = "1.52.3", default-features = false, features = ["macros", "net", "rt-multi-thread", "test-util"] }
 tokio-tungstenite = "0.29.0"
 tower = { version = "0.5.3", features = ["util"] }

@@ -3,8 +3,8 @@
 use std::collections::BTreeMap;

 use axum::{
-    Json, Router,
-    extract::{Query, State},
+    Router,
+    extract::State,
    http::StatusCode,
    response::IntoResponse,
    routing::{get, post},
@@ -22,8 +22,8 @@ use gateway_core::routing::AccountGroupId;
 use serde::{Deserialize, Serialize};

 use super::{
-    AdminAuth, AdminEnvelope, AdminError, AdminResponse, AdminSessionState, PageMeta,
-    WireValidationError, wire::map_admin_service_error,
+    AdminAuth, AdminEnvelope, AdminError, AdminJson, AdminQuery, AdminResponse, AdminSessionState,
+    PageMeta, WireValidationError, wire::map_admin_service_error,
 };

 const DEFAULT_PAGE_SIZE: u32 = 50;
@@ -127,7 +127,7 @@ struct AccountGroupCapacityView {
 #[serde(rename_all = "camelCase")]
 struct AccountGroupUsageView {
    today_usd: String,
-    total_usd: String,
+    retained_total_usd: String,
 }

 impl From<AccountGroupRecord> for AccountGroupView {
@@ -168,7 +168,7 @@ fn capacity_view(capacity: AccountGroupCapacity) -> AccountGroupCapacityView {
 fn usage_view(usage: AccountGroupUsage) -> AccountGroupUsageView {
    AccountGroupUsageView {
        today_usd: usage.today_usd.to_string(),
-        total_usd: usage.total_usd.to_string(),
+        retained_total_usd: usage.retained_total_usd.to_string(),
    }
 }

@@ -235,7 +235,7 @@ where
 async fn list<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<ListAccountGroupsQuery>,
+    AdminQuery(query): AdminQuery<ListAccountGroupsQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -255,7 +255,7 @@ where
 async fn create<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<CreateAccountGroupRequest>,
+    AdminJson(request): AdminJson<CreateAccountGroupRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -281,7 +281,7 @@ where
 async fn update<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<UpdateAccountGroupRequest>,
+    AdminJson(request): AdminJson<UpdateAccountGroupRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -308,7 +308,7 @@ where
 async fn enable<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountGroupIdRequest>,
+    AdminJson(request): AdminJson<AccountGroupIdRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -319,7 +319,7 @@ where
 async fn disable<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountGroupIdRequest>,
+    AdminJson(request): AdminJson<AccountGroupIdRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -355,7 +355,7 @@ where
 async fn delete<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountGroupIdRequest>,
+    AdminJson(request): AdminJson<AccountGroupIdRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -387,12 +387,11 @@ fn mutation_response(
 }

 fn group_id(value: String) -> Result<AccountGroupId, AdminError> {
-    AccountGroupId::new(value).map_err(|_| AdminError::bad_request("Invalid account group ID"))
+    AccountGroupId::new(value).map_err(|_| AdminError::bad_request("账号组 ID 不合法"))
 }

 fn group_color(value: &str) -> Result<AccountGroupColor, AdminError> {
-    AccountGroupColor::parse(value)
-        .ok_or_else(|| AdminError::bad_request("Invalid account group color"))
+    AccountGroupColor::parse(value).ok_or_else(|| AdminError::bad_request("账号组颜色不合法"))
 }

 fn validate_group_fields(name: &str, description: Option<&str>) -> Result<(), AdminError> {
@@ -403,15 +402,15 @@ fn validate_group_fields(name: &str, description: Option<&str>) -> Result<(), Ad
        || description
            .is_some_and(|value| value.len() > 4096 || value.chars().any(char::is_control))
    {
-        return Err(AdminError::bad_request("Invalid account group request"));
+        return Err(AdminError::bad_request("账号组请求不合法"));
    }
    Ok(())
 }

 fn map_wire_error(_: WireValidationError) -> AdminError {
-    AdminError::bad_request("Invalid account group query")
+    AdminError::bad_request("账号组查询参数不合法")
 }

 fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
-    map_admin_service_error(error, "Account group repository unavailable")
+    map_admin_service_error(error)
 }
@@ -3,8 +3,8 @@
 use std::{collections::BTreeSet, convert::Infallible, fmt};

 use axum::{
-    Json, Router,
-    extract::{Query, State},
+    Router,
+    extract::State,
    http::{HeaderValue, StatusCode, header::CACHE_CONTROL},
    response::{
        IntoResponse, Response,
@@ -28,8 +28,10 @@ use gateway_admin::model::{
        AuthorizationStarted, CompleteAuthorization, ConsumeProviderResetCredit,
        CredentialDeletion, CredentialDeletionResult, CredentialImportResult, CredentialMutation,
        CredentialMutationResult, ImportCredentials, ProviderDocument, ProviderModels,
-        ProviderQuota, ProviderQuotaWindow, ProviderResetCredit, ProviderResetCreditResult,
-        ProviderResetCredits, RotateCredential, StartAuthorization,
+        ProviderProfileActivityInsights, ProviderProfileDailyUsage, ProviderProfileInvocation,
+        ProviderProfileStatistics, ProviderProfileStatisticsSummary, ProviderQuota,
+        ProviderQuotaWindow, ProviderResetCredit, ProviderResetCreditResult, ProviderResetCredits,
+        RotateCredential, StartAuthorization,
    },
 };
 use gateway_core::{
@@ -42,8 +44,8 @@ use uuid::{Uuid, Version};

 use super::presenter::{format_compact_number, format_decimal_currency, format_number};
 use super::{
-    AdminAuth, AdminEnvelope, AdminError, AdminResponse, AdminSessionState, PageMeta,
-    WireValidationError,
+    AdminAuth, AdminEnvelope, AdminError, AdminJson, AdminQuery, AdminResponse, AdminSessionState,
+    PageMeta, WireValidationError,
 };

 const DEFAULT_PAGE_SIZE: u32 = 50;
@@ -587,6 +589,125 @@ pub struct AccountQuotaData {
    pub account: AccountView,
 }

+/// Provider 官方个人资料统计响应。
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileStatisticsData {
+    pub display_name: Option<String>,
+    pub username: Option<String>,
+    pub image_url: Option<String>,
+    pub has_stats_error: bool,
+    pub summary: AccountProfileStatisticsSummaryView,
+    pub daily_usage: Option<Vec<AccountProfileDailyUsageView>>,
+    pub activity_insights: AccountProfileActivityInsightsView,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileStatisticsSummaryView {
+    pub total_text_tokens: Option<u64>,
+    pub peak_tokens: Option<u64>,
+    pub longest_task_duration_ms: Option<u64>,
+    pub current_streak_days: Option<u64>,
+    pub longest_streak_days: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileDailyUsageView {
+    pub date: String,
+    pub tokens: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileActivityInsightsView {
+    pub fast_mode_percent: Option<f64>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_effort_percent: Option<f64>,
+    pub skills_explored: Option<u64>,
+    pub total_skills_used: Option<u64>,
+    pub total_threads: Option<u64>,
+    pub invocations: Option<Vec<AccountProfileInvocationView>>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileInvocationView {
+    #[serde(rename = "type")]
+    pub invocation_type: String,
+    pub plugin_id: Option<String>,
+    pub plugin_name: Option<String>,
+    pub skill_id: Option<String>,
+    pub skill_name: Option<String>,
+    pub usage_count: Option<u64>,
+}
+
+impl From<ProviderProfileStatistics> for AccountProfileStatisticsData {
+    fn from(statistics: ProviderProfileStatistics) -> Self {
+        Self {
+            display_name: statistics.display_name,
+            username: statistics.username,
+            image_url: statistics.image_url,
+            has_stats_error: statistics.has_stats_error,
+            summary: profile_statistics_summary_view(statistics.summary),
+            daily_usage: statistics
+                .daily_usage
+                .map(|daily| daily.into_iter().map(profile_daily_usage_view).collect()),
+            activity_insights: profile_activity_insights_view(statistics.activity_insights),
+        }
+    }
+}
+
+const fn profile_statistics_summary_view(
+    summary: ProviderProfileStatisticsSummary,
+) -> AccountProfileStatisticsSummaryView {
+    AccountProfileStatisticsSummaryView {
+        total_text_tokens: summary.total_text_tokens,
+        peak_tokens: summary.peak_tokens,
+        longest_task_duration_ms: summary.longest_task_duration_ms,
+        current_streak_days: summary.current_streak_days,
+        longest_streak_days: summary.longest_streak_days,
+    }
+}
+
+fn profile_daily_usage_view(daily: ProviderProfileDailyUsage) -> AccountProfileDailyUsageView {
+    AccountProfileDailyUsageView {
+        date: daily.date.to_string(),
+        tokens: daily.tokens,
+    }
+}
+
+fn profile_activity_insights_view(
+    insights: ProviderProfileActivityInsights,
+) -> AccountProfileActivityInsightsView {
+    AccountProfileActivityInsightsView {
+        fast_mode_percent: insights.fast_mode_percent,
+        reasoning_effort: insights.reasoning_effort,
+        reasoning_effort_percent: insights.reasoning_effort_percent,
+        skills_explored: insights.skills_explored,
+        total_skills_used: insights.total_skills_used,
+        total_threads: insights.total_threads,
+        invocations: insights.invocations.map(|invocations| {
+            invocations
+                .into_iter()
+                .map(profile_invocation_view)
+                .collect()
+        }),
+    }
+}
+
+fn profile_invocation_view(invocation: ProviderProfileInvocation) -> AccountProfileInvocationView {
+    AccountProfileInvocationView {
+        invocation_type: invocation.invocation_type,
+        plugin_id: invocation.plugin_id,
+        plugin_name: invocation.plugin_name,
+        skill_id: invocation.skill_id,
+        skill_name: invocation.skill_name,
+        usage_count: invocation.usage_count,
+    }
+}
+
 /// 主动额度重置卡列表响应。
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -720,6 +841,9 @@ impl From<DomainConnectionTestEvent> for AccountConnectionTestEvent {
                "success": true
            }),
            DomainConnectionTestEvent::Failed {
+                source,
+                gateway_error_code,
+                send_state,
                message,
                provider_error_code,
                provider_error_type,
@@ -728,6 +852,9 @@ impl From<DomainConnectionTestEvent> for AccountConnectionTestEvent {
                upstream_body,
            } => serde_json::json!({
                "type": "error",
+                "source": source.as_str(),
+                "gatewayErrorCode": gateway_error_code.as_str(),
+                "sendState": send_state.map(gateway_core::engine::UpstreamSendState::as_str),
                "error": message,
                "providerErrorCode": provider_error_code,
                "providerErrorType": provider_error_type,
@@ -1160,6 +1287,10 @@ where
            post(batch_update_accounts::<S>),
        )
        .route("/api/admin/accounts/quota", get(account_quota::<S>))
+        .route(
+            "/api/admin/accounts/profile-statistics",
+            get(account_profile_statistics::<S>),
+        )
        .route(
            "/api/admin/accounts/reset-credits",
            get(account_reset_credits::<S>).post(consume_account_reset_credit::<S>),
@@ -1190,7 +1321,7 @@ where
 async fn batch_update_accounts<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<BatchUpdateAccountsRequest>,
+    AdminJson(request): AdminJson<BatchUpdateAccountsRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1211,7 +1342,7 @@ where
 async fn list_accounts<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<ListQuery>,
+    AdminQuery(query): AdminQuery<ListQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1232,7 +1363,7 @@ where
 async fn account_detail<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<AccountIdQuery>,
+    AdminQuery(query): AdminQuery<AccountIdQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1253,7 +1384,7 @@ where
 async fn export_accounts<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<AccountExportQuery>,
+    AdminQuery(query): AdminQuery<AccountExportQuery>,
 ) -> Result<Response, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1276,7 +1407,7 @@ where
 async fn import_accounts<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountImportRequest>,
+    AdminJson(request): AdminJson<AccountImportRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1304,7 +1435,7 @@ where
 async fn start_account_authorization<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<StartAccountAuthorizationRequest>,
+    AdminJson(request): AdminJson<StartAccountAuthorizationRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1338,7 +1469,7 @@ where
 async fn complete_account_authorization<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<CompleteAccountAuthorizationRequest>,
+    AdminJson(request): AdminJson<CompleteAccountAuthorizationRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1372,7 +1503,7 @@ where
 async fn rotate_account<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<RotateAccountRequest>,
+    AdminJson(request): AdminJson<RotateAccountRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1395,7 +1526,7 @@ where
 async fn update_account<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<UpdateAccountRequest>,
+    AdminJson(request): AdminJson<UpdateAccountRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1416,7 +1547,7 @@ where
 async fn delete_accounts<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountDeletionRequest>,
+    AdminJson(request): AdminJson<AccountDeletionRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1438,7 +1569,7 @@ where
 async fn refresh_account<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountRefreshRequest>,
+    AdminJson(request): AdminJson<AccountRefreshRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1457,7 +1588,7 @@ where
 async fn recover_account<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountActionRequest>,
+    AdminJson(request): AdminJson<AccountActionRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1476,7 +1607,7 @@ where
 async fn account_quota<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<AccountIdQuery>,
+    AdminQuery(query): AdminQuery<AccountIdQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1494,10 +1625,31 @@ where
    Ok(AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)))
 }

+async fn account_profile_statistics<S>(
+    _auth: AdminAuth,
+    State(state): State<S>,
+    AdminQuery(query): AdminQuery<AccountIdQuery>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: AdminSessionState + Send + Sync,
+{
+    let account_id = query.into_id().map_err(map_wire_error)?;
+    let result = state
+        .admin_services()
+        .accounts()
+        .profile_statistics(&account_id)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(AccountProfileStatisticsData::from(result)),
+    ))
+}
+
 async fn refresh_account_quota<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountActionRequest>,
+    AdminJson(request): AdminJson<AccountActionRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1518,7 +1670,7 @@ where
 async fn account_reset_credits<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<AccountIdQuery>,
+    AdminQuery(query): AdminQuery<AccountIdQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1539,7 +1691,7 @@ where
 async fn consume_account_reset_credit<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountResetCreditConsumeRequest>,
+    AdminJson(request): AdminJson<AccountResetCreditConsumeRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1560,7 +1712,7 @@ where
 async fn account_models<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<AccountIdQuery>,
+    AdminQuery(query): AdminQuery<AccountIdQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1579,7 +1731,7 @@ where
 async fn refresh_account_models<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<AccountActionRequest>,
+    AdminJson(request): AdminJson<AccountActionRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1598,7 +1750,7 @@ where
 async fn test_account_connection<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<AccountTestQuery>,
+    AdminQuery(query): AdminQuery<AccountTestQuery>,
 ) -> Result<Sse<impl Stream<Item = Result<Event, Infallible>>>, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -1936,7 +2088,7 @@ fn account_currency_cost_view(cost: &AccountCost) -> CurrencyCostView {
    CurrencyCostView {
        currency: cost.currency.clone(),
        estimated_amount: cost.amount.as_str().to_owned(),
-        estimated_amount_display: format!("{} {}", cost.currency, cost.amount.as_str()),
+        estimated_amount_display: format_decimal_currency(cost.amount.as_str(), &cost.currency),
    }
 }

@@ -2090,9 +2242,9 @@ fn china_datetime(value: &DateTime<Utc>) -> String {
 }

 fn map_wire_error(error: WireValidationError) -> AdminError {
-    AdminError::bad_request(format!("Invalid {}", error.field()))
+    AdminError::bad_request(format!("{} 字段不合法", error.field()))
 }

 fn map_service_error(error: AdminServiceError) -> AdminError {
-    super::wire::map_admin_service_error(error, "Account directory unavailable")
+    super::wire::map_admin_service_error(error)
 }
@@ -3,7 +3,7 @@
 use std::fmt;

 use axum::{
-    Json, Router,
+    Router,
    extract::{FromRequestParts, State},
    http::{HeaderMap, HeaderValue, StatusCode, header::SET_COOKIE, request::Parts},
    response::{IntoResponse, Response},
@@ -16,7 +16,7 @@ use gateway_admin::{
 use serde::{Deserialize, Serialize};
 use tower_http::request_id::RequestId;

-use super::{AdminEnvelope, AdminError, AdminResponse};
+use super::{AdminEnvelope, AdminError, AdminJson, AdminResponse};

 const REQUEST_ID_HEADER: &str = "x-request-id";
 const ADMIN_SESSION_COOKIE: &str = "cpr_admin_session";
@@ -37,11 +37,6 @@ impl AdminAuth {
    pub const fn context(&self) -> &AdminRequestContext {
        &self.context
    }
-
-    #[must_use]
-    pub fn into_context(self) -> AdminRequestContext {
-        self.context
-    }
 }

 impl<S> FromRequestParts<S> for AdminAuth
@@ -52,8 +47,7 @@ where

    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
        let principal = require_admin_auth(state, &parts.headers).await?;
-        let request_id = admin_request_id(parts)
-            .ok_or_else(|| AdminError::internal("Missing admin request context"))?;
+        let request_id = admin_request_id(parts).ok_or_else(AdminError::internal)?;
        Ok(Self {
            context: AdminRequestContext {
                principal,
@@ -90,7 +84,7 @@ where
    {
        Ok(Some(admin_user_id)) => Ok(admin_user_id),
        Ok(None) => Err(AdminError::admin_session_required()),
-        Err(_) => Err(AdminError::internal("Failed to validate admin session")),
+        Err(_) => Err(AdminError::internal()),
    }
 }

@@ -107,7 +101,7 @@ where
        {
            Ok(true) => Ok(AdminPrincipal::ApiKey),
            Ok(false) => Err(AdminError::invalid_admin_api_key()),
-            Err(_) => Err(AdminError::internal("Failed to validate admin API key")),
+            Err(_) => Err(AdminError::internal()),
        };
    }

@@ -209,7 +203,7 @@ where

 async fn login<S>(
    State(state): State<S>,
-    Json(payload): Json<AdminLoginRequest>,
+    AdminJson(payload): AdminJson<AdminLoginRequest>,
 ) -> Result<Response, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -232,8 +226,7 @@ where
    );
    response.headers_mut().insert(
        SET_COOKIE,
-        HeaderValue::from_str(&cookie)
-            .map_err(|_| AdminError::internal("Failed to create admin session cookie"))?,
+        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
    );
    Ok(response)
 }
@@ -250,7 +243,7 @@ where
        .auth()
        .validate_session(admin_session_cookie(&headers).as_deref())
        .await
-        .map_err(|_| AdminError::internal("Failed to validate admin session"))?;
+        .map_err(|_| AdminError::internal())?;
    Ok(AdminResponse::new(
        StatusCode::OK,
        AdminEnvelope::ok(AdminSessionStatusData::new(authenticated)),
@@ -270,8 +263,7 @@ where
    let cookie = format!("{ADMIN_SESSION_COOKIE}=; {ADMIN_SESSION_COOKIE_ATTRS}; Max-Age=0");
    response.headers_mut().insert(
        SET_COOKIE,
-        HeaderValue::from_str(&cookie)
-            .map_err(|_| AdminError::internal("Failed to clear admin session cookie"))?,
+        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
    );
    Ok(response)
 }
@@ -287,6 +279,6 @@ fn admin_session_cookie(headers: &HeaderMap) -> Option<String> {
 fn map_login_error(error: LoginError) -> AdminError {
    match error {
        LoginError::InvalidCredentials => AdminError::invalid_admin_credentials(),
-        LoginError::Unavailable => AdminError::internal("Failed to create admin session"),
+        LoginError::Unavailable => AdminError::internal(),
    }
 }
@@ -3,8 +3,8 @@
 //! 路径统一位于 `/api/admin/settings/backups/*`，内部由独立 `BackupService` 承担业务。

 use axum::{
-    Json, Router,
-    extract::{Query, State},
+    Router,
+    extract::State,
    http::StatusCode,
    response::IntoResponse,
    routing::{get, post},
@@ -18,8 +18,8 @@ use secrecy::{ExposeSecret as _, SecretString};
 use serde::{Deserialize, Serialize};

 use super::{
-    AdminAuth, AdminEnvelope, AdminError, AdminPageData, AdminResponse, AdminSessionState,
-    PageMeta, wire::map_admin_service_error,
+    AdminAuth, AdminEnvelope, AdminError, AdminJson, AdminPageData, AdminQuery, AdminResponse,
+    AdminSessionState, PageMeta, wire::map_admin_service_error,
 };

 /// 备份设置视图；`secretAccessKey` 返回已保存的明文凭据，由前端掩码显示。
@@ -256,7 +256,7 @@ where
 async fn update_backup_storage<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<UpdateBackupStorageRequest>,
+    AdminJson(request): AdminJson<UpdateBackupStorageRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -304,7 +304,7 @@ where
 async fn update_backup_schedule<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<UpdateBackupScheduleRequest>,
+    AdminJson(request): AdminJson<UpdateBackupScheduleRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -331,28 +331,28 @@ where
 async fn backup_records<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<BackupRecordsQuery>,
+    AdminQuery(query): AdminQuery<BackupRecordsQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
 {
    let page_size = gateway_admin::model::PageSize::new(query.page_size.unwrap_or(20))
-        .map_err(|_| AdminError::bad_request("Invalid pageSize"))?;
+        .map_err(|_| AdminError::bad_request("pageSize 不合法"))?;
    let page = query.page.unwrap_or(1);
    if page == 0 {
-        return Err(AdminError::bad_request("Invalid page"));
+        return Err(AdminError::bad_request("page 不合法"));
    }
    let status = match query.status.as_deref() {
        None => None,
        Some(value) => BackupStatus::parse(value)
            .map(Some)
-            .ok_or_else(|| AdminError::bad_request("Invalid status"))?,
+            .ok_or_else(|| AdminError::bad_request("status 不合法"))?,
    };
    let trigger = match query.trigger.as_deref() {
        None => None,
        Some(value) => BackupTriggerKind::parse(value)
            .map(Some)
-            .ok_or_else(|| AdminError::bad_request("Invalid trigger"))?,
+            .ok_or_else(|| AdminError::bad_request("trigger 不合法"))?,
    };
    let domain_query = gateway_admin::model::backup::BackupRecordListQuery {
        page,
@@ -386,7 +386,7 @@ where
 async fn create_backup<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    body: Option<Json<CreateBackupRequest>>,
+    body: Option<AdminJson<CreateBackupRequest>>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -417,7 +417,7 @@ pub struct CreateBackupRequest {
 async fn download_backup_url<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<BackupIdRequest>,
+    AdminJson(request): AdminJson<BackupIdRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -437,7 +437,7 @@ where
 async fn delete_backup<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<BackupIdRequest>,
+    AdminJson(request): AdminJson<BackupIdRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -455,5 +455,5 @@ where
 }

 fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
-    map_admin_service_error(error, "Backup service unavailable")
+    map_admin_service_error(error)
 }
@@ -17,16 +17,16 @@ use gateway_core::{
 use serde::{Deserialize, Serialize};

 use axum::{
-    Json, Router,
-    extract::{Query, State},
+    Router,
+    extract::State,
    http::{HeaderValue, StatusCode, header::CACHE_CONTROL},
    response::{IntoResponse, Response},
    routing::{get, post},
 };

 use super::{
-    AdminAuth, AdminEnvelope, AdminError, AdminResponse, AdminSessionState, WireValidationError,
-    wire::map_admin_service_error,
+    AdminAuth, AdminEnvelope, AdminError, AdminJson, AdminQuery, AdminResponse, AdminSessionState,
+    WireValidationError, wire::map_admin_service_error,
 };

 const MAX_CURSOR_BYTES: usize = 512;
@@ -669,7 +669,7 @@ where
 async fn list_client_keys<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<ListClientKeysQuery>,
+    AdminQuery(query): AdminQuery<ListClientKeysQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -680,15 +680,14 @@ where
        .list(query.into_command().map_err(map_wire_error)?)
        .await
        .map_err(map_service_error)?;
-    let data = ClientKeyListData::try_from(result)
-        .map_err(|_| AdminError::internal("Failed to encode client key cursor"))?;
+    let data = ClientKeyListData::try_from(result).map_err(|_| AdminError::internal())?;
    Ok(AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)))
 }

 async fn create_client_key<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(payload): Json<CreateClientKeyRequest>,
+    AdminJson(payload): AdminJson<CreateClientKeyRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -709,7 +708,7 @@ where
 async fn reveal_client_key<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<ClientKeyIdQuery>,
+    AdminQuery(query): AdminQuery<ClientKeyIdQuery>,
 ) -> Result<Response, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -735,7 +734,7 @@ where
 async fn update_client_key<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(payload): Json<UpdateClientKeyRequest>,
+    AdminJson(payload): AdminJson<UpdateClientKeyRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -753,7 +752,7 @@ where
 async fn disable_client_key<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(payload): Json<ClientKeyMutationRequest>,
+    AdminJson(payload): AdminJson<ClientKeyMutationRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -774,7 +773,7 @@ where
 async fn enable_client_key<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(payload): Json<ClientKeyMutationRequest>,
+    AdminJson(payload): AdminJson<ClientKeyMutationRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -795,7 +794,7 @@ where
 async fn delete_client_key<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(payload): Json<ClientKeyMutationRequest>,
+    AdminJson(payload): AdminJson<ClientKeyMutationRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -822,13 +821,14 @@ fn mutation_response(

 fn map_wire_error(error: WireValidationError) -> AdminError {
    match error.field() {
-        "cursor" => AdminError::bad_request("Invalid client key cursor"),
-        "clientKeyRevealNotFound" => AdminError::not_found("Client API key was not found"),
-        "clientKeyMutationNotFound" => AdminError::not_found("client API key was not found"),
-        _ => AdminError::bad_request("Invalid client API key request"),
+        "cursor" => AdminError::bad_request("Client API Key 游标不合法"),
+        "clientKeyRevealNotFound" | "clientKeyMutationNotFound" => {
+            AdminError::not_found("Client API Key 不存在")
+        }
+        _ => AdminError::bad_request("Client API Key 请求不合法"),
    }
 }

 fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
-    map_admin_service_error(error, "Configuration repository unavailable")
+    map_admin_service_error(error)
 }
@@ -0,0 +1,87 @@
+//! 管理端 JSON 与 Query extractor 的稳定 rejection 映射。
+
+use axum::{
+    Json,
+    extract::{
+        FromRequest, FromRequestParts, OptionalFromRequest, Query, Request,
+        rejection::{JsonRejection, QueryRejection},
+    },
+    http::{StatusCode, request::Parts},
+};
+use serde::de::DeserializeOwned;
+
+use super::AdminError;
+
+/// 将 Axum JSON rejection 收口为管理端错误信封。
+pub struct AdminJson<T>(pub T);
+
+impl<T, S> FromRequest<S> for AdminJson<T>
+where
+    T: DeserializeOwned,
+    S: Send + Sync,
+{
+    type Rejection = AdminError;
+
+    async fn from_request(request: Request, state: &S) -> Result<Self, Self::Rejection> {
+        <Json<T> as FromRequest<S>>::from_request(request, state)
+            .await
+            .map(|Json(value)| Self(value))
+            .map_err(map_json_rejection)
+    }
+}
+
+impl<T, S> OptionalFromRequest<S> for AdminJson<T>
+where
+    T: DeserializeOwned,
+    S: Send + Sync,
+{
+    type Rejection = AdminError;
+
+    async fn from_request(request: Request, state: &S) -> Result<Option<Self>, Self::Rejection> {
+        <Json<T> as OptionalFromRequest<S>>::from_request(request, state)
+            .await
+            .map(|value| value.map(|Json(value)| Self(value)))
+            .map_err(map_json_rejection)
+    }
+}
+
+/// 将 Axum Query rejection 收口为管理端错误信封。
+pub struct AdminQuery<T>(pub T);
+
+impl<T, S> FromRequestParts<S> for AdminQuery<T>
+where
+    T: DeserializeOwned,
+    S: Send + Sync,
+{
+    type Rejection = AdminError;
+
+    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
+        Query::<T>::from_request_parts(parts, state)
+            .await
+            .map(|Query(value)| Self(value))
+            .map_err(map_query_rejection)
+    }
+}
+
+fn map_json_rejection(rejection: JsonRejection) -> AdminError {
+    let status = rejection.status();
+    match rejection {
+        JsonRejection::JsonSyntaxError(_) => AdminError::malformed_json(),
+        JsonRejection::JsonDataError(_) => {
+            AdminError::invalid_request(StatusCode::UNPROCESSABLE_ENTITY, "请求字段不合法")
+        }
+        JsonRejection::MissingJsonContentType(_) => AdminError::invalid_request(
+            StatusCode::UNSUPPORTED_MEDIA_TYPE,
+            "请求必须使用 application/json",
+        ),
+        JsonRejection::BytesRejection(_) if status == StatusCode::PAYLOAD_TOO_LARGE => {
+            AdminError::invalid_request(status, "请求体过大")
+        }
+        JsonRejection::BytesRejection(_) => AdminError::internal(),
+        _ => AdminError::invalid_request(status, "请求体不合法"),
+    }
+}
+
+fn map_query_rejection(_: QueryRejection) -> AdminError {
+    AdminError::bad_request("请求参数不合法")
+}
@@ -5,6 +5,7 @@ use axum::{
    http::{HeaderValue, header},
    middleware,
    response::Response,
+    routing::any,
 };

 pub mod account_groups;
@@ -12,6 +13,7 @@ pub mod accounts;
 pub mod auth;
 pub mod backups;
 pub mod client_keys;
+mod extract;
 pub mod observability;
 pub mod presenter;
 pub mod settings;
@@ -19,6 +21,7 @@ pub mod system;
 pub mod wire;

 pub use auth::{AdminAuth, AdminSessionState};
+pub use extract::{AdminJson, AdminQuery};
 pub use wire::{
    ADMIN_OK_CODE, ADMIN_OK_MESSAGE, AdminEnvelope, AdminError, AdminErrorBody, AdminErrorCode,
    AdminPageData, AdminResponse, PageMeta, WireValidationError,
@@ -38,9 +41,20 @@ where
        .merge(observability::router::<S>())
        .merge(settings::router::<S>())
        .merge(system::router::<S>())
+        .method_not_allowed_fallback(method_not_allowed)
+        .route("/api/admin", any(admin_not_found))
+        .route("/api/admin/{*path}", any(admin_not_found))
        .layer(middleware::map_response(no_store))
 }

+async fn method_not_allowed() -> AdminError {
+    AdminError::method_not_allowed()
+}
+
+async fn admin_not_found() -> AdminError {
+    AdminError::admin_route_not_found()
+}
+
 async fn no_store(mut response: Response) -> Response {
    response
        .headers_mut()
@@ -1,14 +1,8 @@
 //! Dashboard、用量与诊断查询的 wire 映射和固定路由。

-use std::{collections::BTreeMap, num::NonZeroU32};
+use std::collections::BTreeMap;

-use axum::{
-    Router,
-    extract::{Query, State},
-    http::StatusCode,
-    response::IntoResponse,
-    routing::get,
-};
+use axum::{Router, extract::State, http::StatusCode, response::IntoResponse, routing::get};
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use chrono::{DateTime, Duration, Utc};
 use gateway_admin::model::{PageSize as DomainPageSize, observability as domain};
@@ -17,7 +11,7 @@ use serde_json::Value;

 use super::presenter::{format_compact_number, format_decimal_currency, format_number};
 use super::{
-    AdminAuth, AdminEnvelope, AdminError, AdminResponse, AdminSessionState, PageMeta,
+    AdminAuth, AdminEnvelope, AdminError, AdminQuery, AdminResponse, AdminSessionState,
    WireValidationError, wire::map_admin_service_error,
 };

@@ -17,6 +17,21 @@ pub(crate) fn display_duration(value: Option<u64>) -> String {
    }
 }

+fn display_duration_f64(value: Option<f64>) -> String {
+    let Some(value) = value.filter(|value| value.is_finite() && *value >= 0.0) else {
+        return "—".to_owned();
+    };
+    if value < 1_000.0 {
+        format!("{value:.0} ms")
+    } else if value < 60_000.0 {
+        format!("{:.2} s", value / 1_000.0)
+    } else if value < 3_600_000.0 {
+        format!("{:.1} min", value / 60_000.0)
+    } else {
+        format!("{:.1} h", value / 3_600_000.0)
+    }
+}
+
 pub(crate) fn display_rate(value: f64) -> String {
    if value.is_finite() {
        format!("{:.1}%", value * 100.0)
@@ -25,6 +40,10 @@ pub(crate) fn display_rate(value: f64) -> String {
    }
 }

+fn basis_points_rate(value: u64) -> f64 {
+    value as f64 / 10_000.0
+}
+
 pub(crate) fn china_datetime(value: &DateTime<Utc>) -> String {
    (*value + Duration::hours(8))
        .format("%Y-%m-%d %H:%M:%S")
@@ -127,6 +146,43 @@ pub(crate) fn token_details(record: &domain::UsageRecord) -> TokenDetailsView {
    }
 }

+pub(crate) fn usage_list_token_details(record: &domain::UsageListRecord) -> TokenDetailsView {
+    TokenDetailsView {
+        input_tokens: record.input_tokens,
+        output_tokens: record.output_tokens,
+        cached_tokens: record.cached_tokens,
+        cache_write_tokens: record.cache_write_tokens,
+        reasoning_tokens: record.reasoning_tokens,
+        image_input_tokens: record.image_input_tokens,
+        image_output_tokens: record.image_output_tokens,
+        total_tokens: record.total_tokens,
+        input_tokens_display: record
+            .input_tokens
+            .map_or_else(|| "-".to_owned(), format_number),
+        output_tokens_display: record
+            .output_tokens
+            .map_or_else(|| "-".to_owned(), format_number),
+        cached_tokens_display: record
+            .cached_tokens
+            .map_or_else(|| "-".to_owned(), format_compact_number),
+        cache_write_tokens_display: record
+            .cache_write_tokens
+            .map_or_else(|| "-".to_owned(), format_compact_number),
+        reasoning_tokens_display: record
+            .reasoning_tokens
+            .map_or_else(|| "-".to_owned(), format_number),
+        image_input_tokens_display: record
+            .image_input_tokens
+            .map_or_else(|| "-".to_owned(), format_number),
+        image_output_tokens_display: record
+            .image_output_tokens
+            .map_or_else(|| "-".to_owned(), format_number),
+        total_tokens_display: record
+            .total_tokens
+            .map_or_else(|| "-".to_owned(), format_number),
+    }
+}
+
 pub(crate) fn format_money(cost: &domain::CurrencyCost) -> String {
    format_decimal_currency(cost.amount.as_str(), &cost.currency)
 }
@@ -142,11 +198,19 @@ pub(crate) fn format_service_tier(service_tier: Option<&str>) -> String {
    match service_tier {
        Some("priority" | "fast") => "Fast".to_owned(),
        Some("flex") => "Flex".to_owned(),
-        Some("default") | None => "Default".to_owned(),
-        Some(other) => other.to_owned(),
+        Some("default" | "standard") | None => "Standard".to_owned(),
+        Some(other) => capitalize_first(other),
    }
 }

+fn capitalize_first(value: &str) -> String {
+    let mut chars = value.chars();
+    chars
+        .next()
+        .map(|first| first.to_uppercase().chain(chars).collect())
+        .unwrap_or_default()
+}
+
 pub(crate) fn billing_view(billing: Option<&domain::UsageBilling>) -> Option<BillingView> {
    match billing? {
        domain::UsageBilling::Total { total, .. } => Some(BillingView {
@@ -180,6 +244,57 @@ pub(crate) fn billing_view(billing: Option<&domain::UsageBilling>) -> Option<Bil
    }
 }

+pub(crate) fn usage_list_record_view(record: domain::UsageListRecord) -> UsageListRecordView {
+    let token_details = usage_list_token_details(&record);
+    let billing = billing_view(record.billing.as_ref());
+    let created_at_display = china_datetime(&record.started_at);
+    let model = record
+        .upstream_model_id
+        .clone()
+        .or_else(|| record.requested_model_id.clone());
+    UsageListRecordView {
+        id: record.id,
+        provider: record.provider_kind,
+        authentication_kind: record.provider_account_authentication_kind,
+        account_id: record.provider_account_ref,
+        account_email: record.provider_account_email,
+        account_name: record.provider_account_name,
+        route: record.endpoint,
+        model,
+        requested_model: record.requested_model_id,
+        upstream_model: record.upstream_model_id,
+        service_tier: record.service_tier,
+        client_transport: record.client_transport,
+        upstream_transport: record.upstream_transport,
+        reasoning_effort: record.reasoning_effort,
+        reasoning_preset: record.reasoning_preset,
+        subagent_kind: record.subagent_kind,
+        compact: record.compact,
+        token_details,
+        billing,
+        latency_details: UsageLatencyDetailsView {
+            admission_decision_ms: record.admission_decision_ms,
+            account_selection_wait_ms: record.account_selection_wait_ms,
+            capacity_used_slots: record.capacity_used_slots,
+            capacity_total_slots: record.capacity_total_slots,
+            transport_decision_wait_ms: record.transport_decision_wait_ms,
+            ws_connect_ms: record.connect_ms,
+            upstream_headers_ms: record.headers_ms,
+            first_event_ms: record.first_event_ms,
+            first_reasoning_ms: record.first_reasoning_ms,
+            first_text_ms: record.first_text_ms,
+            first_token_ms: record.first_token_ms,
+            openai_processing_ms: record.provider_processing_ms,
+        },
+        first_token_latency_ms: record.first_token_ms,
+        latency_ms: record.latency_ms,
+        created_at: record.started_at,
+        created_at_display,
+        client_ip: record.client_ip,
+        user_agent: record.user_agent,
+    }
+}
+
 pub(crate) fn usage_record_view(record: domain::UsageRecord) -> UsageRecordView {
    let tokens = token_details(&record);
    let billing = billing_view(record.billing.as_ref());
@@ -223,10 +338,6 @@ pub(crate) fn usage_record_view(record: domain::UsageRecord) -> UsageRecordView
        .upstream_model_id
        .clone()
        .or_else(|| record.requested_model_id.clone());
-    let transport = record
-        .upstream_transport
-        .clone()
-        .or_else(|| Some(record.client_transport.clone()));
    let metadata = provider_metadata_fields(record.provider_metadata_json.as_deref());
    UsageRecordView {
        id: record.id.clone(),
@@ -247,7 +358,8 @@ pub(crate) fn usage_record_view(record: domain::UsageRecord) -> UsageRecordView
        upstream_model: record.upstream_model_id,
        service_tier: record.service_tier,
        status_code,
-        transport,
+        client_transport: record.client_transport,
+        upstream_transport: record.upstream_transport,
        protocol: record.protocol.clone(),
        http_version: record.http_version.clone(),
        client_status_code: record.client_status_code.map(i64::from),
@@ -259,6 +371,10 @@ pub(crate) fn usage_record_view(record: domain::UsageRecord) -> UsageRecordView
        image_generation_requested: record.image_generation_requested,
        image_generation_succeeded: record.image_generation_succeeded,
        latency_details: UsageLatencyDetailsView {
+            admission_decision_ms: record.admission_decision_ms,
+            account_selection_wait_ms: record.account_selection_wait_ms,
+            capacity_used_slots: record.capacity_used_slots,
+            capacity_total_slots: record.capacity_total_slots,
            transport_decision_wait_ms: record.transport_decision_wait_ms,
            ws_connect_ms: record.connect_ms,
            upstream_headers_ms: record.headers_ms,
@@ -318,6 +434,8 @@ pub(crate) fn provider_metadata_fields(value: Option<&str>) -> BTreeMap<String,
        "requestKind",
        "subagentKind",
        "transport",
+        "clientTransport",
+        "upstreamTransport",
        "httpVersion",
        "clientStatusCode",
        "upstreamStatusCode",
@@ -397,25 +515,12 @@ pub(crate) fn usage_detail_view(detail: domain::UsageDetail) -> UsageRecordDetai
    }
 }

-pub(crate) fn page_meta(page: u32, page_size: u16, total: u64) -> PageMeta {
-    let page_size_u64 = u64::from(page_size);
-    let total_pages = total.saturating_add(page_size_u64 - 1) / page_size_u64;
-    PageMeta::new(
-        page,
-        u32::from(page_size),
-        total,
-        u32::try_from(total_pages).unwrap_or(u32::MAX),
-    )
-}
-
 pub(crate) fn usage_page_view(
    page: domain::UsagePage,
-    page_number: u32,
-    page_size: u16,
-) -> Result<PageData<UsageRecordView>, WireValidationError> {
+) -> Result<PageData<UsageListRecordView>, WireValidationError> {
    Ok(PageData {
-        items: page.items.into_iter().map(usage_record_view).collect(),
-        page: page_meta(page_number, page_size, page.total),
+        items: page.items.into_iter().map(usage_list_record_view).collect(),
+        total: page.total,
        next_cursor: page
            .next_cursor
            .as_ref()
@@ -463,12 +568,10 @@ pub(crate) fn ops_error_view(error: domain::OpsError) -> OpsErrorView {

 pub(crate) fn ops_page_view(
    page: domain::OpsErrorPage,
-    page_number: u32,
-    page_size: u16,
 ) -> Result<PageData<OpsErrorView>, WireValidationError> {
    Ok(PageData {
        items: page.items.into_iter().map(ops_error_view).collect(),
-        page: page_meta(page_number, page_size, page.total),
+        total: page.total,
        next_cursor: page
            .next_cursor
            .as_ref()
@@ -506,6 +609,36 @@ pub(crate) fn trend_point_view(point: domain::TrendPoint) -> TrendPointView {
        success_rate: success_rate_value
            .map_or_else(|| "—".to_owned(), |value| format!("{value:.1}%")),
        success_rate_value,
+        first_token_p50_ms: point
+            .metrics
+            .first_token_latency_percentiles
+            .p50_ms
+            .map(|value| value.as_f64()),
+        first_token_p95_ms: point
+            .metrics
+            .first_token_latency_percentiles
+            .p95_ms
+            .map(|value| value.as_f64()),
+        latency_p95_ms: point
+            .metrics
+            .latency_percentiles
+            .p95_ms
+            .map(|value| value.as_f64()),
+        output_throughput_p50: point.metrics.output_throughput_p50,
+        admission_decision_p95_ms: point
+            .metrics
+            .admission_decision_percentiles
+            .p95_ms
+            .map(|value| value.as_f64()),
+        account_selection_wait_p95_ms: point
+            .metrics
+            .account_selection_wait_percentiles
+            .p95_ms
+            .map(|value| value.as_f64()),
+        capacity_utilization: point
+            .metrics
+            .capacity_utilization_p95_basis_points
+            .map(basis_points_rate),
    }
 }

@@ -533,18 +666,20 @@ pub(crate) fn trend_summary_view(
        ],
        TrendKind::Latency => vec![
            TrendSummaryView {
-                label: "平均".to_owned(),
-                value: display_duration(summary.average_latency_ms),
+                label: "首字 P95".to_owned(),
+                value: display_duration_f64(summary.peak_first_token_p95_ms),
                ratio: None,
            },
            TrendSummaryView {
-                label: "最高".to_owned(),
-                value: display_duration(summary.max_latency_ms),
+                label: "总耗时 P95".to_owned(),
+                value: display_duration_f64(summary.peak_latency_p95_ms),
                ratio: None,
            },
            TrendSummaryView {
-                label: "最低".to_owned(),
-                value: display_duration(summary.min_latency_ms),
+                label: "吞吐 P50".to_owned(),
+                value: summary
+                    .minimum_output_throughput_p50
+                    .map_or_else(|| "—".to_owned(), |value| format!("{value} tok/s")),
                ratio: None,
            },
        ],
@@ -729,21 +864,19 @@ pub(crate) fn dashboard_view(
            last_used: relative_time(credential.last_used_at, range.end),
        });
    }
+    let unavailable_accounts = provider_accounts
+        .total
+        .saturating_sub(provider_accounts.normal);
+
    DashboardDataView {
        cards: DashboardCardsView {
            credentials: DashboardCredentialsCardView {
-                total: format_compact_number(provider_accounts.total),
+                total: provider_accounts.total.to_string(),
                total_value: provider_accounts.total,
-                available: format_compact_number(provider_accounts.normal),
+                available: provider_accounts.normal.to_string(),
                available_value: provider_accounts.normal,
-                unavailable: format_compact_number(
-                    provider_accounts
-                        .total
-                        .saturating_sub(provider_accounts.normal),
-                ),
-                unavailable_value: provider_accounts
-                    .total
-                    .saturating_sub(provider_accounts.normal),
+                unavailable: unavailable_accounts.to_string(),
+                unavailable_value: unavailable_accounts,
            },
            traffic: DashboardTrafficCardView {
                today_requests: format_compact_number(today.request_count),
@@ -773,7 +906,10 @@ pub(crate) fn dashboard_view(
        health_timeline: health_timeline_view(health_timeline),
        wire_profiles: wire_profiles.into_iter().map(wire_profile_view).collect(),
        account_usage: account_usage_views,
-        usage_records: recent_requests.into_iter().map(usage_record_view).collect(),
+        usage_records: recent_requests
+            .into_iter()
+            .map(usage_list_record_view)
+            .collect(),
        pool_summary: DashboardPoolSummaryView {
            total: provider_accounts.total,
            normal: provider_accounts.normal,
@@ -815,6 +951,7 @@ pub(crate) fn usage_insights_view(insights: domain::UsageInsights) -> UsageInsig
        .map(|point| OverviewHealthPointView {
            bucket: point.bucket_start,
            label: china_label(point.bucket_start, "%m-%d %H:%M"),
+            total_requests: point.total_requests,
            success_requests: point.success_requests,
            failed_requests: point.failed_requests,
            cancelled_requests: point.cancelled_requests,
@@ -845,6 +982,31 @@ pub(crate) fn usage_insights_view(insights: domain::UsageInsights) -> UsageInsig
                .first_token_latency_percentiles
                .p99_ms
                .map(|value| value.as_f64()),
+            admission_decision_p50_ms: point
+                .admission_decision_percentiles
+                .p50_ms
+                .map(|value| value.as_f64()),
+            admission_decision_p95_ms: point
+                .admission_decision_percentiles
+                .p95_ms
+                .map(|value| value.as_f64()),
+            account_selection_wait_p50_ms: point
+                .account_selection_wait_percentiles
+                .p50_ms
+                .map(|value| value.as_f64()),
+            account_selection_wait_p95_ms: point
+                .account_selection_wait_percentiles
+                .p95_ms
+                .map(|value| value.as_f64()),
+            output_throughput_p10: point.output_throughput_p10,
+            output_throughput_p50: point.output_throughput_p50,
+            output_throughput_p90: point.output_throughput_p90,
+            capacity_utilization: point
+                .capacity_utilization_avg_basis_points
+                .map(basis_points_rate),
+            capacity_utilization_p95: point
+                .capacity_utilization_p95_basis_points
+                .map(basis_points_rate),
        })
        .collect();
    let cost_points = insights
@@ -860,6 +1022,8 @@ pub(crate) fn usage_insights_view(insights: domain::UsageInsights) -> UsageInsig
            total_tokens: point.total_tokens,
            estimated_cost: point.estimated_cost.as_ref().map(ToString::to_string),
            standard_cost: point.standard_cost.as_ref().map(ToString::to_string),
+            no_cache_cost: point.no_cache_cost.as_ref().map(ToString::to_string),
+            cache_savings: point.cache_savings.as_ref().map(ToString::to_string),
            cached_token_rate: point.cached_token_rate,
            cache_hit_request_rate: point.cache_hit_request_rate,
        })
@@ -874,6 +1038,7 @@ pub(crate) fn usage_insights_view(insights: domain::UsageInsights) -> UsageInsig
            incomplete_requests: insights.health.incomplete_requests,
            caller_error_requests: insights.health.caller_error_requests,
            success_rate: insights.health.success_rate,
+            completion_rate: insights.health.completion_rate,
            request_change_rate: None,
            success_rate_change: None,
            points: health_points,
@@ -909,8 +1074,42 @@ pub(crate) fn usage_insights_view(insights: domain::UsageInsights) -> UsageInsig
                .first_token_latency_percentiles
                .p99_ms
                .map(|value| value.as_f64()),
+            admission_decision_p50_ms: insights
+                .performance
+                .admission_decision_percentiles
+                .p50_ms
+                .map(|value| value.as_f64()),
+            admission_decision_p95_ms: insights
+                .performance
+                .admission_decision_percentiles
+                .p95_ms
+                .map(|value| value.as_f64()),
+            account_selection_wait_p50_ms: insights
+                .performance
+                .account_selection_wait_percentiles
+                .p50_ms
+                .map(|value| value.as_f64()),
+            account_selection_wait_p95_ms: insights
+                .performance
+                .account_selection_wait_percentiles
+                .p95_ms
+                .map(|value| value.as_f64()),
+            output_throughput_p10: insights.performance.output_throughput_p10,
+            output_throughput_p50: insights.performance.output_throughput_p50,
+            output_throughput_p90: insights.performance.output_throughput_p90,
+            capacity_utilization: insights
+                .performance
+                .capacity_utilization_avg_basis_points
+                .map(basis_points_rate),
+            capacity_utilization_p95: insights
+                .performance
+                .capacity_utilization_p95_basis_points
+                .map(basis_points_rate),
            latency_coverage: insights.performance.latency_coverage,
            first_token_coverage: insights.performance.first_token_coverage,
+            admission_decision_coverage: insights.performance.admission_decision_coverage,
+            account_selection_wait_coverage: insights.performance.account_selection_wait_coverage,
+            capacity_coverage: insights.performance.capacity_coverage,
            points: performance_points,
        },
        cost: OverviewCostView {
@@ -924,11 +1123,27 @@ pub(crate) fn usage_insights_view(insights: domain::UsageInsights) -> UsageInsig
                .standard_cost
                .as_ref()
                .map(ToString::to_string),
+            no_cache_cost: insights
+                .cost
+                .no_cache_cost
+                .as_ref()
+                .map(ToString::to_string),
+            cache_savings: insights
+                .cost
+                .cache_savings
+                .as_ref()
+                .map(ToString::to_string),
+            tier_premium: insights.cost.tier_premium.as_ref().map(ToString::to_string),
            cost_per_request: insights
                .cost
                .cost_per_request
                .as_ref()
                .map(ToString::to_string),
+            cost_per_successful_request: insights
+                .cost
+                .cost_per_successful_request
+                .as_ref()
+                .map(ToString::to_string),
            tokens_per_request: insights.cost.tokens_per_request,
            cached_token_rate: insights.cost.cached_token_rate,
            cache_hit_request_rate: insights.cost.cache_hit_request_rate,
@@ -986,6 +1201,12 @@ pub(crate) fn diagnostics_view(
                request_share: item.request_share,
                average_latency_ms: item.average_latency_ms,
                latency_p95_ms: item.latency_p95_ms,
+                first_token_p95_ms: item.first_token_p95_ms,
+                non_completion_count: item.non_completion_count,
+                non_completion_rate: item.non_completion_rate,
+                retry_count: item.retry_count,
+                retry_rate: item.retry_rate,
+                impact_score: item.impact_score,
                estimated_cost: item.estimated_cost.as_ref().map(ToString::to_string),
                attempt_count: item.attempt_count,
                total_tokens: item.total_tokens,
@@ -995,21 +1216,21 @@ pub(crate) fn diagnostics_view(
 }

 pub(crate) fn map_wire_error(error: WireValidationError) -> AdminError {
+    if error.field() == "timeRange" {
+        return AdminError::invalid_time_range();
+    }
    let message = match error.field() {
-        "timeRange" => "Invalid time range",
-        "statusCode" => "Status code must be between 100 and 599",
-        "attemptIndex" => "Attempt index is out of range",
-        "kind" => "Invalid dashboard trend kind",
-        "dimension" => "Invalid diagnostics dimension",
-        "outcome" => "Invalid Observability query",
-        "id" => "Usage record ID is required",
-        "page" | "pageSize" => "Invalid Observability query",
-        "cursor" => "Invalid observability cursor",
-        _ => "Invalid observability query",
+        "statusCode" => "statusCode 必须在 100 到 599 之间",
+        "attemptIndex" => "attemptIndex 超出有效范围",
+        "kind" => "Dashboard 趋势类型不合法",
+        "dimension" => "诊断维度不合法",
+        "id" => "用量记录 ID 不能为空",
+        "cursor" => "观测数据游标不合法",
+        _ => "观测查询参数不合法",
    };
    AdminError::bad_request(message)
 }

 pub(crate) fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
-    map_admin_service_error(error, "Observability repository unavailable")
+    map_admin_service_error(error)
 }
@@ -31,7 +31,6 @@ impl DashboardQuery {
 #[derive(Clone, Default, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct UsageQuery {
-    pub page: Option<u32>,
    pub page_size: Option<u16>,
    pub cursor: Option<String>,
    pub kind: Option<String>,
@@ -54,16 +53,12 @@ pub struct UsageQuery {

 impl UsageQuery {
    /// 校验分页字段，不改变仓储层的分页 owner。
-    pub fn validate_page(&self) -> Result<(u32, u16), WireValidationError> {
-        let page = self.page.unwrap_or(1);
-        if page == 0 {
-            return Err(WireValidationError::new("page"));
-        }
+    pub fn validate_page_size(&self) -> Result<u16, WireValidationError> {
        let page_size = self.page_size.unwrap_or(DEFAULT_PAGE_SIZE);
        if page_size == 0 || page_size > MAX_PAGE_SIZE {
            return Err(WireValidationError::new("pageSize"));
        }
-        Ok((page, page_size))
+        Ok(page_size)
    }

    /// 校验游标的 wire 边界；编码和排序语义由应用层负责。
@@ -110,7 +105,6 @@ impl DiagnosticsQuery {
 #[derive(Clone, Default, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct OpsQuery {
-    pub page: Option<u32>,
    pub page_size: Option<u16>,
    pub cursor: Option<String>,
    pub kind: Option<String>,
@@ -135,16 +129,12 @@ pub struct OpsQuery {

 impl OpsQuery {
    /// 校验分页字段。
-    pub fn validate_page(&self) -> Result<(u32, u16), WireValidationError> {
-        let page = self.page.unwrap_or(1);
-        if page == 0 {
-            return Err(WireValidationError::new("page"));
-        }
+    pub fn validate_page_size(&self) -> Result<u16, WireValidationError> {
        let page_size = self.page_size.unwrap_or(DEFAULT_PAGE_SIZE);
        if page_size == 0 || page_size > MAX_PAGE_SIZE {
            return Err(WireValidationError::new("pageSize"));
        }
-        Ok((page, page_size))
+        Ok(page_size)
    }

    /// 校验游标的 wire 边界。
@@ -345,37 +335,23 @@ pub(crate) fn usage_filter(query: &UsageQuery) -> Result<domain::UsageFilter, Wi
    })
 }

-pub(crate) fn usage_command(
-    query: &UsageQuery,
-) -> Result<(domain::UsageQuery, u32, u16), WireValidationError> {
-    let (page, page_size) = query.validate_page()?;
+pub(crate) fn usage_command(query: &UsageQuery) -> Result<domain::UsageQuery, WireValidationError> {
+    let page_size = query.validate_page_size()?;
    query.validate_cursor()?;
-    let page_number = NonZeroU32::new(page)
-        .map(domain::PageNumber::new)
-        .ok_or_else(|| WireValidationError::new("page"))?;
    let page_size_value =
        DomainPageSize::new(page_size).map_err(|_| WireValidationError::new("pageSize"))?;
-    Ok((
-        domain::UsageQuery {
-            range: usage_range(query.start_time.as_deref(), query.end_time.as_deref())?,
-            filter: usage_filter(query)?,
-            cursor: decode_observability_cursor(query.cursor.as_deref())?,
-            page: page_number,
-            page_size: page_size_value,
-        },
-        page,
-        page_size,
-    ))
+    Ok(domain::UsageQuery {
+        range: usage_range(query.start_time.as_deref(), query.end_time.as_deref())?,
+        filter: usage_filter(query)?,
+        cursor: decode_observability_cursor(query.cursor.as_deref())?,
+        page_size: page_size_value,
+        include_total: query.cursor.is_none(),
+    })
 }

-pub(crate) fn ops_command(
-    query: &OpsQuery,
-) -> Result<(domain::OpsErrorQuery, u32, u16), WireValidationError> {
-    let (page, page_size) = query.validate_page()?;
+pub(crate) fn ops_command(query: &OpsQuery) -> Result<domain::OpsErrorQuery, WireValidationError> {
+    let page_size = query.validate_page_size()?;
    query.validate_cursor()?;
-    let page_number = NonZeroU32::new(page)
-        .map(domain::PageNumber::new)
-        .ok_or_else(|| WireValidationError::new("page"))?;
    let page_size_value =
        DomainPageSize::new(page_size).map_err(|_| WireValidationError::new("pageSize"))?;
    let status_code = parse_status(
@@ -384,31 +360,27 @@ pub(crate) fn ops_command(
            .or(query.client_status_code)
            .or(query.status_code),
    )?;
-    Ok((
-        domain::OpsErrorQuery {
-            range: usage_range(query.start_time.as_deref(), query.end_time.as_deref())?,
-            filter: domain::OpsErrorFilter {
-                client_api_key_ref: non_empty(query.client_api_key_id.clone()),
-                request_id: non_empty(query.request_id.clone()),
-                provider_kind: non_empty(query.provider.clone()),
-                provider_account_ref: non_empty(query.account_id.clone()),
-                operation: non_empty(query.route.clone()).or_else(|| non_empty(query.kind.clone())),
-                model: non_empty(query.model.clone()),
-                transport: non_empty(query.transport.clone()),
-                attempt_index: parse_attempt_index(query.attempt_index)?,
-                response_id: non_empty(query.response_id.clone()),
-                upstream_request_id: non_empty(query.upstream_request_id.clone()),
-                failure_kind: non_empty(query.failure_class.clone()),
-                status_code,
-                search: non_empty(query.search.clone()),
-            },
-            cursor: decode_observability_cursor(query.cursor.as_deref())?,
-            page: page_number,
-            page_size: page_size_value,
+    Ok(domain::OpsErrorQuery {
+        range: usage_range(query.start_time.as_deref(), query.end_time.as_deref())?,
+        filter: domain::OpsErrorFilter {
+            client_api_key_ref: non_empty(query.client_api_key_id.clone()),
+            request_id: non_empty(query.request_id.clone()),
+            provider_kind: non_empty(query.provider.clone()),
+            provider_account_ref: non_empty(query.account_id.clone()),
+            operation: non_empty(query.route.clone()).or_else(|| non_empty(query.kind.clone())),
+            model: non_empty(query.model.clone()),
+            transport: non_empty(query.transport.clone()),
+            attempt_index: parse_attempt_index(query.attempt_index)?,
+            response_id: non_empty(query.response_id.clone()),
+            upstream_request_id: non_empty(query.upstream_request_id.clone()),
+            failure_kind: non_empty(query.failure_class.clone()),
+            status_code,
+            search: non_empty(query.search.clone()),
        },
-        page,
-        page_size,
-    ))
+        cursor: decode_observability_cursor(query.cursor.as_deref())?,
+        page_size: page_size_value,
+        include_total: query.cursor.is_none(),
+    })
 }

 pub(crate) fn decode_observability_cursor(
@@ -32,7 +32,7 @@ where
 pub(crate) async fn dashboard_summary<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<DashboardQuery>,
+    AdminQuery(query): AdminQuery<DashboardQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -56,7 +56,7 @@ where
 pub(crate) async fn dashboard_trend<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<DashboardQuery>,
+    AdminQuery(query): AdminQuery<DashboardQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -79,27 +79,26 @@ where
 pub(crate) async fn usage_records<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<UsageQuery>,
+    AdminQuery(query): AdminQuery<UsageQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
 {
-    let (command, page, page_size) = usage_command(&query).map_err(map_wire_error)?;
+    let command = usage_command(&query).map_err(map_wire_error)?;
    let result = state
        .admin_services()
        .observability()
        .usage_records(command)
        .await
        .map_err(map_service_error)?;
-    let data = usage_page_view(result, page, page_size)
-        .map_err(|_| AdminError::internal("Failed to encode observability cursor"))?;
+    let data = usage_page_view(result).map_err(|_| AdminError::internal())?;
    Ok(AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)))
 }

 pub(crate) async fn usage_record_detail<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<DetailQuery>,
+    AdminQuery(query): AdminQuery<DetailQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -120,7 +119,7 @@ where
 pub(crate) async fn usage_records_summary<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<UsageQuery>,
+    AdminQuery(query): AdminQuery<UsageQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -143,7 +142,7 @@ where
 pub(crate) async fn usage_insights_overview<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<UsageQuery>,
+    AdminQuery(query): AdminQuery<UsageQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -166,7 +165,7 @@ where
 pub(crate) async fn usage_insights_diagnostics<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<DiagnosticsQuery>,
+    AdminQuery(query): AdminQuery<DiagnosticsQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -196,19 +195,18 @@ where
 pub(crate) async fn ops_errors<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<OpsQuery>,
+    AdminQuery(query): AdminQuery<OpsQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
 {
-    let (command, page, page_size) = ops_command(&query).map_err(map_wire_error)?;
+    let command = ops_command(&query).map_err(map_wire_error)?;
    let result = state
        .admin_services()
        .observability()
        .ops_errors(command)
        .await
        .map_err(map_service_error)?;
-    let data = ops_page_view(result, page, page_size)
-        .map_err(|_| AdminError::internal("Failed to encode observability cursor"))?;
+    let data = ops_page_view(result).map_err(|_| AdminError::internal())?;
    Ok(AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)))
 }
@@ -15,7 +15,7 @@ pub struct CursorWire {
 #[serde(rename_all = "camelCase")]
 pub struct PageData<T> {
    pub items: Vec<T>,
-    pub page: PageMeta,
+    pub total: Option<u64>,
    pub next_cursor: Option<String>,
 }

@@ -77,7 +77,39 @@ pub struct BillingView {
    pub multiplier_display: String,
 }

-/// 单条逻辑请求展示。
+/// 使用记录表格的窄展示。
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UsageListRecordView {
+    pub id: String,
+    pub provider: Option<String>,
+    pub authentication_kind: Option<String>,
+    pub account_id: Option<String>,
+    pub account_email: Option<String>,
+    pub account_name: Option<String>,
+    pub route: String,
+    pub model: Option<String>,
+    pub requested_model: Option<String>,
+    pub upstream_model: Option<String>,
+    pub service_tier: Option<String>,
+    pub client_transport: String,
+    pub upstream_transport: Option<String>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_preset: Option<String>,
+    pub subagent_kind: Option<String>,
+    pub compact: bool,
+    pub token_details: TokenDetailsView,
+    pub billing: Option<BillingView>,
+    pub latency_details: UsageLatencyDetailsView,
+    pub first_token_latency_ms: Option<u64>,
+    pub latency_ms: Option<u64>,
+    pub created_at: DateTime<Utc>,
+    pub created_at_display: String,
+    pub client_ip: Option<String>,
+    pub user_agent: Option<String>,
+}
+
+/// 单条逻辑请求详情展示。
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageRecordView {
@@ -99,7 +131,8 @@ pub struct UsageRecordView {
    pub upstream_model: Option<String>,
    pub service_tier: Option<String>,
    pub status_code: Option<i64>,
-    pub transport: Option<String>,
+    pub client_transport: String,
+    pub upstream_transport: Option<String>,
    pub protocol: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub http_version: Option<String>,
@@ -157,6 +190,14 @@ pub struct WebSocketPoolMetadataView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageLatencyDetailsView {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub admission_decision_ms: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub account_selection_wait_ms: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capacity_used_slots: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capacity_total_slots: Option<u64>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub transport_decision_wait_ms: Option<u64>,
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -256,6 +297,13 @@ pub struct TrendPointView {
    pub min_latency_value: Option<u64>,
    pub success_rate: String,
    pub success_rate_value: Option<f64>,
+    pub first_token_p50_ms: Option<f64>,
+    pub first_token_p95_ms: Option<f64>,
+    pub latency_p95_ms: Option<f64>,
+    pub output_throughput_p50: Option<u64>,
+    pub admission_decision_p95_ms: Option<f64>,
+    pub account_selection_wait_p95_ms: Option<f64>,
+    pub capacity_utilization: Option<f64>,
 }

 /// Dashboard 趋势摘要。
@@ -510,7 +558,7 @@ pub struct DashboardDataView {
    pub health_timeline: HealthTimelineView,
    pub wire_profiles: Vec<DashboardWireProfileView>,
    pub account_usage: Vec<DashboardAccountUsageView>,
-    pub usage_records: Vec<UsageRecordView>,
+    pub usage_records: Vec<UsageListRecordView>,
    pub pool_summary: DashboardPoolSummaryView,
    pub capacity_info: DashboardCapacityInfoView,
    pub rotation_strategy: String,
@@ -537,6 +585,7 @@ pub struct UsageSummaryView {
 pub struct OverviewHealthPointView {
    pub bucket: DateTime<Utc>,
    pub label: String,
+    pub total_requests: u64,
    pub success_requests: u64,
    pub failed_requests: u64,
    pub cancelled_requests: u64,
@@ -556,6 +605,7 @@ pub struct OverviewHealthView {
    pub incomplete_requests: u64,
    pub caller_error_requests: u64,
    pub success_rate: f64,
+    pub completion_rate: f64,
    pub request_change_rate: Option<f64>,
    pub success_rate_change: Option<f64>,
    pub points: Vec<OverviewHealthPointView>,
@@ -573,6 +623,15 @@ pub struct OverviewPerformancePointView {
    pub first_token_p50_ms: Option<f64>,
    pub first_token_p95_ms: Option<f64>,
    pub first_token_p99_ms: Option<f64>,
+    pub admission_decision_p50_ms: Option<f64>,
+    pub admission_decision_p95_ms: Option<f64>,
+    pub account_selection_wait_p50_ms: Option<f64>,
+    pub account_selection_wait_p95_ms: Option<f64>,
+    pub output_throughput_p10: Option<u64>,
+    pub output_throughput_p50: Option<u64>,
+    pub output_throughput_p90: Option<u64>,
+    pub capacity_utilization: Option<f64>,
+    pub capacity_utilization_p95: Option<f64>,
 }

 /// 洞察性能摘要。
@@ -585,8 +644,20 @@ pub struct OverviewPerformanceView {
    pub first_token_p50_ms: Option<f64>,
    pub first_token_p95_ms: Option<f64>,
    pub first_token_p99_ms: Option<f64>,
+    pub admission_decision_p50_ms: Option<f64>,
+    pub admission_decision_p95_ms: Option<f64>,
+    pub account_selection_wait_p50_ms: Option<f64>,
+    pub account_selection_wait_p95_ms: Option<f64>,
+    pub output_throughput_p10: Option<u64>,
+    pub output_throughput_p50: Option<u64>,
+    pub output_throughput_p90: Option<u64>,
+    pub capacity_utilization: Option<f64>,
+    pub capacity_utilization_p95: Option<f64>,
    pub latency_coverage: f64,
    pub first_token_coverage: f64,
+    pub admission_decision_coverage: f64,
+    pub account_selection_wait_coverage: f64,
+    pub capacity_coverage: f64,
    pub points: Vec<OverviewPerformancePointView>,
 }

@@ -602,6 +673,8 @@ pub struct OverviewCostPointView {
    pub total_tokens: u64,
    pub estimated_cost: Option<String>,
    pub standard_cost: Option<String>,
+    pub no_cache_cost: Option<String>,
+    pub cache_savings: Option<String>,
    pub cached_token_rate: f64,
    pub cache_hit_request_rate: Option<f64>,
 }
@@ -612,7 +685,11 @@ pub struct OverviewCostPointView {
 pub struct OverviewCostView {
    pub estimated_cost: Option<String>,
    pub standard_cost: Option<String>,
+    pub no_cache_cost: Option<String>,
+    pub cache_savings: Option<String>,
+    pub tier_premium: Option<String>,
    pub cost_per_request: Option<String>,
+    pub cost_per_successful_request: Option<String>,
    pub tokens_per_request: f64,
    pub cached_token_rate: f64,
    pub cache_hit_request_rate: Option<f64>,
@@ -661,6 +738,12 @@ pub struct DiagnosticItemView {
    pub request_share: f64,
    pub average_latency_ms: Option<u64>,
    pub latency_p95_ms: Option<u64>,
+    pub first_token_p95_ms: Option<u64>,
+    pub non_completion_count: u64,
+    pub non_completion_rate: f64,
+    pub retry_count: u64,
+    pub retry_rate: f64,
+    pub impact_score: f64,
    pub estimated_cost: Option<String>,
    pub attempt_count: u64,
    pub total_tokens: u64,
@@ -3,7 +3,7 @@
 use std::{collections::BTreeMap, fmt};

 use axum::{
-    Json, Router,
+    Router,
    extract::State,
    http::StatusCode,
    response::IntoResponse,
@@ -17,8 +17,8 @@ use gateway_core::routing::{PublicModelId, UpstreamModelId};
 use serde::{Deserialize, Serialize};

 use super::{
-    AdminAuth, AdminEnvelope, AdminError, AdminResponse, AdminSessionState, WireValidationError,
-    wire::map_admin_service_error,
+    AdminAuth, AdminEnvelope, AdminError, AdminJson, AdminResponse, AdminSessionState,
+    WireValidationError, wire::map_admin_service_error,
 };

 /// 客户端模型到上游模型的全局精确映射。
@@ -197,7 +197,7 @@ where
 async fn update_settings<S>(
    auth: AdminAuth,
    State(state): State<S>,
-    Json(request): Json<UpdateRuntimeSettingsRequest>,
+    AdminJson(request): AdminJson<UpdateRuntimeSettingsRequest>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -324,16 +324,16 @@ fn valid_model_name(value: &str, max_len: usize) -> bool {

 fn map_wire_error(error: WireValidationError) -> AdminError {
    let message = match error.field() {
-        "settingsRefreshConcurrencyOverflow" => "Invalid refreshConcurrency".to_owned(),
-        "settingsMaxConcurrencyOverflow" => "Invalid maxConcurrentPerAccount".to_owned(),
-        "settingsUsageRetentionOverflow" => "Invalid usageRetentionDays".to_owned(),
-        "settingsOpsRetentionOverflow" => "Invalid opsEventRetentionDays".to_owned(),
-        "settingsAuditRetentionOverflow" => "Invalid auditRetentionDays".to_owned(),
-        field => format!("Invalid field: {field}"),
+        "settingsRefreshConcurrencyOverflow" => "refreshConcurrency 不合法".to_owned(),
+        "settingsMaxConcurrencyOverflow" => "maxConcurrentPerAccount 不合法".to_owned(),
+        "settingsUsageRetentionOverflow" => "usageRetentionDays 不合法".to_owned(),
+        "settingsOpsRetentionOverflow" => "opsEventRetentionDays 不合法".to_owned(),
+        "settingsAuditRetentionOverflow" => "auditRetentionDays 不合法".to_owned(),
+        field => format!("{field} 字段不合法"),
    };
    AdminError::bad_request(message)
 }

 fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
-    map_admin_service_error(error, "Settings repository unavailable")
+    map_admin_service_error(error)
 }
@@ -5,8 +5,8 @@
 use std::convert::Infallible;

 use axum::{
-    Json, Router,
-    extract::{Query, State},
+    Router,
+    extract::State,
    http::StatusCode,
    response::{
        IntoResponse,
@@ -23,7 +23,7 @@ use gateway_admin::model::system::{
 use serde::{Deserialize, Serialize};

 use super::{
-    AdminAuth, AdminEnvelope, AdminError, AdminResponse, AdminSessionState,
+    AdminAuth, AdminEnvelope, AdminError, AdminJson, AdminQuery, AdminResponse, AdminSessionState,
    wire::map_admin_service_error,
 };

@@ -251,7 +251,7 @@ where
 async fn update_detail<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    Query(query): Query<UpdateDetailQuery>,
+    AdminQuery(query): AdminQuery<UpdateDetailQuery>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -290,7 +290,7 @@ where
 async fn perform_update<S>(
    _auth: AdminAuth,
    State(state): State<S>,
-    payload: Option<Json<UpdateRequest>>,
+    payload: Option<AdminJson<UpdateRequest>>,
 ) -> Result<impl IntoResponse, AdminError>
 where
    S: AdminSessionState + Send + Sync,
@@ -298,7 +298,7 @@ where
    let result = state
        .admin_services()
        .system()
-        .perform_update(payload.map(|Json(value)| value.into_target_version()))
+        .perform_update(payload.map(|AdminJson(value)| value.into_target_version()))
        .await
        .map_err(map_system_error)?;
    let SystemOperationAccepted::Update {
@@ -309,7 +309,7 @@ where
        target_version,
    } = result
    else {
-        return Err(AdminError::internal("Invalid system update result"));
+        return Err(AdminError::internal());
    };
    Ok(AdminResponse::new(
        StatusCode::OK,
@@ -361,7 +361,7 @@ where
        need_restart,
    } = result
    else {
-        return Err(AdminError::internal("Invalid system rollback result"));
+        return Err(AdminError::internal());
    };
    Ok(AdminResponse::new(
        StatusCode::OK,
@@ -391,7 +391,7 @@ where
        message,
    } = result
    else {
-        return Err(AdminError::internal("Invalid system restart result"));
+        return Err(AdminError::internal());
    };
    Ok(AdminResponse::new(
        StatusCode::OK,
@@ -477,5 +477,5 @@ const fn update_event_level_name(level: SystemUpdateEventLevel) -> &'static str
 }

 fn map_system_error(error: gateway_admin::model::AdminError) -> AdminError {
-    map_admin_service_error(error, "System operation unavailable")
+    map_admin_service_error(error)
 }
@@ -116,6 +116,8 @@ impl AdminErrorCode {
    pub const USAGE_RECORD_ACCOUNTS: Self = Self(50002);
    /// 上游网关失败。
    pub const BAD_GATEWAY: Self = Self(50201);
+    /// 不可逆上游操作的执行结果未知。
+    pub const UPSTREAM_RESULT_UNKNOWN: Self = Self(50202);
    /// 依赖的服务暂不可用。
    pub const SERVICE_UNAVAILABLE: Self = Self(50301);

@@ -165,6 +167,89 @@ pub struct AdminError {
    body: AdminErrorBody,
 }

+#[derive(Debug, Clone, Copy)]
+struct AdminErrorSpec {
+    status: StatusCode,
+    code: AdminErrorCode,
+    message: &'static str,
+}
+
+impl AdminErrorSpec {
+    const fn new(status: StatusCode, code: AdminErrorCode, message: &'static str) -> Self {
+        Self {
+            status,
+            code,
+            message,
+        }
+    }
+}
+
+const MALFORMED_JSON: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::BAD_REQUEST,
+    AdminErrorCode::MALFORMED_JSON,
+    "请求体不是合法 JSON",
+);
+const BAD_REQUEST: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::BAD_REQUEST,
+    AdminErrorCode::BAD_REQUEST,
+    "请求参数不合法",
+);
+const INVALID_TIME_RANGE: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::BAD_REQUEST,
+    AdminErrorCode::INVALID_TIME_RANGE,
+    "时间范围不合法",
+);
+const SESSION_REQUIRED: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::UNAUTHORIZED,
+    AdminErrorCode::SESSION_REQUIRED,
+    "需要管理员登录",
+);
+const INVALID_CREDENTIALS: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::UNAUTHORIZED,
+    AdminErrorCode::INVALID_CREDENTIALS,
+    "管理员用户名或密码错误",
+);
+const INVALID_API_KEY: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::UNAUTHORIZED,
+    AdminErrorCode::INVALID_API_KEY,
+    "管理 API Key 无效",
+);
+const ADMIN_ROUTE_NOT_FOUND: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::NOT_FOUND,
+    AdminErrorCode::NOT_FOUND,
+    "管理接口不存在",
+);
+const METHOD_NOT_ALLOWED: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::METHOD_NOT_ALLOWED,
+    AdminErrorCode::BAD_REQUEST,
+    "请求方法不受支持",
+);
+const TOO_MANY_LOGIN_ATTEMPTS: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::TOO_MANY_REQUESTS,
+    AdminErrorCode::TOO_MANY_LOGIN_ATTEMPTS,
+    "登录尝试过多，请稍后重试",
+);
+const INTERNAL: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::INTERNAL_SERVER_ERROR,
+    AdminErrorCode::INTERNAL,
+    "服务内部错误",
+);
+const BAD_GATEWAY: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::BAD_GATEWAY,
+    AdminErrorCode::BAD_GATEWAY,
+    "上游服务请求失败",
+);
+const UPSTREAM_RESULT_UNKNOWN: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::BAD_GATEWAY,
+    AdminErrorCode::UPSTREAM_RESULT_UNKNOWN,
+    "上游执行结果未知，请刷新状态后再决定是否重试",
+);
+const SERVICE_UNAVAILABLE: AdminErrorSpec = AdminErrorSpec::new(
+    StatusCode::SERVICE_UNAVAILABLE,
+    AdminErrorCode::SERVICE_UNAVAILABLE,
+    "依赖服务暂不可用",
+);
+
 impl AdminError {
    fn new(status: StatusCode, code: AdminErrorCode, message: impl Into<String>) -> Self {
        Self {
@@ -173,44 +258,48 @@ impl AdminError {
        }
    }

+    fn from_spec(spec: AdminErrorSpec) -> Self {
+        Self::new(spec.status, spec.code, spec.message)
+    }
+
+    pub fn malformed_json() -> Self {
+        Self::from_spec(MALFORMED_JSON)
+    }
+
+    pub fn invalid_request(status: StatusCode, message: &'static str) -> Self {
+        Self::new(status, BAD_REQUEST.code, message)
+    }
+
+    pub fn invalid_time_range() -> Self {
+        Self::from_spec(INVALID_TIME_RANGE)
+    }
+
+    pub fn admin_route_not_found() -> Self {
+        Self::from_spec(ADMIN_ROUTE_NOT_FOUND)
+    }
+
+    pub fn method_not_allowed() -> Self {
+        Self::from_spec(METHOD_NOT_ALLOWED)
+    }
+
    pub fn bad_request(message: impl Into<String>) -> Self {
-        Self::new(
-            StatusCode::BAD_REQUEST,
-            AdminErrorCode::BAD_REQUEST,
-            message,
-        )
+        Self::new(BAD_REQUEST.status, BAD_REQUEST.code, message)
    }

    pub fn admin_session_required() -> Self {
-        Self::new(
-            StatusCode::UNAUTHORIZED,
-            AdminErrorCode::SESSION_REQUIRED,
-            "Admin session required",
-        )
+        Self::from_spec(SESSION_REQUIRED)
    }

    pub fn invalid_admin_credentials() -> Self {
-        Self::new(
-            StatusCode::UNAUTHORIZED,
-            AdminErrorCode::INVALID_CREDENTIALS,
-            "Invalid admin credentials",
-        )
+        Self::from_spec(INVALID_CREDENTIALS)
    }

    pub fn invalid_admin_api_key() -> Self {
-        Self::new(
-            StatusCode::UNAUTHORIZED,
-            AdminErrorCode::INVALID_API_KEY,
-            "Invalid admin API key",
-        )
+        Self::from_spec(INVALID_API_KEY)
    }

    pub fn too_many_login_attempts() -> Self {
-        Self::new(
-            StatusCode::TOO_MANY_REQUESTS,
-            AdminErrorCode::TOO_MANY_LOGIN_ATTEMPTS,
-            "Too many admin login attempts",
-        )
+        Self::from_spec(TOO_MANY_LOGIN_ATTEMPTS)
    }

    pub fn conflict(message: impl Into<String>) -> Self {
@@ -221,47 +310,37 @@ impl AdminError {
        Self::new(StatusCode::NOT_FOUND, AdminErrorCode::NOT_FOUND, message)
    }

-    pub fn internal(message: impl Into<String>) -> Self {
-        Self::new(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            AdminErrorCode::INTERNAL,
-            message,
-        )
+    pub fn internal() -> Self {
+        Self::from_spec(INTERNAL)
    }

-    pub fn bad_gateway(message: impl Into<String>) -> Self {
-        Self::new(
-            StatusCode::BAD_GATEWAY,
-            AdminErrorCode::BAD_GATEWAY,
-            message,
-        )
+    pub fn bad_gateway() -> Self {
+        Self::from_spec(BAD_GATEWAY)
    }

-    pub fn service_unavailable(message: impl Into<String>) -> Self {
-        Self::new(
-            StatusCode::SERVICE_UNAVAILABLE,
-            AdminErrorCode::SERVICE_UNAVAILABLE,
-            message,
-        )
+    pub fn upstream_result_unknown() -> Self {
+        Self::from_spec(UPSTREAM_RESULT_UNKNOWN)
+    }
+
+    pub fn service_unavailable() -> Self {
+        Self::from_spec(SERVICE_UNAVAILABLE)
    }
 }

 /// 把管理用例的稳定错误分类映射到既有 HTTP 错误 contract。
-pub(crate) fn map_admin_service_error(
-    error: gateway_admin::model::AdminError,
-    unavailable_message: &'static str,
-) -> AdminError {
+pub(crate) fn map_admin_service_error(error: gateway_admin::model::AdminError) -> AdminError {
    use gateway_admin::model::AdminErrorKind;

    match error.kind() {
-        AdminErrorKind::Invalid => AdminError::bad_request(error.to_string()),
+        AdminErrorKind::Invalid => AdminError::bad_request(error.message()),
        AdminErrorKind::Unauthorized => AdminError::admin_session_required(),
-        AdminErrorKind::NotFound => AdminError::not_found(error.to_string()),
-        AdminErrorKind::Conflict => AdminError::conflict(error.to_string()),
+        AdminErrorKind::NotFound => AdminError::not_found(error.message()),
+        AdminErrorKind::Conflict => AdminError::conflict(error.message()),
        AdminErrorKind::RateLimited => AdminError::too_many_login_attempts(),
-        AdminErrorKind::BadGateway => AdminError::bad_gateway(error.to_string()),
-        AdminErrorKind::Unavailable => AdminError::service_unavailable(unavailable_message),
-        AdminErrorKind::Internal => AdminError::internal(error.to_string()),
+        AdminErrorKind::BadGateway => AdminError::bad_gateway(),
+        AdminErrorKind::UpstreamResultUnknown => AdminError::upstream_result_unknown(),
+        AdminErrorKind::Unavailable => AdminError::service_unavailable(),
+        AdminErrorKind::Internal => AdminError::internal(),
    }
 }

@@ -136,12 +136,6 @@ pub enum ContinuationIntent {
 }

 impl ContinuationIntent {
-    /// 返回是否请求了对话延续。
-    #[must_use]
-    pub const fn is_continuation(&self) -> bool {
-        matches!(self, Self::PreviousResponseId(_))
-    }
-
    /// 返回待 history owner 解析的 response ID。
    #[must_use]
    pub fn previous_response_id(&self) -> Option<&str> {
@@ -1,699 +0,0 @@
-//! OpenAI Responses WebSocket adapter。
-
-use std::net::{IpAddr, SocketAddr};
-use std::sync::Arc;
-
-use axum::{
-    extract::{
-        Extension, State,
-        connect_info::ConnectInfo,
-        ws::{CloseFrame, Message, WebSocket, WebSocketUpgrade, close_code},
-    },
-    http::{HeaderMap, HeaderName, StatusCode},
-    response::{IntoResponse, Response},
-};
-use futures::StreamExt;
-use gateway_core::engine::execution::{AuthenticatedClient, ClientTransport, StartedExecution};
-use gateway_core::engine::{CommitRequirement, CoordinatedEvent, EngineError};
-use gateway_core::error::{GatewayError, GatewayErrorKind};
-use gateway_core::event::ProviderResponseHeader;
-use gateway_core::lifecycle::{ConnectionGuard, ConnectionLifecycle};
-use gateway_core::operation::ProviderSessionState;
-use serde_json::{Map, Value, json};
-use thiserror::Error;
-
-use crate::{
-    ApiState,
-    openai::{
-        auth::{authenticate_client, authentication_error_response},
-        error::{gateway_error_contract, gateway_error_from_engine, runtime_unavailable_response},
-        service::OpenAiService,
-    },
-};
-
-use super::{
-    DecodedResponsesRequest, OpenAiResponsesEncoder, ProtocolErrorBody, RequestDecodeError,
-    http::{PendingExecution, request_client_context},
-    request::OpenAiRequestHeaders,
-};
-
-const ACTIVE_RESPONSE_VIOLATION: &str = "Only one response.create may be active per connection";
-const TEXT_FRAMES_ONLY: &str = "Responses WebSocket accepts text frames only";
-
-/// 将已认证的 `GET /v1/responses` 升级为 Responses WebSocket。
-pub(crate) async fn responses_websocket(
-    State(state): State<ApiState>,
-    connect_info: Option<Extension<ConnectInfo<SocketAddr>>>,
-    headers: HeaderMap,
-    websocket: WebSocketUpgrade,
-) -> Response {
-    let service = state.openai().clone();
-    let client = match authenticate_client(&service, &headers) {
-        Ok(client) => client,
-        Err(error) => return authentication_error_response(error),
-    };
-    let (client_ip, user_agent) = request_client_context(
-        &headers,
-        connect_info.map(|Extension(ConnectInfo(address))| address),
-    );
-    ResponsesWebSocketAdapter::new(service).upgrade_with_client_context(
-        websocket,
-        client,
-        client_ip,
-        user_agent,
-        OpenAiRequestHeaders::from_headers(&headers),
-    )
-}
-
-/// 已鉴权 Responses WebSocket 升级边界。
-#[derive(Clone)]
-pub(crate) struct ResponsesWebSocketAdapter {
-    service: OpenAiService,
-}
-
-impl ResponsesWebSocketAdapter {
-    /// 绑定应用提供的唯一 OpenAI 客户端服务端口。
-    #[must_use]
-    pub const fn new(service: OpenAiService) -> Self {
-        Self { service }
-    }
-
-    fn upgrade_with_client_context(
-        &self,
-        websocket: WebSocketUpgrade,
-        client: AuthenticatedClient,
-        client_ip: Option<IpAddr>,
-        user_agent: Option<String>,
-        request_headers: OpenAiRequestHeaders,
-    ) -> Response {
-        let connection_guard = match self.service.try_register_connection() {
-            Ok(guard) => guard,
-            Err(_) => return runtime_unavailable_response().into_response(),
-        };
-        let session = ResponsesWebSocketSession {
-            service: self.service.clone(),
-            client,
-            connection_id: self.service.next_request_id().replacen("req_", "ws_", 1),
-            client_ip,
-            user_agent,
-            request_headers,
-            lifecycle: self.service.lifecycle(),
-            _connection_guard: connection_guard,
-        };
-        websocket
-            // 覆盖 axum/tungstenite 的私有 64 MiB message 与 16 MiB frame 默认值。
-            // Responses JSON 的协议可接受性由上游决定，代理不另设 wire 长度上限。
-            .max_message_size(usize::MAX)
-            .max_frame_size(usize::MAX)
-            .on_upgrade(move |socket| async move {
-                serve_responses_websocket(socket, session).await;
-            })
-    }
-}
-
-struct ResponsesWebSocketSession {
-    service: OpenAiService,
-    client: AuthenticatedClient,
-    connection_id: String,
-    client_ip: Option<IpAddr>,
-    user_agent: Option<String>,
-    request_headers: OpenAiRequestHeaders,
-    lifecycle: Arc<dyn ConnectionLifecycle>,
-    _connection_guard: Box<dyn ConnectionGuard>,
-}
-
-async fn serve_responses_websocket(mut socket: WebSocket, session: ResponsesWebSocketSession) {
-    tracing::info!(
-        websocket_connection_id = %session.connection_id,
-        "Responses WebSocket connected"
-    );
-    let mut request_count = 0_u64;
-    let mut replay = ConnectionReplaySnapshot::default();
-
-    let cancellation = session.lifecycle.cancellation();
-    loop {
-        let message = tokio::select! {
-            () = cancellation.cancelled() => break,
-            message = socket.next() => message,
-        };
-        let Some(message) = message else {
-            break;
-        };
-        let payload = match message {
-            Ok(Message::Text(payload)) => payload,
-            Ok(Message::Ping(_) | Message::Pong(_)) => continue,
-            Ok(Message::Close(_)) => break,
-            Ok(Message::Binary(_)) => {
-                close_for_protocol_violation(&mut socket, TEXT_FRAMES_ONLY).await;
-                break;
-            }
-            Err(error) => {
-                tracing::info!(
-                    websocket_connection_id = %session.connection_id,
-                    error = %error,
-                    "Responses WebSocket receive failed"
-                );
-                break;
-            }
-        };
-        request_count = request_count.saturating_add(1);
-        let correlation_id = session.service.next_request_id();
-        let decoded =
-            match decode_response_create_with_context(payload.as_str(), &session.request_headers) {
-                Ok(decoded) => {
-                    decoded.with_client_context(session.client_ip, session.user_agent.clone())
-                }
-                Err(error) => {
-                    tracing::info!(
-                        websocket_connection_id = %session.connection_id,
-                        request_id = %correlation_id,
-                        error = %error,
-                        "Responses WebSocket request rejected"
-                    );
-                    if send_protocol_error(
-                        &mut socket,
-                        StatusCode::BAD_REQUEST,
-                        error.protocol_body(),
-                        &correlation_id,
-                    )
-                    .await
-                        == ForwardOutcome::Disconnect
-                    {
-                        break;
-                    }
-                    continue;
-                }
-            };
-        let decoded = replay.prepare(decoded);
-        let started = match session
-            .service
-            .start_response(
-                session.client.clone(),
-                decoded,
-                ClientTransport::WebSocket,
-                "/v1/responses",
-            )
-            .await
-        {
-            Ok(started) => started,
-            Err(error) => {
-                if send_gateway_error(&mut socket, &error, &correlation_id).await
-                    == ForwardOutcome::Disconnect
-                {
-                    break;
-                }
-                continue;
-            }
-        };
-
-        if forward_execution(&mut socket, started, &mut replay).await == ForwardOutcome::Disconnect
-        {
-            break;
-        }
-    }
-
-    tracing::info!(
-        websocket_connection_id = %session.connection_id,
-        request_count,
-        "Responses WebSocket disconnected"
-    );
-}
-
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum ForwardOutcome {
-    Continue,
-    Disconnect,
-}
-
-#[derive(Default)]
-struct ConnectionReplaySnapshot {
-    last_response_id: Option<String>,
-    provider_state: Option<ProviderSessionState>,
-}
-
-impl ConnectionReplaySnapshot {
-    fn prepare(&self, request: DecodedResponsesRequest) -> DecodedResponsesRequest {
-        match (
-            request.metadata().continuation().previous_response_id(),
-            self.last_response_id.as_deref(),
-            self.provider_state.as_ref(),
-        ) {
-            (Some(previous), Some(last), Some(state)) if previous == last => {
-                request.with_provider_session_state(state.clone())
-            }
-            _ => request,
-        }
-    }
-
-    fn commit(&mut self, response_id: String, provider_state: Option<ProviderSessionState>) {
-        self.last_response_id = Some(response_id);
-        self.provider_state = provider_state;
-    }
-}
-
-async fn forward_execution(
-    socket: &mut WebSocket,
-    started: StartedExecution,
-    replay: &mut ConnectionReplaySnapshot,
-) -> ForwardOutcome {
-    let request_id = started.request_id.to_string();
-    let streaming = started.stream;
-    let mut execution = PendingExecution::new(started.session);
-    if !streaming {
-        let error = GatewayError::new(
-            GatewayErrorKind::Internal,
-            "WebSocket execution was not initialized as a stream",
-        );
-        return send_gateway_error(socket, &error, &request_id).await;
-    }
-    let first = loop {
-        match next_active_input(socket, &mut execution).await {
-            ActiveInput::Event(Ok(Some(event))) => break event,
-            ActiveInput::Event(Ok(None)) => {
-                let error = GatewayError::new(
-                    GatewayErrorKind::Internal,
-                    "gateway response ended before its first event",
-                );
-                return send_gateway_error(socket, &error, &request_id).await;
-            }
-            ActiveInput::Event(Err(error)) => {
-                let error = gateway_error_from_engine(&error);
-                return send_gateway_error(socket, &error, &request_id).await;
-            }
-            ActiveInput::Control => continue,
-            ActiveInput::Disconnect => return ForwardOutcome::Disconnect,
-            ActiveInput::ProtocolViolation => {
-                close_for_protocol_violation(socket, ACTIVE_RESPONSE_VIOLATION).await;
-                return ForwardOutcome::Disconnect;
-            }
-        }
-    };
-    let requirement = first.commit_requirement();
-    let mut first = first.into_provider_events();
-    if requirement != CommitRequirement::CommitBeforeDelivery {
-        let error = GatewayError::new(
-            GatewayErrorKind::Internal,
-            "gateway first event did not require commit",
-        );
-        return send_gateway_error(socket, &error, &request_id).await;
-    }
-    let mut encoder = OpenAiResponsesEncoder::new();
-    let mut provider_state = None;
-    let mut first_messages = Vec::new();
-    for event in &mut first {
-        if let Some(update) = event.take_session_update() {
-            provider_state = Some(update);
-        }
-        first_messages.extend(encoder.push_websocket(event));
-    }
-    if first_messages.is_empty() {
-        let error = GatewayError::new(
-            GatewayErrorKind::Internal,
-            "gateway commit batch encoded no output",
-        );
-        return send_gateway_error(socket, &error, &request_id).await;
-    }
-    let Some(response_session) = execution.session_mut() else {
-        return ForwardOutcome::Disconnect;
-    };
-    let response_headers = response_session.response_headers().to_vec();
-    if let Err(error) = response_session.commit_downstream(None).await {
-        let error = gateway_error_from_engine(&error);
-        return send_gateway_error(socket, &error, &request_id).await;
-    }
-    if encoder.is_completed() {
-        if let Err(outcome) = confirm_completed_execution(socket, &mut execution, &request_id).await
-        {
-            return outcome;
-        }
-        commit_connection_replay(replay, &encoder, provider_state.take());
-        if !send_text(
-            socket,
-            response_metadata_event(&request_id, &response_headers),
-        )
-        .await
-            || !send_messages(socket, first_messages).await
-        {
-            return ForwardOutcome::Disconnect;
-        }
-        execution.disarm();
-        return ForwardOutcome::Continue;
-    }
-    if !send_text(
-        socket,
-        response_metadata_event(&request_id, &response_headers),
-    )
-    .await
-        || !send_messages(socket, first_messages).await
-    {
-        return ForwardOutcome::Disconnect;
-    }
-
-    loop {
-        match next_active_input(socket, &mut execution).await {
-            ActiveInput::Event(Ok(Some(delivery))) => {
-                let requirement = delivery.commit_requirement();
-                let mut events = delivery.into_provider_events();
-                if requirement != CommitRequirement::AlreadyCommitted {
-                    let error = GatewayError::new(
-                        GatewayErrorKind::Internal,
-                        "gateway requested another downstream commit",
-                    );
-                    return send_gateway_error(socket, &error, &request_id).await;
-                }
-                let mut messages = Vec::new();
-                for event in &mut events {
-                    if let Some(update) = event.take_session_update() {
-                        provider_state = Some(update);
-                    }
-                    messages.extend(encoder.push_websocket(event));
-                }
-                if encoder.is_completed() {
-                    if let Err(outcome) =
-                        confirm_completed_execution(socket, &mut execution, &request_id).await
-                    {
-                        return outcome;
-                    }
-                    commit_connection_replay(replay, &encoder, provider_state.take());
-                    if !send_messages(socket, messages).await {
-                        return ForwardOutcome::Disconnect;
-                    }
-                    execution.disarm();
-                    return ForwardOutcome::Continue;
-                }
-                if !send_messages(socket, messages).await {
-                    return ForwardOutcome::Disconnect;
-                }
-            }
-            ActiveInput::Event(Ok(None)) => {
-                if execution
-                    .session_mut()
-                    .is_some_and(|session| session.is_finalized())
-                {
-                    commit_connection_replay(replay, &encoder, provider_state.take());
-                    execution.disarm();
-                    return ForwardOutcome::Continue;
-                }
-                let error = GatewayError::new(
-                    GatewayErrorKind::Internal,
-                    "gateway response ended without finalizing the execution",
-                );
-                return send_gateway_error(socket, &error, &request_id).await;
-            }
-            ActiveInput::Event(Err(error)) => {
-                if encoder.has_wire_failure() {
-                    execution.disarm();
-                    return ForwardOutcome::Continue;
-                }
-                let error = gateway_error_from_engine(&error);
-                return send_gateway_error(socket, &error, &request_id).await;
-            }
-            ActiveInput::Control => {}
-            ActiveInput::Disconnect => return ForwardOutcome::Disconnect,
-            ActiveInput::ProtocolViolation => {
-                close_for_protocol_violation(socket, ACTIVE_RESPONSE_VIOLATION).await;
-                return ForwardOutcome::Disconnect;
-            }
-        }
-    }
-}
-
-fn commit_connection_replay(
-    replay: &mut ConnectionReplaySnapshot,
-    encoder: &OpenAiResponsesEncoder,
-    provider_state: Option<ProviderSessionState>,
-) {
-    if let Some(response_id) = encoder.response_id() {
-        replay.commit(response_id.to_owned(), provider_state);
-    }
-}
-
-async fn confirm_completed_execution(
-    socket: &mut WebSocket,
-    execution: &mut PendingExecution,
-    request_id: &str,
-) -> Result<(), ForwardOutcome> {
-    loop {
-        match next_active_input(socket, execution).await {
-            ActiveInput::Event(Ok(None))
-                if execution
-                    .session_mut()
-                    .is_some_and(|session| session.is_finalized()) =>
-            {
-                return Ok(());
-            }
-            ActiveInput::Event(Ok(None)) => {
-                let error = GatewayError::new(
-                    GatewayErrorKind::Internal,
-                    "gateway response was not finalized after its terminal event",
-                );
-                return Err(send_gateway_error(socket, &error, request_id).await);
-            }
-            ActiveInput::Event(Ok(Some(_))) => {
-                let error = GatewayError::new(
-                    GatewayErrorKind::Internal,
-                    "gateway response continued after its terminal event",
-                );
-                return Err(send_gateway_error(socket, &error, request_id).await);
-            }
-            ActiveInput::Event(Err(error)) => {
-                let error = gateway_error_from_engine(&error);
-                return Err(send_gateway_error(socket, &error, request_id).await);
-            }
-            ActiveInput::Control => {}
-            ActiveInput::Disconnect => return Err(ForwardOutcome::Disconnect),
-            ActiveInput::ProtocolViolation => {
-                close_for_protocol_violation(socket, ACTIVE_RESPONSE_VIOLATION).await;
-                return Err(ForwardOutcome::Disconnect);
-            }
-        }
-    }
-}
-
-enum ActiveInput {
-    Event(Result<Option<CoordinatedEvent>, EngineError>),
-    Control,
-    Disconnect,
-    ProtocolViolation,
-}
-
-async fn next_active_input(
-    socket: &mut WebSocket,
-    execution: &mut PendingExecution,
-) -> ActiveInput {
-    let Some(session) = execution.session_mut() else {
-        return ActiveInput::Disconnect;
-    };
-    tokio::select! {
-        event = session.next_event() => ActiveInput::Event(event),
-        message = socket.next() => match message {
-            Some(Ok(Message::Ping(_) | Message::Pong(_))) => ActiveInput::Control,
-            Some(Ok(Message::Close(_))) | None | Some(Err(_)) => ActiveInput::Disconnect,
-            Some(Ok(Message::Text(_) | Message::Binary(_))) => ActiveInput::ProtocolViolation,
-        },
-    }
-}
-
-/// 使用连接级请求头和 Provider 上下文解码官方 `response.create` 文本帧。
-///
-/// 缺省 `stream` 等价于 WebSocket 固有的流式语义；显式 `false` 会被拒绝。
-///
-/// # Errors
-///
-/// 帧不是合法 JSON object、消息类型错误、显式关闭 stream，或 Responses 请求
-/// 无法映射到 canonical operation 时返回不包含正文内容的稳定错误。
-pub fn decode_response_create_with_context(
-    payload: &str,
-    request_headers: &OpenAiRequestHeaders,
-) -> Result<DecodedResponsesRequest, ResponseCreateFrameError> {
-    decode_response_create_inner(payload, request_headers)
-}
-
-fn decode_response_create_inner(
-    payload: &str,
-    request_headers: &OpenAiRequestHeaders,
-) -> Result<DecodedResponsesRequest, ResponseCreateFrameError> {
-    let Value::Object(mut body) = serde_json::from_str::<Value>(payload)
-        .map_err(|_| ResponseCreateFrameError::InvalidJson)?
-    else {
-        return Err(ResponseCreateFrameError::ExpectedObject);
-    };
-    match body.remove("type") {
-        Some(Value::String(message_type)) if message_type == "response.create" => {}
-        _ => return Err(ResponseCreateFrameError::UnsupportedType),
-    }
-    if matches!(body.get("stream"), Some(value) if value.as_bool() != Some(true)) {
-        return Err(ResponseCreateFrameError::StreamingRequired);
-    }
-    super::request::decode_request_object(body, false, request_headers)
-        .map_err(ResponseCreateFrameError::Request)
-}
-
-/// `response.create` 帧的稳定安全错误。
-#[derive(Debug, Clone, PartialEq, Eq, Error)]
-pub enum ResponseCreateFrameError {
-    /// 文本不是合法 JSON。
-    #[error("response.create frame must be valid JSON")]
-    InvalidJson,
-    /// 顶层不是 object。
-    #[error("response.create frame must be a JSON object")]
-    ExpectedObject,
-    /// `type` 缺失或不是 `response.create`。
-    #[error("unsupported Responses WebSocket message type")]
-    UnsupportedType,
-    /// WebSocket 请求显式声明 `stream=false`。
-    #[error("Responses WebSocket requests require stream=true")]
-    StreamingRequired,
-    /// 内层 Responses 请求无法映射到 canonical operation。
-    #[error(transparent)]
-    Request(RequestDecodeError),
-}
-
-impl ResponseCreateFrameError {
-    fn protocol_body(&self) -> ProtocolErrorBody {
-        match self {
-            Self::Request(error) => error.protocol_body(),
-            Self::InvalidJson => RequestDecodeError::MalformedJson.protocol_body(),
-            Self::ExpectedObject => RequestDecodeError::ExpectedObject.protocol_body(),
-            Self::UnsupportedType => RequestDecodeError::InvalidValue {
-                field: "type".to_owned(),
-            }
-            .protocol_body(),
-            Self::StreamingRequired => RequestDecodeError::InvalidValue {
-                field: "stream".to_owned(),
-            }
-            .protocol_body(),
-        }
-    }
-}
-
-fn response_metadata_event(
-    request_id: &str,
-    response_headers: &[ProviderResponseHeader],
-) -> String {
-    let connection_options = super::response_connection_options(response_headers);
-    let mut headers = Map::new();
-    for header in response_headers {
-        if !super::response_header_is_forwardable(header.name(), &connection_options) {
-            continue;
-        }
-        let Ok(name) = HeaderName::from_bytes(header.name().as_bytes()) else {
-            continue;
-        };
-        let Ok(value) = std::str::from_utf8(header.value()) else {
-            continue;
-        };
-        // 官方 response.metadata 使用 string map，无法表达同名多值；后值保持既有覆盖语义。
-        headers.insert(name.as_str().to_owned(), Value::String(value.to_owned()));
-    }
-    headers
-        .entry("x-request-id".to_owned())
-        .or_insert_with(|| Value::String(request_id.to_owned()));
-    json!({
-        "type": "response.metadata",
-        "headers": headers,
-    })
-    .to_string()
-}
-
-async fn send_gateway_error(
-    socket: &mut WebSocket,
-    error: &GatewayError,
-    request_id: &str,
-) -> ForwardOutcome {
-    let (status, default_type, default_code) = gateway_error_contract(error.kind());
-    if send_error_event(
-        socket,
-        status,
-        error.client_error_type().unwrap_or(default_type),
-        error.client_error_code().unwrap_or(default_code),
-        error.client_message(),
-        None,
-        request_id,
-    )
-    .await
-    {
-        ForwardOutcome::Continue
-    } else {
-        ForwardOutcome::Disconnect
-    }
-}
-
-async fn send_protocol_error(
-    socket: &mut WebSocket,
-    status: StatusCode,
-    body: ProtocolErrorBody,
-    request_id: &str,
-) -> ForwardOutcome {
-    let error = body.error;
-    if send_error_event(
-        socket,
-        status,
-        error.kind,
-        error.code,
-        &error.message,
-        error.param.as_deref(),
-        request_id,
-    )
-    .await
-    {
-        ForwardOutcome::Continue
-    } else {
-        ForwardOutcome::Disconnect
-    }
-}
-
-async fn send_error_event(
-    socket: &mut WebSocket,
-    status: StatusCode,
-    error_type: &str,
-    code: &str,
-    message: &str,
-    param: Option<&str>,
-    request_id: &str,
-) -> bool {
-    let mut error = Map::new();
-    error.insert("type".to_owned(), Value::String(error_type.to_owned()));
-    error.insert("code".to_owned(), Value::String(code.to_owned()));
-    error.insert("message".to_owned(), Value::String(message.to_owned()));
-    if let Some(param) = param {
-        error.insert("param".to_owned(), Value::String(param.to_owned()));
-    }
-    send_text(
-        socket,
-        json!({
-            "type": "error",
-            "status": status.as_u16(),
-            "error": error,
-            "request_id": request_id,
-        })
-        .to_string(),
-    )
-    .await
-}
-
-async fn send_messages(socket: &mut WebSocket, messages: Vec<String>) -> bool {
-    for message in messages {
-        if !send_text(socket, message).await {
-            return false;
-        }
-    }
-    true
-}
-
-async fn send_text(socket: &mut WebSocket, payload: String) -> bool {
-    if let Err(error) = socket.send(Message::Text(payload.into())).await {
-        tracing::info!(error = %error, "Responses WebSocket send failed");
-        return false;
-    }
-    true
-}
-
-async fn close_for_protocol_violation(socket: &mut WebSocket, reason: &'static str) {
-    let _ = socket
-        .send(Message::Close(Some(CloseFrame {
-            code: close_code::POLICY,
-            reason: reason.into(),
-        })))
-        .await;
-}
@@ -0,0 +1,550 @@
+//! 下游客户端 WebSocket 的单 owner pump 与有界收发边界。
+
+use std::{
+    fmt,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use axum::extract::ws::{CloseFrame, Message, WebSocket, close_code};
+use futures::{Sink, SinkExt, Stream, StreamExt};
+use gateway_core::engine::CancellationToken;
+use thiserror::Error;
+use tokio::{
+    sync::{mpsc, oneshot},
+    task::JoinHandle,
+    time::{Instant, timeout},
+};
+
+const OUTBOUND_COMMAND_BUFFER: usize = 32;
+const INBOUND_EVENT_BUFFER: usize = 32;
+const DOWNSTREAM_WRITE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
+const CONNECTION_MAX_AGE: Duration = Duration::from_secs(60 * 60);
+
+#[derive(Clone, Copy)]
+pub(super) struct ConnectionConfig {
+    pub(super) write_timeout: Duration,
+    pub(super) max_age: Duration,
+}
+
+impl ConnectionConfig {
+    pub(super) const PRODUCTION: Self = Self {
+        write_timeout: DOWNSTREAM_WRITE_TIMEOUT,
+        max_age: CONNECTION_MAX_AGE,
+    };
+}
+
+/// 业务层可观察的客户端输入；Ping/Pong 始终由 pump 消费。
+pub(super) enum ConnectionEvent {
+    Text(String),
+    Binary,
+    Expired,
+    Exited(PumpExitReason),
+}
+
+/// 下游写入阶段；名称刻意使用 write，而不是暗示客户端已消费的 delivery。
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum FramePhase {
+    Metadata,
+    First,
+    Data,
+    Terminal,
+    FirstAndTerminal,
+    Error,
+    ConnectionLimit,
+    Close,
+}
+
+impl FramePhase {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Metadata => "metadata",
+            Self::First => "first",
+            Self::Data => "data",
+            Self::Terminal => "terminal",
+            Self::FirstAndTerminal => "first_and_terminal",
+            Self::Error => "error",
+            Self::ConnectionLimit => "connection_limit",
+            Self::Close => "close",
+        }
+    }
+
+    const fn is_milestone(self) -> bool {
+        matches!(
+            self,
+            Self::First
+                | Self::Terminal
+                | Self::FirstAndTerminal
+                | Self::Error
+                | Self::ConnectionLimit
+                | Self::Close
+        )
+    }
+}
+
+#[derive(Clone)]
+pub(super) struct WriteContext {
+    request_id: Option<Arc<str>>,
+    phase: FramePhase,
+}
+
+impl WriteContext {
+    pub(super) fn request(request_id: &Arc<str>, phase: FramePhase) -> Self {
+        Self {
+            request_id: Some(Arc::clone(request_id)),
+            phase,
+        }
+    }
+
+    pub(super) const fn connection(phase: FramePhase) -> Self {
+        Self {
+            request_id: None,
+            phase,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum PumpExitReason {
+    ClientClose,
+    PeerEof,
+    ReadError,
+    WriteError,
+    WriteTimeout,
+    LifecycleShutdown,
+    ConnectionMaxAge,
+    CoordinatorDropped,
+    InboundOverload,
+    ServerClose,
+    PumpStopped,
+}
+
+impl PumpExitReason {
+    pub(super) const fn as_str(self) -> &'static str {
+        match self {
+            Self::ClientClose => "client_close",
+            Self::PeerEof => "peer_eof",
+            Self::ReadError => "read_error",
+            Self::WriteError => "write_error",
+            Self::WriteTimeout => "write_timeout",
+            Self::LifecycleShutdown => "lifecycle_shutdown",
+            Self::ConnectionMaxAge => "connection_max_age",
+            Self::CoordinatorDropped => "coordinator_dropped",
+            Self::InboundOverload => "inbound_overload",
+            Self::ServerClose => "server_close",
+            Self::PumpStopped => "pump_stopped",
+        }
+    }
+}
+
+#[derive(Debug, Error)]
+pub(super) enum ConnectionWriteError {
+    #[error("downstream WebSocket pump is closed")]
+    Closed,
+    #[error("downstream WebSocket write timed out after {timeout:?}")]
+    Timeout { timeout: Duration },
+    #[error("downstream WebSocket transport write failed: {message}")]
+    Transport { message: String },
+}
+
+struct ConnectionCommand {
+    message: Message,
+    context: WriteContext,
+    acknowledged: oneshot::Sender<Result<(), ConnectionWriteError>>,
+}
+
+#[derive(Default)]
+struct ConnectionStats {
+    command_queue_high_water: AtomicUsize,
+    command_backpressure_count: AtomicU64,
+    ping_received_count: AtomicU64,
+    pong_written_count: AtomicU64,
+}
+
+impl ConnectionStats {
+    fn observe_command_queue(&self, sender: &mpsc::Sender<ConnectionCommand>) {
+        let queued = OUTBOUND_COMMAND_BUFFER
+            .saturating_sub(sender.capacity())
+            .saturating_add(1)
+            .min(OUTBOUND_COMMAND_BUFFER);
+        self.command_queue_high_water
+            .fetch_max(queued, Ordering::Relaxed);
+        if sender.capacity() == 0 {
+            self.command_backpressure_count
+                .fetch_add(1, Ordering::Relaxed);
+        }
+    }
+}
+
+pub(super) struct ResponsesWebSocketConnection {
+    connection_id: Arc<str>,
+    opened_at: Instant,
+    expired: Arc<AtomicBool>,
+    commands: Option<mpsc::Sender<ConnectionCommand>>,
+    incoming: mpsc::Receiver<ConnectionEvent>,
+    pump_task: Option<JoinHandle<()>>,
+    stats: Arc<ConnectionStats>,
+    config: ConnectionConfig,
+    exit_reason: Option<PumpExitReason>,
+}
+
+impl ResponsesWebSocketConnection {
+    pub(super) fn new(
+        socket: WebSocket,
+        connection_id: String,
+        cancellation: CancellationToken,
+    ) -> Self {
+        spawn_connection(
+            socket,
+            Arc::<str>::from(connection_id),
+            cancellation,
+            ConnectionConfig::PRODUCTION,
+        )
+    }
+
+    pub(super) fn id(&self) -> &str {
+        &self.connection_id
+    }
+
+    pub(super) fn is_expired(&self) -> bool {
+        self.expired.load(Ordering::Acquire)
+    }
+
+    pub(super) fn age(&self) -> Duration {
+        self.opened_at.elapsed()
+    }
+
+    pub(super) async fn next_event(&mut self) -> Option<ConnectionEvent> {
+        let event = self.incoming.recv().await;
+        if let Some(ConnectionEvent::Exited(reason)) = event.as_ref() {
+            self.exit_reason.get_or_insert(*reason);
+        } else if event.is_none() {
+            self.exit_reason.get_or_insert(PumpExitReason::PumpStopped);
+        }
+        event
+    }
+
+    pub(super) async fn send_text(
+        &mut self,
+        payload: String,
+        context: WriteContext,
+    ) -> Result<(), ConnectionWriteError> {
+        self.send(Message::Text(payload.into()), context).await
+    }
+
+    pub(super) async fn close_policy(
+        &mut self,
+        reason: &'static str,
+        request_id: Option<&Arc<str>>,
+    ) {
+        let context = request_id.map_or_else(
+            || WriteContext::connection(FramePhase::Close),
+            |request_id| WriteContext::request(request_id, FramePhase::Close),
+        );
+        self.close(
+            CloseFrame {
+                code: close_code::POLICY,
+                reason: reason.into(),
+            },
+            context,
+            PumpExitReason::ServerClose,
+        )
+        .await;
+    }
+
+    pub(super) async fn close_for_connection_limit(&mut self, reason: &'static str) {
+        self.close(
+            CloseFrame {
+                code: close_code::NORMAL,
+                reason: reason.into(),
+            },
+            WriteContext::connection(FramePhase::Close),
+            PumpExitReason::ConnectionMaxAge,
+        )
+        .await;
+    }
+
+    async fn close(
+        &mut self,
+        frame: CloseFrame,
+        context: WriteContext,
+        exit_reason: PumpExitReason,
+    ) {
+        if self
+            .send(Message::Close(Some(frame)), context)
+            .await
+            .is_ok()
+        {
+            self.exit_reason.get_or_insert(exit_reason);
+        }
+    }
+
+    async fn send(
+        &mut self,
+        message: Message,
+        context: WriteContext,
+    ) -> Result<(), ConnectionWriteError> {
+        let Some(commands) = self.commands.as_ref().cloned() else {
+            return Err(ConnectionWriteError::Closed);
+        };
+        self.stats.observe_command_queue(&commands);
+        let (acknowledged, acknowledgement) = oneshot::channel();
+        let started_at = Instant::now();
+        let request_id = context.request_id.clone();
+        let phase = context.phase;
+        let command = ConnectionCommand {
+            message,
+            context,
+            acknowledged,
+        };
+        let write = async move {
+            commands
+                .send(command)
+                .await
+                .map_err(|_| ConnectionWriteError::Closed)?;
+            acknowledgement
+                .await
+                .map_err(|_| ConnectionWriteError::Closed)?
+        };
+        let result = match timeout(self.config.write_timeout, write).await {
+            Ok(result) => result,
+            Err(_) => Err(ConnectionWriteError::Timeout {
+                timeout: self.config.write_timeout,
+            }),
+        };
+        let duration = started_at.elapsed();
+        match &result {
+            Ok(()) if phase.is_milestone() => tracing::info!(
+                websocket_connection_id = %self.connection_id,
+                request_id = request_id.as_deref().unwrap_or(""),
+                frame_phase = phase.as_str(),
+                write_duration_ms = duration.as_millis(),
+                "Responses WebSocket frame write succeeded"
+            ),
+            Ok(()) => tracing::debug!(
+                websocket_connection_id = %self.connection_id,
+                request_id = request_id.as_deref().unwrap_or(""),
+                frame_phase = phase.as_str(),
+                write_duration_ms = duration.as_millis(),
+                "Responses WebSocket frame write succeeded"
+            ),
+            Err(error) => tracing::info!(
+                websocket_connection_id = %self.connection_id,
+                request_id = request_id.as_deref().unwrap_or(""),
+                frame_phase = phase.as_str(),
+                write_duration_ms = duration.as_millis(),
+                error = %error,
+                "Responses WebSocket frame write failed"
+            ),
+        }
+        if let Err(error) = &result {
+            let reason = match error {
+                ConnectionWriteError::Timeout { .. } => PumpExitReason::WriteTimeout,
+                ConnectionWriteError::Transport { .. } => PumpExitReason::WriteError,
+                ConnectionWriteError::Closed => PumpExitReason::PumpStopped,
+            };
+            self.terminate(reason);
+        }
+        result
+    }
+
+    fn terminate(&mut self, reason: PumpExitReason) {
+        self.exit_reason.get_or_insert(reason);
+        self.commands.take();
+        if let Some(task) = self.pump_task.take() {
+            task.abort();
+        }
+    }
+
+    pub(super) fn log_summary(&self, request_count: u64) {
+        tracing::info!(
+            websocket_connection_id = %self.connection_id,
+            request_count,
+            connection_age_ms = self.age().as_millis(),
+            pump_exit_reason = self
+                .exit_reason
+                .map_or("unknown", PumpExitReason::as_str),
+            command_queue_high_water = self
+                .stats
+                .command_queue_high_water
+                .load(Ordering::Relaxed),
+            command_backpressure_count = self
+                .stats
+                .command_backpressure_count
+                .load(Ordering::Relaxed),
+            ping_received_count = self.stats.ping_received_count.load(Ordering::Relaxed),
+            pong_written_count = self.stats.pong_written_count.load(Ordering::Relaxed),
+            "Responses WebSocket disconnected"
+        );
+    }
+}
+
+impl Drop for ResponsesWebSocketConnection {
+    fn drop(&mut self) {
+        self.commands.take();
+        if let Some(task) = self.pump_task.take() {
+            task.abort();
+        }
+    }
+}
+
+pub(super) fn spawn_connection<S, E>(
+    socket: S,
+    connection_id: Arc<str>,
+    cancellation: CancellationToken,
+    config: ConnectionConfig,
+) -> ResponsesWebSocketConnection
+where
+    S: Stream<Item = Result<Message, E>> + Sink<Message, Error = E> + Unpin + Send + 'static,
+    E: fmt::Display + Send + 'static,
+{
+    let opened_at = Instant::now();
+    let expired = Arc::new(AtomicBool::new(false));
+    let stats = Arc::new(ConnectionStats::default());
+    let (command_tx, command_rx) = mpsc::channel(OUTBOUND_COMMAND_BUFFER);
+    let (incoming_tx, incoming_rx) = mpsc::channel(INBOUND_EVENT_BUFFER);
+    let pump_task = tokio::spawn(run_pump(
+        socket,
+        command_rx,
+        incoming_tx,
+        Arc::clone(&connection_id),
+        cancellation,
+        opened_at,
+        Arc::clone(&expired),
+        Arc::clone(&stats),
+        config,
+    ));
+    ResponsesWebSocketConnection {
+        connection_id,
+        opened_at,
+        expired,
+        commands: Some(command_tx),
+        incoming: incoming_rx,
+        pump_task: Some(pump_task),
+        stats,
+        config,
+        exit_reason: None,
+    }
+}
+
+#[expect(clippy::too_many_arguments)]
+async fn run_pump<S, E>(
+    mut socket: S,
+    mut commands: mpsc::Receiver<ConnectionCommand>,
+    incoming: mpsc::Sender<ConnectionEvent>,
+    connection_id: Arc<str>,
+    cancellation: CancellationToken,
+    opened_at: Instant,
+    expired: Arc<AtomicBool>,
+    stats: Arc<ConnectionStats>,
+    config: ConnectionConfig,
+) where
+    S: Stream<Item = Result<Message, E>> + Sink<Message, Error = E> + Unpin,
+    E: fmt::Display,
+{
+    let deadline = tokio::time::sleep_until(opened_at + config.max_age);
+    tokio::pin!(deadline);
+    let mut deadline_elapsed = false;
+    let reason = loop {
+        tokio::select! {
+            biased;
+            () = cancellation.cancelled() => break PumpExitReason::LifecycleShutdown,
+            () = &mut deadline, if !deadline_elapsed => {
+                deadline_elapsed = true;
+                expired.store(true, Ordering::Release);
+                if let Err(reason) = emit_incoming(&incoming, ConnectionEvent::Expired) {
+                    break reason;
+                }
+            }
+            command = commands.recv() => {
+                let Some(command) = command else {
+                    break PumpExitReason::CoordinatorDropped;
+                };
+                let ConnectionCommand {
+                    message,
+                    context,
+                    acknowledged,
+                } = command;
+                let closing = matches!(message, Message::Close(_));
+                let result = socket.send(message).await.map_err(|error| {
+                    let message = error.to_string();
+                    tracing::debug!(
+                        websocket_connection_id = %connection_id,
+                        request_id = context.request_id.as_deref().unwrap_or(""),
+                        frame_phase = context.phase.as_str(),
+                        error = %message,
+                        "Responses WebSocket pump transport write failed"
+                    );
+                    ConnectionWriteError::Transport { message }
+                });
+                let failed = result.is_err();
+                let _ = acknowledged.send(result);
+                if failed {
+                    break PumpExitReason::WriteError;
+                }
+                if closing {
+                    break PumpExitReason::ServerClose;
+                }
+            }
+            message = socket.next() => match message {
+                Some(Ok(Message::Text(payload))) => {
+                    if let Err(reason) = emit_incoming(&incoming, ConnectionEvent::Text(payload.to_string())) {
+                        break reason;
+                    }
+                }
+                Some(Ok(Message::Binary(_))) => {
+                    if let Err(reason) = emit_incoming(&incoming, ConnectionEvent::Binary) {
+                        break reason;
+                    }
+                }
+                Some(Ok(Message::Ping(payload))) => {
+                    stats.ping_received_count.fetch_add(1, Ordering::Relaxed);
+                    match timeout(config.write_timeout, socket.send(Message::Pong(payload))).await {
+                        Ok(Ok(())) => {
+                            stats.pong_written_count.fetch_add(1, Ordering::Relaxed);
+                        }
+                        Ok(Err(error)) => {
+                            tracing::info!(
+                                websocket_connection_id = %connection_id,
+                                error = %error,
+                                "Responses WebSocket Pong write failed"
+                            );
+                            break PumpExitReason::WriteError;
+                        }
+                        Err(_) => break PumpExitReason::WriteTimeout,
+                    }
+                }
+                Some(Ok(Message::Pong(_))) => {}
+                Some(Ok(Message::Close(_))) => break PumpExitReason::ClientClose,
+                Some(Err(error)) => {
+                    tracing::info!(
+                        websocket_connection_id = %connection_id,
+                        error = %error,
+                        "Responses WebSocket receive failed"
+                    );
+                    break PumpExitReason::ReadError;
+                }
+                None => break PumpExitReason::PeerEof,
+            },
+        }
+    };
+    let _ = incoming.try_send(ConnectionEvent::Exited(reason));
+    tracing::debug!(
+        websocket_connection_id = %connection_id,
+        pump_exit_reason = reason.as_str(),
+        "Responses WebSocket pump exited"
+    );
+}
+
+fn emit_incoming(
+    incoming: &mpsc::Sender<ConnectionEvent>,
+    event: ConnectionEvent,
+) -> Result<(), PumpExitReason> {
+    incoming.try_send(event).map_err(|error| match error {
+        mpsc::error::TrySendError::Full(_) => PumpExitReason::InboundOverload,
+        mpsc::error::TrySendError::Closed(_) => PumpExitReason::CoordinatorDropped,
+    })
+}
@@ -0,0 +1,482 @@
+//! 已启动 Responses execution 到客户端 WebSocket wire event 的串行转发。
+
+use std::sync::Arc;
+
+use axum::http::StatusCode;
+use gateway_core::engine::execution::StartedExecution;
+use gateway_core::engine::{CommitRequirement, CoordinatedEvent, EngineError};
+use gateway_core::error::{GatewayError, GatewayErrorKind};
+use gateway_core::operation::ProviderSessionState;
+use tokio::time::Instant;
+
+use crate::openai::error::{gateway_error_contract, gateway_error_from_engine};
+
+use super::{
+    super::{DecodedResponsesRequest, OpenAiResponsesEncoder, PendingExecution, ProtocolErrorBody},
+    connection::{ConnectionEvent, FramePhase, ResponsesWebSocketConnection, WriteContext},
+    protocol::{error_event, response_metadata_event},
+};
+
+const ACTIVE_RESPONSE_VIOLATION: &str = "Only one response.create may be active per connection";
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(super) enum ForwardOutcome {
+    Continue,
+    Disconnect,
+}
+
+#[derive(Default)]
+pub(super) struct ConnectionReplaySnapshot {
+    last_response_id: Option<String>,
+    provider_state: Option<ProviderSessionState>,
+}
+
+impl ConnectionReplaySnapshot {
+    pub(super) fn prepare(&self, request: DecodedResponsesRequest) -> DecodedResponsesRequest {
+        match (
+            request.metadata().continuation().previous_response_id(),
+            self.last_response_id.as_deref(),
+            self.provider_state.as_ref(),
+        ) {
+            (Some(previous), Some(last), Some(state)) if previous == last => {
+                request.with_provider_session_state(state.clone())
+            }
+            _ => request,
+        }
+    }
+
+    fn commit(&mut self, response_id: String, provider_state: Option<ProviderSessionState>) {
+        self.last_response_id = Some(response_id);
+        self.provider_state = provider_state;
+    }
+}
+
+pub(super) async fn forward_execution(
+    connection: &mut ResponsesWebSocketConnection,
+    started: StartedExecution,
+    replay: &mut ConnectionReplaySnapshot,
+) -> ForwardOutcome {
+    let request_id = Arc::<str>::from(started.request_id.to_string());
+    let streaming = started.stream;
+    let mut execution = PendingExecution::new(started.session);
+    if !streaming {
+        let error = GatewayError::new(
+            GatewayErrorKind::Internal,
+            "WebSocket execution was not initialized as a stream",
+        );
+        return send_gateway_error(connection, &error, &request_id).await;
+    }
+    let first = loop {
+        match next_active_input(connection, &mut execution).await {
+            ActiveInput::Event(Ok(Some(event))) => break event,
+            ActiveInput::Event(Ok(None)) => {
+                let error = GatewayError::new(
+                    GatewayErrorKind::Internal,
+                    "gateway response ended before its first event",
+                );
+                return send_gateway_error(connection, &error, &request_id).await;
+            }
+            ActiveInput::Event(Err(error)) => {
+                let error = gateway_error_from_engine(&error);
+                return send_gateway_error(connection, &error, &request_id).await;
+            }
+            ActiveInput::Control => continue,
+            ActiveInput::Disconnect => return ForwardOutcome::Disconnect,
+            ActiveInput::ProtocolViolation => {
+                connection
+                    .close_policy(ACTIVE_RESPONSE_VIOLATION, Some(&request_id))
+                    .await;
+                return ForwardOutcome::Disconnect;
+            }
+        }
+    };
+    let requirement = first.commit_requirement();
+    let mut first = first.into_provider_events();
+    if requirement != CommitRequirement::CommitBeforeDelivery {
+        let error = GatewayError::new(
+            GatewayErrorKind::Internal,
+            "gateway first event did not require commit",
+        );
+        return send_gateway_error(connection, &error, &request_id).await;
+    }
+    let mut encoder = OpenAiResponsesEncoder::new();
+    let mut provider_state = None;
+    let mut first_messages = Vec::new();
+    for event in &mut first {
+        if let Some(update) = event.take_session_update() {
+            provider_state = Some(update);
+        }
+        first_messages.extend(encoder.push_websocket(event));
+    }
+    if first_messages.is_empty() {
+        let error = GatewayError::new(
+            GatewayErrorKind::Internal,
+            "gateway commit batch encoded no output",
+        );
+        return send_gateway_error(connection, &error, &request_id).await;
+    }
+    let Some(response_session) = execution.session_mut() else {
+        return ForwardOutcome::Disconnect;
+    };
+    let response_headers = response_session.response_headers().to_vec();
+    if let Err(error) = response_session.commit_downstream(None).await {
+        let error = gateway_error_from_engine(&error);
+        return send_gateway_error(connection, &error, &request_id).await;
+    }
+    let mut first_frame_written = false;
+    if encoder.is_completed() {
+        if let Err(outcome) =
+            confirm_completed_execution(connection, &mut execution, &request_id).await
+        {
+            return outcome;
+        }
+        let provider_terminal_at = Instant::now();
+        commit_connection_replay(replay, &encoder, provider_state.take());
+        let writes_succeeded = send_metadata(
+            connection,
+            &request_id,
+            response_metadata_event(&request_id, &response_headers),
+        )
+        .await
+            && send_messages(
+                connection,
+                first_messages,
+                &request_id,
+                &mut first_frame_written,
+                true,
+            )
+            .await;
+        if !writes_succeeded {
+            log_terminal_write_failure(connection, &request_id, provider_terminal_at.elapsed());
+            return ForwardOutcome::Disconnect;
+        }
+        log_terminal_write_success(connection, &request_id, provider_terminal_at.elapsed());
+        execution.disarm();
+        return ForwardOutcome::Continue;
+    }
+    if !send_metadata(
+        connection,
+        &request_id,
+        response_metadata_event(&request_id, &response_headers),
+    )
+    .await
+        || !send_messages(
+            connection,
+            first_messages,
+            &request_id,
+            &mut first_frame_written,
+            encoder.has_wire_failure(),
+        )
+        .await
+    {
+        return ForwardOutcome::Disconnect;
+    }
+
+    loop {
+        match next_active_input(connection, &mut execution).await {
+            ActiveInput::Event(Ok(Some(delivery))) => {
+                let requirement = delivery.commit_requirement();
+                let mut events = delivery.into_provider_events();
+                if requirement != CommitRequirement::AlreadyCommitted {
+                    let error = GatewayError::new(
+                        GatewayErrorKind::Internal,
+                        "gateway requested another downstream commit",
+                    );
+                    return send_gateway_error(connection, &error, &request_id).await;
+                }
+                let mut messages = Vec::new();
+                for event in &mut events {
+                    if let Some(update) = event.take_session_update() {
+                        provider_state = Some(update);
+                    }
+                    messages.extend(encoder.push_websocket(event));
+                }
+                if encoder.is_completed() {
+                    if let Err(outcome) =
+                        confirm_completed_execution(connection, &mut execution, &request_id).await
+                    {
+                        return outcome;
+                    }
+                    let provider_terminal_at = Instant::now();
+                    commit_connection_replay(replay, &encoder, provider_state.take());
+                    if !send_messages(
+                        connection,
+                        messages,
+                        &request_id,
+                        &mut first_frame_written,
+                        true,
+                    )
+                    .await
+                    {
+                        log_terminal_write_failure(
+                            connection,
+                            &request_id,
+                            provider_terminal_at.elapsed(),
+                        );
+                        return ForwardOutcome::Disconnect;
+                    }
+                    log_terminal_write_success(
+                        connection,
+                        &request_id,
+                        provider_terminal_at.elapsed(),
+                    );
+                    execution.disarm();
+                    return ForwardOutcome::Continue;
+                }
+                let terminal_batch = encoder.has_wire_failure();
+                if !send_messages(
+                    connection,
+                    messages,
+                    &request_id,
+                    &mut first_frame_written,
+                    terminal_batch,
+                )
+                .await
+                {
+                    return ForwardOutcome::Disconnect;
+                }
+            }
+            ActiveInput::Event(Ok(None)) => {
+                if execution
+                    .session_mut()
+                    .is_some_and(|session| session.is_finalized())
+                {
+                    commit_connection_replay(replay, &encoder, provider_state.take());
+                    execution.disarm();
+                    return ForwardOutcome::Continue;
+                }
+                let error = GatewayError::new(
+                    GatewayErrorKind::Internal,
+                    "gateway response ended without finalizing the execution",
+                );
+                return send_gateway_error(connection, &error, &request_id).await;
+            }
+            ActiveInput::Event(Err(error)) => {
+                if encoder.has_wire_failure() {
+                    execution.disarm();
+                    return ForwardOutcome::Continue;
+                }
+                let error = gateway_error_from_engine(&error);
+                return send_gateway_error(connection, &error, &request_id).await;
+            }
+            ActiveInput::Control => {}
+            ActiveInput::Disconnect => return ForwardOutcome::Disconnect,
+            ActiveInput::ProtocolViolation => {
+                connection
+                    .close_policy(ACTIVE_RESPONSE_VIOLATION, Some(&request_id))
+                    .await;
+                return ForwardOutcome::Disconnect;
+            }
+        }
+    }
+}
+
+fn commit_connection_replay(
+    replay: &mut ConnectionReplaySnapshot,
+    encoder: &OpenAiResponsesEncoder,
+    provider_state: Option<ProviderSessionState>,
+) {
+    if let Some(response_id) = encoder.response_id() {
+        replay.commit(response_id.to_owned(), provider_state);
+    }
+}
+
+async fn confirm_completed_execution(
+    connection: &mut ResponsesWebSocketConnection,
+    execution: &mut PendingExecution,
+    request_id: &Arc<str>,
+) -> Result<(), ForwardOutcome> {
+    loop {
+        match next_active_input(connection, execution).await {
+            ActiveInput::Event(Ok(None))
+                if execution
+                    .session_mut()
+                    .is_some_and(|session| session.is_finalized()) =>
+            {
+                return Ok(());
+            }
+            ActiveInput::Event(Ok(None)) => {
+                let error = GatewayError::new(
+                    GatewayErrorKind::Internal,
+                    "gateway response was not finalized after its terminal event",
+                );
+                return Err(send_gateway_error(connection, &error, request_id).await);
+            }
+            ActiveInput::Event(Ok(Some(_))) => {
+                let error = GatewayError::new(
+                    GatewayErrorKind::Internal,
+                    "gateway response continued after its terminal event",
+                );
+                return Err(send_gateway_error(connection, &error, request_id).await);
+            }
+            ActiveInput::Event(Err(error)) => {
+                let error = gateway_error_from_engine(&error);
+                return Err(send_gateway_error(connection, &error, request_id).await);
+            }
+            ActiveInput::Control => {}
+            ActiveInput::Disconnect => return Err(ForwardOutcome::Disconnect),
+            ActiveInput::ProtocolViolation => {
+                connection
+                    .close_policy(ACTIVE_RESPONSE_VIOLATION, Some(request_id))
+                    .await;
+                return Err(ForwardOutcome::Disconnect);
+            }
+        }
+    }
+}
+
+enum ActiveInput {
+    Event(Result<Option<CoordinatedEvent>, EngineError>),
+    Control,
+    Disconnect,
+    ProtocolViolation,
+}
+
+async fn next_active_input(
+    connection: &mut ResponsesWebSocketConnection,
+    execution: &mut PendingExecution,
+) -> ActiveInput {
+    let Some(session) = execution.session_mut() else {
+        return ActiveInput::Disconnect;
+    };
+    tokio::select! {
+        event = session.next_event() => ActiveInput::Event(event),
+        message = connection.next_event() => match message {
+            Some(ConnectionEvent::Expired) => ActiveInput::Control,
+            Some(ConnectionEvent::Text(_) | ConnectionEvent::Binary) => {
+                ActiveInput::ProtocolViolation
+            }
+            Some(ConnectionEvent::Exited(_)) | None => ActiveInput::Disconnect,
+        },
+    }
+}
+
+pub(super) async fn send_gateway_error(
+    connection: &mut ResponsesWebSocketConnection,
+    error: &GatewayError,
+    request_id: &Arc<str>,
+) -> ForwardOutcome {
+    let (status, default_type, default_code) = gateway_error_contract(error.kind());
+    send_error(
+        connection,
+        status,
+        error.client_error_type().unwrap_or(default_type),
+        error.client_error_code().unwrap_or(default_code),
+        error.client_message(),
+        None,
+        request_id,
+    )
+    .await
+}
+
+pub(super) async fn send_protocol_error(
+    connection: &mut ResponsesWebSocketConnection,
+    status: StatusCode,
+    body: ProtocolErrorBody,
+    request_id: &Arc<str>,
+) -> ForwardOutcome {
+    let error = body.error;
+    send_error(
+        connection,
+        status,
+        error.kind,
+        error.code,
+        &error.message,
+        error.param.as_deref(),
+        request_id,
+    )
+    .await
+}
+
+async fn send_error(
+    connection: &mut ResponsesWebSocketConnection,
+    status: StatusCode,
+    error_type: &str,
+    code: &str,
+    message: &str,
+    param: Option<&str>,
+    request_id: &Arc<str>,
+) -> ForwardOutcome {
+    if connection
+        .send_text(
+            error_event(status, error_type, code, message, param, Some(request_id)),
+            WriteContext::request(request_id, FramePhase::Error),
+        )
+        .await
+        .is_ok()
+    {
+        ForwardOutcome::Continue
+    } else {
+        ForwardOutcome::Disconnect
+    }
+}
+
+async fn send_metadata(
+    connection: &mut ResponsesWebSocketConnection,
+    request_id: &Arc<str>,
+    message: String,
+) -> bool {
+    connection
+        .send_text(
+            message,
+            WriteContext::request(request_id, FramePhase::Metadata),
+        )
+        .await
+        .is_ok()
+}
+
+async fn send_messages(
+    connection: &mut ResponsesWebSocketConnection,
+    messages: Vec<String>,
+    request_id: &Arc<str>,
+    first_frame_written: &mut bool,
+    terminal_batch: bool,
+) -> bool {
+    let message_count = messages.len();
+    for (index, message) in messages.into_iter().enumerate() {
+        let is_terminal = terminal_batch && index + 1 == message_count;
+        let phase = match (*first_frame_written, is_terminal) {
+            (false, true) => FramePhase::FirstAndTerminal,
+            (false, false) => FramePhase::First,
+            (true, true) => FramePhase::Terminal,
+            (true, false) => FramePhase::Data,
+        };
+        if connection
+            .send_text(message, WriteContext::request(request_id, phase))
+            .await
+            .is_err()
+        {
+            return false;
+        }
+        *first_frame_written = true;
+    }
+    true
+}
+
+fn log_terminal_write_success(
+    connection: &ResponsesWebSocketConnection,
+    request_id: &Arc<str>,
+    provider_terminal_to_write: std::time::Duration,
+) {
+    tracing::info!(
+        websocket_connection_id = connection.id(),
+        request_id = %request_id,
+        provider_terminal_to_terminal_write_ms = provider_terminal_to_write.as_millis(),
+        terminal_frame_written = true,
+        "Provider execution terminal was written to the WebSocket transport"
+    );
+}
+
+fn log_terminal_write_failure(
+    connection: &ResponsesWebSocketConnection,
+    request_id: &Arc<str>,
+    provider_terminal_to_write: std::time::Duration,
+) {
+    tracing::info!(
+        websocket_connection_id = connection.id(),
+        request_id = %request_id,
+        provider_terminal_to_terminal_write_ms = provider_terminal_to_write.as_millis(),
+        provider_succeeded_but_terminal_write_failed = true,
+        "Provider execution succeeded before the terminal WebSocket frame write failed"
+    );
+}
@@ -0,0 +1,248 @@
+//! OpenAI Responses WebSocket 的升级、连接与串行 session 编排。
+
+mod connection;
+mod forward;
+mod protocol;
+
+use std::{
+    net::{IpAddr, SocketAddr},
+    sync::Arc,
+};
+
+use axum::{
+    extract::{
+        Extension, State,
+        connect_info::ConnectInfo,
+        ws::{WebSocket, WebSocketUpgrade},
+    },
+    http::{HeaderMap, StatusCode},
+    response::{IntoResponse, Response},
+};
+use gateway_core::{
+    engine::execution::{AuthenticatedClient, ClientTransport},
+    lifecycle::{ConnectionGuard, ConnectionLifecycle},
+};
+
+use crate::{
+    ApiState,
+    openai::{
+        auth::{authenticate_client, authentication_error_response},
+        error::runtime_unavailable_response,
+        service::OpenAiService,
+    },
+};
+
+use super::{http::request_client_context, request::OpenAiRequestHeaders};
+use connection::{ConnectionEvent, FramePhase, ResponsesWebSocketConnection, WriteContext};
+use forward::{
+    ConnectionReplaySnapshot, ForwardOutcome, forward_execution, send_gateway_error,
+    send_protocol_error,
+};
+use protocol::connection_limit_event;
+pub use protocol::{ResponseCreateFrameError, decode_response_create_with_context};
+
+const TEXT_FRAMES_ONLY: &str = "Responses WebSocket accepts text frames only";
+const CONNECTION_LIMIT_CLOSE_REASON: &str = "Responses websocket connection limit reached";
+
+/// 将已认证的 `GET /v1/responses` 升级为 Responses WebSocket。
+pub(crate) async fn responses_websocket(
+    State(state): State<ApiState>,
+    connect_info: Option<Extension<ConnectInfo<SocketAddr>>>,
+    headers: HeaderMap,
+    websocket: WebSocketUpgrade,
+) -> Response {
+    let service = state.openai().clone();
+    let client = match authenticate_client(&service, &headers) {
+        Ok(client) => client,
+        Err(error) => return authentication_error_response(error),
+    };
+    let (client_ip, user_agent) = request_client_context(
+        &headers,
+        connect_info.map(|Extension(ConnectInfo(address))| address),
+    );
+    ResponsesWebSocketAdapter::new(service).upgrade_with_client_context(
+        websocket,
+        client,
+        client_ip,
+        user_agent,
+        OpenAiRequestHeaders::from_headers(&headers),
+    )
+}
+
+/// 已鉴权 Responses WebSocket 升级边界。
+#[derive(Clone)]
+pub(crate) struct ResponsesWebSocketAdapter {
+    service: OpenAiService,
+}
+
+impl ResponsesWebSocketAdapter {
+    /// 绑定应用提供的唯一 OpenAI 客户端服务端口。
+    #[must_use]
+    pub const fn new(service: OpenAiService) -> Self {
+        Self { service }
+    }
+
+    fn upgrade_with_client_context(
+        &self,
+        websocket: WebSocketUpgrade,
+        client: AuthenticatedClient,
+        client_ip: Option<IpAddr>,
+        user_agent: Option<String>,
+        request_headers: OpenAiRequestHeaders,
+    ) -> Response {
+        let connection_guard = match self.service.try_register_connection() {
+            Ok(guard) => guard,
+            Err(_) => return runtime_unavailable_response().into_response(),
+        };
+        let session = ResponsesWebSocketSession {
+            service: self.service.clone(),
+            client,
+            connection_id: self.service.next_request_id().replacen("req_", "ws_", 1),
+            client_ip,
+            user_agent,
+            request_headers,
+            lifecycle: self.service.lifecycle(),
+            connection_guard,
+        };
+        websocket
+            // 覆盖 axum/tungstenite 的私有 64 MiB message 与 16 MiB frame 默认值。
+            // Responses JSON 的协议可接受性由上游决定，代理不另设 wire 长度上限。
+            .max_message_size(usize::MAX)
+            .max_frame_size(usize::MAX)
+            .on_upgrade(move |socket| async move {
+                serve_responses_websocket(socket, session).await;
+            })
+    }
+}
+
+struct ResponsesWebSocketSession {
+    service: OpenAiService,
+    client: AuthenticatedClient,
+    connection_id: String,
+    client_ip: Option<IpAddr>,
+    user_agent: Option<String>,
+    request_headers: OpenAiRequestHeaders,
+    lifecycle: Arc<dyn ConnectionLifecycle>,
+    connection_guard: Box<dyn ConnectionGuard>,
+}
+
+async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocketSession) {
+    let ResponsesWebSocketSession {
+        service,
+        client,
+        connection_id,
+        client_ip,
+        user_agent,
+        request_headers,
+        lifecycle,
+        connection_guard,
+    } = session;
+    tracing::info!(
+        websocket_connection_id = %connection_id,
+        "Responses WebSocket connected"
+    );
+    let _connection_guard = connection_guard;
+    let cancellation = lifecycle.cancellation();
+    let mut connection = ResponsesWebSocketConnection::new(socket, connection_id, cancellation);
+    let mut request_count = 0_u64;
+    let mut replay = ConnectionReplaySnapshot::default();
+
+    loop {
+        let Some(event) = connection.next_event().await else {
+            break;
+        };
+        let payload = match event {
+            ConnectionEvent::Text(payload) => payload,
+            ConnectionEvent::Binary => {
+                connection.close_policy(TEXT_FRAMES_ONLY, None).await;
+                break;
+            }
+            ConnectionEvent::Expired => {
+                expire_connection(&mut connection).await;
+                break;
+            }
+            ConnectionEvent::Exited(_) => break,
+        };
+        if connection.is_expired() {
+            expire_connection(&mut connection).await;
+            break;
+        }
+        request_count = request_count.saturating_add(1);
+        let correlation_id = Arc::<str>::from(service.next_request_id());
+        let decoded = match decode_response_create_with_context(&payload, &request_headers) {
+            Ok(decoded) => decoded.with_client_context(client_ip, user_agent.clone()),
+            Err(error) => {
+                tracing::info!(
+                    websocket_connection_id = connection.id(),
+                    request_id = %correlation_id,
+                    error = %error,
+                    "Responses WebSocket request rejected"
+                );
+                if send_protocol_error(
+                    &mut connection,
+                    StatusCode::BAD_REQUEST,
+                    error.protocol_body(),
+                    &correlation_id,
+                )
+                .await
+                    == ForwardOutcome::Disconnect
+                {
+                    break;
+                }
+                continue;
+            }
+        };
+        let decoded = replay.prepare(decoded);
+        // deadline 与 Text 可能同时就绪；在任何上游执行开始前再次封住该竞争窗口。
+        if connection.is_expired() {
+            expire_connection(&mut connection).await;
+            break;
+        }
+        let started = match service
+            .start_response(
+                client.clone(),
+                decoded,
+                ClientTransport::WebSocket,
+                "/v1/responses",
+            )
+            .await
+        {
+            Ok(started) => started,
+            Err(error) => {
+                if send_gateway_error(&mut connection, &error, &correlation_id).await
+                    == ForwardOutcome::Disconnect
+                {
+                    break;
+                }
+                continue;
+            }
+        };
+
+        if forward_execution(&mut connection, started, &mut replay).await
+            == ForwardOutcome::Disconnect
+        {
+            break;
+        }
+        if connection.is_expired() {
+            expire_connection(&mut connection).await;
+            break;
+        }
+    }
+
+    connection.log_summary(request_count);
+}
+
+async fn expire_connection(connection: &mut ResponsesWebSocketConnection) {
+    if connection
+        .send_text(
+            connection_limit_event(),
+            WriteContext::connection(FramePhase::ConnectionLimit),
+        )
+        .await
+        .is_ok()
+    {
+        connection
+            .close_for_connection_limit(CONNECTION_LIMIT_CLOSE_REASON)
+            .await;
+    }
+}
@@ -0,0 +1,151 @@
+//! Responses WebSocket 入站请求与下行事件的纯协议映射。
+
+use axum::http::{HeaderName, StatusCode};
+use gateway_core::event::ProviderResponseHeader;
+use serde_json::{Map, Value, json};
+use thiserror::Error;
+
+use super::super::{
+    DecodedResponsesRequest, ProtocolErrorBody, RequestDecodeError, request::OpenAiRequestHeaders,
+};
+
+/// 使用连接级请求头和 Provider 上下文解码官方 `response.create` 文本帧。
+///
+/// 缺省 `stream` 等价于 WebSocket 固有的流式语义；显式 `false` 会被拒绝。
+///
+/// # Errors
+///
+/// 帧不是合法 JSON object、消息类型错误、显式关闭 stream，或 Responses 请求
+/// 无法映射到 canonical operation 时返回不包含正文内容的稳定错误。
+pub fn decode_response_create_with_context(
+    payload: &str,
+    request_headers: &OpenAiRequestHeaders,
+) -> Result<DecodedResponsesRequest, ResponseCreateFrameError> {
+    decode_response_create_inner(payload, request_headers)
+}
+
+fn decode_response_create_inner(
+    payload: &str,
+    request_headers: &OpenAiRequestHeaders,
+) -> Result<DecodedResponsesRequest, ResponseCreateFrameError> {
+    let Value::Object(mut body) = serde_json::from_str::<Value>(payload)
+        .map_err(|_| ResponseCreateFrameError::InvalidJson)?
+    else {
+        return Err(ResponseCreateFrameError::ExpectedObject);
+    };
+    match body.remove("type") {
+        Some(Value::String(message_type)) if message_type == "response.create" => {}
+        _ => return Err(ResponseCreateFrameError::UnsupportedType),
+    }
+    if matches!(body.get("stream"), Some(value) if value.as_bool() != Some(true)) {
+        return Err(ResponseCreateFrameError::StreamingRequired);
+    }
+    super::super::request::decode_request_object(body, false, request_headers)
+        .map_err(ResponseCreateFrameError::Request)
+}
+
+/// `response.create` 帧的稳定安全错误。
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum ResponseCreateFrameError {
+    /// 文本不是合法 JSON。
+    #[error("response.create frame must be valid JSON")]
+    InvalidJson,
+    /// 顶层不是 object。
+    #[error("response.create frame must be a JSON object")]
+    ExpectedObject,
+    /// `type` 缺失或不是 `response.create`。
+    #[error("unsupported Responses WebSocket message type")]
+    UnsupportedType,
+    /// WebSocket 请求显式声明 `stream=false`。
+    #[error("Responses WebSocket requests require stream=true")]
+    StreamingRequired,
+    /// 内层 Responses 请求无法映射到 canonical operation。
+    #[error(transparent)]
+    Request(RequestDecodeError),
+}
+
+impl ResponseCreateFrameError {
+    pub(super) fn protocol_body(&self) -> ProtocolErrorBody {
+        match self {
+            Self::Request(error) => error.protocol_body(),
+            Self::InvalidJson => RequestDecodeError::MalformedJson.protocol_body(),
+            Self::ExpectedObject => RequestDecodeError::ExpectedObject.protocol_body(),
+            Self::UnsupportedType => RequestDecodeError::InvalidValue {
+                field: "type".to_owned(),
+            }
+            .protocol_body(),
+            Self::StreamingRequired => RequestDecodeError::InvalidValue {
+                field: "stream".to_owned(),
+            }
+            .protocol_body(),
+        }
+    }
+}
+
+pub(super) fn response_metadata_event(
+    request_id: &str,
+    response_headers: &[ProviderResponseHeader],
+) -> String {
+    let connection_options = super::super::response_connection_options(response_headers);
+    let mut headers = Map::new();
+    for header in response_headers {
+        if !super::super::response_header_is_forwardable(header.name(), &connection_options) {
+            continue;
+        }
+        let Ok(name) = HeaderName::from_bytes(header.name().as_bytes()) else {
+            continue;
+        };
+        let Ok(value) = std::str::from_utf8(header.value()) else {
+            continue;
+        };
+        // 官方 response.metadata 使用 string map，无法表达同名多值；后值保持既有覆盖语义。
+        headers.insert(name.as_str().to_owned(), Value::String(value.to_owned()));
+    }
+    headers
+        .entry("x-request-id".to_owned())
+        .or_insert_with(|| Value::String(request_id.to_owned()));
+    json!({
+        "type": "response.metadata",
+        "headers": headers,
+    })
+    .to_string()
+}
+
+pub(super) fn error_event(
+    status: StatusCode,
+    error_type: &str,
+    code: &str,
+    message: &str,
+    param: Option<&str>,
+    request_id: Option<&str>,
+) -> String {
+    let mut error = Map::new();
+    error.insert("type".to_owned(), Value::String(error_type.to_owned()));
+    error.insert("code".to_owned(), Value::String(code.to_owned()));
+    error.insert("message".to_owned(), Value::String(message.to_owned()));
+    if let Some(param) = param {
+        error.insert("param".to_owned(), Value::String(param.to_owned()));
+    }
+    let mut event = Map::new();
+    event.insert("type".to_owned(), Value::String("error".to_owned()));
+    event.insert("status".to_owned(), Value::Number(status.as_u16().into()));
+    event.insert("error".to_owned(), Value::Object(error));
+    if let Some(request_id) = request_id {
+        event.insert(
+            "request_id".to_owned(),
+            Value::String(request_id.to_owned()),
+        );
+    }
+    Value::Object(event).to_string()
+}
+
+pub(super) fn connection_limit_event() -> String {
+    error_event(
+        StatusCode::BAD_REQUEST,
+        "invalid_request_error",
+        "websocket_connection_limit_reached",
+        "Responses websocket connection limit reached (60 minutes). Create a new websocket connection to continue.",
+        None,
+        None,
+    )
+}
@@ -40,7 +40,10 @@ async fn list_route_should_keep_camel_case_group_and_page_wire() {
    assert_eq!(value["data"]["items"][0]["capacity"]["usedSlots"], 0);
    assert_eq!(value["data"]["items"][0]["capacity"]["totalSlots"], 1);
    assert_eq!(value["data"]["items"][0]["usage"]["todayUsd"], "1.25");
-    assert_eq!(value["data"]["items"][0]["usage"]["totalUsd"], "5.5");
+    assert_eq!(
+        value["data"]["items"][0]["usage"]["retainedTotalUsd"],
+        "5.5"
+    );
    assert!(value["data"]["items"][0].get("member_count").is_none());
 }

@@ -70,6 +70,72 @@ mod query {
    }
 }

+mod profile_statistics {
+    use chrono::NaiveDate;
+    use gateway_admin::model::provider_credentials::{
+        ProviderProfileActivityInsights, ProviderProfileDailyUsage, ProviderProfileInvocation,
+        ProviderProfileStatistics, ProviderProfileStatisticsSummary,
+    };
+    use gateway_api::admin::accounts::AccountProfileStatisticsData;
+    use serde_json::json;
+
+    #[test]
+    fn profile_statistics_response_preserves_nullable_official_fields() {
+        let response = AccountProfileStatisticsData::from(ProviderProfileStatistics {
+            display_name: Some("Ada".to_owned()),
+            username: Some("ada".to_owned()),
+            image_url: Some("https://example.test/avatar.png".to_owned()),
+            has_stats_error: false,
+            summary: ProviderProfileStatisticsSummary {
+                total_text_tokens: Some(409_500_000),
+                peak_tokens: Some(267_000_000),
+                longest_task_duration_ms: Some(51_900_000),
+                current_streak_days: Some(16),
+                longest_streak_days: Some(32),
+            },
+            daily_usage: Some(vec![ProviderProfileDailyUsage {
+                date: NaiveDate::from_ymd_opt(2026, 8, 25).expect("usage date"),
+                tokens: 42,
+            }]),
+            activity_insights: ProviderProfileActivityInsights {
+                fast_mode_percent: Some(0.0),
+                reasoning_effort: Some("high".to_owned()),
+                reasoning_effort_percent: Some(48.0),
+                skills_explored: Some(8),
+                total_skills_used: Some(61),
+                total_threads: Some(2_391),
+                invocations: Some(vec![ProviderProfileInvocation {
+                    invocation_type: "plugin".to_owned(),
+                    plugin_id: Some("plugin_1".to_owned()),
+                    plugin_name: Some("example".to_owned()),
+                    skill_id: None,
+                    skill_name: None,
+                    usage_count: Some(29),
+                }]),
+            },
+        });
+        let value = serde_json::to_value(response).expect("serialize profile statistics");
+
+        assert_eq!(value["displayName"], "Ada");
+        assert_eq!(value["summary"]["totalTextTokens"], 409_500_000);
+        assert_eq!(
+            value["dailyUsage"][0],
+            json!({"date": "2026-08-25", "tokens": 42})
+        );
+        assert_eq!(
+            value["activityInsights"]["invocations"][0]["type"],
+            "plugin"
+        );
+        assert_eq!(
+            value["activityInsights"]["invocations"][0]["usageCount"],
+            29
+        );
+        assert!(value.get("cycle").is_none());
+        assert!(value.get("models").is_none());
+        assert!(value.get("estimatedCost").is_none());
+    }
+}
+
 mod batch_update {
    use gateway_api::admin::accounts::{BatchUpdateAccountsRequest, UpdateAccountRequest};
    use serde_json::json;
@@ -269,7 +335,12 @@ mod actions {
        AccountResetCreditConsumeRequest, AccountTestQuery, CompleteAccountAuthorizationRequest,
        RotateAccountRequest, StartAccountAuthorizationRequest,
    };
-    use gateway_core::engine::credential::ProviderAccountId;
+    use gateway_core::{
+        engine::{
+            UpstreamSendState, credential::ProviderAccountId, probe::AccountProbeErrorSource,
+        },
+        error::GatewayErrorKind,
+    };
    use serde_json::json;

    #[test]
@@ -554,6 +625,9 @@ mod actions {
            },
            DomainConnectionTestEvent::Completed {},
            DomainConnectionTestEvent::Failed {
+                source: AccountProbeErrorSource::Upstream,
+                gateway_error_code: GatewayErrorKind::RateLimited,
+                send_state: Some(UpstreamSendState::Sent),
                message: "upstream unavailable".to_owned(),
                provider_error_code: Some("usage_exhausted".to_owned()),
                provider_error_type: Some("invalid_request_error".to_owned()),
@@ -587,6 +661,9 @@ mod actions {
                json!({ "type": "test_complete", "success": true }),
                json!({
                    "type": "error",
+                    "source": "upstream",
+                    "gatewayErrorCode": "rate_limited",
+                    "sendState": "sent",
                    "error": "upstream unavailable",
                    "providerErrorCode": "usage_exhausted",
                    "providerErrorType": "invalid_request_error",
@@ -0,0 +1,320 @@
+use axum::{
+    Router,
+    body::{Body, to_bytes},
+    http::{Method, Request, StatusCode, header},
+};
+use gateway_api::admin;
+use serde_json::{Value, json};
+use tower::ServiceExt as _;
+
+use super::{AdminTestFixture, AdminTestState};
+
+const SESSION_COOKIE: &str = "cpr_admin_session=valid-session";
+
+fn app(state: AdminTestState) -> Router {
+    admin::router::<AdminTestState>().with_state(state)
+}
+
+fn request(method: Method, uri: &str, body: Body) -> Request<Body> {
+    Request::builder()
+        .method(method)
+        .uri(uri)
+        .header("x-request-id", "req_admin_errors")
+        .body(body)
+        .expect("build admin error request")
+}
+
+async fn response_json(response: axum::response::Response) -> (StatusCode, String, Value) {
+    let status = response.status();
+    let content_type = response
+        .headers()
+        .get(header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or_default()
+        .to_owned();
+    let body = to_bytes(response.into_body(), 64 * 1024)
+        .await
+        .expect("read admin error response body");
+    let body = serde_json::from_slice(&body).expect("parse admin error response JSON");
+    (status, content_type, body)
+}
+
+#[tokio::test]
+async fn malformed_login_json_should_use_the_admin_error_envelope() {
+    let fixture = AdminTestFixture::new().await;
+    let mut request = request(
+        Method::POST,
+        "/api/admin/auth/login",
+        Body::from(r#"{"password":"secret""#),
+    );
+    request
+        .headers_mut()
+        .insert(header::CONTENT_TYPE, "application/json".parse().unwrap());
+
+    let response = app(fixture.state())
+        .oneshot(request)
+        .await
+        .expect("malformed JSON response");
+    let actual = response_json(response).await;
+
+    assert_eq!(
+        actual,
+        (
+            StatusCode::BAD_REQUEST,
+            "application/json".to_owned(),
+            json!({
+                "code": 40000,
+                "message": "请求体不是合法 JSON",
+                "data": null
+            })
+        )
+    );
+}
+
+#[tokio::test]
+async fn invalid_login_json_data_should_not_echo_the_submitted_value() {
+    let fixture = AdminTestFixture::new().await;
+    let submitted = "password-must-not-leak";
+    let mut request = request(
+        Method::POST,
+        "/api/admin/auth/login",
+        Body::from(json!({ "password": submitted, "rememberMe": true }).to_string()),
+    );
+    request
+        .headers_mut()
+        .insert(header::CONTENT_TYPE, "application/json".parse().unwrap());
+
+    let response = app(fixture.state())
+        .oneshot(request)
+        .await
+        .expect("invalid JSON data response");
+    let actual = response_json(response).await;
+
+    assert_eq!(
+        actual,
+        (
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "application/json".to_owned(),
+            json!({
+                "code": 40001,
+                "message": "请求字段不合法",
+                "data": null
+            })
+        )
+    );
+    assert!(!actual.2.to_string().contains(submitted));
+}
+
+#[tokio::test]
+async fn login_without_json_content_type_should_keep_415_with_an_admin_envelope() {
+    let fixture = AdminTestFixture::new().await;
+    let response = app(fixture.state())
+        .oneshot(request(
+            Method::POST,
+            "/api/admin/auth/login",
+            Body::from(json!({ "password": "secret" }).to_string()),
+        ))
+        .await
+        .expect("missing JSON content type response");
+    let actual = response_json(response).await;
+
+    assert_eq!(
+        actual,
+        (
+            StatusCode::UNSUPPORTED_MEDIA_TYPE,
+            "application/json".to_owned(),
+            json!({
+                "code": 40001,
+                "message": "请求必须使用 application/json",
+                "data": null
+            })
+        )
+    );
+}
+
+#[tokio::test]
+async fn malformed_admin_query_should_use_a_safe_bad_request_envelope() {
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let mut request = request(
+        Method::GET,
+        "/api/admin/usage/records?page=not-a-number",
+        Body::empty(),
+    );
+    request
+        .headers_mut()
+        .insert(header::COOKIE, SESSION_COOKIE.parse().unwrap());
+
+    let response = app(fixture.state())
+        .oneshot(request)
+        .await
+        .expect("invalid query response");
+    let actual = response_json(response).await;
+
+    assert_eq!(
+        actual,
+        (
+            StatusCode::BAD_REQUEST,
+            "application/json".to_owned(),
+            json!({
+                "code": 40001,
+                "message": "请求参数不合法",
+                "data": null
+            })
+        )
+    );
+}
+
+#[tokio::test]
+async fn invalid_time_range_should_use_its_published_business_code() {
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let mut request = request(
+        Method::GET,
+        "/api/admin/dashboard/summary?startTime=not-a-time",
+        Body::empty(),
+    );
+    request
+        .headers_mut()
+        .insert(header::COOKIE, SESSION_COOKIE.parse().unwrap());
+
+    let response = app(fixture.state())
+        .oneshot(request)
+        .await
+        .expect("invalid time range response");
+    let actual = response_json(response).await;
+
+    assert_eq!(
+        actual,
+        (
+            StatusCode::BAD_REQUEST,
+            "application/json".to_owned(),
+            json!({
+                "code": 40002,
+                "message": "时间范围不合法",
+                "data": null
+            })
+        )
+    );
+}
+
+#[tokio::test]
+async fn unknown_admin_path_should_not_fall_through_to_the_spa() {
+    let fixture = AdminTestFixture::new().await;
+    let response = app(fixture.state())
+        .oneshot(request(
+            Method::GET,
+            "/api/admin/not-a-real-route",
+            Body::empty(),
+        ))
+        .await
+        .expect("unknown admin path response");
+    let actual = response_json(response).await;
+
+    assert_eq!(
+        actual,
+        (
+            StatusCode::NOT_FOUND,
+            "application/json".to_owned(),
+            json!({
+                "code": 40401,
+                "message": "管理接口不存在",
+                "data": null
+            })
+        )
+    );
+}
+
+#[tokio::test]
+async fn unsupported_admin_method_should_keep_allow_and_return_an_envelope() {
+    let fixture = AdminTestFixture::new().await;
+    let response = app(fixture.state())
+        .oneshot(request(
+            Method::POST,
+            "/api/admin/auth/status",
+            Body::empty(),
+        ))
+        .await
+        .expect("unsupported admin method response");
+    let allow = response
+        .headers()
+        .get(header::ALLOW)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or_default()
+        .to_owned();
+    let actual = response_json(response).await;
+
+    assert_eq!(
+        (allow, actual),
+        (
+            "GET,HEAD".to_owned(),
+            (
+                StatusCode::METHOD_NOT_ALLOWED,
+                "application/json".to_owned(),
+                json!({
+                    "code": 40001,
+                    "message": "请求方法不受支持",
+                    "data": null
+                })
+            )
+        )
+    );
+}
+
+#[tokio::test]
+async fn admin_auth_failures_should_use_stable_chinese_contracts() {
+    let fixture = AdminTestFixture::new().await;
+    let unauthenticated = app(fixture.state())
+        .clone()
+        .oneshot(request(Method::GET, "/api/admin/accounts", Body::empty()))
+        .await
+        .expect("missing session response");
+    let mut invalid_api_key = request(Method::GET, "/api/admin/accounts", Body::empty());
+    invalid_api_key
+        .headers_mut()
+        .insert("x-api-key", "admin-invalid".parse().unwrap());
+    let invalid_api_key = app(fixture.state())
+        .clone()
+        .oneshot(invalid_api_key)
+        .await
+        .expect("invalid API key response");
+    let mut invalid_login = request(
+        Method::POST,
+        "/api/admin/auth/login",
+        Body::from(json!({ "password": "wrong-password" }).to_string()),
+    );
+    invalid_login
+        .headers_mut()
+        .insert(header::CONTENT_TYPE, "application/json".parse().unwrap());
+    let invalid_login = app(fixture.state())
+        .oneshot(invalid_login)
+        .await
+        .expect("invalid credentials response");
+
+    let actual = [
+        response_json(unauthenticated).await,
+        response_json(invalid_login).await,
+        response_json(invalid_api_key).await,
+    ];
+
+    assert_eq!(
+        actual.map(|(status, _, body)| (status, body["code"].clone(), body["message"].clone())),
+        [
+            (
+                StatusCode::UNAUTHORIZED,
+                json!(40101),
+                json!("需要管理员登录")
+            ),
+            (
+                StatusCode::UNAUTHORIZED,
+                json!(40102),
+                json!("管理员用户名或密码错误")
+            ),
+            (
+                StatusCode::UNAUTHORIZED,
+                json!(40103),
+                json!("管理 API Key 无效")
+            ),
+        ]
+    );
+}
@@ -15,14 +15,14 @@ use gateway_admin::{
        MutationContext, Revision,
        account_groups::{
            AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupColor,
-            AccountGroupListQuery, AccountGroupMutation, AccountGroupPage, AccountGroupRecord,
-            AccountGroupUsage, DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled,
-            UpdateAccountGroup,
+            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
+            AccountGroupRecord, AccountGroupUsage, DeleteAccountGroup, NewAccountGroup,
+            SetAccountGroupEnabled, UpdateAccountGroup,
        },
        accounts::{
-            AccountListQuery, AccountPage, AccountPageItem, AccountUpdateResult, AccountUsage,
-            AccountUsageWindowQuery, AccountUsageWindowResult, AccountsUpdateResult,
-            BatchUpdateAccounts, DeleteAccounts, UpdateAccount,
+            AccountListQuery, AccountPage, AccountPageItem, AccountRuntimeSnapshot,
+            AccountUpdateResult, AccountUsage, AccountUsageWindowQuery, AccountUsageWindowResult,
+            AccountsUpdateResult, BatchUpdateAccounts, DeleteAccounts, UpdateAccount,
        },
        auth::{AdminAuditEvent, AdminSession},
        client_keys::{
@@ -32,7 +32,7 @@ use gateway_admin::{
        observability::{
            DashboardObservation, DecimalAmount, DiagnosticDimension, DiagnosticObservation,
            OpsError, OpsErrorPage, OpsErrorQuery, RequestMetricPoint, TimeRange, UsageDetail,
-            UsageFilter, UsageOverview, UsagePage, UsageQuery, UsageRecord,
+            UsageFilter, UsageListRecord, UsageOverview, UsagePage, UsageQuery,
        },
        provider_credentials::{
            AuthorizationCommit, AuthorizationStarted, CompleteAuthorization, CredentialDetails,
@@ -52,8 +52,9 @@ use gateway_admin::{
    ports::{
        provider::{ProviderAdmin, ProviderAdminError, ProviderAdminErrorKind},
        store::{
-            AccountGroupStore, AccountStore, AdminStoreError, AdminStoreErrorKind, AdminStorePorts,
-            AdminStoreResult, AuthStore, ClientKeyStore, ObservabilityStore, SettingsStore,
+            AccountGroupStore, AccountRuntimeStore, AccountStore, AdminAccountStorePorts,
+            AdminStoreError, AdminStoreErrorKind, AdminStorePorts, AdminStoreResult, AuthStore,
+            ClientKeyStore, ObservabilityStore, SettingsStore,
        },
        system::{
            SystemOperationError, SystemOperationErrorKind, SystemOperations,
@@ -64,7 +65,7 @@ use gateway_admin::{
 use gateway_api::admin::AdminSessionState;
 use gateway_core::{
    engine::{
-        credential::ProviderAccountId,
+        credential::{AccountStatusFacts, CredentialState, ProviderAccountId, QuotaState},
        probe::{AccountProbe, AccountProbeError, AccountProbeRequest, AccountProbeResult},
    },
    policy::{ClientApiKeyId, RateLimits},
@@ -77,6 +78,7 @@ mod account_groups;
 mod accounts;
 mod auth;
 mod client_keys;
+mod errors;
 mod observability;
 mod settings;
 mod system;
@@ -86,7 +88,7 @@ pub(super) struct AdminTestFixture {
    pub services: AdminServices,
    pub auth: Arc<MemoryAuthStore>,
    pub settings: Arc<MemorySettingsStore>,
-    pub usage_records: Arc<Mutex<Vec<UsageRecord>>>,
+    pub usage_records: Arc<Mutex<Vec<UsageListRecord>>>,
    pub usage_detail: Arc<Mutex<Option<UsageDetail>>>,
    pub diagnostics: Arc<Mutex<Vec<DiagnosticObservation>>>,
    pub ops_errors: Arc<Mutex<Vec<OpsError>>>,
@@ -120,8 +122,7 @@ impl AdminTestFixture {
            dashboard_summary_range: Arc::clone(&dashboard_summary_range),
        });
        let stores = AdminStorePorts::new(
-            unused.clone(),
-            account_groups.clone(),
+            AdminAccountStorePorts::new(unused.clone(), unused.clone(), account_groups.clone()),
            auth.clone(),
            client_keys.clone(),
            unused,
@@ -465,6 +466,45 @@ impl AccountGroupStore for MemoryAccountGroupStore {
        })
    }

+    async fn load_account_group_members(
+        &self,
+        group_ids: &[gateway_core::routing::AccountGroupId],
+    ) -> AdminStoreResult<Vec<AccountGroupMemberFact>> {
+        if !group_ids.iter().any(|id| id.as_str() == PRIMARY_GROUP_ID) {
+            return Ok(Vec::new());
+        }
+        Ok(vec![
+            AccountGroupMemberFact {
+                group_id: group_id(PRIMARY_GROUP_ID),
+                account_id: "acct_group_ready".to_owned(),
+                status: AccountStatusFacts {
+                    enabled: true,
+                    credential_state: CredentialState::Ready,
+                    access_token_expires_at: None,
+                    quota: QuotaState::default(),
+                    rate_limited_until: None,
+                    last_error_reason: None,
+                    last_error_message: None,
+                },
+                total_slots: 1,
+            },
+            AccountGroupMemberFact {
+                group_id: group_id(PRIMARY_GROUP_ID),
+                account_id: "acct_group_disabled".to_owned(),
+                status: AccountStatusFacts {
+                    enabled: false,
+                    credential_state: CredentialState::Ready,
+                    access_token_expires_at: None,
+                    quota: QuotaState::default(),
+                    rate_limited_until: None,
+                    last_error_reason: None,
+                    last_error_message: None,
+                },
+                total_slots: 1,
+            },
+        ])
+    }
+
    async fn create_account_group(
        &self,
        command: NewAccountGroup,
@@ -621,7 +661,7 @@ impl ClientKeyStore for MemoryClientKeyStore {
 }

 struct UnusedStore {
-    usage_records: Arc<Mutex<Vec<UsageRecord>>>,
+    usage_records: Arc<Mutex<Vec<UsageListRecord>>>,
    usage_detail: Arc<Mutex<Option<UsageDetail>>>,
    diagnostics: Arc<Mutex<Vec<DiagnosticObservation>>>,
    ops_errors: Arc<Mutex<Vec<OpsError>>>,
@@ -631,11 +671,19 @@ struct UnusedStore {

 #[async_trait]
 impl AccountStore for UnusedStore {
-    async fn list_accounts(&self, _: AccountListQuery) -> AdminStoreResult<AccountPage> {
+    async fn list_accounts(
+        &self,
+        _: AccountListQuery,
+        _: AccountRuntimeSnapshot,
+    ) -> AdminStoreResult<AccountPage> {
        Err(unavailable("account list"))
    }

-    async fn load_account(&self, _: &str) -> AdminStoreResult<Option<AccountPageItem>> {
+    async fn load_account(
+        &self,
+        _: &str,
+        _: AccountRuntimeSnapshot,
+    ) -> AdminStoreResult<Option<AccountPageItem>> {
        Err(unavailable("account"))
    }

@@ -751,6 +799,23 @@ impl AccountStore for UnusedStore {
    }
 }

+#[async_trait]
+impl AccountRuntimeStore for UnusedStore {
+    async fn active_rate_limits(&self) -> AdminStoreResult<AccountRuntimeSnapshot> {
+        Ok(AccountRuntimeSnapshot {
+            rate_limited_until: BTreeMap::new(),
+            in_flight: Some(BTreeMap::new()),
+        })
+    }
+
+    async fn account_runtime(&self, _: &[String]) -> AdminStoreResult<AccountRuntimeSnapshot> {
+        Ok(AccountRuntimeSnapshot {
+            rate_limited_until: BTreeMap::new(),
+            in_flight: Some(BTreeMap::new()),
+        })
+    }
+}
+
 #[async_trait]
 impl ObservabilityStore for UnusedStore {
    async fn dashboard_summary(
@@ -790,10 +855,10 @@ impl ObservabilityStore for UnusedStore {
        Err(unavailable("usage billing facts"))
    }

-    async fn list_usage_records(&self, _: UsageQuery) -> AdminStoreResult<UsagePage> {
+    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
        let items = self.usage_records.lock().expect("usage records").clone();
        Ok(UsagePage {
-            total: items.len() as u64,
+            total: query.include_total.then_some(items.len() as u64),
            items,
            next_cursor: None,
        })
@@ -820,10 +885,10 @@ impl ObservabilityStore for UnusedStore {
        Ok(self.diagnostics.lock().expect("diagnostics").clone())
    }

-    async fn list_ops_errors(&self, _: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage> {
+    async fn list_ops_errors(&self, query: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage> {
        let items = self.ops_errors.lock().expect("ops errors").clone();
        Ok(OpsErrorPage {
-            total: items.len() as u64,
+            total: query.include_total.then_some(items.len() as u64),
            items,
            next_cursor: None,
        })
@@ -1036,10 +1101,12 @@ fn capacity(used_slots: Option<u64>, total_slots: u64) -> AccountGroupCapacity {
    }
 }

-fn usage(today_usd: &str, total_usd: &str) -> AccountGroupUsage {
+fn usage(today_usd: &str, retained_total_usd: &str) -> AccountGroupUsage {
    AccountGroupUsage {
        today_usd: today_usd.parse::<DecimalAmount>().expect("today cost"),
-        total_usd: total_usd.parse::<DecimalAmount>().expect("total cost"),
+        retained_total_usd: retained_total_usd
+            .parse::<DecimalAmount>()
+            .expect("retained total cost"),
    }
 }

@@ -21,25 +21,28 @@ fn dashboard_query_should_reject_unknown_trend_kind() {
 #[test]
 fn usage_query_should_bound_page_size_and_cursor() {
    let query: UsageQuery = serde_json::from_value(json!({
-        "page": 2,
        "pageSize": 100,
        "cursor": "opaque"
    }))
    .unwrap();
-    assert_eq!(query.validate_page().unwrap(), (2, 100));
+    assert_eq!(query.validate_page_size().unwrap(), 100);
    assert!(query.validate_cursor().is_ok());
 }

 #[test]
-fn usage_query_should_reject_zero_page() {
-    let query: UsageQuery = serde_json::from_value(json!({"page": 0})).unwrap();
-    assert_eq!(query.validate_page().unwrap_err().field(), "page");
+fn usage_query_should_reject_removed_total_toggle() {
+    assert!(serde_json::from_value::<UsageQuery>(json!({"includeTotal": true})).is_err());
+}
+
+#[test]
+fn usage_query_should_reject_removed_offset_page_contract() {
+    assert!(serde_json::from_value::<UsageQuery>(json!({"page": 1})).is_err());
 }

 #[test]
 fn ops_query_should_reject_page_size_above_terminal_limit() {
    let query: OpsQuery = serde_json::from_value(json!({"pageSize": 101})).unwrap();
-    assert_eq!(query.validate_page().unwrap_err().field(), "pageSize");
+    assert_eq!(query.validate_page_size().unwrap_err().field(), "pageSize");
 }

 #[test]
@@ -2,7 +2,6 @@

 use chrono::{TimeZone, Utc};
 use gateway_admin::model::observability::DesktopReleaseStatus;
-use gateway_api::admin::PageMeta;
 use gateway_api::admin::observability::{
    BillingView, CostCoverageView, CursorWire, DashboardAccountRequestBucketView,
    DashboardAccountUsageView, DashboardDesktopReleaseStatusView, DashboardWireAttributeView,
@@ -15,11 +14,11 @@ use serde_json::json;
 fn usage_page_should_keep_terminal_camel_case_shape() {
    let data = PageData {
        items: vec![json!({"id": "request_1"})],
-        page: PageMeta::new(1, 50, 1, 1),
+        total: Some(1),
        next_cursor: Some("cursor".to_owned()),
    };
    let value = serde_json::to_value(data).unwrap();
-    assert_eq!(value["page"]["pageSize"], 50);
+    assert_eq!(value["total"], 1);
    assert_eq!(value["nextCursor"], "cursor");
 }

@@ -110,6 +109,13 @@ fn trend_wire_should_serialize_kind_and_values_without_store_types() {
            min_latency_value: Some(1),
            success_rate: "100.0%".to_owned(),
            success_rate_value: Some(100.0),
+            first_token_p50_ms: Some(1.0),
+            first_token_p95_ms: Some(2.0),
+            latency_p95_ms: Some(3.0),
+            output_throughput_p50: Some(50),
+            admission_decision_p95_ms: Some(4.0),
+            account_selection_wait_p95_ms: Some(5.0),
+            capacity_utilization: Some(0.7),
        }],
        summary: vec![TrendSummaryView {
            label: "输入".to_owned(),
@@ -202,7 +208,7 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
    };
    use chrono::{Duration, Utc};
    use gateway_admin::model::observability::{
-        AccountPoolMetrics, AttemptMetrics, DashboardObservation, RequestMetrics, TimeRange,
+        AccountPoolMetrics, DashboardObservation, TimeRange,
    };
    use gateway_api::admin::observability;
    use tower::ServiceExt as _;
@@ -217,13 +223,11 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
        .lock()
        .expect("dashboard observation") = Some(DashboardObservation {
        range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
-        requests: RequestMetrics::default(),
-        attempts: AttemptMetrics::default(),
        totals: Default::default(),
        provider_accounts: AccountPoolMetrics {
-            total: 807,
-            normal: 15,
-            quota_exhausted: 785,
+            total: 1002,
+            normal: 943,
+            quota_exhausted: 52,
            rate_limited: 0,
            disabled: 3,
            error: 4,
@@ -259,9 +263,21 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
            &value["data"]["cards"]["credentials"]["unavailableValue"],
        ),
        (
-            &serde_json::json!(807),
-            &serde_json::json!(15),
-            &serde_json::json!(792)
+            &serde_json::json!(1002),
+            &serde_json::json!(943),
+            &serde_json::json!(59)
+        ),
+    );
+    assert_eq!(
+        (
+            &value["data"]["cards"]["credentials"]["total"],
+            &value["data"]["cards"]["credentials"]["available"],
+            &value["data"]["cards"]["credentials"]["unavailable"],
+        ),
+        (
+            &serde_json::json!("1002"),
+            &serde_json::json!("943"),
+            &serde_json::json!("59")
        ),
    );
 }
@@ -274,8 +290,7 @@ async fn dashboard_summary_should_use_lifetime_totals_for_card_footers() {
    };
    use chrono::{Duration, Utc};
    use gateway_admin::model::observability::{
-        AccountPoolMetrics, AttemptMetrics, DashboardObservation, DashboardTotals, RequestMetrics,
-        TimeRange,
+        AccountPoolMetrics, DashboardObservation, DashboardTotals, TimeRange,
    };
    use gateway_api::admin::observability;
    use tower::ServiceExt as _;
@@ -285,20 +300,11 @@ async fn dashboard_summary_should_use_lifetime_totals_for_card_footers() {
    let fixture = AdminTestFixture::new().await;
    fixture.auth.insert_session("valid-session");
    let now = Utc::now();
-    let range_requests = RequestMetrics {
-        request_count: 2,
-        input_tokens: 8,
-        cached_tokens: 2,
-        total_tokens: 12,
-        ..RequestMetrics::default()
-    };
    *fixture
        .dashboard_observation
        .lock()
        .expect("dashboard observation") = Some(DashboardObservation {
        range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
-        requests: range_requests,
-        attempts: AttemptMetrics::default(),
        totals: DashboardTotals {
            request_count: 42,
            input_tokens: 800,
@@ -355,8 +361,7 @@ async fn dashboard_summary_should_default_to_current_china_day() {
    };
    use chrono::{Duration, Utc};
    use gateway_admin::model::observability::{
-        AccountPoolMetrics, AttemptMetrics, DashboardObservation, RequestMetrics, TimeRange,
-        china_day_start,
+        AccountPoolMetrics, DashboardObservation, TimeRange, china_day_start,
    };
    use gateway_api::admin::observability;
    use tower::ServiceExt as _;
@@ -371,8 +376,6 @@ async fn dashboard_summary_should_default_to_current_china_day() {
        .lock()
        .expect("dashboard observation") = Some(DashboardObservation {
        range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
-        requests: RequestMetrics::default(),
-        attempts: AttemptMetrics::default(),
        totals: Default::default(),
        provider_accounts: AccountPoolMetrics::default(),
        trend: Vec::new(),
@@ -624,6 +627,9 @@ async fn diagnostics_should_keep_stable_key_and_display_name_contract() {
            total_tokens: 200,
            average_latency_ms: Some(100),
            latency_p95_ms: Some(3800),
+            first_token_p95_ms: Some(1200),
+            non_completion_count: 0,
+            retry_count: 0,
            cost_coverage: CostCoverage::default(),
            costs: Vec::new(),
        });
@@ -727,6 +733,10 @@ fn usage_record_with_account(
        first_token_ms: None,
        provider_processing_ms: None,
        latency_ms: None,
+        admission_decision_ms: None,
+        account_selection_wait_ms: None,
+        capacity_used_slots: None,
+        capacity_total_slots: None,
        client_ip: None,
        user_agent: None,
        reasoning_effort: None,
@@ -772,7 +782,7 @@ async fn usage_route_should_forward_a_bounded_unknown_outcome_filter() {
 }

 #[tokio::test]
-async fn usage_route_should_expose_image_and_websocket_facts() {
+async fn usage_route_should_expose_table_facts_without_detail_payload() {
    use std::str::FromStr as _;

    use axum::{
@@ -781,8 +791,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
    };
    use chrono::Utc;
    use gateway_admin::model::observability::{
-        CalculatedBillingBreakdown, CurrencyCost, DecimalAmount, RequestOutcome, UsageBilling,
-        UsageRecord,
+        CalculatedBillingBreakdown, CurrencyCost, DecimalAmount, UsageBilling, UsageListRecord,
    };
    use gateway_api::admin::observability;
    use tower::ServiceExt as _;
@@ -799,17 +808,10 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
        .usage_records
        .lock()
        .expect("usage records")
-        .push(UsageRecord {
+        .push(UsageListRecord {
            id: "request_endpoint".to_owned(),
-            client_api_key_ref: "key_endpoint".to_owned(),
-            config_revision: 1,
-            routing_scope: "groups".to_owned(),
-            routing_group_refs: vec!["grp_usage".to_owned()],
-            routing_group_names_snapshot: vec!["Usage group".to_owned()],
-            protocol: "openai".to_owned(),
-            operation: "generate".to_owned(),
            endpoint: "/v1/responses".to_owned(),
-            client_transport: "http_sse".to_owned(),
+            client_transport: "websocket".to_owned(),
            requested_model_id: Some("grok-4.5".to_owned()),
            provider_kind: Some("xai".to_owned()),
            provider_account_ref: Some("acct_snapshot".to_owned()),
@@ -818,30 +820,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
            provider_account_authentication_kind: Some("oauth".to_owned()),
            upstream_model_id: Some("grok-4.5".to_owned()),
            upstream_transport: Some("http_sse".to_owned()),
-            http_version: Some("h2".to_owned()),
-            websocket_pool: Some("reuse".to_owned()),
-            service_tier: Some("priority".to_owned()),
-            provider_metadata_json: Some(
-                serde_json::json!({
-                    "effectiveModel": "grok-4.5",
-                    "requestSummary": {"inputItemsCount": 2},
-                    "transport": "must-not-overwrite-core",
-                })
-                .to_string(),
-            ),
-            attempt_count: 1,
-            upstream_send_state: "sent".to_owned(),
-            downstream_committed_at: None,
-            outcome: RequestOutcome::Succeeded,
-            client_status_code: Some(200),
-            upstream_status_code: Some(200),
-            client_response_id: Some("resp_usage_metadata".to_owned()),
-            upstream_request_id: Some("upstream_usage_metadata".to_owned()),
-            upstream_response_id: None,
-            error_kind: None,
-            provider_error_code: None,
-            error_message: None,
-            retry_after_ms: None,
+            service_tier: Some("default".to_owned()),
            input_tokens: Some(1),
            output_tokens: Some(1),
            cached_tokens: Some(0),
@@ -865,31 +844,30 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
                    output_price_per_million: usd("60.0000"),
                    cache_read_price_per_million: usd("1.0000"),
                    cache_write_price_per_million: usd("12.5000"),
-                    service_tier: Some("priority".to_owned()),
+                    service_tier: Some("default".to_owned()),
                    multiplier_percent: 100,
                },
            ))),
-            transport_decision_wait_ms: Some(7),
-            connect_ms: Some(11),
-            headers_ms: Some(13),
+            transport_decision_wait_ms: Some(4),
+            connect_ms: Some(5),
+            headers_ms: Some(7),
            first_event_ms: Some(17),
-            first_reasoning_ms: Some(19),
-            first_text_ms: Some(23),
-            first_token_ms: Some(19),
-            provider_processing_ms: Some(29),
+            first_reasoning_ms: Some(18),
+            first_text_ms: Some(19),
+            first_token_ms: Some(20),
+            provider_processing_ms: Some(21),
            latency_ms: Some(31),
-            client_ip: Some("127.0.0.1".to_owned()),
-            user_agent: Some("usage-metadata-test".to_owned()),
+            admission_decision_ms: Some(1),
+            account_selection_wait_ms: Some(2),
+            capacity_used_slots: Some(3),
+            capacity_total_slots: Some(8),
+            client_ip: Some("192.0.2.10".to_owned()),
+            user_agent: Some("codex-cli/1.0".to_owned()),
            reasoning_effort: Some("max".to_owned()),
            reasoning_preset: Some("ultra".to_owned()),
-            request_kind: Some("review".to_owned()),
            subagent_kind: Some("worker".to_owned()),
            compact: true,
-            image_generation_requested: true,
-            image_generation_succeeded: Some(true),
            started_at: Utc::now(),
-            deadline_at: Utc::now(),
-            completed_at: Some(Utc::now()),
        });
    let response = observability::router::<AdminTestState>()
        .with_state(fixture.state())
@@ -921,13 +899,14 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
        value["data"]["items"][0]["billing"]["cacheWritePriceDisplay"],
        "$12.5 / 1M Token"
    );
+    assert_eq!(
+        value["data"]["items"][0]["billing"]["serviceTierDisplay"],
+        "Standard"
+    );

    assert_eq!(
        serde_json::json!({
            "route": value["data"]["items"][0]["route"],
-            "routingScope": value["data"]["items"][0]["routingScope"],
-            "routingGroupRefs": value["data"]["items"][0]["routingGroupRefs"],
-            "routingGroupNamesSnapshot": value["data"]["items"][0]["routingGroupNamesSnapshot"],
            "serviceTier": value["data"]["items"][0]["serviceTier"],
            "accountId": value["data"]["items"][0]["accountId"],
            "accountName": value["data"]["items"][0]["accountName"],
@@ -935,59 +914,56 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
            "authenticationKind": value["data"]["items"][0]["authenticationKind"],
            "imageInputTokens": value["data"]["items"][0]["tokenDetails"]["imageInputTokens"],
            "imageOutputTokens": value["data"]["items"][0]["tokenDetails"]["imageOutputTokens"],
-            "websocketPool": value["data"]["items"][0]["websocketPool"],
-            "imageGenerationRequested": value["data"]["items"][0]["imageGenerationRequested"],
-            "imageGenerationSucceeded": value["data"]["items"][0]["imageGenerationSucceeded"],
            "requestedModel": value["data"]["items"][0]["requestedModel"],
            "upstreamModel": value["data"]["items"][0]["upstreamModel"],
-            "clientIp": value["data"]["items"][0]["clientIp"],
-            "userAgent": value["data"]["items"][0]["userAgent"],
            "reasoningEffort": value["data"]["items"][0]["reasoningEffort"],
            "reasoningPreset": value["data"]["items"][0]["reasoningPreset"],
-            "requestKind": value["data"]["items"][0]["requestKind"],
            "subagentKind": value["data"]["items"][0]["subagentKind"],
            "compact": value["data"]["items"][0]["compact"],
-            "transport": value["data"]["items"][0]["transport"],
-            "transportDecisionWaitMs": value["data"]["items"][0]["latencyDetails"]["transportDecisionWaitMs"],
-            "wsConnectMs": value["data"]["items"][0]["latencyDetails"]["wsConnectMs"],
-            "firstReasoningMs": value["data"]["items"][0]["latencyDetails"]["firstReasoningMs"],
-            "firstTextMs": value["data"]["items"][0]["latencyDetails"]["firstTextMs"],
-            "firstTokenMs": value["data"]["items"][0]["latencyDetails"]["firstTokenMs"],
-            "effectiveModel": value["data"]["items"][0]["metadata"]["effectiveModel"],
-            "requestSummary": value["data"]["items"][0]["metadata"]["requestSummary"],
+            "clientTransport": value["data"]["items"][0]["clientTransport"],
+            "upstreamTransport": value["data"]["items"][0]["upstreamTransport"],
+            "latencyDetails": value["data"]["items"][0]["latencyDetails"],
+            "firstTokenLatencyMs": value["data"]["items"][0]["firstTokenLatencyMs"],
+            "latencyMs": value["data"]["items"][0]["latencyMs"],
+            "clientIp": value["data"]["items"][0]["clientIp"],
+            "userAgent": value["data"]["items"][0]["userAgent"],
        }),
        serde_json::json!({
            "route": "/v1/responses",
-            "routingScope": "groups",
-            "routingGroupRefs": ["grp_usage"],
-            "routingGroupNamesSnapshot": ["Usage group"],
-            "serviceTier": "priority",
+            "serviceTier": "default",
            "accountId": "acct_snapshot",
            "accountName": "Snapshot Alpha",
            "accountEmail": "alpha@example.invalid",
            "authenticationKind": "oauth",
            "imageInputTokens": 31,
            "imageOutputTokens": 9,
-            "websocketPool": {"kind": "reuse"},
-            "imageGenerationRequested": true,
-            "imageGenerationSucceeded": true,
            "requestedModel": "grok-4.5",
            "upstreamModel": "grok-4.5",
-            "clientIp": "127.0.0.1",
-            "userAgent": "usage-metadata-test",
            "reasoningEffort": "max",
            "reasoningPreset": "ultra",
-            "requestKind": "review",
            "subagentKind": "worker",
            "compact": true,
-            "transport": "http_sse",
-            "transportDecisionWaitMs": 7,
-            "wsConnectMs": 11,
-            "firstReasoningMs": 19,
-            "firstTextMs": 23,
-            "firstTokenMs": 19,
-            "effectiveModel": "grok-4.5",
-            "requestSummary": {"inputItemsCount": 2},
+            "clientTransport": "websocket",
+            "upstreamTransport": "http_sse",
+            "latencyDetails": {
+                "admissionDecisionMs": 1,
+                "accountSelectionWaitMs": 2,
+                "capacityUsedSlots": 3,
+                "capacityTotalSlots": 8,
+                "transportDecisionWaitMs": 4,
+                "wsConnectMs": 5,
+                "upstreamHeadersMs": 7,
+                "firstEventMs": 17,
+                "firstReasoningMs": 18,
+                "firstTextMs": 19,
+                "firstTokenMs": 20,
+                "openaiProcessingMs": 21,
+            },
+            "firstTokenLatencyMs": 20,
+            "latencyMs": 31,
+            "clientIp": "192.0.2.10",
+            "userAgent": "codex-cli/1.0",
        })
    );
+    assert!(value["data"]["items"][0].get("metadata").is_none());
 }
@@ -40,6 +40,7 @@ mod error {
            AdminErrorCode::INTERNAL,
            AdminErrorCode::USAGE_RECORD_ACCOUNTS,
            AdminErrorCode::BAD_GATEWAY,
+            AdminErrorCode::UPSTREAM_RESULT_UNKNOWN,
            AdminErrorCode::SERVICE_UNAVAILABLE,
        ]
        .map(AdminErrorCode::value);
@@ -48,7 +49,7 @@ mod error {
            actual,
            [
                40000, 40001, 40002, 40003, 40101, 40102, 40103, 40401, 40901, 42901, 50000, 50001,
-                50002, 50201, 50301,
+                50002, 50201, 50202, 50301,
            ]
        );
    }
@@ -57,7 +58,7 @@ mod error {
    fn invalid_admin_api_key_should_keep_code_and_null_data() {
        let value = serde_json::to_value(AdminErrorBody::new(
            AdminErrorCode::INVALID_API_KEY,
-            "Invalid admin API key",
+            "管理 API Key 无效",
        ))
        .expect("admin error body should serialize");

@@ -65,7 +66,7 @@ mod error {
            value,
            json!({
                "code": 40103,
-                "message": "Invalid admin API key",
+                "message": "管理 API Key 无效",
                "data": null
            })
        );
@@ -158,7 +159,7 @@ mod response {
                StatusCode::UNAUTHORIZED,
                json!({
                    "code": 40103,
-                    "message": "Invalid admin API key",
+                    "message": "管理 API Key 无效",
                    "data": null
                })
            )
@@ -199,17 +200,18 @@ mod response {
                40401,
            ),
            (
-                AdminError::internal("internal"),
+                AdminError::internal(),
                StatusCode::INTERNAL_SERVER_ERROR,
                50001,
            ),
+            (AdminError::bad_gateway(), StatusCode::BAD_GATEWAY, 50201),
            (
-                AdminError::bad_gateway("upstream"),
+                AdminError::upstream_result_unknown(),
                StatusCode::BAD_GATEWAY,
-                50201,
+                50202,
            ),
            (
-                AdminError::service_unavailable("storage"),
+                AdminError::service_unavailable(),
                StatusCode::SERVICE_UNAVAILABLE,
                50301,
            ),
@@ -38,6 +38,7 @@ fn source_tree_should_match_frozen_machine_manifest() {
        "src/admin/auth.rs",
        "src/admin/backups.rs",
        "src/admin/client_keys.rs",
+        "src/admin/extract.rs",
        "src/admin/mod.rs",
        "src/admin/observability/mod.rs",
        "src/admin/observability/presenter.rs",
@@ -61,7 +62,10 @@ fn source_tree_should_match_frozen_machine_manifest() {
        "src/openai/responses/mod.rs",
        "src/openai/responses/request.rs",
        "src/openai/responses/response.rs",
-        "src/openai/responses/websocket.rs",
+        "src/openai/responses/websocket/connection.rs",
+        "src/openai/responses/websocket/forward.rs",
+        "src/openai/responses/websocket/mod.rs",
+        "src/openai/responses/websocket/protocol.rs",
        "src/openai/router.rs",
        "src/openai/service.rs",
    ];
@@ -80,6 +84,7 @@ fn test_tree_should_match_frozen_rust_mirror() {
        "tests/admin/accounts.rs",
        "tests/admin/auth.rs",
        "tests/admin/client_keys.rs",
+        "tests/admin/errors.rs",
        "tests/admin/mod.rs",
        "tests/admin/observability/mod.rs",
        "tests/admin/observability/query.rs",
@@ -97,7 +102,9 @@ fn test_tree_should_match_frozen_rust_mirror() {
        "tests/openai/models.rs",
        "tests/openai/responses/http.rs",
        "tests/openai/responses/mod.rs",
-        "tests/openai/responses/websocket.rs",
+        "tests/openai/responses/websocket/connection.rs",
+        "tests/openai/responses/websocket/mod.rs",
+        "tests/openai/responses/websocket/protocol.rs",
        "tests/openai/router.rs",
    ];
    expected.sort_unstable();
@@ -105,14 +112,6 @@ fn test_tree_should_match_frozen_rust_mirror() {
    assert_eq!(actual, expected);
 }

-#[test]
-fn frozen_openai_fixture_set_should_be_complete() {
-    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/openai/responses/fixtures");
-    let files = all_files(&root);
-
-    assert_eq!(files.len(), 69);
-}
-
 #[test]
 fn admin_routes_should_use_only_get_post_and_static_paths() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("src/admin");
@@ -1,26 +0,0 @@
-{
-  "type": "response.create",
-  "model": "gpt-5.5",
-  "instructions": "answer briefly",
-  "input": [
-    {
-      "type": "reasoning",
-      "id": "rs_implicit_resume",
-      "status": "completed",
-      "summary": [
-        {
-          "type": "summary_text",
-          "text": "cached reasoning"
-        }
-      ],
-      "encrypted_content": "enc_reasoning_replay"
-    },
-    {
-      "role": "user",
-      "content": "continue"
-    }
-  ],
-  "store": false,
-  "stream": false,
-  "previous_response_id": "resp_implicit_resume_first"
-}
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"auth fallback hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_after_401","object":"response","status":"completed","usage":{"input_tokens":3,"output_tokens":1}}}
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"quota fallback hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_after_402","object":"response","status":"completed","usage":{"input_tokens":6,"output_tokens":2}}}
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"banned fallback hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_after_403","object":"response","status":"completed","usage":{"input_tokens":5,"output_tokens":1}}}
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"retry hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_after_5xx_retry","object":"response","status":"completed","usage":{"input_tokens":4,"output_tokens":2}}}
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"cloudflare fallback hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_after_cloudflare","object":"response","status":"completed","usage":{"input_tokens":5,"output_tokens":2}}}
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"model fallback hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_after_model_unsupported","object":"response","status":"completed","usage":{"input_tokens":4,"output_tokens":2}}}
@@ -1,6 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"hello"}
-
-event: response.completed
-data: {"response":{"usage":{"input_tokens":2,"output_tokens":3}}}
-
@@ -1,6 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_1","usage":{"input_tokens":2,"output_tokens":3}}}
-
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"type":"response.output_text.delta","delta":"hello"}
-
-event: response.incomplete
-data: {"type":"response.incomplete","response":{"id":"resp_incomplete","object":"response","status":"incomplete","incomplete_details":{"reason":"max_output_tokens"},"usage":{"input_tokens":2,"output_tokens":3},"output":[{"type":"message","status":"incomplete","role":"assistant","content":[{"type":"output_text","text":"hello","annotations":[]}]}],"output_text":"hello"}}
@@ -1,9 +0,0 @@
-event: response.reasoning_summary_text.delta
-data: {"delta":"I considered the context."}
-
-event: response.output_text.delta
-data: {"delta":"hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_1","output_text":"hello","usage":{"input_tokens":9,"output_tokens":3}}}
-
@@ -1,3 +0,0 @@
-event: response.completed
-data: {}
-
@@ -1,5 +0,0 @@
-event: response.completed
-data: {}
-
-data: [DONE]
-
@@ -1,3 +0,0 @@
-event: response.completed
-data: {"response":{"id":"resp_1","usage":{"input_tokens":12,"output_tokens":5,"input_tokens_details":{"cached_tokens":3}},"tool_usage":{"image_gen":{"input_tokens":31,"output_tokens":9}}}}
-
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"image done"}
-
-event: response.completed
-data: {"response":{"id":"resp_image","object":"response","status":"completed","output_text":"image done","usage":{"input_tokens":7,"output_tokens":4,"input_tokens_details":{"cached_tokens":2}},"tool_usage":{"image_gen":{"input_tokens":31,"output_tokens":9}}}}
@@ -1,3 +0,0 @@
-event: response.completed
-data: {"response":{"id":"resp_order","status":"completed","usage":{"input_tokens":1,"output_tokens":1}}}
-
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"usage hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_usage","object":"response","status":"completed","output_text":"usage hello","usage":{"input_tokens":7,"output_tokens":4,"input_tokens_details":{"cached_tokens":2}}}}
@@ -1,3 +0,0 @@
-event: response.completed
-data: {"response":{"id":"resp_1","usage":{"input_tokens":2,"output_tokens":3,"input_tokens_details":{"cached_tokens":1}}}}
-
@@ -1,6 +0,0 @@
-event: response.created
-data: {"response":{"id":"resp_1","usage":{"input_tokens":3,"output_tokens":5,"input_tokens_details":{"cached_tokens":1}}}}
-
-event: response.completed
-data: {"response":{"id":"resp_1","usage":{"input_tokens":3,"output_tokens":5,"input_tokens_details":{"cached_tokens":1}}}}
-
@@ -1,2 +0,0 @@
-data: {"type":"response.output_text.delta","delta":"hello"}
-
@@ -1,5 +0,0 @@
-event: response.output_item.done
-data: {"item":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"from done item"}]}}
-
-event: response.completed
-data: {"response":{"id":"resp_item","object":"response","status":"completed","output":[],"usage":{"input_tokens":2,"output_tokens":3}}}
@@ -1,2 +0,0 @@
-data: [DONE]
-
@@ -1,2 +0,0 @@
-event: response.completed
-data: {"response":{"id":"resp_empty","object":"response","status":"completed"}}
@@ -1,3 +0,0 @@
-event: response.output_text.delta
-data: {"delta":""}
-
@@ -1,2 +0,0 @@
-event: response.failed
-data: {"response":{"id":"resp_sse_auth_failed","object":"response","status":"failed","error":{"code":"token_invalid","message":"token revoked"}}}
@@ -1,3 +0,0 @@
-event: response.failed
-data: {"type":"response.failed","response":{"id":"resp_cyber_policy","object":"response","status":"failed","error":{"code":"cyber_policy","message":"This request has been flagged for possible cybersecurity risk."}}}
-
@@ -1,2 +0,0 @@
-event: response.failed
-data: {"response":{"id":"resp_model_unsupported_failed","object":"response","status":"failed","error":{"code":"model_not_supported","message":"Model gpt-5.5 is not supported on this account plan"}}}
@@ -1,2 +0,0 @@
-event: response.failed
-data: {"response":{"id":"resp_sse_quota_failed","object":"response","status":"failed","error":{"code":"quota_exceeded","message":"quota exhausted"}}}
@@ -1,2 +0,0 @@
-event: response.failed
-data: {"response":{"id":"resp_server_overloaded","object":"response","status":"failed","error":{"code":"server_is_overloaded","message":"upstream is temporarily overloaded"}}}
@@ -1,3 +0,0 @@
-event: response.function_call_arguments.delta
-data: {"delta":"{\"path\""}
-
@@ -1,2 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"hello"}
@@ -1,3 +0,0 @@
-event: response.completed
-data: {"response":{"id":"resp_live_stream","object":"response","status":"completed","usage":{"input_tokens":3,"output_tokens":4}}}
-
@@ -1,2 +0,0 @@
-event: response.failed
-data: {"response":{"id":"resp_live_auth_failed","object":"response","status":"failed","error":{"code":"token_invalid","message":"live token expired"}}}
@@ -1,2 +0,0 @@
-event: response.failed
-data: {"response":{"id":"resp_live_quota_failed","object":"response","status":"failed","error":{"code":"quota_exceeded","message":"live quota exhausted"}}}
@@ -1,3 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"live stream hello"}
-
@@ -1,9 +0,0 @@
-event: codex.rate_limits
-data: {"type":"codex.rate_limits","rate_limits":{"primary":{"used_percent":42}}}
-
-event: response.metadata
-data: {"type":"response.metadata","x-codex-turn-state":"state"}
-
-event: response.in_progress
-data: {"type":"response.in_progress","response":{"id":"resp_1","status":"in_progress"}}
-
@@ -1,8 +0,0 @@
-event: response.created
-data: {"type":"response.created","response":{"id":"resp_http_cyber_policy","status":"in_progress"}}
-
-event: response.output_text.delta
-data: {"type":"response.output_text.delta","response_id":"resp_http_cyber_policy","output_index":0,"content_index":0,"delta":"partial output before HTTP SSE policy failure"}
-
-event: response.failed
-data: {"type":"response.failed","response":{"id":"resp_http_cyber_policy","status":"failed","error":{"code":"cyber_policy","message":"This request has been flagged for possible cybersecurity risk."}}}
@@ -1,8 +0,0 @@
-event: response.created
-data: {"type":"response.created","response":{"id":"resp_http_output_then_missing","status":"in_progress"}}
-
-event: response.output_text.delta
-data: {"type":"response.output_text.delta","response_id":"resp_http_output_then_missing","output_index":0,"content_index":0,"delta":"visible HTTP SSE output"}
-
-event: response.failed
-data: {"type":"response.failed","response":{"id":"resp_http_output_then_missing","status":"failed","error":{"code":"previous_response_not_found","message":"Previous response was not found"}}}
@@ -1,6 +0,0 @@
-event: response.created
-data: {"response":{"id":"resp_clean_close"}}
-
-event: response.output_text.delta
-data: {"delta":"partial before clean close"}
-
@@ -1,3 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"partial before logged disconnect"}
-
@@ -1,3 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"partial before transport failure"}
-
@@ -1,3 +0,0 @@
-event: response.reasoning_summary_text.delta
-data: {"delta":"thinking"}
-
@@ -1,3 +0,0 @@
-event: response.created
-data: {"type":"response.created","response":{"id":"resp_1","status":"in_progress"}}
-
@@ -1,5 +0,0 @@
-event: response.output_text.delta
-data: {"delta":"auth stream fallback hello"}
-
-event: response.completed
-data: {"response":{"id":"resp_stream_after_401","object":"response","status":"completed","usage":{"input_tokens":4,"output_tokens":2}}}
--- a/Show More
+++ b/Show More
				`@@ -1,2 +0,0 @@`
				`data: {"type":"response.output_text.delta","delta":"hello"}`